From ef367a7d10c0a621c50dedf7a8211890f6763667 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 11 May 2024 06:24:20 -0500 Subject: [PATCH 0001/1058] move branch to prd --- argocd/templates/InternalProxy.yaml | 2 +- argocd/templates/argocd.yaml | 2 +- argocd/templates/authentik.yaml | 2 +- argocd/templates/bitwarden.yaml | 2 +- argocd/templates/cert-manager.yaml | 2 +- argocd/templates/crossplane.yml | 2 +- argocd/templates/durpapi.yaml | 2 +- argocd/templates/durpot.yaml | 2 +- argocd/templates/external-dns.yaml | 2 +- argocd/templates/external-secrets.yaml | 2 +- argocd/templates/gatekeeper.yaml | 2 +- argocd/templates/gitlab-runner.yaml | 2 +- argocd/templates/heimdall.yaml | 2 +- argocd/templates/krakend.yaml | 2 +- argocd/templates/kube-prometheus-stack.yaml | 2 +- argocd/templates/kubeclarity.yaml | 2 +- argocd/templates/littlelink.yaml | 2 +- argocd/templates/longhorn.yaml | 2 +- argocd/templates/nfs-client.yaml | 2 +- argocd/templates/open-webui.yaml | 2 +- argocd/templates/traefik.yaml | 2 +- argocd/templates/uptimekuma.yaml | 2 +- argocd/templates/vault.yaml | 2 +- 23 files changed, 23 insertions(+), 23 deletions(-) diff --git a/argocd/templates/InternalProxy.yaml b/argocd/templates/InternalProxy.yaml index 1769a19..da6a5ae 100644 --- a/argocd/templates/InternalProxy.yaml +++ b/argocd/templates/InternalProxy.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: internalproxy directory: recurse: true diff --git a/argocd/templates/argocd.yaml b/argocd/templates/argocd.yaml index d8f0fd3..ba2c019 100644 --- a/argocd/templates/argocd.yaml +++ b/argocd/templates/argocd.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: argocd destination: namespace: argocd diff --git a/argocd/templates/authentik.yaml b/argocd/templates/authentik.yaml index 735fa1a..e0fa9e6 100644 --- a/argocd/templates/authentik.yaml +++ b/argocd/templates/authentik.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: authentik destination: namespace: authentik diff --git a/argocd/templates/bitwarden.yaml b/argocd/templates/bitwarden.yaml index 6aad52f..e633437 100644 --- a/argocd/templates/bitwarden.yaml +++ b/argocd/templates/bitwarden.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: bitwarden directory: recurse: true diff --git a/argocd/templates/cert-manager.yaml b/argocd/templates/cert-manager.yaml index 1eb8fe2..2e959f8 100644 --- a/argocd/templates/cert-manager.yaml +++ b/argocd/templates/cert-manager.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: cert-manager destination: namespace: cert-manager diff --git a/argocd/templates/crossplane.yml b/argocd/templates/crossplane.yml index e079c78..a109f1c 100644 --- a/argocd/templates/crossplane.yml +++ b/argocd/templates/crossplane.yml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: crossplane destination: namespace: crossplane diff --git a/argocd/templates/durpapi.yaml b/argocd/templates/durpapi.yaml index 53c2db6..e8f0eaa 100644 --- a/argocd/templates/durpapi.yaml +++ b/argocd/templates/durpapi.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: durpapi destination: namespace: durpapi diff --git a/argocd/templates/durpot.yaml b/argocd/templates/durpot.yaml index 1bfcd37..22001b3 100644 --- a/argocd/templates/durpot.yaml +++ b/argocd/templates/durpot.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: durpot destination: namespace: durpot diff --git a/argocd/templates/external-dns.yaml b/argocd/templates/external-dns.yaml index ba05f2c..77e9a78 100644 --- a/argocd/templates/external-dns.yaml +++ b/argocd/templates/external-dns.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: external-dns destination: namespace: external-dns diff --git a/argocd/templates/external-secrets.yaml b/argocd/templates/external-secrets.yaml index cf8a595..aa8483f 100644 --- a/argocd/templates/external-secrets.yaml +++ b/argocd/templates/external-secrets.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: external-secrets destination: namespace: external-secrets diff --git a/argocd/templates/gatekeeper.yaml b/argocd/templates/gatekeeper.yaml index 5c60c12..edbf240 100644 --- a/argocd/templates/gatekeeper.yaml +++ b/argocd/templates/gatekeeper.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: gatekeeper destination: namespace: gatekeeper diff --git a/argocd/templates/gitlab-runner.yaml b/argocd/templates/gitlab-runner.yaml index c5539d7..08494ba 100644 --- a/argocd/templates/gitlab-runner.yaml +++ b/argocd/templates/gitlab-runner.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: gitlab-runner destination: namespace: gitlab-runner diff --git a/argocd/templates/heimdall.yaml b/argocd/templates/heimdall.yaml index d695e34..d668561 100644 --- a/argocd/templates/heimdall.yaml +++ b/argocd/templates/heimdall.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: heimdall destination: namespace: heimdall diff --git a/argocd/templates/krakend.yaml b/argocd/templates/krakend.yaml index 68a57d1..6c86d0a 100644 --- a/argocd/templates/krakend.yaml +++ b/argocd/templates/krakend.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: krakend destination: namespace: krakend diff --git a/argocd/templates/kube-prometheus-stack.yaml b/argocd/templates/kube-prometheus-stack.yaml index 02f8261..4a99e59 100644 --- a/argocd/templates/kube-prometheus-stack.yaml +++ b/argocd/templates/kube-prometheus-stack.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: kube-prometheus-stack destination: namespace: kube-prometheus-stack diff --git a/argocd/templates/kubeclarity.yaml b/argocd/templates/kubeclarity.yaml index c812528..31a3018 100644 --- a/argocd/templates/kubeclarity.yaml +++ b/argocd/templates/kubeclarity.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: kubeclarity destination: namespace: kubeclarity diff --git a/argocd/templates/littlelink.yaml b/argocd/templates/littlelink.yaml index 99b08fe..f18eadf 100644 --- a/argocd/templates/littlelink.yaml +++ b/argocd/templates/littlelink.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: littlelink directory: recurse: true diff --git a/argocd/templates/longhorn.yaml b/argocd/templates/longhorn.yaml index 017da6f..3794786 100644 --- a/argocd/templates/longhorn.yaml +++ b/argocd/templates/longhorn.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: longhorn destination: namespace: longhorn-system diff --git a/argocd/templates/nfs-client.yaml b/argocd/templates/nfs-client.yaml index e374885..f7717c9 100644 --- a/argocd/templates/nfs-client.yaml +++ b/argocd/templates/nfs-client.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: nfs-client directory: recurse: true diff --git a/argocd/templates/open-webui.yaml b/argocd/templates/open-webui.yaml index a2b25fa..9bb8103 100644 --- a/argocd/templates/open-webui.yaml +++ b/argocd/templates/open-webui.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: open-webui destination: namespace: open-webui diff --git a/argocd/templates/traefik.yaml b/argocd/templates/traefik.yaml index 3995a9f..959cc20 100644 --- a/argocd/templates/traefik.yaml +++ b/argocd/templates/traefik.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: traefik destination: namespace: traefik diff --git a/argocd/templates/uptimekuma.yaml b/argocd/templates/uptimekuma.yaml index ff0e1af..d88557e 100644 --- a/argocd/templates/uptimekuma.yaml +++ b/argocd/templates/uptimekuma.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: uptimekuma directory: recurse: true diff --git a/argocd/templates/vault.yaml b/argocd/templates/vault.yaml index 6e243c5..5727fba 100644 --- a/argocd/templates/vault.yaml +++ b/argocd/templates/vault.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: prd path: vault destination: namespace: vault From ea811669c3dc2630011554b1a63adb051b359ecb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 04:54:27 -0500 Subject: [PATCH 0002/1058] move everything to dev branch --- argocd/templates/InternalProxy.yaml | 2 +- argocd/templates/argocd.yaml | 2 +- argocd/templates/authentik.yaml | 2 +- argocd/templates/bitwarden.yaml | 2 +- argocd/templates/cert-manager.yaml | 2 +- argocd/templates/crossplane.yml | 2 +- argocd/templates/durpapi.yaml | 2 +- argocd/templates/durpot.yaml | 2 +- argocd/templates/external-dns.yaml | 2 +- argocd/templates/external-secrets.yaml | 2 +- argocd/templates/gatekeeper.yaml | 2 +- argocd/templates/gitlab-runner.yaml | 2 +- argocd/templates/heimdall.yaml | 2 +- argocd/templates/krakend.yaml | 2 +- argocd/templates/kube-prometheus-stack.yaml | 2 +- argocd/templates/kubeclarity.yaml | 2 +- argocd/templates/littlelink.yaml | 2 +- argocd/templates/longhorn.yaml | 2 +- argocd/templates/nfs-client.yaml | 2 +- argocd/templates/open-webui.yaml | 2 +- argocd/templates/traefik.yaml | 2 +- argocd/templates/uptimekuma.yaml | 2 +- argocd/templates/vault.yaml | 2 +- 23 files changed, 23 insertions(+), 23 deletions(-) diff --git a/argocd/templates/InternalProxy.yaml b/argocd/templates/InternalProxy.yaml index 1769a19..a99813e 100644 --- a/argocd/templates/InternalProxy.yaml +++ b/argocd/templates/InternalProxy.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: internalproxy directory: recurse: true diff --git a/argocd/templates/argocd.yaml b/argocd/templates/argocd.yaml index d8f0fd3..5df8c09 100644 --- a/argocd/templates/argocd.yaml +++ b/argocd/templates/argocd.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: argocd destination: namespace: argocd diff --git a/argocd/templates/authentik.yaml b/argocd/templates/authentik.yaml index 735fa1a..ff4a7a1 100644 --- a/argocd/templates/authentik.yaml +++ b/argocd/templates/authentik.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: authentik destination: namespace: authentik diff --git a/argocd/templates/bitwarden.yaml b/argocd/templates/bitwarden.yaml index 6aad52f..6936d6b 100644 --- a/argocd/templates/bitwarden.yaml +++ b/argocd/templates/bitwarden.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: bitwarden directory: recurse: true diff --git a/argocd/templates/cert-manager.yaml b/argocd/templates/cert-manager.yaml index 1eb8fe2..2dfa2d4 100644 --- a/argocd/templates/cert-manager.yaml +++ b/argocd/templates/cert-manager.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: cert-manager destination: namespace: cert-manager diff --git a/argocd/templates/crossplane.yml b/argocd/templates/crossplane.yml index e079c78..299ebc9 100644 --- a/argocd/templates/crossplane.yml +++ b/argocd/templates/crossplane.yml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: crossplane destination: namespace: crossplane diff --git a/argocd/templates/durpapi.yaml b/argocd/templates/durpapi.yaml index 53c2db6..c468265 100644 --- a/argocd/templates/durpapi.yaml +++ b/argocd/templates/durpapi.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: durpapi destination: namespace: durpapi diff --git a/argocd/templates/durpot.yaml b/argocd/templates/durpot.yaml index 1bfcd37..6cf517e 100644 --- a/argocd/templates/durpot.yaml +++ b/argocd/templates/durpot.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: durpot destination: namespace: durpot diff --git a/argocd/templates/external-dns.yaml b/argocd/templates/external-dns.yaml index ba05f2c..e097b89 100644 --- a/argocd/templates/external-dns.yaml +++ b/argocd/templates/external-dns.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: external-dns destination: namespace: external-dns diff --git a/argocd/templates/external-secrets.yaml b/argocd/templates/external-secrets.yaml index cf8a595..0c0ddab 100644 --- a/argocd/templates/external-secrets.yaml +++ b/argocd/templates/external-secrets.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: external-secrets destination: namespace: external-secrets diff --git a/argocd/templates/gatekeeper.yaml b/argocd/templates/gatekeeper.yaml index 5c60c12..225194d 100644 --- a/argocd/templates/gatekeeper.yaml +++ b/argocd/templates/gatekeeper.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: gatekeeper destination: namespace: gatekeeper diff --git a/argocd/templates/gitlab-runner.yaml b/argocd/templates/gitlab-runner.yaml index c5539d7..6caa79d 100644 --- a/argocd/templates/gitlab-runner.yaml +++ b/argocd/templates/gitlab-runner.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: gitlab-runner destination: namespace: gitlab-runner diff --git a/argocd/templates/heimdall.yaml b/argocd/templates/heimdall.yaml index d695e34..2340dca 100644 --- a/argocd/templates/heimdall.yaml +++ b/argocd/templates/heimdall.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: heimdall destination: namespace: heimdall diff --git a/argocd/templates/krakend.yaml b/argocd/templates/krakend.yaml index 68a57d1..f1e1b78 100644 --- a/argocd/templates/krakend.yaml +++ b/argocd/templates/krakend.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: krakend destination: namespace: krakend diff --git a/argocd/templates/kube-prometheus-stack.yaml b/argocd/templates/kube-prometheus-stack.yaml index 02f8261..59800a7 100644 --- a/argocd/templates/kube-prometheus-stack.yaml +++ b/argocd/templates/kube-prometheus-stack.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: kube-prometheus-stack destination: namespace: kube-prometheus-stack diff --git a/argocd/templates/kubeclarity.yaml b/argocd/templates/kubeclarity.yaml index c812528..0457b36 100644 --- a/argocd/templates/kubeclarity.yaml +++ b/argocd/templates/kubeclarity.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: kubeclarity destination: namespace: kubeclarity diff --git a/argocd/templates/littlelink.yaml b/argocd/templates/littlelink.yaml index 99b08fe..42e2c2d 100644 --- a/argocd/templates/littlelink.yaml +++ b/argocd/templates/littlelink.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: littlelink directory: recurse: true diff --git a/argocd/templates/longhorn.yaml b/argocd/templates/longhorn.yaml index 017da6f..ea388f0 100644 --- a/argocd/templates/longhorn.yaml +++ b/argocd/templates/longhorn.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: longhorn destination: namespace: longhorn-system diff --git a/argocd/templates/nfs-client.yaml b/argocd/templates/nfs-client.yaml index e374885..f101b4d 100644 --- a/argocd/templates/nfs-client.yaml +++ b/argocd/templates/nfs-client.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: nfs-client directory: recurse: true diff --git a/argocd/templates/open-webui.yaml b/argocd/templates/open-webui.yaml index a2b25fa..658a941 100644 --- a/argocd/templates/open-webui.yaml +++ b/argocd/templates/open-webui.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: open-webui destination: namespace: open-webui diff --git a/argocd/templates/traefik.yaml b/argocd/templates/traefik.yaml index 3995a9f..d2247d7 100644 --- a/argocd/templates/traefik.yaml +++ b/argocd/templates/traefik.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: traefik destination: namespace: traefik diff --git a/argocd/templates/uptimekuma.yaml b/argocd/templates/uptimekuma.yaml index ff0e1af..dc00dc0 100644 --- a/argocd/templates/uptimekuma.yaml +++ b/argocd/templates/uptimekuma.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: uptimekuma directory: recurse: true diff --git a/argocd/templates/vault.yaml b/argocd/templates/vault.yaml index 6e243c5..672a6dd 100644 --- a/argocd/templates/vault.yaml +++ b/argocd/templates/vault.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main + targetRevision: dev path: vault destination: namespace: vault From e06a35f1a27db0381a63a770285735c77e33ea6b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 05:08:56 -0500 Subject: [PATCH 0003/1058] update --- authentik/templates/ingress.yaml | 6 +- bitwarden/templates/ingress.yaml | 8 +- durpapi/templates/ingress.yaml | 4 +- heimdall/templates/ingress.yaml | 8 +- internalproxy/templates/argocd.yaml | 6 +- .../templates/duplicati-ingress.yaml | 70 ---------------- internalproxy/templates/gitea.yaml | 9 -- internalproxy/templates/guac.yaml | 71 ---------------- internalproxy/templates/jellyfin.yaml | 9 -- internalproxy/templates/kasm.yaml | 9 -- internalproxy/templates/nexus.yaml | 71 ---------------- internalproxy/templates/plex.yaml | 9 -- .../templates/registry-internal.yaml | 59 ------------- internalproxy/templates/registry.yaml | 71 ---------------- internalproxy/templates/smokeping.yaml | 82 ------------------- internalproxy/templates/speedtest.yaml | 74 ----------------- internalproxy/templates/tdarr.yaml | 67 --------------- krakend/templates/ingress.yaml | 10 +-- kube-prometheus-stack/templates/ingress.yaml | 16 ++-- kubeclarity/templates/ingress.yaml | 10 +-- littlelink/templates/ingress.yaml | 10 +-- longhorn/templates/ingress.yaml | 8 +- open-webui/templates/ingress.yaml | 10 +-- uptimekuma/templates/ingress.yaml | 10 +-- vault/templates/ingress.yaml | 6 +- 25 files changed, 56 insertions(+), 657 deletions(-) delete mode 100644 internalproxy/templates/duplicati-ingress.yaml delete mode 100644 internalproxy/templates/gitea.yaml delete mode 100644 internalproxy/templates/guac.yaml delete mode 100644 internalproxy/templates/jellyfin.yaml delete mode 100644 internalproxy/templates/kasm.yaml delete mode 100644 internalproxy/templates/nexus.yaml delete mode 100644 internalproxy/templates/plex.yaml delete mode 100644 internalproxy/templates/registry-internal.yaml delete mode 100644 internalproxy/templates/registry.yaml delete mode 100644 internalproxy/templates/smokeping.yaml delete mode 100644 internalproxy/templates/speedtest.yaml delete mode 100644 internalproxy/templates/tdarr.yaml diff --git a/authentik/templates/ingress.yaml b/authentik/templates/ingress.yaml index ac10303..1de2d83 100644 --- a/authentik/templates/ingress.yaml +++ b/authentik/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + - match: Host(`authentik.dev.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: authentik-server @@ -25,9 +25,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "authentik.durp.info" + commonName: "authentik.dev.durp.info" dnsNames: - - "authentik.durp.info" + - "authentik.dev.durp.info" --- diff --git a/bitwarden/templates/ingress.yaml b/bitwarden/templates/ingress.yaml index 8a9a628..49cfa24 100644 --- a/bitwarden/templates/ingress.yaml +++ b/bitwarden/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) + - match: Host(`bitwarden.dev.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: bitwarden @@ -25,9 +25,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "bitwarden.durp.info" + commonName: "bitwarden.dev.durp.info" dnsNames: - - "bitwarden.durp.info" + - "bitwarden.dev.durp.info" --- @@ -39,4 +39,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info diff --git a/durpapi/templates/ingress.yaml b/durpapi/templates/ingress.yaml index bd268dd..b722670 100644 --- a/durpapi/templates/ingress.yaml +++ b/durpapi/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host("api.durp.info") && PathPrefix(`/api`) + - match: Host("api.dev.durp.info") && PathPrefix(`/api`) kind: Rule middlewares: - name: jwt @@ -24,7 +24,7 @@ spec: entryPoints: - websecure routes: - - match: Host("api.durp.info") && PathPrefix(`/swagger`) + - match: Host("api.dev.durp.info") && PathPrefix(`/swagger`) kind: Rule services: - name: "durpapi-service" diff --git a/heimdall/templates/ingress.yaml b/heimdall/templates/ingress.yaml index 98b6144..49dd1c7 100644 --- a/heimdall/templates/ingress.yaml +++ b/heimdall/templates/ingress.yaml @@ -7,7 +7,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`heimdall.durp.info`) && PathPrefix(`/`) + - match: Host(`heimdall.dev.durp.info`) && PathPrefix(`/`) middlewares: - name: authentik-proxy-provider namespace: traefik @@ -15,7 +15,7 @@ spec: services: - name: heimdall port: 80 - - match: Host(`heimdall.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + - match: Host(`heimdall.dev.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) kind: Rule services: - name: ak-outpost-authentik-embedded-outpost @@ -35,9 +35,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "heimdall.durp.info" + commonName: "heimdall.dev.durp.info" dnsNames: - - "heimdall.durp.info" + - "heimdall.dev.durp.info" --- diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index 15dfaf9..01d5862 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -8,7 +8,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`argocd.internal.durp.info`) + - match: Host(`argocd.dev.internal.durp.info`) middlewares: - name: whitelist namespace: traefik @@ -41,6 +41,6 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "argocd.internal.durp.info" + commonName: "argocd.dev.internal.durp.info" dnsNames: - - "argocd.internal.durp.info" \ No newline at end of file + - "argocd.dev.internal.durp.info" diff --git a/internalproxy/templates/duplicati-ingress.yaml b/internalproxy/templates/duplicati-ingress.yaml deleted file mode 100644 index d51c391..0000000 --- a/internalproxy/templates/duplicati-ingress.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: duplicati -spec: - ports: - - name: app - port: 8200 - protocol: TCP - targetPort: 8200 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: duplicati -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8200 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: duplicati-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: duplicati - port: 8200 - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: duplicati-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: duplicati-tls -spec: - secretName: duplicati-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "duplicati.internal.durp.info" - dnsNames: - - "duplicati.internal.durp.info" \ No newline at end of file diff --git a/internalproxy/templates/gitea.yaml b/internalproxy/templates/gitea.yaml deleted file mode 100644 index 8443aaf..0000000 --- a/internalproxy/templates/gitea.yaml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Service -apiVersion: v1 -metadata: - name: gitea-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: gitea.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/guac.yaml b/internalproxy/templates/guac.yaml deleted file mode 100644 index a69b685..0000000 --- a/internalproxy/templates/guac.yaml +++ /dev/null @@ -1,71 +0,0 @@ -kind: Service -apiVersion: v1 -metadata: - name: guac-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: guac.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- - -apiVersion: v1 -kind: Service -metadata: - name: guac -spec: - ports: - - name: app - port: 8082 - protocol: TCP - targetPort: 8082 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: guac -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8082 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: guac-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`guac.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: guac - port: 8082 - tls: - secretName: guac-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: guac-tls -spec: - secretName: guac-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "guac.durp.info" - dnsNames: - - "guac.durp.info" \ No newline at end of file diff --git a/internalproxy/templates/jellyfin.yaml b/internalproxy/templates/jellyfin.yaml deleted file mode 100644 index 61d86a5..0000000 --- a/internalproxy/templates/jellyfin.yaml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Service -apiVersion: v1 -metadata: - name: jellyfin-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: jellyfin.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/internalproxy/templates/kasm.yaml b/internalproxy/templates/kasm.yaml deleted file mode 100644 index 28b25ae..0000000 --- a/internalproxy/templates/kasm.yaml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Service -apiVersion: v1 -metadata: - name: kasm-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kasm.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/internalproxy/templates/nexus.yaml b/internalproxy/templates/nexus.yaml deleted file mode 100644 index 7074102..0000000 --- a/internalproxy/templates/nexus.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: nexus -spec: - ports: - - name: app - port: 8081 - protocol: TCP - targetPort: 8081 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: nexus -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8081 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: nexus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`nexus.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: nexus - port: 8081 - tls: - secretName: nexus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: nexus-tls -spec: - secretName: nexus-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "nexus.durp.info" - dnsNames: - - "nexus.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: nexus-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: nexus.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/plex.yaml b/internalproxy/templates/plex.yaml deleted file mode 100644 index 2e70286..0000000 --- a/internalproxy/templates/plex.yaml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Service -apiVersion: v1 -metadata: - name: plex-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: plex.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/internalproxy/templates/registry-internal.yaml b/internalproxy/templates/registry-internal.yaml deleted file mode 100644 index a1c584f..0000000 --- a/internalproxy/templates/registry-internal.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry-internal -spec: - ports: - - name: app - port: 5001 - protocol: TCP - targetPort: 5001 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry-internal -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 5001 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-internal-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry-internal - port: 5001 - tls: - secretName: registry-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-internal-tls -spec: - secretName: registry-internal-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.durp.info" - dnsNames: - - "registry.durp.info" diff --git a/internalproxy/templates/registry.yaml b/internalproxy/templates/registry.yaml deleted file mode 100644 index b4ac19a..0000000 --- a/internalproxy/templates/registry.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 5000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry - port: 5000 - tls: - secretName: registry-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-tls -spec: - secretName: registry-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.durp.info" - dnsNames: - - "registry.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: registry-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: registry.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/smokeping.yaml b/internalproxy/templates/smokeping.yaml deleted file mode 100644 index 8a76738..0000000 --- a/internalproxy/templates/smokeping.yaml +++ /dev/null @@ -1,82 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: smokeping -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: smokeping -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: smokeping-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: smokeping - port: 81 - - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: smokeping-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: smokeping-tls -spec: - secretName: smokeping-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "smokeping.durp.info" - dnsNames: - - "smokeping.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: smokeping-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/speedtest.yaml b/internalproxy/templates/speedtest.yaml deleted file mode 100644 index e034917..0000000 --- a/internalproxy/templates/speedtest.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: speedtest -spec: - ports: - - name: app - port: 6580 - protocol: TCP - targetPort: 6580 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: speedtest -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 6580 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: speedtest-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: speedtest - port: 6580 - tls: - secretName: speedtest-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: speedtest-tls -spec: - secretName: speedtest-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "speedtest.durp.info" - dnsNames: - - "speedtest.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: speedtest-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/tdarr.yaml b/internalproxy/templates/tdarr.yaml deleted file mode 100644 index c4403b9..0000000 --- a/internalproxy/templates/tdarr.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: tdarr -spec: - ports: - - name: app - port: 8267 - protocol: TCP - targetPort: 8267 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: tdarr -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8267 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: tdarr-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`tdarr.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: tdarr - port: 8267 - scheme: http - tls: - secretName: tdarr-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: tdarr-tls -spec: - secretName: tdarr-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "tdarr.internal.durp.info" - dnsNames: - - "tdarr.internal.durp.info" diff --git a/krakend/templates/ingress.yaml b/krakend/templates/ingress.yaml index a8c08eb..4b42ba3 100644 --- a/krakend/templates/ingress.yaml +++ b/krakend/templates/ingress.yaml @@ -7,9 +7,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "api.durp.info" + commonName: "api.dev.durp.info" dnsNames: - - "api.durp.info" + - "api.dev.durp.info" --- @@ -21,7 +21,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`api.durp.info`) && PathPrefix(`/`) + - match: Host(`api.dev.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: krakend-service @@ -37,7 +37,7 @@ apiVersion: v1 metadata: name: api-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: api.durp.info + external-dns.alpha.kubernetes.io/hostname: api.dev.durp.info spec: type: ExternalName externalName: durp.info @@ -49,7 +49,7 @@ apiVersion: v1 metadata: name: api-developer-dns annotations: - external-dns.alpha.kubernetes.io/hostname: developer.durp.info + external-dns.alpha.kubernetes.io/hostname: developer.dev.durp.info external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" spec: type: ExternalName diff --git a/kube-prometheus-stack/templates/ingress.yaml b/kube-prometheus-stack/templates/ingress.yaml index caf0ee1..851faff 100644 --- a/kube-prometheus-stack/templates/ingress.yaml +++ b/kube-prometheus-stack/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`grafana.durp.info`) && PathPrefix(`/`) + - match: Host(`grafana.dev.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: grafana @@ -25,9 +25,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "grafana.durp.info" + commonName: "grafana.dev.durp.info" dnsNames: - - "grafana.durp.info" + - "grafana.dev.durp.info" --- @@ -39,7 +39,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) + - match: Host(`alertmanager.dev.durp.info`) && PathPrefix(`/`) middlewares: - name: whitelist namespace: traefik @@ -63,9 +63,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "alertmanager.durp.info" + commonName: "alertmanager.dev.durp.info" dnsNames: - - "alertmanager.durp.info" + - "alertmanager.dev.durp.info" --- @@ -74,7 +74,7 @@ apiVersion: v1 metadata: name: grafana-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: grafana.durp.info + external-dns.alpha.kubernetes.io/hostname: grafana.dev.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: dev.durp.info diff --git a/kubeclarity/templates/ingress.yaml b/kubeclarity/templates/ingress.yaml index 77b67a7..ac0950d 100644 --- a/kubeclarity/templates/ingress.yaml +++ b/kubeclarity/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`kubeclarity.durp.info`) && PathPrefix(`/`) + - match: Host(`kubeclarity.dev.durp.info`) && PathPrefix(`/`) middlewares: - name: whitelist namespace: traefik @@ -30,9 +30,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "kubeclarity.durp.info" + commonName: "kubeclarity.dev.durp.info" dnsNames: - - "kubeclarity.durp.info" + - "kubeclarity.dev.durp.info" --- @@ -41,7 +41,7 @@ apiVersion: v1 metadata: name: kubeclarity-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: kubeclarity.durp.info + external-dns.alpha.kubernetes.io/hostname: kubeclarity.dev.durp.info spec: type: ExternalName - externalName: durp.info + externalName: dev.durp.info diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 194f31e..5708501 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`links.durp.info`) && PathPrefix(`/`) + - match: Host(`links.dev.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: littlelink @@ -25,9 +25,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "links.durp.info" + commonName: "links.dev.durp.info" dnsNames: - - "links.durp.info" + - "links.dev.durp.info" --- @@ -36,7 +36,7 @@ apiVersion: v1 metadata: name: links-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: links.durp.info + external-dns.alpha.kubernetes.io/hostname: links.dev.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: dev.durp.info diff --git a/longhorn/templates/ingress.yaml b/longhorn/templates/ingress.yaml index df2e071..7f67dec 100644 --- a/longhorn/templates/ingress.yaml +++ b/longhorn/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) + - match: Host(`longhorn.internal.dev.durp.info`) && PathPrefix(`/`) middlewares: - name: whitelist namespace: traefik @@ -16,7 +16,7 @@ spec: services: - name: longhorn-frontend port: 80 - - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + - match: Host(`longhorn.internal.dev.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) kind: Rule services: - name: ak-outpost-authentik-embedded-outpost @@ -36,6 +36,6 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "longhorn.internal.durp.info" + commonName: "longhorn.internal.dev.durp.info" dnsNames: - - "longhorn.internal.durp.info" + - "longhorn.internal.dev.durp.info" diff --git a/open-webui/templates/ingress.yaml b/open-webui/templates/ingress.yaml index 6331e92..9a5f14f 100644 --- a/open-webui/templates/ingress.yaml +++ b/open-webui/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) + - match: Host(`open-webui.dev.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: open-webui @@ -25,9 +25,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "open-webui.durp.info" + commonName: "open-webui.dev.durp.info" dnsNames: - - "open-webui.durp.info" + - "open-webui.dev.durp.info" --- @@ -36,7 +36,7 @@ apiVersion: v1 metadata: name: open-webui-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info + external-dns.alpha.kubernetes.io/hostname: open-webui.dev.durp.info spec: type: ExternalName - externalName: durp.info + externalName: dev.durp.info diff --git a/uptimekuma/templates/ingress.yaml b/uptimekuma/templates/ingress.yaml index 3df2689..24c683e 100644 --- a/uptimekuma/templates/ingress.yaml +++ b/uptimekuma/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`kuma.durp.info`) && PathPrefix(`/`) + - match: Host(`kuma.dev.durp.info`) && PathPrefix(`/`) middlewares: - name: authentik-proxy-provider namespace: traefik @@ -28,9 +28,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "kuma.durp.info" + commonName: "kuma.dev.durp.info" dnsNames: - - "kuma.durp.info" + - "kuma.dev.durp.info" --- @@ -39,7 +39,7 @@ apiVersion: v1 metadata: name: heimdall-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: kuma.durp.info + external-dns.alpha.kubernetes.io/hostname: kuma.dev.durp.info spec: type: ExternalName - externalName: durp.info + externalName: dev.durp.info diff --git a/vault/templates/ingress.yaml b/vault/templates/ingress.yaml index 8998087..41802da 100644 --- a/vault/templates/ingress.yaml +++ b/vault/templates/ingress.yaml @@ -8,7 +8,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`vault.internal.durp.info`) + - match: Host(`vault.internal.dev.durp.info`) middlewares: - name: whitelist namespace: traefik @@ -31,7 +31,7 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "vault.internal.durp.info" + commonName: "vault.internal.dev.durp.info" dnsNames: - - "vault.internal.durp.info" + - "vault.internal.dev.durp.info" From 1be8492f4cc4ff006678f2366477627cfbaed190 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 06:50:24 -0500 Subject: [PATCH 0004/1058] update --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index b7b6417..8c0a8ae 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.3.2 + version: 1.6.1 From d0e7fd57eda34ec466476af4c19071a9a6013aac Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 06:52:13 -0500 Subject: [PATCH 0005/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index 5343300..16fd4a4 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -238,7 +238,7 @@ longhorn: # certificate: # Configure a pod security policy in the Longhorn namespace to allow privileged pods - enablePSP: true + enablePSP: false ## Specify override namespace, specifically this is useful for using longhorn as sub-chart ## and its release namespace is not the `longhorn-system` From 8ff8705a2f7f5d68f7ad8c4f1c188ed8f63cc4fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 07:17:14 -0500 Subject: [PATCH 0006/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index 16fd4a4..ced04ee 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -47,7 +47,7 @@ longhorn: persistence: defaultClass: true defaultFsType: ext4 - defaultClassReplicaCount: 3 + defaultClassReplicaCount: 1 defaultDataLocality: disabled # best-effort otherwise reclaimPolicy: Retain migratable: false From 583c5489003ae59dbbabd8bbd86256d4fa99ba49 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 07:36:54 -0500 Subject: [PATCH 0007/1058] update --- argocd/templates/metallb.yaml | 21 ++ metallb/Chart.yaml | 12 ++ metallb/templates/config.yaml | 12 ++ metallb/values.yaml | 364 ++++++++++++++++++++++++++++++++++ 4 files changed, 409 insertions(+) create mode 100644 argocd/templates/metallb.yaml create mode 100644 metallb/Chart.yaml create mode 100644 metallb/templates/config.yaml create mode 100644 metallb/values.yaml diff --git a/argocd/templates/metallb.yaml b/argocd/templates/metallb.yaml new file mode 100644 index 0000000..cc0aa5e --- /dev/null +++ b/argocd/templates/metallb.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: methallb + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: dev + path: methallb + destination: + namespace: methallb + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/metallb/Chart.yaml b/metallb/Chart.yaml new file mode 100644 index 0000000..6b183c3 --- /dev/null +++ b/metallb/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.14.5 diff --git a/metallb/templates/config.yaml b/metallb/templates/config.yaml new file mode 100644 index 0000000..b65a201 --- /dev/null +++ b/metallb/templates/config.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + namespace: metallb-system + name: config +data: + config: | + address-pools: + - name: default + protocol: layer2 + addresses: + - 192.168.10.130-192.168.10.140 diff --git a/metallb/values.yaml b/metallb/values.yaml new file mode 100644 index 0000000..36c62aa --- /dev/null +++ b/metallb/values.yaml @@ -0,0 +1,364 @@ +metallb: + # Default values for metallb. + # This is a YAML-formatted file. + # Declare variables to be passed into your templates. + + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + loadBalancerClass: "" + + # To configure MetalLB, you must specify ONE of the following two + # options. + + rbac: + # create specifies whether to install and use RBAC rules. + create: true + + prometheus: + # scrape annotations specifies whether to add Prometheus metric + # auto-collection annotations to pods. See + # https://github.com/prometheus/prometheus/blob/release-2.1/documentation/examples/prometheus-kubernetes.yml + # for a corresponding Prometheus configuration. Alternatively, you + # may want to use the Prometheus Operator + # (https://github.com/coreos/prometheus-operator) for more powerful + # monitoring configuration. If you use the Prometheus operator, this + # can be left at false. + scrapeAnnotations: false + + # port both controller and speaker will listen on for metrics + metricsPort: 7472 + + # if set, enables rbac proxy on the controller and speaker to expose + # the metrics via tls. + # secureMetricsPort: 9120 + + # the name of the secret to be mounted in the speaker pod + # to expose the metrics securely. If not present, a self signed + # certificate to be used. + speakerMetricsTLSSecret: "" + + # the name of the secret to be mounted in the controller pod + # to expose the metrics securely. If not present, a self signed + # certificate to be used. + controllerMetricsTLSSecret: "" + + # prometheus doens't have the permission to scrape all namespaces so we give it permission to scrape metallb's one + rbacPrometheus: true + + # the service account used by prometheus + # required when " .Values.prometheus.rbacPrometheus == true " and " .Values.prometheus.podMonitor.enabled=true or prometheus.serviceMonitor.enabled=true " + serviceAccount: "" + + # the namespace where prometheus is deployed + # required when " .Values.prometheus.rbacPrometheus == true " and " .Values.prometheus.podMonitor.enabled=true or prometheus.serviceMonitor.enabled=true " + namespace: "" + + # the image to be used for the kuberbacproxy container + rbacProxy: + repository: gcr.io/kubebuilder/kube-rbac-proxy + tag: v0.12.0 + pullPolicy: + + # Prometheus Operator PodMonitors + podMonitor: + # enable support for Prometheus Operator + enabled: false + + # optional additionnal labels for podMonitors + additionalLabels: {} + + # optional annotations for podMonitors + annotations: {} + + # Job label for scrape target + jobLabel: "app.kubernetes.io/name" + + # Scrape interval. If not set, the Prometheus default scrape interval is used. + interval: + + # metric relabel configs to apply to samples before ingestion. + metricRelabelings: [] + # - action: keep + # regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+' + # sourceLabels: [__name__] + + # relabel configs to apply to samples before ingestion. + relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # target_label: nodename + # replacement: $1 + # action: replace + + # Prometheus Operator ServiceMonitors. To be used as an alternative + # to podMonitor, supports secure metrics. + serviceMonitor: + # enable support for Prometheus Operator + enabled: false + + speaker: + # optional additional labels for the speaker serviceMonitor + additionalLabels: {} + # optional additional annotations for the speaker serviceMonitor + annotations: {} + # optional tls configuration for the speaker serviceMonitor, in case + # secure metrics are enabled. + tlsConfig: + insecureSkipVerify: true + + controller: + # optional additional labels for the controller serviceMonitor + additionalLabels: {} + # optional additional annotations for the controller serviceMonitor + annotations: {} + # optional tls configuration for the controller serviceMonitor, in case + # secure metrics are enabled. + tlsConfig: + insecureSkipVerify: true + + # Job label for scrape target + jobLabel: "app.kubernetes.io/name" + + # Scrape interval. If not set, the Prometheus default scrape interval is used. + interval: + + # metric relabel configs to apply to samples before ingestion. + metricRelabelings: [] + # - action: keep + # regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+' + # sourceLabels: [__name__] + + # relabel configs to apply to samples before ingestion. + relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # target_label: nodename + # replacement: $1 + # action: replace + + # Prometheus Operator alertmanager alerts + prometheusRule: + # enable alertmanager alerts + enabled: false + + # optional additionnal labels for prometheusRules + additionalLabels: {} + + # optional annotations for prometheusRules + annotations: {} + + # MetalLBStaleConfig + staleConfig: + enabled: true + labels: + severity: warning + + # MetalLBConfigNotLoaded + configNotLoaded: + enabled: true + labels: + severity: warning + + # MetalLBAddressPoolExhausted + addressPoolExhausted: + enabled: true + labels: + severity: alert + + addressPoolUsage: + enabled: true + thresholds: + - percent: 75 + labels: + severity: warning + - percent: 85 + labels: + severity: warning + - percent: 95 + labels: + severity: alert + + # MetalLBBGPSessionDown + bgpSessionDown: + enabled: true + labels: + severity: alert + + extraAlerts: [] + + # controller contains configuration specific to the MetalLB cluster + # controller. + controller: + enabled: true + # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` + logLevel: info + # command: /controller + # webhookMode: enabled + image: + repository: quay.io/metallb/controller + tag: + pullPolicy: + ## @param controller.updateStrategy.type Metallb controller deployment strategy type. + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + ## e.g: + ## strategy: + ## type: RollingUpdate + ## rollingUpdate: + ## maxSurge: 25% + ## maxUnavailable: 25% + ## + strategy: + type: RollingUpdate + serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. If not set and create is + # true, a name is generated using the fullname template + name: "" + annotations: {} + securityContext: + runAsNonRoot: true + # nobody + runAsUser: 65534 + fsGroup: 65534 + resources: {} + # limits: + # cpu: 100m + # memory: 100Mi + nodeSelector: {} + tolerations: [] + priorityClassName: "" + runtimeClassName: "" + affinity: {} + podAnnotations: {} + labels: {} + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + tlsMinVersion: "VersionTLS12" + tlsCipherSuites: "" + + extraContainers: [] + + # speaker contains configuration specific to the MetalLB speaker + # daemonset. + speaker: + enabled: true + # command: /speaker + # -- Speaker log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` + logLevel: info + tolerateMaster: true + memberlist: + enabled: true + mlBindPort: 7946 + mlBindAddrOverride: "" + mlSecretKeyPath: "/etc/ml_secret_key" + excludeInterfaces: + enabled: true + # ignore the exclude-from-external-loadbalancer label + ignoreExcludeLB: false + + image: + repository: quay.io/metallb/speaker + tag: + pullPolicy: + ## @param speaker.updateStrategy.type Speaker daemonset strategy type + ## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/ + ## + updateStrategy: + ## StrategyType + ## Can be set to RollingUpdate or OnDelete + ## + type: RollingUpdate + serviceAccount: + # Specifies whether a ServiceAccount should be created + create: true + # The name of the ServiceAccount to use. If not set and create is + # true, a name is generated using the fullname template + name: "" + annotations: {} + securityContext: {} + ## Defines a secret name for the controller to generate a memberlist encryption secret + ## By default secretName: {{ "metallb.fullname" }}-memberlist + ## + # secretName: + resources: {} + # limits: + # cpu: 100m + # memory: 100Mi + nodeSelector: {} + tolerations: [] + priorityClassName: "" + affinity: {} + ## Selects which runtime class will be used by the pod. + runtimeClassName: "" + podAnnotations: {} + labels: {} + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + startupProbe: + enabled: true + failureThreshold: 30 + periodSeconds: 5 + # frr contains configuration specific to the MetalLB FRR container, + # for speaker running alongside FRR. + frr: + enabled: true + image: + repository: quay.io/frrouting/frr + tag: 9.0.2 + pullPolicy: + metricsPort: 7473 + resources: {} + + # if set, enables a rbac proxy sidecar container on the speaker to + # expose the frr metrics via tls. + # secureMetricsPort: 9121 + + + reloader: + resources: {} + + frrMetrics: + resources: {} + + extraContainers: [] + + crds: + enabled: true + validationFailurePolicy: Fail + + # frrk8s contains the configuration related to using an frrk8s instance + # (github.com/metallb/frr-k8s) as the backend for the BGP implementation. + # This allows configuring additional frr parameters in combination to those + # applied by MetalLB. + frrk8s: + # if set, enables frrk8s as a backend. This is mutually exclusive to frr + # mode. + enabled: false From 2f9dca4bc7d2e1e109908c3789acdc9a4da5d010 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 07:38:09 -0500 Subject: [PATCH 0008/1058] update --- argocd/templates/metallb.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/argocd/templates/metallb.yaml b/argocd/templates/metallb.yaml index cc0aa5e..4110ad7 100644 --- a/argocd/templates/metallb.yaml +++ b/argocd/templates/metallb.yaml @@ -1,16 +1,16 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: methallb + name: metallb namespace: argocd spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: dev - path: methallb + path: metallb destination: - namespace: methallb + namespace: metallb name: in-cluster syncPolicy: automated: From 76449c7ccd1ef8b456fda985ed6243f1b9b288d3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 07:39:25 -0500 Subject: [PATCH 0009/1058] update --- metallb/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metallb/templates/config.yaml b/metallb/templates/config.yaml index b65a201..e868c40 100644 --- a/metallb/templates/config.yaml +++ b/metallb/templates/config.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: ConfigMap metadata: - namespace: metallb-system + namespace: metallb name: config data: config: | From aed1ff955628708c33cd7fbc8cdb9bccb04cfe24 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 13 May 2024 08:21:10 -0500 Subject: [PATCH 0010/1058] update --- metallb/values.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/metallb/values.yaml b/metallb/values.yaml index 36c62aa..d04832b 100644 --- a/metallb/values.yaml +++ b/metallb/values.yaml @@ -307,7 +307,10 @@ metallb: ## Selects which runtime class will be used by the pod. runtimeClassName: "" podAnnotations: {} - labels: {} + labels: + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged livenessProbe: enabled: true failureThreshold: 3 From 7beeb5c86f0824ea17c122b2986fb3046d393372 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 04:44:51 -0500 Subject: [PATCH 0011/1058] update --- metallb/templates/config.yaml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/metallb/templates/config.yaml b/metallb/templates/config.yaml index e868c40..664e4a0 100644 --- a/metallb/templates/config.yaml +++ b/metallb/templates/config.yaml @@ -1,12 +1,12 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - namespace: metallb - name: config -data: - config: | - address-pools: - - name: default - protocol: layer2 - addresses: - - 192.168.10.130-192.168.10.140 +#apiVersion: v1 +#kind: ConfigMap +#metadata: +# namespace: metallb +# name: config +#data: +# config: | +# address-pools: +# - name: default +# protocol: layer2 +# addresses: +# - 192.168.10.130-192.168.10.140 From c3411b7f93be11a9f8d5e64dac75797f1b69f700 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 04:51:07 -0500 Subject: [PATCH 0012/1058] update --- metallb/values.yaml | 173 +------------------------------------------- 1 file changed, 1 insertion(+), 172 deletions(-) diff --git a/metallb/values.yaml b/metallb/values.yaml index d04832b..69b6742 100644 --- a/metallb/values.yaml +++ b/metallb/values.yaml @@ -1,173 +1,64 @@ metallb: - # Default values for metallb. - # This is a YAML-formatted file. - # Declare variables to be passed into your templates. - imagePullSecrets: [] nameOverride: "" fullnameOverride: "" loadBalancerClass: "" - # To configure MetalLB, you must specify ONE of the following two - # options. - rbac: - # create specifies whether to install and use RBAC rules. create: true prometheus: - # scrape annotations specifies whether to add Prometheus metric - # auto-collection annotations to pods. See - # https://github.com/prometheus/prometheus/blob/release-2.1/documentation/examples/prometheus-kubernetes.yml - # for a corresponding Prometheus configuration. Alternatively, you - # may want to use the Prometheus Operator - # (https://github.com/coreos/prometheus-operator) for more powerful - # monitoring configuration. If you use the Prometheus operator, this - # can be left at false. scrapeAnnotations: false - - # port both controller and speaker will listen on for metrics metricsPort: 7472 - - # if set, enables rbac proxy on the controller and speaker to expose - # the metrics via tls. - # secureMetricsPort: 9120 - - # the name of the secret to be mounted in the speaker pod - # to expose the metrics securely. If not present, a self signed - # certificate to be used. speakerMetricsTLSSecret: "" - - # the name of the secret to be mounted in the controller pod - # to expose the metrics securely. If not present, a self signed - # certificate to be used. controllerMetricsTLSSecret: "" - - # prometheus doens't have the permission to scrape all namespaces so we give it permission to scrape metallb's one rbacPrometheus: true - - # the service account used by prometheus - # required when " .Values.prometheus.rbacPrometheus == true " and " .Values.prometheus.podMonitor.enabled=true or prometheus.serviceMonitor.enabled=true " serviceAccount: "" - - # the namespace where prometheus is deployed - # required when " .Values.prometheus.rbacPrometheus == true " and " .Values.prometheus.podMonitor.enabled=true or prometheus.serviceMonitor.enabled=true " namespace: "" - - # the image to be used for the kuberbacproxy container rbacProxy: repository: gcr.io/kubebuilder/kube-rbac-proxy tag: v0.12.0 pullPolicy: - - # Prometheus Operator PodMonitors podMonitor: - # enable support for Prometheus Operator enabled: false - - # optional additionnal labels for podMonitors additionalLabels: {} - - # optional annotations for podMonitors annotations: {} - - # Job label for scrape target jobLabel: "app.kubernetes.io/name" - - # Scrape interval. If not set, the Prometheus default scrape interval is used. interval: - - # metric relabel configs to apply to samples before ingestion. metricRelabelings: [] - # - action: keep - # regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+' - # sourceLabels: [__name__] - - # relabel configs to apply to samples before ingestion. relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # target_label: nodename - # replacement: $1 - # action: replace - - # Prometheus Operator ServiceMonitors. To be used as an alternative - # to podMonitor, supports secure metrics. serviceMonitor: - # enable support for Prometheus Operator enabled: false - speaker: - # optional additional labels for the speaker serviceMonitor additionalLabels: {} - # optional additional annotations for the speaker serviceMonitor annotations: {} - # optional tls configuration for the speaker serviceMonitor, in case - # secure metrics are enabled. tlsConfig: insecureSkipVerify: true - controller: - # optional additional labels for the controller serviceMonitor additionalLabels: {} - # optional additional annotations for the controller serviceMonitor annotations: {} - # optional tls configuration for the controller serviceMonitor, in case - # secure metrics are enabled. tlsConfig: insecureSkipVerify: true - - # Job label for scrape target jobLabel: "app.kubernetes.io/name" - - # Scrape interval. If not set, the Prometheus default scrape interval is used. interval: - - # metric relabel configs to apply to samples before ingestion. metricRelabelings: [] - # - action: keep - # regex: 'kube_(daemonset|deployment|pod|namespace|node|statefulset).+' - # sourceLabels: [__name__] - - # relabel configs to apply to samples before ingestion. relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # target_label: nodename - # replacement: $1 - # action: replace - - # Prometheus Operator alertmanager alerts prometheusRule: - # enable alertmanager alerts enabled: false - - # optional additionnal labels for prometheusRules additionalLabels: {} - - # optional annotations for prometheusRules annotations: {} - - # MetalLBStaleConfig staleConfig: enabled: true labels: severity: warning - - # MetalLBConfigNotLoaded configNotLoaded: enabled: true labels: severity: warning - - # MetalLBAddressPoolExhausted addressPoolExhausted: enabled: true labels: severity: alert - addressPoolUsage: enabled: true thresholds: @@ -180,8 +71,6 @@ metallb: - percent: 95 labels: severity: alert - - # MetalLBBGPSessionDown bgpSessionDown: enabled: true labels: @@ -189,45 +78,25 @@ metallb: extraAlerts: [] - # controller contains configuration specific to the MetalLB cluster - # controller. controller: enabled: true # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` logLevel: info - # command: /controller - # webhookMode: enabled image: repository: quay.io/metallb/controller tag: pullPolicy: - ## @param controller.updateStrategy.type Metallb controller deployment strategy type. - ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy - ## e.g: - ## strategy: - ## type: RollingUpdate - ## rollingUpdate: - ## maxSurge: 25% - ## maxUnavailable: 25% - ## strategy: type: RollingUpdate serviceAccount: - # Specifies whether a ServiceAccount should be created create: true - # The name of the ServiceAccount to use. If not set and create is - # true, a name is generated using the fullname template name: "" annotations: {} securityContext: runAsNonRoot: true - # nobody runAsUser: 65534 fsGroup: 65534 resources: {} - # limits: - # cpu: 100m - # memory: 100Mi nodeSelector: {} tolerations: [] priorityClassName: "" @@ -254,12 +123,8 @@ metallb: extraContainers: [] - # speaker contains configuration specific to the MetalLB speaker - # daemonset. speaker: enabled: true - # command: /speaker - # -- Speaker log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` logLevel: info tolerateMaster: true memberlist: @@ -269,42 +134,24 @@ metallb: mlSecretKeyPath: "/etc/ml_secret_key" excludeInterfaces: enabled: true - # ignore the exclude-from-external-loadbalancer label ignoreExcludeLB: false image: repository: quay.io/metallb/speaker tag: pullPolicy: - ## @param speaker.updateStrategy.type Speaker daemonset strategy type - ## ref: https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/ - ## updateStrategy: - ## StrategyType - ## Can be set to RollingUpdate or OnDelete - ## type: RollingUpdate serviceAccount: - # Specifies whether a ServiceAccount should be created create: true - # The name of the ServiceAccount to use. If not set and create is - # true, a name is generated using the fullname template name: "" annotations: {} securityContext: {} - ## Defines a secret name for the controller to generate a memberlist encryption secret - ## By default secretName: {{ "metallb.fullname" }}-memberlist - ## - # secretName: resources: {} - # limits: - # cpu: 100m - # memory: 100Mi nodeSelector: {} tolerations: [] priorityClassName: "" affinity: {} - ## Selects which runtime class will be used by the pod. runtimeClassName: "" podAnnotations: {} labels: @@ -329,8 +176,6 @@ metallb: enabled: true failureThreshold: 30 periodSeconds: 5 - # frr contains configuration specific to the MetalLB FRR container, - # for speaker running alongside FRR. frr: enabled: true image: @@ -339,29 +184,13 @@ metallb: pullPolicy: metricsPort: 7473 resources: {} - - # if set, enables a rbac proxy sidecar container on the speaker to - # expose the frr metrics via tls. - # secureMetricsPort: 9121 - - reloader: resources: {} - frrMetrics: resources: {} - extraContainers: [] - crds: enabled: true validationFailurePolicy: Fail - - # frrk8s contains the configuration related to using an frrk8s instance - # (github.com/metallb/frr-k8s) as the backend for the BGP implementation. - # This allows configuring additional frr parameters in combination to those - # applied by MetalLB. frrk8s: - # if set, enables frrk8s as a backend. This is mutually exclusive to frr - # mode. - enabled: false + enabled: true From f0ca5ec41f340f05731e16a203f5e32c03c8788b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 04:51:35 -0500 Subject: [PATCH 0013/1058] update --- metallb/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metallb/values.yaml b/metallb/values.yaml index 69b6742..52b028d 100644 --- a/metallb/values.yaml +++ b/metallb/values.yaml @@ -177,7 +177,7 @@ metallb: failureThreshold: 30 periodSeconds: 5 frr: - enabled: true + enabled: false image: repository: quay.io/frrouting/frr tag: 9.0.2 From 2ef82bd70fc0947b55ed8e0d620d7f2c7700f061 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 04:53:37 -0500 Subject: [PATCH 0014/1058] update --- metallb/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/metallb/values.yaml b/metallb/values.yaml index 52b028d..25b7ee1 100644 --- a/metallb/values.yaml +++ b/metallb/values.yaml @@ -177,7 +177,7 @@ metallb: failureThreshold: 30 periodSeconds: 5 frr: - enabled: false + enabled: true image: repository: quay.io/frrouting/frr tag: 9.0.2 @@ -193,4 +193,4 @@ metallb: enabled: true validationFailurePolicy: Fail frrk8s: - enabled: true + enabled: false From 9c59677594bad48ac06b76025b088ce8d7b92082 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 04:54:36 -0500 Subject: [PATCH 0015/1058] update --- metallb/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metallb/values.yaml b/metallb/values.yaml index 25b7ee1..876db14 100644 --- a/metallb/values.yaml +++ b/metallb/values.yaml @@ -125,7 +125,7 @@ metallb: speaker: enabled: true - logLevel: info + logLevel: debug tolerateMaster: true memberlist: enabled: true From b105b7004c76126241ba709630aa061d4c22c2e2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 05:06:44 -0500 Subject: [PATCH 0016/1058] update --- metallb/templates/config.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/metallb/templates/config.yaml b/metallb/templates/config.yaml index 664e4a0..71e181a 100644 --- a/metallb/templates/config.yaml +++ b/metallb/templates/config.yaml @@ -10,3 +10,11 @@ # protocol: layer2 # addresses: # - 192.168.10.130-192.168.10.140 +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap + namespace: metallb-system +spec: + addresses: + - 192.168.10.0/24 From 77faed876d0b0d9518ea1319b0aa7439bda5fa10 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 05:07:12 -0500 Subject: [PATCH 0017/1058] update --- metallb/templates/config.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/metallb/templates/config.yaml b/metallb/templates/config.yaml index 71e181a..39121ce 100644 --- a/metallb/templates/config.yaml +++ b/metallb/templates/config.yaml @@ -14,7 +14,6 @@ apiVersion: metallb.io/v1beta1 kind: IPAddressPool metadata: name: cheap - namespace: metallb-system spec: addresses: - 192.168.10.0/24 From c47dba6dc6dc7b0944fc8df0e95edcabc27ba04a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 05:08:32 -0500 Subject: [PATCH 0018/1058] update --- argocd/templates/{metallb.yaml => metallb-system.yaml} | 6 +++--- {metallb => metallb-system}/Chart.yaml | 0 {metallb => metallb-system}/templates/config.yaml | 0 {metallb => metallb-system}/values.yaml | 0 4 files changed, 3 insertions(+), 3 deletions(-) rename argocd/templates/{metallb.yaml => metallb-system.yaml} (81%) rename {metallb => metallb-system}/Chart.yaml (100%) rename {metallb => metallb-system}/templates/config.yaml (100%) rename {metallb => metallb-system}/values.yaml (100%) diff --git a/argocd/templates/metallb.yaml b/argocd/templates/metallb-system.yaml similarity index 81% rename from argocd/templates/metallb.yaml rename to argocd/templates/metallb-system.yaml index 4110ad7..8c33829 100644 --- a/argocd/templates/metallb.yaml +++ b/argocd/templates/metallb-system.yaml @@ -1,16 +1,16 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: metallb + name: metallb-system namespace: argocd spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: dev - path: metallb + path: metallb-system destination: - namespace: metallb + namespace: metallb-system name: in-cluster syncPolicy: automated: diff --git a/metallb/Chart.yaml b/metallb-system/Chart.yaml similarity index 100% rename from metallb/Chart.yaml rename to metallb-system/Chart.yaml diff --git a/metallb/templates/config.yaml b/metallb-system/templates/config.yaml similarity index 100% rename from metallb/templates/config.yaml rename to metallb-system/templates/config.yaml diff --git a/metallb/values.yaml b/metallb-system/values.yaml similarity index 100% rename from metallb/values.yaml rename to metallb-system/values.yaml From a63fe8cb3f5f47a5c73b28e86024c728fd239b32 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 05:10:12 -0500 Subject: [PATCH 0019/1058] update --- metallb-system/templates/config.yaml | 36 ++++++++++++++-------------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index 39121ce..ca50e52 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -1,19 +1,19 @@ -#apiVersion: v1 -#kind: ConfigMap -#metadata: -# namespace: metallb -# name: config -#data: -# config: | -# address-pools: -# - name: default -# protocol: layer2 -# addresses: -# - 192.168.10.130-192.168.10.140 -apiVersion: metallb.io/v1beta1 -kind: IPAddressPool +apiVersion: v1 +kind: ConfigMap metadata: - name: cheap -spec: - addresses: - - 192.168.10.0/24 + namespace: metallb + name: config +data: + config: | + address-pools: + - name: default + protocol: layer2 + addresses: + - 192.168.10.130-192.168.10.140 + #apiVersion: metallb.io/v1beta1 + #kind: IPAddressPool + #metadata: + # name: cheap + #spec: + # addresses: + # - 192.168.10.0/24 From 1a0458354b5f20f9a3d1429b893376d2d61a42a5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 05:10:37 -0500 Subject: [PATCH 0020/1058] update --- metallb-system/templates/config.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index ca50e52..830134b 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -1,7 +1,6 @@ apiVersion: v1 kind: ConfigMap metadata: - namespace: metallb name: config data: config: | From 6059303fcf793a6c914a5328b2d0b2be7c748332 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 05:11:27 -0500 Subject: [PATCH 0021/1058] update --- metallb-system/templates/config.yaml | 35 ++++++++++++++-------------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index 830134b..39121ce 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -1,18 +1,19 @@ -apiVersion: v1 -kind: ConfigMap +#apiVersion: v1 +#kind: ConfigMap +#metadata: +# namespace: metallb +# name: config +#data: +# config: | +# address-pools: +# - name: default +# protocol: layer2 +# addresses: +# - 192.168.10.130-192.168.10.140 +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool metadata: - name: config -data: - config: | - address-pools: - - name: default - protocol: layer2 - addresses: - - 192.168.10.130-192.168.10.140 - #apiVersion: metallb.io/v1beta1 - #kind: IPAddressPool - #metadata: - # name: cheap - #spec: - # addresses: - # - 192.168.10.0/24 + name: cheap +spec: + addresses: + - 192.168.10.0/24 From f69d3babfc0d9d963258770899f01157aadfbefb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 06:11:09 -0500 Subject: [PATCH 0022/1058] update --- metallb-system/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index 39121ce..9a5e1c8 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -16,4 +16,4 @@ metadata: name: cheap spec: addresses: - - 192.168.10.0/24 + - 192.168.10.128/28 From a669676e8b3ce276916d8ad886621b621977bada Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 May 2024 06:12:36 -0500 Subject: [PATCH 0023/1058] update --- metallb-system/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index 9a5e1c8..5fa424a 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -16,4 +16,4 @@ metadata: name: cheap spec: addresses: - - 192.168.10.128/28 + - 192.168.10.130-192.168.10.140 From bf6314e914d5dfe40440b20a0ed412ac1a92e4c9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 17 May 2024 04:52:41 -0500 Subject: [PATCH 0024/1058] update --- argocd/values.yaml | 2 +- internalproxy/templates/argocd.yaml | 6 +++--- metallb-system/templates/config.yaml | 12 ------------ 3 files changed, 4 insertions(+), 16 deletions(-) diff --git a/argocd/values.yaml b/argocd/values.yaml index 47a56e3..765b0bb 100644 --- a/argocd/values.yaml +++ b/argocd/values.yaml @@ -33,7 +33,7 @@ argo-cd: cm: create: true annotations: {} - url: https://argocd.internal.durp.info + url: https://argocd.dev.durp.info oidc.tls.insecure.skip.verify: "true" dex.config: | connectors: diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index 01d5862..dd232f3 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -8,7 +8,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`argocd.dev.internal.durp.info`) + - match: Host(`argocd.dev.durp.info`) middlewares: - name: whitelist namespace: traefik @@ -41,6 +41,6 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "argocd.dev.internal.durp.info" + commonName: "argocd.dev.durp.info" dnsNames: - - "argocd.dev.internal.durp.info" + - "argocd.dev.durp.info" diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index 5fa424a..dc31512 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -1,15 +1,3 @@ -#apiVersion: v1 -#kind: ConfigMap -#metadata: -# namespace: metallb -# name: config -#data: -# config: | -# address-pools: -# - name: default -# protocol: layer2 -# addresses: -# - 192.168.10.130-192.168.10.140 apiVersion: metallb.io/v1beta1 kind: IPAddressPool metadata: From 29136dd3953489a0dae5b1992d5e2867b34fd1a8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 17 May 2024 04:53:44 -0500 Subject: [PATCH 0025/1058] update --- internalproxy/templates/argocd.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index dd232f3..5c67ad4 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -17,8 +17,8 @@ spec: - name: argocd-server port: 443 scheme: https - tls: - secretName: argocd-tls + #tls: + # secretName: argocd-tls --- From 690c9e40c9c99481f0424dccec93d00495aec3e1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 17 May 2024 04:54:23 -0500 Subject: [PATCH 0026/1058] update --- internalproxy/templates/argocd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index 5c67ad4..2fa700e 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -6,7 +6,7 @@ metadata: cert-manager.io/cluster-issuer: letsencrypt-production spec: entryPoints: - - websecure + - web routes: - match: Host(`argocd.dev.durp.info`) middlewares: From 43160a8da1c1b43f0ae61a3a0b17450e52cd6895 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 17 May 2024 04:57:22 -0500 Subject: [PATCH 0027/1058] update --- ...prroduction.yaml => letsencrypt-production.yaml} | 2 +- cert-manager/templates/self-signed.yaml | 13 +++++++++++++ internalproxy/templates/argocd.yaml | 8 ++++---- 3 files changed, 18 insertions(+), 5 deletions(-) rename cert-manager/templates/{letsencrypt-prroduction.yaml => letsencrypt-production.yaml} (92%) create mode 100644 cert-manager/templates/self-signed.yaml diff --git a/cert-manager/templates/letsencrypt-prroduction.yaml b/cert-manager/templates/letsencrypt-production.yaml similarity index 92% rename from cert-manager/templates/letsencrypt-prroduction.yaml rename to cert-manager/templates/letsencrypt-production.yaml index 034ed9b..72a0064 100644 --- a/cert-manager/templates/letsencrypt-prroduction.yaml +++ b/cert-manager/templates/letsencrypt-production.yaml @@ -1,4 +1,4 @@ -apiVersion: cert-manager.io/v1 +piVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-production diff --git a/cert-manager/templates/self-signed.yaml b/cert-manager/templates/self-signed.yaml new file mode 100644 index 0000000..fa3ea4d --- /dev/null +++ b/cert-manager/templates/self-signed.yaml @@ -0,0 +1,13 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: selfsigned-issuer +spec: + selfSigned: {} +--- +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned-cluster-issuer +spec: + selfSigned: {} diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index 2fa700e..3760130 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -6,7 +6,7 @@ metadata: cert-manager.io/cluster-issuer: letsencrypt-production spec: entryPoints: - - web + - websecure routes: - match: Host(`argocd.dev.durp.info`) middlewares: @@ -17,8 +17,8 @@ spec: - name: argocd-server port: 443 scheme: https - #tls: - # secretName: argocd-tls + tls: + secretName: argocd-tls --- @@ -39,7 +39,7 @@ metadata: spec: secretName: argocd-tls issuerRef: - name: letsencrypt-production + name: selfsigned-cluster-issuer kind: ClusterIssuer commonName: "argocd.dev.durp.info" dnsNames: From 38846d58f3ebaa561148c2f9bff5c7fb380a0e4b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 17 May 2024 04:57:51 -0500 Subject: [PATCH 0028/1058] update --- cert-manager/templates/letsencrypt-production.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cert-manager/templates/letsencrypt-production.yaml b/cert-manager/templates/letsencrypt-production.yaml index 72a0064..034ed9b 100644 --- a/cert-manager/templates/letsencrypt-production.yaml +++ b/cert-manager/templates/letsencrypt-production.yaml @@ -1,4 +1,4 @@ -piVersion: cert-manager.io/v1 +apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: name: letsencrypt-production From 9f45c8b1450cc5d361a27f4a15b10fd6700019cb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 17 May 2024 05:07:52 -0500 Subject: [PATCH 0029/1058] update --- metallb-system/templates/config.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index dc31512..bb2fbd5 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -5,3 +5,12 @@ metadata: spec: addresses: - 192.168.10.130-192.168.10.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: poop + namespace: metallb-system +spec: + ipAddressPools: + - cheap From 2b4e117ba30ebec99cd617c37f53fe63c53a59d3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 17 May 2024 05:09:10 -0500 Subject: [PATCH 0030/1058] update --- traefik/templates/middlewares.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index aaf45ab..ec025a2 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -30,5 +30,6 @@ metadata: spec: ipWhiteList: sourceRange: + - 192.168.30.0/24 - 192.168.20.1/32 - 10.0.0.0/8 From 8568d5e4c05cdfa533cf31579ce07420ce56acf3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 07:08:59 -0500 Subject: [PATCH 0031/1058] update --- internalproxy/templates/argocd.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index 3760130..6aa67a1 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -8,7 +8,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`argocd.dev.durp.info`) + - match: Host(`argocd.internal.dev.durp.info`) middlewares: - name: whitelist namespace: traefik @@ -39,8 +39,8 @@ metadata: spec: secretName: argocd-tls issuerRef: - name: selfsigned-cluster-issuer + name: letsencrypt-production kind: ClusterIssuer - commonName: "argocd.dev.durp.info" + commonName: "argocd.internal.dev.durp.info" dnsNames: - - "argocd.dev.durp.info" + - "argocd.internal.dev.durp.info" From ec8afdb6bcbed6244501eda28d37e0ff9ce8947b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 07:14:11 -0500 Subject: [PATCH 0032/1058] update --- traefik/templates/middlewares.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index ec025a2..6560aa9 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -30,6 +30,5 @@ metadata: spec: ipWhiteList: sourceRange: - - 192.168.30.0/24 - - 192.168.20.1/32 + - 192.168.10.1/32 - 10.0.0.0/8 From d42cf229bfed883a75b35ea0c21c424ad68efb0b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 07:18:46 -0500 Subject: [PATCH 0033/1058] update --- traefik/templates/ingress.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/traefik/templates/ingress.yaml b/traefik/templates/ingress.yaml index a165566..8fb4d8d 100644 --- a/traefik/templates/ingress.yaml +++ b/traefik/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`traefik.internal.durp.info`) + - match: Host(`traefik.internal.dev.durp.info`) middlewares: - name: authentik-proxy-provider namespace: traefik @@ -14,7 +14,7 @@ spec: services: - name: api@internal kind: TraefikService - - match: Host(`traefik.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + - match: Host(`traefik.internal.dev.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) kind: Rule services: - name: ak-outpost-authentik-embedded-outpost @@ -34,6 +34,6 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "traefik.internal.durp.info" + commonName: "traefik.internal.dev.durp.info" dnsNames: - - "traefik.internal.durp.info" \ No newline at end of file + - "traefik.internal.dev.durp.info" From dd91465e449aa76f9e9f8a0aeda8451e7e32af95 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 07:33:42 -0500 Subject: [PATCH 0034/1058] update --- vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vault/values.yaml b/vault/values.yaml index d77a898..857f973 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -14,7 +14,7 @@ vault: injector: enabled: "-" - replicas: 3 + replicas: 2 leaderElector: enabled: true From d63ee6027d4f7a0e4e207044a8900e561ff2676e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 07:42:26 -0500 Subject: [PATCH 0035/1058] update --- nfs-client/templates/provisioner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nfs-client/templates/provisioner.yml b/nfs-client/templates/provisioner.yml index c76fe8c..c3c6eea 100644 --- a/nfs-client/templates/provisioner.yml +++ b/nfs-client/templates/provisioner.yml @@ -34,7 +34,7 @@ spec: - name: NFS_SERVER value: 192.168.20.253 - name: NFS_PATH - value: /mnt/user/k3s + value: /mnt/user/k3s-dev volumes: - name: nfs-client-ssd nfs: From 0aeccd39b8c251613278b4a9bd23b296f7a881ff Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 07:43:15 -0500 Subject: [PATCH 0036/1058] update --- nfs-client/templates/provisioner.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nfs-client/templates/provisioner.yml b/nfs-client/templates/provisioner.yml index c3c6eea..b79da69 100644 --- a/nfs-client/templates/provisioner.yml +++ b/nfs-client/templates/provisioner.yml @@ -39,4 +39,4 @@ spec: - name: nfs-client-ssd nfs: server: 192.168.20.253 - path: /mnt/user/k3s + path: /mnt/user/k3s-dev From fd9731b7e1d5d4b07296e8f251d3b6875ed50c03 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 07:45:43 -0500 Subject: [PATCH 0037/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index ced04ee..4389062 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -76,7 +76,7 @@ longhorn: snapshotterReplicaCount: ~ defaultSettings: - backupTarget: S3://longhorn@us-east-1/ + backupTarget: S3://longhorn-dev@us-east-1/ backupTargetCredentialSecret: longhorn-backup-token-secret allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ From 2fe3df9227bcadaa4d00af4a5fe9e69d6dd4f3ca Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 08:48:37 -0500 Subject: [PATCH 0038/1058] update --- external-dns/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external-dns/values.yaml b/external-dns/values.yaml index 4102088..76e1156 100644 --- a/external-dns/values.yaml +++ b/external-dns/values.yaml @@ -4,7 +4,7 @@ external-dns: image: pullPolicy: Always - + txtPrefix: "dev" sources: - service @@ -13,4 +13,4 @@ external-dns: secretName : "external-dns" proxied: true - policy: sync \ No newline at end of file + policy: sync From 6a57946a538b49078ea84db92599f56d127946ff Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 08:53:43 -0500 Subject: [PATCH 0039/1058] update --- external-dns/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external-dns/values.yaml b/external-dns/values.yaml index 76e1156..1e42393 100644 --- a/external-dns/values.yaml +++ b/external-dns/values.yaml @@ -4,7 +4,7 @@ external-dns: image: pullPolicy: Always - txtPrefix: "dev" + txtPrefix: "dev-" sources: - service From 54e51af63f2c978a9ceaa1369f0a5bbf7d499f41 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 08:57:04 -0500 Subject: [PATCH 0040/1058] update --- littlelink/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 5708501..c400477 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -39,4 +39,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: links.dev.durp.info spec: type: ExternalName - externalName: dev.durp.info + externalName: durp.info From ec8111c239acb5d68d3ae0536043ff2bbad63a60 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 18 May 2024 09:26:47 -0500 Subject: [PATCH 0041/1058] update --- external-dns/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external-dns/values.yaml b/external-dns/values.yaml index 1e42393..23e5315 100644 --- a/external-dns/values.yaml +++ b/external-dns/values.yaml @@ -11,6 +11,6 @@ external-dns: provider: cloudflare cloudflare: secretName : "external-dns" - proxied: true + proxied: false policy: sync From d0ec1a9909512d15638c21169e41e5877fdff934 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:36:12 -0500 Subject: [PATCH 0042/1058] update --- traefik/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/traefik/values.yaml b/traefik/values.yaml index 362a574..1f50a6e 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -502,6 +502,8 @@ traefik: - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin - --experimental.plugins.jwt.version=v0.7.0 + - --experimental.plugins.traefik-real-ip.moduleName=github.com/soulbalz/traefik-real-ip + - --experimental.plugins.traefik-real-ip.version=v1.0.3 # Environment variables to be passed to Traefik's binary From ce256ff51a7aaff0495de3a5e7529562e71ecce0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:38:52 -0500 Subject: [PATCH 0043/1058] update --- littlelink/templates/ingress.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index c400477..e19d285 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -8,6 +8,8 @@ spec: routes: - match: Host(`links.dev.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - name: traefik-real-ip services: - name: littlelink port: 80 @@ -40,3 +42,15 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: traefik-real-ip +spec: + plugin: + traefik-real-ip: + excludednets: + - "1.1.1.1/24" From 540a9c6f8a4d382b5abe2bde6eba25f1e7a0ed86 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:47:17 -0500 Subject: [PATCH 0044/1058] update --- durpapi/templates/ingress.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/durpapi/templates/ingress.yaml b/durpapi/templates/ingress.yaml index b722670..3d33391 100644 --- a/durpapi/templates/ingress.yaml +++ b/durpapi/templates/ingress.yaml @@ -10,6 +10,7 @@ spec: kind: Rule middlewares: - name: jwt + - name: traefik-real-ip services: - name: "durpapi-service" port: 80 @@ -42,3 +43,15 @@ spec: Required: true Keys: - https://authentik.durp.info/application/o/api/jwks + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: traefik-real-ip +spec: + plugin: + traefik-real-ip: + excludednets: + - "1.1.1.1/24" From f95e7539f0f1d3f1b0e7a148e3134f74247ebe49 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:47:54 -0500 Subject: [PATCH 0045/1058] update --- durpapi/templates/ingress.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/durpapi/templates/ingress.yaml b/durpapi/templates/ingress.yaml index 3d33391..d2cd7e2 100644 --- a/durpapi/templates/ingress.yaml +++ b/durpapi/templates/ingress.yaml @@ -9,7 +9,6 @@ spec: - match: Host("api.dev.durp.info") && PathPrefix(`/api`) kind: Rule middlewares: - - name: jwt - name: traefik-real-ip services: - name: "durpapi-service" From b03642cd1de813d980192fdb449db4a2825b379a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:49:33 -0500 Subject: [PATCH 0046/1058] update --- durpapi/templates/ingress.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/durpapi/templates/ingress.yaml b/durpapi/templates/ingress.yaml index d2cd7e2..3d33391 100644 --- a/durpapi/templates/ingress.yaml +++ b/durpapi/templates/ingress.yaml @@ -9,6 +9,7 @@ spec: - match: Host("api.dev.durp.info") && PathPrefix(`/api`) kind: Rule middlewares: + - name: jwt - name: traefik-real-ip services: - name: "durpapi-service" From 3babb5db29f2238cd2325a1ddbc6881930d6a8fd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:50:32 -0500 Subject: [PATCH 0047/1058] update --- littlelink/templates/ingress.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index e19d285..1469385 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -10,6 +10,7 @@ spec: kind: Rule middlewares: - name: traefik-real-ip + - name: whitelist services: - name: littlelink port: 80 @@ -54,3 +55,13 @@ spec: traefik-real-ip: excludednets: - "1.1.1.1/24" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: whitelist +spec: + ipWhiteList: + sourceRange: + - 192.168.10.1/32 + - 10.0.0.0/8 From 6ad1f067e45412aaa76ff3d1293df49295d86c74 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:54:06 -0500 Subject: [PATCH 0048/1058] update --- littlelink/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 1469385..7687e55 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -61,7 +61,7 @@ kind: Middleware metadata: name: whitelist spec: - ipWhiteList: + ipAllowList: sourceRange: - 192.168.10.1/32 - 10.0.0.0/8 From b7c14e18b26c1af31d44a512c928739f2e3624ce Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:54:35 -0500 Subject: [PATCH 0049/1058] update --- littlelink/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 7687e55..1469385 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -61,7 +61,7 @@ kind: Middleware metadata: name: whitelist spec: - ipAllowList: + ipWhiteList: sourceRange: - 192.168.10.1/32 - 10.0.0.0/8 From ca4d492882b1ec6dcd9683ec0b3bd49a5cfed169 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:55:17 -0500 Subject: [PATCH 0050/1058] update --- littlelink/templates/ingress.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 1469385..d9cf039 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -65,3 +65,5 @@ spec: sourceRange: - 192.168.10.1/32 - 10.0.0.0/8 + ipStrategy: + depth: 1 From 1b1d9178d3ffd97747f4e4c90738101aa0017cac Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 06:59:23 -0500 Subject: [PATCH 0051/1058] update --- littlelink/templates/ingress.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index d9cf039..1469385 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -65,5 +65,3 @@ spec: sourceRange: - 192.168.10.1/32 - 10.0.0.0/8 - ipStrategy: - depth: 1 From c45d239b8c88701aa15c4e27e0a3a5337b6945e4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:00:51 -0500 Subject: [PATCH 0052/1058] update --- littlelink/templates/ingress.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 1469385..b05e3be 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -9,7 +9,6 @@ spec: - match: Host(`links.dev.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - name: traefik-real-ip - name: whitelist services: - name: littlelink From 083bbe5af594f4c3cd6040500d01cf70c5501777 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:04:28 -0500 Subject: [PATCH 0053/1058] update --- traefik/values.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 1f50a6e..3692400 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -580,9 +580,10 @@ traefik: redirectTo: websecure # # Trust forwarded headers information (X-Forwarded-*). - # forwardedHeaders: - # trustedIPs: [] - # insecure: false + forwardedHeaders: + trustedIPs: + - "192.168.10.1" + insecure: false # # Enable the Proxy Protocol header parsing for the entry point # proxyProtocol: From d01ee2da248e3be61ba57694d317b38bf78ccbeb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:18:52 -0500 Subject: [PATCH 0054/1058] update --- traefik/values.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 3692400..3d304bc 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -611,9 +611,10 @@ traefik: # advertisedPort: 4443 # ## Trust forwarded headers information (X-Forwarded-*). - #forwardedHeaders: - # trustedIPs: [] - # insecure: false + forwardedHeaders: + trustedIPs: + - "192.168.10.1" + insecure: false # ## Enable the Proxy Protocol header parsing for the entry point #proxyProtocol: From db7e629fed811705b3af9fe3710d308ab9778508 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:25:59 -0500 Subject: [PATCH 0055/1058] update --- littlelink/templates/ingress.yaml | 11 ----------- traefik/templates/middlewares.yaml | 12 ++++++++++++ traefik/values.yaml | 1 + 3 files changed, 13 insertions(+), 11 deletions(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index b05e3be..f61efef 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -44,17 +44,6 @@ spec: externalName: durp.info --- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: traefik-real-ip -spec: - plugin: - traefik-real-ip: - excludednets: - - "1.1.1.1/24" ---- apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 6560aa9..13ca2bf 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -32,3 +32,15 @@ spec: sourceRange: - 192.168.10.1/32 - 10.0.0.0/8 + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: traefik-real-ip +spec: + plugin: + traefik-real-ip: + excludednets: + - "1.1.1.1/24" diff --git a/traefik/values.yaml b/traefik/values.yaml index 3d304bc..0816a51 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -643,6 +643,7 @@ traefik: # - namespace-name1@kubernetescrd # - namespace-name2@kubernetescrd middlewares: [] + - traefik@traefik-real-ip metrics: # When using hostNetwork, use another port to avoid conflict with node exporter: # https://github.com/prometheus/prometheus/wiki/Default-port-allocations From 1017d6a8345b83f400fcbf9cc1abcfe8a7df6a55 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:26:18 -0500 Subject: [PATCH 0056/1058] update --- traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 0816a51..ba4f47d 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -642,7 +642,7 @@ traefik: # middlewares: # - namespace-name1@kubernetescrd # - namespace-name2@kubernetescrd - middlewares: [] + middlewares: - traefik@traefik-real-ip metrics: # When using hostNetwork, use another port to avoid conflict with node exporter: From 8e585ed7b023001677708f60ff32a1c40eee738d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:27:58 -0500 Subject: [PATCH 0057/1058] update --- traefik/values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index ba4f47d..3d304bc 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -642,8 +642,7 @@ traefik: # middlewares: # - namespace-name1@kubernetescrd # - namespace-name2@kubernetescrd - middlewares: - - traefik@traefik-real-ip + middlewares: [] metrics: # When using hostNetwork, use another port to avoid conflict with node exporter: # https://github.com/prometheus/prometheus/wiki/Default-port-allocations From 81384297be4f35fbf54d711fec3c58a2ebfe8545 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:35:10 -0500 Subject: [PATCH 0058/1058] update --- littlelink/templates/ingress.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index f61efef..9ca5eca 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -10,6 +10,8 @@ spec: kind: Rule middlewares: - name: whitelist + - name: traefik-real-ip + namespace: traefik services: - name: littlelink port: 80 From b30297b9515681e45be8f8f918a16ea1f9a70286 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 07:36:05 -0500 Subject: [PATCH 0059/1058] update --- littlelink/templates/ingress.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 9ca5eca..cbf5b37 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -55,3 +55,5 @@ spec: sourceRange: - 192.168.10.1/32 - 10.0.0.0/8 + ipStrategy: + depth: 1 From bd9af607282bbfb4d727144783f3ca14de9fcc35 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:00:18 -0500 Subject: [PATCH 0060/1058] update --- littlelink/templates/ingress.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index cbf5b37..0bfdd1b 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -53,7 +53,8 @@ metadata: spec: ipWhiteList: sourceRange: - - 192.168.10.1/32 + - 192.168.10.1/32 + - 192.168.30.1/24 - 10.0.0.0/8 ipStrategy: depth: 1 From d6b5a05352afc9b68f90e32f256499558ee2a46f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:02:12 -0500 Subject: [PATCH 0061/1058] update --- littlelink/templates/ingress.yaml | 14 +------------- traefik/templates/middlewares.yaml | 6 ++++-- 2 files changed, 5 insertions(+), 15 deletions(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 0bfdd1b..42139f7 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -10,6 +10,7 @@ spec: kind: Rule middlewares: - name: whitelist + namespace: traefik - name: traefik-real-ip namespace: traefik services: @@ -45,16 +46,3 @@ spec: type: ExternalName externalName: durp.info ---- -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: whitelist -spec: - ipWhiteList: - sourceRange: - - 192.168.10.1/32 - - 192.168.30.1/24 - - 10.0.0.0/8 - ipStrategy: - depth: 1 diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 13ca2bf..13fad79 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -26,12 +26,14 @@ apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: name: whitelist - namespace: traefik spec: ipWhiteList: sourceRange: - - 192.168.10.1/32 + - 192.168.10.1/32 + - 192.168.30.0/24 - 10.0.0.0/8 + ipStrategy: + depth: 1 --- From 8461a4e81845b00fc7d283e97f4e0086352c5af9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:03:37 -0500 Subject: [PATCH 0062/1058] update --- traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 13fad79..4fbe8be 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -30,7 +30,7 @@ spec: ipWhiteList: sourceRange: - 192.168.10.1/32 - - 192.168.30.0/24 + - 192.168.30.1/24 - 10.0.0.0/8 ipStrategy: depth: 1 From 475ccd6576fa60dd6caf23230845158cd74ef113 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:06:59 -0500 Subject: [PATCH 0063/1058] update --- littlelink/templates/ingress.yaml | 4 +--- traefik/templates/middleware-chain.yaml | 9 +++++++++ 2 files changed, 10 insertions(+), 3 deletions(-) create mode 100644 traefik/templates/middleware-chain.yaml diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 42139f7..4a76e33 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -9,9 +9,7 @@ spec: - match: Host(`links.dev.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - name: whitelist - namespace: traefik - - name: traefik-real-ip + - name: internalOnly namespace: traefik services: - name: littlelink diff --git a/traefik/templates/middleware-chain.yaml b/traefik/templates/middleware-chain.yaml new file mode 100644 index 0000000..c38a5d5 --- /dev/null +++ b/traefik/templates/middleware-chain.yaml @@ -0,0 +1,9 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: internalOnly +spec: + chain: + middlewares: + - name: traefik-real-ip + - name: whitelist From bf6d929398486f6b52d8b8ea0715219d8319506d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:07:48 -0500 Subject: [PATCH 0064/1058] update --- littlelink/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 4a76e33..a294f68 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -9,7 +9,7 @@ spec: - match: Host(`links.dev.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - name: internalOnly + - name: internal-only namespace: traefik services: - name: littlelink From 6bebb64c41a4645c1d2855be571dc3867b8ae5e1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:08:17 -0500 Subject: [PATCH 0065/1058] update --- traefik/templates/middleware-chain.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/templates/middleware-chain.yaml b/traefik/templates/middleware-chain.yaml index c38a5d5..4f21880 100644 --- a/traefik/templates/middleware-chain.yaml +++ b/traefik/templates/middleware-chain.yaml @@ -1,7 +1,7 @@ apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: - name: internalOnly + name: internal-only spec: chain: middlewares: From ed970283aef85001f564d93cc7b97e04b450bb6b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:12:42 -0500 Subject: [PATCH 0066/1058] update --- argocd/templates/ingress.yaml | 36 +++++++++++++++++++++++++++++ internalproxy/templates/argocd.yaml | 2 +- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 argocd/templates/ingress.yaml diff --git a/argocd/templates/ingress.yaml b/argocd/templates/ingress.yaml new file mode 100644 index 0000000..11fa1bc --- /dev/null +++ b/argocd/templates/ingress.yaml @@ -0,0 +1,36 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: argocd-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`argocd.internal.dev.durp.info`) + middlewares: + - name: internal-only + namespace: traefik + kind: Rule + services: + - name: argocd-server + port: 443 + scheme: https + tls: + secretName: argocd-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: argocd-tls +spec: + secretName: argocd-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "argocd.internal.dev.durp.info" + dnsNames: + - "argocd.internal.dev.durp.info" diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index 6aa67a1..6e89858 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -10,7 +10,7 @@ spec: routes: - match: Host(`argocd.internal.dev.durp.info`) middlewares: - - name: whitelist + - name: internal-only namespace: traefik kind: Rule services: From 0d4ec2c08a6b3668d58709a8ee5eea2d5045e9dd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:13:28 -0500 Subject: [PATCH 0067/1058] update --- internalproxy/templates/argocd.yaml | 46 ----------------------------- 1 file changed, 46 deletions(-) delete mode 100644 internalproxy/templates/argocd.yaml diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml deleted file mode 100644 index 6e89858..0000000 --- a/internalproxy/templates/argocd.yaml +++ /dev/null @@ -1,46 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: argocd-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`argocd.internal.dev.durp.info`) - middlewares: - - name: internal-only - namespace: traefik - kind: Rule - services: - - name: argocd-server - port: 443 - scheme: https - tls: - secretName: argocd-tls - ---- - -kind: Service -apiVersion: v1 -metadata: - name: argocd-server -spec: - type: ExternalName - externalName: argocd-server.argocd.svc.cluster.local - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: argocd-tls -spec: - secretName: argocd-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "argocd.internal.dev.durp.info" - dnsNames: - - "argocd.internal.dev.durp.info" From 9c35356c5dfb425bde59a60b4d72b13e94118090 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:17:52 -0500 Subject: [PATCH 0068/1058] update --- littlelink/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index a294f68..04f4322 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -42,5 +42,5 @@ metadata: external-dns.alpha.kubernetes.io/hostname: links.dev.durp.info spec: type: ExternalName - externalName: durp.info + externalName: dev.durp.info From 1ef48ae879c0e9815284c2fa1b40d744f23d31a4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:19:42 -0500 Subject: [PATCH 0069/1058] update --- durpapi/templates/ingress.yaml | 12 ------------ krakend/templates/ingress.yaml | 2 +- 2 files changed, 1 insertion(+), 13 deletions(-) diff --git a/durpapi/templates/ingress.yaml b/durpapi/templates/ingress.yaml index 3d33391..80dd3d2 100644 --- a/durpapi/templates/ingress.yaml +++ b/durpapi/templates/ingress.yaml @@ -10,7 +10,6 @@ spec: kind: Rule middlewares: - name: jwt - - name: traefik-real-ip services: - name: "durpapi-service" port: 80 @@ -44,14 +43,3 @@ spec: Keys: - https://authentik.durp.info/application/o/api/jwks ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: traefik-real-ip -spec: - plugin: - traefik-real-ip: - excludednets: - - "1.1.1.1/24" diff --git a/krakend/templates/ingress.yaml b/krakend/templates/ingress.yaml index 4b42ba3..127c616 100644 --- a/krakend/templates/ingress.yaml +++ b/krakend/templates/ingress.yaml @@ -40,7 +40,7 @@ metadata: external-dns.alpha.kubernetes.io/hostname: api.dev.durp.info spec: type: ExternalName - externalName: durp.info + externalName: dev.durp.info --- From a0f384a42885c1da323d6e1880b22e6e2155c8d1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 May 2024 08:40:40 -0500 Subject: [PATCH 0070/1058] update --- littlelink/templates/ingress.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml index 04f4322..1cf7211 100644 --- a/littlelink/templates/ingress.yaml +++ b/littlelink/templates/ingress.yaml @@ -8,9 +8,6 @@ spec: routes: - match: Host(`links.dev.durp.info`) && PathPrefix(`/`) kind: Rule - middlewares: - - name: internal-only - namespace: traefik services: - name: littlelink port: 80 From f349a1c43abc88a66d7883011bcc40c57dde9f00 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 May 2024 04:49:54 -0500 Subject: [PATCH 0071/1058] update --- longhorn/templates/ingress.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/longhorn/templates/ingress.yaml b/longhorn/templates/ingress.yaml index 7f67dec..d67e620 100644 --- a/longhorn/templates/ingress.yaml +++ b/longhorn/templates/ingress.yaml @@ -10,8 +10,8 @@ spec: middlewares: - name: whitelist namespace: traefik - - name: authentik-proxy-provider - namespace: traefik + #- name: authentik-proxy-provider + # namespace: traefik kind: Rule services: - name: longhorn-frontend From 9e1debe339b99c72021387c0a30c5abc7f42fcf6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 May 2024 04:54:11 -0500 Subject: [PATCH 0072/1058] update --- authentik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authentik/values.yaml b/authentik/values.yaml index bd03ad1..9f470a5 100644 --- a/authentik/values.yaml +++ b/authentik/values.yaml @@ -1,7 +1,7 @@ authentik: global: env: - - name: AUTHENTIK_POSTGRESQL__PASSWORD + - name: AUTHENTIK_POSTGRESQL_PASSWORD valueFrom: secretKeyRef: name: db-pass From 43486b4ab42bc6e5b00e6b6f0ed3c85d83a9df9e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 May 2024 04:58:42 -0500 Subject: [PATCH 0073/1058] update --- authentik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authentik/values.yaml b/authentik/values.yaml index 9f470a5..bd03ad1 100644 --- a/authentik/values.yaml +++ b/authentik/values.yaml @@ -1,7 +1,7 @@ authentik: global: env: - - name: AUTHENTIK_POSTGRESQL_PASSWORD + - name: AUTHENTIK_POSTGRESQL__PASSWORD valueFrom: secretKeyRef: name: db-pass From 1e19df0c7a8b653ff9dc83ae4eace6bf867c18d7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 24 May 2024 05:01:05 -0500 Subject: [PATCH 0074/1058] update --- authentik/values.yaml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/authentik/values.yaml b/authentik/values.yaml index bd03ad1..a749b15 100644 --- a/authentik/values.yaml +++ b/authentik/values.yaml @@ -32,9 +32,16 @@ authentik: registry: registry.internal.durp.info repository: bitnami/postgresql pullPolicy: Always - postgresqlUsername: "authentik" - postgresqlDatabase: "authentik" - existingSecret: db-pass + auth: + username: "authentik" + existingSecret: db-pass + secretKeys: + adminPasswordKey: dbpass + userPasswordKey: dbpass + + #postgresqlUsername: "authentik" + #postgresqlDatabase: "authentik" + #existingSecret: db-pass persistence: enabled: true storageClass: longhorn From 5915b5b7a343e8298b84bd47b104d633b8115f5b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 25 May 2024 07:21:53 -0500 Subject: [PATCH 0075/1058] update --- authentik/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/authentik/values.yaml b/authentik/values.yaml index a749b15..35117da 100644 --- a/authentik/values.yaml +++ b/authentik/values.yaml @@ -1,6 +1,8 @@ authentik: global: env: + - name: AUTHENTIK_REDIS__DB + value: 1 - name: AUTHENTIK_POSTGRESQL__PASSWORD valueFrom: secretKeyRef: From 2256f76caa43114d1f826346bded9b79a2b660c0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 25 May 2024 07:22:52 -0500 Subject: [PATCH 0076/1058] update --- authentik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authentik/values.yaml b/authentik/values.yaml index 35117da..ecc79d1 100644 --- a/authentik/values.yaml +++ b/authentik/values.yaml @@ -2,7 +2,7 @@ authentik: global: env: - name: AUTHENTIK_REDIS__DB - value: 1 + value: "1" - name: AUTHENTIK_POSTGRESQL__PASSWORD valueFrom: secretKeyRef: From f4f02d9147f72ada202fdb1d854b6a250fe88e05 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 25 May 2024 08:33:40 -0500 Subject: [PATCH 0077/1058] update --- bitwarden/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bitwarden/templates/deployment.yaml b/bitwarden/templates/deployment.yaml index d6e1788..4789083 100644 --- a/bitwarden/templates/deployment.yaml +++ b/bitwarden/templates/deployment.yaml @@ -39,7 +39,7 @@ spec: value: "80" - name: ROCKET_WORKERS value: "10" - - name: SECRET_USERNAME + - name: ADMIN_TOKEN valueFrom: secretKeyRef: name: bitwarden-secret From 338e3c23c22428f44e90ffba9963cd6ae4072588 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 25 May 2024 08:43:43 -0500 Subject: [PATCH 0078/1058] update --- bitwarden/templates/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bitwarden/templates/deployment.yaml b/bitwarden/templates/deployment.yaml index 4789083..9a78d07 100644 --- a/bitwarden/templates/deployment.yaml +++ b/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.internal.durp.info/vaultwarden/server:1.30.3 + image: registry.internal.durp.info/vaultwarden/server:1.30.5 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc @@ -28,7 +28,7 @@ spec: containerPort: 80 env: - name: SIGNUPS_ALLOWED - value: "FALSE" + value: "TRUE" - name: INVITATIONS_ALLOWED value: "FALSE" - name: WEBSOCKET_ENABLED From 78e6bd6b8e88aed2785fc16a979db17fb53d0477 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 25 May 2024 08:48:13 -0500 Subject: [PATCH 0079/1058] update --- bitwarden/templates/ingress.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bitwarden/templates/ingress.yaml b/bitwarden/templates/ingress.yaml index 49cfa24..1bd001f 100644 --- a/bitwarden/templates/ingress.yaml +++ b/bitwarden/templates/ingress.yaml @@ -36,7 +36,7 @@ apiVersion: v1 metadata: name: bitwarden-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info + external-dns.alpha.kubernetes.io/hostname: bitwarden.dev.durp.info spec: type: ExternalName - externalName: durp.info + externalName: dev.durp.info From 6aaafd3a7e4863c2926bbabc8869752a6c194501 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 25 May 2024 10:55:13 -0500 Subject: [PATCH 0080/1058] update --- bitwarden/templates/ingress.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/bitwarden/templates/ingress.yaml b/bitwarden/templates/ingress.yaml index 1bd001f..011ad8a 100644 --- a/bitwarden/templates/ingress.yaml +++ b/bitwarden/templates/ingress.yaml @@ -40,3 +40,24 @@ metadata: spec: type: ExternalName externalName: dev.durp.info + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: bitwarden-admin-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`bitwarden.dev.durp.info`) && PathPrefix(`/admin`) + kind: Rule + middlewares: + - name: whitelist + namespace: traefik + services: + - name: bitwarden + port: 80 + tls: + secretName: bitwarden-tls From 8a3104684e2b002d35b10c5b9fad605fdd104c55 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 25 May 2024 18:18:18 -0500 Subject: [PATCH 0081/1058] update --- argocd/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/argocd/values.yaml b/argocd/values.yaml index 765b0bb..c91ada3 100644 --- a/argocd/values.yaml +++ b/argocd/values.yaml @@ -38,8 +38,8 @@ argo-cd: dex.config: | connectors: - config: - issuer: https://authentik.durp.info/application/o/argocd/ - clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625 + issuer: https://authentik.dev.durp.info/application/o/argocd/ + clientID: lKuMgyYaOlQMNAUSjsRVYgkwZG9UT6CeFWeTLAcl clientSecret: $client-secret:clientSecret insecureEnableGroups: true scopes: From 30331572e53f8b90d7869e54506b070fa86dafe7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 29 May 2024 02:21:27 +0000 Subject: [PATCH 0082/1058] Update Chart --- durpapi/Chart.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 07593b9..23a6be3 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -version: 0.1.0-dev0144 -apiVersion: v2 -name: durpapi -dependencies: -- version: 12.5.* - condition: postgresql.enabled - name: postgresql - repository: https://charts.bitnami.com/bitnami -description: A Helm chart for Kubernetes type: application appVersion: 0.1.0 +description: A Helm chart for Kubernetes +name: durpapi +dependencies: +- condition: postgresql.enabled + version: 12.5.* + repository: https://charts.bitnami.com/bitnami + name: postgresql +apiVersion: v2 +version: test From f761405a7fefdcc73daf84e03eaeb053481cb3ae Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 02:25:50 +0000 Subject: [PATCH 0083/1058] Update Chart --- durpapi/Chart.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 07593b9..a3f04be 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -version: 0.1.0-dev0144 +appVersion: 0.1.0 +type: application +description: A Helm chart for Kubernetes +version: apiVersion: v2 name: durpapi dependencies: -- version: 12.5.* - condition: postgresql.enabled - name: postgresql +- name: postgresql repository: https://charts.bitnami.com/bitnami -description: A Helm chart for Kubernetes -type: application -appVersion: 0.1.0 + condition: postgresql.enabled + version: 12.5.* From 01c8cd9e38896af7fea759c360a38358bd6714c7 Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 02:29:24 +0000 Subject: [PATCH 0084/1058] Update Chart --- durpapi/Chart.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index a3f04be..dc1c20c 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -appVersion: 0.1.0 -type: application description: A Helm chart for Kubernetes -version: -apiVersion: v2 -name: durpapi +appVersion: 0.1.0 dependencies: - name: postgresql - repository: https://charts.bitnami.com/bitnami condition: postgresql.enabled version: 12.5.* + repository: https://charts.bitnami.com/bitnami +apiVersion: v2 +version: +name: durpapi +type: application From ef8c5e6ba2f60e037b36e3f3d0b7a97bb1e3c8d9 Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 02:45:48 +0000 Subject: [PATCH 0085/1058] Update Chart --- durpapi/Chart.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index dc1c20c..184a86a 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -description: A Helm chart for Kubernetes +name: durpapi +apiVersion: v2 +version: 0.1.0-dev0175 appVersion: 0.1.0 +type: application dependencies: - name: postgresql condition: postgresql.enabled version: 12.5.* repository: https://charts.bitnami.com/bitnami -apiVersion: v2 -version: -name: durpapi -type: application +description: A Helm chart for Kubernetes From 3254fda22627355797f4efa183fe69e5fea2683a Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 03:01:14 +0000 Subject: [PATCH 0086/1058] Update Chart --- durpapi/Chart.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 184a86a..e0207d2 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -name: durpapi -apiVersion: v2 -version: 0.1.0-dev0175 appVersion: 0.1.0 type: application +name: durpapi +version: 0.1.0-dev0176 +apiVersion: v2 +description: A Helm chart for Kubernetes dependencies: - name: postgresql - condition: postgresql.enabled - version: 12.5.* repository: https://charts.bitnami.com/bitnami -description: A Helm chart for Kubernetes + version: 12.5.* + condition: postgresql.enabled From 911398e73f0b66a58fc80c8cf62c7ffaa6d838d9 Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 03:06:48 +0000 Subject: [PATCH 0087/1058] Update Chart --- durpapi/Chart.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index e0207d2..1ef5590 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -appVersion: 0.1.0 -type: application +version: 0.1.0-dev0177 +dependencies: +- repository: https://charts.bitnami.com/bitnami + condition: postgresql.enabled + version: 12.5.* + name: postgresql name: durpapi -version: 0.1.0-dev0176 +type: application +appVersion: 0.1.0 apiVersion: v2 description: A Helm chart for Kubernetes -dependencies: -- name: postgresql - repository: https://charts.bitnami.com/bitnami - version: 12.5.* - condition: postgresql.enabled From 3b05002fcfb8fc56f81c0fb2a2a8f6f0664160fc Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 03:16:45 +0000 Subject: [PATCH 0088/1058] Update Chart --- durpapi/Chart.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 1ef5590..8f552d2 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -version: 0.1.0-dev0177 -dependencies: -- repository: https://charts.bitnami.com/bitnami - condition: postgresql.enabled - version: 12.5.* - name: postgresql +version: 0.1.0-dev0178 name: durpapi +dependencies: +- version: 12.5.* + condition: postgresql.enabled + name: postgresql + repository: https://charts.bitnami.com/bitnami +apiVersion: v2 type: application appVersion: 0.1.0 -apiVersion: v2 description: A Helm chart for Kubernetes From 5811b6ecbfb7d49dd3eb9651e463573739c3ed86 Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 03:22:44 +0000 Subject: [PATCH 0089/1058] Update Chart --- durpapi/Chart.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 8f552d2..864fda9 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -version: 0.1.0-dev0178 +appVersion: 0.1.0 +type: application +description: A Helm chart for Kubernetes name: durpapi dependencies: -- version: 12.5.* +- repository: https://charts.bitnami.com/bitnami condition: postgresql.enabled + version: 12.5.* name: postgresql - repository: https://charts.bitnami.com/bitnami apiVersion: v2 -type: application -appVersion: 0.1.0 -description: A Helm chart for Kubernetes +version: 0.1.0-dev0180 From 6c3e9ba78172c74582b047e61277db9b61889633 Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 29 May 2024 03:27:44 +0000 Subject: [PATCH 0090/1058] Update Chart --- durpapi/Chart.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 864fda9..ef8dd0b 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -appVersion: 0.1.0 -type: application description: A Helm chart for Kubernetes -name: durpapi dependencies: -- repository: https://charts.bitnami.com/bitnami +- version: 12.5.* + repository: https://charts.bitnami.com/bitnami condition: postgresql.enabled - version: 12.5.* name: postgresql -apiVersion: v2 version: 0.1.0-dev0180 +type: application +name: durpapi +apiVersion: v2 +appVersion: 0.1.0 From 6d7e5d6956acf1dc8024dfee0ea9452a12ede3fd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Jun 2024 13:32:27 -0500 Subject: [PATCH 0091/1058] update --- crossplane/Chart.yaml | 2 +- crossplane/values.yaml | 186 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 187 insertions(+), 1 deletion(-) create mode 100644 crossplane/values.yaml diff --git a/crossplane/Chart.yaml b/crossplane/Chart.yaml index c7bf1ab..d8f781c 100644 --- a/crossplane/Chart.yaml +++ b/crossplane/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: crossplane repository: https://charts.crossplane.io/stable - version: 1.12.0 + version: 1.16.0 diff --git a/crossplane/values.yaml b/crossplane/values.yaml new file mode 100644 index 0000000..6a319f2 --- /dev/null +++ b/crossplane/values.yaml @@ -0,0 +1,186 @@ +# helm-docs renders these comments into markdown. Use markdown formatting where +# appropiate. +# +# -- The number of Crossplane pod `replicas` to deploy. +replicas: 1 + +# -- The deployment strategy for the Crossplane and RBAC Manager pods. +deploymentStrategy: RollingUpdate + +image: + # -- Repository for the Crossplane pod image. + repository: xpkg.upbound.io/crossplane/crossplane + # -- The Crossplane image tag. Defaults to the value of `appVersion` in `Chart.yaml`. + tag: "" + # -- The image pull policy used for Crossplane and RBAC Manager pods. + pullPolicy: IfNotPresent + +# -- Add `nodeSelectors` to the Crossplane pod deployment. +nodeSelector: {} +# -- Add `tolerations` to the Crossplane pod deployment. +tolerations: [] +# -- Add `affinities` to the Crossplane pod deployment. +affinity: {} + +# -- Enable `hostNetwork` for the Crossplane deployment. Caution: enabling `hostNetwork` grants the Crossplane Pod access to the host network namespace. Consider setting `dnsPolicy` to `ClusterFirstWithHostNet`. +hostNetwork: false + +# -- Specify the `dnsPolicy` to be used by the Crossplane pod. +dnsPolicy: "" + +# -- Add custom `labels` to the Crossplane pod deployment. +customLabels: {} + +# -- Add custom `annotations` to the Crossplane pod deployment. +customAnnotations: {} + +serviceAccount: + # -- Add custom `annotations` to the Crossplane ServiceAccount. + customAnnotations: {} + +# -- Enable [leader election](https://docs.crossplane.io/latest/concepts/pods/#leader-election) for the Crossplane pod. +leaderElection: true +# -- Add custom arguments to the Crossplane pod. +args: [] + +provider: + # -- A list of Provider packages to install. + packages: [] + +configuration: + # -- A list of Configuration packages to install. + packages: [] + +function: + # -- A list of Function packages to install + packages: [] + +# -- The imagePullSecret names to add to the Crossplane ServiceAccount. +imagePullSecrets: [] + +registryCaBundleConfig: + # -- The ConfigMap name containing a custom CA bundle to enable fetching packages from registries with unknown or untrusted certificates. + name: "" + # -- The ConfigMap key containing a custom CA bundle to enable fetching packages from registries with unknown or untrusted certificates. + key: "" + +service: + # -- Configure annotations on the service object. Only enabled when webhooks.enabled = true + customAnnotations: {} + +webhooks: + # -- Enable webhooks for Crossplane and installed Provider packages. + enabled: true + +rbacManager: + # -- Deploy the RBAC Manager pod and its required roles. + deploy: true + # -- Don't install aggregated Crossplane ClusterRoles. + skipAggregatedClusterRoles: false + # -- The number of RBAC Manager pod `replicas` to deploy. + replicas: 1 + # -- Enable [leader election](https://docs.crossplane.io/latest/concepts/pods/#leader-election) for the RBAC Manager pod. + leaderElection: true + # -- Add custom arguments to the RBAC Manager pod. + args: [] + # -- Add `nodeSelectors` to the RBAC Manager pod deployment. + nodeSelector: {} + # -- Add `tolerations` to the RBAC Manager pod deployment. + tolerations: [] + # -- Add `affinities` to the RBAC Manager pod deployment. + affinity: {} + +# -- The PriorityClass name to apply to the Crossplane and RBAC Manager pods. +priorityClassName: "" + +resourcesCrossplane: + limits: + # -- CPU resource limits for the Crossplane pod. + cpu: 500m + # -- Memory resource limits for the Crossplane pod. + memory: 1024Mi + requests: + # -- CPU resource requests for the Crossplane pod. + cpu: 100m + # -- Memory resource requests for the Crossplane pod. + memory: 256Mi + +securityContextCrossplane: + # -- The user ID used by the Crossplane pod. + runAsUser: 65532 + # -- The group ID used by the Crossplane pod. + runAsGroup: 65532 + # -- Enable `allowPrivilegeEscalation` for the Crossplane pod. + allowPrivilegeEscalation: false + # -- Set the Crossplane pod root file system as read-only. + readOnlyRootFilesystem: true + +packageCache: + # -- Set to `Memory` to hold the package cache in a RAM backed file system. Useful for Crossplane development. + medium: "" + # -- The size limit for the package cache. If medium is `Memory` the `sizeLimit` can't exceed Node memory. + sizeLimit: 20Mi + # -- The name of a PersistentVolumeClaim to use as the package cache. Disables the default package cache `emptyDir` Volume. + pvc: "" + # -- The name of a ConfigMap to use as the package cache. Disables the default package cache `emptyDir` Volume. + configMap: "" + +resourcesRBACManager: + limits: + # -- CPU resource limits for the RBAC Manager pod. + cpu: 100m + # -- Memory resource limits for the RBAC Manager pod. + memory: 512Mi + requests: + # -- CPU resource requests for the RBAC Manager pod. + cpu: 100m + # -- Memory resource requests for the RBAC Manager pod. + memory: 256Mi + +securityContextRBACManager: + # -- The user ID used by the RBAC Manager pod. + runAsUser: 65532 + # -- The group ID used by the RBAC Manager pod. + runAsGroup: 65532 + # -- Enable `allowPrivilegeEscalation` for the RBAC Manager pod. + allowPrivilegeEscalation: false + # -- Set the RBAC Manager pod root file system as read-only. + readOnlyRootFilesystem: true + +metrics: + # -- Enable Prometheus path, port and scrape annotations and expose port 8080 for both the Crossplane and RBAC Manager pods. + enabled: false + +# -- Add custom environmental variables to the Crossplane pod deployment. +# Replaces any `.` in a variable name with `_`. For example, `SAMPLE.KEY=value1` becomes `SAMPLE_KEY=value1`. +extraEnvVarsCrossplane: {} + +# -- Add custom environmental variables to the RBAC Manager pod deployment. +# Replaces any `.` in a variable name with `_`. For example, `SAMPLE.KEY=value1` becomes `SAMPLE_KEY=value1`. +extraEnvVarsRBACManager: {} + +# -- Add a custom `securityContext` to the Crossplane pod. +podSecurityContextCrossplane: {} + +# -- Add a custom `securityContext` to the RBAC Manager pod. +podSecurityContextRBACManager: {} + +# -- Add custom `volumes` to the Crossplane pod. +extraVolumesCrossplane: {} + +# -- Add custom `volumeMounts` to the Crossplane pod. +extraVolumeMountsCrossplane: {} + +# -- To add arbitrary Kubernetes Objects during a Helm Install +extraObjects: [] + # - apiVersion: pkg.crossplane.io/v1alpha1 + # kind: ControllerConfig + # metadata: + # name: aws-config + # annotations: + # eks.amazonaws.com/role-arn: arn:aws:iam::123456789101:role/example + # helm.sh/hook: post-install + # spec: + # podSecurityContext: + # fsGroup: 2000 + From 2978aee67a1690463bd25839f6cb624a6ecabdcc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Jun 2024 13:32:58 -0500 Subject: [PATCH 0092/1058] update --- crossplane/templates/gitlab.yml | 46 ++++++++++++++++----------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/crossplane/templates/gitlab.yml b/crossplane/templates/gitlab.yml index 3a20b9c..e89f80a 100644 --- a/crossplane/templates/gitlab.yml +++ b/crossplane/templates/gitlab.yml @@ -1,26 +1,26 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-gitlab -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 ---- - -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: accesstoken - remoteRef: - key: secrets/gitlab/token - property: accesstoken +#apiVersion: pkg.crossplane.io/v1 +#kind: Provider +#metadata: +# name: provider-gitlab +#spec: +# package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 +#--- +# +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: gitlab-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: gitlab-secret +# data: +# - secretKey: accesstoken +# remoteRef: +# key: secrets/gitlab/token +# property: accesstoken --- From cb2798e20153be4b56ec36e9470fa1be97141f90 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Jun 2024 13:36:03 -0500 Subject: [PATCH 0093/1058] update --- crossplane/templates/gitlab.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/crossplane/templates/gitlab.yml b/crossplane/templates/gitlab.yml index e89f80a..d655ea5 100644 --- a/crossplane/templates/gitlab.yml +++ b/crossplane/templates/gitlab.yml @@ -1,9 +1,9 @@ -#apiVersion: pkg.crossplane.io/v1 -#kind: Provider -#metadata: -# name: provider-gitlab -#spec: -# package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-gitlab +spec: + package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.7.0 #--- # #apiVersion: external-secrets.io/v1beta1 From 01e75840d3b484da82b562d24b9e6686e0ff93e8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Jun 2024 13:40:49 -0500 Subject: [PATCH 0094/1058] update --- crossplane/templates/gitlab.yml | 34 ++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/crossplane/templates/gitlab.yml b/crossplane/templates/gitlab.yml index d655ea5..ea1dbdf 100644 --- a/crossplane/templates/gitlab.yml +++ b/crossplane/templates/gitlab.yml @@ -4,23 +4,23 @@ metadata: name: provider-gitlab spec: package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.7.0 -#--- -# -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: gitlab-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: gitlab-secret -# data: -# - secretKey: accesstoken -# remoteRef: -# key: secrets/gitlab/token -# property: accesstoken +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: accesstoken + remoteRef: + key: secrets/gitlab/token + property: accesstoken --- From f6da30f4f4b17b402b5161804962dbff4c427394 Mon Sep 17 00:00:00 2001 From: pipeline Date: Sun, 16 Jun 2024 23:34:26 +0000 Subject: [PATCH 0095/1058] Update Chart --- durpapi/Chart.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index ef8dd0b..e1b1c70 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ +version: 0.1.0-dev0182 description: A Helm chart for Kubernetes -dependencies: -- version: 12.5.* - repository: https://charts.bitnami.com/bitnami - condition: postgresql.enabled - name: postgresql -version: 0.1.0-dev0180 type: application name: durpapi -apiVersion: v2 appVersion: 0.1.0 +apiVersion: v2 +dependencies: +- condition: postgresql.enabled + version: 12.5.* + repository: https://charts.bitnami.com/bitnami + name: postgresql From 750889d58cfb67d267a8191ddd57436328090ac0 Mon Sep 17 00:00:00 2001 From: pipeline Date: Sat, 22 Jun 2024 17:50:38 +0000 Subject: [PATCH 0096/1058] Update Chart --- durpapi/Chart.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index e1b1c70..da481fe 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -version: 0.1.0-dev0182 -description: A Helm chart for Kubernetes -type: application name: durpapi +type: application appVersion: 0.1.0 -apiVersion: v2 dependencies: -- condition: postgresql.enabled +- name: postgresql version: 12.5.* repository: https://charts.bitnami.com/bitnami - name: postgresql + condition: postgresql.enabled +description: A Helm chart for Kubernetes +version: 0.1.0-dev0183 +apiVersion: v2 From 1bab20668d8a54c27e73958440d4f44c52bd3279 Mon Sep 17 00:00:00 2001 From: pipeline Date: Sun, 14 Jul 2024 23:09:00 +0000 Subject: [PATCH 0097/1058] Update Chart --- durpapi/Chart.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index da481fe..5a5784e 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ +description: A Helm chart for Kubernetes name: durpapi -type: application appVersion: 0.1.0 dependencies: -- name: postgresql +- condition: postgresql.enabled + name: postgresql version: 12.5.* repository: https://charts.bitnami.com/bitnami - condition: postgresql.enabled -description: A Helm chart for Kubernetes -version: 0.1.0-dev0183 +version: 0.1.0-dev0184 apiVersion: v2 +type: application From 40e98020bb8a9a10a1d3fa8c94583c04c2933f06 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 21 Jul 2024 08:47:10 -0500 Subject: [PATCH 0098/1058] update --- .gitignore | 1 + argocd/templates/InternalProxy.yaml | 2 +- argocd/templates/argocd.yaml | 2 +- argocd/templates/authentik.yaml | 2 +- argocd/templates/bitwarden.yaml | 2 +- argocd/templates/cert-manager.yaml | 2 +- argocd/templates/crossplane.yml | 2 +- argocd/templates/durpapi.yaml | 2 +- argocd/templates/durpot.yaml | 2 +- argocd/templates/external-dns.yaml | 2 +- argocd/templates/external-secrets.yaml | 2 +- argocd/templates/gatekeeper.yaml | 2 +- argocd/templates/gitlab-runner.yaml | 2 +- argocd/templates/heimdall.yaml | 2 +- argocd/templates/krakend.yaml | 2 +- argocd/templates/kube-prometheus-stack.yaml | 2 +- argocd/templates/kubeclarity.yaml | 2 +- argocd/templates/littlelink.yaml | 2 +- argocd/templates/longhorn.yaml | 2 +- argocd/templates/nfs-client.yaml | 2 +- argocd/templates/open-webui.yaml | 2 +- argocd/templates/traefik.yaml | 2 +- argocd/templates/uptimekuma.yaml | 2 +- argocd/templates/vault.yaml | 2 +- 24 files changed, 24 insertions(+), 23 deletions(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..485dee6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.idea diff --git a/argocd/templates/InternalProxy.yaml b/argocd/templates/InternalProxy.yaml index da6a5ae..1769a19 100644 --- a/argocd/templates/InternalProxy.yaml +++ b/argocd/templates/InternalProxy.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: internalproxy directory: recurse: true diff --git a/argocd/templates/argocd.yaml b/argocd/templates/argocd.yaml index ba2c019..d8f0fd3 100644 --- a/argocd/templates/argocd.yaml +++ b/argocd/templates/argocd.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: argocd destination: namespace: argocd diff --git a/argocd/templates/authentik.yaml b/argocd/templates/authentik.yaml index e0fa9e6..735fa1a 100644 --- a/argocd/templates/authentik.yaml +++ b/argocd/templates/authentik.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: authentik destination: namespace: authentik diff --git a/argocd/templates/bitwarden.yaml b/argocd/templates/bitwarden.yaml index e633437..6aad52f 100644 --- a/argocd/templates/bitwarden.yaml +++ b/argocd/templates/bitwarden.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: bitwarden directory: recurse: true diff --git a/argocd/templates/cert-manager.yaml b/argocd/templates/cert-manager.yaml index 2e959f8..1eb8fe2 100644 --- a/argocd/templates/cert-manager.yaml +++ b/argocd/templates/cert-manager.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: cert-manager destination: namespace: cert-manager diff --git a/argocd/templates/crossplane.yml b/argocd/templates/crossplane.yml index a109f1c..e079c78 100644 --- a/argocd/templates/crossplane.yml +++ b/argocd/templates/crossplane.yml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: crossplane destination: namespace: crossplane diff --git a/argocd/templates/durpapi.yaml b/argocd/templates/durpapi.yaml index e8f0eaa..53c2db6 100644 --- a/argocd/templates/durpapi.yaml +++ b/argocd/templates/durpapi.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: durpapi destination: namespace: durpapi diff --git a/argocd/templates/durpot.yaml b/argocd/templates/durpot.yaml index 22001b3..1bfcd37 100644 --- a/argocd/templates/durpot.yaml +++ b/argocd/templates/durpot.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: durpot destination: namespace: durpot diff --git a/argocd/templates/external-dns.yaml b/argocd/templates/external-dns.yaml index 77e9a78..ba05f2c 100644 --- a/argocd/templates/external-dns.yaml +++ b/argocd/templates/external-dns.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: external-dns destination: namespace: external-dns diff --git a/argocd/templates/external-secrets.yaml b/argocd/templates/external-secrets.yaml index aa8483f..cf8a595 100644 --- a/argocd/templates/external-secrets.yaml +++ b/argocd/templates/external-secrets.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: external-secrets destination: namespace: external-secrets diff --git a/argocd/templates/gatekeeper.yaml b/argocd/templates/gatekeeper.yaml index edbf240..5c60c12 100644 --- a/argocd/templates/gatekeeper.yaml +++ b/argocd/templates/gatekeeper.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: gatekeeper destination: namespace: gatekeeper diff --git a/argocd/templates/gitlab-runner.yaml b/argocd/templates/gitlab-runner.yaml index 08494ba..c5539d7 100644 --- a/argocd/templates/gitlab-runner.yaml +++ b/argocd/templates/gitlab-runner.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: gitlab-runner destination: namespace: gitlab-runner diff --git a/argocd/templates/heimdall.yaml b/argocd/templates/heimdall.yaml index d668561..d695e34 100644 --- a/argocd/templates/heimdall.yaml +++ b/argocd/templates/heimdall.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: heimdall destination: namespace: heimdall diff --git a/argocd/templates/krakend.yaml b/argocd/templates/krakend.yaml index 6c86d0a..68a57d1 100644 --- a/argocd/templates/krakend.yaml +++ b/argocd/templates/krakend.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: krakend destination: namespace: krakend diff --git a/argocd/templates/kube-prometheus-stack.yaml b/argocd/templates/kube-prometheus-stack.yaml index 4a99e59..02f8261 100644 --- a/argocd/templates/kube-prometheus-stack.yaml +++ b/argocd/templates/kube-prometheus-stack.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: kube-prometheus-stack destination: namespace: kube-prometheus-stack diff --git a/argocd/templates/kubeclarity.yaml b/argocd/templates/kubeclarity.yaml index 31a3018..c812528 100644 --- a/argocd/templates/kubeclarity.yaml +++ b/argocd/templates/kubeclarity.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: kubeclarity destination: namespace: kubeclarity diff --git a/argocd/templates/littlelink.yaml b/argocd/templates/littlelink.yaml index f18eadf..99b08fe 100644 --- a/argocd/templates/littlelink.yaml +++ b/argocd/templates/littlelink.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: littlelink directory: recurse: true diff --git a/argocd/templates/longhorn.yaml b/argocd/templates/longhorn.yaml index 3794786..017da6f 100644 --- a/argocd/templates/longhorn.yaml +++ b/argocd/templates/longhorn.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: longhorn destination: namespace: longhorn-system diff --git a/argocd/templates/nfs-client.yaml b/argocd/templates/nfs-client.yaml index f7717c9..e374885 100644 --- a/argocd/templates/nfs-client.yaml +++ b/argocd/templates/nfs-client.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: nfs-client directory: recurse: true diff --git a/argocd/templates/open-webui.yaml b/argocd/templates/open-webui.yaml index 9bb8103..a2b25fa 100644 --- a/argocd/templates/open-webui.yaml +++ b/argocd/templates/open-webui.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: open-webui destination: namespace: open-webui diff --git a/argocd/templates/traefik.yaml b/argocd/templates/traefik.yaml index 959cc20..3995a9f 100644 --- a/argocd/templates/traefik.yaml +++ b/argocd/templates/traefik.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: traefik destination: namespace: traefik diff --git a/argocd/templates/uptimekuma.yaml b/argocd/templates/uptimekuma.yaml index d88557e..ff0e1af 100644 --- a/argocd/templates/uptimekuma.yaml +++ b/argocd/templates/uptimekuma.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: uptimekuma directory: recurse: true diff --git a/argocd/templates/vault.yaml b/argocd/templates/vault.yaml index 5727fba..6e243c5 100644 --- a/argocd/templates/vault.yaml +++ b/argocd/templates/vault.yaml @@ -7,7 +7,7 @@ spec: project: default source: repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: prd + targetRevision: main path: vault destination: namespace: vault From c2298c51b19b184a5481fd27dcd10c61a8efd8a4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 21 Jul 2024 08:54:15 -0500 Subject: [PATCH 0099/1058] update --- argocd/templates/metallb-system.yaml | 22 +++ metallb-system/Chart.yaml | 13 ++ metallb-system/templates/config.yaml | 17 +++ metallb-system/values.yaml | 197 +++++++++++++++++++++++++++ 4 files changed, 249 insertions(+) create mode 100644 argocd/templates/metallb-system.yaml create mode 100644 metallb-system/Chart.yaml create mode 100644 metallb-system/templates/config.yaml create mode 100644 metallb-system/values.yaml diff --git a/argocd/templates/metallb-system.yaml b/argocd/templates/metallb-system.yaml new file mode 100644 index 0000000..051be57 --- /dev/null +++ b/argocd/templates/metallb-system.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: metallb-system + destination: + namespace: metallb-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + + diff --git a/metallb-system/Chart.yaml b/metallb-system/Chart.yaml new file mode 100644 index 0000000..c90584f --- /dev/null +++ b/metallb-system/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.14.5 + diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml new file mode 100644 index 0000000..e44285d --- /dev/null +++ b/metallb-system/templates/config.yaml @@ -0,0 +1,17 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap +spec: + addresses: + - 192.168.20.130-192.168.20.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: poop + namespace: metallb-system +spec: + ipAddressPools: + - cheap + diff --git a/metallb-system/values.yaml b/metallb-system/values.yaml new file mode 100644 index 0000000..260551d --- /dev/null +++ b/metallb-system/values.yaml @@ -0,0 +1,197 @@ +metallb: + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + loadBalancerClass: "" + + rbac: + create: true + + prometheus: + scrapeAnnotations: false + metricsPort: 7472 + speakerMetricsTLSSecret: "" + controllerMetricsTLSSecret: "" + rbacPrometheus: true + serviceAccount: "" + namespace: "" + rbacProxy: + repository: gcr.io/kubebuilder/kube-rbac-proxy + tag: v0.12.0 + pullPolicy: + podMonitor: + enabled: false + additionalLabels: {} + annotations: {} + jobLabel: "app.kubernetes.io/name" + interval: + metricRelabelings: [] + relabelings: [] + serviceMonitor: + enabled: false + speaker: + additionalLabels: {} + annotations: {} + tlsConfig: + insecureSkipVerify: true + controller: + additionalLabels: {} + annotations: {} + tlsConfig: + insecureSkipVerify: true + jobLabel: "app.kubernetes.io/name" + interval: + metricRelabelings: [] + relabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + annotations: {} + staleConfig: + enabled: true + labels: + severity: warning + configNotLoaded: + enabled: true + labels: + severity: warning + addressPoolExhausted: + enabled: true + labels: + severity: alert + addressPoolUsage: + enabled: true + thresholds: + - percent: 75 + labels: + severity: warning + - percent: 85 + labels: + severity: warning + - percent: 95 + labels: + severity: alert + bgpSessionDown: + enabled: true + labels: + severity: alert + + extraAlerts: [] + + controller: + enabled: true + # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` + logLevel: info + image: + repository: quay.io/metallb/controller + tag: + pullPolicy: + strategy: + type: RollingUpdate + serviceAccount: + create: true + name: "" + annotations: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + fsGroup: 65534 + resources: {} + nodeSelector: {} + tolerations: [] + priorityClassName: "" + runtimeClassName: "" + affinity: {} + podAnnotations: {} + labels: {} + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + tlsMinVersion: "VersionTLS12" + tlsCipherSuites: "" + + extraContainers: [] + + speaker: + enabled: true + logLevel: debug + tolerateMaster: true + memberlist: + enabled: true + mlBindPort: 7946 + mlBindAddrOverride: "" + mlSecretKeyPath: "/etc/ml_secret_key" + excludeInterfaces: + enabled: true + ignoreExcludeLB: false + + image: + repository: quay.io/metallb/speaker + tag: + pullPolicy: + updateStrategy: + type: RollingUpdate + serviceAccount: + create: true + name: "" + annotations: {} + securityContext: {} + resources: {} + nodeSelector: {} + tolerations: [] + priorityClassName: "" + affinity: {} + runtimeClassName: "" + podAnnotations: {} + labels: + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + startupProbe: + enabled: true + failureThreshold: 30 + periodSeconds: 5 + frr: + enabled: true + image: + repository: quay.io/frrouting/frr + tag: 9.0.2 + pullPolicy: + metricsPort: 7473 + resources: {} + reloader: + resources: {} + frrMetrics: + resources: {} + extraContainers: [] + crds: + enabled: true + validationFailurePolicy: Fail + frrk8s: + enabled: false + From b1272fc0526b81a760c6ad4caa7ae3e8f3d1e79b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 4 Aug 2024 07:25:42 -0500 Subject: [PATCH 0100/1058] remove proxy --- external-dns/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/external-dns/values.yaml b/external-dns/values.yaml index 4102088..68abe91 100644 --- a/external-dns/values.yaml +++ b/external-dns/values.yaml @@ -11,6 +11,6 @@ external-dns: provider: cloudflare cloudflare: secretName : "external-dns" - proxied: true + proxied: false - policy: sync \ No newline at end of file + policy: sync From 5e5a7b3803dbeab33a72080e5cc67744ce8c1831 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 Aug 2024 07:40:16 -0500 Subject: [PATCH 0101/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index 5343300..c9ac97b 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -76,7 +76,7 @@ longhorn: snapshotterReplicaCount: ~ defaultSettings: - backupTarget: S3://longhorn@us-east-1/ + backupTarget: S3://lukritz-longhorn@us-east-1/ backupTargetCredentialSecret: longhorn-backup-token-secret allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ From b2212a6608d4074ef94b87ed87c21b80e8c2a91e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 Aug 2024 07:47:05 -0500 Subject: [PATCH 0102/1058] move to nfs --- longhorn/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index c9ac97b..e46b91f 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -76,7 +76,8 @@ longhorn: snapshotterReplicaCount: ~ defaultSettings: - backupTarget: S3://lukritz-longhorn@us-east-1/ + #backupTarget: S3://lukritz-longhorn@us-east-1/ + backupTarget: nfs://192.168.20.253:/longhorn backupTargetCredentialSecret: longhorn-backup-token-secret allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ From f70c55dcf2ed64c3296dcc3ad4505d0873b4e932 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 Aug 2024 07:48:13 -0500 Subject: [PATCH 0103/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index e46b91f..38dcae2 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -77,7 +77,7 @@ longhorn: defaultSettings: #backupTarget: S3://lukritz-longhorn@us-east-1/ - backupTarget: nfs://192.168.20.253:/longhorn + backupTarget: nfs://192.168.20.253:/longhorn-master backupTargetCredentialSecret: longhorn-backup-token-secret allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ From 5765f9b5d71103e59fba6297df65b2d297102c84 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 Aug 2024 07:50:53 -0500 Subject: [PATCH 0104/1058] revert --- longhorn/values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index 38dcae2..5343300 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -76,8 +76,7 @@ longhorn: snapshotterReplicaCount: ~ defaultSettings: - #backupTarget: S3://lukritz-longhorn@us-east-1/ - backupTarget: nfs://192.168.20.253:/longhorn-master + backupTarget: S3://longhorn@us-east-1/ backupTargetCredentialSecret: longhorn-backup-token-secret allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ From 61110282d514f50ba3bdb9d1a27c1420f94dda9d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 Aug 2024 07:57:18 -0500 Subject: [PATCH 0105/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index 5343300..f9becb6 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -76,7 +76,7 @@ longhorn: snapshotterReplicaCount: ~ defaultSettings: - backupTarget: S3://longhorn@us-east-1/ + backupTarget: S3://longhorn-master@us-east-1/ backupTargetCredentialSecret: longhorn-backup-token-secret allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ From b6e7d5065c367858c2a616f05155b071ff0629ae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 18:44:38 -0500 Subject: [PATCH 0106/1058] update --- .gitignore | 1 + 1 file changed, 1 insertion(+) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..485dee6 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.idea From 21405024f722571e88d671b2128865b6e6292ee4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:23:35 -0500 Subject: [PATCH 0107/1058] add pfsense --- internalproxy/templates/pfsense.yaml | 64 ++++++++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 internalproxy/templates/pfsense.yaml diff --git a/internalproxy/templates/pfsense.yaml b/internalproxy/templates/pfsense.yaml new file mode 100644 index 0000000..e107e97 --- /dev/null +++ b/internalproxy/templates/pfsense.yaml @@ -0,0 +1,64 @@ +apiVersion: v1 +kind: Service +metadata: + name: pfsense +spec: + ports: + - name: app + port: 10433 + protocol: TCP + targetPort: 10433 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: pfsense +subsets: + - addresses: + - ip: 192.168.20.1 + ports: + - name: app + port: 10433 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: pfsense-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`pfsense.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: pfsense + port: 10433 + tls: + secretName: pfsense-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: pfsense-tls +spec: + secretName: pfsense-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "pfsense.internal.durp.info" + dnsNames: + - "pfsense.internal.durp.info" From 0a3f3d99d748c06653bcdb71332d1d21ceab36b6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:29:32 -0500 Subject: [PATCH 0108/1058] update --- traefik/templates/middlewares.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index aaf45ab..8fdf234 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -30,5 +30,6 @@ metadata: spec: ipWhiteList: sourceRange: - - 192.168.20.1/32 + - 192.168.20.1/32 - 10.0.0.0/8 + - 192.168.30.0/24 From f5b4c583677759eb12e97f272b86a92889cb549a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:30:21 -0500 Subject: [PATCH 0109/1058] update --- internalproxy/templates/pfsense.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/internalproxy/templates/pfsense.yaml b/internalproxy/templates/pfsense.yaml index e107e97..42945e7 100644 --- a/internalproxy/templates/pfsense.yaml +++ b/internalproxy/templates/pfsense.yaml @@ -39,8 +39,6 @@ spec: middlewares: - name: whitelist namespace: traefik - - name: authentik-proxy-provider - namespace: traefik kind: Rule services: - name: pfsense From 280298cc0a02ccc0b33047f24ce3c3af2d60dd52 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:31:37 -0500 Subject: [PATCH 0110/1058] update --- internalproxy/templates/pfsense.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internalproxy/templates/pfsense.yaml b/internalproxy/templates/pfsense.yaml index 42945e7..ebb928a 100644 --- a/internalproxy/templates/pfsense.yaml +++ b/internalproxy/templates/pfsense.yaml @@ -5,7 +5,7 @@ metadata: spec: ports: - name: app - port: 10433 + port: 10443 protocol: TCP targetPort: 10433 clusterIP: None @@ -22,7 +22,7 @@ subsets: - ip: 192.168.20.1 ports: - name: app - port: 10433 + port: 10443 protocol: TCP --- @@ -42,7 +42,7 @@ spec: kind: Rule services: - name: pfsense - port: 10433 + port: 10443 tls: secretName: pfsense-tls From 26c3a919c65ae4e4c49e218857a28d59341258ea Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:33:10 -0500 Subject: [PATCH 0111/1058] update --- internalproxy/templates/pfsense.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/internalproxy/templates/pfsense.yaml b/internalproxy/templates/pfsense.yaml index ebb928a..dee9e7f 100644 --- a/internalproxy/templates/pfsense.yaml +++ b/internalproxy/templates/pfsense.yaml @@ -43,6 +43,7 @@ spec: services: - name: pfsense port: 10443 + scheme: https tls: secretName: pfsense-tls From 785a2562583846cc468e818ff53d59c5086ccc91 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:47:17 -0500 Subject: [PATCH 0112/1058] update --- internalproxy/templates/octopus.yaml | 63 ++++++++++++++++++++++++++++ internalproxy/templates/pfsense.yaml | 2 +- internalproxy/templates/unraid.yaml | 63 ++++++++++++++++++++++++++++ 3 files changed, 127 insertions(+), 1 deletion(-) create mode 100644 internalproxy/templates/octopus.yaml create mode 100644 internalproxy/templates/unraid.yaml diff --git a/internalproxy/templates/octopus.yaml b/internalproxy/templates/octopus.yaml new file mode 100644 index 0000000..e0e5d78 --- /dev/null +++ b/internalproxy/templates/octopus.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: octopus +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: octopus +subsets: + - addresses: + - ip: 192.168.20.105 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: octopus-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`octopus.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: octopus + port: 443 + scheme: https + tls: + secretName: octopus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: octopus-tls +spec: + secretName: octopus-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "octopus.internal.durp.info" + dnsNames: + - "octopus.internal.durp.info" diff --git a/internalproxy/templates/pfsense.yaml b/internalproxy/templates/pfsense.yaml index dee9e7f..45d45e8 100644 --- a/internalproxy/templates/pfsense.yaml +++ b/internalproxy/templates/pfsense.yaml @@ -7,7 +7,7 @@ spec: - name: app port: 10443 protocol: TCP - targetPort: 10433 + targetPort: 10443 clusterIP: None type: ClusterIP diff --git a/internalproxy/templates/unraid.yaml b/internalproxy/templates/unraid.yaml new file mode 100644 index 0000000..9c62edc --- /dev/null +++ b/internalproxy/templates/unraid.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: unraid-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: unraid + port: 443 + scheme: https + tls: + secretName: unraid-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: unraid-tls +spec: + secretName: unraid-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "unraid.internal.durp.info" + dnsNames: + - "unraid.internal.durp.info" From 1f2fd56d89f25092e07e9dbe809dc1b64f6d0cb9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:56:13 -0500 Subject: [PATCH 0113/1058] update --- internalproxy/templates/proxmox.yaml | 63 ++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 internalproxy/templates/proxmox.yaml diff --git a/internalproxy/templates/proxmox.yaml b/internalproxy/templates/proxmox.yaml new file mode 100644 index 0000000..5d13090 --- /dev/null +++ b/internalproxy/templates/proxmox.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: proxmox +spec: + ports: + - name: app + port: 8443 + protocol: TCP + targetPort: 8443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: proxmox +subsets: + - addresses: + - ip: 192.168.21.252 + ports: + - name: app + port: 8443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: proxmox-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: proxmox + port: 443 + scheme: https + tls: + secretName: proxmox-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: proxmox-tls +spec: + secretName: proxmox-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "proxmox.internal.durp.info" + dnsNames: + - "proxmox.internal.durp.info" From e2cabee7ddce9a7447f95ab1c16533e11299c6d9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 20:57:18 -0500 Subject: [PATCH 0114/1058] update --- internalproxy/templates/minio.yaml | 63 ++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 internalproxy/templates/minio.yaml diff --git a/internalproxy/templates/minio.yaml b/internalproxy/templates/minio.yaml new file mode 100644 index 0000000..35f1ed4 --- /dev/null +++ b/internalproxy/templates/minio.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: minio +spec: + ports: + - name: app + port: 9769 + protocol: TCP + targetPort: 9769 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: minio +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 9769 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: minio-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: minio + port: 443 + scheme: http + tls: + secretName: minio-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-tls +spec: + secretName: minio-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "minio.internal.durp.info" + dnsNames: + - "minio.internal.durp.info" From 0abc90d9cda40f635f7fdf8fa4c031c4c4b14b81 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:08:06 -0500 Subject: [PATCH 0115/1058] update --- internalproxy/templates/jellyfin.yaml | 66 +++++++++++++++++++++++++++ traefik/templates/middlewares.yaml | 1 + 2 files changed, 67 insertions(+) diff --git a/internalproxy/templates/jellyfin.yaml b/internalproxy/templates/jellyfin.yaml index 61d86a5..a46a4fd 100644 --- a/internalproxy/templates/jellyfin.yaml +++ b/internalproxy/templates/jellyfin.yaml @@ -1,3 +1,69 @@ +apiVersion: v1 +kind: Service +metadata: + name: jellyfin +spec: + ports: + - name: app + port: 8096 + protocol: TCP + targetPort: 8096 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: jellyfin +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 8096 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: jellyfin-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`jellyfin.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: jellyfin + port: 8096 + scheme: https + tls: + secretName: jellyfin-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: jellyfin-tls +spec: + secretName: jellyfin-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "jellyfin.internal.durp.info" + dnsNames: + - "jellyfin.internal.durp.info" + +--- + kind: Service apiVersion: v1 metadata: diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 8fdf234..6ca24f5 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -33,3 +33,4 @@ spec: - 192.168.20.1/32 - 10.0.0.0/8 - 192.168.30.0/24 + - 192.168.130.0/24 From bf6c021d8b57f10d4e331bf921ad2e77cf40f411 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:09:10 -0500 Subject: [PATCH 0116/1058] update --- internalproxy/templates/plex.yaml | 66 +++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/internalproxy/templates/plex.yaml b/internalproxy/templates/plex.yaml index 2e70286..524bcd1 100644 --- a/internalproxy/templates/plex.yaml +++ b/internalproxy/templates/plex.yaml @@ -1,3 +1,69 @@ +apiVersion: v1 +kind: Service +metadata: + name: plex +spec: + ports: + - name: app + port: 32400 + protocol: TCP + targetPort: 32400 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: plex +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 32400 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: plex-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`plex.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: plex + port: 32400 + scheme: https + tls: + secretName: plex-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: plex-tls +spec: + secretName: plex-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "plex.internal.durp.info" + dnsNames: + - "plex.internal.durp.info" + +--- + kind: Service apiVersion: v1 metadata: From 4a1e4f980df5f65f9743ca79415f7e00d1743d49 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:23:10 -0500 Subject: [PATCH 0117/1058] update --- internalproxy/templates/jellyfin.yaml | 3 -- internalproxy/templates/plex.yaml | 3 -- internalproxy/templates/wazuh | 63 +++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 6 deletions(-) create mode 100644 internalproxy/templates/wazuh diff --git a/internalproxy/templates/jellyfin.yaml b/internalproxy/templates/jellyfin.yaml index a46a4fd..e366d0d 100644 --- a/internalproxy/templates/jellyfin.yaml +++ b/internalproxy/templates/jellyfin.yaml @@ -36,9 +36,6 @@ spec: - websecure routes: - match: Host(`jellyfin.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik kind: Rule services: - name: jellyfin diff --git a/internalproxy/templates/plex.yaml b/internalproxy/templates/plex.yaml index 524bcd1..ef2dbfb 100644 --- a/internalproxy/templates/plex.yaml +++ b/internalproxy/templates/plex.yaml @@ -36,9 +36,6 @@ spec: - websecure routes: - match: Host(`plex.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik kind: Rule services: - name: plex diff --git a/internalproxy/templates/wazuh b/internalproxy/templates/wazuh new file mode 100644 index 0000000..5a5d853 --- /dev/null +++ b/internalproxy/templates/wazuh @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: wazuh +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: wazuh +subsets: + - addresses: + - ip: 192.168.20.102 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: wazuh-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`wazuh.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: wazuh + port: 443 + scheme: https + tls: + secretName: wazuh-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wazuh-tls +spec: + secretName: wazuh-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "wazuh.internal.durp.info" + dnsNames: + - "wazuh.internal.durp.info" From 86a5af321dac125d4acace68311fd24e8411b0bf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:25:12 -0500 Subject: [PATCH 0118/1058] update --- internalproxy/templates/blueiris.yaml | 63 +++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 internalproxy/templates/blueiris.yaml diff --git a/internalproxy/templates/blueiris.yaml b/internalproxy/templates/blueiris.yaml new file mode 100644 index 0000000..5f120c9 --- /dev/null +++ b/internalproxy/templates/blueiris.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: blueiris +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: blueiris +subsets: + - addresses: + - ip: 192.168.99.2 + ports: + - name: app + port: 81 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: blueiris-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`blueiris.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: blueiris + port: 81 + scheme: http + tls: + secretName: blueiris-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: blueiris-tls +spec: + secretName: blueiris-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "blueiris.internal.durp.info" + dnsNames: + - "blueiris.internal.durp.info" From f12af0f92f5acea86258cca495bc1b5384969286 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:28:03 -0500 Subject: [PATCH 0119/1058] update --- internalproxy/templates/gitea.yaml | 62 ++++++++++++++++++++++++++++++ internalproxy/templates/plex.yaml | 1 - 2 files changed, 62 insertions(+), 1 deletion(-) diff --git a/internalproxy/templates/gitea.yaml b/internalproxy/templates/gitea.yaml index 8443aaf..4ecb95f 100644 --- a/internalproxy/templates/gitea.yaml +++ b/internalproxy/templates/gitea.yaml @@ -1,3 +1,65 @@ +kind: Service +metadata: + name: gitea +spec: + ports: + - name: app + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: gitea +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 3000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: gitea-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gitea.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: gitea + port: 3000 + scheme: http + tls: + secretName: gitea-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitea-tls +spec: + secretName: gitea-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gitea.internal.durp.info" + dnsNames: + - "gitea.internal.durp.info" + +--- + kind: Service apiVersion: v1 metadata: diff --git a/internalproxy/templates/plex.yaml b/internalproxy/templates/plex.yaml index ef2dbfb..511afaa 100644 --- a/internalproxy/templates/plex.yaml +++ b/internalproxy/templates/plex.yaml @@ -1,4 +1,3 @@ -apiVersion: v1 kind: Service metadata: name: plex From 3f74860c2898a611fab1c46639595a4a81695910 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:28:14 -0500 Subject: [PATCH 0120/1058] update --- internalproxy/templates/plex.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/internalproxy/templates/plex.yaml b/internalproxy/templates/plex.yaml index 511afaa..ef2dbfb 100644 --- a/internalproxy/templates/plex.yaml +++ b/internalproxy/templates/plex.yaml @@ -1,3 +1,4 @@ +apiVersion: v1 kind: Service metadata: name: plex From 8d92151ad347b3ccd31ca7aae83997e0d80953b2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:29:00 -0500 Subject: [PATCH 0121/1058] update --- internalproxy/templates/kasm.yaml | 63 +++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/internalproxy/templates/kasm.yaml b/internalproxy/templates/kasm.yaml index 28b25ae..43f3874 100644 --- a/internalproxy/templates/kasm.yaml +++ b/internalproxy/templates/kasm.yaml @@ -1,3 +1,66 @@ +apiVersion: v1 +kind: Service +metadata: + name: kasm +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: kasm +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kasm-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kasm.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: kasm + port: 443 + scheme: https + tls: + secretName: kasm-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kasm-tls +spec: + secretName: kasm-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kasm.internal.durp.info" + dnsNames: + - "kasm.internal.durp.info" + +--- + kind: Service apiVersion: v1 metadata: From 0ff6377bd6d87deacae2f982c56098d0ec430d5a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 24 Aug 2024 21:30:35 -0500 Subject: [PATCH 0122/1058] update --- internalproxy/templates/gitea.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/internalproxy/templates/gitea.yaml b/internalproxy/templates/gitea.yaml index 4ecb95f..782c31b 100644 --- a/internalproxy/templates/gitea.yaml +++ b/internalproxy/templates/gitea.yaml @@ -1,3 +1,4 @@ +apiVersion: v1 kind: Service metadata: name: gitea From 10bfb6fd54a8bb3c22bb87d0d47dbe3515a97e67 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 04:34:31 -0500 Subject: [PATCH 0123/1058] update --- internalproxy/templates/kasm.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internalproxy/templates/kasm.yaml b/internalproxy/templates/kasm.yaml index 43f3874..6286621 100644 --- a/internalproxy/templates/kasm.yaml +++ b/internalproxy/templates/kasm.yaml @@ -35,7 +35,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`kasm.internal.durp.info`) && PathPrefix(`/`) + - match: Host(`kasm.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: kasm @@ -55,9 +55,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "kasm.internal.durp.info" + commonName: "kasm.durp.info" dnsNames: - - "kasm.internal.durp.info" + - "kasm.durp.info" --- From 23d397e5d4c3e452b674b2a7439c5c4a7d579923 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 04:35:16 -0500 Subject: [PATCH 0124/1058] update --- internalproxy/templates/jellyfin.yaml | 6 +++--- internalproxy/templates/plex.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/internalproxy/templates/jellyfin.yaml b/internalproxy/templates/jellyfin.yaml index e366d0d..5f69e21 100644 --- a/internalproxy/templates/jellyfin.yaml +++ b/internalproxy/templates/jellyfin.yaml @@ -35,7 +35,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`jellyfin.internal.durp.info`) && PathPrefix(`/`) + - match: Host(`jellyfin.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: jellyfin @@ -55,9 +55,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "jellyfin.internal.durp.info" + commonName: "jellyfin.durp.info" dnsNames: - - "jellyfin.internal.durp.info" + - "jellyfin.durp.info" --- diff --git a/internalproxy/templates/plex.yaml b/internalproxy/templates/plex.yaml index ef2dbfb..81f6426 100644 --- a/internalproxy/templates/plex.yaml +++ b/internalproxy/templates/plex.yaml @@ -35,7 +35,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`plex.internal.durp.info`) && PathPrefix(`/`) + - match: Host(`plex.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: plex @@ -55,9 +55,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "plex.internal.durp.info" + commonName: "plex.durp.info" dnsNames: - - "plex.internal.durp.info" + - "plex.durp.info" --- From 738d19edfabd878625c73735b200f07e102771ca Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 04:40:58 -0500 Subject: [PATCH 0125/1058] update --- internalproxy/templates/kasm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/kasm.yaml b/internalproxy/templates/kasm.yaml index 6286621..7f756e0 100644 --- a/internalproxy/templates/kasm.yaml +++ b/internalproxy/templates/kasm.yaml @@ -19,7 +19,7 @@ metadata: name: kasm subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.104 ports: - name: app port: 443 From 3457eba0a2ef5ec4d50a6585e8da0a9eacb7d96a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 04:52:22 -0500 Subject: [PATCH 0126/1058] update --- internalproxy/templates/guac.yaml | 71 -------------------------- internalproxy/templates/portainer.yaml | 62 ++++++++++++++++++++++ 2 files changed, 62 insertions(+), 71 deletions(-) delete mode 100644 internalproxy/templates/guac.yaml create mode 100644 internalproxy/templates/portainer.yaml diff --git a/internalproxy/templates/guac.yaml b/internalproxy/templates/guac.yaml deleted file mode 100644 index a69b685..0000000 --- a/internalproxy/templates/guac.yaml +++ /dev/null @@ -1,71 +0,0 @@ -kind: Service -apiVersion: v1 -metadata: - name: guac-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: guac.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- - -apiVersion: v1 -kind: Service -metadata: - name: guac -spec: - ports: - - name: app - port: 8082 - protocol: TCP - targetPort: 8082 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: guac -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8082 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: guac-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`guac.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: guac - port: 8082 - tls: - secretName: guac-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: guac-tls -spec: - secretName: guac-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "guac.durp.info" - dnsNames: - - "guac.durp.info" \ No newline at end of file diff --git a/internalproxy/templates/portainer.yaml b/internalproxy/templates/portainer.yaml new file mode 100644 index 0000000..91763a9 --- /dev/null +++ b/internalproxy/templates/portainer.yaml @@ -0,0 +1,62 @@ +apiVersion: v1 +kind: Service +metadata: + name: portainer +spec: + ports: + - name: app + port: 9443 + protocol: TCP + targetPort: 9443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: portainer +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 9443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: portainer-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: portainer + port: 8200 + tls: + secretName: portainer-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: portainer-tls +spec: + secretName: portainer-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "portainer.internal.durp.info" + dnsNames: + - "portainer.internal.durp.info" From c9d77c5eec28b602e265d1106edf645b0dbad62b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 05:03:23 -0500 Subject: [PATCH 0127/1058] update --- internalproxy/templates/portainer.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/internalproxy/templates/portainer.yaml b/internalproxy/templates/portainer.yaml index 91763a9..5c22061 100644 --- a/internalproxy/templates/portainer.yaml +++ b/internalproxy/templates/portainer.yaml @@ -42,7 +42,8 @@ spec: kind: Rule services: - name: portainer - port: 8200 + port: 9443 + scheme: https tls: secretName: portainer-tls From f8a13c4bff4a19ecff8fafd602ad351602deda56 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 05:05:59 -0500 Subject: [PATCH 0128/1058] update --- internalproxy/templates/registry-internal.yaml | 4 ++-- internalproxy/templates/{wazuh => wazuh.yaml} | 0 2 files changed, 2 insertions(+), 2 deletions(-) rename internalproxy/templates/{wazuh => wazuh.yaml} (100%) diff --git a/internalproxy/templates/registry-internal.yaml b/internalproxy/templates/registry-internal.yaml index a1c584f..1700b63 100644 --- a/internalproxy/templates/registry-internal.yaml +++ b/internalproxy/templates/registry-internal.yaml @@ -54,6 +54,6 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "registry.durp.info" + commonName: "registry.internal.durp.info" dnsNames: - - "registry.durp.info" + - "registry.internal.durp.info" diff --git a/internalproxy/templates/wazuh b/internalproxy/templates/wazuh.yaml similarity index 100% rename from internalproxy/templates/wazuh rename to internalproxy/templates/wazuh.yaml From 1fbe3dbc953357f6311e7aa7f4a222d9c8909b32 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 05:08:59 -0500 Subject: [PATCH 0129/1058] update --- internalproxy/templates/registry-internal.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/internalproxy/templates/registry-internal.yaml b/internalproxy/templates/registry-internal.yaml index 1700b63..03927ae 100644 --- a/internalproxy/templates/registry-internal.yaml +++ b/internalproxy/templates/registry-internal.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 5001 + port: 5000 protocol: TCP - targetPort: 5001 + targetPort: 5000 clusterIP: None type: ClusterIP @@ -22,7 +22,7 @@ subsets: - ip: 192.168.20.253 ports: - name: app - port: 5001 + port: 5000 protocol: TCP --- @@ -39,7 +39,7 @@ spec: kind: Rule services: - name: registry-internal - port: 5001 + port: 5000 tls: secretName: registry-tls From be2ee6274abacb2d4923c95be3ee48f92aa41283 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 05:12:54 -0500 Subject: [PATCH 0130/1058] update --- internalproxy/templates/registry-internal.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/registry-internal.yaml b/internalproxy/templates/registry-internal.yaml index 03927ae..27561fe 100644 --- a/internalproxy/templates/registry-internal.yaml +++ b/internalproxy/templates/registry-internal.yaml @@ -41,7 +41,7 @@ spec: - name: registry-internal port: 5000 tls: - secretName: registry-tls + secretName: registry-internal-tls --- From a50214eafc991af162e0abe520264b69215ef6fa Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 05:32:20 -0500 Subject: [PATCH 0131/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index f9becb6..647385b 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -57,7 +57,7 @@ longhorn: { "name":"backup", "task":"backup", - "cron":"0 */6 * * *", + "cron":"0 0 * * ?", "retain":24 } ]' From de022ea46bed7643dde05c7549038fb0232d7553 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 05:33:43 -0500 Subject: [PATCH 0132/1058] update --- internalproxy/templates/s3.yaml | 63 +++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 internalproxy/templates/s3.yaml diff --git a/internalproxy/templates/s3.yaml b/internalproxy/templates/s3.yaml new file mode 100644 index 0000000..1fb967d --- /dev/null +++ b/internalproxy/templates/s3.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: s3 +spec: + ports: + - name: app + port: 9768 + protocol: TCP + targetPort: 9768 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: s3 +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 9768 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: s3-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: s3 + port: 443 + scheme: http + tls: + secretName: s3-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: s3-tls +spec: + secretName: s3-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "s3.internal.durp.info" + dnsNames: + - "s3.internal.durp.info" From 418162a9e03124fdeb2fd3affe1806ad050b6fac Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 05:43:48 -0500 Subject: [PATCH 0133/1058] update --- internalproxy/templates/s3.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/s3.yaml b/internalproxy/templates/s3.yaml index 1fb967d..cd52fb6 100644 --- a/internalproxy/templates/s3.yaml +++ b/internalproxy/templates/s3.yaml @@ -42,7 +42,7 @@ spec: kind: Rule services: - name: s3 - port: 443 + port: 9768 scheme: http tls: secretName: s3-tls From 3259cd6f3738dc5cd246155c15d86ec7887f4579 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:07:19 -0500 Subject: [PATCH 0134/1058] update --- internalproxy/templates/ollama.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 internalproxy/templates/ollama.yaml diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml new file mode 100644 index 0000000..c02fd90 --- /dev/null +++ b/internalproxy/templates/ollama.yaml @@ -0,0 +1,15 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ollama-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: ollama-secret + data: + - secretKey: users + remoteRef: + key: secrets/internalproxy/ollama + property: users From b6f0c41d5d586da2342a8d614124cd3a778a610a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:09:41 -0500 Subject: [PATCH 0135/1058] update --- internalproxy/templates/ollama.yaml | 66 +++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index c02fd90..c70b638 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -13,3 +13,69 @@ spec: remoteRef: key: secrets/internalproxy/ollama property: users + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: ollama-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`ollama.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: ollama + port: 11435 + scheme: https + tls: + secretName: ollama-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls +spec: + secretName: ollama-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "ollama.durp.info" + dnsNames: + - "ollama.durp.info" From 0f4048072da6a786858e1a88c25d9df4e83a6a23 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:11:13 -0500 Subject: [PATCH 0136/1058] update --- internalproxy/templates/ollama.yaml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index c70b638..e6f58ef 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -16,6 +16,16 @@ spec: --- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: ollama-basic-auth +spec: + basicAuth: + secret: ollama-secret + +--- + apiVersion: v1 kind: Service metadata: @@ -55,8 +65,7 @@ spec: routes: - match: Host(`ollama.durp.info`) && PathPrefix(`/`) middlewares: - - name: whitelist - namespace: traefik + - name: ollama-basic-auth kind: Rule services: - name: ollama From 44aac2736280a06dde3dab88da0201801e59661d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:19:34 -0500 Subject: [PATCH 0137/1058] update --- internalproxy/templates/ollama.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index e6f58ef..9d84b71 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -88,3 +88,15 @@ spec: commonName: "ollama.durp.info" dnsNames: - "ollama.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: plex-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +spec: + type: ExternalName + externalName: durp.info From 8c77e536699c34da9a24b12e9c404fbae8196d0c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:20:12 -0500 Subject: [PATCH 0138/1058] update --- internalproxy/templates/ollama.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index 9d84b71..bef5f0e 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -94,7 +94,7 @@ spec: kind: Service apiVersion: v1 metadata: - name: plex-external-dns + name: ollama-external-dns annotations: external-dns.alpha.kubernetes.io/hostname: ollama.durp.info spec: From 38bb3538a3cbb29fa6ec5402eeb5ed8b5038ca1a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:22:33 -0500 Subject: [PATCH 0139/1058] update --- internalproxy/templates/ollama.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index bef5f0e..4834ff5 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -70,7 +70,6 @@ spec: services: - name: ollama port: 11435 - scheme: https tls: secretName: ollama-tls From 5ef03e6dbe10f012f36557014ecaefabcec7f851 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:27:05 -0500 Subject: [PATCH 0140/1058] update --- internalproxy/templates/semaphore.yaml | 63 ++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 internalproxy/templates/semaphore.yaml diff --git a/internalproxy/templates/semaphore.yaml b/internalproxy/templates/semaphore.yaml new file mode 100644 index 0000000..ffd81dc --- /dev/null +++ b/internalproxy/templates/semaphore.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: semaphore +spec: + ports: + - name: app + port: 3001 + protocol: TCP + targetPort: 3001 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: semaphore +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 3001 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: semaphore-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: semaphore + port: 3001 + scheme: http + tls: + secretName: semaphore-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: semaphore-tls +spec: + secretName: semaphore-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "semaphore.internal.durp.info" + dnsNames: + - "semaphore.internal.durp.info" From 31b689d5fe02c03e79dceae4af0abe2924c19e02 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:28:15 -0500 Subject: [PATCH 0141/1058] update --- internalproxy/templates/proxmox.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internalproxy/templates/proxmox.yaml b/internalproxy/templates/proxmox.yaml index 5d13090..31e9704 100644 --- a/internalproxy/templates/proxmox.yaml +++ b/internalproxy/templates/proxmox.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 8443 + port: 8006 protocol: TCP - targetPort: 8443 + targetPort: 8006 clusterIP: None type: ClusterIP @@ -22,7 +22,7 @@ subsets: - ip: 192.168.21.252 ports: - name: app - port: 8443 + port: 8006 protocol: TCP --- From 47ddf2fd28f2522f094930372fc2761117ee28cb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 06:32:15 -0500 Subject: [PATCH 0142/1058] update --- internalproxy/templates/proxmox.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/proxmox.yaml b/internalproxy/templates/proxmox.yaml index 31e9704..fd0343a 100644 --- a/internalproxy/templates/proxmox.yaml +++ b/internalproxy/templates/proxmox.yaml @@ -42,7 +42,7 @@ spec: kind: Rule services: - name: proxmox - port: 443 + port: 8006 scheme: https tls: secretName: proxmox-tls From b90fdc19911c0ed3f9d79abf1ef6f9db9b8458f5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 13:10:41 -0500 Subject: [PATCH 0143/1058] update --- metallb-system/templates/config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml index bb2fbd5..505a798 100644 --- a/metallb-system/templates/config.yaml +++ b/metallb-system/templates/config.yaml @@ -4,12 +4,12 @@ metadata: name: cheap spec: addresses: - - 192.168.10.130-192.168.10.140 + - 192.168.10.110-192.168.10.120 --- apiVersion: metallb.io/v1beta1 kind: L2Advertisement metadata: - name: poop + name: pool namespace: metallb-system spec: ipAddressPools: From 00969f8183600c3becaebb246710199b87b30bcc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 20:10:08 -0500 Subject: [PATCH 0144/1058] update --- argocd/values.yaml | 22 ++-------------------- traefik/templates/middlewares.yaml | 3 +-- 2 files changed, 3 insertions(+), 22 deletions(-) diff --git a/argocd/values.yaml b/argocd/values.yaml index c91ada3..957a47e 100644 --- a/argocd/values.yaml +++ b/argocd/values.yaml @@ -1,28 +1,10 @@ argo-cd: - global: revisionHistoryLimit: 1 image: repository: registry.internal.durp.info/argoproj/argocd imagePullPolicy: Always - server: - #extraArgs: - # - --dex-server-plaintext - # - --dex-server=argocd-dex-server:5556 - # oidc.config: | - # name: AzureAD - # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 - # clientID: CLIENT_ID - # clientSecret: $oidc.azuread.clientSecret - # requestedIDTokenClaims: - # groups: - # essential: true - # requestedScopes: - # - openid - # - profile - # - email - dex: enabled: true image: @@ -54,9 +36,9 @@ argo-cd: rbac: create: true policy.csv: | - g, ArgoCD Admins, role:admin + g, ArgoCD Admins, role:admin scopes: "[groups]" server: - route: + route: enabled: false diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 4fbe8be..89e99b7 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -29,8 +29,7 @@ metadata: spec: ipWhiteList: sourceRange: - - 192.168.10.1/32 - - 192.168.30.1/24 + - 192.168.0.0/16 - 10.0.0.0/8 ipStrategy: depth: 1 From 8a9004d4560c9ca8a515a94eeb457aee7f81bdc5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 20:11:49 -0500 Subject: [PATCH 0145/1058] update --- traefik/templates/middleware-chain.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/traefik/templates/middleware-chain.yaml b/traefik/templates/middleware-chain.yaml index 4f21880..21ac202 100644 --- a/traefik/templates/middleware-chain.yaml +++ b/traefik/templates/middleware-chain.yaml @@ -5,5 +5,4 @@ metadata: spec: chain: middlewares: - - name: traefik-real-ip - name: whitelist From df628900435facc699d5fbc797fb5415d21463f8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 Aug 2024 20:12:35 -0500 Subject: [PATCH 0146/1058] update --- traefik/templates/middlewares.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 89e99b7..bd625f6 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -31,8 +31,6 @@ spec: sourceRange: - 192.168.0.0/16 - 10.0.0.0/8 - ipStrategy: - depth: 1 --- From 6e4ae08a5ca57c53c361c8627d9c27006574fab8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 27 Aug 2024 04:46:57 -0500 Subject: [PATCH 0147/1058] update --- longhorn/templates/secrets.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/templates/secrets.yaml b/longhorn/templates/secrets.yaml index c10ab89..26c10a1 100644 --- a/longhorn/templates/secrets.yaml +++ b/longhorn/templates/secrets.yaml @@ -8,7 +8,7 @@ spec: name: vault kind: ClusterSecretStore target: - name: longhorn-backup-token-secret + name: longhorn-backup-token-secret2 data: - secretKey: AWS_ACCESS_KEY_ID remoteRef: From 0ff4cc5bad4ddb0a5aedd90240bd49c6f8ff9528 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 27 Aug 2024 04:47:51 -0500 Subject: [PATCH 0148/1058] update --- longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/values.yaml b/longhorn/values.yaml index 4389062..3f9c17d 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -77,7 +77,7 @@ longhorn: defaultSettings: backupTarget: S3://longhorn-dev@us-east-1/ - backupTargetCredentialSecret: longhorn-backup-token-secret + backupTargetCredentialSecret: longhorn-backup-token-secret2 allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ defaultDataPath: ~ From 34950703ca3505e1729a609e0ec604b27cb7b80f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 27 Aug 2024 04:50:42 -0500 Subject: [PATCH 0149/1058] update chart --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index 8c0a8ae..c26d7e0 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.6.1 + version: 1.7.0 From 62b7efad894495b6c956b6a2931f529a8c385bea Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 27 Aug 2024 04:58:07 -0500 Subject: [PATCH 0150/1058] update --- internalproxy/templates/minio.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/minio.yaml b/internalproxy/templates/minio.yaml index 35f1ed4..aa191b6 100644 --- a/internalproxy/templates/minio.yaml +++ b/internalproxy/templates/minio.yaml @@ -42,7 +42,7 @@ spec: kind: Rule services: - name: minio - port: 443 + port: 9769 scheme: http tls: secretName: minio-tls From e8cafed885db7d32a99df94ca57ef88b498aedb0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 29 Aug 2024 04:50:55 -0500 Subject: [PATCH 0151/1058] update --- internalproxy/templates/jellyfin.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/jellyfin.yaml b/internalproxy/templates/jellyfin.yaml index 5f69e21..1b919bf 100644 --- a/internalproxy/templates/jellyfin.yaml +++ b/internalproxy/templates/jellyfin.yaml @@ -40,7 +40,7 @@ spec: services: - name: jellyfin port: 8096 - scheme: https + scheme: http tls: secretName: jellyfin-tls From e2d1e01708616bd9be1b5538b0efc0d404ed7de5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 29 Aug 2024 04:55:28 -0500 Subject: [PATCH 0152/1058] update --- internalproxy/templates/gitea.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/internalproxy/templates/gitea.yaml b/internalproxy/templates/gitea.yaml index 782c31b..ec29631 100644 --- a/internalproxy/templates/gitea.yaml +++ b/internalproxy/templates/gitea.yaml @@ -35,7 +35,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`gitea.internal.durp.info`) && PathPrefix(`/`) + - match: Host(`gitea.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: gitea @@ -55,9 +55,9 @@ spec: issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "gitea.internal.durp.info" + commonName: "gitea.durp.info" dnsNames: - - "gitea.internal.durp.info" + - "gitea.durp.info" --- From 7843ae7c29ecd0ba3366bdef77b62a4d1c5401f7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 29 Aug 2024 04:57:40 -0500 Subject: [PATCH 0153/1058] update --- durpapi/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/durpapi/values.yaml b/durpapi/values.yaml index 65f1b4c..9e9eeab 100644 --- a/durpapi/values.yaml +++ b/durpapi/values.yaml @@ -10,15 +10,15 @@ deployment: probe: readiness: httpGet: - path: /api/health/gethealth + path: /health/gethealth port: 8080 liveness: httpGet: - path: /api/health/gethealth + path: /health/gethealth port: 8080 startup: httpGet: - path: /api/health/gethealth + path: /health/gethealth port: 8080 service: type: ClusterIP From 885ab5e3d7e54b9a96cf593e27d3f774ec03a3fd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 29 Aug 2024 05:02:08 -0500 Subject: [PATCH 0154/1058] update --- durpapi/Chart.yaml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 23a6be3..f778c1c 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,13 @@ -type: application -appVersion: 0.1.0 -description: A Helm chart for Kubernetes +apiVersion: v2 name: durpapi +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: 0.1.0 + dependencies: - condition: postgresql.enabled version: 12.5.* repository: https://charts.bitnami.com/bitnami name: postgresql -apiVersion: v2 -version: test From 52038a7585c42b0564944c17171681227940e628 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 29 Aug 2024 05:04:25 -0500 Subject: [PATCH 0155/1058] update --- durpapi/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index f778c1c..078c7e0 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -3,7 +3,7 @@ name: durpapi description: A Helm chart for Kubernetes type: application -version: 0.1.0 +version: 0.1.0-dev0184 appVersion: 0.1.0 dependencies: From 89b8364fe5f42e9d0b5da0d035e2a88c51609724 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 04:49:03 -0500 Subject: [PATCH 0156/1058] add resource limits --- vault/values.yaml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/vault/values.yaml b/vault/values.yaml index d77a898..b8f0102 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -39,14 +39,13 @@ vault: ha: enabled: false replicas: 3 - resources: {} - # resources: - # requests: - # memory: 256Mi - # cpu: 250m - # limits: - # memory: 256Mi - # cpu: 250m + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 256Mi + cpu: 250m dataStorage: enabled: true From 33fd621ec8610c0fcf95721bb59a7576459d1163 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 04:51:35 -0500 Subject: [PATCH 0157/1058] add resource limits --- traefik/values.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 362a574..a487670 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -819,13 +819,13 @@ traefik: # Additional serviceAccount annotations (e.g. for oidc authentication) serviceAccountAnnotations: {} - resources: {} - # requests: - # cpu: "100m" - # memory: "50Mi" - # limits: - # cpu: "300m" - # memory: "150Mi" + resources: + requests: + cpu: "100m" + memory: "50Mi" + limits: + cpu: "300m" + memory: "150Mi" # This example pod anti-affinity forces the scheduler to put traefik pods # on nodes where no other traefik pods are scheduled. From 8ec254f59c4cc29c34dfcb2e784ec9edd07e2fa8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 04:52:29 -0500 Subject: [PATCH 0158/1058] enable autoscaller --- traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index a487670..b93f754 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -730,7 +730,7 @@ traefik: ## Create HorizontalPodAutoscaler object. ## autoscaling: - enabled: false + enabled: true minReplicas: 1 maxReplicas: 10 metrics: From f12b7aa5320d51078598bb0a90078965b0cd5bfb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 04:56:01 -0500 Subject: [PATCH 0159/1058] update resource --- traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index b93f754..3a31886 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -825,7 +825,7 @@ traefik: memory: "50Mi" limits: cpu: "300m" - memory: "150Mi" + memory: "256Mi" # This example pod anti-affinity forces the scheduler to put traefik pods # on nodes where no other traefik pods are scheduled. From f16da3d3a8eade53875ee614b21ce2dfd6f87c4a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 04:58:02 -0500 Subject: [PATCH 0160/1058] update resources --- traefik/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 3a31886..1763285 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -822,10 +822,10 @@ traefik: resources: requests: cpu: "100m" - memory: "50Mi" + memory: "256Mi" limits: cpu: "300m" - memory: "256Mi" + memory: "512Mi" # This example pod anti-affinity forces the scheduler to put traefik pods # on nodes where no other traefik pods are scheduled. From 216cece298dc8e2464a2bd9a36cc87e302743c7b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 05:03:40 -0500 Subject: [PATCH 0161/1058] update --- traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 1763285..844946e 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -730,7 +730,7 @@ traefik: ## Create HorizontalPodAutoscaler object. ## autoscaling: - enabled: true + enabled: false minReplicas: 1 maxReplicas: 10 metrics: From 5c866c2eb7788b4998da31c75e220ffd401e5d3a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 05:04:25 -0500 Subject: [PATCH 0162/1058] update --- traefik/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 844946e..82f80d0 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -730,7 +730,7 @@ traefik: ## Create HorizontalPodAutoscaler object. ## autoscaling: - enabled: false + enabled: true minReplicas: 1 maxReplicas: 10 metrics: @@ -739,13 +739,13 @@ traefik: name: cpu target: type: Utilization - averageUtilization: 60 + averageUtilization: 80 - type: Resource resource: name: memory target: type: Utilization - averageUtilization: 60 + averageUtilization: 80 behavior: scaleDown: stabilizationWindowSeconds: 300 From 44d099ad9eca7b97f253e772ed7d6502c6f4cc92 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 05:04:57 -0500 Subject: [PATCH 0163/1058] update --- traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index 82f80d0..a537069 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -731,7 +731,7 @@ traefik: ## autoscaling: enabled: true - minReplicas: 1 + minReplicas: 3 maxReplicas: 10 metrics: - type: Resource From d28f17120b57e49019e2b69cc224a0edc02ac621 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 30 Aug 2024 05:08:33 -0500 Subject: [PATCH 0164/1058] upupdate --- traefik/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/traefik/values.yaml b/traefik/values.yaml index a537069..de51762 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -736,13 +736,13 @@ traefik: metrics: - type: Resource resource: - name: cpu + name: memory target: type: Utilization averageUtilization: 80 - type: Resource resource: - name: memory + name: cpu target: type: Utilization averageUtilization: 80 @@ -822,10 +822,10 @@ traefik: resources: requests: cpu: "100m" - memory: "256Mi" + memory: "128Mi" limits: cpu: "300m" - memory: "512Mi" + memory: "256Mi" # This example pod anti-affinity forces the scheduler to put traefik pods # on nodes where no other traefik pods are scheduled. From a99e0649dde9d18551866f9ff36c88662958243e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 31 Aug 2024 07:11:20 -0500 Subject: [PATCH 0165/1058] update --- argocd/templates/plane.yaml | 20 ++++++ plane/Chart.yaml | 11 +++ plane/values.yaml | 130 ++++++++++++++++++++++++++++++++++++ 3 files changed, 161 insertions(+) create mode 100644 argocd/templates/plane.yaml create mode 100644 plane/Chart.yaml create mode 100644 plane/values.yaml diff --git a/argocd/templates/plane.yaml b/argocd/templates/plane.yaml new file mode 100644 index 0000000..4906f0c --- /dev/null +++ b/argocd/templates/plane.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: plane + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: plane + destination: + namespace: plane + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/plane/Chart.yaml b/plane/Chart.yaml new file mode 100644 index 0000000..e53710e --- /dev/null +++ b/plane/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: plane +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: plane-ce + repository: https://helm.plane.so/ + version: 1.0.22 diff --git a/plane/values.yaml b/plane/values.yaml new file mode 100644 index 0000000..f32227a --- /dev/null +++ b/plane/values.yaml @@ -0,0 +1,130 @@ +planeVersion: stable + +dockerRegistry: + enabled: false + host: "index.docker.io/v1/" + loginid: makeplane + password: "" + +ingress: + enabled: true + appHost: "plane.durp.info" + minioHost: "plane-minio.durp.info" + ingressClass: "nginx" + ingress_annotations: { + "nginx.ingress.kubernetes.io/proxy-body-size": "5m", + } + +# SSL Configuration - Valid only if ingress.enabled is true +ssl: + createIssuer: false + issuer: "http" # Allowed : cloudflare, digitalocean, http + token: "" # not required for http + server: https://acme-v02.api.letsencrypt.org/directory + email: plane@example.com + generateCerts: false + +redis: + local_setup: true + image: valkey/valkey:7.2.5-alpine + servicePort: 6379 + storageClass: longhorn + volumeSize: 1Gi + pullPolicy: IfNotPresent + assign_cluster_ip: false + +postgres: + local_setup: true + image: postgres:15.5-alpine + servicePort: 5432 + cliConnectPort: "" + storageClass: longhorn + volumeSize: 5Gi + pullPolicy: IfNotPresent + assign_cluster_ip: false + +minio: + image: minio/minio:latest + local_setup: true + pullPolicy: IfNotPresent + root_password: password + root_user: admin + storageClass: longhorn + volumeSize: 5Gi + assign_cluster_ip: true + +web: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-frontend + pullPolicy: IfNotPresent + assign_cluster_ip: true + +space: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-space + pullPolicy: IfNotPresent + assign_cluster_ip: true + +admin: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-admin + pullPolicy: IfNotPresent + assign_cluster_ip: true + +api: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-backend + pullPolicy: IfNotPresent + assign_cluster_ip: false + +worker: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-backend + pullPolicy: IfNotPresent + +beatworker: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-backend + pullPolicy: IfNotPresent + +env: + pgdb_username: plane + pgdb_password: plane + pgdb_name: plane + pgdb_remote_url: "" #INCASE OF REMOTE PG DB URL ONLY + + # NEXT_PUBLIC_DEPLOY_URL: "" + # REDIS + remote_redis_url: "" #INCASE OF REMOTE REDIS ONLY + # POSTGRES DB VALUES + + # DATA STORE + docstore_bucket: "uploads" + doc_upload_size_limit: "5242880" # 5MB + + # REQUIRED IF MINIO LOCAL SETUP IS FALSE + aws_access_key: "" + aws_secret_access_key: "" + aws_region: "" + aws_s3_endpoint_url: "" + + secret_key: "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5" + + sentry_dsn: "" + sentry_environment: "" + + cors_allowed_origins: "" + default_cluster_domain: cluster.local + From 1febc6915ea1df0d5d811a1e8b46e989e1c447fb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 31 Aug 2024 07:14:08 -0500 Subject: [PATCH 0166/1058] update --- plane/values.yaml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/plane/values.yaml b/plane/values.yaml index f32227a..81a41c3 100644 --- a/plane/values.yaml +++ b/plane/values.yaml @@ -10,10 +10,7 @@ ingress: enabled: true appHost: "plane.durp.info" minioHost: "plane-minio.durp.info" - ingressClass: "nginx" - ingress_annotations: { - "nginx.ingress.kubernetes.io/proxy-body-size": "5m", - } + ingressClass: "traefik" # SSL Configuration - Valid only if ingress.enabled is true ssl: From 0f908a1460cc3a5ae80b95b5dc20f7822dbdd75d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 31 Aug 2024 07:19:33 -0500 Subject: [PATCH 0167/1058] update --- plane/values.yaml | 220 +++++++++++++++++++++++----------------------- 1 file changed, 112 insertions(+), 108 deletions(-) diff --git a/plane/values.yaml b/plane/values.yaml index 81a41c3..6ef036c 100644 --- a/plane/values.yaml +++ b/plane/values.yaml @@ -1,127 +1,131 @@ -planeVersion: stable +plane: + planeVersion: stable -dockerRegistry: - enabled: false - host: "index.docker.io/v1/" - loginid: makeplane - password: "" + dockerRegistry: + enabled: false + host: "index.docker.io/v1/" + loginid: makeplane + password: "" -ingress: - enabled: true - appHost: "plane.durp.info" - minioHost: "plane-minio.durp.info" - ingressClass: "traefik" + ingress: + enabled: true + appHost: "plane.durp.info" + minioHost: "plane-minio.durp.info" + ingressClass: "nginx" + ingress_annotations: { + "nginx.ingress.kubernetes.io/proxy-body-size": "5m", + } -# SSL Configuration - Valid only if ingress.enabled is true -ssl: - createIssuer: false - issuer: "http" # Allowed : cloudflare, digitalocean, http - token: "" # not required for http - server: https://acme-v02.api.letsencrypt.org/directory - email: plane@example.com - generateCerts: false + # SSL Configuration - Valid only if ingress.enabled is true + ssl: + createIssuer: false + issuer: "http" # Allowed : cloudflare, digitalocean, http + token: "" # not required for http + server: https://acme-v02.api.letsencrypt.org/directory + email: plane@example.com + generateCerts: false -redis: - local_setup: true - image: valkey/valkey:7.2.5-alpine - servicePort: 6379 - storageClass: longhorn - volumeSize: 1Gi - pullPolicy: IfNotPresent - assign_cluster_ip: false + redis: + local_setup: true + image: valkey/valkey:7.2.5-alpine + servicePort: 6379 + storageClass: longhorn + volumeSize: 1Gi + pullPolicy: IfNotPresent + assign_cluster_ip: false -postgres: - local_setup: true - image: postgres:15.5-alpine - servicePort: 5432 - cliConnectPort: "" - storageClass: longhorn - volumeSize: 5Gi - pullPolicy: IfNotPresent - assign_cluster_ip: false + postgres: + local_setup: true + image: postgres:15.5-alpine + servicePort: 5432 + cliConnectPort: "" + storageClass: longhorn + volumeSize: 5Gi + pullPolicy: IfNotPresent + assign_cluster_ip: false -minio: - image: minio/minio:latest - local_setup: true - pullPolicy: IfNotPresent - root_password: password - root_user: admin - storageClass: longhorn - volumeSize: 5Gi - assign_cluster_ip: true + minio: + image: minio/minio:latest + local_setup: true + pullPolicy: IfNotPresent + root_password: password + root_user: admin + storageClass: longhorn + volumeSize: 5Gi + assign_cluster_ip: true -web: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-frontend - pullPolicy: IfNotPresent - assign_cluster_ip: true + web: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-frontend + pullPolicy: IfNotPresent + assign_cluster_ip: true -space: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-space - pullPolicy: IfNotPresent - assign_cluster_ip: true + space: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-space + pullPolicy: IfNotPresent + assign_cluster_ip: true -admin: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-admin - pullPolicy: IfNotPresent - assign_cluster_ip: true + admin: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-admin + pullPolicy: IfNotPresent + assign_cluster_ip: true -api: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-backend - pullPolicy: IfNotPresent - assign_cluster_ip: false + api: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-backend + pullPolicy: IfNotPresent + assign_cluster_ip: false -worker: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-backend - pullPolicy: IfNotPresent + worker: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-backend + pullPolicy: IfNotPresent -beatworker: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-backend - pullPolicy: IfNotPresent + beatworker: + replicas: 1 + memoryLimit: 1000Mi + cpuLimit: 500m + image: makeplane/plane-backend + pullPolicy: IfNotPresent -env: - pgdb_username: plane - pgdb_password: plane - pgdb_name: plane - pgdb_remote_url: "" #INCASE OF REMOTE PG DB URL ONLY + env: + pgdb_username: plane + pgdb_password: plane + pgdb_name: plane + pgdb_remote_url: "" #INCASE OF REMOTE PG DB URL ONLY - # NEXT_PUBLIC_DEPLOY_URL: "" - # REDIS - remote_redis_url: "" #INCASE OF REMOTE REDIS ONLY - # POSTGRES DB VALUES + # NEXT_PUBLIC_DEPLOY_URL: "" + # REDIS + remote_redis_url: "" #INCASE OF REMOTE REDIS ONLY + # POSTGRES DB VALUES - # DATA STORE - docstore_bucket: "uploads" - doc_upload_size_limit: "5242880" # 5MB + # DATA STORE + docstore_bucket: "uploads" + doc_upload_size_limit: "5242880" # 5MB - # REQUIRED IF MINIO LOCAL SETUP IS FALSE - aws_access_key: "" - aws_secret_access_key: "" - aws_region: "" - aws_s3_endpoint_url: "" - - secret_key: "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5" + # REQUIRED IF MINIO LOCAL SETUP IS FALSE + aws_access_key: "" + aws_secret_access_key: "" + aws_region: "" + aws_s3_endpoint_url: "" + + secret_key: "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5" - sentry_dsn: "" - sentry_environment: "" + sentry_dsn: "" + sentry_environment: "" - cors_allowed_origins: "" - default_cluster_domain: cluster.local + cors_allowed_origins: "" + default_cluster_domain: cluster.local From 42fc48bb279762367ceb1cb82d5b4d68c7a33997 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 31 Aug 2024 07:22:25 -0500 Subject: [PATCH 0168/1058] update --- plane/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plane/values.yaml b/plane/values.yaml index 6ef036c..2b321a3 100644 --- a/plane/values.yaml +++ b/plane/values.yaml @@ -1,4 +1,4 @@ -plane: +plane-ce: planeVersion: stable dockerRegistry: From 5781c6dddaf03de3df37d474ab6429e931a92f4f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 31 Aug 2024 07:23:47 -0500 Subject: [PATCH 0169/1058] update --- plane/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plane/values.yaml b/plane/values.yaml index 2b321a3..d45409c 100644 --- a/plane/values.yaml +++ b/plane/values.yaml @@ -11,7 +11,7 @@ plane-ce: enabled: true appHost: "plane.durp.info" minioHost: "plane-minio.durp.info" - ingressClass: "nginx" + ingressClass: "traefik" ingress_annotations: { "nginx.ingress.kubernetes.io/proxy-body-size": "5m", } From a1293abaf67b1516d59d206b4103c784c5aa8f22 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 31 Aug 2024 07:40:14 -0500 Subject: [PATCH 0170/1058] update --- argocd/templates/plane.yaml | 20 ------ plane/Chart.yaml | 11 --- plane/values.yaml | 131 ------------------------------------ 3 files changed, 162 deletions(-) delete mode 100644 argocd/templates/plane.yaml delete mode 100644 plane/Chart.yaml delete mode 100644 plane/values.yaml diff --git a/argocd/templates/plane.yaml b/argocd/templates/plane.yaml deleted file mode 100644 index 4906f0c..0000000 --- a/argocd/templates/plane.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: plane - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: plane - destination: - namespace: plane - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/plane/Chart.yaml b/plane/Chart.yaml deleted file mode 100644 index e53710e..0000000 --- a/plane/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: plane -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: plane-ce - repository: https://helm.plane.so/ - version: 1.0.22 diff --git a/plane/values.yaml b/plane/values.yaml deleted file mode 100644 index d45409c..0000000 --- a/plane/values.yaml +++ /dev/null @@ -1,131 +0,0 @@ -plane-ce: - planeVersion: stable - - dockerRegistry: - enabled: false - host: "index.docker.io/v1/" - loginid: makeplane - password: "" - - ingress: - enabled: true - appHost: "plane.durp.info" - minioHost: "plane-minio.durp.info" - ingressClass: "traefik" - ingress_annotations: { - "nginx.ingress.kubernetes.io/proxy-body-size": "5m", - } - - # SSL Configuration - Valid only if ingress.enabled is true - ssl: - createIssuer: false - issuer: "http" # Allowed : cloudflare, digitalocean, http - token: "" # not required for http - server: https://acme-v02.api.letsencrypt.org/directory - email: plane@example.com - generateCerts: false - - redis: - local_setup: true - image: valkey/valkey:7.2.5-alpine - servicePort: 6379 - storageClass: longhorn - volumeSize: 1Gi - pullPolicy: IfNotPresent - assign_cluster_ip: false - - postgres: - local_setup: true - image: postgres:15.5-alpine - servicePort: 5432 - cliConnectPort: "" - storageClass: longhorn - volumeSize: 5Gi - pullPolicy: IfNotPresent - assign_cluster_ip: false - - minio: - image: minio/minio:latest - local_setup: true - pullPolicy: IfNotPresent - root_password: password - root_user: admin - storageClass: longhorn - volumeSize: 5Gi - assign_cluster_ip: true - - web: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-frontend - pullPolicy: IfNotPresent - assign_cluster_ip: true - - space: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-space - pullPolicy: IfNotPresent - assign_cluster_ip: true - - admin: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-admin - pullPolicy: IfNotPresent - assign_cluster_ip: true - - api: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-backend - pullPolicy: IfNotPresent - assign_cluster_ip: false - - worker: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-backend - pullPolicy: IfNotPresent - - beatworker: - replicas: 1 - memoryLimit: 1000Mi - cpuLimit: 500m - image: makeplane/plane-backend - pullPolicy: IfNotPresent - - env: - pgdb_username: plane - pgdb_password: plane - pgdb_name: plane - pgdb_remote_url: "" #INCASE OF REMOTE PG DB URL ONLY - - # NEXT_PUBLIC_DEPLOY_URL: "" - # REDIS - remote_redis_url: "" #INCASE OF REMOTE REDIS ONLY - # POSTGRES DB VALUES - - # DATA STORE - docstore_bucket: "uploads" - doc_upload_size_limit: "5242880" # 5MB - - # REQUIRED IF MINIO LOCAL SETUP IS FALSE - aws_access_key: "" - aws_secret_access_key: "" - aws_region: "" - aws_s3_endpoint_url: "" - - secret_key: "60gp0byfz2dvffa45cxl20p1scy9xbpf6d8c5y0geejgkyp1b5" - - sentry_dsn: "" - sentry_environment: "" - - cors_allowed_origins: "" - default_cluster_domain: cluster.local - From 0bb5570668b712854e5c55eec4c629737b64a4ff Mon Sep 17 00:00:00 2001 From: pipeline Date: Mon, 2 Sep 2024 12:10:58 +0000 Subject: [PATCH 0171/1058] Update Chart --- durpapi/Chart.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 5a5784e..ec403f5 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -description: A Helm chart for Kubernetes -name: durpapi -appVersion: 0.1.0 +version: 0.1.0-dev0186 dependencies: -- condition: postgresql.enabled - name: postgresql +- name: postgresql version: 12.5.* + condition: postgresql.enabled repository: https://charts.bitnami.com/bitnami -version: 0.1.0-dev0184 -apiVersion: v2 +description: A Helm chart for Kubernetes type: application +appVersion: 0.1.0 +apiVersion: v2 +name: durpapi From 86e50e6ed8c1c55c319c768e13fa65560bb34703 Mon Sep 17 00:00:00 2001 From: pipeline Date: Wed, 4 Sep 2024 23:52:49 +0000 Subject: [PATCH 0172/1058] Update Chart --- durpapi/Chart.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index ec403f5..4f19dec 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -version: 0.1.0-dev0186 -dependencies: -- name: postgresql - version: 12.5.* - condition: postgresql.enabled - repository: https://charts.bitnami.com/bitnami description: A Helm chart for Kubernetes +version: 0.1.0-dev0190 type: application appVersion: 0.1.0 +dependencies: +- version: 12.5.* + repository: https://charts.bitnami.com/bitnami + name: postgresql + condition: postgresql.enabled apiVersion: v2 name: durpapi From f196ed4fbbde4bafe98cc304f0932285a9505110 Mon Sep 17 00:00:00 2001 From: pipeline Date: Sun, 8 Sep 2024 10:42:20 +0000 Subject: [PATCH 0173/1058] Update Chart --- durpapi/Chart.yaml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 4f19dec..82255c6 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -description: A Helm chart for Kubernetes -version: 0.1.0-dev0190 -type: application -appVersion: 0.1.0 -dependencies: -- version: 12.5.* - repository: https://charts.bitnami.com/bitnami - name: postgresql - condition: postgresql.enabled -apiVersion: v2 name: durpapi +description: A Helm chart for Kubernetes +appVersion: 0.1.0 +apiVersion: v2 +version: 0.1.0-dev0191 +type: application +dependencies: +- name: postgresql + version: 12.5.* + repository: https://charts.bitnami.com/bitnami + condition: postgresql.enabled From 2b951b2814d50728a18afa563bed40811d31fac6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 10 Sep 2024 04:43:57 -0500 Subject: [PATCH 0174/1058] update authentik version --- authentik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authentik/Chart.yaml b/authentik/Chart.yaml index 640dc35..3daffdf 100644 --- a/authentik/Chart.yaml +++ b/authentik/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: authentik repository: https://charts.goauthentik.io - version: 2024.4.1 + version: 2024.8.1 From eecf949f862b7e4595139ea3959d6c3f57411076 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 10 Sep 2024 04:48:15 -0500 Subject: [PATCH 0175/1058] Update worker count --- authentik/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/authentik/values.yaml b/authentik/values.yaml index bd03ad1..7c50f22 100644 --- a/authentik/values.yaml +++ b/authentik/values.yaml @@ -26,6 +26,8 @@ authentik: server: name: server replicas: 3 + worker: + replicas: 3 postgresql: enabled: true image: From 8b74b2efb6fe7bf7fb8eb9e71ffe694609fbf962 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 13 Sep 2024 06:10:15 -0500 Subject: [PATCH 0176/1058] Update chart version --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index b7b6417..e7b37ee 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.3.2 + version: 1.7.1 From c3cd2c0b8be2238080549fa30a8f62f6f66feac3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 13 Sep 2024 06:14:44 -0500 Subject: [PATCH 0177/1058] Update chart version --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index e7b37ee..75149be 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.7.1 + version: 1.4.2 From 10ce90a460f89efda2907c1e0521bf43642c5770 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 13 Sep 2024 06:17:56 -0500 Subject: [PATCH 0178/1058] Update chart version --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index 75149be..295037b 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.4.2 + version: 1.5.1 From 126c6e6f4569701f94423ddeb15487499d51644f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 13 Sep 2024 06:20:00 -0500 Subject: [PATCH 0179/1058] Update chart version --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index 295037b..eaac2bb 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.5.1 + version: 1.6.2 From 10fcd43274a33d5caf75a36b82b4d1fc04c029fd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 13 Sep 2024 06:23:48 -0500 Subject: [PATCH 0180/1058] Update chart version --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index eaac2bb..6fd47ad 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.6.2 + version: 1.5.5 From 3a4e96aaf02bc7f4a2830765ad037e789be7914f Mon Sep 17 00:00:00 2001 From: pipeline Date: Sat, 28 Sep 2024 21:44:17 +0000 Subject: [PATCH 0181/1058] Update Chart --- durpapi/Chart.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml index 82255c6..5012185 100644 --- a/durpapi/Chart.yaml +++ b/durpapi/Chart.yaml @@ -1,11 +1,11 @@ -name: durpapi +apiVersion: v2 +type: application +version: 0.1.0-dev0192 description: A Helm chart for Kubernetes appVersion: 0.1.0 -apiVersion: v2 -version: 0.1.0-dev0191 -type: application +name: durpapi dependencies: -- name: postgresql - version: 12.5.* - repository: https://charts.bitnami.com/bitnami +- version: 12.5.* condition: postgresql.enabled + repository: https://charts.bitnami.com/bitnami + name: postgresql From bd2def6d467ce654a0b4099e10b1f2ddc136ad37 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 06:18:47 -0500 Subject: [PATCH 0182/1058] Update chart version --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index 6fd47ad..8c0a8ae 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.5.5 + version: 1.6.1 From 49b23b1788004458e625526fe60854ed427c055f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 06:22:50 -0500 Subject: [PATCH 0183/1058] Update chart version --- longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml index 8c0a8ae..fde2188 100644 --- a/longhorn/Chart.yaml +++ b/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.6.1 + version: 1.7.1 \ No newline at end of file From e935822058319c79c28e565f4cadbf7ce245cbbd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 06:35:39 -0500 Subject: [PATCH 0184/1058] Update chart version --- authentik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/authentik/Chart.yaml b/authentik/Chart.yaml index 3daffdf..c75360e 100644 --- a/authentik/Chart.yaml +++ b/authentik/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: authentik repository: https://charts.goauthentik.io - version: 2024.8.1 + version: 2024.8.3 From 1aefb8163bcbd4afdbe38de44f24b0ba82557c6d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 06:39:44 -0500 Subject: [PATCH 0185/1058] Update chart version --- argocd/Chart.yaml | 2 +- authentik/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/argocd/Chart.yaml b/argocd/Chart.yaml index 07e391f..cdccf8c 100644 --- a/argocd/Chart.yaml +++ b/argocd/Chart.yaml @@ -9,6 +9,6 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 6.7.11 + version: 6.11.1 diff --git a/authentik/Chart.yaml b/authentik/Chart.yaml index c75360e..c87b677 100644 --- a/authentik/Chart.yaml +++ b/authentik/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: authentik repository: https://charts.goauthentik.io - version: 2024.8.3 + version: 2024.8.3 \ No newline at end of file From 1151680f65bf3a878284d0a385213e86f810139c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 06:42:16 -0500 Subject: [PATCH 0186/1058] Update chart version --- bitwarden/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bitwarden/templates/deployment.yaml b/bitwarden/templates/deployment.yaml index d6e1788..7d9c28b 100644 --- a/bitwarden/templates/deployment.yaml +++ b/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.internal.durp.info/vaultwarden/server:1.30.3 + image: registry.internal.durp.info/vaultwarden/server:1.32.0 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc From 45ae3523b9af8d94d380db7bb8de4564de537e8f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 06:43:58 -0500 Subject: [PATCH 0187/1058] Update chart version --- cert-manager/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cert-manager/Chart.yaml b/cert-manager/Chart.yaml index 8593f8c..e14d98b 100644 --- a/cert-manager/Chart.yaml +++ b/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: 1.*.* + version: v1.15.3 From 4e37bfb8dc6c4f7bda11d3f4ae4430c7ad74d9cf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:13:09 -0500 Subject: [PATCH 0188/1058] Update chart version --- crossplane/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crossplane/Chart.yaml b/crossplane/Chart.yaml index c7bf1ab..b0a80b7 100644 --- a/crossplane/Chart.yaml +++ b/crossplane/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: crossplane repository: https://charts.crossplane.io/stable - version: 1.12.0 + version: 1.17.1 From d5224c0c7f8f9c5e56c9d4804e0a4636fb1b62b6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:20:05 -0500 Subject: [PATCH 0189/1058] Update chart version --- external-dns/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external-dns/Chart.yaml b/external-dns/Chart.yaml index 24d735c..8fb36bc 100644 --- a/external-dns/Chart.yaml +++ b/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 6.20.3 + version: 8.3.8 From 3bfec1450f2ff6732531e1d7dde3d80eebe51d78 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:23:46 -0500 Subject: [PATCH 0190/1058] Update chart version --- external-secrets/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external-secrets/Chart.yaml b/external-secrets/Chart.yaml index 96c39ce..5b9982f 100644 --- a/external-secrets/Chart.yaml +++ b/external-secrets/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.8.1 + version: 0.10.4 From b1c45f939b4b0a9fe4621f76410c8c938317412b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:29:39 -0500 Subject: [PATCH 0191/1058] Update chart version --- gatekeeper/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gatekeeper/Chart.yaml b/gatekeeper/Chart.yaml index ebd28af..ec42676 100644 --- a/gatekeeper/Chart.yaml +++ b/gatekeeper/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: gatekeeper repository: https://open-policy-agent.github.io/gatekeeper/charts - version: 3.14.0 + version: 3.17.1 From e6a8aa74b4fcde2e833dcbed5f354ca4889ac220 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:34:52 -0500 Subject: [PATCH 0192/1058] Update chart version --- gatekeeper/values.yaml | 555 +++++++++++++++++++++-------------------- 1 file changed, 278 insertions(+), 277 deletions(-) diff --git a/gatekeeper/values.yaml b/gatekeeper/values.yaml index d01ace9..0b0c6e7 100644 --- a/gatekeeper/values.yaml +++ b/gatekeeper/values.yaml @@ -1,277 +1,278 @@ -gatekeeper: - replicas: 3 - revisionHistoryLimit: 10 - auditInterval: 60 - metricsBackends: ["prometheus"] - auditMatchKindOnly: false - constraintViolationsLimit: 20 - auditFromCache: false - disableMutation: false - disableValidatingWebhook: false - validatingWebhookName: gatekeeper-validating-webhook-configuration - validatingWebhookTimeoutSeconds: 3 - validatingWebhookFailurePolicy: Ignore - validatingWebhookAnnotations: {} - validatingWebhookExemptNamespacesLabels: {} - validatingWebhookObjectSelector: {} - validatingWebhookCheckIgnoreFailurePolicy: Fail - validatingWebhookCustomRules: {} - validatingWebhookURL: null - enableDeleteOperations: false - enableExternalData: true - enableGeneratorResourceExpansion: true - enableTLSHealthcheck: false - maxServingThreads: -1 - mutatingWebhookName: gatekeeper-mutating-webhook-configuration - mutatingWebhookFailurePolicy: Ignore - mutatingWebhookReinvocationPolicy: Never - mutatingWebhookAnnotations: {} - mutatingWebhookExemptNamespacesLabels: {} - mutatingWebhookObjectSelector: {} - mutatingWebhookTimeoutSeconds: 1 - mutatingWebhookCustomRules: {} - mutatingWebhookURL: null - mutationAnnotations: false - auditChunkSize: 500 - logLevel: INFO - logDenies: false - logMutations: false - emitAdmissionEvents: false - emitAuditEvents: false - admissionEventsInvolvedNamespace: false - auditEventsInvolvedNamespace: false - resourceQuota: true - externaldataProviderResponseCacheTTL: 3m - image: - repository: openpolicyagent/gatekeeper - crdRepository: openpolicyagent/gatekeeper-crds - release: v3.15.0-beta.0 - pullPolicy: Always - pullSecrets: [] - preInstall: - crdRepository: - image: - repository: null - tag: v3.15.0-beta.0 - postUpgrade: - labelNamespace: - enabled: false - image: - repository: openpolicyagent/gatekeeper-crds - tag: v3.15.0-beta.0 - pullPolicy: IfNotPresent - pullSecrets: [] - extraNamespaces: [] - podSecurity: ["pod-security.kubernetes.io/audit=restricted", - "pod-security.kubernetes.io/audit-version=latest", - "pod-security.kubernetes.io/warn=restricted", - "pod-security.kubernetes.io/warn-version=latest", - "pod-security.kubernetes.io/enforce=restricted", - "pod-security.kubernetes.io/enforce-version=v1.24"] - extraAnnotations: {} - priorityClassName: "" - affinity: {} - tolerations: [] - nodeSelector: {kubernetes.io/os: linux} - resources: {} - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsGroup: 999 - runAsNonRoot: true - runAsUser: 1000 - postInstall: - labelNamespace: - enabled: true - extraRules: [] - image: - repository: openpolicyagent/gatekeeper-crds - tag: v3.15.0-beta.0 - pullPolicy: IfNotPresent - pullSecrets: [] - extraNamespaces: [] - podSecurity: ["pod-security.kubernetes.io/audit=restricted", - "pod-security.kubernetes.io/audit-version=latest", - "pod-security.kubernetes.io/warn=restricted", - "pod-security.kubernetes.io/warn-version=latest", - "pod-security.kubernetes.io/enforce=restricted", - "pod-security.kubernetes.io/enforce-version=v1.24"] - extraAnnotations: {} - priorityClassName: "" - probeWebhook: - enabled: true - image: - repository: curlimages/curl - tag: 7.83.1 - pullPolicy: IfNotPresent - pullSecrets: [] - waitTimeout: 60 - httpTimeout: 2 - insecureHTTPS: false - priorityClassName: "" - affinity: {} - tolerations: [] - nodeSelector: {kubernetes.io/os: linux} - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsGroup: 999 - runAsNonRoot: true - runAsUser: 1000 - preUninstall: - deleteWebhookConfigurations: - extraRules: [] - enabled: false - image: - repository: openpolicyagent/gatekeeper-crds - tag: v3.15.0-beta.0 - pullPolicy: IfNotPresent - pullSecrets: [] - priorityClassName: "" - affinity: {} - tolerations: [] - nodeSelector: {kubernetes.io/os: linux} - resources: {} - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsGroup: 999 - runAsNonRoot: true - runAsUser: 1000 - podAnnotations: {} - auditPodAnnotations: {} - podLabels: {} - podCountLimit: "100" - secretAnnotations: {} - enableRuntimeDefaultSeccompProfile: true - controllerManager: - exemptNamespaces: [] - exemptNamespacePrefixes: [] - hostNetwork: false - dnsPolicy: ClusterFirst - port: 8443 - metricsPort: 8888 - healthPort: 9090 - readinessTimeout: 1 - livenessTimeout: 1 - priorityClassName: system-cluster-critical - disableCertRotation: false - tlsMinVersion: 1.3 - clientCertName: "" - strategyType: RollingUpdate - affinity: - podAntiAffinity: - preferredDuringSchedulingIgnoredDuringExecution: - - podAffinityTerm: - labelSelector: - matchExpressions: - - key: gatekeeper.sh/operation - operator: In - values: - - webhook - topologyKey: kubernetes.io/hostname - weight: 100 - topologySpreadConstraints: [] - tolerations: [] - nodeSelector: {kubernetes.io/os: linux} - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 512Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsGroup: 999 - runAsNonRoot: true - runAsUser: 1000 - podSecurityContext: - fsGroup: 999 - supplementalGroups: - - 999 - extraRules: [] - networkPolicy: - enabled: false - ingress: { } - # - from: - # - ipBlock: - # cidr: 0.0.0.0/0 - audit: - enablePubsub: false - connection: audit-connection - channel: audit-channel - hostNetwork: false - dnsPolicy: ClusterFirst - metricsPort: 8888 - healthPort: 9090 - readinessTimeout: 1 - livenessTimeout: 1 - priorityClassName: system-cluster-critical - disableCertRotation: false - affinity: {} - tolerations: [] - nodeSelector: {kubernetes.io/os: linux} - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 512Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsGroup: 999 - runAsNonRoot: true - runAsUser: 1000 - podSecurityContext: - fsGroup: 999 - supplementalGroups: - - 999 - writeToRAMDisk: false - extraRules: [] - crds: - affinity: {} - tolerations: [] - nodeSelector: {kubernetes.io/os: linux} - resources: {} - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsGroup: 65532 - runAsNonRoot: true - runAsUser: 65532 - pdb: - controllerManager: - minAvailable: 1 - service: {} - disabledBuiltins: ["{http.send}"] - psp: - enabled: true - upgradeCRDs: - enabled: true - extraRules: [] - priorityClassName: "" - rbac: - create: true - externalCertInjection: - enabled: false - secretName: gatekeeper-webhook-server-cert +#gatekeeper: +# replicas: 3 +# revisionHistoryLimit: 10 +# auditInterval: 60 +# metricsBackends: ["prometheus"] +# auditMatchKindOnly: false +# constraintViolationsLimit: 20 +# auditFromCache: false +# disableMutation: false +# disableValidatingWebhook: false +# validatingWebhookName: gatekeeper-validating-webhook-configuration +# validatingWebhookTimeoutSeconds: 3 +# validatingWebhookFailurePolicy: Ignore +# validatingWebhookAnnotations: {} +# validatingWebhookExemptNamespacesLabels: {} +# validatingWebhookObjectSelector: {} +# validatingWebhookCheckIgnoreFailurePolicy: Fail +# validatingWebhookCustomRules: {} +# validatingWebhookURL: null +# enableDeleteOperations: false +# enableExternalData: true +# enableGeneratorResourceExpansion: true +# enableTLSHealthcheck: false +# maxServingThreads: -1 +# mutatingWebhookName: gatekeeper-mutating-webhook-configuration +# mutatingWebhookFailurePolicy: Ignore +# mutatingWebhookReinvocationPolicy: Never +# mutatingWebhookAnnotations: {} +# mutatingWebhookExemptNamespacesLabels: {} +# mutatingWebhookObjectSelector: {} +# mutatingWebhookTimeoutSeconds: 1 +# mutatingWebhookCustomRules: {} +# mutatingWebhookURL: null +# mutationAnnotations: false +# auditChunkSize: 500 +# logLevel: INFO +# logDenies: false +# logMutations: false +# emitAdmissionEvents: false +# emitAuditEvents: false +# admissionEventsInvolvedNamespace: false +# auditEventsInvolvedNamespace: false +# resourceQuota: true +# externaldataProviderResponseCacheTTL: 3m +# image: +# repository: openpolicyagent/gatekeeper +# crdRepository: openpolicyagent/gatekeeper-crds +# release: v3.15.0-beta.0 +# pullPolicy: Always +# pullSecrets: [] +# preInstall: +# crdRepository: +# image: +# repository: null +# tag: v3.15.0-beta.0 +# postUpgrade: +# labelNamespace: +# enabled: false +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# extraNamespaces: [] +# podSecurity: ["pod-security.kubernetes.io/audit=restricted", +# "pod-security.kubernetes.io/audit-version=latest", +# "pod-security.kubernetes.io/warn=restricted", +# "pod-security.kubernetes.io/warn-version=latest", +# "pod-security.kubernetes.io/enforce=restricted", +# "pod-security.kubernetes.io/enforce-version=v1.24"] +# extraAnnotations: {} +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# postInstall: +# labelNamespace: +# enabled: true +# extraRules: [] +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# extraNamespaces: [] +# podSecurity: ["pod-security.kubernetes.io/audit=restricted", +# "pod-security.kubernetes.io/audit-version=latest", +# "pod-security.kubernetes.io/warn=restricted", +# "pod-security.kubernetes.io/warn-version=latest", +# "pod-security.kubernetes.io/enforce=restricted", +# "pod-security.kubernetes.io/enforce-version=v1.24"] +# extraAnnotations: {} +# priorityClassName: "" +# probeWebhook: +# enabled: true +# image: +# repository: curlimages/curl +# tag: 7.83.1 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# waitTimeout: 60 +# httpTimeout: 2 +# insecureHTTPS: false +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# preUninstall: +# deleteWebhookConfigurations: +# extraRules: [] +# enabled: false +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podAnnotations: {} +# auditPodAnnotations: {} +# podLabels: {} +# podCountLimit: "100" +# secretAnnotations: {} +# enableRuntimeDefaultSeccompProfile: true +# controllerManager: +# exemptNamespaces: [] +# exemptNamespacePrefixes: [] +# hostNetwork: false +# dnsPolicy: ClusterFirst +# port: 8443 +# metricsPort: 8888 +# healthPort: 9090 +# readinessTimeout: 1 +# livenessTimeout: 1 +# priorityClassName: system-cluster-critical +# disableCertRotation: false +# tlsMinVersion: 1.3 +# clientCertName: "" +# strategyType: RollingUpdate +# affinity: +# podAntiAffinity: +# preferredDuringSchedulingIgnoredDuringExecution: +# - podAffinityTerm: +# labelSelector: +# matchExpressions: +# - key: gatekeeper.sh/operation +# operator: In +# values: +# - webhook +# topologyKey: kubernetes.io/hostname +# weight: 100 +# topologySpreadConstraints: [] +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: +# limits: +# memory: 512Mi +# requests: +# cpu: 100m +# memory: 512Mi +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podSecurityContext: +# fsGroup: 999 +# supplementalGroups: +# - 999 +# extraRules: [] +# networkPolicy: +# enabled: false +# ingress: { } +# # - from: +# # - ipBlock: +# # cidr: 0.0.0.0/0 +# audit: +# enablePubsub: false +# connection: audit-connection +# channel: audit-channel +# hostNetwork: false +# dnsPolicy: ClusterFirst +# metricsPort: 8888 +# healthPort: 9090 +# readinessTimeout: 1 +# livenessTimeout: 1 +# priorityClassName: system-cluster-critical +# disableCertRotation: false +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: +# limits: +# memory: 512Mi +# requests: +# cpu: 100m +# memory: 512Mi +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podSecurityContext: +# fsGroup: 999 +# supplementalGroups: +# - 999 +# writeToRAMDisk: false +# extraRules: [] +# crds: +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 65532 +# runAsNonRoot: true +# runAsUser: 65532 +# pdb: +# controllerManager: +# minAvailable: 1 +# service: {} +# disabledBuiltins: ["{http.send}"] +# psp: +# enabled: true +# upgradeCRDs: +# enabled: true +# extraRules: [] +# priorityClassName: "" +# rbac: +# create: true +# externalCertInjection: +# enabled: false +# secretName: gatekeeper-webhook-server-cert +# \ No newline at end of file From f64bdfbedd7fa6d0b271135f5076f93b0fdc4e36 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:39:11 -0500 Subject: [PATCH 0193/1058] Update chart version --- gitlab-runner/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gitlab-runner/Chart.yaml b/gitlab-runner/Chart.yaml index c04efe7..f64e829 100644 --- a/gitlab-runner/Chart.yaml +++ b/gitlab-runner/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: gitlab-runner repository: https://charts.gitlab.io/ - version: 0.43.0 + version: 0.69.0 From a565952e0c83624c6cf43253261244a9fb2ef42a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:48:50 -0500 Subject: [PATCH 0194/1058] Update chart version --- heimdall/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/heimdall/Chart.yaml b/heimdall/Chart.yaml index 8351778..39dbf54 100644 --- a/heimdall/Chart.yaml +++ b/heimdall/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: heimdall repository: https://djjudas21.github.io/charts/ - version: 8.5.2 + version: 8.5.4 From 7f6e182084e0e7e0e6eed7845d9a0549a7f10453 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 07:50:40 -0500 Subject: [PATCH 0195/1058] Update chart version --- kube-prometheus-stack/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kube-prometheus-stack/Chart.yaml b/kube-prometheus-stack/Chart.yaml index 3cd9e24..ecb4ab2 100644 --- a/kube-prometheus-stack/Chart.yaml +++ b/kube-prometheus-stack/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: kube-prometheus-stack repository: https://prometheus-community.github.io/helm-charts - version: 40.5.0 + version: 63.1.0 From 1284e2ec60415c444289d952751971efaaff605e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:28:14 -0500 Subject: [PATCH 0196/1058] Update chart version --- kubeclarity/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kubeclarity/Chart.yaml b/kubeclarity/Chart.yaml index 6c050c2..4eef59a 100644 --- a/kubeclarity/Chart.yaml +++ b/kubeclarity/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: kubeclarity repository: https://openclarity.github.io/kubeclarity - version: 2.22.0 + version: 2.23.3 From 4826c5beb625e10a7bc2ccfb87412a69c05db63c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:33:29 -0500 Subject: [PATCH 0197/1058] Update chart version --- metallb-system/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/metallb-system/Chart.yaml b/metallb-system/Chart.yaml index c90584f..0f6506f 100644 --- a/metallb-system/Chart.yaml +++ b/metallb-system/Chart.yaml @@ -9,5 +9,5 @@ appVersion: "1.16.0" dependencies: - name: metallb repository: https://metallb.github.io/metallb - version: 0.14.5 + version: 0.14.8 From 599e86e1a9d49e9dbc18c5e0fbf9f2c5695bb717 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:37:42 -0500 Subject: [PATCH 0198/1058] Update chart version --- traefik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml index 1ebbb2d..aaa59ba 100644 --- a/traefik/Chart.yaml +++ b/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 22.1.0 + version: 32.0.0 From 6705352a1038a8c1711f3e7593880abda478e086 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:41:06 -0500 Subject: [PATCH 0199/1058] Update chart version --- traefik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml index aaa59ba..e8fb699 100644 --- a/traefik/Chart.yaml +++ b/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 32.0.0 + version: 27.0.2 \ No newline at end of file From f9987ac705cbc5db3883e021ac12d4b19006ce8d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:43:01 -0500 Subject: [PATCH 0200/1058] Update chart version --- traefik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml index e8fb699..1ebbb2d 100644 --- a/traefik/Chart.yaml +++ b/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 27.0.2 \ No newline at end of file + version: 22.1.0 From dde4eac2387f5fca1503192b6bccfef5697db70f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:43:25 -0500 Subject: [PATCH 0201/1058] Update chart version --- traefik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml index 1ebbb2d..e64f4d2 100644 --- a/traefik/Chart.yaml +++ b/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 22.1.0 + version: 23.0.0 From 4a67df78b3864e6bfa999052afb8713a62c32d8d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:45:48 -0500 Subject: [PATCH 0202/1058] Update chart version --- traefik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml index e64f4d2..5378476 100644 --- a/traefik/Chart.yaml +++ b/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 23.0.0 + version: 24.0.0 From dd3ca7c9a421712a85680b3cce4f8763df3eb900 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:51:08 -0500 Subject: [PATCH 0203/1058] Update chart version --- internalproxy/templates/argocd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index 15dfaf9..fe7c24a 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: argocd-ingress From 9b1680cfc8d02071c7c4f59062bc73930110ea02 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:54:11 -0500 Subject: [PATCH 0204/1058] Update chart version --- argocd/templates/argocd.yaml | 39 ++++++++++++ internalproxy/templates/argocd.yaml | 92 ++++++++++++++--------------- 2 files changed, 85 insertions(+), 46 deletions(-) diff --git a/argocd/templates/argocd.yaml b/argocd/templates/argocd.yaml index d8f0fd3..417915e 100644 --- a/argocd/templates/argocd.yaml +++ b/argocd/templates/argocd.yaml @@ -18,3 +18,42 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: argocd-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`argocd.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: argocd-server + port: 443 + scheme: https + tls: + secretName: argocd-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: argocd-tls +spec: + secretName: argocd-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "argocd.internal.durp.info" + dnsNames: + - "argocd.internal.durp.info" diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml index fe7c24a..9a82e9e 100644 --- a/internalproxy/templates/argocd.yaml +++ b/internalproxy/templates/argocd.yaml @@ -1,46 +1,46 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: argocd-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`argocd.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: argocd-server - port: 443 - scheme: https - tls: - secretName: argocd-tls - ---- - -kind: Service -apiVersion: v1 -metadata: - name: argocd-server -spec: - type: ExternalName - externalName: argocd-server.argocd.svc.cluster.local - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: argocd-tls -spec: - secretName: argocd-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "argocd.internal.durp.info" - dnsNames: - - "argocd.internal.durp.info" \ No newline at end of file +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: argocd-ingress +# annotations: +# cert-manager.io/cluster-issuer: letsencrypt-production +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`argocd.internal.durp.info`) +# middlewares: +# - name: whitelist +# namespace: traefik +# kind: Rule +# services: +# - name: argocd-server +# port: 443 +# scheme: https +# tls: +# secretName: argocd-tls +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: argocd-server +#spec: +# type: ExternalName +# externalName: argocd-server.argocd.svc.cluster.local +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: argocd-tls +#spec: +# secretName: argocd-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "argocd.internal.durp.info" +# dnsNames: +# - "argocd.internal.durp.info" \ No newline at end of file From 679742ab459f6df126e056bd42b19f1cc3396b21 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:55:44 -0500 Subject: [PATCH 0205/1058] Update chart version --- traefik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml index 5378476..9151567 100644 --- a/traefik/Chart.yaml +++ b/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 24.0.0 + version: 25.0.0 From 97d73b36c4950c989a12b19b415aff62025592f1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Sep 2024 08:56:15 -0500 Subject: [PATCH 0206/1058] Update chart version --- traefik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml index 9151567..5378476 100644 --- a/traefik/Chart.yaml +++ b/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 25.0.0 + version: 24.0.0 From 7cbe7932f19971a78dd2e735e66c034d3e5609de Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 30 Sep 2024 04:41:20 -0500 Subject: [PATCH 0207/1058] Update chart version --- vault/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vault/Chart.yaml b/vault/Chart.yaml index fc08adf..1ad2d4a 100644 --- a/vault/Chart.yaml +++ b/vault/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: vault repository: https://helm.releases.hashicorp.com - version: 0.27.0 + version: 0.28.1 From 8ca00e27154f9125c7fa21309ccc17dcdbf2c7a6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 30 Sep 2024 04:45:20 -0500 Subject: [PATCH 0208/1058] Update chart version --- vault/values.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/vault/values.yaml b/vault/values.yaml index b8f0102..abe60d3 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -4,12 +4,10 @@ vault: image: repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.3.1" pullPolicy: Always agentImage: repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.15.2" injector: enabled: "-" @@ -23,18 +21,15 @@ vault: image: repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.3.1" pullPolicy: Always agentImage: repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.15.2" server: enabled: "-" image: repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.15.2" pullPolicy: Always ha: enabled: false From a1b05d6f8a2043bd22d76cd97378503e6a88659d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 30 Sep 2024 04:47:53 -0500 Subject: [PATCH 0209/1058] Update chart version --- vault/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/vault/values.yaml b/vault/values.yaml index abe60d3..b7c6d88 100644 --- a/vault/values.yaml +++ b/vault/values.yaml @@ -4,10 +4,12 @@ vault: image: repository: "registry.internal.durp.info/hashicorp/vault-k8s" + tag: "1.4.2" pullPolicy: Always agentImage: repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" injector: enabled: "-" @@ -21,15 +23,18 @@ vault: image: repository: "registry.internal.durp.info/hashicorp/vault-k8s" + tag: "1.4.2" pullPolicy: Always agentImage: repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" server: enabled: "-" image: repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" pullPolicy: Always ha: enabled: false From 47214c5a93dc1dbf74de4ed083af73023277c977 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 15 Oct 2024 11:12:18 +0000 Subject: [PATCH 0210/1058] Update file values.yaml --- authentik/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/authentik/values.yaml b/authentik/values.yaml index 7c50f22..716e081 100644 --- a/authentik/values.yaml +++ b/authentik/values.yaml @@ -44,6 +44,9 @@ authentik: - ReadWriteMany redis: enabled: true + master: + persistence: + enabled: false image: registry: registry.internal.durp.info repository: bitnami/redis From f1f8a9e837a5edbebd625b76e5cd14e0d3c62c23 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 17 Nov 2024 09:21:29 -0600 Subject: [PATCH 0211/1058] update IP range --- traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 6ca24f5..048ada5 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -30,7 +30,7 @@ metadata: spec: ipWhiteList: sourceRange: - - 192.168.20.1/32 + - 192.168.20.0/32 - 10.0.0.0/8 - 192.168.30.0/24 - 192.168.130.0/24 From 6645dd77f63ff66194c72c98d5676b46053dd67f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 17 Nov 2024 10:24:23 -0600 Subject: [PATCH 0212/1058] update IP range --- traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 048ada5..824777a 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -30,7 +30,7 @@ metadata: spec: ipWhiteList: sourceRange: - - 192.168.20.0/32 + - 192.168.20.0/24 - 10.0.0.0/8 - 192.168.30.0/24 - 192.168.130.0/24 From e60030016ee37f33105d33c99bdd878e02c4e49a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 13 Dec 2024 10:52:57 +0000 Subject: [PATCH 0213/1058] Update file ollama.yaml --- internalproxy/templates/ollama.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index 4834ff5..1468c76 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -47,7 +47,7 @@ metadata: name: ollama subsets: - addresses: - - ip: 192.168.20.104 + - ip: 192.168.30.99 ports: - name: app port: 11435 From 47d4e5015e64475ff7febf156114a1c7fd4b4992 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 15 Dec 2024 08:00:55 -0600 Subject: [PATCH 0214/1058] Update ollama auth --- dmz/internalproxy/templates/ollama.yaml | 101 ++++++++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 dmz/internalproxy/templates/ollama.yaml diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml new file mode 100644 index 0000000..4834ff5 --- /dev/null +++ b/dmz/internalproxy/templates/ollama.yaml @@ -0,0 +1,101 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ollama-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: ollama-secret + data: + - secretKey: users + remoteRef: + key: secrets/internalproxy/ollama + property: users + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: ollama-basic-auth +spec: + basicAuth: + secret: ollama-secret + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: ollama-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`ollama.durp.info`) && PathPrefix(`/`) + middlewares: + - name: ollama-basic-auth + kind: Rule + services: + - name: ollama + port: 11435 + tls: + secretName: ollama-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls +spec: + secretName: ollama-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "ollama.durp.info" + dnsNames: + - "ollama.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: ollama-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +spec: + type: ExternalName + externalName: durp.info From 54e12aa8c122198ca4fec903df36cced11882dfa Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 15 Dec 2024 08:04:32 -0600 Subject: [PATCH 0215/1058] Update ollama auth --- internalproxy/templates/ollama.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index 1468c76..ae7b9b6 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -22,6 +22,7 @@ metadata: name: ollama-basic-auth spec: basicAuth: + headerField: x-api-key secret: ollama-secret --- From 2d4d3773b7b1cdfeda51a4e4811457719d3ccaad Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 19 Dec 2024 05:00:42 -0600 Subject: [PATCH 0216/1058] Update ollama --- internalproxy/templates/ollama.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml index ae7b9b6..75e8691 100644 --- a/internalproxy/templates/ollama.yaml +++ b/internalproxy/templates/ollama.yaml @@ -48,7 +48,7 @@ metadata: name: ollama subsets: - addresses: - - ip: 192.168.30.99 + - ip: 192.168.20.104 ports: - name: app port: 11435 From dc324a2d8b9543b4b06c5a07331044364e6e6ec9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 4 Jan 2025 07:17:43 -0600 Subject: [PATCH 0217/1058] Update whitelist --- traefik/templates/middlewares.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml index 824777a..6ed5f31 100644 --- a/traefik/templates/middlewares.yaml +++ b/traefik/templates/middlewares.yaml @@ -34,3 +34,4 @@ spec: - 10.0.0.0/8 - 192.168.30.0/24 - 192.168.130.0/24 + - 192.168.131.0/24 From c39f20e371032e2d9745fa600d563b5f357b1b00 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 6 Jan 2025 05:01:00 -0600 Subject: [PATCH 0218/1058] Update folder location --- argocd/templates/InternalProxy.yaml | 2 +- argocd/templates/argocd.yaml | 2 +- argocd/templates/authentik.yaml | 2 +- argocd/templates/bitwarden.yaml | 2 +- argocd/templates/cert-manager.yaml | 2 +- argocd/templates/crossplane.yml | 2 +- argocd/templates/durpapi.yaml | 2 +- argocd/templates/durpot.yaml | 2 +- argocd/templates/external-dns.yaml | 2 +- argocd/templates/external-secrets.yaml | 2 +- argocd/templates/gatekeeper.yaml | 2 +- argocd/templates/gitlab-runner.yaml | 2 +- argocd/templates/heimdall.yaml | 2 +- argocd/templates/krakend.yaml | 2 +- argocd/templates/kube-prometheus-stack.yaml | 2 +- argocd/templates/kubeclarity.yaml | 2 +- argocd/templates/littlelink.yaml | 2 +- argocd/templates/longhorn.yaml | 2 +- argocd/templates/metallb-system.yaml | 2 +- argocd/templates/nfs-client.yaml | 2 +- argocd/templates/open-webui.yaml | 2 +- argocd/templates/traefik.yaml | 2 +- argocd/templates/uptimekuma.yaml | 2 +- argocd/templates/vault.yaml | 4 +- master/argocd/Chart.yaml | 14 + master/argocd/templates/InternalProxy.yaml | 23 + master/argocd/templates/argocd.yaml | 59 + master/argocd/templates/authentik.yaml | 21 + master/argocd/templates/bitwarden.yaml | 23 + master/argocd/templates/cert-manager.yaml | 20 + master/argocd/templates/crossplane.yml | 20 + master/argocd/templates/durpapi.yaml | 20 + master/argocd/templates/durpot.yaml | 20 + master/argocd/templates/external-dns.yaml | 20 + master/argocd/templates/external-secrets.yaml | 20 + master/argocd/templates/gatekeeper.yaml | 20 + master/argocd/templates/gitlab-runner.yaml | 21 + master/argocd/templates/heimdall.yaml | 20 + master/argocd/templates/krakend.yaml | 20 + .../templates/kube-prometheus-stack.yaml | 21 + master/argocd/templates/kubeclarity.yaml | 20 + master/argocd/templates/littlelink.yaml | 22 + master/argocd/templates/longhorn.yaml | 21 + master/argocd/templates/metallb-system.yaml | 22 + master/argocd/templates/nfs-client.yaml | 23 + master/argocd/templates/open-webui.yaml | 20 + master/argocd/templates/secrets.yaml | 17 + master/argocd/templates/traefik.yaml | 20 + master/argocd/templates/uptimekuma.yaml | 23 + master/argocd/templates/vault.yaml | 25 + master/argocd/values.yaml | 62 + master/authentik/Chart.yaml | 12 + master/authentik/templates/authentik-pv.yaml | 24 + master/authentik/templates/authentik-pvc.yaml | 18 + master/authentik/templates/ingress.yaml | 42 + master/authentik/templates/secrets.yaml | 28 + master/authentik/values.yaml | 56 + master/bitwarden/Chart.yaml | 7 + master/bitwarden/templates/bitwarden-pv.yaml | 25 + master/bitwarden/templates/bitwarden-pvc.yaml | 11 + master/bitwarden/templates/deployment.yaml | 50 + master/bitwarden/templates/ingress.yaml | 42 + master/bitwarden/templates/secrets.yaml | 16 + master/bitwarden/templates/service.yaml | 12 + master/cert-manager/Chart.yaml | 11 + .../templates/letsencrypt-prroduction.yaml | 16 + .../templates/letsencrypt-staging.yaml | 16 + .../cert-manager/templates/sealedsecret.yaml | 16 + master/cert-manager/values.yaml | 25 + master/crossplane/Chart.yaml | 12 + master/crossplane/templates/gitlab.yml | 55 + master/dashboards/nginx-dashboard.yaml | 1506 +++++++++++++++++ master/durpapi/Chart.yaml | 13 + master/durpapi/templates/deployment.yaml | 38 + master/durpapi/templates/hpa.yaml | 24 + master/durpapi/templates/ingress.yaml | 44 + master/durpapi/templates/secrets.yaml | 39 + master/durpapi/templates/service.yaml | 12 + master/durpapi/values.yaml | 39 + master/durpot/Chart.yaml | 11 + master/durpot/templates/secrets.yaml | 43 + master/external-dns/Chart.yaml | 12 + master/external-dns/templates/secrets.yaml | 23 + master/external-dns/values.yaml | 16 + master/external-secrets/Chart.yaml | 12 + master/external-secrets/values.yaml | 463 +++++ master/gatekeeper/Chart.yaml | 11 + master/gatekeeper/values.yaml | 278 +++ master/gitlab-runner/Chart.yaml | 11 + master/gitlab-runner/Dockerfile | 4 + master/gitlab-runner/templates/secrets.yaml | 19 + master/gitlab-runner/values.yaml | 71 + master/heimdall/Chart.yaml | 11 + master/heimdall/templates/ingress.yaml | 52 + master/heimdall/values.yaml | 28 + master/internalproxy/Chart.yaml | 7 + master/internalproxy/templates/argocd.yaml | 46 + master/internalproxy/templates/blueiris.yaml | 63 + .../templates/duplicati-ingress.yaml | 70 + master/internalproxy/templates/gitea.yaml | 72 + master/internalproxy/templates/jellyfin.yaml | 72 + master/internalproxy/templates/kasm.yaml | 72 + master/internalproxy/templates/minio.yaml | 63 + master/internalproxy/templates/nexus.yaml | 71 + master/internalproxy/templates/octopus.yaml | 63 + master/internalproxy/templates/ollama.yaml | 102 ++ master/internalproxy/templates/pfsense.yaml | 63 + master/internalproxy/templates/plex.yaml | 72 + master/internalproxy/templates/portainer.yaml | 63 + master/internalproxy/templates/proxmox.yaml | 63 + .../templates/registry-internal.yaml | 59 + master/internalproxy/templates/registry.yaml | 71 + master/internalproxy/templates/s3.yaml | 63 + master/internalproxy/templates/semaphore.yaml | 63 + master/internalproxy/templates/smokeping.yaml | 82 + master/internalproxy/templates/speedtest.yaml | 74 + master/internalproxy/templates/tdarr.yaml | 67 + master/internalproxy/templates/unraid.yaml | 63 + master/internalproxy/templates/wazuh.yaml | 63 + master/krakend/Chart.yaml | 7 + master/krakend/templates/deployments.yaml | 39 + master/krakend/templates/ingress.yaml | 56 + master/krakend/templates/secrets.yaml | 15 + master/krakend/templates/service.yaml | 12 + master/kube-prometheus-stack/Chart.yaml | 12 + .../templates/grafana-secrets-sealed.yaml | 41 + .../templates/ingress.yaml | 80 + master/kube-prometheus-stack/values.yaml | 203 +++ master/kubeclarity/Chart.yaml | 11 + master/kubeclarity/templates/ingress.yaml | 47 + master/kubeclarity/values.yaml | 235 +++ master/littlelink/Chart.yaml | 0 master/littlelink/templates/deployment.yaml | 99 ++ master/littlelink/templates/ingress.yaml | 42 + master/littlelink/templates/service.yaml | 12 + master/longhorn/Chart.yaml | 12 + master/longhorn/templates/ingress.yaml | 41 + master/longhorn/templates/secrets.yaml | 24 + master/longhorn/values.yaml | 253 +++ master/metallb-system/Chart.yaml | 13 + master/metallb-system/templates/config.yaml | 17 + master/metallb-system/values.yaml | 197 +++ master/nfs-client/Chart.yml | 8 + .../templates/cluster-role-binding.yml | 12 + master/nfs-client/templates/cluster-role.yml | 20 + master/nfs-client/templates/provisioner.yml | 42 + master/nfs-client/templates/role-binding.yml | 13 + master/nfs-client/templates/role.yml | 9 + .../nfs-client/templates/service-account.yml | 5 + master/nfs-client/templates/storage-class.yml | 10 + master/open-webui/Chart.yaml | 7 + master/open-webui/templates/deployment.yaml | 37 + master/open-webui/templates/ingress.yaml | 42 + master/open-webui/templates/pvc.yaml | 11 + master/open-webui/templates/secrets.yaml | 16 + master/open-webui/templates/service.yaml | 12 + master/traefik/Chart.yaml | 11 + master/traefik/templates/ingress.yaml | 39 + master/traefik/templates/middlewares.yaml | 37 + master/traefik/values.yaml | 887 ++++++++++ master/uptimekuma/Chart.yaml | 7 + master/uptimekuma/templates/deployment.yaml | 42 + master/uptimekuma/templates/ingress.yaml | 45 + master/uptimekuma/templates/kuma-pv.yaml | 25 + master/uptimekuma/templates/kuma-pvc.yaml | 12 + master/uptimekuma/templates/service.yaml | 13 + master/vault/Chart.yaml | 12 + master/vault/templates/ingress.yaml | 37 + master/vault/templates/secret-store.yaml | 14 + master/vault/values.yaml | 65 + 170 files changed, 8461 insertions(+), 25 deletions(-) create mode 100644 master/argocd/Chart.yaml create mode 100644 master/argocd/templates/InternalProxy.yaml create mode 100644 master/argocd/templates/argocd.yaml create mode 100644 master/argocd/templates/authentik.yaml create mode 100644 master/argocd/templates/bitwarden.yaml create mode 100644 master/argocd/templates/cert-manager.yaml create mode 100644 master/argocd/templates/crossplane.yml create mode 100644 master/argocd/templates/durpapi.yaml create mode 100644 master/argocd/templates/durpot.yaml create mode 100644 master/argocd/templates/external-dns.yaml create mode 100644 master/argocd/templates/external-secrets.yaml create mode 100644 master/argocd/templates/gatekeeper.yaml create mode 100644 master/argocd/templates/gitlab-runner.yaml create mode 100644 master/argocd/templates/heimdall.yaml create mode 100644 master/argocd/templates/krakend.yaml create mode 100644 master/argocd/templates/kube-prometheus-stack.yaml create mode 100644 master/argocd/templates/kubeclarity.yaml create mode 100644 master/argocd/templates/littlelink.yaml create mode 100644 master/argocd/templates/longhorn.yaml create mode 100644 master/argocd/templates/metallb-system.yaml create mode 100644 master/argocd/templates/nfs-client.yaml create mode 100644 master/argocd/templates/open-webui.yaml create mode 100644 master/argocd/templates/secrets.yaml create mode 100644 master/argocd/templates/traefik.yaml create mode 100644 master/argocd/templates/uptimekuma.yaml create mode 100644 master/argocd/templates/vault.yaml create mode 100644 master/argocd/values.yaml create mode 100644 master/authentik/Chart.yaml create mode 100644 master/authentik/templates/authentik-pv.yaml create mode 100644 master/authentik/templates/authentik-pvc.yaml create mode 100644 master/authentik/templates/ingress.yaml create mode 100644 master/authentik/templates/secrets.yaml create mode 100644 master/authentik/values.yaml create mode 100644 master/bitwarden/Chart.yaml create mode 100644 master/bitwarden/templates/bitwarden-pv.yaml create mode 100644 master/bitwarden/templates/bitwarden-pvc.yaml create mode 100644 master/bitwarden/templates/deployment.yaml create mode 100644 master/bitwarden/templates/ingress.yaml create mode 100644 master/bitwarden/templates/secrets.yaml create mode 100644 master/bitwarden/templates/service.yaml create mode 100644 master/cert-manager/Chart.yaml create mode 100644 master/cert-manager/templates/letsencrypt-prroduction.yaml create mode 100644 master/cert-manager/templates/letsencrypt-staging.yaml create mode 100644 master/cert-manager/templates/sealedsecret.yaml create mode 100644 master/cert-manager/values.yaml create mode 100644 master/crossplane/Chart.yaml create mode 100644 master/crossplane/templates/gitlab.yml create mode 100644 master/dashboards/nginx-dashboard.yaml create mode 100644 master/durpapi/Chart.yaml create mode 100644 master/durpapi/templates/deployment.yaml create mode 100644 master/durpapi/templates/hpa.yaml create mode 100644 master/durpapi/templates/ingress.yaml create mode 100644 master/durpapi/templates/secrets.yaml create mode 100644 master/durpapi/templates/service.yaml create mode 100644 master/durpapi/values.yaml create mode 100644 master/durpot/Chart.yaml create mode 100644 master/durpot/templates/secrets.yaml create mode 100644 master/external-dns/Chart.yaml create mode 100644 master/external-dns/templates/secrets.yaml create mode 100644 master/external-dns/values.yaml create mode 100644 master/external-secrets/Chart.yaml create mode 100644 master/external-secrets/values.yaml create mode 100644 master/gatekeeper/Chart.yaml create mode 100644 master/gatekeeper/values.yaml create mode 100644 master/gitlab-runner/Chart.yaml create mode 100644 master/gitlab-runner/Dockerfile create mode 100644 master/gitlab-runner/templates/secrets.yaml create mode 100644 master/gitlab-runner/values.yaml create mode 100644 master/heimdall/Chart.yaml create mode 100644 master/heimdall/templates/ingress.yaml create mode 100644 master/heimdall/values.yaml create mode 100644 master/internalproxy/Chart.yaml create mode 100644 master/internalproxy/templates/argocd.yaml create mode 100644 master/internalproxy/templates/blueiris.yaml create mode 100644 master/internalproxy/templates/duplicati-ingress.yaml create mode 100644 master/internalproxy/templates/gitea.yaml create mode 100644 master/internalproxy/templates/jellyfin.yaml create mode 100644 master/internalproxy/templates/kasm.yaml create mode 100644 master/internalproxy/templates/minio.yaml create mode 100644 master/internalproxy/templates/nexus.yaml create mode 100644 master/internalproxy/templates/octopus.yaml create mode 100644 master/internalproxy/templates/ollama.yaml create mode 100644 master/internalproxy/templates/pfsense.yaml create mode 100644 master/internalproxy/templates/plex.yaml create mode 100644 master/internalproxy/templates/portainer.yaml create mode 100644 master/internalproxy/templates/proxmox.yaml create mode 100644 master/internalproxy/templates/registry-internal.yaml create mode 100644 master/internalproxy/templates/registry.yaml create mode 100644 master/internalproxy/templates/s3.yaml create mode 100644 master/internalproxy/templates/semaphore.yaml create mode 100644 master/internalproxy/templates/smokeping.yaml create mode 100644 master/internalproxy/templates/speedtest.yaml create mode 100644 master/internalproxy/templates/tdarr.yaml create mode 100644 master/internalproxy/templates/unraid.yaml create mode 100644 master/internalproxy/templates/wazuh.yaml create mode 100644 master/krakend/Chart.yaml create mode 100644 master/krakend/templates/deployments.yaml create mode 100644 master/krakend/templates/ingress.yaml create mode 100644 master/krakend/templates/secrets.yaml create mode 100644 master/krakend/templates/service.yaml create mode 100644 master/kube-prometheus-stack/Chart.yaml create mode 100644 master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml create mode 100644 master/kube-prometheus-stack/templates/ingress.yaml create mode 100644 master/kube-prometheus-stack/values.yaml create mode 100644 master/kubeclarity/Chart.yaml create mode 100644 master/kubeclarity/templates/ingress.yaml create mode 100644 master/kubeclarity/values.yaml create mode 100644 master/littlelink/Chart.yaml create mode 100644 master/littlelink/templates/deployment.yaml create mode 100644 master/littlelink/templates/ingress.yaml create mode 100644 master/littlelink/templates/service.yaml create mode 100644 master/longhorn/Chart.yaml create mode 100644 master/longhorn/templates/ingress.yaml create mode 100644 master/longhorn/templates/secrets.yaml create mode 100644 master/longhorn/values.yaml create mode 100644 master/metallb-system/Chart.yaml create mode 100644 master/metallb-system/templates/config.yaml create mode 100644 master/metallb-system/values.yaml create mode 100644 master/nfs-client/Chart.yml create mode 100644 master/nfs-client/templates/cluster-role-binding.yml create mode 100644 master/nfs-client/templates/cluster-role.yml create mode 100644 master/nfs-client/templates/provisioner.yml create mode 100644 master/nfs-client/templates/role-binding.yml create mode 100644 master/nfs-client/templates/role.yml create mode 100644 master/nfs-client/templates/service-account.yml create mode 100644 master/nfs-client/templates/storage-class.yml create mode 100644 master/open-webui/Chart.yaml create mode 100644 master/open-webui/templates/deployment.yaml create mode 100644 master/open-webui/templates/ingress.yaml create mode 100644 master/open-webui/templates/pvc.yaml create mode 100644 master/open-webui/templates/secrets.yaml create mode 100644 master/open-webui/templates/service.yaml create mode 100644 master/traefik/Chart.yaml create mode 100644 master/traefik/templates/ingress.yaml create mode 100644 master/traefik/templates/middlewares.yaml create mode 100644 master/traefik/values.yaml create mode 100644 master/uptimekuma/Chart.yaml create mode 100644 master/uptimekuma/templates/deployment.yaml create mode 100644 master/uptimekuma/templates/ingress.yaml create mode 100644 master/uptimekuma/templates/kuma-pv.yaml create mode 100644 master/uptimekuma/templates/kuma-pvc.yaml create mode 100644 master/uptimekuma/templates/service.yaml create mode 100644 master/vault/Chart.yaml create mode 100644 master/vault/templates/ingress.yaml create mode 100644 master/vault/templates/secret-store.yaml create mode 100644 master/vault/values.yaml diff --git a/argocd/templates/InternalProxy.yaml b/argocd/templates/InternalProxy.yaml index 1769a19..ca9bcc0 100644 --- a/argocd/templates/InternalProxy.yaml +++ b/argocd/templates/InternalProxy.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: internalproxy + path: master/internalproxy directory: recurse: true destination: diff --git a/argocd/templates/argocd.yaml b/argocd/templates/argocd.yaml index 417915e..e93aa4f 100644 --- a/argocd/templates/argocd.yaml +++ b/argocd/templates/argocd.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: argocd + path: master/argocd destination: namespace: argocd name: in-cluster diff --git a/argocd/templates/authentik.yaml b/argocd/templates/authentik.yaml index 735fa1a..5abfb3b 100644 --- a/argocd/templates/authentik.yaml +++ b/argocd/templates/authentik.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: authentik + path: master/authentik destination: namespace: authentik name: in-cluster diff --git a/argocd/templates/bitwarden.yaml b/argocd/templates/bitwarden.yaml index 6aad52f..ed56924 100644 --- a/argocd/templates/bitwarden.yaml +++ b/argocd/templates/bitwarden.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: bitwarden + path: master/bitwarden directory: recurse: true destination: diff --git a/argocd/templates/cert-manager.yaml b/argocd/templates/cert-manager.yaml index 1eb8fe2..fc11c13 100644 --- a/argocd/templates/cert-manager.yaml +++ b/argocd/templates/cert-manager.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: cert-manager + path: master/cert-manager destination: namespace: cert-manager name: in-cluster diff --git a/argocd/templates/crossplane.yml b/argocd/templates/crossplane.yml index e079c78..91473eb 100644 --- a/argocd/templates/crossplane.yml +++ b/argocd/templates/crossplane.yml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: crossplane + path: master/crossplane destination: namespace: crossplane name: in-cluster diff --git a/argocd/templates/durpapi.yaml b/argocd/templates/durpapi.yaml index 53c2db6..aeefcc1 100644 --- a/argocd/templates/durpapi.yaml +++ b/argocd/templates/durpapi.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: durpapi + path: master/durpapi destination: namespace: durpapi name: in-cluster diff --git a/argocd/templates/durpot.yaml b/argocd/templates/durpot.yaml index 1bfcd37..7a97eb4 100644 --- a/argocd/templates/durpot.yaml +++ b/argocd/templates/durpot.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: durpot + path: master/durpot destination: namespace: durpot name: in-cluster diff --git a/argocd/templates/external-dns.yaml b/argocd/templates/external-dns.yaml index ba05f2c..5cf21a5 100644 --- a/argocd/templates/external-dns.yaml +++ b/argocd/templates/external-dns.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: external-dns + path: master/external-dns destination: namespace: external-dns name: in-cluster diff --git a/argocd/templates/external-secrets.yaml b/argocd/templates/external-secrets.yaml index cf8a595..04f8f1d 100644 --- a/argocd/templates/external-secrets.yaml +++ b/argocd/templates/external-secrets.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: external-secrets + path: master/external-secrets destination: namespace: external-secrets name: in-cluster diff --git a/argocd/templates/gatekeeper.yaml b/argocd/templates/gatekeeper.yaml index 5c60c12..d9a0265 100644 --- a/argocd/templates/gatekeeper.yaml +++ b/argocd/templates/gatekeeper.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: gatekeeper + path: master/gatekeeper destination: namespace: gatekeeper name: in-cluster diff --git a/argocd/templates/gitlab-runner.yaml b/argocd/templates/gitlab-runner.yaml index c5539d7..13f4ebd 100644 --- a/argocd/templates/gitlab-runner.yaml +++ b/argocd/templates/gitlab-runner.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: gitlab-runner + path: master/gitlab-runner destination: namespace: gitlab-runner name: in-cluster diff --git a/argocd/templates/heimdall.yaml b/argocd/templates/heimdall.yaml index d695e34..333a761 100644 --- a/argocd/templates/heimdall.yaml +++ b/argocd/templates/heimdall.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: heimdall + path: master/heimdall destination: namespace: heimdall name: in-cluster diff --git a/argocd/templates/krakend.yaml b/argocd/templates/krakend.yaml index 68a57d1..e5ed113 100644 --- a/argocd/templates/krakend.yaml +++ b/argocd/templates/krakend.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: krakend + path: master/krakend destination: namespace: krakend name: in-cluster diff --git a/argocd/templates/kube-prometheus-stack.yaml b/argocd/templates/kube-prometheus-stack.yaml index 02f8261..ab57dfa 100644 --- a/argocd/templates/kube-prometheus-stack.yaml +++ b/argocd/templates/kube-prometheus-stack.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: kube-prometheus-stack + path: master/kube-prometheus-stack destination: namespace: kube-prometheus-stack name: in-cluster diff --git a/argocd/templates/kubeclarity.yaml b/argocd/templates/kubeclarity.yaml index c812528..f2db3c0 100644 --- a/argocd/templates/kubeclarity.yaml +++ b/argocd/templates/kubeclarity.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: kubeclarity + path: master/kubeclarity destination: namespace: kubeclarity name: in-cluster diff --git a/argocd/templates/littlelink.yaml b/argocd/templates/littlelink.yaml index 99b08fe..856ac87 100644 --- a/argocd/templates/littlelink.yaml +++ b/argocd/templates/littlelink.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: littlelink + path: master/littlelink directory: recurse: true destination: diff --git a/argocd/templates/longhorn.yaml b/argocd/templates/longhorn.yaml index 017da6f..1e857c5 100644 --- a/argocd/templates/longhorn.yaml +++ b/argocd/templates/longhorn.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: longhorn + path: master/longhorn destination: namespace: longhorn-system name: in-cluster diff --git a/argocd/templates/metallb-system.yaml b/argocd/templates/metallb-system.yaml index 051be57..d343453 100644 --- a/argocd/templates/metallb-system.yaml +++ b/argocd/templates/metallb-system.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: metallb-system + path: master/metallb-system destination: namespace: metallb-system name: in-cluster diff --git a/argocd/templates/nfs-client.yaml b/argocd/templates/nfs-client.yaml index e374885..a299095 100644 --- a/argocd/templates/nfs-client.yaml +++ b/argocd/templates/nfs-client.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: nfs-client + path: master/nfs-client directory: recurse: true destination: diff --git a/argocd/templates/open-webui.yaml b/argocd/templates/open-webui.yaml index a2b25fa..beb59a6 100644 --- a/argocd/templates/open-webui.yaml +++ b/argocd/templates/open-webui.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: open-webui + path: master/open-webui destination: namespace: open-webui name: in-cluster diff --git a/argocd/templates/traefik.yaml b/argocd/templates/traefik.yaml index 3995a9f..e336d57 100644 --- a/argocd/templates/traefik.yaml +++ b/argocd/templates/traefik.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: traefik + path: master/traefik destination: namespace: traefik name: in-cluster diff --git a/argocd/templates/uptimekuma.yaml b/argocd/templates/uptimekuma.yaml index ff0e1af..1d2c5e6 100644 --- a/argocd/templates/uptimekuma.yaml +++ b/argocd/templates/uptimekuma.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: uptimekuma + path: master/uptimekuma directory: recurse: true destination: diff --git a/argocd/templates/vault.yaml b/argocd/templates/vault.yaml index 6e243c5..7a5e227 100644 --- a/argocd/templates/vault.yaml +++ b/argocd/templates/vault.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: vault + path: master/vault destination: namespace: vault name: in-cluster @@ -16,7 +16,7 @@ spec: automated: prune: true selfHeal: true - syncOptions: + syncOptions: Gc - CreateNamespace=true ignoreDifferences: - group: admissionregistration.k8s.io diff --git a/master/argocd/Chart.yaml b/master/argocd/Chart.yaml new file mode 100644 index 0000000..cdccf8c --- /dev/null +++ b/master/argocd/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v2 +name: argocd +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: argo-cd + repository: https://argoproj.github.io/argo-helm + version: 6.11.1 + + diff --git a/master/argocd/templates/InternalProxy.yaml b/master/argocd/templates/InternalProxy.yaml new file mode 100644 index 0000000..1769a19 --- /dev/null +++ b/master/argocd/templates/InternalProxy.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: internalproxy + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: internalproxy + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: internalproxy + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/argocd.yaml b/master/argocd/templates/argocd.yaml new file mode 100644 index 0000000..417915e --- /dev/null +++ b/master/argocd/templates/argocd.yaml @@ -0,0 +1,59 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: argocd + destination: + namespace: argocd + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: argocd-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`argocd.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: argocd-server + port: 443 + scheme: https + tls: + secretName: argocd-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: argocd-tls +spec: + secretName: argocd-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "argocd.internal.durp.info" + dnsNames: + - "argocd.internal.durp.info" diff --git a/master/argocd/templates/authentik.yaml b/master/argocd/templates/authentik.yaml new file mode 100644 index 0000000..735fa1a --- /dev/null +++ b/master/argocd/templates/authentik.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: authentik + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: authentik + destination: + namespace: authentik + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/bitwarden.yaml b/master/argocd/templates/bitwarden.yaml new file mode 100644 index 0000000..6aad52f --- /dev/null +++ b/master/argocd/templates/bitwarden.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: bitwarden + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: bitwarden + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: bitwarden + syncPolicy: + automated: + prune: true + selfHeal: false + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/cert-manager.yaml b/master/argocd/templates/cert-manager.yaml new file mode 100644 index 0000000..1eb8fe2 --- /dev/null +++ b/master/argocd/templates/cert-manager.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: cert-manager + destination: + namespace: cert-manager + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/crossplane.yml b/master/argocd/templates/crossplane.yml new file mode 100644 index 0000000..e079c78 --- /dev/null +++ b/master/argocd/templates/crossplane.yml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: crossplane + destination: + namespace: crossplane + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/durpapi.yaml b/master/argocd/templates/durpapi.yaml new file mode 100644 index 0000000..53c2db6 --- /dev/null +++ b/master/argocd/templates/durpapi.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: durpapi + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: durpapi + destination: + namespace: durpapi + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/durpot.yaml b/master/argocd/templates/durpot.yaml new file mode 100644 index 0000000..1bfcd37 --- /dev/null +++ b/master/argocd/templates/durpot.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: durpot + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: durpot + destination: + namespace: durpot + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/external-dns.yaml b/master/argocd/templates/external-dns.yaml new file mode 100644 index 0000000..ba05f2c --- /dev/null +++ b/master/argocd/templates/external-dns.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: external-dns + destination: + namespace: external-dns + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/external-secrets.yaml b/master/argocd/templates/external-secrets.yaml new file mode 100644 index 0000000..cf8a595 --- /dev/null +++ b/master/argocd/templates/external-secrets.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: external-secrets + destination: + namespace: external-secrets + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/gatekeeper.yaml b/master/argocd/templates/gatekeeper.yaml new file mode 100644 index 0000000..5c60c12 --- /dev/null +++ b/master/argocd/templates/gatekeeper.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: gatekeeper + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: gatekeeper + destination: + namespace: gatekeeper + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/gitlab-runner.yaml b/master/argocd/templates/gitlab-runner.yaml new file mode 100644 index 0000000..c5539d7 --- /dev/null +++ b/master/argocd/templates/gitlab-runner.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: gitlab-runner + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: gitlab-runner + destination: + namespace: gitlab-runner + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/heimdall.yaml b/master/argocd/templates/heimdall.yaml new file mode 100644 index 0000000..d695e34 --- /dev/null +++ b/master/argocd/templates/heimdall.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: heimdall + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: heimdall + destination: + namespace: heimdall + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/krakend.yaml b/master/argocd/templates/krakend.yaml new file mode 100644 index 0000000..68a57d1 --- /dev/null +++ b/master/argocd/templates/krakend.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: krakend + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: krakend + destination: + namespace: krakend + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/kube-prometheus-stack.yaml b/master/argocd/templates/kube-prometheus-stack.yaml new file mode 100644 index 0000000..02f8261 --- /dev/null +++ b/master/argocd/templates/kube-prometheus-stack.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: kube-prometheus-stack + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: kube-prometheus-stack + destination: + namespace: kube-prometheus-stack + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/kubeclarity.yaml b/master/argocd/templates/kubeclarity.yaml new file mode 100644 index 0000000..c812528 --- /dev/null +++ b/master/argocd/templates/kubeclarity.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: kubeclarity + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: kubeclarity + destination: + namespace: kubeclarity + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/littlelink.yaml b/master/argocd/templates/littlelink.yaml new file mode 100644 index 0000000..99b08fe --- /dev/null +++ b/master/argocd/templates/littlelink.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: littlelink + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: littlelink + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: littlelink + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/longhorn.yaml b/master/argocd/templates/longhorn.yaml new file mode 100644 index 0000000..017da6f --- /dev/null +++ b/master/argocd/templates/longhorn.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: longhorn-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: longhorn + destination: + namespace: longhorn-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/metallb-system.yaml b/master/argocd/templates/metallb-system.yaml new file mode 100644 index 0000000..051be57 --- /dev/null +++ b/master/argocd/templates/metallb-system.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: metallb-system + destination: + namespace: metallb-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + + diff --git a/master/argocd/templates/nfs-client.yaml b/master/argocd/templates/nfs-client.yaml new file mode 100644 index 0000000..e374885 --- /dev/null +++ b/master/argocd/templates/nfs-client.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: nfs-client + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: nfs-client + directory: + recurse: true + destination: + namespace: nfs-client + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/open-webui.yaml b/master/argocd/templates/open-webui.yaml new file mode 100644 index 0000000..a2b25fa --- /dev/null +++ b/master/argocd/templates/open-webui.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-webui + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: open-webui + destination: + namespace: open-webui + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/secrets.yaml b/master/argocd/templates/secrets.yaml new file mode 100644 index 0000000..baeaaee --- /dev/null +++ b/master/argocd/templates/secrets.yaml @@ -0,0 +1,17 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: vault-argocd + labels: + app.kubernetes.io/part-of: argocd +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: client-secret + data: + - secretKey: clientSecret + remoteRef: + key: secrets/argocd/authentik + property: clientsecret diff --git a/master/argocd/templates/traefik.yaml b/master/argocd/templates/traefik.yaml new file mode 100644 index 0000000..3995a9f --- /dev/null +++ b/master/argocd/templates/traefik.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: traefik + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: traefik + destination: + namespace: traefik + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/master/argocd/templates/uptimekuma.yaml b/master/argocd/templates/uptimekuma.yaml new file mode 100644 index 0000000..ff0e1af --- /dev/null +++ b/master/argocd/templates/uptimekuma.yaml @@ -0,0 +1,23 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: uptimekuma + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: uptimekuma + directory: + recurse: true + destination: + server: https://kubernetes.default.svc + namespace: uptimekuma + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/master/argocd/templates/vault.yaml b/master/argocd/templates/vault.yaml new file mode 100644 index 0000000..6e243c5 --- /dev/null +++ b/master/argocd/templates/vault.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: vault + destination: + namespace: vault + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle diff --git a/master/argocd/values.yaml b/master/argocd/values.yaml new file mode 100644 index 0000000..47a56e3 --- /dev/null +++ b/master/argocd/values.yaml @@ -0,0 +1,62 @@ +argo-cd: + + global: + revisionHistoryLimit: 1 + image: + repository: registry.internal.durp.info/argoproj/argocd + imagePullPolicy: Always + + server: + #extraArgs: + # - --dex-server-plaintext + # - --dex-server=argocd-dex-server:5556 + # oidc.config: | + # name: AzureAD + # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 + # clientID: CLIENT_ID + # clientSecret: $oidc.azuread.clientSecret + # requestedIDTokenClaims: + # groups: + # essential: true + # requestedScopes: + # - openid + # - profile + # - email + + dex: + enabled: true + image: + repository: registry.internal.durp.info/dexidp/dex + imagePullPolicy: Always + + configs: + cm: + create: true + annotations: {} + url: https://argocd.internal.durp.info + oidc.tls.insecure.skip.verify: "true" + dex.config: | + connectors: + - config: + issuer: https://authentik.durp.info/application/o/argocd/ + clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625 + clientSecret: $client-secret:clientSecret + insecureEnableGroups: true + scopes: + - openid + - profile + - email + - groups + name: authentik + type: oidc + id: authentik + + rbac: + create: true + policy.csv: | + g, ArgoCD Admins, role:admin + scopes: "[groups]" + + server: + route: + enabled: false diff --git a/master/authentik/Chart.yaml b/master/authentik/Chart.yaml new file mode 100644 index 0000000..c87b677 --- /dev/null +++ b/master/authentik/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: authentik +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: authentik + repository: https://charts.goauthentik.io + version: 2024.8.3 \ No newline at end of file diff --git a/master/authentik/templates/authentik-pv.yaml b/master/authentik/templates/authentik-pv.yaml new file mode 100644 index 0000000..8fbc2e2 --- /dev/null +++ b/master/authentik/templates/authentik-pv.yaml @@ -0,0 +1,24 @@ +#apiVersion: v1 +#kind: PersistentVolume +#metadata: +# annotations: +# pv.kubernetes.io/provisioned-by: durp.info/nfs +# finalizers: +# - kubernetes.io/pv-protection +# name: authentik-pv +#spec: +# accessModes: +# - ReadWriteMany +# capacity: +# storage: 10Gi +# claimRef: +# apiVersion: v1 +# kind: PersistentVolumeClaim +# name: authentik-pvc +# namespace: authentik +# nfs: +# path: /mnt/user/k3s/authentik +# server: 192.168.20.253 +# persistentVolumeReclaimPolicy: Retain +# storageClassName: nfs-storage +# volumeMode: Filesystem diff --git a/master/authentik/templates/authentik-pvc.yaml b/master/authentik/templates/authentik-pvc.yaml new file mode 100644 index 0000000..f22640b --- /dev/null +++ b/master/authentik/templates/authentik-pvc.yaml @@ -0,0 +1,18 @@ +#apiVersion: v1 +#kind: PersistentVolumeClaim +#metadata: +# labels: +# app.kubernetes.io/component: app +# app.kubernetes.io/instance: authentik +# app.kubernetes.io/managed-by: Helm +# app.kubernetes.io/name: authentik +# helm.sh/chart: authentik-2.14.4 +# name: authentik-pvc +# namespace: authentik +#spec: +# accessModes: +# - ReadWriteMany +# resources: +# requests: +# storage: 10Gi +# storageClassName: nfs-storage \ No newline at end of file diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml new file mode 100644 index 0000000..ac10303 --- /dev/null +++ b/master/authentik/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 80 + tls: + secretName: authentik-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + secretName: authentik-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/authentik/templates/secrets.yaml b/master/authentik/templates/secrets.yaml new file mode 100644 index 0000000..07b7747 --- /dev/null +++ b/master/authentik/templates/secrets.yaml @@ -0,0 +1,28 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: authentik-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: db-pass + data: + - secretKey: dbpass + remoteRef: + key: secrets/authentik/database + property: dbpass + - secretKey: secretkey + remoteRef: + key: secrets/authentik/database + property: secretkey + - secretKey: postgresql-postgres-password + remoteRef: + key: secrets/authentik/database + property: dbpass + - secretKey: postgresql-password + remoteRef: + key: secrets/authentik/database + property: dbpass + diff --git a/master/authentik/values.yaml b/master/authentik/values.yaml new file mode 100644 index 0000000..716e081 --- /dev/null +++ b/master/authentik/values.yaml @@ -0,0 +1,56 @@ +authentik: + global: + env: + - name: AUTHENTIK_POSTGRESQL__PASSWORD + valueFrom: + secretKeyRef: + name: db-pass + key: dbpass + - name: AUTHENTIK_SECRET_KEY + valueFrom: + secretKeyRef: + name: db-pass + key: secretkey + revisionHistoryLimit: 1 + image: + repository: registry.internal.durp.info/goauthentik/server + pullPolicy: Always + authentik: + outposts: + container_image_base: registry.internal.durp.info/goauthentik/%(type)s:%(version)s + postgresql: + host: '{{ .Release.Name }}-postgresql-hl' + name: "authentik" + user: "authentik" + port: 5432 + server: + name: server + replicas: 3 + worker: + replicas: 3 + postgresql: + enabled: true + image: + registry: registry.internal.durp.info + repository: bitnami/postgresql + pullPolicy: Always + postgresqlUsername: "authentik" + postgresqlDatabase: "authentik" + existingSecret: db-pass + persistence: + enabled: true + storageClass: longhorn + accessModes: + - ReadWriteMany + redis: + enabled: true + master: + persistence: + enabled: false + image: + registry: registry.internal.durp.info + repository: bitnami/redis + pullPolicy: Always + architecture: standalone + auth: + enabled: false diff --git a/master/bitwarden/Chart.yaml b/master/bitwarden/Chart.yaml new file mode 100644 index 0000000..cfdd821 --- /dev/null +++ b/master/bitwarden/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: bitwarden +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/master/bitwarden/templates/bitwarden-pv.yaml b/master/bitwarden/templates/bitwarden-pv.yaml new file mode 100644 index 0000000..ff647d1 --- /dev/null +++ b/master/bitwarden/templates/bitwarden-pv.yaml @@ -0,0 +1,25 @@ +#apiVersion: v1 +#kind: PersistentVolume +#metadata: +# annotations: +# pv.kubernetes.io/provisioned-by: durp.info/nfs +# finalizers: +# - kubernetes.io/pv-protection +# name: bitwarden-pv +#spec: +# accessModes: +# - ReadWriteMany +# capacity: +# storage: 10Gi +# claimRef: +# apiVersion: v1 +# kind: PersistentVolumeClaim +# name: bitwarden-pvc +# namespace: bitwarden +# nfs: +# path: /mnt/user/k3s/bitwarden +# server: 192.168.20.253 +# persistentVolumeReclaimPolicy: Retain +# storageClassName: nfs-storage +# volumeMode: Filesystem +# \ No newline at end of file diff --git a/master/bitwarden/templates/bitwarden-pvc.yaml b/master/bitwarden/templates/bitwarden-pvc.yaml new file mode 100644 index 0000000..333af4d --- /dev/null +++ b/master/bitwarden/templates/bitwarden-pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: bitwarden-pvc +spec: + storageClassName: longhorn + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi diff --git a/master/bitwarden/templates/deployment.yaml b/master/bitwarden/templates/deployment.yaml new file mode 100644 index 0000000..7d9c28b --- /dev/null +++ b/master/bitwarden/templates/deployment.yaml @@ -0,0 +1,50 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: bitwarden + name: bitwarden + labels: + app: bitwarden +spec: + selector: + matchLabels: + app: bitwarden + replicas: 1 + template: + metadata: + labels: + app: bitwarden + spec: + containers: + - name: bitwarden + image: registry.internal.durp.info/vaultwarden/server:1.32.0 + imagePullPolicy: Always + volumeMounts: + - name: bitwarden-pvc + mountPath: /data + subPath: bitwaren-data + ports: + - name: http + containerPort: 80 + env: + - name: SIGNUPS_ALLOWED + value: "FALSE" + - name: INVITATIONS_ALLOWED + value: "FALSE" + - name: WEBSOCKET_ENABLED + value: "TRUE" + - name: ROCKET_ENV + value: "staging" + - name: ROCKET_PORT + value: "80" + - name: ROCKET_WORKERS + value: "10" + - name: SECRET_USERNAME + valueFrom: + secretKeyRef: + name: bitwarden-secret + key: ADMIN_TOKEN + volumes: + - name: bitwarden-pvc + persistentVolumeClaim: + claimName: bitwarden-pvc diff --git a/master/bitwarden/templates/ingress.yaml b/master/bitwarden/templates/ingress.yaml new file mode 100644 index 0000000..8a9a628 --- /dev/null +++ b/master/bitwarden/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: bitwarden-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: bitwarden + port: 80 + tls: + secretName: bitwarden-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: bitwarden-tls +spec: + secretName: bitwarden-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "bitwarden.durp.info" + dnsNames: + - "bitwarden.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: bitwarden-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/bitwarden/templates/secrets.yaml b/master/bitwarden/templates/secrets.yaml new file mode 100644 index 0000000..7a8d858 --- /dev/null +++ b/master/bitwarden/templates/secrets.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: bitwarden-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: bitwarden-secret + data: + - secretKey: ADMIN_TOKEN + remoteRef: + key: secrets/bitwarden/admin + property: ADMIN_TOKEN + diff --git a/master/bitwarden/templates/service.yaml b/master/bitwarden/templates/service.yaml new file mode 100644 index 0000000..df30857 --- /dev/null +++ b/master/bitwarden/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: bitwarden +spec: + ports: + - name: http + port: 80 + targetPort: 80 + protocol: TCP + selector: + app: bitwarden \ No newline at end of file diff --git a/master/cert-manager/Chart.yaml b/master/cert-manager/Chart.yaml new file mode 100644 index 0000000..e14d98b --- /dev/null +++ b/master/cert-manager/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.15.3 diff --git a/master/cert-manager/templates/letsencrypt-prroduction.yaml b/master/cert-manager/templates/letsencrypt-prroduction.yaml new file mode 100644 index 0000000..034ed9b --- /dev/null +++ b/master/cert-manager/templates/letsencrypt-prroduction.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret diff --git a/master/cert-manager/templates/letsencrypt-staging.yaml b/master/cert-manager/templates/letsencrypt-staging.yaml new file mode 100644 index 0000000..b6ae4f9 --- /dev/null +++ b/master/cert-manager/templates/letsencrypt-staging.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-staging +spec: + acme: + server: https://acme-staging-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-staging + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret \ No newline at end of file diff --git a/master/cert-manager/templates/sealedsecret.yaml b/master/cert-manager/templates/sealedsecret.yaml new file mode 100644 index 0000000..37a2e92 --- /dev/null +++ b/master/cert-manager/templates/sealedsecret.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: secrets/cert-manager + property: cloudflare-api-token-secret + diff --git a/master/cert-manager/values.yaml b/master/cert-manager/values.yaml new file mode 100644 index 0000000..36f403b --- /dev/null +++ b/master/cert-manager/values.yaml @@ -0,0 +1,25 @@ +cert-manager: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-controller + pullPolicy: Always + installCRDs: true + replicaCount: 3 + extraArgs: + - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + - --dns01-recursive-nameservers-only + podDnsPolicy: None + podDnsConfig: + nameservers: + - "1.1.1.1" + - "1.0.0.1" + webhook: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-webhook + pullPolicy: Always + cainjector: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-cainjector + pullPolicy: Always \ No newline at end of file diff --git a/master/crossplane/Chart.yaml b/master/crossplane/Chart.yaml new file mode 100644 index 0000000..b0a80b7 --- /dev/null +++ b/master/crossplane/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: crossplane +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: crossplane + repository: https://charts.crossplane.io/stable + version: 1.17.1 diff --git a/master/crossplane/templates/gitlab.yml b/master/crossplane/templates/gitlab.yml new file mode 100644 index 0000000..3a20b9c --- /dev/null +++ b/master/crossplane/templates/gitlab.yml @@ -0,0 +1,55 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-gitlab +spec: + package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: accesstoken + remoteRef: + key: secrets/gitlab/token + property: accesstoken + +--- + +#apiVersion: gitlab.crossplane.io/v1beta1 +#kind: ProviderConfig +#metadata: +# name: gitlab-provider +#spec: +# baseURL: https://gitlab.com/ +# credentials: +# source: Secret +# secretRef: +# namespace: crossplane +# name: gitlab-secret +# key: accesstoken +# +#--- +# +#apiVersion: projects.gitlab.crossplane.io/v1alpha1 +#kind: Project +#metadata: +# name: example-project +#spec: +# deletionPolicy: Orphan +# forProvider: +# name: "Example Project" +# description: "example project description" +# providerConfigRef: +# name: gitlab-provider +# policy: +# resolution: Optional +# resolve: Always diff --git a/master/dashboards/nginx-dashboard.yaml b/master/dashboards/nginx-dashboard.yaml new file mode 100644 index 0000000..333a6c5 --- /dev/null +++ b/master/dashboards/nginx-dashboard.yaml @@ -0,0 +1,1506 @@ +apiVersion: v1 +data: + nginx-ingress-controller_rev1.json: |- + { + "annotations": { + "list": [ + { + "builtIn": 1, + "datasource": { + "type": "datasource", + "uid": "grafana" + }, + "enable": true, + "hide": true, + "iconColor": "rgba(0, 211, 255, 1)", + "name": "Annotations & Alerts", + "target": { + "limit": 100, + "matchAny": false, + "tags": [], + "type": "dashboard" + }, + "type": "dashboard" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "enable": true, + "expr": "sum(changes(nginx_ingress_controller_config_last_reload_successful_timestamp_seconds{instance!=\"unknown\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[30s])) by (controller_class)", + "hide": false, + "iconColor": "rgba(255, 96, 96, 1)", + "limit": 100, + "name": "Config Reloads", + "showIn": 0, + "step": "30s", + "tagKeys": "controller_class", + "tags": [], + "titleFormat": "Config Reloaded", + "type": "tags" + } + ] + }, + "description": "Ingress-nginx supports a rich collection of prometheus metrics. If you have prometheus and grafana installed on your cluster then prometheus will already be scraping this data due to the scrape annotation on the deployment.", + "editable": true, + "fiscalYearStartMonth": 0, + "gnetId": 9614, + "graphTooltip": 0, + "id": 27, + "links": [], + "liveNow": false, + "panels": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "ops" + }, + "overrides": [] + }, + "id": 20, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m])), 0.001)", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Controller Request Volume", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "none" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 6, + "y": 0 + }, + "id": 82, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(avg_over_time(nginx_ingress_controller_nginx_process_connections{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "instant": false, + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Controller Connections", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "rgba(245, 54, 54, 0.9)", + "value": null + }, + { + "color": "rgba(237, 129, 40, 0.89)", + "value": 95 + }, + { + "color": "rgba(50, 172, 45, 0.97)", + "value": 99 + } + ] + }, + "unit": "percentunit" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 6, + "x": 12, + "y": 0 + }, + "id": 21, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",status!~\"[4-5].*\"}[2m])) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Controller Success Rate (non-4|5xx responses)", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "decimals": 0, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "none" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 3, + "x": 18, + "y": 0 + }, + "id": 81, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "avg(nginx_ingress_controller_success{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"})", + "format": "time_series", + "instant": true, + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Config Reloads", + "type": "stat" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fieldConfig": { + "defaults": { + "color": { + "fixedColor": "rgb(31, 120, 193)", + "mode": "fixed" + }, + "decimals": 0, + "mappings": [ + { + "options": { + "match": "null", + "result": { + "text": "N/A" + } + }, + "type": "special" + } + ], + "thresholds": { + "mode": "absolute", + "steps": [ + { + "color": "green", + "value": null + }, + { + "color": "red", + "value": 80 + } + ] + }, + "unit": "none" + }, + "overrides": [] + }, + "gridPos": { + "h": 3, + "w": 3, + "x": 21, + "y": 0 + }, + "id": 83, + "links": [], + "maxDataPoints": 100, + "options": { + "colorMode": "none", + "graphMode": "area", + "justifyMode": "auto", + "orientation": "horizontal", + "reduceOptions": { + "calcs": [ + "mean" + ], + "fields": "", + "values": false + }, + "textMode": "auto" + }, + "pluginVersion": "9.1.6", + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "count(nginx_ingress_controller_config_last_reload_successful{controller_pod=~\"$controller\",controller_namespace=~\"$namespace\"} == 0)", + "format": "time_series", + "instant": true, + "intervalFactor": 1, + "refId": "A", + "step": 4 + } + ], + "title": "Last Config Failed", + "type": "stat" + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": true, + "error": false, + "fill": 1, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 7, + "w": 12, + "x": 0, + "y": 3 + }, + "height": "200px", + "hiddenSeries": false, + "id": 86, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": false, + "hideEmpty": false, + "hideZero": true, + "max": false, + "min": false, + "rightSide": true, + "show": true, + "sideWidth": 300, + "sort": "current", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "repeatDirection": "h", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress), 0.001)", + "format": "time_series", + "hide": false, + "instant": false, + "interval": "", + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "metric": "network", + "refId": "A", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Ingress Request Volume", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 2, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "reqps", + "logBase": 1, + "show": true + }, + { + "format": "Bps", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": { + "max - istio-proxy": "#890f02", + "max - master": "#bf1b00", + "max - prometheus": "#bf1b00" + }, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": false, + "error": false, + "fill": 0, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 7, + "w": 12, + "x": 12, + "y": 3 + }, + "hiddenSeries": false, + "id": 87, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": false, + "hideEmpty": true, + "hideZero": false, + "max": false, + "min": false, + "rightSide": true, + "show": true, + "sideWidth": 300, + "sort": "avg", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\",status!~\"[4-5].*\"}[2m])) by (ingress) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", + "format": "time_series", + "instant": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "metric": "container_memory_usage:sort_desc", + "refId": "A", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Ingress Success Rate (non-4|5xx responses)", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 1, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "percentunit", + "logBase": 1, + "show": true + }, + { + "format": "short", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": {}, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": true, + "error": false, + "fill": 1, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 6, + "w": 8, + "x": 0, + "y": 10 + }, + "height": "200px", + "hiddenSeries": false, + "id": 32, + "isNew": true, + "legend": { + "alignAsTable": false, + "avg": true, + "current": true, + "max": false, + "min": false, + "rightSide": false, + "show": false, + "sideWidth": 200, + "sort": "current", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum (irate (nginx_ingress_controller_request_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "instant": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "Received", + "metric": "network", + "refId": "A", + "step": 10 + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "- sum (irate (nginx_ingress_controller_response_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", + "format": "time_series", + "hide": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "Sent", + "metric": "network", + "refId": "B", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Network I/O pressure", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 0, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "Bps", + "logBase": 1, + "show": true + }, + { + "format": "Bps", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": { + "max - istio-proxy": "#890f02", + "max - master": "#bf1b00", + "max - prometheus": "#bf1b00" + }, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 2, + "editable": false, + "error": false, + "fill": 0, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 6, + "w": 8, + "x": 8, + "y": 10 + }, + "hiddenSeries": false, + "id": 77, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": true, + "max": false, + "min": false, + "rightSide": false, + "show": false, + "sideWidth": 200, + "sort": "current", + "sortDesc": true, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "avg(nginx_ingress_controller_nginx_process_resident_memory_bytes{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}) ", + "format": "time_series", + "instant": false, + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "nginx", + "metric": "container_memory_usage:sort_desc", + "refId": "A", + "step": 10 + } + ], + "thresholds": [], + "timeRegions": [], + "title": "Average Memory Usage", + "tooltip": { + "msResolution": false, + "shared": true, + "sort": 2, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "bytes", + "logBase": 1, + "show": true + }, + { + "format": "short", + "logBase": 1, + "show": false + } + ], + "yaxis": { + "align": false + } + }, + { + "aliasColors": { + "max - istio-proxy": "#890f02", + "max - master": "#bf1b00" + }, + "bars": false, + "dashLength": 10, + "dashes": false, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "decimals": 3, + "editable": false, + "error": false, + "fill": 0, + "fillGradient": 0, + "grid": {}, + "gridPos": { + "h": 6, + "w": 8, + "x": 16, + "y": 10 + }, + "height": "", + "hiddenSeries": false, + "id": 79, + "isNew": true, + "legend": { + "alignAsTable": true, + "avg": true, + "current": true, + "max": false, + "min": false, + "rightSide": false, + "show": false, + "total": false, + "values": true + }, + "lines": true, + "linewidth": 2, + "links": [], + "nullPointMode": "connected", + "options": { + "alertThreshold": true + }, + "percentage": false, + "pluginVersion": "9.1.6", + "pointradius": 5, + "points": false, + "renderer": "flot", + "seriesOverrides": [], + "spaceLength": 10, + "stack": false, + "steppedLine": false, + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum (rate (nginx_ingress_controller_nginx_process_cpu_seconds_total{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m])) ", + "format": "time_series", + "interval": "10s", + "intervalFactor": 1, + "legendFormat": "nginx", + "metric": "container_cpu", + "refId": "A", + "step": 10 + } + ], + "thresholds": [ + { + "colorMode": "critical", + "fill": true, + "line": true, + "op": "gt" + } + ], + "timeRegions": [], + "title": "Average CPU Usage", + "tooltip": { + "msResolution": true, + "shared": true, + "sort": 2, + "value_type": "cumulative" + }, + "type": "graph", + "xaxis": { + "mode": "time", + "show": true, + "values": [] + }, + "yaxes": [ + { + "format": "none", + "label": "cores", + "logBase": 1, + "show": true + }, + { + "format": "short", + "logBase": 1, + "show": true + } + ], + "yaxis": { + "align": false + } + }, + { + "columns": [], + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fontSize": "100%", + "gridPos": { + "h": 8, + "w": 24, + "x": 0, + "y": 16 + }, + "hideTimeOverride": false, + "id": 75, + "links": [], + "pageSize": 7, + "repeatDirection": "h", + "scroll": true, + "showHeader": true, + "sort": { + "col": 1, + "desc": true + }, + "styles": [ + { + "alias": "Ingress", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "ingress", + "preserveFormat": false, + "sanitize": false, + "thresholds": [], + "type": "string", + "unit": "short" + }, + { + "alias": "Requests", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #A", + "thresholds": [ + "" + ], + "type": "number", + "unit": "ops" + }, + { + "alias": "Errors", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #B", + "thresholds": [], + "type": "number", + "unit": "ops" + }, + { + "alias": "P50 Latency", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "link": false, + "pattern": "Value #C", + "thresholds": [], + "type": "number", + "unit": "dtdurations" + }, + { + "alias": "P90 Latency", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "pattern": "Value #D", + "thresholds": [], + "type": "number", + "unit": "dtdurations" + }, + { + "alias": "P99 Latency", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "pattern": "Value #E", + "thresholds": [], + "type": "number", + "unit": "dtdurations" + }, + { + "alias": "IN", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Value #F", + "thresholds": [ + "" + ], + "type": "number", + "unit": "Bps" + }, + { + "alias": "", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "pattern": "Time", + "thresholds": [], + "type": "hidden", + "unit": "short" + }, + { + "alias": "OUT", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 2, + "mappingType": 1, + "pattern": "Value #G", + "thresholds": [], + "type": "number", + "unit": "Bps" + } + ], + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "histogram_quantile(0.50, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "C" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "histogram_quantile(0.90, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "D" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "histogram_quantile(0.99, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", + "format": "table", + "hide": false, + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ destination_service }}", + "refId": "E" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(irate(nginx_ingress_controller_request_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", + "format": "table", + "hide": false, + "instant": true, + "interval": "", + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "F" + }, + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "sum(irate(nginx_ingress_controller_response_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", + "format": "table", + "instant": true, + "intervalFactor": 1, + "legendFormat": "{{ ingress }}", + "refId": "G" + } + ], + "title": "Ingress Percentile Response Times and Transfer Rates", + "transform": "table", + "type": "table-old" + }, + { + "columns": [ + { + "text": "Current", + "value": "current" + } + ], + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "fontSize": "100%", + "gridPos": { + "h": 8, + "w": 24, + "x": 0, + "y": 24 + }, + "height": "1024", + "id": 85, + "links": [], + "pageSize": 7, + "scroll": true, + "showHeader": true, + "sort": { + "col": 1, + "desc": false + }, + "styles": [ + { + "alias": "Time", + "align": "auto", + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "pattern": "Time", + "type": "date" + }, + { + "alias": "TTL", + "align": "auto", + "colorMode": "cell", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "dateFormat": "YYYY-MM-DD HH:mm:ss", + "decimals": 0, + "pattern": "Current", + "thresholds": [ + "0", + "691200" + ], + "type": "number", + "unit": "s" + }, + { + "alias": "", + "align": "auto", + "colors": [ + "rgba(245, 54, 54, 0.9)", + "rgba(237, 129, 40, 0.89)", + "rgba(50, 172, 45, 0.97)" + ], + "decimals": 2, + "pattern": "/.*/", + "thresholds": [], + "type": "number", + "unit": "short" + } + ], + "targets": [ + { + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "expr": "avg(nginx_ingress_controller_ssl_expire_time_seconds{kubernetes_pod_name=~\"$controller\",namespace=~\"$namespace\",ingress=~\"$ingress\"}) by (host) - time()", + "format": "time_series", + "intervalFactor": 1, + "legendFormat": "{{ host }}", + "metric": "gke_letsencrypt_cert_expiration", + "refId": "A", + "step": 1 + } + ], + "title": "Ingress Certificate Expiry", + "transform": "timeseries_aggregations", + "type": "table-old" + } + ], + "refresh": "5s", + "schemaVersion": 37, + "style": "dark", + "tags": [ + "nginx" + ], + "templating": { + "list": [ + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Namespace", + "multi": false, + "name": "namespace", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_config_hash, controller_namespace)", + "refId": "Prometheus-namespace-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 0, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Controller Class", + "multi": false, + "name": "controller_class", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\"}, controller_class) ", + "refId": "Prometheus-controller_class-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 0, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Controller", + "multi": false, + "name": "controller", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\",controller_class=~\"$controller_class\"}, controller_pod) ", + "refId": "Prometheus-controller-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 0, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + }, + { + "allValue": ".*", + "current": { + "selected": false, + "text": "All", + "value": "$__all" + }, + "datasource": { + "type": "prometheus", + "uid": "prometheus" + }, + "definition": "", + "hide": 0, + "includeAll": true, + "label": "Ingress", + "multi": false, + "name": "ingress", + "options": [], + "query": { + "query": "label_values(nginx_ingress_controller_requests{namespace=~\"$namespace\",controller_class=~\"$controller_class\",controller=~\"$controller\"}, ingress) ", + "refId": "Prometheus-ingress-Variable-Query" + }, + "refresh": 1, + "regex": "", + "skipUrlSync": false, + "sort": 2, + "tagValuesQuery": "", + "tagsQuery": "", + "type": "query", + "useTags": false + } + ] + }, + "time": { + "from": "now-1h", + "to": "now" + }, + "timepicker": { + "refresh_intervals": [ + "5s", + "10s", + "30s", + "2m", + "5m", + "15m", + "30m", + "1h", + "2h", + "1d" + ], + "time_options": [ + "5m", + "15m", + "1h", + "6h", + "12h", + "24h", + "2d", + "7d", + "30d" + ] + }, + "timezone": "browser", + "title": "NGINX Ingress controller", + "uid": "nginx", + "version": 1, + "weekStart": "" + } +kind: ConfigMap +metadata: + labels: + grafana_dashboard: "1" + creationTimestamp: null + name: nginx-dashboard + namespace: kube-prometheus-stack \ No newline at end of file diff --git a/master/durpapi/Chart.yaml b/master/durpapi/Chart.yaml new file mode 100644 index 0000000..078c7e0 --- /dev/null +++ b/master/durpapi/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: durpapi +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0-dev0184 +appVersion: 0.1.0 + +dependencies: +- condition: postgresql.enabled + version: 12.5.* + repository: https://charts.bitnami.com/bitnami + name: postgresql diff --git a/master/durpapi/templates/deployment.yaml b/master/durpapi/templates/deployment.yaml new file mode 100644 index 0000000..0f42dfb --- /dev/null +++ b/master/durpapi/templates/deployment.yaml @@ -0,0 +1,38 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Chart.Name }} + labels: + app: {{ .Chart.Name }} +spec: + revisionHistoryLimit: 1 + selector: + matchLabels: + app: {{ .Chart.Name }} + replicas: {{ .Values.deployment.hpa.minReplicas }} + template: + metadata: + labels: + app: {{ .Chart.Name }} + spec: + containers: + - name: api + image: "{{ .Values.deployment.image }}:{{ default .Chart.Version .Values.deployment.tag }}" + imagePullPolicy: {{ .Values.deployment.imagePullPolicy }} + readinessProbe: + {{- toYaml .Values.deployment.probe.readiness | nindent 12 }} + livenessProbe: + {{- toYaml .Values.deployment.probe.liveness | nindent 12 }} + startupProbe: + {{- toYaml .Values.deployment.probe.startup | nindent 12 }} + ports: + - name: http + containerPort: {{ .Values.service.targetport }} + env: + - name: host + value: {{ .Values.swagger.host }} + - name: version + value: {{ default .Chart.Version .Values.deployment.tag }} + envFrom: + - secretRef: + name: {{ .Values.deployment.secretfile }} diff --git a/master/durpapi/templates/hpa.yaml b/master/durpapi/templates/hpa.yaml new file mode 100644 index 0000000..68d484d --- /dev/null +++ b/master/durpapi/templates/hpa.yaml @@ -0,0 +1,24 @@ +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: "{{ .Chart.Name }}-hpa" +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ .Chart.Name }} + minReplicas: {{ .Values.deployment.hpa.minReplicas }} + maxReplicas: {{ .Values.deployment.hpa.maxReplicas }} + metrics: + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: 80 + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 40 diff --git a/master/durpapi/templates/ingress.yaml b/master/durpapi/templates/ingress.yaml new file mode 100644 index 0000000..bd268dd --- /dev/null +++ b/master/durpapi/templates/ingress.yaml @@ -0,0 +1,44 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: "{{ .Chart.Name }}-ingress" +spec: + entryPoints: + - websecure + routes: + - match: Host("api.durp.info") && PathPrefix(`/api`) + kind: Rule + middlewares: + - name: jwt + services: + - name: "durpapi-service" + port: 80 + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: "{{ .Chart.Name }}-swagger" +spec: + entryPoints: + - websecure + routes: + - match: Host("api.durp.info") && PathPrefix(`/swagger`) + kind: Rule + services: + - name: "durpapi-service" + port: 80 + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: jwt +spec: + plugin: + jwt: + Required: true + Keys: + - https://authentik.durp.info/application/o/api/jwks diff --git a/master/durpapi/templates/secrets.yaml b/master/durpapi/templates/secrets.yaml new file mode 100644 index 0000000..0157b5b --- /dev/null +++ b/master/durpapi/templates/secrets.yaml @@ -0,0 +1,39 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: durpapi-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: durpapi-secret + data: + - secretKey: db_host + remoteRef: + key: secrets/durpapi/postgres + property: db_host + - secretKey: db_port + remoteRef: + key: secrets/durpapi/postgres + property: db_port + - secretKey: db_pass + remoteRef: + key: secrets/durpapi/postgres + property: db_pass + - secretKey: db_user + remoteRef: + key: secrets/durpapi/postgres + property: db_user + - secretKey: db_sslmode + remoteRef: + key: secrets/durpapi/postgres + property: db_sslmode + - secretKey: db_name + remoteRef: + key: secrets/durpapi/postgres + property: db_name + - secretKey: llamaurl + remoteRef: + key: secrets/durpapi/llamaurl + property: llamaurl \ No newline at end of file diff --git a/master/durpapi/templates/service.yaml b/master/durpapi/templates/service.yaml new file mode 100644 index 0000000..2cab669 --- /dev/null +++ b/master/durpapi/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: "{{ .Chart.Name }}-service" +spec: + ports: + - name: http + port: {{ .Values.service.port }} + targetPort: {{ .Values.service.targetport }} + protocol: TCP + selector: + app: {{ .Chart.Name }} diff --git a/master/durpapi/values.yaml b/master/durpapi/values.yaml new file mode 100644 index 0000000..9e9eeab --- /dev/null +++ b/master/durpapi/values.yaml @@ -0,0 +1,39 @@ +ingress: + enabled: false +deployment: + image: registry.internal.durp.info/developerdurp/durpapi + secretfile: durpapi-secret + imagePullPolicy: Always + hpa: + minReplicas: 3 + maxReplicas: 10 + probe: + readiness: + httpGet: + path: /health/gethealth + port: 8080 + liveness: + httpGet: + path: /health/gethealth + port: 8080 + startup: + httpGet: + path: /health/gethealth + port: 8080 +service: + type: ClusterIP + port: 80 + targetport: 8080 + +swagger: + host: api.durp.info +postgresql: + enabled: true + auth: + existingSecret: durpapi-secret + secretKeys: + adminPasswordKey: db_pass + userPasswordKey: db_pass + replicationPasswordKey: db_pass + database: postgres + username: postgres diff --git a/master/durpot/Chart.yaml b/master/durpot/Chart.yaml new file mode 100644 index 0000000..c21a834 --- /dev/null +++ b/master/durpot/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: durpapi +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: durpot + repository: https://gitlab.com/api/v4/projects/45025485/packages/helm/stable + version: 0.1.0-dev0038 diff --git a/master/durpot/templates/secrets.yaml b/master/durpot/templates/secrets.yaml new file mode 100644 index 0000000..792f909 --- /dev/null +++ b/master/durpot/templates/secrets.yaml @@ -0,0 +1,43 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: durpot-secert +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: durpot-secret + data: + - secretKey: OPENAI_API_KEY + remoteRef: + key: secrets/durpot/openai + property: OPENAI_API_KEY + - secretKey: BOTPREFIX + remoteRef: + key: secrets/durpot/discord + property: BOTPREFIX + - secretKey: ChannelID + remoteRef: + key: secrets/durpot/discord + property: ChannelID + - secretKey: TOKEN + remoteRef: + key: secrets/durpot/discord + property: TOKEN + - secretKey: ClientID + remoteRef: + key: secrets/durpot/auth + property: ClientID + - secretKey: Password + remoteRef: + key: secrets/durpot/auth + property: Password + - secretKey: TokenURL + remoteRef: + key: secrets/durpot/auth + property: TokenURL + - secretKey: Username + remoteRef: + key: secrets/durpot/auth + property: Username diff --git a/master/external-dns/Chart.yaml b/master/external-dns/Chart.yaml new file mode 100644 index 0000000..8fb36bc --- /dev/null +++ b/master/external-dns/Chart.yaml @@ -0,0 +1,12 @@ + +apiVersion: v2 +name: external-dns +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-dns + repository: https://charts.bitnami.com/bitnami + version: 8.3.8 diff --git a/master/external-dns/templates/secrets.yaml b/master/external-dns/templates/secrets.yaml new file mode 100644 index 0000000..142c03a --- /dev/null +++ b/master/external-dns/templates/secrets.yaml @@ -0,0 +1,23 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: external-dns-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: external-dns + data: + - secretKey: cloudflare_api_email + remoteRef: + key: secrets/external-dns/cloudflare + property: cloudflare_api_email + - secretKey: cloudflare_api_key + remoteRef: + key: secrets/external-dns/cloudflare + property: cloudflare_api_key + - secretKey: cloudflare_api_token + remoteRef: + key: secrets/external-dns/cloudflare + property: cloudflare_api_token diff --git a/master/external-dns/values.yaml b/master/external-dns/values.yaml new file mode 100644 index 0000000..68abe91 --- /dev/null +++ b/master/external-dns/values.yaml @@ -0,0 +1,16 @@ +external-dns: + global: + imageRegistry: "registry.internal.durp.info" + + image: + pullPolicy: Always + + sources: + - service + + provider: cloudflare + cloudflare: + secretName : "external-dns" + proxied: false + + policy: sync diff --git a/master/external-secrets/Chart.yaml b/master/external-secrets/Chart.yaml new file mode 100644 index 0000000..5b9982f --- /dev/null +++ b/master/external-secrets/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-secrets + repository: https://charts.external-secrets.io + version: 0.10.4 + diff --git a/master/external-secrets/values.yaml b/master/external-secrets/values.yaml new file mode 100644 index 0000000..a720adb --- /dev/null +++ b/master/external-secrets/values.yaml @@ -0,0 +1,463 @@ +external-secrets: + replicaCount: 3 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: Always + # -- The image tag to use. The default is the chart appVersion. + # There are different image flavours available, like distroless and ubi. + # Please see GitHub release notes for image tags for these flavors. + # By default the distroless image is used. + tag: "" + + # -- If set, install and upgrade CRDs through helm chart. + installCRDs: true + + crds: + # -- If true, create CRDs for Cluster External Secret. + createClusterExternalSecret: true + # -- If true, create CRDs for Cluster Secret Store. + createClusterSecretStore: true + # -- If true, create CRDs for Push Secret. + createPushSecret: true + annotations: {} + conversion: + enabled: true + + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + + # -- If true, external-secrets will perform leader election between instances to ensure no more + # than one instance of external-secrets operates at a time. + leaderElect: true + + # -- If set external secrets will filter matching + # Secret Stores with the appropriate controller values. + controllerClass: "" + + # -- If true external secrets will use recommended kubernetes + # annotations as prometheus metric labels. + extendedMetricLabels: false + + # -- If set external secrets are only reconciled in the + # provided namespace + scopedNamespace: "" + + # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace + # and implicitly disable cluster stores and cluster external secrets + scopedRBAC: false + + # -- if true, the operator will process cluster external secret. Else, it will ignore them. + processClusterExternalSecret: true + + # -- if true, the operator will process cluster store. Else, it will ignore them. + processClusterStore: true + + # -- Specifies whether an external secret operator deployment be created. + createOperator: true + + # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at + # a time. + concurrent: 1 + + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + ## -- Extra containers to add to the pod. + extraContainers: [] + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- namespace where you want to install ServiceMonitors + namespace: "" + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + # -- Let prometheus add an exported_ prefix to conflicting labels + honorLabels: false + + # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) + metricRelabelings: [] + # - action: replace + # regex: (.*) + # replacement: $1 + # sourceLabels: + # - exported_namespace + # targetLabel: namespace + + # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) + relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # targetLabel: nodename + # replacement: $1 + # action: replace + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + + # -- Run the controller on the host network + hostNetwork: false + + webhook: + # -- Specifies whether a webhook deployment be created. + create: true + # -- Specifices the time to check if the cert is valid + certCheckInterval: "5m" + # -- Specifices the lookaheadInterval for certificate validity + lookaheadInterval: "" + replicaCount: 1 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + certDir: /tmp/certs + # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore + failurePolicy: Fail + # -- Specifies if webhook pod should use hostNetwork or not. + hostNetwork: false + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: IfNotPresent + # -- The image tag to use. The default is the chart appVersion. + tag: "" + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + # -- The port the webhook will listen to + port: 10250 + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + + readinessProbe: + # -- Address for readiness probe + address: "" + # -- ReadinessProbe port for kubelet + port: 8081 + + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + # -- Annotations to add to Secret + secretAnnotations: {} + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + certController: + # -- Specifies whether a certificate controller deployment be created. + create: true + requeueInterval: "5m" + replicaCount: 1 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: Always + tag: "" + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Run the certController on the host network + hostNetwork: false + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + # -- Specifies `dnsOptions` to deployment + dnsConfig: {} diff --git a/master/gatekeeper/Chart.yaml b/master/gatekeeper/Chart.yaml new file mode 100644 index 0000000..ec42676 --- /dev/null +++ b/master/gatekeeper/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: gatekeeper +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: gatekeeper + repository: https://open-policy-agent.github.io/gatekeeper/charts + version: 3.17.1 diff --git a/master/gatekeeper/values.yaml b/master/gatekeeper/values.yaml new file mode 100644 index 0000000..0b0c6e7 --- /dev/null +++ b/master/gatekeeper/values.yaml @@ -0,0 +1,278 @@ +#gatekeeper: +# replicas: 3 +# revisionHistoryLimit: 10 +# auditInterval: 60 +# metricsBackends: ["prometheus"] +# auditMatchKindOnly: false +# constraintViolationsLimit: 20 +# auditFromCache: false +# disableMutation: false +# disableValidatingWebhook: false +# validatingWebhookName: gatekeeper-validating-webhook-configuration +# validatingWebhookTimeoutSeconds: 3 +# validatingWebhookFailurePolicy: Ignore +# validatingWebhookAnnotations: {} +# validatingWebhookExemptNamespacesLabels: {} +# validatingWebhookObjectSelector: {} +# validatingWebhookCheckIgnoreFailurePolicy: Fail +# validatingWebhookCustomRules: {} +# validatingWebhookURL: null +# enableDeleteOperations: false +# enableExternalData: true +# enableGeneratorResourceExpansion: true +# enableTLSHealthcheck: false +# maxServingThreads: -1 +# mutatingWebhookName: gatekeeper-mutating-webhook-configuration +# mutatingWebhookFailurePolicy: Ignore +# mutatingWebhookReinvocationPolicy: Never +# mutatingWebhookAnnotations: {} +# mutatingWebhookExemptNamespacesLabels: {} +# mutatingWebhookObjectSelector: {} +# mutatingWebhookTimeoutSeconds: 1 +# mutatingWebhookCustomRules: {} +# mutatingWebhookURL: null +# mutationAnnotations: false +# auditChunkSize: 500 +# logLevel: INFO +# logDenies: false +# logMutations: false +# emitAdmissionEvents: false +# emitAuditEvents: false +# admissionEventsInvolvedNamespace: false +# auditEventsInvolvedNamespace: false +# resourceQuota: true +# externaldataProviderResponseCacheTTL: 3m +# image: +# repository: openpolicyagent/gatekeeper +# crdRepository: openpolicyagent/gatekeeper-crds +# release: v3.15.0-beta.0 +# pullPolicy: Always +# pullSecrets: [] +# preInstall: +# crdRepository: +# image: +# repository: null +# tag: v3.15.0-beta.0 +# postUpgrade: +# labelNamespace: +# enabled: false +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# extraNamespaces: [] +# podSecurity: ["pod-security.kubernetes.io/audit=restricted", +# "pod-security.kubernetes.io/audit-version=latest", +# "pod-security.kubernetes.io/warn=restricted", +# "pod-security.kubernetes.io/warn-version=latest", +# "pod-security.kubernetes.io/enforce=restricted", +# "pod-security.kubernetes.io/enforce-version=v1.24"] +# extraAnnotations: {} +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# postInstall: +# labelNamespace: +# enabled: true +# extraRules: [] +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# extraNamespaces: [] +# podSecurity: ["pod-security.kubernetes.io/audit=restricted", +# "pod-security.kubernetes.io/audit-version=latest", +# "pod-security.kubernetes.io/warn=restricted", +# "pod-security.kubernetes.io/warn-version=latest", +# "pod-security.kubernetes.io/enforce=restricted", +# "pod-security.kubernetes.io/enforce-version=v1.24"] +# extraAnnotations: {} +# priorityClassName: "" +# probeWebhook: +# enabled: true +# image: +# repository: curlimages/curl +# tag: 7.83.1 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# waitTimeout: 60 +# httpTimeout: 2 +# insecureHTTPS: false +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# preUninstall: +# deleteWebhookConfigurations: +# extraRules: [] +# enabled: false +# image: +# repository: openpolicyagent/gatekeeper-crds +# tag: v3.15.0-beta.0 +# pullPolicy: IfNotPresent +# pullSecrets: [] +# priorityClassName: "" +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podAnnotations: {} +# auditPodAnnotations: {} +# podLabels: {} +# podCountLimit: "100" +# secretAnnotations: {} +# enableRuntimeDefaultSeccompProfile: true +# controllerManager: +# exemptNamespaces: [] +# exemptNamespacePrefixes: [] +# hostNetwork: false +# dnsPolicy: ClusterFirst +# port: 8443 +# metricsPort: 8888 +# healthPort: 9090 +# readinessTimeout: 1 +# livenessTimeout: 1 +# priorityClassName: system-cluster-critical +# disableCertRotation: false +# tlsMinVersion: 1.3 +# clientCertName: "" +# strategyType: RollingUpdate +# affinity: +# podAntiAffinity: +# preferredDuringSchedulingIgnoredDuringExecution: +# - podAffinityTerm: +# labelSelector: +# matchExpressions: +# - key: gatekeeper.sh/operation +# operator: In +# values: +# - webhook +# topologyKey: kubernetes.io/hostname +# weight: 100 +# topologySpreadConstraints: [] +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: +# limits: +# memory: 512Mi +# requests: +# cpu: 100m +# memory: 512Mi +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podSecurityContext: +# fsGroup: 999 +# supplementalGroups: +# - 999 +# extraRules: [] +# networkPolicy: +# enabled: false +# ingress: { } +# # - from: +# # - ipBlock: +# # cidr: 0.0.0.0/0 +# audit: +# enablePubsub: false +# connection: audit-connection +# channel: audit-channel +# hostNetwork: false +# dnsPolicy: ClusterFirst +# metricsPort: 8888 +# healthPort: 9090 +# readinessTimeout: 1 +# livenessTimeout: 1 +# priorityClassName: system-cluster-critical +# disableCertRotation: false +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: +# limits: +# memory: 512Mi +# requests: +# cpu: 100m +# memory: 512Mi +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 999 +# runAsNonRoot: true +# runAsUser: 1000 +# podSecurityContext: +# fsGroup: 999 +# supplementalGroups: +# - 999 +# writeToRAMDisk: false +# extraRules: [] +# crds: +# affinity: {} +# tolerations: [] +# nodeSelector: {kubernetes.io/os: linux} +# resources: {} +# securityContext: +# allowPrivilegeEscalation: false +# capabilities: +# drop: +# - ALL +# readOnlyRootFilesystem: true +# runAsGroup: 65532 +# runAsNonRoot: true +# runAsUser: 65532 +# pdb: +# controllerManager: +# minAvailable: 1 +# service: {} +# disabledBuiltins: ["{http.send}"] +# psp: +# enabled: true +# upgradeCRDs: +# enabled: true +# extraRules: [] +# priorityClassName: "" +# rbac: +# create: true +# externalCertInjection: +# enabled: false +# secretName: gatekeeper-webhook-server-cert +# \ No newline at end of file diff --git a/master/gitlab-runner/Chart.yaml b/master/gitlab-runner/Chart.yaml new file mode 100644 index 0000000..f64e829 --- /dev/null +++ b/master/gitlab-runner/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: gitlab-runner +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: gitlab-runner + repository: https://charts.gitlab.io/ + version: 0.69.0 diff --git a/master/gitlab-runner/Dockerfile b/master/gitlab-runner/Dockerfile new file mode 100644 index 0000000..498fcc3 --- /dev/null +++ b/master/gitlab-runner/Dockerfile @@ -0,0 +1,4 @@ +FROM ubuntu:latest +LABEL authors="user" + +ENTRYPOINT ["top", "-b"] \ No newline at end of file diff --git a/master/gitlab-runner/templates/secrets.yaml b/master/gitlab-runner/templates/secrets.yaml new file mode 100644 index 0000000..784ef11 --- /dev/null +++ b/master/gitlab-runner/templates/secrets.yaml @@ -0,0 +1,19 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: runner-registration-token + remoteRef: + key: secrets/gitlab/runner + property: runner-registration-token + - secretKey: runner-token + remoteRef: + key: secrets/gitlab/runner + property: runner-token diff --git a/master/gitlab-runner/values.yaml b/master/gitlab-runner/values.yaml new file mode 100644 index 0000000..0cc62b8 --- /dev/null +++ b/master/gitlab-runner/values.yaml @@ -0,0 +1,71 @@ +gitlab-runner: + + image: + registry: registry.internal.durp.info + image: gitlab-org/gitlab-runner + + imagePullPolicy: Always + gitlabUrl: https://gitlab.com/ + unregisterRunner: true + terminationGracePeriodSeconds: 3600 + concurrent: 10 + checkInterval: 30 + + rbac: + create: true + rules: [] + clusterWideAccess: false + podSecurityPolicy: + enabled: false + resourceNames: + - gitlab-runner + + metrics: + enabled: true + serviceMonitor: + enabled: true + service: + enabled: true + annotations: {} + + runners: + config: | + [[runners]] + [runners.kubernetes] + namespace = "{{.Release.Namespace}}" + image = "ubuntu:22.04" + privileged = true + + executor: kubernetes + name: "k3s" + runUntagged: true + privileged: true + secret: gitlab-secret + #builds: + #cpuLimit: 200m + #cpuLimitOverwriteMaxAllowed: 400m + #memoryLimit: 256Mi + #memoryLimitOverwriteMaxAllowed: 512Mi + #cpuRequests: 100m + #cpuRequestsOverwriteMaxAllowed: 200m + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + privileged: false + capabilities: + drop: ["ALL"] + + podSecurityContext: + runAsUser: 100 + fsGroup: 65533 + + resources: + limits: + memory: 2Gi + requests: + memory: 128Mi + cpu: 500m \ No newline at end of file diff --git a/master/heimdall/Chart.yaml b/master/heimdall/Chart.yaml new file mode 100644 index 0000000..39dbf54 --- /dev/null +++ b/master/heimdall/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: heimdall +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: heimdall + repository: https://djjudas21.github.io/charts/ + version: 8.5.4 diff --git a/master/heimdall/templates/ingress.yaml b/master/heimdall/templates/ingress.yaml new file mode 100644 index 0000000..98b6144 --- /dev/null +++ b/master/heimdall/templates/ingress.yaml @@ -0,0 +1,52 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + annotations: + name: heimdall-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`heimdall.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: heimdall + port: 80 + - match: Host(`heimdall.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: heimdall-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: heimdall-tls +spec: + secretName: heimdall-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "heimdall.durp.info" + dnsNames: + - "heimdall.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: heimdall-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/heimdall/values.yaml b/master/heimdall/values.yaml new file mode 100644 index 0000000..e93ca43 --- /dev/null +++ b/master/heimdall/values.yaml @@ -0,0 +1,28 @@ +heimdall: + + image: + registry: + repository: registry.internal.durp.info/linuxserver/heimdall + pullPolicy: Always + + env: + TZ: UTC + PUID: "1000" + PGID: "1000" + + service: + main: + annotations: + external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info + external-dns.alpha.kubernetes.io/target: home.durp.info + ports: + http: + port: 80 + + ingress: + main: + enabled: false + + persistence: + config: + enabled: true diff --git a/master/internalproxy/Chart.yaml b/master/internalproxy/Chart.yaml new file mode 100644 index 0000000..71c9b0d --- /dev/null +++ b/master/internalproxy/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: internalproxy +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "0.1.0" diff --git a/master/internalproxy/templates/argocd.yaml b/master/internalproxy/templates/argocd.yaml new file mode 100644 index 0000000..9a82e9e --- /dev/null +++ b/master/internalproxy/templates/argocd.yaml @@ -0,0 +1,46 @@ +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: argocd-ingress +# annotations: +# cert-manager.io/cluster-issuer: letsencrypt-production +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`argocd.internal.durp.info`) +# middlewares: +# - name: whitelist +# namespace: traefik +# kind: Rule +# services: +# - name: argocd-server +# port: 443 +# scheme: https +# tls: +# secretName: argocd-tls +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: argocd-server +#spec: +# type: ExternalName +# externalName: argocd-server.argocd.svc.cluster.local +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: argocd-tls +#spec: +# secretName: argocd-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "argocd.internal.durp.info" +# dnsNames: +# - "argocd.internal.durp.info" \ No newline at end of file diff --git a/master/internalproxy/templates/blueiris.yaml b/master/internalproxy/templates/blueiris.yaml new file mode 100644 index 0000000..5f120c9 --- /dev/null +++ b/master/internalproxy/templates/blueiris.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: blueiris +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: blueiris +subsets: + - addresses: + - ip: 192.168.99.2 + ports: + - name: app + port: 81 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: blueiris-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`blueiris.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: blueiris + port: 81 + scheme: http + tls: + secretName: blueiris-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: blueiris-tls +spec: + secretName: blueiris-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "blueiris.internal.durp.info" + dnsNames: + - "blueiris.internal.durp.info" diff --git a/master/internalproxy/templates/duplicati-ingress.yaml b/master/internalproxy/templates/duplicati-ingress.yaml new file mode 100644 index 0000000..d51c391 --- /dev/null +++ b/master/internalproxy/templates/duplicati-ingress.yaml @@ -0,0 +1,70 @@ +apiVersion: v1 +kind: Service +metadata: + name: duplicati +spec: + ports: + - name: app + port: 8200 + protocol: TCP + targetPort: 8200 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: duplicati +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 8200 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: duplicati-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: duplicati + port: 8200 + - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: duplicati-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: duplicati-tls +spec: + secretName: duplicati-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "duplicati.internal.durp.info" + dnsNames: + - "duplicati.internal.durp.info" \ No newline at end of file diff --git a/master/internalproxy/templates/gitea.yaml b/master/internalproxy/templates/gitea.yaml new file mode 100644 index 0000000..ec29631 --- /dev/null +++ b/master/internalproxy/templates/gitea.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitea +spec: + ports: + - name: app + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: gitea +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 3000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: gitea-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gitea.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: gitea + port: 3000 + scheme: http + tls: + secretName: gitea-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitea-tls +spec: + secretName: gitea-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gitea.durp.info" + dnsNames: + - "gitea.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: gitea-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: gitea.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/internalproxy/templates/jellyfin.yaml b/master/internalproxy/templates/jellyfin.yaml new file mode 100644 index 0000000..1b919bf --- /dev/null +++ b/master/internalproxy/templates/jellyfin.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: jellyfin +spec: + ports: + - name: app + port: 8096 + protocol: TCP + targetPort: 8096 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: jellyfin +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 8096 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: jellyfin-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`jellyfin.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: jellyfin + port: 8096 + scheme: http + tls: + secretName: jellyfin-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: jellyfin-tls +spec: + secretName: jellyfin-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "jellyfin.durp.info" + dnsNames: + - "jellyfin.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: jellyfin-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: jellyfin.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/kasm.yaml b/master/internalproxy/templates/kasm.yaml new file mode 100644 index 0000000..7f756e0 --- /dev/null +++ b/master/internalproxy/templates/kasm.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: kasm +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: kasm +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kasm-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kasm.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: kasm + port: 443 + scheme: https + tls: + secretName: kasm-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kasm-tls +spec: + secretName: kasm-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kasm.durp.info" + dnsNames: + - "kasm.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: kasm-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kasm.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/minio.yaml b/master/internalproxy/templates/minio.yaml new file mode 100644 index 0000000..aa191b6 --- /dev/null +++ b/master/internalproxy/templates/minio.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: minio +spec: + ports: + - name: app + port: 9769 + protocol: TCP + targetPort: 9769 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: minio +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 9769 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: minio-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: minio + port: 9769 + scheme: http + tls: + secretName: minio-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-tls +spec: + secretName: minio-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "minio.internal.durp.info" + dnsNames: + - "minio.internal.durp.info" diff --git a/master/internalproxy/templates/nexus.yaml b/master/internalproxy/templates/nexus.yaml new file mode 100644 index 0000000..7074102 --- /dev/null +++ b/master/internalproxy/templates/nexus.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: Service +metadata: + name: nexus +spec: + ports: + - name: app + port: 8081 + protocol: TCP + targetPort: 8081 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: nexus +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 8081 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: nexus-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`nexus.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: nexus + port: 8081 + tls: + secretName: nexus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: nexus-tls +spec: + secretName: nexus-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "nexus.durp.info" + dnsNames: + - "nexus.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: nexus-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: nexus.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/internalproxy/templates/octopus.yaml b/master/internalproxy/templates/octopus.yaml new file mode 100644 index 0000000..e0e5d78 --- /dev/null +++ b/master/internalproxy/templates/octopus.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: octopus +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: octopus +subsets: + - addresses: + - ip: 192.168.20.105 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: octopus-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`octopus.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: octopus + port: 443 + scheme: https + tls: + secretName: octopus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: octopus-tls +spec: + secretName: octopus-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "octopus.internal.durp.info" + dnsNames: + - "octopus.internal.durp.info" diff --git a/master/internalproxy/templates/ollama.yaml b/master/internalproxy/templates/ollama.yaml new file mode 100644 index 0000000..75e8691 --- /dev/null +++ b/master/internalproxy/templates/ollama.yaml @@ -0,0 +1,102 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ollama-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: ollama-secret + data: + - secretKey: users + remoteRef: + key: secrets/internalproxy/ollama + property: users + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: ollama-basic-auth +spec: + basicAuth: + headerField: x-api-key + secret: ollama-secret + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: ollama-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`ollama.durp.info`) && PathPrefix(`/`) + middlewares: + - name: ollama-basic-auth + kind: Rule + services: + - name: ollama + port: 11435 + tls: + secretName: ollama-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls +spec: + secretName: ollama-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "ollama.durp.info" + dnsNames: + - "ollama.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: ollama-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/pfsense.yaml b/master/internalproxy/templates/pfsense.yaml new file mode 100644 index 0000000..45d45e8 --- /dev/null +++ b/master/internalproxy/templates/pfsense.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: pfsense +spec: + ports: + - name: app + port: 10443 + protocol: TCP + targetPort: 10443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: pfsense +subsets: + - addresses: + - ip: 192.168.20.1 + ports: + - name: app + port: 10443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: pfsense-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`pfsense.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: pfsense + port: 10443 + scheme: https + tls: + secretName: pfsense-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: pfsense-tls +spec: + secretName: pfsense-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "pfsense.internal.durp.info" + dnsNames: + - "pfsense.internal.durp.info" diff --git a/master/internalproxy/templates/plex.yaml b/master/internalproxy/templates/plex.yaml new file mode 100644 index 0000000..81f6426 --- /dev/null +++ b/master/internalproxy/templates/plex.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: plex +spec: + ports: + - name: app + port: 32400 + protocol: TCP + targetPort: 32400 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: plex +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 32400 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: plex-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`plex.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: plex + port: 32400 + scheme: https + tls: + secretName: plex-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: plex-tls +spec: + secretName: plex-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "plex.durp.info" + dnsNames: + - "plex.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: plex-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: plex.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/internalproxy/templates/portainer.yaml b/master/internalproxy/templates/portainer.yaml new file mode 100644 index 0000000..5c22061 --- /dev/null +++ b/master/internalproxy/templates/portainer.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: portainer +spec: + ports: + - name: app + port: 9443 + protocol: TCP + targetPort: 9443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: portainer +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 9443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: portainer-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: portainer + port: 9443 + scheme: https + tls: + secretName: portainer-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: portainer-tls +spec: + secretName: portainer-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "portainer.internal.durp.info" + dnsNames: + - "portainer.internal.durp.info" diff --git a/master/internalproxy/templates/proxmox.yaml b/master/internalproxy/templates/proxmox.yaml new file mode 100644 index 0000000..fd0343a --- /dev/null +++ b/master/internalproxy/templates/proxmox.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: proxmox +spec: + ports: + - name: app + port: 8006 + protocol: TCP + targetPort: 8006 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: proxmox +subsets: + - addresses: + - ip: 192.168.21.252 + ports: + - name: app + port: 8006 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: proxmox-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: proxmox + port: 8006 + scheme: https + tls: + secretName: proxmox-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: proxmox-tls +spec: + secretName: proxmox-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "proxmox.internal.durp.info" + dnsNames: + - "proxmox.internal.durp.info" diff --git a/master/internalproxy/templates/registry-internal.yaml b/master/internalproxy/templates/registry-internal.yaml new file mode 100644 index 0000000..27561fe --- /dev/null +++ b/master/internalproxy/templates/registry-internal.yaml @@ -0,0 +1,59 @@ +apiVersion: v1 +kind: Service +metadata: + name: registry-internal +spec: + ports: + - name: app + port: 5000 + protocol: TCP + targetPort: 5000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: registry-internal +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 5000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: registry-internal-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`registry.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: registry-internal + port: 5000 + tls: + secretName: registry-internal-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: registry-internal-tls +spec: + secretName: registry-internal-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "registry.internal.durp.info" + dnsNames: + - "registry.internal.durp.info" diff --git a/master/internalproxy/templates/registry.yaml b/master/internalproxy/templates/registry.yaml new file mode 100644 index 0000000..b4ac19a --- /dev/null +++ b/master/internalproxy/templates/registry.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: Service +metadata: + name: registry +spec: + ports: + - name: app + port: 5000 + protocol: TCP + targetPort: 5000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: registry +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 5000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: registry-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`registry.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: registry + port: 5000 + tls: + secretName: registry-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: registry-tls +spec: + secretName: registry-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "registry.durp.info" + dnsNames: + - "registry.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: registry-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: registry.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/internalproxy/templates/s3.yaml b/master/internalproxy/templates/s3.yaml new file mode 100644 index 0000000..cd52fb6 --- /dev/null +++ b/master/internalproxy/templates/s3.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: s3 +spec: + ports: + - name: app + port: 9768 + protocol: TCP + targetPort: 9768 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: s3 +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 9768 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: s3-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: s3 + port: 9768 + scheme: http + tls: + secretName: s3-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: s3-tls +spec: + secretName: s3-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "s3.internal.durp.info" + dnsNames: + - "s3.internal.durp.info" diff --git a/master/internalproxy/templates/semaphore.yaml b/master/internalproxy/templates/semaphore.yaml new file mode 100644 index 0000000..ffd81dc --- /dev/null +++ b/master/internalproxy/templates/semaphore.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: semaphore +spec: + ports: + - name: app + port: 3001 + protocol: TCP + targetPort: 3001 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: semaphore +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 3001 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: semaphore-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: semaphore + port: 3001 + scheme: http + tls: + secretName: semaphore-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: semaphore-tls +spec: + secretName: semaphore-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "semaphore.internal.durp.info" + dnsNames: + - "semaphore.internal.durp.info" diff --git a/master/internalproxy/templates/smokeping.yaml b/master/internalproxy/templates/smokeping.yaml new file mode 100644 index 0000000..8a76738 --- /dev/null +++ b/master/internalproxy/templates/smokeping.yaml @@ -0,0 +1,82 @@ +apiVersion: v1 +kind: Service +metadata: + name: smokeping +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: smokeping +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 81 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: smokeping-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: smokeping + port: 81 + - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: smokeping-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: smokeping-tls +spec: + secretName: smokeping-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "smokeping.durp.info" + dnsNames: + - "smokeping.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: smokeping-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/internalproxy/templates/speedtest.yaml b/master/internalproxy/templates/speedtest.yaml new file mode 100644 index 0000000..e034917 --- /dev/null +++ b/master/internalproxy/templates/speedtest.yaml @@ -0,0 +1,74 @@ +apiVersion: v1 +kind: Service +metadata: + name: speedtest +spec: + ports: + - name: app + port: 6580 + protocol: TCP + targetPort: 6580 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: speedtest +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 6580 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: speedtest-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: speedtest + port: 6580 + tls: + secretName: speedtest-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: speedtest-tls +spec: + secretName: speedtest-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "speedtest.durp.info" + dnsNames: + - "speedtest.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: speedtest-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/internalproxy/templates/tdarr.yaml b/master/internalproxy/templates/tdarr.yaml new file mode 100644 index 0000000..c4403b9 --- /dev/null +++ b/master/internalproxy/templates/tdarr.yaml @@ -0,0 +1,67 @@ +apiVersion: v1 +kind: Service +metadata: + name: tdarr +spec: + ports: + - name: app + port: 8267 + protocol: TCP + targetPort: 8267 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: tdarr +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 8267 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: tdarr-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`tdarr.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: tdarr + port: 8267 + scheme: http + tls: + secretName: tdarr-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: tdarr-tls +spec: + secretName: tdarr-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "tdarr.internal.durp.info" + dnsNames: + - "tdarr.internal.durp.info" diff --git a/master/internalproxy/templates/unraid.yaml b/master/internalproxy/templates/unraid.yaml new file mode 100644 index 0000000..9c62edc --- /dev/null +++ b/master/internalproxy/templates/unraid.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: unraid-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: unraid + port: 443 + scheme: https + tls: + secretName: unraid-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: unraid-tls +spec: + secretName: unraid-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "unraid.internal.durp.info" + dnsNames: + - "unraid.internal.durp.info" diff --git a/master/internalproxy/templates/wazuh.yaml b/master/internalproxy/templates/wazuh.yaml new file mode 100644 index 0000000..5a5d853 --- /dev/null +++ b/master/internalproxy/templates/wazuh.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: wazuh +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: wazuh +subsets: + - addresses: + - ip: 192.168.20.102 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: wazuh-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`wazuh.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: wazuh + port: 443 + scheme: https + tls: + secretName: wazuh-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: wazuh-tls +spec: + secretName: wazuh-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "wazuh.internal.durp.info" + dnsNames: + - "wazuh.internal.durp.info" diff --git a/master/krakend/Chart.yaml b/master/krakend/Chart.yaml new file mode 100644 index 0000000..d998c9f --- /dev/null +++ b/master/krakend/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: krakend +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" \ No newline at end of file diff --git a/master/krakend/templates/deployments.yaml b/master/krakend/templates/deployments.yaml new file mode 100644 index 0000000..ce50302 --- /dev/null +++ b/master/krakend/templates/deployments.yaml @@ -0,0 +1,39 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: krakend + name: krakend + labels: + app: krakend +spec: + selector: + matchLabels: + app: krakend + replicas: 1 + template: + metadata: + labels: + app: krakend + spec: + volumes: + - name: krakend-secret + secret: + secretName: krakend-secret + containers: + - name: krakend + image: registry.internal.durp.info/devopsfaith/krakend:2.4.3 + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /__health + port: 8080 + readinessProbe: + httpGet: + path: /__health + port: 8080 + ports: + - name: http + containerPort: 8080 + volumeMounts: + - name: krakend-secret + mountPath: /etc/krakend \ No newline at end of file diff --git a/master/krakend/templates/ingress.yaml b/master/krakend/templates/ingress.yaml new file mode 100644 index 0000000..a8c08eb --- /dev/null +++ b/master/krakend/templates/ingress.yaml @@ -0,0 +1,56 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: api-tls +spec: + secretName: api-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "api.durp.info" + dnsNames: + - "api.durp.info" + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: krakend-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`api.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: krakend-service + port: 8080 + scheme: http + tls: + secretName: api-tls + +--- + +kind: Service +apiVersion: v1 +metadata: + name: api-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: api.durp.info +spec: + type: ExternalName + externalName: durp.info + +--- + +kind: Service +apiVersion: v1 +metadata: + name: api-developer-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: developer.durp.info + external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" +spec: + type: ExternalName + externalName: developerdurp.github.io diff --git a/master/krakend/templates/secrets.yaml b/master/krakend/templates/secrets.yaml new file mode 100644 index 0000000..2eb1a9d --- /dev/null +++ b/master/krakend/templates/secrets.yaml @@ -0,0 +1,15 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: krakend-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: krakend-secret + data: + - secretKey: krakend.json + remoteRef: + key: secrets/krakend/config + property: config \ No newline at end of file diff --git a/master/krakend/templates/service.yaml b/master/krakend/templates/service.yaml new file mode 100644 index 0000000..d5393f3 --- /dev/null +++ b/master/krakend/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: krakend-service +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP + selector: + app: krakend \ No newline at end of file diff --git a/master/kube-prometheus-stack/Chart.yaml b/master/kube-prometheus-stack/Chart.yaml new file mode 100644 index 0000000..ecb4ab2 --- /dev/null +++ b/master/kube-prometheus-stack/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: kube-prometheus-stack +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: kube-prometheus-stack + repository: https://prometheus-community.github.io/helm-charts + version: 63.1.0 diff --git a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml new file mode 100644 index 0000000..716d4e5 --- /dev/null +++ b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml @@ -0,0 +1,41 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: vault-grafana-oauth +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: grafana-oauth + data: + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + remoteRef: + key: secrets/kube-prometheus/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET + remoteRef: + key: secrets/kube-prometheus/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: vault-admin-credentials +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: grafana-admin-credentials + data: + - secretKey: admin-password + remoteRef: + key: secrets/kube-prometheus/grafana/admin + property: admin-password + - secretKey: admin-user + remoteRef: + key: secrets/kube-prometheus/grafana/admin + property: admin-user diff --git a/master/kube-prometheus-stack/templates/ingress.yaml b/master/kube-prometheus-stack/templates/ingress.yaml new file mode 100644 index 0000000..caf0ee1 --- /dev/null +++ b/master/kube-prometheus-stack/templates/ingress.yaml @@ -0,0 +1,80 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: grafana-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`grafana.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: grafana + port: 80 + tls: + secretName: grafana-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: grafana-tls +spec: + secretName: grafana-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "grafana.durp.info" + dnsNames: + - "grafana.durp.info" + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: alertmanager-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: prometheus-alertmanager + port: 9093 + tls: + secretName: alertmanager-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: alertmanager-tls +spec: + secretName: alertmanager-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "alertmanager.durp.info" + dnsNames: + - "alertmanager.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: grafana-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: grafana.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/kube-prometheus-stack/values.yaml b/master/kube-prometheus-stack/values.yaml new file mode 100644 index 0000000..19436ac --- /dev/null +++ b/master/kube-prometheus-stack/values.yaml @@ -0,0 +1,203 @@ +kube-prometheus-stack: + fullnameOverride: prometheus + + defaultRules: + create: true + rules: + alertmanager: true + etcd: true + configReloaders: true + general: true + k8s: true + kubeApiserverAvailability: true + kubeApiserverBurnrate: true + kubeApiserverHistogram: true + kubeApiserverSlos: true + kubelet: true + kubeProxy: true + kubePrometheusGeneral: true + kubePrometheusNodeRecording: true + kubernetesApps: true + kubernetesResources: true + kubernetesStorage: true + kubernetesSystem: true + kubeScheduler: true + kubeStateMetrics: true + network: true + node: true + nodeExporterAlerting: true + nodeExporterRecording: true + prometheus: true + prometheusOperator: true + + alertmanager: + fullnameOverride: alertmanager + enabled: true + ingress: + enabled: false + grafana: + enabled: true + fullnameOverride: grafana + forceDeployDatasources: false + forceDeployDashboards: false + defaultDashboardsEnabled: true + defaultDashboardsTimezone: utc + plugins: + - grafana-polystat-panel + serviceMonitor: + enabled: true + admin: + existingSecret: grafana-admin-credentials + userKey: admin-user + passwordKey: admin-password + ingress: + enabled: false + grafana.ini: + server: + root_url: https://grafana.durp.info + auth.generic_oauth: + enabled: true + scopes: openid profile email + auth_url: https://authentik.durp.info/application/o/authorize/ + token_url: https://authentik.durp.info/application/o/token/ + api_url: https://authentik.durp.info/application/o/userinfo/ + envFromSecret: "grafana-oauth" + + kubeApiServer: + enabled: true + + kubelet: + enabled: true + serviceMonitor: + metricRelabelings: + - action: replace + sourceLabels: + - node + targetLabel: instance + + kubeControllerManager: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + + coreDns: + enabled: false + + kubeDns: + enabled: false + + kubeEtcd: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + service: + enabled: true + port: 2381 + targetPort: 2381 + + kubeScheduler: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + + kubeProxy: + enabled: true + endpoints: # ips of servers + - 192.168.20.121 + - 192.168.20.122 + - 192.168.20.123 + + kubeStateMetrics: + enabled: true + + kube-state-metrics: + fullnameOverride: kube-state-metrics + selfMonitor: + enabled: true + prometheus: + monitor: + enabled: true + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + + nodeExporter: + enabled: true + serviceMonitor: + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + + prometheus-node-exporter: + fullnameOverride: node-exporter + podLabels: + jobLabel: node-exporter + extraArgs: + - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/) + - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$ + service: + portName: http-metrics + prometheus: + monitor: + enabled: true + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + resources: + requests: + memory: 512Mi + cpu: 250m + limits: + memory: 2048Mi + + prometheusOperator: + enabled: true + prometheusConfigReloader: + resources: + requests: + cpu: 200m + memory: 50Mi + limits: + memory: 100Mi + + prometheus: + enabled: true + prometheusSpec: + replicas: 1 + replicaExternalLabelName: "replica" + ruleSelectorNilUsesHelmValues: false + serviceMonitorSelectorNilUsesHelmValues: false + podMonitorSelectorNilUsesHelmValues: false + probeSelectorNilUsesHelmValues: false + retention: 6h + enableAdminAPI: true + walCompression: true + storageSpec: + volumeClaimTemplate: + spec: + storageClassName: nfs-storage + accessModes: ["ReadWriteMany"] + resources: + requests: + storage: 50Gi + + thanosRuler: + enabled: false diff --git a/master/kubeclarity/Chart.yaml b/master/kubeclarity/Chart.yaml new file mode 100644 index 0000000..4eef59a --- /dev/null +++ b/master/kubeclarity/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: kubeclarity +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: kubeclarity + repository: https://openclarity.github.io/kubeclarity + version: 2.23.3 diff --git a/master/kubeclarity/templates/ingress.yaml b/master/kubeclarity/templates/ingress.yaml new file mode 100644 index 0000000..77b67a7 --- /dev/null +++ b/master/kubeclarity/templates/ingress.yaml @@ -0,0 +1,47 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kubeclarity-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kubeclarity.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: kubeclarity-kubeclarity + port: 8080 + tls: + secretName: kubeclarity-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kubeclarity-tls +spec: + secretName: kubeclarity-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kubeclarity.durp.info" + dnsNames: + - "kubeclarity.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: kubeclarity-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kubeclarity.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/kubeclarity/values.yaml b/master/kubeclarity/values.yaml new file mode 100644 index 0000000..0bb5078 --- /dev/null +++ b/master/kubeclarity/values.yaml @@ -0,0 +1,235 @@ +kubeclarity: + global: + databasePassword: kubeclarity + docker: + registry: "registry.internal.durp.info/openclarity" + tag: "latest" + imagePullPolicy: Always + + curl: + image: + registry: "registry.internal.durp.info" + repository: curlimages/curl + tag: 7.87.0 + + kubeclarity: + docker: + imageName: "" + + logLevel: warning + + enableDBInfoLog: false + + prometheus: + enabled: false + + podAnnotations: {} + + service: + type: ClusterIP + port: 8080 + annotations: {} + + ingress: + enabled: false + + resources: + requests: + memory: "200Mi" + cpu: "100m" + limits: + memory: "1000Mi" + cpu: "1000m" + + initContainers: + resources: + requests: + memory: "100Mi" + cpu: "100m" + limits: + memory: "200Mi" + cpu: "200m" + + kubeclarity-runtime-scan: + httpsProxy: "" + httpProxy: "" + resultServicePort: 8888 + + labels: + app: kubeclarity-scanner + sidecar.istio.io/inject: "false" + + namespace: "" + + registry: + skipVerifyTlS: "false" + useHTTP: "false" + + cis-docker-benchmark-scanner: + resources: + requests: + memory: "50Mi" + cpu: "50m" + limits: + memory: "1000Mi" + cpu: "1000m" + + vulnerability-scanner: + resources: + requests: + memory: "50Mi" + cpu: "50m" + limits: + memory: "1000Mi" + cpu: "1000m" + + analyzer: + analyzerList: "syft gomod trivy" + analyzerScope: "squashed" + + trivy: + enabled: true + timeout: "300" + + scanner: + scannerList: "grype trivy" + + grype: + enabled: true + mode: "REMOTE" + + remote-grype: + timeout: "2m" + + dependency-track: + enabled: false + insecureSkipVerify: "true" + disableTls: "true" + apiserverAddress: "dependency-track-apiserver.dependency-track" + apiKey: "" + + trivy: + enabled: true + timeout: "300" + + kubeclarity-grype-server: + enabled: true + + docker: + imageRepo: "registry.internal.durp.info/openclarity" + imageTag: "v0.6.0" + imagePullPolicy: Always + + logLevel: warning + + servicePort: 9991 + + resources: + requests: + cpu: "200m" + memory: "200Mi" + limits: + cpu: "1000m" + memory: "1G" + + kubeclarity-trivy-server: + enabled: true + + ## Docker Image values. + image: + registry: registry.internal.durp.info + repository: aquasec/trivy + tag: 0.44.1 + pullPolicy: Always + + persistence: + enabled: false + + podSecurityContext: + runAsUser: 1001 + runAsNonRoot: true + fsGroup: 1001 + + securityContext: + privileged: false + readOnlyRootFilesystem: true + + trivy: + debugMode: false + + service: + port: 9992 + + resources: + requests: + cpu: "200m" + memory: "200Mi" + limits: + cpu: "1000m" + memory: "1G" + + + kubeclarity-sbom-db: + docker: + imageName: "" + logLevel: warning + + servicePort: 8080 + + resources: + requests: + memory: "20Mi" + cpu: "10m" + limits: + memory: "1Gi" + cpu: "200m" + + kubeclarity-postgresql: + enabled: true + + image: + registry: registry.internal.durp.info + repository: bitnami/postgresql + tag: 14.6.0-debian-11-r31 + + auth: + existingSecret: kubeclarity-postgresql-secret + username: postgres + database: kubeclarity + sslMode: disable + + service: + ports: + postgresql: 5432 + + serviceAccount: + enabled: true + securityContext: + enabled: true + fsGroup: 1001 + containerSecurityContext: + enabled: true + runAsUser: 1001 + runAsNonRoot: true + volumePermissions: + enabled: false + securityContext: + runAsUser: 1001 + shmVolume: + chmod: + enabled: true + + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "1000Mi" + cpu: "1000m" + + kubeclarity-postgresql-external: + enabled: false + + kubeclarity-postgresql-secret: + create: true + secretKey: "postgres-password" diff --git a/master/littlelink/Chart.yaml b/master/littlelink/Chart.yaml new file mode 100644 index 0000000..e69de29 diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml new file mode 100644 index 0000000..b713b86 --- /dev/null +++ b/master/littlelink/templates/deployment.yaml @@ -0,0 +1,99 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: littlelink + name: littlelink + labels: + app: littlelink +spec: + selector: + matchLabels: + app: littlelink + replicas: 1 + template: + metadata: + labels: + app: littlelink + spec: + containers: + - name: littlelink + image: registry.internal.durp.info/techno-tim/littlelink-server:latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthcheck + port: 3000 + readinessProbe: + httpGet: + path: /healthcheck + port: 3000 + env: + - name: META_TITLE + value: DeveloperDurp + - name: META_DESCRIPTION + value: The Durpy Developer + - name: META_AUTHOR + value: DeveloperDurp + - name: LANG + value: en + - name: META_INDEX_STATUS + value: all + - name: OG_TITLE + value: DeveloperDurp + - name: OG_DESCRIPTION + value: DeveloperDurp + - name: OG_URL + value: https://gitlab.com/developerdurp + - name: OG_IMAGE + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : OG_IMAGE_WIDTH + value: "400" + - name : OG_IMAGE_HEIGHT + value: "400" + - name : THEME + value: Dark + - name : FAVICON_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_2X_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_ALT + value: DeveloperDurp Profile Pic + - name : NAME + value: DeveloperDurp + - name : BIO + value: Sup Nerd, + - name : BUTTON_ORDER + value: GITHUB,GITLAB,YOUTUBE,TWITTER,COFFEE,EMAIL + - name : TWITTER + value: https://twitter.com/developerdurp + - name : GITHUB + value: https://github.com/DeveloperDurp + - name : GITLAB + value: https://gitlab.com/developerdurp + - name: YOUTUBE + value: https://www.youtube.com/channel/UC1rGa6s6kER_gLpIQsxeMVQ + - name : EMAIL + value: DeveloperDurp@durp.info + - name : EMAIL_TEXT + value: DeveloperDurp@durp.info + - name : FOOTER + value: DeveloperDurp © 2022 + - name: CUSTOM_BUTTON_TEXT + value: BuyMeACoffee + - name: CUSTOM_BUTTON_URL + value: https://www.buymeacoffee.com/DeveloperDurp + - name: CUSTOM_BUTTON_COLOR + value: '#ffdd00' + - name: CUSTOM_BUTTON_TEXT_COLOR + value: '#000000' + - name: CUSTOM_BUTTON_ALT_TEXT + value: Support + - name: CUSTOM_BUTTON_NAME + value: COFFEE + - name: CUSTOM_BUTTON_ICON + value: fa-solid fa-cup-togo + ports: + - name: http + containerPort: 3000 diff --git a/master/littlelink/templates/ingress.yaml b/master/littlelink/templates/ingress.yaml new file mode 100644 index 0000000..194f31e --- /dev/null +++ b/master/littlelink/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: littlelink-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`links.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: littlelink + port: 80 + tls: + secretName: littlelink-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: littlelink-tls +spec: + secretName: littlelink-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "links.durp.info" + dnsNames: + - "links.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: links-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: links.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/master/littlelink/templates/service.yaml b/master/littlelink/templates/service.yaml new file mode 100644 index 0000000..445d527 --- /dev/null +++ b/master/littlelink/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: littlelink +spec: + ports: + - name: http + port: 80 + targetPort: 3000 + protocol: TCP + selector: + app: littlelink \ No newline at end of file diff --git a/master/longhorn/Chart.yaml b/master/longhorn/Chart.yaml new file mode 100644 index 0000000..fde2188 --- /dev/null +++ b/master/longhorn/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: longhorn-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: longhorn + repository: https://charts.longhorn.io + version: 1.7.1 \ No newline at end of file diff --git a/master/longhorn/templates/ingress.yaml b/master/longhorn/templates/ingress.yaml new file mode 100644 index 0000000..df2e071 --- /dev/null +++ b/master/longhorn/templates/ingress.yaml @@ -0,0 +1,41 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: longhorn-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: longhorn-frontend + port: 80 + - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: longhorn-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-tls +spec: + secretName: longhorn-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "longhorn.internal.durp.info" + dnsNames: + - "longhorn.internal.durp.info" diff --git a/master/longhorn/templates/secrets.yaml b/master/longhorn/templates/secrets.yaml new file mode 100644 index 0000000..c10ab89 --- /dev/null +++ b/master/longhorn/templates/secrets.yaml @@ -0,0 +1,24 @@ + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: external-longhorn-backup-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: longhorn-backup-token-secret + data: + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + key: secrets/longhorn/backup + property: AWS_ACCESS_KEY_ID + - secretKey: AWS_ENDPOINTS + remoteRef: + key: secrets/longhorn/backup + property: AWS_ENDPOINTS + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + key: secrets/longhorn/backup + property: AWS_SECRET_ACCESS_KEY diff --git a/master/longhorn/values.yaml b/master/longhorn/values.yaml new file mode 100644 index 0000000..647385b --- /dev/null +++ b/master/longhorn/values.yaml @@ -0,0 +1,253 @@ +longhorn: + + # Default values for longhorn. + # This is a YAML-formatted file. + # Declare variables to be passed into your templates. + global: + cattle: + systemDefaultRegistry: "" + + image: + longhorn: + engine: + repository: longhornio/longhorn-engine + manager: + repository: longhornio/longhorn-manager + ui: + repository: longhornio/longhorn-ui + instanceManager: + repository: longhornio/longhorn-instance-manager + shareManager: + repository: longhornio/longhorn-share-manager + backingImageManager: + repository: longhornio/backing-image-manager + csi: + attacher: + repository: longhornio/csi-attacher + provisioner: + repository: longhornio/csi-provisioner + nodeDriverRegistrar: + repository: longhornio/csi-node-driver-registrar + resizer: + repository: longhornio/csi-resizer + snapshotter: + repository: longhornio/csi-snapshotter + pullPolicy: Always + + service: + ui: + type: ClusterIP + nodePort: null + manager: + type: ClusterIP + nodePort: "" + loadBalancerIP: "" + loadBalancerSourceRanges: "" + + persistence: + defaultClass: true + defaultFsType: ext4 + defaultClassReplicaCount: 3 + defaultDataLocality: disabled # best-effort otherwise + reclaimPolicy: Retain + migratable: false + recurringJobSelector: + enable: true + jobList: '[ + { + "name":"backup", + "task":"backup", + "cron":"0 0 * * ?", + "retain":24 + } + ]' + backingImage: + enable: false + name: ~ + dataSourceType: ~ + dataSourceParameters: ~ + expectedChecksum: ~ + + csi: + kubeletRootDir: ~ + attacherReplicaCount: ~ + provisionerReplicaCount: ~ + resizerReplicaCount: ~ + snapshotterReplicaCount: ~ + + defaultSettings: + backupTarget: S3://longhorn-master@us-east-1/ + backupTargetCredentialSecret: longhorn-backup-token-secret + allowRecurringJobWhileVolumeDetached: ~ + createDefaultDiskLabeledNodes: ~ + defaultDataPath: ~ + defaultDataLocality: ~ + replicaSoftAntiAffinity: ~ + replicaAutoBalance: ~ + storageOverProvisioningPercentage: ~ + storageMinimalAvailablePercentage: ~ + upgradeChecker: ~ + defaultReplicaCount: ~ + defaultLonghornStaticStorageClass: longhorn + backupstorePollInterval: ~ + taintToleration: ~ + systemManagedComponentsNodeSelector: ~ + priorityClass: ~ + autoSalvage: ~ + autoDeletePodWhenVolumeDetachedUnexpectedly: ~ + disableSchedulingOnCordonedNode: ~ + replicaZoneSoftAntiAffinity: ~ + nodeDownPodDeletionPolicy: ~ + allowNodeDrainWithLastHealthyReplica: ~ + mkfsExt4Parameters: ~ + disableReplicaRebuild: ~ + replicaReplenishmentWaitInterval: ~ + concurrentReplicaRebuildPerNodeLimit: ~ + disableRevisionCounter: ~ + systemManagedPodsImagePullPolicy: ~ + allowVolumeCreationWithDegradedAvailability: ~ + autoCleanupSystemGeneratedSnapshot: ~ + concurrentAutomaticEngineUpgradePerNodeLimit: ~ + backingImageCleanupWaitInterval: ~ + backingImageRecoveryWaitInterval: ~ + guaranteedEngineManagerCPU: ~ + guaranteedReplicaManagerCPU: ~ + kubernetesClusterAutoscalerEnabled: ~ + orphanAutoDeletion: ~ + storageNetwork: ~ + privateRegistry: + createSecret: ~ + registryUrl: ~ + registryUser: ~ + registryPasswd: ~ + registrySecret: ~ + + longhornManager: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornDriver: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornUI: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + # + + ingress: + ## Set to true to enable ingress record generation + enabled: false + + ## Add ingressClassName to the Ingress + ## Can replace the kubernetes.io/ingress.class annotation on v1.18+ + ingressClassName: nginx + + host: longhorn.internal.durp.info + + ## Set this to true in order to enable TLS on the ingress record + ## A side effect of this will be that the backend service will be connected at port 443 + tls: + - secretName: longhorn-tls + hosts: + - longhorn.internal.durp.info + + ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS + tlsSecret: longhorn-tls + + ## If ingress is enabled you can set the default ingress path + ## then you can access the UI by using the following full path {{host}}+{{path}} + path: / + + ## Ingress annotations done as key:value pairs + ## If you're using kube-lego, you will want to add: + ## kubernetes.io/tls-acme: true + ## + ## For a full list of possible ingress annotations, please see + ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md + ## + ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production + nginx.ingress.kubernetes.io/auth-url: |- + http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx + nginx.ingress.kubernetes.io/auth-signin: |- + https://longhorn.internal.durp.info/outpost.goauthentik.io/start?rd=$escaped_request_uri + nginx.ingress.kubernetes.io/auth-response-headers: |- + Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid + nginx.ingress.kubernetes.io/auth-snippet: | + proxy_set_header X-Forwarded-Host $http_host; + + secrets: + ## If you're providing your own certificates, please use this to add the certificates as secrets + ## key and certificate should start with -----BEGIN CERTIFICATE----- or + ## -----BEGIN RSA PRIVATE KEY----- + ## + ## name should line up with a tlsSecret set further up + ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set + ## + ## It is also possible to create and manage the certificates outside of this helm chart + ## Please see README.md for more information + # - name: longhorn.local-tls + # key: + # certificate: + + # Configure a pod security policy in the Longhorn namespace to allow privileged pods + enablePSP: true + + ## Specify override namespace, specifically this is useful for using longhorn as sub-chart + ## and its release namespace is not the `longhorn-system` + namespaceOverride: "" + + # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional. + annotations: {} + + serviceAccount: + # Annotations to add to the service account + annotations: {} + diff --git a/master/metallb-system/Chart.yaml b/master/metallb-system/Chart.yaml new file mode 100644 index 0000000..0f6506f --- /dev/null +++ b/master/metallb-system/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.14.8 + diff --git a/master/metallb-system/templates/config.yaml b/master/metallb-system/templates/config.yaml new file mode 100644 index 0000000..e44285d --- /dev/null +++ b/master/metallb-system/templates/config.yaml @@ -0,0 +1,17 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap +spec: + addresses: + - 192.168.20.130-192.168.20.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: poop + namespace: metallb-system +spec: + ipAddressPools: + - cheap + diff --git a/master/metallb-system/values.yaml b/master/metallb-system/values.yaml new file mode 100644 index 0000000..260551d --- /dev/null +++ b/master/metallb-system/values.yaml @@ -0,0 +1,197 @@ +metallb: + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + loadBalancerClass: "" + + rbac: + create: true + + prometheus: + scrapeAnnotations: false + metricsPort: 7472 + speakerMetricsTLSSecret: "" + controllerMetricsTLSSecret: "" + rbacPrometheus: true + serviceAccount: "" + namespace: "" + rbacProxy: + repository: gcr.io/kubebuilder/kube-rbac-proxy + tag: v0.12.0 + pullPolicy: + podMonitor: + enabled: false + additionalLabels: {} + annotations: {} + jobLabel: "app.kubernetes.io/name" + interval: + metricRelabelings: [] + relabelings: [] + serviceMonitor: + enabled: false + speaker: + additionalLabels: {} + annotations: {} + tlsConfig: + insecureSkipVerify: true + controller: + additionalLabels: {} + annotations: {} + tlsConfig: + insecureSkipVerify: true + jobLabel: "app.kubernetes.io/name" + interval: + metricRelabelings: [] + relabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + annotations: {} + staleConfig: + enabled: true + labels: + severity: warning + configNotLoaded: + enabled: true + labels: + severity: warning + addressPoolExhausted: + enabled: true + labels: + severity: alert + addressPoolUsage: + enabled: true + thresholds: + - percent: 75 + labels: + severity: warning + - percent: 85 + labels: + severity: warning + - percent: 95 + labels: + severity: alert + bgpSessionDown: + enabled: true + labels: + severity: alert + + extraAlerts: [] + + controller: + enabled: true + # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` + logLevel: info + image: + repository: quay.io/metallb/controller + tag: + pullPolicy: + strategy: + type: RollingUpdate + serviceAccount: + create: true + name: "" + annotations: {} + securityContext: + runAsNonRoot: true + runAsUser: 65534 + fsGroup: 65534 + resources: {} + nodeSelector: {} + tolerations: [] + priorityClassName: "" + runtimeClassName: "" + affinity: {} + podAnnotations: {} + labels: {} + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + tlsMinVersion: "VersionTLS12" + tlsCipherSuites: "" + + extraContainers: [] + + speaker: + enabled: true + logLevel: debug + tolerateMaster: true + memberlist: + enabled: true + mlBindPort: 7946 + mlBindAddrOverride: "" + mlSecretKeyPath: "/etc/ml_secret_key" + excludeInterfaces: + enabled: true + ignoreExcludeLB: false + + image: + repository: quay.io/metallb/speaker + tag: + pullPolicy: + updateStrategy: + type: RollingUpdate + serviceAccount: + create: true + name: "" + annotations: {} + securityContext: {} + resources: {} + nodeSelector: {} + tolerations: [] + priorityClassName: "" + affinity: {} + runtimeClassName: "" + podAnnotations: {} + labels: + pod-security.kubernetes.io/enforce: privileged + pod-security.kubernetes.io/audit: privileged + pod-security.kubernetes.io/warn: privileged + livenessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + enabled: true + failureThreshold: 3 + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + startupProbe: + enabled: true + failureThreshold: 30 + periodSeconds: 5 + frr: + enabled: true + image: + repository: quay.io/frrouting/frr + tag: 9.0.2 + pullPolicy: + metricsPort: 7473 + resources: {} + reloader: + resources: {} + frrMetrics: + resources: {} + extraContainers: [] + crds: + enabled: true + validationFailurePolicy: Fail + frrk8s: + enabled: false + diff --git a/master/nfs-client/Chart.yml b/master/nfs-client/Chart.yml new file mode 100644 index 0000000..217f2c1 --- /dev/null +++ b/master/nfs-client/Chart.yml @@ -0,0 +1,8 @@ +apiVersion: v2 +name: nfs-client +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + diff --git a/master/nfs-client/templates/cluster-role-binding.yml b/master/nfs-client/templates/cluster-role-binding.yml new file mode 100644 index 0000000..427d8c6 --- /dev/null +++ b/master/nfs-client/templates/cluster-role-binding.yml @@ -0,0 +1,12 @@ +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: run-nfs-client-provisioner +subjects: + - kind: ServiceAccount + name: nfs-client-provisioner + namespace: nfs-client +roleRef: + kind: ClusterRole + name: nfs-client-provisioner-runner + apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/cluster-role.yml b/master/nfs-client/templates/cluster-role.yml new file mode 100644 index 0000000..fa6ed20 --- /dev/null +++ b/master/nfs-client/templates/cluster-role.yml @@ -0,0 +1,20 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: nfs-client-provisioner-runner +rules: + - apiGroups: [""] + resources: ["persistentvolumes"] + verbs: ["get", "list", "watch", "create", "delete"] + - apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "watch", "update"] + - apiGroups: ["storage.k8s.io"] + resources: ["storageclasses"] + verbs: ["get", "list", "watch"] + - apiGroups: [""] + resources: ["events"] + verbs: ["create", "update", "patch"] + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/provisioner.yml b/master/nfs-client/templates/provisioner.yml new file mode 100644 index 0000000..c76fe8c --- /dev/null +++ b/master/nfs-client/templates/provisioner.yml @@ -0,0 +1,42 @@ +kind: Deployment +apiVersion: apps/v1 +metadata: + name: nfs-client-provisioner + namespace: nfs-client +spec: + selector: + matchLabels: + app: nfs-client-provisioner + replicas: 1 + strategy: + type: Recreate + template: + metadata: + labels: + app: nfs-client-provisioner + spec: + serviceAccountName: nfs-client-provisioner + containers: + - name: nfs-client-provisioner + image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0 + resources: + requests: + cpu: 500m + memory: 512Mi + limits: + memory: 1Gi + volumeMounts: + - name: nfs-client-ssd + mountPath: /persistentvolumes + env: + - name: PROVISIONER_NAME + value: durp.info/nfs + - name: NFS_SERVER + value: 192.168.20.253 + - name: NFS_PATH + value: /mnt/user/k3s + volumes: + - name: nfs-client-ssd + nfs: + server: 192.168.20.253 + path: /mnt/user/k3s diff --git a/master/nfs-client/templates/role-binding.yml b/master/nfs-client/templates/role-binding.yml new file mode 100644 index 0000000..fb0f085 --- /dev/null +++ b/master/nfs-client/templates/role-binding.yml @@ -0,0 +1,13 @@ +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-client-provisioner + namespace: nfs-client +subjects: + - kind: ServiceAccount + name: nfs-client-provisioner + namespace: nfs-client +roleRef: + kind: Role + name: leader-locking-nfs-client-provisioner + apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/role.yml b/master/nfs-client/templates/role.yml new file mode 100644 index 0000000..910346d --- /dev/null +++ b/master/nfs-client/templates/role.yml @@ -0,0 +1,9 @@ +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: leader-locking-nfs-client-provisioner + namespace: nfs-client +rules: + - apiGroups: [""] + resources: ["endpoints"] + verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/service-account.yml b/master/nfs-client/templates/service-account.yml new file mode 100644 index 0000000..ef9b4d7 --- /dev/null +++ b/master/nfs-client/templates/service-account.yml @@ -0,0 +1,5 @@ +kind: ServiceAccount +apiVersion: v1 +metadata: + name: nfs-client-provisioner + namespace: nfs-client diff --git a/master/nfs-client/templates/storage-class.yml b/master/nfs-client/templates/storage-class.yml new file mode 100644 index 0000000..b615fe1 --- /dev/null +++ b/master/nfs-client/templates/storage-class.yml @@ -0,0 +1,10 @@ +apiVersion: storage.k8s.io/v1 +kind: StorageClass +metadata: + name: nfs-storage + annotations: + storageclass.kubernetes.io/is-default-class: "false" +provisioner: durp.info/nfs +parameters: + archiveOnDelete: "false" +reclaimPolicy: Retain diff --git a/master/open-webui/Chart.yaml b/master/open-webui/Chart.yaml new file mode 100644 index 0000000..1561d60 --- /dev/null +++ b/master/open-webui/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: open-webui +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/master/open-webui/templates/deployment.yaml b/master/open-webui/templates/deployment.yaml new file mode 100644 index 0000000..7a51d0f --- /dev/null +++ b/master/open-webui/templates/deployment.yaml @@ -0,0 +1,37 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: open-webui + name: open-webui + labels: + app: open-webui +spec: + selector: + matchLabels: + app: open-webui + replicas: 1 + template: + metadata: + labels: + app: open-webui + spec: + containers: + - name: open-webui + image: registry.internal.durp.info/open-webui/open-webui:main + imagePullPolicy: Always + volumeMounts: + - name: open-webui-pvc + mountPath: /app/backend/data + ports: + - name: http + containerPort: 8080 + env: + - name: OLLAMA_BASE_URL + valueFrom: + secretKeyRef: + name: open-webui-secret + key: OLLAMA_BASE_URL + volumes: + - name: open-webui-pvc + persistentVolumeClaim: + claimName: open-webui-pvc diff --git a/master/open-webui/templates/ingress.yaml b/master/open-webui/templates/ingress.yaml new file mode 100644 index 0000000..6331e92 --- /dev/null +++ b/master/open-webui/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: open-webui-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: open-webui + port: 8080 + tls: + secretName: open-webui-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: open-webui-tls +spec: + secretName: open-webui-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "open-webui.durp.info" + dnsNames: + - "open-webui.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: open-webui-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/open-webui/templates/pvc.yaml b/master/open-webui/templates/pvc.yaml new file mode 100644 index 0000000..63a3280 --- /dev/null +++ b/master/open-webui/templates/pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: open-webui-pvc +spec: + storageClassName: longhorn + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi diff --git a/master/open-webui/templates/secrets.yaml b/master/open-webui/templates/secrets.yaml new file mode 100644 index 0000000..1fe6fec --- /dev/null +++ b/master/open-webui/templates/secrets.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: open-webui-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: open-webui-secret + data: + - secretKey: OLLAMA_BASE_URL + remoteRef: + key: secrets/open-webui + property: OLLAMA_BASE_URL + diff --git a/master/open-webui/templates/service.yaml b/master/open-webui/templates/service.yaml new file mode 100644 index 0000000..cd93455 --- /dev/null +++ b/master/open-webui/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: open-webui +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP + selector: + app: open-webui diff --git a/master/traefik/Chart.yaml b/master/traefik/Chart.yaml new file mode 100644 index 0000000..5378476 --- /dev/null +++ b/master/traefik/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: traefik +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: traefik + repository: https://traefik.github.io/charts + version: 24.0.0 diff --git a/master/traefik/templates/ingress.yaml b/master/traefik/templates/ingress.yaml new file mode 100644 index 0000000..a165566 --- /dev/null +++ b/master/traefik/templates/ingress.yaml @@ -0,0 +1,39 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: traefik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`traefik.internal.durp.info`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: api@internal + kind: TraefikService + - match: Host(`traefik.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: traefik-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: traefik-tls + namespace: traefik +spec: + secretName: traefik-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "traefik.internal.durp.info" + dnsNames: + - "traefik.internal.durp.info" \ No newline at end of file diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml new file mode 100644 index 0000000..6ed5f31 --- /dev/null +++ b/master/traefik/templates/middlewares.yaml @@ -0,0 +1,37 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: authentik-proxy-provider + namespace: traefik +spec: + forwardAuth: + address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: whitelist + namespace: traefik +spec: + ipWhiteList: + sourceRange: + - 192.168.20.0/24 + - 10.0.0.0/8 + - 192.168.30.0/24 + - 192.168.130.0/24 + - 192.168.131.0/24 diff --git a/master/traefik/values.yaml b/master/traefik/values.yaml new file mode 100644 index 0000000..de51762 --- /dev/null +++ b/master/traefik/values.yaml @@ -0,0 +1,887 @@ +traefik: + # Default values for Traefik + image: + registry: docker.io + repository: traefik + # defaults to appVersion + tag: "" + pullPolicy: Always + + # + # Configure integration with Traefik Hub + # + hub: + ## Enabling Hub will: + # * enable Traefik Hub integration on Traefik + # * add `traefikhub-tunl` endpoint + # * enable Prometheus metrics with addRoutersLabels + # * enable allowExternalNameServices on KubernetesIngress provider + # * enable allowCrossNamespace on KubernetesCRD provider + # * add an internal (ClusterIP) Service, dedicated for Traefik Hub + enabled: true + ## Default port can be changed + # tunnelPort: 9901 + ## TLS is optional. Insecure is mutually exclusive with any other options + # tls: + # insecure: false + # ca: "/path/to/ca.pem" + # cert: "/path/to/cert.pem" + # key: "/path/to/key.pem" + + # + # Configure the deployment + # + deployment: + enabled: true + # Can be either Deployment or DaemonSet + kind: Deployment + # Number of pods of the deployment (only applies when kind == Deployment) + replicas: 3 + # Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) + revisionHistoryLimit: 1 + # Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down + terminationGracePeriodSeconds: 60 + # The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available + minReadySeconds: 0 + # Additional deployment annotations (e.g. for jaeger-operator sidecar injection) + annotations: {} + # Additional deployment labels (e.g. for filtering deployment by custom labels) + labels: {} + # Additional pod annotations (e.g. for mesh injection or prometheus scraping) + podAnnotations: {} + # Additional Pod labels (e.g. for filtering Pod by custom labels) + podLabels: {} + # Additional containers (e.g. for metric offloading sidecars) + additionalContainers: [] + # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host + # - name: socat-proxy + # image: alpine/socat:1.0.5 + # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] + # volumeMounts: + # - name: dsdsocket + # mountPath: /socket + # Additional volumes available for use with initContainers and additionalContainers + additionalVolumes: [] + # - name: dsdsocket + # hostPath: + # path: /var/run/statsd-exporter + # Additional initContainers (e.g. for setting file permission as shown below) + initContainers: [] + # The "volume-permissions" init container is required if you run into permission issues. + # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396 + # - name: volume-permissions + # image: busybox:latest + # command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"] + # securityContext: + # runAsNonRoot: true + # runAsGroup: 65532 + # runAsUser: 65532 + # volumeMounts: + # - name: data + # mountPath: /data + # Use process namespace sharing + shareProcessNamespace: false + # Custom pod DNS policy. Apply if `hostNetwork: true` + # dnsPolicy: ClusterFirstWithHostNet + # Additional imagePullSecrets + imagePullSecrets: [] + # - name: myRegistryKeySecretName + # Pod lifecycle actions + lifecycle: {} + # preStop: + # exec: + # command: ["/bin/sh", "-c", "sleep 40"] + # postStart: + # httpGet: + # path: /ping + # port: 9000 + # host: localhost + # scheme: HTTP + + # Pod disruption budget + podDisruptionBudget: + enabled: false + # maxUnavailable: 1 + # maxUnavailable: 33% + # minAvailable: 0 + # minAvailable: 25% + + # Create a default IngressClass for Traefik + ingressClass: + enabled: true + isDefaultClass: false + + # Enable experimental features + experimental: + v3: + enabled: false + plugins: + enabled: true + kubernetesGateway: + enabled: false + gateway: + enabled: true + # certificate: + # group: "core" + # kind: "Secret" + # name: "mysecret" + # By default, Gateway would be created to the Namespace you are deploying Traefik to. + # You may create that Gateway in another namespace, setting its name below: + # namespace: default + # Additional gateway annotations (e.g. for cert-manager.io/issuer) + # annotations: + # cert-manager.io/issuer: letsencrypt + + # Create an IngressRoute for the dashboard + ingressRoute: + dashboard: + enabled: true + # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) + annotations: {} + # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) + labels: {} + # The router match rule used for the dashboard ingressRoute + matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`) + # Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure). + # By default, it's using traefik entrypoint, which is not exposed. + # /!\ Do not expose your dashboard without any protection over the internet /!\ + entryPoints: ["traefik"] + # Additional ingressRoute middlewares (e.g. for authentication) + middlewares: [] + # TLS options (e.g. secret containing certificate) + tls: {} + + # Customize updateStrategy of traefik pods + updateStrategy: + type: RollingUpdate + rollingUpdate: + maxUnavailable: 0 + maxSurge: 1 + + # Customize liveness and readiness probe values. + readinessProbe: + failureThreshold: 1 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 2 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 2 + + # + # Configure providers + # + providers: + kubernetesCRD: + enabled: true + allowCrossNamespace: true + allowExternalNameServices: false + allowEmptyServices: false + # ingressClass: traefik-internal + # labelSelector: environment=production,method=traefik + namespaces: [] + # - "default" + + kubernetesIngress: + enabled: true + allowExternalNameServices: false + allowEmptyServices: false + # ingressClass: traefik-internal + # labelSelector: environment=production,method=traefik + namespaces: [] + # - "default" + # IP used for Kubernetes Ingress endpoints + publishedService: + enabled: false + # Published Kubernetes Service to copy status from. Format: namespace/servicename + # By default this Traefik service + # pathOverride: "" + + # + # Add volumes to the traefik pod. The volume name will be passed to tpl. + # This can be used to mount a cert pair or a configmap that holds a config.toml file. + # After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: + # additionalArguments: + # - "--providers.file.filename=/config/dynamic.toml" + # - "--ping" + # - "--ping.entrypoint=web" + volumes: [] + # - name: public-cert + # mountPath: "/certs" + # type: secret + # - name: '{{ printf "%s-configs" .Release.Name }}' + # mountPath: "/config" + # type: configMap + + # Additional volumeMounts to add to the Traefik container + additionalVolumeMounts: [] + # For instance when using a logshipper for access logs + # - name: traefik-logs + # mountPath: /var/log/traefik + + ## Logs + ## https://docs.traefik.io/observability/logs/ + logs: + ## Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). + general: + # By default, the logs use a text format (common), but you can + # also ask for the json format in the format option + # format: json + # By default, the level is set to ERROR. + # Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. + level: ERROR + access: + # To enable access logs + enabled: false + ## By default, logs are written using the Common Log Format (CLF) on stdout. + ## To write logs in JSON, use json in the format option. + ## If the given format is unsupported, the default (CLF) is used instead. + # format: json + # filePath: "/var/log/traefik/access.log + ## To write the logs in an asynchronous fashion, specify a bufferingSize option. + ## This option represents the number of log lines Traefik will keep in memory before writing + ## them to the selected output. In some cases, this option can greatly help performances. + # bufferingSize: 100 + ## Filtering https://docs.traefik.io/observability/access-logs/#filtering + filters: {} + # statuscodes: "200,300-302" + # retryattempts: true + # minduration: 10ms + ## Fields + ## https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers + fields: + general: + defaultmode: keep + names: {} + ## Examples: + # ClientUsername: drop + headers: + defaultmode: drop + names: {} + ## Examples: + # User-Agent: redact + # Authorization: drop + # Content-Type: keep + + metrics: + ## Prometheus is enabled by default. + ## It can be disabled by setting "prometheus: null" + prometheus: + ## Entry point used to expose metrics. + entryPoint: metrics + ## Enable metrics on entry points. Default=true + # addEntryPointsLabels: false + ## Enable metrics on routers. Default=false + # addRoutersLabels: true + ## Enable metrics on services. Default=true + # addServicesLabels: false + ## Buckets for latency metrics. Default="0.1,0.3,1.2,5.0" + # buckets: "0.5,1.0,2.5" + ## When manualRouting is true, it disables the default internal router in + ## order to allow creating a custom router for prometheus@internal service. + # manualRouting: true + # datadog: + # ## Address instructs exporter to send metrics to datadog-agent at this address. + # address: "127.0.0.1:8125" + # ## The interval used by the exporter to push metrics to datadog-agent. Default=10s + # # pushInterval: 30s + # ## The prefix to use for metrics collection. Default="traefik" + # # prefix: traefik + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # influxdb: + # ## Address instructs exporter to send metrics to influxdb at this address. + # address: localhost:8089 + # ## InfluxDB's address protocol (udp or http). Default="udp" + # protocol: udp + # ## InfluxDB database used when protocol is http. Default="" + # # database: "" + # ## InfluxDB retention policy used when protocol is http. Default="" + # # retentionPolicy: "" + # ## InfluxDB username (only with http). Default="" + # # username: "" + # ## InfluxDB password (only with http). Default="" + # # password: "" + # ## The interval used by the exporter to push metrics to influxdb. Default=10s + # # pushInterval: 30s + # ## Additional labels (influxdb tags) on all metrics. + # # additionalLabels: + # # env: production + # # foo: bar + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # influxdb2: + # ## Address instructs exporter to send metrics to influxdb v2 at this address. + # address: localhost:8086 + # ## Token with which to connect to InfluxDB v2. + # token: xxx + # ## Organisation where metrics will be stored. + # org: "" + # ## Bucket where metrics will be stored. + # bucket: "" + # ## The interval used by the exporter to push metrics to influxdb. Default=10s + # # pushInterval: 30s + # ## Additional labels (influxdb tags) on all metrics. + # # additionalLabels: + # # env: production + # # foo: bar + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # statsd: + # ## Address instructs exporter to send metrics to statsd at this address. + # address: localhost:8125 + # ## The interval used by the exporter to push metrics to influxdb. Default=10s + # # pushInterval: 30s + # ## The prefix to use for metrics collection. Default="traefik" + # # prefix: traefik + # ## Enable metrics on entry points. Default=true + # # addEntryPointsLabels: false + # ## Enable metrics on routers. Default=false + # # addRoutersLabels: true + # ## Enable metrics on services. Default=true + # # addServicesLabels: false + # openTelemetry: + # ## Address of the OpenTelemetry Collector to send metrics to. + # address: "localhost:4318" + # ## Enable metrics on entry points. + # addEntryPointsLabels: true + # ## Enable metrics on routers. + # addRoutersLabels: true + # ## Enable metrics on services. + # addServicesLabels: true + # ## Explicit boundaries for Histogram data points. + # explicitBoundaries: + # - "0.1" + # - "0.3" + # - "1.2" + # - "5.0" + # ## Additional headers sent with metrics by the reporter to the OpenTelemetry Collector. + # headers: + # foo: bar + # test: test + # ## Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol. + # insecure: true + # ## Interval at which metrics are sent to the OpenTelemetry Collector. + # pushInterval: 10s + # ## Allows to override the default URL path used for sending metrics. This option has no effect when using gRPC transport. + # path: /foo/v1/traces + # ## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector. + # tls: + # ## The path to the certificate authority, it defaults to the system bundle. + # ca: path/to/ca.crt + # ## The path to the public certificate. When using this option, setting the key option is required. + # cert: path/to/foo.cert + # ## The path to the private key. When using this option, setting the cert option is required. + # key: path/to/key.key + # ## If set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers. + # insecureSkipVerify: true + # ## This instructs the reporter to send metrics to the OpenTelemetry Collector using gRPC. + # grpc: true + + ## + ## enable optional CRDs for Prometheus Operator + ## + ## Create a dedicated metrics service for use with ServiceMonitor + ## When hub.enabled is set to true, it's not needed: it will use hub service. + # service: + # enabled: false + # labels: {} + # annotations: {} + ## When set to true, it won't check if Prometheus Operator CRDs are deployed + # disableAPICheck: false + # serviceMonitor: + # metricRelabelings: [] + # - sourceLabels: [__name__] + # separator: ; + # regex: ^fluentd_output_status_buffer_(oldest|newest)_.+ + # replacement: $1 + # action: drop + # relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # targetLabel: nodename + # replacement: $1 + # action: replace + # jobLabel: traefik + # interval: 30s + # honorLabels: true + # # (Optional) + # # scrapeTimeout: 5s + # # honorTimestamps: true + # # enableHttp2: true + # # followRedirects: true + # # additionalLabels: + # # foo: bar + # # namespace: "another-namespace" + # # namespaceSelector: {} + # prometheusRule: + # additionalLabels: {} + # namespace: "another-namespace" + # rules: + # - alert: TraefikDown + # expr: up{job="traefik"} == 0 + # for: 5m + # labels: + # context: traefik + # severity: warning + # annotations: + # summary: "Traefik Down" + # description: "{{ $labels.pod }} on {{ $labels.nodename }} is down" + + tracing: {} + # instana: + # localAgentHost: 127.0.0.1 + # localAgentPort: 42699 + # logLevel: info + # enableAutoProfile: true + # datadog: + # localAgentHostPort: 127.0.0.1:8126 + # debug: false + # globalTag: "" + # prioritySampling: false + # jaeger: + # samplingServerURL: http://localhost:5778/sampling + # samplingType: const + # samplingParam: 1.0 + # localAgentHostPort: 127.0.0.1:6831 + # gen128Bit: false + # propagation: jaeger + # traceContextHeaderName: uber-trace-id + # disableAttemptReconnecting: true + # collector: + # endpoint: "" + # user: "" + # password: "" + # zipkin: + # httpEndpoint: http://localhost:9411/api/v2/spans + # sameSpan: false + # id128Bit: true + # sampleRate: 1.0 + # haystack: + # localAgentHost: 127.0.0.1 + # localAgentPort: 35000 + # globalTag: "" + # traceIDHeaderName: "" + # parentIDHeaderName: "" + # spanIDHeaderName: "" + # baggagePrefixHeaderName: "" + # elastic: + # serverURL: http://localhost:8200 + # secretToken: "" + # serviceEnvironment: "" + + globalArguments: + - "--global.checknewversion=false" + - "--global.sendanonymoususage=false" + + # + # Configure Traefik static configuration + # Additional arguments to be passed at Traefik's binary + # All available options available on https://docs.traefik.io/reference/static-configuration/cli/ + ## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` + additionalArguments: + - "--serversTransport.insecureSkipVerify=true" + - "--log.level=DEBUG" + - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin + - --experimental.plugins.jwt.version=v0.7.0 + + + # Environment variables to be passed to Traefik's binary + env: [] + # - name: SOME_VAR + # value: some-var-value + # - name: SOME_VAR_FROM_CONFIG_MAP + # valueFrom: + # configMapRef: + # name: configmap-name + # key: config-key + # - name: SOME_SECRET + # valueFrom: + # secretKeyRef: + # name: secret-name + # key: secret-key + + envFrom: [] + # - configMapRef: + # name: config-map-name + # - secretRef: + # name: secret-name + + # Configure ports + ports: + # The name of this one can't be changed as it is used for the readiness and + # liveness probes, but you can adjust its config to your liking + traefik: + port: 9000 + # Use hostPort if set. + # hostPort: 9000 + # + # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which + # means it's listening on all your interfaces and all your IPs. You may want + # to set this value if you need traefik to listen on specific interface + # only. + # hostIP: 192.168.100.10 + + # Override the liveness/readiness port. This is useful to integrate traefik + # with an external Load Balancer that performs healthchecks. + # Default: ports.traefik.port + # healthchecksPort: 9000 + + # Override the liveness/readiness scheme. Useful for getting ping to + # respond on websecure entryPoint. + # healthchecksScheme: HTTPS + + # Defines whether the port is exposed if service.type is LoadBalancer or + # NodePort. + # + # You SHOULD NOT expose the traefik port on production deployments. + # If you want to access it from outside of your cluster, + # use `kubectl port-forward` or create a secure ingress + expose: false + # The exposed port for this service + exposedPort: 9000 + # The port protocol (TCP/UDP) + protocol: TCP + web: + ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. + # asDefault: true + port: 8000 + # hostPort: 8000 + expose: true + exposedPort: 80 + # The port protocol (TCP/UDP) + protocol: TCP + # Use nodeport if set. This is useful if you have configured Traefik in a + # LoadBalancer. + # nodePort: 32080 + # Port Redirections + # Added in 2.2, you can make permanent redirects via entrypoints. + # https://docs.traefik.io/routing/entrypoints/#redirection + redirectTo: websecure + # + # Trust forwarded headers information (X-Forwarded-*). + # forwardedHeaders: + # trustedIPs: [] + # insecure: false + # + # Enable the Proxy Protocol header parsing for the entry point + # proxyProtocol: + # trustedIPs: [] + # insecure: false + websecure: + ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. + # asDefault: true + port: 8443 + # hostPort: 8443 + expose: true + exposedPort: 443 + ## The port protocol (TCP/UDP) + protocol: TCP + # nodePort: 32443 + # + ## Enable HTTP/3 on the entrypoint + ## Enabling it will also enable http3 experimental feature + ## https://doc.traefik.io/traefik/routing/entrypoints/#http3 + ## There are known limitations when trying to listen on same ports for + ## TCP & UDP (Http3). There is a workaround in this chart using dual Service. + ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741 + http3: + enabled: false + # advertisedPort: 4443 + # + ## Trust forwarded headers information (X-Forwarded-*). + #forwardedHeaders: + # trustedIPs: [] + # insecure: false + # + ## Enable the Proxy Protocol header parsing for the entry point + #proxyProtocol: + # trustedIPs: [] + # insecure: false + # + ## Set TLS at the entrypoint + ## https://doc.traefik.io/traefik/routing/entrypoints/#tls + tls: + enabled: true + # this is the name of a TLSOption definition + options: "" + certResolver: "" + domains: [] + # - main: example.com + # sans: + # - foo.example.com + # - bar.example.com + # + # One can apply Middlewares on an entrypoint + # https://doc.traefik.io/traefik/middlewares/overview/ + # https://doc.traefik.io/traefik/routing/entrypoints/#middlewares + # /!\ It introduces here a link between your static configuration and your dynamic configuration /!\ + # It follows the provider naming convention: https://doc.traefik.io/traefik/providers/overview/#provider-namespace + # middlewares: + # - namespace-name1@kubernetescrd + # - namespace-name2@kubernetescrd + middlewares: [] + metrics: + # When using hostNetwork, use another port to avoid conflict with node exporter: + # https://github.com/prometheus/prometheus/wiki/Default-port-allocations + port: 9100 + # hostPort: 9100 + # Defines whether the port is exposed if service.type is LoadBalancer or + # NodePort. + # + # You may not want to expose the metrics port on production deployments. + # If you want to access it from outside of your cluster, + # use `kubectl port-forward` or create a secure ingress + expose: false + # The exposed port for this service + exposedPort: 9100 + # The port protocol (TCP/UDP) + protocol: TCP + + # TLS Options are created as TLSOption CRDs + # https://doc.traefik.io/traefik/https/tls/#tls-options + # When using `labelSelector`, you'll need to set labels on tlsOption accordingly. + # Example: + # tlsOptions: + # default: + # labels: {} + # sniStrict: true + # preferServerCipherSuites: true + # customOptions: + # labels: {} + # curvePreferences: + # - CurveP521 + # - CurveP384 + tlsOptions: {} + + # TLS Store are created as TLSStore CRDs. This is useful if you want to set a default certificate + # https://doc.traefik.io/traefik/https/tls/#default-certificate + # Example: + # tlsStore: + # default: + # defaultCertificate: + # secretName: tls-cert + tlsStore: {} + + # Options for the main traefik service, where the entrypoints traffic comes + # from. + service: + enabled: true + ## Single service is using `MixedProtocolLBService` feature gate. + ## When set to false, it will create two Service, one for TCP and one for UDP. + single: true + type: LoadBalancer + # Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config) + annotations: {} + # Additional annotations for TCP service only + annotationsTCP: {} + # Additional annotations for UDP service only + annotationsUDP: {} + # Additional service labels (e.g. for filtering Service by custom labels) + labels: {} + # Additional entries here will be added to the service spec. + # Cannot contain type, selector or ports entries. + spec: + externalTrafficPolicy: Local + # loadBalancerIP: "1.2.3.4" + # clusterIP: "2.3.4.5" + loadBalancerSourceRanges: [] + # - 192.168.0.1/32 + # - 172.16.0.0/16 + externalIPs: [] + # - 1.2.3.4 + ## One of SingleStack, PreferDualStack, or RequireDualStack. + # ipFamilyPolicy: SingleStack + ## List of IP families (e.g. IPv4 and/or IPv6). + ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + # ipFamilies: + # - IPv4 + # - IPv6 + ## + ## An additionnal and optional internal Service. + ## Same parameters as external Service + # internal: + # type: ClusterIP + # # labels: {} + # # annotations: {} + # # spec: {} + # # loadBalancerSourceRanges: [] + # # externalIPs: [] + # # ipFamilies: [ "IPv4","IPv6" ] + + ## Create HorizontalPodAutoscaler object. + ## + autoscaling: + enabled: true + minReplicas: 3 + maxReplicas: 10 + metrics: + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: 80 + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 60 + + # Enable persistence using Persistent Volume Claims + # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + # It can be used to store TLS certificates, see `storage` in certResolvers + persistence: + enabled: false + name: data + # existingClaim: "" + accessMode: ReadWriteOnce + size: 128Mi + # storageClass: "" + # volumeName: "" + path: /data + annotations: {} + # subPath: "" # only mount a subpath of the Volume into the pod + + certResolvers: {} + # letsencrypt: + # # for challenge options cf. https://doc.traefik.io/traefik/https/acme/ + # email: email@example.com + # dnsChallenge: + # # also add the provider's required configuration under env + # # or expand then from secrets/configmaps with envfrom + # # cf. https://doc.traefik.io/traefik/https/acme/#providers + # provider: digitalocean + # # add futher options for the dns challenge as needed + # # cf. https://doc.traefik.io/traefik/https/acme/#dnschallenge + # delayBeforeCheck: 30 + # resolvers: + # - 1.1.1.1 + # - 8.8.8.8 + # tlsChallenge: true + # httpChallenge: + # entryPoint: "web" + # # It has to match the path with a persistent volume + # storage: /data/acme.json + + # If hostNetwork is true, runs traefik in the host network namespace + # To prevent unschedulabel pods due to port collisions, if hostNetwork=true + # and replicas>1, a pod anti-affinity is recommended and will be set if the + # affinity is left as default. + hostNetwork: false + + # Whether Role Based Access Control objects like roles and rolebindings should be created + rbac: + enabled: true + # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. + # If set to true, installs Role and RoleBinding. Providers will only watch target namespace. + namespaced: false + # Enable user-facing roles + # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles + # aggregateTo: [ "admin" ] + + # Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding + podSecurityPolicy: + enabled: false + + # The service account the pods will use to interact with the Kubernetes API + serviceAccount: + # If set, an existing service account is used + # If not set, a service account is created automatically using the fullname template + name: "" + + # Additional serviceAccount annotations (e.g. for oidc authentication) + serviceAccountAnnotations: {} + + resources: + requests: + cpu: "100m" + memory: "128Mi" + limits: + cpu: "300m" + memory: "256Mi" + + # This example pod anti-affinity forces the scheduler to put traefik pods + # on nodes where no other traefik pods are scheduled. + # It should be used when hostNetwork: true to prevent port conflicts + affinity: {} + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchLabels: + # app.kubernetes.io/name: '{{ template "traefik.name" . }}' + # app.kubernetes.io/instance: '{{ .Release.Name }}-{{ .Release.Namespace }}' + # topologyKey: kubernetes.io/hostname + + nodeSelector: {} + tolerations: [] + topologySpreadConstraints: [] + # # This example topologySpreadConstraints forces the scheduler to put traefik pods + # # on nodes where no other traefik pods are scheduled. + # - labelSelector: + # matchLabels: + # app: '{{ template "traefik.name" . }}' + # maxSkew: 1 + # topologyKey: kubernetes.io/hostname + # whenUnsatisfiable: DoNotSchedule + + # Pods can have priority. + # Priority indicates the importance of a Pod relative to other Pods. + priorityClassName: "" + + # Set the container security context + # To run the container with ports below 1024 this will need to be adjust to run as root + securityContext: + capabilities: + drop: [ALL] + readOnlyRootFilesystem: true + + podSecurityContext: + # # /!\ When setting fsGroup, Kubernetes will recursively changes ownership and + # # permissions for the contents of each volume to match the fsGroup. This can + # # be an issue when storing sensitive content like TLS Certificates /!\ + # fsGroup: 65532 + fsGroupChangePolicy: "OnRootMismatch" + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + + # + # Extra objects to deploy (value evaluated as a template) + # + # In some cases, it can avoid the need for additional, extended or adhoc deployments. + # See #595 for more details and traefik/tests/values/extra.yaml for example. + extraObjects: [] + + # This will override the default Release Namespace for Helm. + # It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules` + # namespaceOverride: traefik + # + ## This will override the default app.kubernetes.io/instance label for all Objects. + # instanceLabelOverride: traefik diff --git a/master/uptimekuma/Chart.yaml b/master/uptimekuma/Chart.yaml new file mode 100644 index 0000000..0dcf730 --- /dev/null +++ b/master/uptimekuma/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: uptimekuma +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/master/uptimekuma/templates/deployment.yaml b/master/uptimekuma/templates/deployment.yaml new file mode 100644 index 0000000..21ce3c0 --- /dev/null +++ b/master/uptimekuma/templates/deployment.yaml @@ -0,0 +1,42 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + component: uptime-kuma + name: deployment +spec: + selector: + matchLabels: + component: uptime-kuma + replicas: 1 + strategy: + type: Recreate + + template: + metadata: + labels: + component: uptime-kuma + spec: + containers: + - name: app + image: registry.internal.durp.info/louislam/uptime-kuma:1 + ports: + - containerPort: 3001 + volumeMounts: + - mountPath: /app/data + name: storage + #livenessProbe: + #exec: + #command: + #- node + #- extra/healthcheck.js + readinessProbe: + httpGet: + path: / + port: 3001 + scheme: HTTP + + volumes: + - name: storage + persistentVolumeClaim: + claimName: uptimekuma-pvc diff --git a/master/uptimekuma/templates/ingress.yaml b/master/uptimekuma/templates/ingress.yaml new file mode 100644 index 0000000..3df2689 --- /dev/null +++ b/master/uptimekuma/templates/ingress.yaml @@ -0,0 +1,45 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kuma-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kuma.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: service + port: 3001 + tls: + secretName: kuma-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kuma-tls +spec: + secretName: kuma-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kuma.durp.info" + dnsNames: + - "kuma.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: heimdall-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kuma.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/master/uptimekuma/templates/kuma-pv.yaml b/master/uptimekuma/templates/kuma-pv.yaml new file mode 100644 index 0000000..e17e5a7 --- /dev/null +++ b/master/uptimekuma/templates/kuma-pv.yaml @@ -0,0 +1,25 @@ +#apiVersion: v1 +#kind: PersistentVolume +#metadata: +# annotations: +# pv.kubernetes.io/provisioned-by: durp.info/nfs +# finalizers: +# - kubernetes.io/pv-protection +# name: uptimekuma-pv +#spec: +# accessModes: +# - ReadWriteMany +# capacity: +# storage: 10Gi +# claimRef: +# apiVersion: v1 +# kind: PersistentVolumeClaim +# name: uptimekuma-pvc +# namespace: uptimekuma +# nfs: +# path: /mnt/user/k3s/uptimekuma +# server: 192.168.20.253 +# persistentVolumeReclaimPolicy: Retain +# storageClassName: nfs-storage +# volumeMode: Filesystem +# \ No newline at end of file diff --git a/master/uptimekuma/templates/kuma-pvc.yaml b/master/uptimekuma/templates/kuma-pvc.yaml new file mode 100644 index 0000000..ab76bf0 --- /dev/null +++ b/master/uptimekuma/templates/kuma-pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: uptimekuma-pvc + namespace: uptimekuma +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi + storageClassName: longhorn \ No newline at end of file diff --git a/master/uptimekuma/templates/service.yaml b/master/uptimekuma/templates/service.yaml new file mode 100644 index 0000000..cad08e7 --- /dev/null +++ b/master/uptimekuma/templates/service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: service +spec: + selector: + component: uptime-kuma + type: ClusterIP + ports: + - name: http + port: 3001 + targetPort: 3001 + protocol: TCP \ No newline at end of file diff --git a/master/vault/Chart.yaml b/master/vault/Chart.yaml new file mode 100644 index 0000000..1ad2d4a --- /dev/null +++ b/master/vault/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: vault +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: vault + repository: https://helm.releases.hashicorp.com + version: 0.28.1 + diff --git a/master/vault/templates/ingress.yaml b/master/vault/templates/ingress.yaml new file mode 100644 index 0000000..8998087 --- /dev/null +++ b/master/vault/templates/ingress.yaml @@ -0,0 +1,37 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: vault-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`vault.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: vault + port: 8200 + scheme: http + tls: + secretName: vault-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: vault-tls +spec: + secretName: vault-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "vault.internal.durp.info" + dnsNames: + - "vault.internal.durp.info" + diff --git a/master/vault/templates/secret-store.yaml b/master/vault/templates/secret-store.yaml new file mode 100644 index 0000000..e7cca3a --- /dev/null +++ b/master/vault/templates/secret-store.yaml @@ -0,0 +1,14 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: vault +spec: + provider: + vault: + server: "http://vault.vault.svc.cluster.local:8200" + path: "secrets" + version: "v2" + auth: + kubernetes: + mountPath: "kubernetes" + role: "external-secrets" diff --git a/master/vault/values.yaml b/master/vault/values.yaml new file mode 100644 index 0000000..b7c6d88 --- /dev/null +++ b/master/vault/values.yaml @@ -0,0 +1,65 @@ +vault: + + global: + + image: + repository: "registry.internal.durp.info/hashicorp/vault-k8s" + tag: "1.4.2" + pullPolicy: Always + + agentImage: + repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" + + injector: + enabled: "-" + + replicas: 3 + leaderElector: + enabled: true + + metrics: + enabled: true + + image: + repository: "registry.internal.durp.info/hashicorp/vault-k8s" + tag: "1.4.2" + pullPolicy: Always + + agentImage: + repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" + + server: + enabled: "-" + image: + repository: "registry.internal.durp.info/hashicorp/vault" + tag: "1.17.6" + pullPolicy: Always + ha: + enabled: false + replicas: 3 + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 256Mi + cpu: 250m + + dataStorage: + enabled: true + size: 10Gi + storageClass: longhorn + accessMode: ReadWriteOnce + auditStorage: + enabled: false + size: 10Gi + mountPath: "/vault/audit" + storageClass: longhorn + accessMode: ReadWriteOnce + ui: + enabled: false + externalPort: 8200 + targetPort: 8200 + From a42b3e785d11d22943b3aac2ea99bf75ea3b1b8e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 6 Jan 2025 05:14:52 -0600 Subject: [PATCH 0219/1058] Update folder location --- master/argocd/templates/InternalProxy.yaml | 2 +- master/argocd/templates/argocd.yaml | 2 +- master/argocd/templates/authentik.yaml | 2 +- master/argocd/templates/bitwarden.yaml | 2 +- master/argocd/templates/cert-manager.yaml | 2 +- master/argocd/templates/crossplane.yml | 2 +- master/argocd/templates/durpapi.yaml | 2 +- master/argocd/templates/durpot.yaml | 2 +- master/argocd/templates/external-dns.yaml | 2 +- master/argocd/templates/external-secrets.yaml | 2 +- master/argocd/templates/gatekeeper.yaml | 2 +- master/argocd/templates/gitlab-runner.yaml | 2 +- master/argocd/templates/heimdall.yaml | 2 +- master/argocd/templates/krakend.yaml | 2 +- master/argocd/templates/kube-prometheus-stack.yaml | 2 +- master/argocd/templates/kubeclarity.yaml | 2 +- master/argocd/templates/littlelink.yaml | 2 +- master/argocd/templates/longhorn.yaml | 2 +- master/argocd/templates/metallb-system.yaml | 2 +- master/argocd/templates/nfs-client.yaml | 2 +- master/argocd/templates/open-webui.yaml | 2 +- master/argocd/templates/traefik.yaml | 2 +- master/argocd/templates/uptimekuma.yaml | 2 +- master/argocd/templates/vault.yaml | 4 ++-- 24 files changed, 25 insertions(+), 25 deletions(-) diff --git a/master/argocd/templates/InternalProxy.yaml b/master/argocd/templates/InternalProxy.yaml index 1769a19..ca9bcc0 100644 --- a/master/argocd/templates/InternalProxy.yaml +++ b/master/argocd/templates/InternalProxy.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: internalproxy + path: master/internalproxy directory: recurse: true destination: diff --git a/master/argocd/templates/argocd.yaml b/master/argocd/templates/argocd.yaml index 417915e..e93aa4f 100644 --- a/master/argocd/templates/argocd.yaml +++ b/master/argocd/templates/argocd.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: argocd + path: master/argocd destination: namespace: argocd name: in-cluster diff --git a/master/argocd/templates/authentik.yaml b/master/argocd/templates/authentik.yaml index 735fa1a..5abfb3b 100644 --- a/master/argocd/templates/authentik.yaml +++ b/master/argocd/templates/authentik.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: authentik + path: master/authentik destination: namespace: authentik name: in-cluster diff --git a/master/argocd/templates/bitwarden.yaml b/master/argocd/templates/bitwarden.yaml index 6aad52f..ed56924 100644 --- a/master/argocd/templates/bitwarden.yaml +++ b/master/argocd/templates/bitwarden.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: bitwarden + path: master/bitwarden directory: recurse: true destination: diff --git a/master/argocd/templates/cert-manager.yaml b/master/argocd/templates/cert-manager.yaml index 1eb8fe2..fc11c13 100644 --- a/master/argocd/templates/cert-manager.yaml +++ b/master/argocd/templates/cert-manager.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: cert-manager + path: master/cert-manager destination: namespace: cert-manager name: in-cluster diff --git a/master/argocd/templates/crossplane.yml b/master/argocd/templates/crossplane.yml index e079c78..91473eb 100644 --- a/master/argocd/templates/crossplane.yml +++ b/master/argocd/templates/crossplane.yml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: crossplane + path: master/crossplane destination: namespace: crossplane name: in-cluster diff --git a/master/argocd/templates/durpapi.yaml b/master/argocd/templates/durpapi.yaml index 53c2db6..aeefcc1 100644 --- a/master/argocd/templates/durpapi.yaml +++ b/master/argocd/templates/durpapi.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: durpapi + path: master/durpapi destination: namespace: durpapi name: in-cluster diff --git a/master/argocd/templates/durpot.yaml b/master/argocd/templates/durpot.yaml index 1bfcd37..7a97eb4 100644 --- a/master/argocd/templates/durpot.yaml +++ b/master/argocd/templates/durpot.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: durpot + path: master/durpot destination: namespace: durpot name: in-cluster diff --git a/master/argocd/templates/external-dns.yaml b/master/argocd/templates/external-dns.yaml index ba05f2c..5cf21a5 100644 --- a/master/argocd/templates/external-dns.yaml +++ b/master/argocd/templates/external-dns.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: external-dns + path: master/external-dns destination: namespace: external-dns name: in-cluster diff --git a/master/argocd/templates/external-secrets.yaml b/master/argocd/templates/external-secrets.yaml index cf8a595..04f8f1d 100644 --- a/master/argocd/templates/external-secrets.yaml +++ b/master/argocd/templates/external-secrets.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: external-secrets + path: master/external-secrets destination: namespace: external-secrets name: in-cluster diff --git a/master/argocd/templates/gatekeeper.yaml b/master/argocd/templates/gatekeeper.yaml index 5c60c12..d9a0265 100644 --- a/master/argocd/templates/gatekeeper.yaml +++ b/master/argocd/templates/gatekeeper.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: gatekeeper + path: master/gatekeeper destination: namespace: gatekeeper name: in-cluster diff --git a/master/argocd/templates/gitlab-runner.yaml b/master/argocd/templates/gitlab-runner.yaml index c5539d7..13f4ebd 100644 --- a/master/argocd/templates/gitlab-runner.yaml +++ b/master/argocd/templates/gitlab-runner.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: gitlab-runner + path: master/gitlab-runner destination: namespace: gitlab-runner name: in-cluster diff --git a/master/argocd/templates/heimdall.yaml b/master/argocd/templates/heimdall.yaml index d695e34..333a761 100644 --- a/master/argocd/templates/heimdall.yaml +++ b/master/argocd/templates/heimdall.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: heimdall + path: master/heimdall destination: namespace: heimdall name: in-cluster diff --git a/master/argocd/templates/krakend.yaml b/master/argocd/templates/krakend.yaml index 68a57d1..e5ed113 100644 --- a/master/argocd/templates/krakend.yaml +++ b/master/argocd/templates/krakend.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: krakend + path: master/krakend destination: namespace: krakend name: in-cluster diff --git a/master/argocd/templates/kube-prometheus-stack.yaml b/master/argocd/templates/kube-prometheus-stack.yaml index 02f8261..ab57dfa 100644 --- a/master/argocd/templates/kube-prometheus-stack.yaml +++ b/master/argocd/templates/kube-prometheus-stack.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: kube-prometheus-stack + path: master/kube-prometheus-stack destination: namespace: kube-prometheus-stack name: in-cluster diff --git a/master/argocd/templates/kubeclarity.yaml b/master/argocd/templates/kubeclarity.yaml index c812528..f2db3c0 100644 --- a/master/argocd/templates/kubeclarity.yaml +++ b/master/argocd/templates/kubeclarity.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: kubeclarity + path: master/kubeclarity destination: namespace: kubeclarity name: in-cluster diff --git a/master/argocd/templates/littlelink.yaml b/master/argocd/templates/littlelink.yaml index 99b08fe..856ac87 100644 --- a/master/argocd/templates/littlelink.yaml +++ b/master/argocd/templates/littlelink.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: littlelink + path: master/littlelink directory: recurse: true destination: diff --git a/master/argocd/templates/longhorn.yaml b/master/argocd/templates/longhorn.yaml index 017da6f..1e857c5 100644 --- a/master/argocd/templates/longhorn.yaml +++ b/master/argocd/templates/longhorn.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: longhorn + path: master/longhorn destination: namespace: longhorn-system name: in-cluster diff --git a/master/argocd/templates/metallb-system.yaml b/master/argocd/templates/metallb-system.yaml index 051be57..d343453 100644 --- a/master/argocd/templates/metallb-system.yaml +++ b/master/argocd/templates/metallb-system.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: metallb-system + path: master/metallb-system destination: namespace: metallb-system name: in-cluster diff --git a/master/argocd/templates/nfs-client.yaml b/master/argocd/templates/nfs-client.yaml index e374885..a299095 100644 --- a/master/argocd/templates/nfs-client.yaml +++ b/master/argocd/templates/nfs-client.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: nfs-client + path: master/nfs-client directory: recurse: true destination: diff --git a/master/argocd/templates/open-webui.yaml b/master/argocd/templates/open-webui.yaml index a2b25fa..beb59a6 100644 --- a/master/argocd/templates/open-webui.yaml +++ b/master/argocd/templates/open-webui.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: open-webui + path: master/open-webui destination: namespace: open-webui name: in-cluster diff --git a/master/argocd/templates/traefik.yaml b/master/argocd/templates/traefik.yaml index 3995a9f..e336d57 100644 --- a/master/argocd/templates/traefik.yaml +++ b/master/argocd/templates/traefik.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: traefik + path: master/traefik destination: namespace: traefik name: in-cluster diff --git a/master/argocd/templates/uptimekuma.yaml b/master/argocd/templates/uptimekuma.yaml index ff0e1af..1d2c5e6 100644 --- a/master/argocd/templates/uptimekuma.yaml +++ b/master/argocd/templates/uptimekuma.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: uptimekuma + path: master/uptimekuma directory: recurse: true destination: diff --git a/master/argocd/templates/vault.yaml b/master/argocd/templates/vault.yaml index 6e243c5..7a5e227 100644 --- a/master/argocd/templates/vault.yaml +++ b/master/argocd/templates/vault.yaml @@ -8,7 +8,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: vault + path: master/vault destination: namespace: vault name: in-cluster @@ -16,7 +16,7 @@ spec: automated: prune: true selfHeal: true - syncOptions: + syncOptions: Gc - CreateNamespace=true ignoreDifferences: - group: admissionregistration.k8s.io From 99006a890021abfbd5fcaad689a2676e4f51f18b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 6 Jan 2025 05:18:54 -0600 Subject: [PATCH 0220/1058] Update folder location --- argocd/templates/vault.yaml | 2 +- master/argocd/templates/vault.yaml | 14 +++++++------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/argocd/templates/vault.yaml b/argocd/templates/vault.yaml index 7a5e227..6f4cf72 100644 --- a/argocd/templates/vault.yaml +++ b/argocd/templates/vault.yaml @@ -16,7 +16,7 @@ spec: automated: prune: true selfHeal: true - syncOptions: Gc + syncOptions: - CreateNamespace=true ignoreDifferences: - group: admissionregistration.k8s.io diff --git a/master/argocd/templates/vault.yaml b/master/argocd/templates/vault.yaml index 7a5e227..6f21f08 100644 --- a/master/argocd/templates/vault.yaml +++ b/master/argocd/templates/vault.yaml @@ -15,11 +15,11 @@ spec: syncPolicy: automated: prune: true - selfHeal: true - syncOptions: Gc - - CreateNamespace=true + selfHeal: true + syncOptions: + - CreateNamespace=true ignoreDifferences: - - group: admissionregistration.k8s.io - kind: MutatingWebhookConfiguration - jqPathExpressions: - - .webhooks[]?.clientConfig.caBundle + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle From 33c5d2527138d4aeed94b4f2f6914258b99474ae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 7 Jan 2025 04:45:49 -0600 Subject: [PATCH 0221/1058] remove top level files --- argocd/Chart.yaml | 14 - argocd/templates/InternalProxy.yaml | 23 - argocd/templates/argocd.yaml | 59 - argocd/templates/authentik.yaml | 21 - argocd/templates/bitwarden.yaml | 23 - argocd/templates/cert-manager.yaml | 20 - argocd/templates/crossplane.yml | 20 - argocd/templates/durpapi.yaml | 20 - argocd/templates/durpot.yaml | 20 - argocd/templates/external-dns.yaml | 20 - argocd/templates/external-secrets.yaml | 20 - argocd/templates/gatekeeper.yaml | 20 - argocd/templates/gitlab-runner.yaml | 21 - argocd/templates/heimdall.yaml | 20 - argocd/templates/krakend.yaml | 20 - argocd/templates/kube-prometheus-stack.yaml | 21 - argocd/templates/kubeclarity.yaml | 20 - argocd/templates/littlelink.yaml | 22 - argocd/templates/longhorn.yaml | 21 - argocd/templates/metallb-system.yaml | 22 - argocd/templates/nfs-client.yaml | 23 - argocd/templates/open-webui.yaml | 20 - argocd/templates/secrets.yaml | 17 - argocd/templates/traefik.yaml | 20 - argocd/templates/uptimekuma.yaml | 23 - argocd/templates/vault.yaml | 25 - argocd/values.yaml | 62 - authentik/Chart.yaml | 12 - authentik/templates/authentik-pv.yaml | 24 - authentik/templates/authentik-pvc.yaml | 18 - authentik/templates/ingress.yaml | 42 - authentik/templates/secrets.yaml | 28 - authentik/values.yaml | 56 - bitwarden/Chart.yaml | 7 - bitwarden/templates/bitwarden-pv.yaml | 25 - bitwarden/templates/bitwarden-pvc.yaml | 11 - bitwarden/templates/deployment.yaml | 50 - bitwarden/templates/ingress.yaml | 42 - bitwarden/templates/secrets.yaml | 16 - bitwarden/templates/service.yaml | 12 - cert-manager/Chart.yaml | 11 - .../templates/letsencrypt-prroduction.yaml | 16 - .../templates/letsencrypt-staging.yaml | 16 - cert-manager/templates/sealedsecret.yaml | 16 - cert-manager/values.yaml | 25 - crossplane/Chart.yaml | 12 - crossplane/templates/gitlab.yml | 55 - dashboards/nginx-dashboard.yaml | 1506 ----------------- durpapi/Chart.yaml | 13 - durpapi/templates/deployment.yaml | 38 - durpapi/templates/hpa.yaml | 24 - durpapi/templates/ingress.yaml | 44 - durpapi/templates/secrets.yaml | 39 - durpapi/templates/service.yaml | 12 - durpapi/values.yaml | 39 - durpot/Chart.yaml | 11 - durpot/templates/secrets.yaml | 43 - external-dns/Chart.yaml | 12 - external-dns/templates/secrets.yaml | 23 - external-dns/values.yaml | 16 - external-secrets/Chart.yaml | 12 - external-secrets/values.yaml | 463 ----- gatekeeper/Chart.yaml | 11 - gatekeeper/values.yaml | 278 --- gitlab-runner/Chart.yaml | 11 - gitlab-runner/templates/secrets.yaml | 19 - gitlab-runner/values.yaml | 71 - heimdall/Chart.yaml | 11 - heimdall/templates/ingress.yaml | 52 - heimdall/values.yaml | 28 - internalproxy/Chart.yaml | 7 - internalproxy/templates/argocd.yaml | 46 - internalproxy/templates/blueiris.yaml | 63 - .../templates/duplicati-ingress.yaml | 70 - internalproxy/templates/gitea.yaml | 72 - internalproxy/templates/jellyfin.yaml | 72 - internalproxy/templates/kasm.yaml | 72 - internalproxy/templates/minio.yaml | 63 - internalproxy/templates/nexus.yaml | 71 - internalproxy/templates/octopus.yaml | 63 - internalproxy/templates/ollama.yaml | 102 -- internalproxy/templates/pfsense.yaml | 63 - internalproxy/templates/plex.yaml | 72 - internalproxy/templates/portainer.yaml | 63 - internalproxy/templates/proxmox.yaml | 63 - .../templates/registry-internal.yaml | 59 - internalproxy/templates/registry.yaml | 71 - internalproxy/templates/s3.yaml | 63 - internalproxy/templates/semaphore.yaml | 63 - internalproxy/templates/smokeping.yaml | 82 - internalproxy/templates/speedtest.yaml | 74 - internalproxy/templates/tdarr.yaml | 67 - internalproxy/templates/unraid.yaml | 63 - internalproxy/templates/wazuh.yaml | 63 - krakend/Chart.yaml | 7 - krakend/templates/deployments.yaml | 39 - krakend/templates/ingress.yaml | 56 - krakend/templates/secrets.yaml | 15 - krakend/templates/service.yaml | 12 - kube-prometheus-stack/Chart.yaml | 12 - .../templates/grafana-secrets-sealed.yaml | 41 - kube-prometheus-stack/templates/ingress.yaml | 80 - kube-prometheus-stack/values.yaml | 203 --- kubeclarity/Chart.yaml | 11 - kubeclarity/templates/ingress.yaml | 47 - kubeclarity/values.yaml | 235 --- littlelink/Chart.yaml | 0 littlelink/templates/deployment.yaml | 99 -- littlelink/templates/ingress.yaml | 42 - littlelink/templates/service.yaml | 12 - longhorn/Chart.yaml | 12 - longhorn/templates/ingress.yaml | 41 - longhorn/templates/secrets.yaml | 24 - longhorn/values.yaml | 253 --- metallb-system/Chart.yaml | 13 - metallb-system/templates/config.yaml | 17 - metallb-system/values.yaml | 197 --- nfs-client/Chart.yml | 8 - nfs-client/templates/cluster-role-binding.yml | 12 - nfs-client/templates/cluster-role.yml | 20 - nfs-client/templates/provisioner.yml | 42 - nfs-client/templates/role-binding.yml | 13 - nfs-client/templates/role.yml | 9 - nfs-client/templates/service-account.yml | 5 - nfs-client/templates/storage-class.yml | 10 - open-webui/Chart.yaml | 7 - open-webui/templates/deployment.yaml | 37 - open-webui/templates/ingress.yaml | 42 - open-webui/templates/pvc.yaml | 11 - open-webui/templates/secrets.yaml | 16 - open-webui/templates/service.yaml | 12 - traefik/Chart.yaml | 11 - traefik/templates/ingress.yaml | 39 - traefik/templates/middlewares.yaml | 37 - traefik/values.yaml | 887 ---------- uptimekuma/Chart.yaml | 7 - uptimekuma/templates/deployment.yaml | 42 - uptimekuma/templates/ingress.yaml | 45 - uptimekuma/templates/kuma-pv.yaml | 25 - uptimekuma/templates/kuma-pvc.yaml | 12 - uptimekuma/templates/service.yaml | 13 - vault/Chart.yaml | 12 - vault/templates/ingress.yaml | 37 - vault/templates/secret-store.yaml | 14 - vault/values.yaml | 65 - 145 files changed, 8432 deletions(-) delete mode 100644 argocd/Chart.yaml delete mode 100644 argocd/templates/InternalProxy.yaml delete mode 100644 argocd/templates/argocd.yaml delete mode 100644 argocd/templates/authentik.yaml delete mode 100644 argocd/templates/bitwarden.yaml delete mode 100644 argocd/templates/cert-manager.yaml delete mode 100644 argocd/templates/crossplane.yml delete mode 100644 argocd/templates/durpapi.yaml delete mode 100644 argocd/templates/durpot.yaml delete mode 100644 argocd/templates/external-dns.yaml delete mode 100644 argocd/templates/external-secrets.yaml delete mode 100644 argocd/templates/gatekeeper.yaml delete mode 100644 argocd/templates/gitlab-runner.yaml delete mode 100644 argocd/templates/heimdall.yaml delete mode 100644 argocd/templates/krakend.yaml delete mode 100644 argocd/templates/kube-prometheus-stack.yaml delete mode 100644 argocd/templates/kubeclarity.yaml delete mode 100644 argocd/templates/littlelink.yaml delete mode 100644 argocd/templates/longhorn.yaml delete mode 100644 argocd/templates/metallb-system.yaml delete mode 100644 argocd/templates/nfs-client.yaml delete mode 100644 argocd/templates/open-webui.yaml delete mode 100644 argocd/templates/secrets.yaml delete mode 100644 argocd/templates/traefik.yaml delete mode 100644 argocd/templates/uptimekuma.yaml delete mode 100644 argocd/templates/vault.yaml delete mode 100644 argocd/values.yaml delete mode 100644 authentik/Chart.yaml delete mode 100644 authentik/templates/authentik-pv.yaml delete mode 100644 authentik/templates/authentik-pvc.yaml delete mode 100644 authentik/templates/ingress.yaml delete mode 100644 authentik/templates/secrets.yaml delete mode 100644 authentik/values.yaml delete mode 100644 bitwarden/Chart.yaml delete mode 100644 bitwarden/templates/bitwarden-pv.yaml delete mode 100644 bitwarden/templates/bitwarden-pvc.yaml delete mode 100644 bitwarden/templates/deployment.yaml delete mode 100644 bitwarden/templates/ingress.yaml delete mode 100644 bitwarden/templates/secrets.yaml delete mode 100644 bitwarden/templates/service.yaml delete mode 100644 cert-manager/Chart.yaml delete mode 100644 cert-manager/templates/letsencrypt-prroduction.yaml delete mode 100644 cert-manager/templates/letsencrypt-staging.yaml delete mode 100644 cert-manager/templates/sealedsecret.yaml delete mode 100644 cert-manager/values.yaml delete mode 100644 crossplane/Chart.yaml delete mode 100644 crossplane/templates/gitlab.yml delete mode 100644 dashboards/nginx-dashboard.yaml delete mode 100644 durpapi/Chart.yaml delete mode 100644 durpapi/templates/deployment.yaml delete mode 100644 durpapi/templates/hpa.yaml delete mode 100644 durpapi/templates/ingress.yaml delete mode 100644 durpapi/templates/secrets.yaml delete mode 100644 durpapi/templates/service.yaml delete mode 100644 durpapi/values.yaml delete mode 100644 durpot/Chart.yaml delete mode 100644 durpot/templates/secrets.yaml delete mode 100644 external-dns/Chart.yaml delete mode 100644 external-dns/templates/secrets.yaml delete mode 100644 external-dns/values.yaml delete mode 100644 external-secrets/Chart.yaml delete mode 100644 external-secrets/values.yaml delete mode 100644 gatekeeper/Chart.yaml delete mode 100644 gatekeeper/values.yaml delete mode 100644 gitlab-runner/Chart.yaml delete mode 100644 gitlab-runner/templates/secrets.yaml delete mode 100644 gitlab-runner/values.yaml delete mode 100644 heimdall/Chart.yaml delete mode 100644 heimdall/templates/ingress.yaml delete mode 100644 heimdall/values.yaml delete mode 100644 internalproxy/Chart.yaml delete mode 100644 internalproxy/templates/argocd.yaml delete mode 100644 internalproxy/templates/blueiris.yaml delete mode 100644 internalproxy/templates/duplicati-ingress.yaml delete mode 100644 internalproxy/templates/gitea.yaml delete mode 100644 internalproxy/templates/jellyfin.yaml delete mode 100644 internalproxy/templates/kasm.yaml delete mode 100644 internalproxy/templates/minio.yaml delete mode 100644 internalproxy/templates/nexus.yaml delete mode 100644 internalproxy/templates/octopus.yaml delete mode 100644 internalproxy/templates/ollama.yaml delete mode 100644 internalproxy/templates/pfsense.yaml delete mode 100644 internalproxy/templates/plex.yaml delete mode 100644 internalproxy/templates/portainer.yaml delete mode 100644 internalproxy/templates/proxmox.yaml delete mode 100644 internalproxy/templates/registry-internal.yaml delete mode 100644 internalproxy/templates/registry.yaml delete mode 100644 internalproxy/templates/s3.yaml delete mode 100644 internalproxy/templates/semaphore.yaml delete mode 100644 internalproxy/templates/smokeping.yaml delete mode 100644 internalproxy/templates/speedtest.yaml delete mode 100644 internalproxy/templates/tdarr.yaml delete mode 100644 internalproxy/templates/unraid.yaml delete mode 100644 internalproxy/templates/wazuh.yaml delete mode 100644 krakend/Chart.yaml delete mode 100644 krakend/templates/deployments.yaml delete mode 100644 krakend/templates/ingress.yaml delete mode 100644 krakend/templates/secrets.yaml delete mode 100644 krakend/templates/service.yaml delete mode 100644 kube-prometheus-stack/Chart.yaml delete mode 100644 kube-prometheus-stack/templates/grafana-secrets-sealed.yaml delete mode 100644 kube-prometheus-stack/templates/ingress.yaml delete mode 100644 kube-prometheus-stack/values.yaml delete mode 100644 kubeclarity/Chart.yaml delete mode 100644 kubeclarity/templates/ingress.yaml delete mode 100644 kubeclarity/values.yaml delete mode 100644 littlelink/Chart.yaml delete mode 100644 littlelink/templates/deployment.yaml delete mode 100644 littlelink/templates/ingress.yaml delete mode 100644 littlelink/templates/service.yaml delete mode 100644 longhorn/Chart.yaml delete mode 100644 longhorn/templates/ingress.yaml delete mode 100644 longhorn/templates/secrets.yaml delete mode 100644 longhorn/values.yaml delete mode 100644 metallb-system/Chart.yaml delete mode 100644 metallb-system/templates/config.yaml delete mode 100644 metallb-system/values.yaml delete mode 100644 nfs-client/Chart.yml delete mode 100644 nfs-client/templates/cluster-role-binding.yml delete mode 100644 nfs-client/templates/cluster-role.yml delete mode 100644 nfs-client/templates/provisioner.yml delete mode 100644 nfs-client/templates/role-binding.yml delete mode 100644 nfs-client/templates/role.yml delete mode 100644 nfs-client/templates/service-account.yml delete mode 100644 nfs-client/templates/storage-class.yml delete mode 100644 open-webui/Chart.yaml delete mode 100644 open-webui/templates/deployment.yaml delete mode 100644 open-webui/templates/ingress.yaml delete mode 100644 open-webui/templates/pvc.yaml delete mode 100644 open-webui/templates/secrets.yaml delete mode 100644 open-webui/templates/service.yaml delete mode 100644 traefik/Chart.yaml delete mode 100644 traefik/templates/ingress.yaml delete mode 100644 traefik/templates/middlewares.yaml delete mode 100644 traefik/values.yaml delete mode 100644 uptimekuma/Chart.yaml delete mode 100644 uptimekuma/templates/deployment.yaml delete mode 100644 uptimekuma/templates/ingress.yaml delete mode 100644 uptimekuma/templates/kuma-pv.yaml delete mode 100644 uptimekuma/templates/kuma-pvc.yaml delete mode 100644 uptimekuma/templates/service.yaml delete mode 100644 vault/Chart.yaml delete mode 100644 vault/templates/ingress.yaml delete mode 100644 vault/templates/secret-store.yaml delete mode 100644 vault/values.yaml diff --git a/argocd/Chart.yaml b/argocd/Chart.yaml deleted file mode 100644 index cdccf8c..0000000 --- a/argocd/Chart.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v2 -name: argocd -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: argo-cd - repository: https://argoproj.github.io/argo-helm - version: 6.11.1 - - diff --git a/argocd/templates/InternalProxy.yaml b/argocd/templates/InternalProxy.yaml deleted file mode 100644 index ca9bcc0..0000000 --- a/argocd/templates/InternalProxy.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: internalproxy - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/internalproxy - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: internalproxy - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/argocd.yaml b/argocd/templates/argocd.yaml deleted file mode 100644 index e93aa4f..0000000 --- a/argocd/templates/argocd.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argocd - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/argocd - destination: - namespace: argocd - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: argocd-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`argocd.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: argocd-server - port: 443 - scheme: https - tls: - secretName: argocd-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: argocd-tls -spec: - secretName: argocd-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "argocd.internal.durp.info" - dnsNames: - - "argocd.internal.durp.info" diff --git a/argocd/templates/authentik.yaml b/argocd/templates/authentik.yaml deleted file mode 100644 index 5abfb3b..0000000 --- a/argocd/templates/authentik.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: authentik - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/authentik - destination: - namespace: authentik - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/bitwarden.yaml b/argocd/templates/bitwarden.yaml deleted file mode 100644 index ed56924..0000000 --- a/argocd/templates/bitwarden.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: bitwarden - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/bitwarden - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: bitwarden - syncPolicy: - automated: - prune: true - selfHeal: false - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/cert-manager.yaml b/argocd/templates/cert-manager.yaml deleted file mode 100644 index fc11c13..0000000 --- a/argocd/templates/cert-manager.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: cert-manager - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/cert-manager - destination: - namespace: cert-manager - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/crossplane.yml b/argocd/templates/crossplane.yml deleted file mode 100644 index 91473eb..0000000 --- a/argocd/templates/crossplane.yml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: crossplane - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/crossplane - destination: - namespace: crossplane - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/durpapi.yaml b/argocd/templates/durpapi.yaml deleted file mode 100644 index aeefcc1..0000000 --- a/argocd/templates/durpapi.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: durpapi - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/durpapi - destination: - namespace: durpapi - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/durpot.yaml b/argocd/templates/durpot.yaml deleted file mode 100644 index 7a97eb4..0000000 --- a/argocd/templates/durpot.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: durpot - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/durpot - destination: - namespace: durpot - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/external-dns.yaml b/argocd/templates/external-dns.yaml deleted file mode 100644 index 5cf21a5..0000000 --- a/argocd/templates/external-dns.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-dns - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/external-dns - destination: - namespace: external-dns - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/external-secrets.yaml b/argocd/templates/external-secrets.yaml deleted file mode 100644 index 04f8f1d..0000000 --- a/argocd/templates/external-secrets.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-secrets - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/external-secrets - destination: - namespace: external-secrets - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/gatekeeper.yaml b/argocd/templates/gatekeeper.yaml deleted file mode 100644 index d9a0265..0000000 --- a/argocd/templates/gatekeeper.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: gatekeeper - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/gatekeeper - destination: - namespace: gatekeeper - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/gitlab-runner.yaml b/argocd/templates/gitlab-runner.yaml deleted file mode 100644 index 13f4ebd..0000000 --- a/argocd/templates/gitlab-runner.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: gitlab-runner - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/gitlab-runner - destination: - namespace: gitlab-runner - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/heimdall.yaml b/argocd/templates/heimdall.yaml deleted file mode 100644 index 333a761..0000000 --- a/argocd/templates/heimdall.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: heimdall - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/heimdall - destination: - namespace: heimdall - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/krakend.yaml b/argocd/templates/krakend.yaml deleted file mode 100644 index e5ed113..0000000 --- a/argocd/templates/krakend.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: krakend - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/krakend - destination: - namespace: krakend - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/kube-prometheus-stack.yaml b/argocd/templates/kube-prometheus-stack.yaml deleted file mode 100644 index ab57dfa..0000000 --- a/argocd/templates/kube-prometheus-stack.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: kube-prometheus-stack - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/kube-prometheus-stack - destination: - namespace: kube-prometheus-stack - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/kubeclarity.yaml b/argocd/templates/kubeclarity.yaml deleted file mode 100644 index f2db3c0..0000000 --- a/argocd/templates/kubeclarity.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: kubeclarity - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/kubeclarity - destination: - namespace: kubeclarity - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/littlelink.yaml b/argocd/templates/littlelink.yaml deleted file mode 100644 index 856ac87..0000000 --- a/argocd/templates/littlelink.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: littlelink - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/littlelink - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: littlelink - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/longhorn.yaml b/argocd/templates/longhorn.yaml deleted file mode 100644 index 1e857c5..0000000 --- a/argocd/templates/longhorn.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: longhorn-system - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/longhorn - destination: - namespace: longhorn-system - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/metallb-system.yaml b/argocd/templates/metallb-system.yaml deleted file mode 100644 index d343453..0000000 --- a/argocd/templates/metallb-system.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: metallb-system - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/metallb-system - destination: - namespace: metallb-system - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - diff --git a/argocd/templates/nfs-client.yaml b/argocd/templates/nfs-client.yaml deleted file mode 100644 index a299095..0000000 --- a/argocd/templates/nfs-client.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: nfs-client - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/nfs-client - directory: - recurse: true - destination: - namespace: nfs-client - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/open-webui.yaml b/argocd/templates/open-webui.yaml deleted file mode 100644 index beb59a6..0000000 --- a/argocd/templates/open-webui.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: open-webui - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/open-webui - destination: - namespace: open-webui - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/secrets.yaml b/argocd/templates/secrets.yaml deleted file mode 100644 index baeaaee..0000000 --- a/argocd/templates/secrets.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: vault-argocd - labels: - app.kubernetes.io/part-of: argocd -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: client-secret - data: - - secretKey: clientSecret - remoteRef: - key: secrets/argocd/authentik - property: clientsecret diff --git a/argocd/templates/traefik.yaml b/argocd/templates/traefik.yaml deleted file mode 100644 index e336d57..0000000 --- a/argocd/templates/traefik.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: traefik - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/traefik - destination: - namespace: traefik - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/argocd/templates/uptimekuma.yaml b/argocd/templates/uptimekuma.yaml deleted file mode 100644 index 1d2c5e6..0000000 --- a/argocd/templates/uptimekuma.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: uptimekuma - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/uptimekuma - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: uptimekuma - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/argocd/templates/vault.yaml b/argocd/templates/vault.yaml deleted file mode 100644 index 6f4cf72..0000000 --- a/argocd/templates/vault.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: vault - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/vault - destination: - namespace: vault - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ignoreDifferences: - - group: admissionregistration.k8s.io - kind: MutatingWebhookConfiguration - jqPathExpressions: - - .webhooks[]?.clientConfig.caBundle diff --git a/argocd/values.yaml b/argocd/values.yaml deleted file mode 100644 index 47a56e3..0000000 --- a/argocd/values.yaml +++ /dev/null @@ -1,62 +0,0 @@ -argo-cd: - - global: - revisionHistoryLimit: 1 - image: - repository: registry.internal.durp.info/argoproj/argocd - imagePullPolicy: Always - - server: - #extraArgs: - # - --dex-server-plaintext - # - --dex-server=argocd-dex-server:5556 - # oidc.config: | - # name: AzureAD - # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 - # clientID: CLIENT_ID - # clientSecret: $oidc.azuread.clientSecret - # requestedIDTokenClaims: - # groups: - # essential: true - # requestedScopes: - # - openid - # - profile - # - email - - dex: - enabled: true - image: - repository: registry.internal.durp.info/dexidp/dex - imagePullPolicy: Always - - configs: - cm: - create: true - annotations: {} - url: https://argocd.internal.durp.info - oidc.tls.insecure.skip.verify: "true" - dex.config: | - connectors: - - config: - issuer: https://authentik.durp.info/application/o/argocd/ - clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625 - clientSecret: $client-secret:clientSecret - insecureEnableGroups: true - scopes: - - openid - - profile - - email - - groups - name: authentik - type: oidc - id: authentik - - rbac: - create: true - policy.csv: | - g, ArgoCD Admins, role:admin - scopes: "[groups]" - - server: - route: - enabled: false diff --git a/authentik/Chart.yaml b/authentik/Chart.yaml deleted file mode 100644 index c87b677..0000000 --- a/authentik/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: authentik -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: authentik - repository: https://charts.goauthentik.io - version: 2024.8.3 \ No newline at end of file diff --git a/authentik/templates/authentik-pv.yaml b/authentik/templates/authentik-pv.yaml deleted file mode 100644 index 8fbc2e2..0000000 --- a/authentik/templates/authentik-pv.yaml +++ /dev/null @@ -1,24 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: authentik-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: authentik-pvc -# namespace: authentik -# nfs: -# path: /mnt/user/k3s/authentik -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem diff --git a/authentik/templates/authentik-pvc.yaml b/authentik/templates/authentik-pvc.yaml deleted file mode 100644 index f22640b..0000000 --- a/authentik/templates/authentik-pvc.yaml +++ /dev/null @@ -1,18 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolumeClaim -#metadata: -# labels: -# app.kubernetes.io/component: app -# app.kubernetes.io/instance: authentik -# app.kubernetes.io/managed-by: Helm -# app.kubernetes.io/name: authentik -# helm.sh/chart: authentik-2.14.4 -# name: authentik-pvc -# namespace: authentik -#spec: -# accessModes: -# - ReadWriteMany -# resources: -# requests: -# storage: 10Gi -# storageClassName: nfs-storage \ No newline at end of file diff --git a/authentik/templates/ingress.yaml b/authentik/templates/ingress.yaml deleted file mode 100644 index ac10303..0000000 --- a/authentik/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: authentik-server - port: 80 - tls: - secretName: authentik-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - secretName: authentik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/authentik/templates/secrets.yaml b/authentik/templates/secrets.yaml deleted file mode 100644 index 07b7747..0000000 --- a/authentik/templates/secrets.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: authentik-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: db-pass - data: - - secretKey: dbpass - remoteRef: - key: secrets/authentik/database - property: dbpass - - secretKey: secretkey - remoteRef: - key: secrets/authentik/database - property: secretkey - - secretKey: postgresql-postgres-password - remoteRef: - key: secrets/authentik/database - property: dbpass - - secretKey: postgresql-password - remoteRef: - key: secrets/authentik/database - property: dbpass - diff --git a/authentik/values.yaml b/authentik/values.yaml deleted file mode 100644 index 716e081..0000000 --- a/authentik/values.yaml +++ /dev/null @@ -1,56 +0,0 @@ -authentik: - global: - env: - - name: AUTHENTIK_POSTGRESQL__PASSWORD - valueFrom: - secretKeyRef: - name: db-pass - key: dbpass - - name: AUTHENTIK_SECRET_KEY - valueFrom: - secretKeyRef: - name: db-pass - key: secretkey - revisionHistoryLimit: 1 - image: - repository: registry.internal.durp.info/goauthentik/server - pullPolicy: Always - authentik: - outposts: - container_image_base: registry.internal.durp.info/goauthentik/%(type)s:%(version)s - postgresql: - host: '{{ .Release.Name }}-postgresql-hl' - name: "authentik" - user: "authentik" - port: 5432 - server: - name: server - replicas: 3 - worker: - replicas: 3 - postgresql: - enabled: true - image: - registry: registry.internal.durp.info - repository: bitnami/postgresql - pullPolicy: Always - postgresqlUsername: "authentik" - postgresqlDatabase: "authentik" - existingSecret: db-pass - persistence: - enabled: true - storageClass: longhorn - accessModes: - - ReadWriteMany - redis: - enabled: true - master: - persistence: - enabled: false - image: - registry: registry.internal.durp.info - repository: bitnami/redis - pullPolicy: Always - architecture: standalone - auth: - enabled: false diff --git a/bitwarden/Chart.yaml b/bitwarden/Chart.yaml deleted file mode 100644 index cfdd821..0000000 --- a/bitwarden/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: bitwarden -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/bitwarden/templates/bitwarden-pv.yaml b/bitwarden/templates/bitwarden-pv.yaml deleted file mode 100644 index ff647d1..0000000 --- a/bitwarden/templates/bitwarden-pv.yaml +++ /dev/null @@ -1,25 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: bitwarden-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: bitwarden-pvc -# namespace: bitwarden -# nfs: -# path: /mnt/user/k3s/bitwarden -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem -# \ No newline at end of file diff --git a/bitwarden/templates/bitwarden-pvc.yaml b/bitwarden/templates/bitwarden-pvc.yaml deleted file mode 100644 index 333af4d..0000000 --- a/bitwarden/templates/bitwarden-pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: bitwarden-pvc -spec: - storageClassName: longhorn - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi diff --git a/bitwarden/templates/deployment.yaml b/bitwarden/templates/deployment.yaml deleted file mode 100644 index 7d9c28b..0000000 --- a/bitwarden/templates/deployment.yaml +++ /dev/null @@ -1,50 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: bitwarden - name: bitwarden - labels: - app: bitwarden -spec: - selector: - matchLabels: - app: bitwarden - replicas: 1 - template: - metadata: - labels: - app: bitwarden - spec: - containers: - - name: bitwarden - image: registry.internal.durp.info/vaultwarden/server:1.32.0 - imagePullPolicy: Always - volumeMounts: - - name: bitwarden-pvc - mountPath: /data - subPath: bitwaren-data - ports: - - name: http - containerPort: 80 - env: - - name: SIGNUPS_ALLOWED - value: "FALSE" - - name: INVITATIONS_ALLOWED - value: "FALSE" - - name: WEBSOCKET_ENABLED - value: "TRUE" - - name: ROCKET_ENV - value: "staging" - - name: ROCKET_PORT - value: "80" - - name: ROCKET_WORKERS - value: "10" - - name: SECRET_USERNAME - valueFrom: - secretKeyRef: - name: bitwarden-secret - key: ADMIN_TOKEN - volumes: - - name: bitwarden-pvc - persistentVolumeClaim: - claimName: bitwarden-pvc diff --git a/bitwarden/templates/ingress.yaml b/bitwarden/templates/ingress.yaml deleted file mode 100644 index 8a9a628..0000000 --- a/bitwarden/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: bitwarden-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: bitwarden - port: 80 - tls: - secretName: bitwarden-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: bitwarden-tls -spec: - secretName: bitwarden-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "bitwarden.durp.info" - dnsNames: - - "bitwarden.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: bitwarden-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/bitwarden/templates/secrets.yaml b/bitwarden/templates/secrets.yaml deleted file mode 100644 index 7a8d858..0000000 --- a/bitwarden/templates/secrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: bitwarden-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: bitwarden-secret - data: - - secretKey: ADMIN_TOKEN - remoteRef: - key: secrets/bitwarden/admin - property: ADMIN_TOKEN - diff --git a/bitwarden/templates/service.yaml b/bitwarden/templates/service.yaml deleted file mode 100644 index df30857..0000000 --- a/bitwarden/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: bitwarden -spec: - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP - selector: - app: bitwarden \ No newline at end of file diff --git a/cert-manager/Chart.yaml b/cert-manager/Chart.yaml deleted file mode 100644 index e14d98b..0000000 --- a/cert-manager/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: cert-manager -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: cert-manager - repository: https://charts.jetstack.io - version: v1.15.3 diff --git a/cert-manager/templates/letsencrypt-prroduction.yaml b/cert-manager/templates/letsencrypt-prroduction.yaml deleted file mode 100644 index 034ed9b..0000000 --- a/cert-manager/templates/letsencrypt-prroduction.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-production -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-production - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret diff --git a/cert-manager/templates/letsencrypt-staging.yaml b/cert-manager/templates/letsencrypt-staging.yaml deleted file mode 100644 index b6ae4f9..0000000 --- a/cert-manager/templates/letsencrypt-staging.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-staging -spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-staging - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret \ No newline at end of file diff --git a/cert-manager/templates/sealedsecret.yaml b/cert-manager/templates/sealedsecret.yaml deleted file mode 100644 index 37a2e92..0000000 --- a/cert-manager/templates/sealedsecret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cloudflare-api-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: cloudflare-api-token-secret - data: - - secretKey: cloudflare-api-token-secret - remoteRef: - key: secrets/cert-manager - property: cloudflare-api-token-secret - diff --git a/cert-manager/values.yaml b/cert-manager/values.yaml deleted file mode 100644 index 36f403b..0000000 --- a/cert-manager/values.yaml +++ /dev/null @@ -1,25 +0,0 @@ -cert-manager: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-controller - pullPolicy: Always - installCRDs: true - replicaCount: 3 - extraArgs: - - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 - - --dns01-recursive-nameservers-only - podDnsPolicy: None - podDnsConfig: - nameservers: - - "1.1.1.1" - - "1.0.0.1" - webhook: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-webhook - pullPolicy: Always - cainjector: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-cainjector - pullPolicy: Always \ No newline at end of file diff --git a/crossplane/Chart.yaml b/crossplane/Chart.yaml deleted file mode 100644 index b0a80b7..0000000 --- a/crossplane/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: crossplane -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: crossplane - repository: https://charts.crossplane.io/stable - version: 1.17.1 diff --git a/crossplane/templates/gitlab.yml b/crossplane/templates/gitlab.yml deleted file mode 100644 index 3a20b9c..0000000 --- a/crossplane/templates/gitlab.yml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-gitlab -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 ---- - -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: accesstoken - remoteRef: - key: secrets/gitlab/token - property: accesstoken - ---- - -#apiVersion: gitlab.crossplane.io/v1beta1 -#kind: ProviderConfig -#metadata: -# name: gitlab-provider -#spec: -# baseURL: https://gitlab.com/ -# credentials: -# source: Secret -# secretRef: -# namespace: crossplane -# name: gitlab-secret -# key: accesstoken -# -#--- -# -#apiVersion: projects.gitlab.crossplane.io/v1alpha1 -#kind: Project -#metadata: -# name: example-project -#spec: -# deletionPolicy: Orphan -# forProvider: -# name: "Example Project" -# description: "example project description" -# providerConfigRef: -# name: gitlab-provider -# policy: -# resolution: Optional -# resolve: Always diff --git a/dashboards/nginx-dashboard.yaml b/dashboards/nginx-dashboard.yaml deleted file mode 100644 index 333a6c5..0000000 --- a/dashboards/nginx-dashboard.yaml +++ /dev/null @@ -1,1506 +0,0 @@ -apiVersion: v1 -data: - nginx-ingress-controller_rev1.json: |- - { - "annotations": { - "list": [ - { - "builtIn": 1, - "datasource": { - "type": "datasource", - "uid": "grafana" - }, - "enable": true, - "hide": true, - "iconColor": "rgba(0, 211, 255, 1)", - "name": "Annotations & Alerts", - "target": { - "limit": 100, - "matchAny": false, - "tags": [], - "type": "dashboard" - }, - "type": "dashboard" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "enable": true, - "expr": "sum(changes(nginx_ingress_controller_config_last_reload_successful_timestamp_seconds{instance!=\"unknown\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[30s])) by (controller_class)", - "hide": false, - "iconColor": "rgba(255, 96, 96, 1)", - "limit": 100, - "name": "Config Reloads", - "showIn": 0, - "step": "30s", - "tagKeys": "controller_class", - "tags": [], - "titleFormat": "Config Reloaded", - "type": "tags" - } - ] - }, - "description": "Ingress-nginx supports a rich collection of prometheus metrics. If you have prometheus and grafana installed on your cluster then prometheus will already be scraping this data due to the scrape annotation on the deployment.", - "editable": true, - "fiscalYearStartMonth": 0, - "gnetId": 9614, - "graphTooltip": 0, - "id": 27, - "links": [], - "liveNow": false, - "panels": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "ops" - }, - "overrides": [] - }, - "id": 20, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m])), 0.001)", - "format": "time_series", - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Request Volume", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 6, - "x": 6, - "y": 0 - }, - "id": 82, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(avg_over_time(nginx_ingress_controller_nginx_process_connections{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "instant": false, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Connections", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "rgba(245, 54, 54, 0.9)", - "value": null - }, - { - "color": "rgba(237, 129, 40, 0.89)", - "value": 95 - }, - { - "color": "rgba(50, 172, 45, 0.97)", - "value": 99 - } - ] - }, - "unit": "percentunit" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 6, - "x": 12, - "y": 0 - }, - "id": 21, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",status!~\"[4-5].*\"}[2m])) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Success Rate (non-4|5xx responses)", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "decimals": 0, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 18, - "y": 0 - }, - "id": 81, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_success{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"})", - "format": "time_series", - "instant": true, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Config Reloads", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "decimals": 0, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 21, - "y": 0 - }, - "id": 83, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "count(nginx_ingress_controller_config_last_reload_successful{controller_pod=~\"$controller\",controller_namespace=~\"$namespace\"} == 0)", - "format": "time_series", - "instant": true, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Last Config Failed", - "type": "stat" - }, - { - "aliasColors": {}, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": true, - "error": false, - "fill": 1, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 7, - "w": 12, - "x": 0, - "y": 3 - }, - "height": "200px", - "hiddenSeries": false, - "id": 86, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": false, - "hideEmpty": false, - "hideZero": true, - "max": false, - "min": false, - "rightSide": true, - "show": true, - "sideWidth": 300, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "repeatDirection": "h", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress), 0.001)", - "format": "time_series", - "hide": false, - "instant": false, - "interval": "", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "metric": "network", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Ingress Request Volume", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "reqps", - "logBase": 1, - "show": true - }, - { - "format": "Bps", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00", - "max - prometheus": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 7, - "w": 12, - "x": 12, - "y": 3 - }, - "hiddenSeries": false, - "id": 87, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": false, - "hideEmpty": true, - "hideZero": false, - "max": false, - "min": false, - "rightSide": true, - "show": true, - "sideWidth": 300, - "sort": "avg", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\",status!~\"[4-5].*\"}[2m])) by (ingress) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "metric": "container_memory_usage:sort_desc", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Ingress Success Rate (non-4|5xx responses)", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 1, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "percentunit", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": {}, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": true, - "error": false, - "fill": 1, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 0, - "y": 10 - }, - "height": "200px", - "hiddenSeries": false, - "id": 32, - "isNew": true, - "legend": { - "alignAsTable": false, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "sideWidth": 200, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum (irate (nginx_ingress_controller_request_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "Received", - "metric": "network", - "refId": "A", - "step": 10 - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "- sum (irate (nginx_ingress_controller_response_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "hide": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "Sent", - "metric": "network", - "refId": "B", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Network I/O pressure", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 0, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "Bps", - "logBase": 1, - "show": true - }, - { - "format": "Bps", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00", - "max - prometheus": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 8, - "y": 10 - }, - "hiddenSeries": false, - "id": 77, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "sideWidth": 200, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_nginx_process_resident_memory_bytes{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}) ", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "nginx", - "metric": "container_memory_usage:sort_desc", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Average Memory Usage", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "bytes", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 3, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 16, - "y": 10 - }, - "height": "", - "hiddenSeries": false, - "id": 79, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum (rate (nginx_ingress_controller_nginx_process_cpu_seconds_total{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m])) ", - "format": "time_series", - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "nginx", - "metric": "container_cpu", - "refId": "A", - "step": 10 - } - ], - "thresholds": [ - { - "colorMode": "critical", - "fill": true, - "line": true, - "op": "gt" - } - ], - "timeRegions": [], - "title": "Average CPU Usage", - "tooltip": { - "msResolution": true, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "none", - "label": "cores", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": true - } - ], - "yaxis": { - "align": false - } - }, - { - "columns": [], - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fontSize": "100%", - "gridPos": { - "h": 8, - "w": 24, - "x": 0, - "y": 16 - }, - "hideTimeOverride": false, - "id": 75, - "links": [], - "pageSize": 7, - "repeatDirection": "h", - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": true - }, - "styles": [ - { - "alias": "Ingress", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "ingress", - "preserveFormat": false, - "sanitize": false, - "thresholds": [], - "type": "string", - "unit": "short" - }, - { - "alias": "Requests", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #A", - "thresholds": [ - "" - ], - "type": "number", - "unit": "ops" - }, - { - "alias": "Errors", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #B", - "thresholds": [], - "type": "number", - "unit": "ops" - }, - { - "alias": "P50 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "link": false, - "pattern": "Value #C", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "P90 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Value #D", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "P99 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Value #E", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "IN", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #F", - "thresholds": [ - "" - ], - "type": "number", - "unit": "Bps" - }, - { - "alias": "", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Time", - "thresholds": [], - "type": "hidden", - "unit": "short" - }, - { - "alias": "OUT", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "Value #G", - "thresholds": [], - "type": "number", - "unit": "Bps" - } - ], - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.50, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "C" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.90, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "D" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.99, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ destination_service }}", - "refId": "E" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(irate(nginx_ingress_controller_request_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "table", - "hide": false, - "instant": true, - "interval": "", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "F" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(irate(nginx_ingress_controller_response_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "table", - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "G" - } - ], - "title": "Ingress Percentile Response Times and Transfer Rates", - "transform": "table", - "type": "table-old" - }, - { - "columns": [ - { - "text": "Current", - "value": "current" - } - ], - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fontSize": "100%", - "gridPos": { - "h": 8, - "w": 24, - "x": 0, - "y": 24 - }, - "height": "1024", - "id": 85, - "links": [], - "pageSize": 7, - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": false - }, - "styles": [ - { - "alias": "Time", - "align": "auto", - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "pattern": "Time", - "type": "date" - }, - { - "alias": "TTL", - "align": "auto", - "colorMode": "cell", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Current", - "thresholds": [ - "0", - "691200" - ], - "type": "number", - "unit": "s" - }, - { - "alias": "", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "decimals": 2, - "pattern": "/.*/", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_ssl_expire_time_seconds{kubernetes_pod_name=~\"$controller\",namespace=~\"$namespace\",ingress=~\"$ingress\"}) by (host) - time()", - "format": "time_series", - "intervalFactor": 1, - "legendFormat": "{{ host }}", - "metric": "gke_letsencrypt_cert_expiration", - "refId": "A", - "step": 1 - } - ], - "title": "Ingress Certificate Expiry", - "transform": "timeseries_aggregations", - "type": "table-old" - } - ], - "refresh": "5s", - "schemaVersion": 37, - "style": "dark", - "tags": [ - "nginx" - ], - "templating": { - "list": [ - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Namespace", - "multi": false, - "name": "namespace", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash, controller_namespace)", - "refId": "Prometheus-namespace-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Controller Class", - "multi": false, - "name": "controller_class", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\"}, controller_class) ", - "refId": "Prometheus-controller_class-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Controller", - "multi": false, - "name": "controller", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\",controller_class=~\"$controller_class\"}, controller_pod) ", - "refId": "Prometheus-controller-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Ingress", - "multi": false, - "name": "ingress", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_requests{namespace=~\"$namespace\",controller_class=~\"$controller_class\",controller=~\"$controller\"}, ingress) ", - "refId": "Prometheus-ingress-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 2, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - } - ] - }, - "time": { - "from": "now-1h", - "to": "now" - }, - "timepicker": { - "refresh_intervals": [ - "5s", - "10s", - "30s", - "2m", - "5m", - "15m", - "30m", - "1h", - "2h", - "1d" - ], - "time_options": [ - "5m", - "15m", - "1h", - "6h", - "12h", - "24h", - "2d", - "7d", - "30d" - ] - }, - "timezone": "browser", - "title": "NGINX Ingress controller", - "uid": "nginx", - "version": 1, - "weekStart": "" - } -kind: ConfigMap -metadata: - labels: - grafana_dashboard: "1" - creationTimestamp: null - name: nginx-dashboard - namespace: kube-prometheus-stack \ No newline at end of file diff --git a/durpapi/Chart.yaml b/durpapi/Chart.yaml deleted file mode 100644 index 078c7e0..0000000 --- a/durpapi/Chart.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v2 -name: durpapi -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0-dev0184 -appVersion: 0.1.0 - -dependencies: -- condition: postgresql.enabled - version: 12.5.* - repository: https://charts.bitnami.com/bitnami - name: postgresql diff --git a/durpapi/templates/deployment.yaml b/durpapi/templates/deployment.yaml deleted file mode 100644 index 0f42dfb..0000000 --- a/durpapi/templates/deployment.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ .Chart.Name }} - labels: - app: {{ .Chart.Name }} -spec: - revisionHistoryLimit: 1 - selector: - matchLabels: - app: {{ .Chart.Name }} - replicas: {{ .Values.deployment.hpa.minReplicas }} - template: - metadata: - labels: - app: {{ .Chart.Name }} - spec: - containers: - - name: api - image: "{{ .Values.deployment.image }}:{{ default .Chart.Version .Values.deployment.tag }}" - imagePullPolicy: {{ .Values.deployment.imagePullPolicy }} - readinessProbe: - {{- toYaml .Values.deployment.probe.readiness | nindent 12 }} - livenessProbe: - {{- toYaml .Values.deployment.probe.liveness | nindent 12 }} - startupProbe: - {{- toYaml .Values.deployment.probe.startup | nindent 12 }} - ports: - - name: http - containerPort: {{ .Values.service.targetport }} - env: - - name: host - value: {{ .Values.swagger.host }} - - name: version - value: {{ default .Chart.Version .Values.deployment.tag }} - envFrom: - - secretRef: - name: {{ .Values.deployment.secretfile }} diff --git a/durpapi/templates/hpa.yaml b/durpapi/templates/hpa.yaml deleted file mode 100644 index 68d484d..0000000 --- a/durpapi/templates/hpa.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: "{{ .Chart.Name }}-hpa" -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ .Chart.Name }} - minReplicas: {{ .Values.deployment.hpa.minReplicas }} - maxReplicas: {{ .Values.deployment.hpa.maxReplicas }} - metrics: - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: 80 - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 40 diff --git a/durpapi/templates/ingress.yaml b/durpapi/templates/ingress.yaml deleted file mode 100644 index bd268dd..0000000 --- a/durpapi/templates/ingress.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: "{{ .Chart.Name }}-ingress" -spec: - entryPoints: - - websecure - routes: - - match: Host("api.durp.info") && PathPrefix(`/api`) - kind: Rule - middlewares: - - name: jwt - services: - - name: "durpapi-service" - port: 80 - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: "{{ .Chart.Name }}-swagger" -spec: - entryPoints: - - websecure - routes: - - match: Host("api.durp.info") && PathPrefix(`/swagger`) - kind: Rule - services: - - name: "durpapi-service" - port: 80 - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: jwt -spec: - plugin: - jwt: - Required: true - Keys: - - https://authentik.durp.info/application/o/api/jwks diff --git a/durpapi/templates/secrets.yaml b/durpapi/templates/secrets.yaml deleted file mode 100644 index 0157b5b..0000000 --- a/durpapi/templates/secrets.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: durpapi-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: durpapi-secret - data: - - secretKey: db_host - remoteRef: - key: secrets/durpapi/postgres - property: db_host - - secretKey: db_port - remoteRef: - key: secrets/durpapi/postgres - property: db_port - - secretKey: db_pass - remoteRef: - key: secrets/durpapi/postgres - property: db_pass - - secretKey: db_user - remoteRef: - key: secrets/durpapi/postgres - property: db_user - - secretKey: db_sslmode - remoteRef: - key: secrets/durpapi/postgres - property: db_sslmode - - secretKey: db_name - remoteRef: - key: secrets/durpapi/postgres - property: db_name - - secretKey: llamaurl - remoteRef: - key: secrets/durpapi/llamaurl - property: llamaurl \ No newline at end of file diff --git a/durpapi/templates/service.yaml b/durpapi/templates/service.yaml deleted file mode 100644 index 2cab669..0000000 --- a/durpapi/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: "{{ .Chart.Name }}-service" -spec: - ports: - - name: http - port: {{ .Values.service.port }} - targetPort: {{ .Values.service.targetport }} - protocol: TCP - selector: - app: {{ .Chart.Name }} diff --git a/durpapi/values.yaml b/durpapi/values.yaml deleted file mode 100644 index 9e9eeab..0000000 --- a/durpapi/values.yaml +++ /dev/null @@ -1,39 +0,0 @@ -ingress: - enabled: false -deployment: - image: registry.internal.durp.info/developerdurp/durpapi - secretfile: durpapi-secret - imagePullPolicy: Always - hpa: - minReplicas: 3 - maxReplicas: 10 - probe: - readiness: - httpGet: - path: /health/gethealth - port: 8080 - liveness: - httpGet: - path: /health/gethealth - port: 8080 - startup: - httpGet: - path: /health/gethealth - port: 8080 -service: - type: ClusterIP - port: 80 - targetport: 8080 - -swagger: - host: api.durp.info -postgresql: - enabled: true - auth: - existingSecret: durpapi-secret - secretKeys: - adminPasswordKey: db_pass - userPasswordKey: db_pass - replicationPasswordKey: db_pass - database: postgres - username: postgres diff --git a/durpot/Chart.yaml b/durpot/Chart.yaml deleted file mode 100644 index c21a834..0000000 --- a/durpot/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: durpapi -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: durpot - repository: https://gitlab.com/api/v4/projects/45025485/packages/helm/stable - version: 0.1.0-dev0038 diff --git a/durpot/templates/secrets.yaml b/durpot/templates/secrets.yaml deleted file mode 100644 index 792f909..0000000 --- a/durpot/templates/secrets.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: durpot-secert -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: durpot-secret - data: - - secretKey: OPENAI_API_KEY - remoteRef: - key: secrets/durpot/openai - property: OPENAI_API_KEY - - secretKey: BOTPREFIX - remoteRef: - key: secrets/durpot/discord - property: BOTPREFIX - - secretKey: ChannelID - remoteRef: - key: secrets/durpot/discord - property: ChannelID - - secretKey: TOKEN - remoteRef: - key: secrets/durpot/discord - property: TOKEN - - secretKey: ClientID - remoteRef: - key: secrets/durpot/auth - property: ClientID - - secretKey: Password - remoteRef: - key: secrets/durpot/auth - property: Password - - secretKey: TokenURL - remoteRef: - key: secrets/durpot/auth - property: TokenURL - - secretKey: Username - remoteRef: - key: secrets/durpot/auth - property: Username diff --git a/external-dns/Chart.yaml b/external-dns/Chart.yaml deleted file mode 100644 index 8fb36bc..0000000 --- a/external-dns/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ - -apiVersion: v2 -name: external-dns -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: external-dns - repository: https://charts.bitnami.com/bitnami - version: 8.3.8 diff --git a/external-dns/templates/secrets.yaml b/external-dns/templates/secrets.yaml deleted file mode 100644 index 142c03a..0000000 --- a/external-dns/templates/secrets.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: external-dns-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: external-dns - data: - - secretKey: cloudflare_api_email - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_email - - secretKey: cloudflare_api_key - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_key - - secretKey: cloudflare_api_token - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_token diff --git a/external-dns/values.yaml b/external-dns/values.yaml deleted file mode 100644 index 68abe91..0000000 --- a/external-dns/values.yaml +++ /dev/null @@ -1,16 +0,0 @@ -external-dns: - global: - imageRegistry: "registry.internal.durp.info" - - image: - pullPolicy: Always - - sources: - - service - - provider: cloudflare - cloudflare: - secretName : "external-dns" - proxied: false - - policy: sync diff --git a/external-secrets/Chart.yaml b/external-secrets/Chart.yaml deleted file mode 100644 index 5b9982f..0000000 --- a/external-secrets/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: external-secrets -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: external-secrets - repository: https://charts.external-secrets.io - version: 0.10.4 - diff --git a/external-secrets/values.yaml b/external-secrets/values.yaml deleted file mode 100644 index a720adb..0000000 --- a/external-secrets/values.yaml +++ /dev/null @@ -1,463 +0,0 @@ -external-secrets: - replicaCount: 3 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: Always - # -- The image tag to use. The default is the chart appVersion. - # There are different image flavours available, like distroless and ubi. - # Please see GitHub release notes for image tags for these flavors. - # By default the distroless image is used. - tag: "" - - # -- If set, install and upgrade CRDs through helm chart. - installCRDs: true - - crds: - # -- If true, create CRDs for Cluster External Secret. - createClusterExternalSecret: true - # -- If true, create CRDs for Cluster Secret Store. - createClusterSecretStore: true - # -- If true, create CRDs for Push Secret. - createPushSecret: true - annotations: {} - conversion: - enabled: true - - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - - # -- If true, external-secrets will perform leader election between instances to ensure no more - # than one instance of external-secrets operates at a time. - leaderElect: true - - # -- If set external secrets will filter matching - # Secret Stores with the appropriate controller values. - controllerClass: "" - - # -- If true external secrets will use recommended kubernetes - # annotations as prometheus metric labels. - extendedMetricLabels: false - - # -- If set external secrets are only reconciled in the - # provided namespace - scopedNamespace: "" - - # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace - # and implicitly disable cluster stores and cluster external secrets - scopedRBAC: false - - # -- if true, the operator will process cluster external secret. Else, it will ignore them. - processClusterExternalSecret: true - - # -- if true, the operator will process cluster store. Else, it will ignore them. - processClusterStore: true - - # -- Specifies whether an external secret operator deployment be created. - createOperator: true - - # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at - # a time. - concurrent: 1 - - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - ## -- Extra containers to add to the pod. - extraContainers: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- namespace where you want to install ServiceMonitors - namespace: "" - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - # -- Let prometheus add an exported_ prefix to conflicting labels - honorLabels: false - - # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) - metricRelabelings: [] - # - action: replace - # regex: (.*) - # replacement: $1 - # sourceLabels: - # - exported_namespace - # targetLabel: namespace - - # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) - relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # targetLabel: nodename - # replacement: $1 - # action: replace - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - # -- Run the controller on the host network - hostNetwork: false - - webhook: - # -- Specifies whether a webhook deployment be created. - create: true - # -- Specifices the time to check if the cert is valid - certCheckInterval: "5m" - # -- Specifices the lookaheadInterval for certificate validity - lookaheadInterval: "" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - certDir: /tmp/certs - # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore - failurePolicy: Fail - # -- Specifies if webhook pod should use hostNetwork or not. - hostNetwork: false - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: IfNotPresent - # -- The image tag to use. The default is the chart appVersion. - tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - # -- The port the webhook will listen to - port: 10250 - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - - readinessProbe: - # -- Address for readiness probe - address: "" - # -- ReadinessProbe port for kubelet - port: 8081 - - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Secret - secretAnnotations: {} - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - certController: - # -- Specifies whether a certificate controller deployment be created. - create: true - requeueInterval: "5m" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: Always - tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Run the certController on the host network - hostNetwork: false - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - # -- Specifies `dnsOptions` to deployment - dnsConfig: {} diff --git a/gatekeeper/Chart.yaml b/gatekeeper/Chart.yaml deleted file mode 100644 index ec42676..0000000 --- a/gatekeeper/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: gatekeeper -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: gatekeeper - repository: https://open-policy-agent.github.io/gatekeeper/charts - version: 3.17.1 diff --git a/gatekeeper/values.yaml b/gatekeeper/values.yaml deleted file mode 100644 index 0b0c6e7..0000000 --- a/gatekeeper/values.yaml +++ /dev/null @@ -1,278 +0,0 @@ -#gatekeeper: -# replicas: 3 -# revisionHistoryLimit: 10 -# auditInterval: 60 -# metricsBackends: ["prometheus"] -# auditMatchKindOnly: false -# constraintViolationsLimit: 20 -# auditFromCache: false -# disableMutation: false -# disableValidatingWebhook: false -# validatingWebhookName: gatekeeper-validating-webhook-configuration -# validatingWebhookTimeoutSeconds: 3 -# validatingWebhookFailurePolicy: Ignore -# validatingWebhookAnnotations: {} -# validatingWebhookExemptNamespacesLabels: {} -# validatingWebhookObjectSelector: {} -# validatingWebhookCheckIgnoreFailurePolicy: Fail -# validatingWebhookCustomRules: {} -# validatingWebhookURL: null -# enableDeleteOperations: false -# enableExternalData: true -# enableGeneratorResourceExpansion: true -# enableTLSHealthcheck: false -# maxServingThreads: -1 -# mutatingWebhookName: gatekeeper-mutating-webhook-configuration -# mutatingWebhookFailurePolicy: Ignore -# mutatingWebhookReinvocationPolicy: Never -# mutatingWebhookAnnotations: {} -# mutatingWebhookExemptNamespacesLabels: {} -# mutatingWebhookObjectSelector: {} -# mutatingWebhookTimeoutSeconds: 1 -# mutatingWebhookCustomRules: {} -# mutatingWebhookURL: null -# mutationAnnotations: false -# auditChunkSize: 500 -# logLevel: INFO -# logDenies: false -# logMutations: false -# emitAdmissionEvents: false -# emitAuditEvents: false -# admissionEventsInvolvedNamespace: false -# auditEventsInvolvedNamespace: false -# resourceQuota: true -# externaldataProviderResponseCacheTTL: 3m -# image: -# repository: openpolicyagent/gatekeeper -# crdRepository: openpolicyagent/gatekeeper-crds -# release: v3.15.0-beta.0 -# pullPolicy: Always -# pullSecrets: [] -# preInstall: -# crdRepository: -# image: -# repository: null -# tag: v3.15.0-beta.0 -# postUpgrade: -# labelNamespace: -# enabled: false -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# extraNamespaces: [] -# podSecurity: ["pod-security.kubernetes.io/audit=restricted", -# "pod-security.kubernetes.io/audit-version=latest", -# "pod-security.kubernetes.io/warn=restricted", -# "pod-security.kubernetes.io/warn-version=latest", -# "pod-security.kubernetes.io/enforce=restricted", -# "pod-security.kubernetes.io/enforce-version=v1.24"] -# extraAnnotations: {} -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# postInstall: -# labelNamespace: -# enabled: true -# extraRules: [] -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# extraNamespaces: [] -# podSecurity: ["pod-security.kubernetes.io/audit=restricted", -# "pod-security.kubernetes.io/audit-version=latest", -# "pod-security.kubernetes.io/warn=restricted", -# "pod-security.kubernetes.io/warn-version=latest", -# "pod-security.kubernetes.io/enforce=restricted", -# "pod-security.kubernetes.io/enforce-version=v1.24"] -# extraAnnotations: {} -# priorityClassName: "" -# probeWebhook: -# enabled: true -# image: -# repository: curlimages/curl -# tag: 7.83.1 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# waitTimeout: 60 -# httpTimeout: 2 -# insecureHTTPS: false -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# preUninstall: -# deleteWebhookConfigurations: -# extraRules: [] -# enabled: false -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podAnnotations: {} -# auditPodAnnotations: {} -# podLabels: {} -# podCountLimit: "100" -# secretAnnotations: {} -# enableRuntimeDefaultSeccompProfile: true -# controllerManager: -# exemptNamespaces: [] -# exemptNamespacePrefixes: [] -# hostNetwork: false -# dnsPolicy: ClusterFirst -# port: 8443 -# metricsPort: 8888 -# healthPort: 9090 -# readinessTimeout: 1 -# livenessTimeout: 1 -# priorityClassName: system-cluster-critical -# disableCertRotation: false -# tlsMinVersion: 1.3 -# clientCertName: "" -# strategyType: RollingUpdate -# affinity: -# podAntiAffinity: -# preferredDuringSchedulingIgnoredDuringExecution: -# - podAffinityTerm: -# labelSelector: -# matchExpressions: -# - key: gatekeeper.sh/operation -# operator: In -# values: -# - webhook -# topologyKey: kubernetes.io/hostname -# weight: 100 -# topologySpreadConstraints: [] -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: -# limits: -# memory: 512Mi -# requests: -# cpu: 100m -# memory: 512Mi -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podSecurityContext: -# fsGroup: 999 -# supplementalGroups: -# - 999 -# extraRules: [] -# networkPolicy: -# enabled: false -# ingress: { } -# # - from: -# # - ipBlock: -# # cidr: 0.0.0.0/0 -# audit: -# enablePubsub: false -# connection: audit-connection -# channel: audit-channel -# hostNetwork: false -# dnsPolicy: ClusterFirst -# metricsPort: 8888 -# healthPort: 9090 -# readinessTimeout: 1 -# livenessTimeout: 1 -# priorityClassName: system-cluster-critical -# disableCertRotation: false -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: -# limits: -# memory: 512Mi -# requests: -# cpu: 100m -# memory: 512Mi -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podSecurityContext: -# fsGroup: 999 -# supplementalGroups: -# - 999 -# writeToRAMDisk: false -# extraRules: [] -# crds: -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 65532 -# runAsNonRoot: true -# runAsUser: 65532 -# pdb: -# controllerManager: -# minAvailable: 1 -# service: {} -# disabledBuiltins: ["{http.send}"] -# psp: -# enabled: true -# upgradeCRDs: -# enabled: true -# extraRules: [] -# priorityClassName: "" -# rbac: -# create: true -# externalCertInjection: -# enabled: false -# secretName: gatekeeper-webhook-server-cert -# \ No newline at end of file diff --git a/gitlab-runner/Chart.yaml b/gitlab-runner/Chart.yaml deleted file mode 100644 index f64e829..0000000 --- a/gitlab-runner/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: gitlab-runner -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: gitlab-runner - repository: https://charts.gitlab.io/ - version: 0.69.0 diff --git a/gitlab-runner/templates/secrets.yaml b/gitlab-runner/templates/secrets.yaml deleted file mode 100644 index 784ef11..0000000 --- a/gitlab-runner/templates/secrets.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: runner-registration-token - remoteRef: - key: secrets/gitlab/runner - property: runner-registration-token - - secretKey: runner-token - remoteRef: - key: secrets/gitlab/runner - property: runner-token diff --git a/gitlab-runner/values.yaml b/gitlab-runner/values.yaml deleted file mode 100644 index 0cc62b8..0000000 --- a/gitlab-runner/values.yaml +++ /dev/null @@ -1,71 +0,0 @@ -gitlab-runner: - - image: - registry: registry.internal.durp.info - image: gitlab-org/gitlab-runner - - imagePullPolicy: Always - gitlabUrl: https://gitlab.com/ - unregisterRunner: true - terminationGracePeriodSeconds: 3600 - concurrent: 10 - checkInterval: 30 - - rbac: - create: true - rules: [] - clusterWideAccess: false - podSecurityPolicy: - enabled: false - resourceNames: - - gitlab-runner - - metrics: - enabled: true - serviceMonitor: - enabled: true - service: - enabled: true - annotations: {} - - runners: - config: | - [[runners]] - [runners.kubernetes] - namespace = "{{.Release.Namespace}}" - image = "ubuntu:22.04" - privileged = true - - executor: kubernetes - name: "k3s" - runUntagged: true - privileged: true - secret: gitlab-secret - #builds: - #cpuLimit: 200m - #cpuLimitOverwriteMaxAllowed: 400m - #memoryLimit: 256Mi - #memoryLimitOverwriteMaxAllowed: 512Mi - #cpuRequests: 100m - #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi - - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - privileged: false - capabilities: - drop: ["ALL"] - - podSecurityContext: - runAsUser: 100 - fsGroup: 65533 - - resources: - limits: - memory: 2Gi - requests: - memory: 128Mi - cpu: 500m \ No newline at end of file diff --git a/heimdall/Chart.yaml b/heimdall/Chart.yaml deleted file mode 100644 index 39dbf54..0000000 --- a/heimdall/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: heimdall -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: heimdall - repository: https://djjudas21.github.io/charts/ - version: 8.5.4 diff --git a/heimdall/templates/ingress.yaml b/heimdall/templates/ingress.yaml deleted file mode 100644 index 98b6144..0000000 --- a/heimdall/templates/ingress.yaml +++ /dev/null @@ -1,52 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - annotations: - name: heimdall-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`heimdall.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: heimdall - port: 80 - - match: Host(`heimdall.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: heimdall-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: heimdall-tls -spec: - secretName: heimdall-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "heimdall.durp.info" - dnsNames: - - "heimdall.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: heimdall-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/heimdall/values.yaml b/heimdall/values.yaml deleted file mode 100644 index e93ca43..0000000 --- a/heimdall/values.yaml +++ /dev/null @@ -1,28 +0,0 @@ -heimdall: - - image: - registry: - repository: registry.internal.durp.info/linuxserver/heimdall - pullPolicy: Always - - env: - TZ: UTC - PUID: "1000" - PGID: "1000" - - service: - main: - annotations: - external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info - external-dns.alpha.kubernetes.io/target: home.durp.info - ports: - http: - port: 80 - - ingress: - main: - enabled: false - - persistence: - config: - enabled: true diff --git a/internalproxy/Chart.yaml b/internalproxy/Chart.yaml deleted file mode 100644 index 71c9b0d..0000000 --- a/internalproxy/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: internalproxy -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "0.1.0" diff --git a/internalproxy/templates/argocd.yaml b/internalproxy/templates/argocd.yaml deleted file mode 100644 index 9a82e9e..0000000 --- a/internalproxy/templates/argocd.yaml +++ /dev/null @@ -1,46 +0,0 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: argocd-ingress -# annotations: -# cert-manager.io/cluster-issuer: letsencrypt-production -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`argocd.internal.durp.info`) -# middlewares: -# - name: whitelist -# namespace: traefik -# kind: Rule -# services: -# - name: argocd-server -# port: 443 -# scheme: https -# tls: -# secretName: argocd-tls -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: argocd-server -#spec: -# type: ExternalName -# externalName: argocd-server.argocd.svc.cluster.local -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: argocd-tls -#spec: -# secretName: argocd-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "argocd.internal.durp.info" -# dnsNames: -# - "argocd.internal.durp.info" \ No newline at end of file diff --git a/internalproxy/templates/blueiris.yaml b/internalproxy/templates/blueiris.yaml deleted file mode 100644 index 5f120c9..0000000 --- a/internalproxy/templates/blueiris.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: blueiris -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: blueiris -subsets: - - addresses: - - ip: 192.168.99.2 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: blueiris-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`blueiris.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: blueiris - port: 81 - scheme: http - tls: - secretName: blueiris-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: blueiris-tls -spec: - secretName: blueiris-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "blueiris.internal.durp.info" - dnsNames: - - "blueiris.internal.durp.info" diff --git a/internalproxy/templates/duplicati-ingress.yaml b/internalproxy/templates/duplicati-ingress.yaml deleted file mode 100644 index d51c391..0000000 --- a/internalproxy/templates/duplicati-ingress.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: duplicati -spec: - ports: - - name: app - port: 8200 - protocol: TCP - targetPort: 8200 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: duplicati -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8200 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: duplicati-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: duplicati - port: 8200 - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: duplicati-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: duplicati-tls -spec: - secretName: duplicati-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "duplicati.internal.durp.info" - dnsNames: - - "duplicati.internal.durp.info" \ No newline at end of file diff --git a/internalproxy/templates/gitea.yaml b/internalproxy/templates/gitea.yaml deleted file mode 100644 index ec29631..0000000 --- a/internalproxy/templates/gitea.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: gitea -spec: - ports: - - name: app - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: gitea -subsets: - - addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 3000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: gitea-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`gitea.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: gitea - port: 3000 - scheme: http - tls: - secretName: gitea-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: gitea-tls -spec: - secretName: gitea-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "gitea.durp.info" - dnsNames: - - "gitea.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: gitea-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: gitea.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/jellyfin.yaml b/internalproxy/templates/jellyfin.yaml deleted file mode 100644 index 1b919bf..0000000 --- a/internalproxy/templates/jellyfin.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: jellyfin -spec: - ports: - - name: app - port: 8096 - protocol: TCP - targetPort: 8096 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: jellyfin -subsets: - - addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8096 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: jellyfin-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`jellyfin.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: jellyfin - port: 8096 - scheme: http - tls: - secretName: jellyfin-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: jellyfin-tls -spec: - secretName: jellyfin-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "jellyfin.durp.info" - dnsNames: - - "jellyfin.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: jellyfin-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: jellyfin.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/internalproxy/templates/kasm.yaml b/internalproxy/templates/kasm.yaml deleted file mode 100644 index 7f756e0..0000000 --- a/internalproxy/templates/kasm.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: kasm -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: kasm -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kasm-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kasm.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: kasm - port: 443 - scheme: https - tls: - secretName: kasm-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kasm-tls -spec: - secretName: kasm-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kasm.durp.info" - dnsNames: - - "kasm.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kasm-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kasm.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/internalproxy/templates/minio.yaml b/internalproxy/templates/minio.yaml deleted file mode 100644 index aa191b6..0000000 --- a/internalproxy/templates/minio.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: minio -spec: - ports: - - name: app - port: 9769 - protocol: TCP - targetPort: 9769 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: minio -subsets: - - addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 9769 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: minio-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: minio - port: 9769 - scheme: http - tls: - secretName: minio-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: minio-tls -spec: - secretName: minio-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "minio.internal.durp.info" - dnsNames: - - "minio.internal.durp.info" diff --git a/internalproxy/templates/nexus.yaml b/internalproxy/templates/nexus.yaml deleted file mode 100644 index 7074102..0000000 --- a/internalproxy/templates/nexus.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: nexus -spec: - ports: - - name: app - port: 8081 - protocol: TCP - targetPort: 8081 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: nexus -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8081 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: nexus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`nexus.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: nexus - port: 8081 - tls: - secretName: nexus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: nexus-tls -spec: - secretName: nexus-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "nexus.durp.info" - dnsNames: - - "nexus.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: nexus-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: nexus.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/octopus.yaml b/internalproxy/templates/octopus.yaml deleted file mode 100644 index e0e5d78..0000000 --- a/internalproxy/templates/octopus.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: octopus -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: octopus -subsets: - - addresses: - - ip: 192.168.20.105 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: octopus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`octopus.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: octopus - port: 443 - scheme: https - tls: - secretName: octopus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: octopus-tls -spec: - secretName: octopus-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "octopus.internal.durp.info" - dnsNames: - - "octopus.internal.durp.info" diff --git a/internalproxy/templates/ollama.yaml b/internalproxy/templates/ollama.yaml deleted file mode 100644 index 75e8691..0000000 --- a/internalproxy/templates/ollama.yaml +++ /dev/null @@ -1,102 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: ollama-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: ollama-secret - data: - - secretKey: users - remoteRef: - key: secrets/internalproxy/ollama - property: users - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: ollama-basic-auth -spec: - basicAuth: - headerField: x-api-key - secret: ollama-secret - ---- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: ollama-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`ollama.durp.info`) && PathPrefix(`/`) - middlewares: - - name: ollama-basic-auth - kind: Rule - services: - - name: ollama - port: 11435 - tls: - secretName: ollama-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: ollama-tls -spec: - secretName: ollama-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "ollama.durp.info" - dnsNames: - - "ollama.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: ollama-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/internalproxy/templates/pfsense.yaml b/internalproxy/templates/pfsense.yaml deleted file mode 100644 index 45d45e8..0000000 --- a/internalproxy/templates/pfsense.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: pfsense -spec: - ports: - - name: app - port: 10443 - protocol: TCP - targetPort: 10443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: pfsense -subsets: - - addresses: - - ip: 192.168.20.1 - ports: - - name: app - port: 10443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: pfsense-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`pfsense.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: pfsense - port: 10443 - scheme: https - tls: - secretName: pfsense-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: pfsense-tls -spec: - secretName: pfsense-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "pfsense.internal.durp.info" - dnsNames: - - "pfsense.internal.durp.info" diff --git a/internalproxy/templates/plex.yaml b/internalproxy/templates/plex.yaml deleted file mode 100644 index 81f6426..0000000 --- a/internalproxy/templates/plex.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: plex -spec: - ports: - - name: app - port: 32400 - protocol: TCP - targetPort: 32400 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: plex -subsets: - - addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 32400 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: plex-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`plex.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: plex - port: 32400 - scheme: https - tls: - secretName: plex-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: plex-tls -spec: - secretName: plex-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "plex.durp.info" - dnsNames: - - "plex.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: plex-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: plex.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/internalproxy/templates/portainer.yaml b/internalproxy/templates/portainer.yaml deleted file mode 100644 index 5c22061..0000000 --- a/internalproxy/templates/portainer.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: portainer -spec: - ports: - - name: app - port: 9443 - protocol: TCP - targetPort: 9443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: portainer -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 9443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: portainer-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: portainer - port: 9443 - scheme: https - tls: - secretName: portainer-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: portainer-tls -spec: - secretName: portainer-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "portainer.internal.durp.info" - dnsNames: - - "portainer.internal.durp.info" diff --git a/internalproxy/templates/proxmox.yaml b/internalproxy/templates/proxmox.yaml deleted file mode 100644 index fd0343a..0000000 --- a/internalproxy/templates/proxmox.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: proxmox -spec: - ports: - - name: app - port: 8006 - protocol: TCP - targetPort: 8006 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: proxmox -subsets: - - addresses: - - ip: 192.168.21.252 - ports: - - name: app - port: 8006 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: proxmox-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: proxmox - port: 8006 - scheme: https - tls: - secretName: proxmox-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: proxmox-tls -spec: - secretName: proxmox-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "proxmox.internal.durp.info" - dnsNames: - - "proxmox.internal.durp.info" diff --git a/internalproxy/templates/registry-internal.yaml b/internalproxy/templates/registry-internal.yaml deleted file mode 100644 index 27561fe..0000000 --- a/internalproxy/templates/registry-internal.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry-internal -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry-internal -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 5000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-internal-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry-internal - port: 5000 - tls: - secretName: registry-internal-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-internal-tls -spec: - secretName: registry-internal-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.internal.durp.info" - dnsNames: - - "registry.internal.durp.info" diff --git a/internalproxy/templates/registry.yaml b/internalproxy/templates/registry.yaml deleted file mode 100644 index b4ac19a..0000000 --- a/internalproxy/templates/registry.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 5000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry - port: 5000 - tls: - secretName: registry-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-tls -spec: - secretName: registry-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.durp.info" - dnsNames: - - "registry.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: registry-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: registry.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/s3.yaml b/internalproxy/templates/s3.yaml deleted file mode 100644 index cd52fb6..0000000 --- a/internalproxy/templates/s3.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: s3 -spec: - ports: - - name: app - port: 9768 - protocol: TCP - targetPort: 9768 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: s3 -subsets: - - addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 9768 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: s3-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: s3 - port: 9768 - scheme: http - tls: - secretName: s3-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: s3-tls -spec: - secretName: s3-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "s3.internal.durp.info" - dnsNames: - - "s3.internal.durp.info" diff --git a/internalproxy/templates/semaphore.yaml b/internalproxy/templates/semaphore.yaml deleted file mode 100644 index ffd81dc..0000000 --- a/internalproxy/templates/semaphore.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: semaphore -spec: - ports: - - name: app - port: 3001 - protocol: TCP - targetPort: 3001 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: semaphore -subsets: - - addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 3001 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: semaphore-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: semaphore - port: 3001 - scheme: http - tls: - secretName: semaphore-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: semaphore-tls -spec: - secretName: semaphore-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "semaphore.internal.durp.info" - dnsNames: - - "semaphore.internal.durp.info" diff --git a/internalproxy/templates/smokeping.yaml b/internalproxy/templates/smokeping.yaml deleted file mode 100644 index 8a76738..0000000 --- a/internalproxy/templates/smokeping.yaml +++ /dev/null @@ -1,82 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: smokeping -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: smokeping -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: smokeping-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: smokeping - port: 81 - - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: smokeping-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: smokeping-tls -spec: - secretName: smokeping-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "smokeping.durp.info" - dnsNames: - - "smokeping.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: smokeping-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/speedtest.yaml b/internalproxy/templates/speedtest.yaml deleted file mode 100644 index e034917..0000000 --- a/internalproxy/templates/speedtest.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: speedtest -spec: - ports: - - name: app - port: 6580 - protocol: TCP - targetPort: 6580 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: speedtest -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 6580 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: speedtest-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: speedtest - port: 6580 - tls: - secretName: speedtest-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: speedtest-tls -spec: - secretName: speedtest-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "speedtest.durp.info" - dnsNames: - - "speedtest.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: speedtest-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/internalproxy/templates/tdarr.yaml b/internalproxy/templates/tdarr.yaml deleted file mode 100644 index c4403b9..0000000 --- a/internalproxy/templates/tdarr.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: tdarr -spec: - ports: - - name: app - port: 8267 - protocol: TCP - targetPort: 8267 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: tdarr -subsets: -- addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 8267 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: tdarr-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`tdarr.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: tdarr - port: 8267 - scheme: http - tls: - secretName: tdarr-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: tdarr-tls -spec: - secretName: tdarr-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "tdarr.internal.durp.info" - dnsNames: - - "tdarr.internal.durp.info" diff --git a/internalproxy/templates/unraid.yaml b/internalproxy/templates/unraid.yaml deleted file mode 100644 index 9c62edc..0000000 --- a/internalproxy/templates/unraid.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: unraid -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unraid -subsets: - - addresses: - - ip: 192.168.20.253 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: unraid-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: unraid - port: 443 - scheme: https - tls: - secretName: unraid-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: unraid-tls -spec: - secretName: unraid-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "unraid.internal.durp.info" - dnsNames: - - "unraid.internal.durp.info" diff --git a/internalproxy/templates/wazuh.yaml b/internalproxy/templates/wazuh.yaml deleted file mode 100644 index 5a5d853..0000000 --- a/internalproxy/templates/wazuh.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: wazuh -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: wazuh -subsets: - - addresses: - - ip: 192.168.20.102 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: wazuh-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`wazuh.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: wazuh - port: 443 - scheme: https - tls: - secretName: wazuh-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: wazuh-tls -spec: - secretName: wazuh-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "wazuh.internal.durp.info" - dnsNames: - - "wazuh.internal.durp.info" diff --git a/krakend/Chart.yaml b/krakend/Chart.yaml deleted file mode 100644 index d998c9f..0000000 --- a/krakend/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: krakend -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" \ No newline at end of file diff --git a/krakend/templates/deployments.yaml b/krakend/templates/deployments.yaml deleted file mode 100644 index ce50302..0000000 --- a/krakend/templates/deployments.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: krakend - name: krakend - labels: - app: krakend -spec: - selector: - matchLabels: - app: krakend - replicas: 1 - template: - metadata: - labels: - app: krakend - spec: - volumes: - - name: krakend-secret - secret: - secretName: krakend-secret - containers: - - name: krakend - image: registry.internal.durp.info/devopsfaith/krakend:2.4.3 - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /__health - port: 8080 - readinessProbe: - httpGet: - path: /__health - port: 8080 - ports: - - name: http - containerPort: 8080 - volumeMounts: - - name: krakend-secret - mountPath: /etc/krakend \ No newline at end of file diff --git a/krakend/templates/ingress.yaml b/krakend/templates/ingress.yaml deleted file mode 100644 index a8c08eb..0000000 --- a/krakend/templates/ingress.yaml +++ /dev/null @@ -1,56 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: api-tls -spec: - secretName: api-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "api.durp.info" - dnsNames: - - "api.durp.info" - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: krakend-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`api.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: krakend-service - port: 8080 - scheme: http - tls: - secretName: api-tls - ---- - -kind: Service -apiVersion: v1 -metadata: - name: api-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: api.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- - -kind: Service -apiVersion: v1 -metadata: - name: api-developer-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: developer.durp.info - external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" -spec: - type: ExternalName - externalName: developerdurp.github.io diff --git a/krakend/templates/secrets.yaml b/krakend/templates/secrets.yaml deleted file mode 100644 index 2eb1a9d..0000000 --- a/krakend/templates/secrets.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: krakend-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: krakend-secret - data: - - secretKey: krakend.json - remoteRef: - key: secrets/krakend/config - property: config \ No newline at end of file diff --git a/krakend/templates/service.yaml b/krakend/templates/service.yaml deleted file mode 100644 index d5393f3..0000000 --- a/krakend/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: krakend-service -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - protocol: TCP - selector: - app: krakend \ No newline at end of file diff --git a/kube-prometheus-stack/Chart.yaml b/kube-prometheus-stack/Chart.yaml deleted file mode 100644 index ecb4ab2..0000000 --- a/kube-prometheus-stack/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: kube-prometheus-stack -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: kube-prometheus-stack - repository: https://prometheus-community.github.io/helm-charts - version: 63.1.0 diff --git a/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml deleted file mode 100644 index 716d4e5..0000000 --- a/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: vault-grafana-oauth -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: grafana-oauth - data: - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - ---- - -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: vault-admin-credentials -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: grafana-admin-credentials - data: - - secretKey: admin-password - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-password - - secretKey: admin-user - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-user diff --git a/kube-prometheus-stack/templates/ingress.yaml b/kube-prometheus-stack/templates/ingress.yaml deleted file mode 100644 index caf0ee1..0000000 --- a/kube-prometheus-stack/templates/ingress.yaml +++ /dev/null @@ -1,80 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: grafana-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`grafana.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: grafana - port: 80 - tls: - secretName: grafana-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: grafana-tls -spec: - secretName: grafana-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "grafana.durp.info" - dnsNames: - - "grafana.durp.info" - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: alertmanager-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: prometheus-alertmanager - port: 9093 - tls: - secretName: alertmanager-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: alertmanager-tls -spec: - secretName: alertmanager-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "alertmanager.durp.info" - dnsNames: - - "alertmanager.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: grafana-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: grafana.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/kube-prometheus-stack/values.yaml b/kube-prometheus-stack/values.yaml deleted file mode 100644 index 19436ac..0000000 --- a/kube-prometheus-stack/values.yaml +++ /dev/null @@ -1,203 +0,0 @@ -kube-prometheus-stack: - fullnameOverride: prometheus - - defaultRules: - create: true - rules: - alertmanager: true - etcd: true - configReloaders: true - general: true - k8s: true - kubeApiserverAvailability: true - kubeApiserverBurnrate: true - kubeApiserverHistogram: true - kubeApiserverSlos: true - kubelet: true - kubeProxy: true - kubePrometheusGeneral: true - kubePrometheusNodeRecording: true - kubernetesApps: true - kubernetesResources: true - kubernetesStorage: true - kubernetesSystem: true - kubeScheduler: true - kubeStateMetrics: true - network: true - node: true - nodeExporterAlerting: true - nodeExporterRecording: true - prometheus: true - prometheusOperator: true - - alertmanager: - fullnameOverride: alertmanager - enabled: true - ingress: - enabled: false - grafana: - enabled: true - fullnameOverride: grafana - forceDeployDatasources: false - forceDeployDashboards: false - defaultDashboardsEnabled: true - defaultDashboardsTimezone: utc - plugins: - - grafana-polystat-panel - serviceMonitor: - enabled: true - admin: - existingSecret: grafana-admin-credentials - userKey: admin-user - passwordKey: admin-password - ingress: - enabled: false - grafana.ini: - server: - root_url: https://grafana.durp.info - auth.generic_oauth: - enabled: true - scopes: openid profile email - auth_url: https://authentik.durp.info/application/o/authorize/ - token_url: https://authentik.durp.info/application/o/token/ - api_url: https://authentik.durp.info/application/o/userinfo/ - envFromSecret: "grafana-oauth" - - kubeApiServer: - enabled: true - - kubelet: - enabled: true - serviceMonitor: - metricRelabelings: - - action: replace - sourceLabels: - - node - targetLabel: instance - - kubeControllerManager: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - coreDns: - enabled: false - - kubeDns: - enabled: false - - kubeEtcd: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - service: - enabled: true - port: 2381 - targetPort: 2381 - - kubeScheduler: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - kubeProxy: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - kubeStateMetrics: - enabled: true - - kube-state-metrics: - fullnameOverride: kube-state-metrics - selfMonitor: - enabled: true - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - - nodeExporter: - enabled: true - serviceMonitor: - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - - prometheus-node-exporter: - fullnameOverride: node-exporter - podLabels: - jobLabel: node-exporter - extraArgs: - - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/) - - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$ - service: - portName: http-metrics - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - resources: - requests: - memory: 512Mi - cpu: 250m - limits: - memory: 2048Mi - - prometheusOperator: - enabled: true - prometheusConfigReloader: - resources: - requests: - cpu: 200m - memory: 50Mi - limits: - memory: 100Mi - - prometheus: - enabled: true - prometheusSpec: - replicas: 1 - replicaExternalLabelName: "replica" - ruleSelectorNilUsesHelmValues: false - serviceMonitorSelectorNilUsesHelmValues: false - podMonitorSelectorNilUsesHelmValues: false - probeSelectorNilUsesHelmValues: false - retention: 6h - enableAdminAPI: true - walCompression: true - storageSpec: - volumeClaimTemplate: - spec: - storageClassName: nfs-storage - accessModes: ["ReadWriteMany"] - resources: - requests: - storage: 50Gi - - thanosRuler: - enabled: false diff --git a/kubeclarity/Chart.yaml b/kubeclarity/Chart.yaml deleted file mode 100644 index 4eef59a..0000000 --- a/kubeclarity/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: kubeclarity -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: kubeclarity - repository: https://openclarity.github.io/kubeclarity - version: 2.23.3 diff --git a/kubeclarity/templates/ingress.yaml b/kubeclarity/templates/ingress.yaml deleted file mode 100644 index 77b67a7..0000000 --- a/kubeclarity/templates/ingress.yaml +++ /dev/null @@ -1,47 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kubeclarity-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kubeclarity.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: kubeclarity-kubeclarity - port: 8080 - tls: - secretName: kubeclarity-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kubeclarity-tls -spec: - secretName: kubeclarity-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kubeclarity.durp.info" - dnsNames: - - "kubeclarity.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kubeclarity-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kubeclarity.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/kubeclarity/values.yaml b/kubeclarity/values.yaml deleted file mode 100644 index 0bb5078..0000000 --- a/kubeclarity/values.yaml +++ /dev/null @@ -1,235 +0,0 @@ -kubeclarity: - global: - databasePassword: kubeclarity - docker: - registry: "registry.internal.durp.info/openclarity" - tag: "latest" - imagePullPolicy: Always - - curl: - image: - registry: "registry.internal.durp.info" - repository: curlimages/curl - tag: 7.87.0 - - kubeclarity: - docker: - imageName: "" - - logLevel: warning - - enableDBInfoLog: false - - prometheus: - enabled: false - - podAnnotations: {} - - service: - type: ClusterIP - port: 8080 - annotations: {} - - ingress: - enabled: false - - resources: - requests: - memory: "200Mi" - cpu: "100m" - limits: - memory: "1000Mi" - cpu: "1000m" - - initContainers: - resources: - requests: - memory: "100Mi" - cpu: "100m" - limits: - memory: "200Mi" - cpu: "200m" - - kubeclarity-runtime-scan: - httpsProxy: "" - httpProxy: "" - resultServicePort: 8888 - - labels: - app: kubeclarity-scanner - sidecar.istio.io/inject: "false" - - namespace: "" - - registry: - skipVerifyTlS: "false" - useHTTP: "false" - - cis-docker-benchmark-scanner: - resources: - requests: - memory: "50Mi" - cpu: "50m" - limits: - memory: "1000Mi" - cpu: "1000m" - - vulnerability-scanner: - resources: - requests: - memory: "50Mi" - cpu: "50m" - limits: - memory: "1000Mi" - cpu: "1000m" - - analyzer: - analyzerList: "syft gomod trivy" - analyzerScope: "squashed" - - trivy: - enabled: true - timeout: "300" - - scanner: - scannerList: "grype trivy" - - grype: - enabled: true - mode: "REMOTE" - - remote-grype: - timeout: "2m" - - dependency-track: - enabled: false - insecureSkipVerify: "true" - disableTls: "true" - apiserverAddress: "dependency-track-apiserver.dependency-track" - apiKey: "" - - trivy: - enabled: true - timeout: "300" - - kubeclarity-grype-server: - enabled: true - - docker: - imageRepo: "registry.internal.durp.info/openclarity" - imageTag: "v0.6.0" - imagePullPolicy: Always - - logLevel: warning - - servicePort: 9991 - - resources: - requests: - cpu: "200m" - memory: "200Mi" - limits: - cpu: "1000m" - memory: "1G" - - kubeclarity-trivy-server: - enabled: true - - ## Docker Image values. - image: - registry: registry.internal.durp.info - repository: aquasec/trivy - tag: 0.44.1 - pullPolicy: Always - - persistence: - enabled: false - - podSecurityContext: - runAsUser: 1001 - runAsNonRoot: true - fsGroup: 1001 - - securityContext: - privileged: false - readOnlyRootFilesystem: true - - trivy: - debugMode: false - - service: - port: 9992 - - resources: - requests: - cpu: "200m" - memory: "200Mi" - limits: - cpu: "1000m" - memory: "1G" - - - kubeclarity-sbom-db: - docker: - imageName: "" - logLevel: warning - - servicePort: 8080 - - resources: - requests: - memory: "20Mi" - cpu: "10m" - limits: - memory: "1Gi" - cpu: "200m" - - kubeclarity-postgresql: - enabled: true - - image: - registry: registry.internal.durp.info - repository: bitnami/postgresql - tag: 14.6.0-debian-11-r31 - - auth: - existingSecret: kubeclarity-postgresql-secret - username: postgres - database: kubeclarity - sslMode: disable - - service: - ports: - postgresql: 5432 - - serviceAccount: - enabled: true - securityContext: - enabled: true - fsGroup: 1001 - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - volumePermissions: - enabled: false - securityContext: - runAsUser: 1001 - shmVolume: - chmod: - enabled: true - - resources: - requests: - memory: "256Mi" - cpu: "250m" - limits: - memory: "1000Mi" - cpu: "1000m" - - kubeclarity-postgresql-external: - enabled: false - - kubeclarity-postgresql-secret: - create: true - secretKey: "postgres-password" diff --git a/littlelink/Chart.yaml b/littlelink/Chart.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/littlelink/templates/deployment.yaml b/littlelink/templates/deployment.yaml deleted file mode 100644 index b713b86..0000000 --- a/littlelink/templates/deployment.yaml +++ /dev/null @@ -1,99 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: littlelink - name: littlelink - labels: - app: littlelink -spec: - selector: - matchLabels: - app: littlelink - replicas: 1 - template: - metadata: - labels: - app: littlelink - spec: - containers: - - name: littlelink - image: registry.internal.durp.info/techno-tim/littlelink-server:latest - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /healthcheck - port: 3000 - readinessProbe: - httpGet: - path: /healthcheck - port: 3000 - env: - - name: META_TITLE - value: DeveloperDurp - - name: META_DESCRIPTION - value: The Durpy Developer - - name: META_AUTHOR - value: DeveloperDurp - - name: LANG - value: en - - name: META_INDEX_STATUS - value: all - - name: OG_TITLE - value: DeveloperDurp - - name: OG_DESCRIPTION - value: DeveloperDurp - - name: OG_URL - value: https://gitlab.com/developerdurp - - name: OG_IMAGE - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : OG_IMAGE_WIDTH - value: "400" - - name : OG_IMAGE_HEIGHT - value: "400" - - name : THEME - value: Dark - - name : FAVICON_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_2X_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_ALT - value: DeveloperDurp Profile Pic - - name : NAME - value: DeveloperDurp - - name : BIO - value: Sup Nerd, - - name : BUTTON_ORDER - value: GITHUB,GITLAB,YOUTUBE,TWITTER,COFFEE,EMAIL - - name : TWITTER - value: https://twitter.com/developerdurp - - name : GITHUB - value: https://github.com/DeveloperDurp - - name : GITLAB - value: https://gitlab.com/developerdurp - - name: YOUTUBE - value: https://www.youtube.com/channel/UC1rGa6s6kER_gLpIQsxeMVQ - - name : EMAIL - value: DeveloperDurp@durp.info - - name : EMAIL_TEXT - value: DeveloperDurp@durp.info - - name : FOOTER - value: DeveloperDurp © 2022 - - name: CUSTOM_BUTTON_TEXT - value: BuyMeACoffee - - name: CUSTOM_BUTTON_URL - value: https://www.buymeacoffee.com/DeveloperDurp - - name: CUSTOM_BUTTON_COLOR - value: '#ffdd00' - - name: CUSTOM_BUTTON_TEXT_COLOR - value: '#000000' - - name: CUSTOM_BUTTON_ALT_TEXT - value: Support - - name: CUSTOM_BUTTON_NAME - value: COFFEE - - name: CUSTOM_BUTTON_ICON - value: fa-solid fa-cup-togo - ports: - - name: http - containerPort: 3000 diff --git a/littlelink/templates/ingress.yaml b/littlelink/templates/ingress.yaml deleted file mode 100644 index 194f31e..0000000 --- a/littlelink/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: littlelink-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`links.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: littlelink - port: 80 - tls: - secretName: littlelink-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: littlelink-tls -spec: - secretName: littlelink-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "links.durp.info" - dnsNames: - - "links.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: links-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: links.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/littlelink/templates/service.yaml b/littlelink/templates/service.yaml deleted file mode 100644 index 445d527..0000000 --- a/littlelink/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: littlelink -spec: - ports: - - name: http - port: 80 - targetPort: 3000 - protocol: TCP - selector: - app: littlelink \ No newline at end of file diff --git a/longhorn/Chart.yaml b/longhorn/Chart.yaml deleted file mode 100644 index fde2188..0000000 --- a/longhorn/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: longhorn-system -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: longhorn - repository: https://charts.longhorn.io - version: 1.7.1 \ No newline at end of file diff --git a/longhorn/templates/ingress.yaml b/longhorn/templates/ingress.yaml deleted file mode 100644 index df2e071..0000000 --- a/longhorn/templates/ingress.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: longhorn-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: longhorn-frontend - port: 80 - - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: longhorn-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: longhorn-tls -spec: - secretName: longhorn-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "longhorn.internal.durp.info" - dnsNames: - - "longhorn.internal.durp.info" diff --git a/longhorn/templates/secrets.yaml b/longhorn/templates/secrets.yaml deleted file mode 100644 index c10ab89..0000000 --- a/longhorn/templates/secrets.yaml +++ /dev/null @@ -1,24 +0,0 @@ - -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: external-longhorn-backup-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: longhorn-backup-token-secret - data: - - secretKey: AWS_ACCESS_KEY_ID - remoteRef: - key: secrets/longhorn/backup - property: AWS_ACCESS_KEY_ID - - secretKey: AWS_ENDPOINTS - remoteRef: - key: secrets/longhorn/backup - property: AWS_ENDPOINTS - - secretKey: AWS_SECRET_ACCESS_KEY - remoteRef: - key: secrets/longhorn/backup - property: AWS_SECRET_ACCESS_KEY diff --git a/longhorn/values.yaml b/longhorn/values.yaml deleted file mode 100644 index 647385b..0000000 --- a/longhorn/values.yaml +++ /dev/null @@ -1,253 +0,0 @@ -longhorn: - - # Default values for longhorn. - # This is a YAML-formatted file. - # Declare variables to be passed into your templates. - global: - cattle: - systemDefaultRegistry: "" - - image: - longhorn: - engine: - repository: longhornio/longhorn-engine - manager: - repository: longhornio/longhorn-manager - ui: - repository: longhornio/longhorn-ui - instanceManager: - repository: longhornio/longhorn-instance-manager - shareManager: - repository: longhornio/longhorn-share-manager - backingImageManager: - repository: longhornio/backing-image-manager - csi: - attacher: - repository: longhornio/csi-attacher - provisioner: - repository: longhornio/csi-provisioner - nodeDriverRegistrar: - repository: longhornio/csi-node-driver-registrar - resizer: - repository: longhornio/csi-resizer - snapshotter: - repository: longhornio/csi-snapshotter - pullPolicy: Always - - service: - ui: - type: ClusterIP - nodePort: null - manager: - type: ClusterIP - nodePort: "" - loadBalancerIP: "" - loadBalancerSourceRanges: "" - - persistence: - defaultClass: true - defaultFsType: ext4 - defaultClassReplicaCount: 3 - defaultDataLocality: disabled # best-effort otherwise - reclaimPolicy: Retain - migratable: false - recurringJobSelector: - enable: true - jobList: '[ - { - "name":"backup", - "task":"backup", - "cron":"0 0 * * ?", - "retain":24 - } - ]' - backingImage: - enable: false - name: ~ - dataSourceType: ~ - dataSourceParameters: ~ - expectedChecksum: ~ - - csi: - kubeletRootDir: ~ - attacherReplicaCount: ~ - provisionerReplicaCount: ~ - resizerReplicaCount: ~ - snapshotterReplicaCount: ~ - - defaultSettings: - backupTarget: S3://longhorn-master@us-east-1/ - backupTargetCredentialSecret: longhorn-backup-token-secret - allowRecurringJobWhileVolumeDetached: ~ - createDefaultDiskLabeledNodes: ~ - defaultDataPath: ~ - defaultDataLocality: ~ - replicaSoftAntiAffinity: ~ - replicaAutoBalance: ~ - storageOverProvisioningPercentage: ~ - storageMinimalAvailablePercentage: ~ - upgradeChecker: ~ - defaultReplicaCount: ~ - defaultLonghornStaticStorageClass: longhorn - backupstorePollInterval: ~ - taintToleration: ~ - systemManagedComponentsNodeSelector: ~ - priorityClass: ~ - autoSalvage: ~ - autoDeletePodWhenVolumeDetachedUnexpectedly: ~ - disableSchedulingOnCordonedNode: ~ - replicaZoneSoftAntiAffinity: ~ - nodeDownPodDeletionPolicy: ~ - allowNodeDrainWithLastHealthyReplica: ~ - mkfsExt4Parameters: ~ - disableReplicaRebuild: ~ - replicaReplenishmentWaitInterval: ~ - concurrentReplicaRebuildPerNodeLimit: ~ - disableRevisionCounter: ~ - systemManagedPodsImagePullPolicy: ~ - allowVolumeCreationWithDegradedAvailability: ~ - autoCleanupSystemGeneratedSnapshot: ~ - concurrentAutomaticEngineUpgradePerNodeLimit: ~ - backingImageCleanupWaitInterval: ~ - backingImageRecoveryWaitInterval: ~ - guaranteedEngineManagerCPU: ~ - guaranteedReplicaManagerCPU: ~ - kubernetesClusterAutoscalerEnabled: ~ - orphanAutoDeletion: ~ - storageNetwork: ~ - privateRegistry: - createSecret: ~ - registryUrl: ~ - registryUser: ~ - registryPasswd: ~ - registrySecret: ~ - - longhornManager: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - longhornDriver: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - longhornUI: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - # - - ingress: - ## Set to true to enable ingress record generation - enabled: false - - ## Add ingressClassName to the Ingress - ## Can replace the kubernetes.io/ingress.class annotation on v1.18+ - ingressClassName: nginx - - host: longhorn.internal.durp.info - - ## Set this to true in order to enable TLS on the ingress record - ## A side effect of this will be that the backend service will be connected at port 443 - tls: - - secretName: longhorn-tls - hosts: - - longhorn.internal.durp.info - - ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS - tlsSecret: longhorn-tls - - ## If ingress is enabled you can set the default ingress path - ## then you can access the UI by using the following full path {{host}}+{{path}} - path: / - - ## Ingress annotations done as key:value pairs - ## If you're using kube-lego, you will want to add: - ## kubernetes.io/tls-acme: true - ## - ## For a full list of possible ingress annotations, please see - ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md - ## - ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production - nginx.ingress.kubernetes.io/auth-url: |- - http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx - nginx.ingress.kubernetes.io/auth-signin: |- - https://longhorn.internal.durp.info/outpost.goauthentik.io/start?rd=$escaped_request_uri - nginx.ingress.kubernetes.io/auth-response-headers: |- - Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid - nginx.ingress.kubernetes.io/auth-snippet: | - proxy_set_header X-Forwarded-Host $http_host; - - secrets: - ## If you're providing your own certificates, please use this to add the certificates as secrets - ## key and certificate should start with -----BEGIN CERTIFICATE----- or - ## -----BEGIN RSA PRIVATE KEY----- - ## - ## name should line up with a tlsSecret set further up - ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set - ## - ## It is also possible to create and manage the certificates outside of this helm chart - ## Please see README.md for more information - # - name: longhorn.local-tls - # key: - # certificate: - - # Configure a pod security policy in the Longhorn namespace to allow privileged pods - enablePSP: true - - ## Specify override namespace, specifically this is useful for using longhorn as sub-chart - ## and its release namespace is not the `longhorn-system` - namespaceOverride: "" - - # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional. - annotations: {} - - serviceAccount: - # Annotations to add to the service account - annotations: {} - diff --git a/metallb-system/Chart.yaml b/metallb-system/Chart.yaml deleted file mode 100644 index 0f6506f..0000000 --- a/metallb-system/Chart.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v2 -name: metallb-system -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: metallb - repository: https://metallb.github.io/metallb - version: 0.14.8 - diff --git a/metallb-system/templates/config.yaml b/metallb-system/templates/config.yaml deleted file mode 100644 index e44285d..0000000 --- a/metallb-system/templates/config.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: metallb.io/v1beta1 -kind: IPAddressPool -metadata: - name: cheap -spec: - addresses: - - 192.168.20.130-192.168.20.140 ---- -apiVersion: metallb.io/v1beta1 -kind: L2Advertisement -metadata: - name: poop - namespace: metallb-system -spec: - ipAddressPools: - - cheap - diff --git a/metallb-system/values.yaml b/metallb-system/values.yaml deleted file mode 100644 index 260551d..0000000 --- a/metallb-system/values.yaml +++ /dev/null @@ -1,197 +0,0 @@ -metallb: - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - loadBalancerClass: "" - - rbac: - create: true - - prometheus: - scrapeAnnotations: false - metricsPort: 7472 - speakerMetricsTLSSecret: "" - controllerMetricsTLSSecret: "" - rbacPrometheus: true - serviceAccount: "" - namespace: "" - rbacProxy: - repository: gcr.io/kubebuilder/kube-rbac-proxy - tag: v0.12.0 - pullPolicy: - podMonitor: - enabled: false - additionalLabels: {} - annotations: {} - jobLabel: "app.kubernetes.io/name" - interval: - metricRelabelings: [] - relabelings: [] - serviceMonitor: - enabled: false - speaker: - additionalLabels: {} - annotations: {} - tlsConfig: - insecureSkipVerify: true - controller: - additionalLabels: {} - annotations: {} - tlsConfig: - insecureSkipVerify: true - jobLabel: "app.kubernetes.io/name" - interval: - metricRelabelings: [] - relabelings: [] - prometheusRule: - enabled: false - additionalLabels: {} - annotations: {} - staleConfig: - enabled: true - labels: - severity: warning - configNotLoaded: - enabled: true - labels: - severity: warning - addressPoolExhausted: - enabled: true - labels: - severity: alert - addressPoolUsage: - enabled: true - thresholds: - - percent: 75 - labels: - severity: warning - - percent: 85 - labels: - severity: warning - - percent: 95 - labels: - severity: alert - bgpSessionDown: - enabled: true - labels: - severity: alert - - extraAlerts: [] - - controller: - enabled: true - # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` - logLevel: info - image: - repository: quay.io/metallb/controller - tag: - pullPolicy: - strategy: - type: RollingUpdate - serviceAccount: - create: true - name: "" - annotations: {} - securityContext: - runAsNonRoot: true - runAsUser: 65534 - fsGroup: 65534 - resources: {} - nodeSelector: {} - tolerations: [] - priorityClassName: "" - runtimeClassName: "" - affinity: {} - podAnnotations: {} - labels: {} - livenessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - tlsMinVersion: "VersionTLS12" - tlsCipherSuites: "" - - extraContainers: [] - - speaker: - enabled: true - logLevel: debug - tolerateMaster: true - memberlist: - enabled: true - mlBindPort: 7946 - mlBindAddrOverride: "" - mlSecretKeyPath: "/etc/ml_secret_key" - excludeInterfaces: - enabled: true - ignoreExcludeLB: false - - image: - repository: quay.io/metallb/speaker - tag: - pullPolicy: - updateStrategy: - type: RollingUpdate - serviceAccount: - create: true - name: "" - annotations: {} - securityContext: {} - resources: {} - nodeSelector: {} - tolerations: [] - priorityClassName: "" - affinity: {} - runtimeClassName: "" - podAnnotations: {} - labels: - pod-security.kubernetes.io/enforce: privileged - pod-security.kubernetes.io/audit: privileged - pod-security.kubernetes.io/warn: privileged - livenessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - startupProbe: - enabled: true - failureThreshold: 30 - periodSeconds: 5 - frr: - enabled: true - image: - repository: quay.io/frrouting/frr - tag: 9.0.2 - pullPolicy: - metricsPort: 7473 - resources: {} - reloader: - resources: {} - frrMetrics: - resources: {} - extraContainers: [] - crds: - enabled: true - validationFailurePolicy: Fail - frrk8s: - enabled: false - diff --git a/nfs-client/Chart.yml b/nfs-client/Chart.yml deleted file mode 100644 index 217f2c1..0000000 --- a/nfs-client/Chart.yml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v2 -name: nfs-client -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - diff --git a/nfs-client/templates/cluster-role-binding.yml b/nfs-client/templates/cluster-role-binding.yml deleted file mode 100644 index 427d8c6..0000000 --- a/nfs-client/templates/cluster-role-binding.yml +++ /dev/null @@ -1,12 +0,0 @@ -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: run-nfs-client-provisioner -subjects: - - kind: ServiceAccount - name: nfs-client-provisioner - namespace: nfs-client -roleRef: - kind: ClusterRole - name: nfs-client-provisioner-runner - apiGroup: rbac.authorization.k8s.io diff --git a/nfs-client/templates/cluster-role.yml b/nfs-client/templates/cluster-role.yml deleted file mode 100644 index fa6ed20..0000000 --- a/nfs-client/templates/cluster-role.yml +++ /dev/null @@ -1,20 +0,0 @@ -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: nfs-client-provisioner-runner -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "delete"] - - apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/nfs-client/templates/provisioner.yml b/nfs-client/templates/provisioner.yml deleted file mode 100644 index c76fe8c..0000000 --- a/nfs-client/templates/provisioner.yml +++ /dev/null @@ -1,42 +0,0 @@ -kind: Deployment -apiVersion: apps/v1 -metadata: - name: nfs-client-provisioner - namespace: nfs-client -spec: - selector: - matchLabels: - app: nfs-client-provisioner - replicas: 1 - strategy: - type: Recreate - template: - metadata: - labels: - app: nfs-client-provisioner - spec: - serviceAccountName: nfs-client-provisioner - containers: - - name: nfs-client-provisioner - image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0 - resources: - requests: - cpu: 500m - memory: 512Mi - limits: - memory: 1Gi - volumeMounts: - - name: nfs-client-ssd - mountPath: /persistentvolumes - env: - - name: PROVISIONER_NAME - value: durp.info/nfs - - name: NFS_SERVER - value: 192.168.20.253 - - name: NFS_PATH - value: /mnt/user/k3s - volumes: - - name: nfs-client-ssd - nfs: - server: 192.168.20.253 - path: /mnt/user/k3s diff --git a/nfs-client/templates/role-binding.yml b/nfs-client/templates/role-binding.yml deleted file mode 100644 index fb0f085..0000000 --- a/nfs-client/templates/role-binding.yml +++ /dev/null @@ -1,13 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: leader-locking-nfs-client-provisioner - namespace: nfs-client -subjects: - - kind: ServiceAccount - name: nfs-client-provisioner - namespace: nfs-client -roleRef: - kind: Role - name: leader-locking-nfs-client-provisioner - apiGroup: rbac.authorization.k8s.io diff --git a/nfs-client/templates/role.yml b/nfs-client/templates/role.yml deleted file mode 100644 index 910346d..0000000 --- a/nfs-client/templates/role.yml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: leader-locking-nfs-client-provisioner - namespace: nfs-client -rules: - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/nfs-client/templates/service-account.yml b/nfs-client/templates/service-account.yml deleted file mode 100644 index ef9b4d7..0000000 --- a/nfs-client/templates/service-account.yml +++ /dev/null @@ -1,5 +0,0 @@ -kind: ServiceAccount -apiVersion: v1 -metadata: - name: nfs-client-provisioner - namespace: nfs-client diff --git a/nfs-client/templates/storage-class.yml b/nfs-client/templates/storage-class.yml deleted file mode 100644 index b615fe1..0000000 --- a/nfs-client/templates/storage-class.yml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: nfs-storage - annotations: - storageclass.kubernetes.io/is-default-class: "false" -provisioner: durp.info/nfs -parameters: - archiveOnDelete: "false" -reclaimPolicy: Retain diff --git a/open-webui/Chart.yaml b/open-webui/Chart.yaml deleted file mode 100644 index 1561d60..0000000 --- a/open-webui/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: open-webui -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/open-webui/templates/deployment.yaml b/open-webui/templates/deployment.yaml deleted file mode 100644 index 7a51d0f..0000000 --- a/open-webui/templates/deployment.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: open-webui - name: open-webui - labels: - app: open-webui -spec: - selector: - matchLabels: - app: open-webui - replicas: 1 - template: - metadata: - labels: - app: open-webui - spec: - containers: - - name: open-webui - image: registry.internal.durp.info/open-webui/open-webui:main - imagePullPolicy: Always - volumeMounts: - - name: open-webui-pvc - mountPath: /app/backend/data - ports: - - name: http - containerPort: 8080 - env: - - name: OLLAMA_BASE_URL - valueFrom: - secretKeyRef: - name: open-webui-secret - key: OLLAMA_BASE_URL - volumes: - - name: open-webui-pvc - persistentVolumeClaim: - claimName: open-webui-pvc diff --git a/open-webui/templates/ingress.yaml b/open-webui/templates/ingress.yaml deleted file mode 100644 index 6331e92..0000000 --- a/open-webui/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: open-webui-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: open-webui - port: 8080 - tls: - secretName: open-webui-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: open-webui-tls -spec: - secretName: open-webui-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "open-webui.durp.info" - dnsNames: - - "open-webui.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: open-webui-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/open-webui/templates/pvc.yaml b/open-webui/templates/pvc.yaml deleted file mode 100644 index 63a3280..0000000 --- a/open-webui/templates/pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: open-webui-pvc -spec: - storageClassName: longhorn - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi diff --git a/open-webui/templates/secrets.yaml b/open-webui/templates/secrets.yaml deleted file mode 100644 index 1fe6fec..0000000 --- a/open-webui/templates/secrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: open-webui-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: open-webui-secret - data: - - secretKey: OLLAMA_BASE_URL - remoteRef: - key: secrets/open-webui - property: OLLAMA_BASE_URL - diff --git a/open-webui/templates/service.yaml b/open-webui/templates/service.yaml deleted file mode 100644 index cd93455..0000000 --- a/open-webui/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: open-webui -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - protocol: TCP - selector: - app: open-webui diff --git a/traefik/Chart.yaml b/traefik/Chart.yaml deleted file mode 100644 index 5378476..0000000 --- a/traefik/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: traefik -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: traefik - repository: https://traefik.github.io/charts - version: 24.0.0 diff --git a/traefik/templates/ingress.yaml b/traefik/templates/ingress.yaml deleted file mode 100644 index a165566..0000000 --- a/traefik/templates/ingress.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: traefik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`traefik.internal.durp.info`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: api@internal - kind: TraefikService - - match: Host(`traefik.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: traefik-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: traefik-tls - namespace: traefik -spec: - secretName: traefik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "traefik.internal.durp.info" - dnsNames: - - "traefik.internal.durp.info" \ No newline at end of file diff --git a/traefik/templates/middlewares.yaml b/traefik/templates/middlewares.yaml deleted file mode 100644 index 6ed5f31..0000000 --- a/traefik/templates/middlewares.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: authentik-proxy-provider - namespace: traefik -spec: - forwardAuth: - address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik - trustForwardHeader: true - authResponseHeaders: - - X-authentik-username - - X-authentik-groups - - X-authentik-email - - X-authentik-name - - X-authentik-uid - - X-authentik-jwt - - X-authentik-meta-jwks - - X-authentik-meta-outpost - - X-authentik-meta-provider - - X-authentik-meta-app - - X-authentik-meta-version - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: whitelist - namespace: traefik -spec: - ipWhiteList: - sourceRange: - - 192.168.20.0/24 - - 10.0.0.0/8 - - 192.168.30.0/24 - - 192.168.130.0/24 - - 192.168.131.0/24 diff --git a/traefik/values.yaml b/traefik/values.yaml deleted file mode 100644 index de51762..0000000 --- a/traefik/values.yaml +++ /dev/null @@ -1,887 +0,0 @@ -traefik: - # Default values for Traefik - image: - registry: docker.io - repository: traefik - # defaults to appVersion - tag: "" - pullPolicy: Always - - # - # Configure integration with Traefik Hub - # - hub: - ## Enabling Hub will: - # * enable Traefik Hub integration on Traefik - # * add `traefikhub-tunl` endpoint - # * enable Prometheus metrics with addRoutersLabels - # * enable allowExternalNameServices on KubernetesIngress provider - # * enable allowCrossNamespace on KubernetesCRD provider - # * add an internal (ClusterIP) Service, dedicated for Traefik Hub - enabled: true - ## Default port can be changed - # tunnelPort: 9901 - ## TLS is optional. Insecure is mutually exclusive with any other options - # tls: - # insecure: false - # ca: "/path/to/ca.pem" - # cert: "/path/to/cert.pem" - # key: "/path/to/key.pem" - - # - # Configure the deployment - # - deployment: - enabled: true - # Can be either Deployment or DaemonSet - kind: Deployment - # Number of pods of the deployment (only applies when kind == Deployment) - replicas: 3 - # Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) - revisionHistoryLimit: 1 - # Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down - terminationGracePeriodSeconds: 60 - # The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available - minReadySeconds: 0 - # Additional deployment annotations (e.g. for jaeger-operator sidecar injection) - annotations: {} - # Additional deployment labels (e.g. for filtering deployment by custom labels) - labels: {} - # Additional pod annotations (e.g. for mesh injection or prometheus scraping) - podAnnotations: {} - # Additional Pod labels (e.g. for filtering Pod by custom labels) - podLabels: {} - # Additional containers (e.g. for metric offloading sidecars) - additionalContainers: [] - # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host - # - name: socat-proxy - # image: alpine/socat:1.0.5 - # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] - # volumeMounts: - # - name: dsdsocket - # mountPath: /socket - # Additional volumes available for use with initContainers and additionalContainers - additionalVolumes: [] - # - name: dsdsocket - # hostPath: - # path: /var/run/statsd-exporter - # Additional initContainers (e.g. for setting file permission as shown below) - initContainers: [] - # The "volume-permissions" init container is required if you run into permission issues. - # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396 - # - name: volume-permissions - # image: busybox:latest - # command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"] - # securityContext: - # runAsNonRoot: true - # runAsGroup: 65532 - # runAsUser: 65532 - # volumeMounts: - # - name: data - # mountPath: /data - # Use process namespace sharing - shareProcessNamespace: false - # Custom pod DNS policy. Apply if `hostNetwork: true` - # dnsPolicy: ClusterFirstWithHostNet - # Additional imagePullSecrets - imagePullSecrets: [] - # - name: myRegistryKeySecretName - # Pod lifecycle actions - lifecycle: {} - # preStop: - # exec: - # command: ["/bin/sh", "-c", "sleep 40"] - # postStart: - # httpGet: - # path: /ping - # port: 9000 - # host: localhost - # scheme: HTTP - - # Pod disruption budget - podDisruptionBudget: - enabled: false - # maxUnavailable: 1 - # maxUnavailable: 33% - # minAvailable: 0 - # minAvailable: 25% - - # Create a default IngressClass for Traefik - ingressClass: - enabled: true - isDefaultClass: false - - # Enable experimental features - experimental: - v3: - enabled: false - plugins: - enabled: true - kubernetesGateway: - enabled: false - gateway: - enabled: true - # certificate: - # group: "core" - # kind: "Secret" - # name: "mysecret" - # By default, Gateway would be created to the Namespace you are deploying Traefik to. - # You may create that Gateway in another namespace, setting its name below: - # namespace: default - # Additional gateway annotations (e.g. for cert-manager.io/issuer) - # annotations: - # cert-manager.io/issuer: letsencrypt - - # Create an IngressRoute for the dashboard - ingressRoute: - dashboard: - enabled: true - # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) - annotations: {} - # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) - labels: {} - # The router match rule used for the dashboard ingressRoute - matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`) - # Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure). - # By default, it's using traefik entrypoint, which is not exposed. - # /!\ Do not expose your dashboard without any protection over the internet /!\ - entryPoints: ["traefik"] - # Additional ingressRoute middlewares (e.g. for authentication) - middlewares: [] - # TLS options (e.g. secret containing certificate) - tls: {} - - # Customize updateStrategy of traefik pods - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 1 - - # Customize liveness and readiness probe values. - readinessProbe: - failureThreshold: 1 - initialDelaySeconds: 2 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 2 - - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 2 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 2 - - # - # Configure providers - # - providers: - kubernetesCRD: - enabled: true - allowCrossNamespace: true - allowExternalNameServices: false - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - namespaces: [] - # - "default" - - kubernetesIngress: - enabled: true - allowExternalNameServices: false - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - namespaces: [] - # - "default" - # IP used for Kubernetes Ingress endpoints - publishedService: - enabled: false - # Published Kubernetes Service to copy status from. Format: namespace/servicename - # By default this Traefik service - # pathOverride: "" - - # - # Add volumes to the traefik pod. The volume name will be passed to tpl. - # This can be used to mount a cert pair or a configmap that holds a config.toml file. - # After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: - # additionalArguments: - # - "--providers.file.filename=/config/dynamic.toml" - # - "--ping" - # - "--ping.entrypoint=web" - volumes: [] - # - name: public-cert - # mountPath: "/certs" - # type: secret - # - name: '{{ printf "%s-configs" .Release.Name }}' - # mountPath: "/config" - # type: configMap - - # Additional volumeMounts to add to the Traefik container - additionalVolumeMounts: [] - # For instance when using a logshipper for access logs - # - name: traefik-logs - # mountPath: /var/log/traefik - - ## Logs - ## https://docs.traefik.io/observability/logs/ - logs: - ## Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). - general: - # By default, the logs use a text format (common), but you can - # also ask for the json format in the format option - # format: json - # By default, the level is set to ERROR. - # Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. - level: ERROR - access: - # To enable access logs - enabled: false - ## By default, logs are written using the Common Log Format (CLF) on stdout. - ## To write logs in JSON, use json in the format option. - ## If the given format is unsupported, the default (CLF) is used instead. - # format: json - # filePath: "/var/log/traefik/access.log - ## To write the logs in an asynchronous fashion, specify a bufferingSize option. - ## This option represents the number of log lines Traefik will keep in memory before writing - ## them to the selected output. In some cases, this option can greatly help performances. - # bufferingSize: 100 - ## Filtering https://docs.traefik.io/observability/access-logs/#filtering - filters: {} - # statuscodes: "200,300-302" - # retryattempts: true - # minduration: 10ms - ## Fields - ## https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers - fields: - general: - defaultmode: keep - names: {} - ## Examples: - # ClientUsername: drop - headers: - defaultmode: drop - names: {} - ## Examples: - # User-Agent: redact - # Authorization: drop - # Content-Type: keep - - metrics: - ## Prometheus is enabled by default. - ## It can be disabled by setting "prometheus: null" - prometheus: - ## Entry point used to expose metrics. - entryPoint: metrics - ## Enable metrics on entry points. Default=true - # addEntryPointsLabels: false - ## Enable metrics on routers. Default=false - # addRoutersLabels: true - ## Enable metrics on services. Default=true - # addServicesLabels: false - ## Buckets for latency metrics. Default="0.1,0.3,1.2,5.0" - # buckets: "0.5,1.0,2.5" - ## When manualRouting is true, it disables the default internal router in - ## order to allow creating a custom router for prometheus@internal service. - # manualRouting: true - # datadog: - # ## Address instructs exporter to send metrics to datadog-agent at this address. - # address: "127.0.0.1:8125" - # ## The interval used by the exporter to push metrics to datadog-agent. Default=10s - # # pushInterval: 30s - # ## The prefix to use for metrics collection. Default="traefik" - # # prefix: traefik - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # influxdb: - # ## Address instructs exporter to send metrics to influxdb at this address. - # address: localhost:8089 - # ## InfluxDB's address protocol (udp or http). Default="udp" - # protocol: udp - # ## InfluxDB database used when protocol is http. Default="" - # # database: "" - # ## InfluxDB retention policy used when protocol is http. Default="" - # # retentionPolicy: "" - # ## InfluxDB username (only with http). Default="" - # # username: "" - # ## InfluxDB password (only with http). Default="" - # # password: "" - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## Additional labels (influxdb tags) on all metrics. - # # additionalLabels: - # # env: production - # # foo: bar - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # influxdb2: - # ## Address instructs exporter to send metrics to influxdb v2 at this address. - # address: localhost:8086 - # ## Token with which to connect to InfluxDB v2. - # token: xxx - # ## Organisation where metrics will be stored. - # org: "" - # ## Bucket where metrics will be stored. - # bucket: "" - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## Additional labels (influxdb tags) on all metrics. - # # additionalLabels: - # # env: production - # # foo: bar - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # statsd: - # ## Address instructs exporter to send metrics to statsd at this address. - # address: localhost:8125 - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## The prefix to use for metrics collection. Default="traefik" - # # prefix: traefik - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # openTelemetry: - # ## Address of the OpenTelemetry Collector to send metrics to. - # address: "localhost:4318" - # ## Enable metrics on entry points. - # addEntryPointsLabels: true - # ## Enable metrics on routers. - # addRoutersLabels: true - # ## Enable metrics on services. - # addServicesLabels: true - # ## Explicit boundaries for Histogram data points. - # explicitBoundaries: - # - "0.1" - # - "0.3" - # - "1.2" - # - "5.0" - # ## Additional headers sent with metrics by the reporter to the OpenTelemetry Collector. - # headers: - # foo: bar - # test: test - # ## Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol. - # insecure: true - # ## Interval at which metrics are sent to the OpenTelemetry Collector. - # pushInterval: 10s - # ## Allows to override the default URL path used for sending metrics. This option has no effect when using gRPC transport. - # path: /foo/v1/traces - # ## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector. - # tls: - # ## The path to the certificate authority, it defaults to the system bundle. - # ca: path/to/ca.crt - # ## The path to the public certificate. When using this option, setting the key option is required. - # cert: path/to/foo.cert - # ## The path to the private key. When using this option, setting the cert option is required. - # key: path/to/key.key - # ## If set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers. - # insecureSkipVerify: true - # ## This instructs the reporter to send metrics to the OpenTelemetry Collector using gRPC. - # grpc: true - - ## - ## enable optional CRDs for Prometheus Operator - ## - ## Create a dedicated metrics service for use with ServiceMonitor - ## When hub.enabled is set to true, it's not needed: it will use hub service. - # service: - # enabled: false - # labels: {} - # annotations: {} - ## When set to true, it won't check if Prometheus Operator CRDs are deployed - # disableAPICheck: false - # serviceMonitor: - # metricRelabelings: [] - # - sourceLabels: [__name__] - # separator: ; - # regex: ^fluentd_output_status_buffer_(oldest|newest)_.+ - # replacement: $1 - # action: drop - # relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # targetLabel: nodename - # replacement: $1 - # action: replace - # jobLabel: traefik - # interval: 30s - # honorLabels: true - # # (Optional) - # # scrapeTimeout: 5s - # # honorTimestamps: true - # # enableHttp2: true - # # followRedirects: true - # # additionalLabels: - # # foo: bar - # # namespace: "another-namespace" - # # namespaceSelector: {} - # prometheusRule: - # additionalLabels: {} - # namespace: "another-namespace" - # rules: - # - alert: TraefikDown - # expr: up{job="traefik"} == 0 - # for: 5m - # labels: - # context: traefik - # severity: warning - # annotations: - # summary: "Traefik Down" - # description: "{{ $labels.pod }} on {{ $labels.nodename }} is down" - - tracing: {} - # instana: - # localAgentHost: 127.0.0.1 - # localAgentPort: 42699 - # logLevel: info - # enableAutoProfile: true - # datadog: - # localAgentHostPort: 127.0.0.1:8126 - # debug: false - # globalTag: "" - # prioritySampling: false - # jaeger: - # samplingServerURL: http://localhost:5778/sampling - # samplingType: const - # samplingParam: 1.0 - # localAgentHostPort: 127.0.0.1:6831 - # gen128Bit: false - # propagation: jaeger - # traceContextHeaderName: uber-trace-id - # disableAttemptReconnecting: true - # collector: - # endpoint: "" - # user: "" - # password: "" - # zipkin: - # httpEndpoint: http://localhost:9411/api/v2/spans - # sameSpan: false - # id128Bit: true - # sampleRate: 1.0 - # haystack: - # localAgentHost: 127.0.0.1 - # localAgentPort: 35000 - # globalTag: "" - # traceIDHeaderName: "" - # parentIDHeaderName: "" - # spanIDHeaderName: "" - # baggagePrefixHeaderName: "" - # elastic: - # serverURL: http://localhost:8200 - # secretToken: "" - # serviceEnvironment: "" - - globalArguments: - - "--global.checknewversion=false" - - "--global.sendanonymoususage=false" - - # - # Configure Traefik static configuration - # Additional arguments to be passed at Traefik's binary - # All available options available on https://docs.traefik.io/reference/static-configuration/cli/ - ## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` - additionalArguments: - - "--serversTransport.insecureSkipVerify=true" - - "--log.level=DEBUG" - - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin - - --experimental.plugins.jwt.version=v0.7.0 - - - # Environment variables to be passed to Traefik's binary - env: [] - # - name: SOME_VAR - # value: some-var-value - # - name: SOME_VAR_FROM_CONFIG_MAP - # valueFrom: - # configMapRef: - # name: configmap-name - # key: config-key - # - name: SOME_SECRET - # valueFrom: - # secretKeyRef: - # name: secret-name - # key: secret-key - - envFrom: [] - # - configMapRef: - # name: config-map-name - # - secretRef: - # name: secret-name - - # Configure ports - ports: - # The name of this one can't be changed as it is used for the readiness and - # liveness probes, but you can adjust its config to your liking - traefik: - port: 9000 - # Use hostPort if set. - # hostPort: 9000 - # - # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which - # means it's listening on all your interfaces and all your IPs. You may want - # to set this value if you need traefik to listen on specific interface - # only. - # hostIP: 192.168.100.10 - - # Override the liveness/readiness port. This is useful to integrate traefik - # with an external Load Balancer that performs healthchecks. - # Default: ports.traefik.port - # healthchecksPort: 9000 - - # Override the liveness/readiness scheme. Useful for getting ping to - # respond on websecure entryPoint. - # healthchecksScheme: HTTPS - - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # You SHOULD NOT expose the traefik port on production deployments. - # If you want to access it from outside of your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # The exposed port for this service - exposedPort: 9000 - # The port protocol (TCP/UDP) - protocol: TCP - web: - ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8000 - # hostPort: 8000 - expose: true - exposedPort: 80 - # The port protocol (TCP/UDP) - protocol: TCP - # Use nodeport if set. This is useful if you have configured Traefik in a - # LoadBalancer. - # nodePort: 32080 - # Port Redirections - # Added in 2.2, you can make permanent redirects via entrypoints. - # https://docs.traefik.io/routing/entrypoints/#redirection - redirectTo: websecure - # - # Trust forwarded headers information (X-Forwarded-*). - # forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - # Enable the Proxy Protocol header parsing for the entry point - # proxyProtocol: - # trustedIPs: [] - # insecure: false - websecure: - ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8443 - # hostPort: 8443 - expose: true - exposedPort: 443 - ## The port protocol (TCP/UDP) - protocol: TCP - # nodePort: 32443 - # - ## Enable HTTP/3 on the entrypoint - ## Enabling it will also enable http3 experimental feature - ## https://doc.traefik.io/traefik/routing/entrypoints/#http3 - ## There are known limitations when trying to listen on same ports for - ## TCP & UDP (Http3). There is a workaround in this chart using dual Service. - ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741 - http3: - enabled: false - # advertisedPort: 4443 - # - ## Trust forwarded headers information (X-Forwarded-*). - #forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - ## Enable the Proxy Protocol header parsing for the entry point - #proxyProtocol: - # trustedIPs: [] - # insecure: false - # - ## Set TLS at the entrypoint - ## https://doc.traefik.io/traefik/routing/entrypoints/#tls - tls: - enabled: true - # this is the name of a TLSOption definition - options: "" - certResolver: "" - domains: [] - # - main: example.com - # sans: - # - foo.example.com - # - bar.example.com - # - # One can apply Middlewares on an entrypoint - # https://doc.traefik.io/traefik/middlewares/overview/ - # https://doc.traefik.io/traefik/routing/entrypoints/#middlewares - # /!\ It introduces here a link between your static configuration and your dynamic configuration /!\ - # It follows the provider naming convention: https://doc.traefik.io/traefik/providers/overview/#provider-namespace - # middlewares: - # - namespace-name1@kubernetescrd - # - namespace-name2@kubernetescrd - middlewares: [] - metrics: - # When using hostNetwork, use another port to avoid conflict with node exporter: - # https://github.com/prometheus/prometheus/wiki/Default-port-allocations - port: 9100 - # hostPort: 9100 - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # You may not want to expose the metrics port on production deployments. - # If you want to access it from outside of your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # The exposed port for this service - exposedPort: 9100 - # The port protocol (TCP/UDP) - protocol: TCP - - # TLS Options are created as TLSOption CRDs - # https://doc.traefik.io/traefik/https/tls/#tls-options - # When using `labelSelector`, you'll need to set labels on tlsOption accordingly. - # Example: - # tlsOptions: - # default: - # labels: {} - # sniStrict: true - # preferServerCipherSuites: true - # customOptions: - # labels: {} - # curvePreferences: - # - CurveP521 - # - CurveP384 - tlsOptions: {} - - # TLS Store are created as TLSStore CRDs. This is useful if you want to set a default certificate - # https://doc.traefik.io/traefik/https/tls/#default-certificate - # Example: - # tlsStore: - # default: - # defaultCertificate: - # secretName: tls-cert - tlsStore: {} - - # Options for the main traefik service, where the entrypoints traffic comes - # from. - service: - enabled: true - ## Single service is using `MixedProtocolLBService` feature gate. - ## When set to false, it will create two Service, one for TCP and one for UDP. - single: true - type: LoadBalancer - # Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config) - annotations: {} - # Additional annotations for TCP service only - annotationsTCP: {} - # Additional annotations for UDP service only - annotationsUDP: {} - # Additional service labels (e.g. for filtering Service by custom labels) - labels: {} - # Additional entries here will be added to the service spec. - # Cannot contain type, selector or ports entries. - spec: - externalTrafficPolicy: Local - # loadBalancerIP: "1.2.3.4" - # clusterIP: "2.3.4.5" - loadBalancerSourceRanges: [] - # - 192.168.0.1/32 - # - 172.16.0.0/16 - externalIPs: [] - # - 1.2.3.4 - ## One of SingleStack, PreferDualStack, or RequireDualStack. - # ipFamilyPolicy: SingleStack - ## List of IP families (e.g. IPv4 and/or IPv6). - ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - # ipFamilies: - # - IPv4 - # - IPv6 - ## - ## An additionnal and optional internal Service. - ## Same parameters as external Service - # internal: - # type: ClusterIP - # # labels: {} - # # annotations: {} - # # spec: {} - # # loadBalancerSourceRanges: [] - # # externalIPs: [] - # # ipFamilies: [ "IPv4","IPv6" ] - - ## Create HorizontalPodAutoscaler object. - ## - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 10 - metrics: - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: 80 - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 80 - behavior: - scaleDown: - stabilizationWindowSeconds: 300 - policies: - - type: Pods - value: 1 - periodSeconds: 60 - - # Enable persistence using Persistent Volume Claims - # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ - # It can be used to store TLS certificates, see `storage` in certResolvers - persistence: - enabled: false - name: data - # existingClaim: "" - accessMode: ReadWriteOnce - size: 128Mi - # storageClass: "" - # volumeName: "" - path: /data - annotations: {} - # subPath: "" # only mount a subpath of the Volume into the pod - - certResolvers: {} - # letsencrypt: - # # for challenge options cf. https://doc.traefik.io/traefik/https/acme/ - # email: email@example.com - # dnsChallenge: - # # also add the provider's required configuration under env - # # or expand then from secrets/configmaps with envfrom - # # cf. https://doc.traefik.io/traefik/https/acme/#providers - # provider: digitalocean - # # add futher options for the dns challenge as needed - # # cf. https://doc.traefik.io/traefik/https/acme/#dnschallenge - # delayBeforeCheck: 30 - # resolvers: - # - 1.1.1.1 - # - 8.8.8.8 - # tlsChallenge: true - # httpChallenge: - # entryPoint: "web" - # # It has to match the path with a persistent volume - # storage: /data/acme.json - - # If hostNetwork is true, runs traefik in the host network namespace - # To prevent unschedulabel pods due to port collisions, if hostNetwork=true - # and replicas>1, a pod anti-affinity is recommended and will be set if the - # affinity is left as default. - hostNetwork: false - - # Whether Role Based Access Control objects like roles and rolebindings should be created - rbac: - enabled: true - # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. - # If set to true, installs Role and RoleBinding. Providers will only watch target namespace. - namespaced: false - # Enable user-facing roles - # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles - # aggregateTo: [ "admin" ] - - # Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding - podSecurityPolicy: - enabled: false - - # The service account the pods will use to interact with the Kubernetes API - serviceAccount: - # If set, an existing service account is used - # If not set, a service account is created automatically using the fullname template - name: "" - - # Additional serviceAccount annotations (e.g. for oidc authentication) - serviceAccountAnnotations: {} - - resources: - requests: - cpu: "100m" - memory: "128Mi" - limits: - cpu: "300m" - memory: "256Mi" - - # This example pod anti-affinity forces the scheduler to put traefik pods - # on nodes where no other traefik pods are scheduled. - # It should be used when hostNetwork: true to prevent port conflicts - affinity: {} - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - labelSelector: - # matchLabels: - # app.kubernetes.io/name: '{{ template "traefik.name" . }}' - # app.kubernetes.io/instance: '{{ .Release.Name }}-{{ .Release.Namespace }}' - # topologyKey: kubernetes.io/hostname - - nodeSelector: {} - tolerations: [] - topologySpreadConstraints: [] - # # This example topologySpreadConstraints forces the scheduler to put traefik pods - # # on nodes where no other traefik pods are scheduled. - # - labelSelector: - # matchLabels: - # app: '{{ template "traefik.name" . }}' - # maxSkew: 1 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - - # Pods can have priority. - # Priority indicates the importance of a Pod relative to other Pods. - priorityClassName: "" - - # Set the container security context - # To run the container with ports below 1024 this will need to be adjust to run as root - securityContext: - capabilities: - drop: [ALL] - readOnlyRootFilesystem: true - - podSecurityContext: - # # /!\ When setting fsGroup, Kubernetes will recursively changes ownership and - # # permissions for the contents of each volume to match the fsGroup. This can - # # be an issue when storing sensitive content like TLS Certificates /!\ - # fsGroup: 65532 - fsGroupChangePolicy: "OnRootMismatch" - runAsGroup: 65532 - runAsNonRoot: true - runAsUser: 65532 - - # - # Extra objects to deploy (value evaluated as a template) - # - # In some cases, it can avoid the need for additional, extended or adhoc deployments. - # See #595 for more details and traefik/tests/values/extra.yaml for example. - extraObjects: [] - - # This will override the default Release Namespace for Helm. - # It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules` - # namespaceOverride: traefik - # - ## This will override the default app.kubernetes.io/instance label for all Objects. - # instanceLabelOverride: traefik diff --git a/uptimekuma/Chart.yaml b/uptimekuma/Chart.yaml deleted file mode 100644 index 0dcf730..0000000 --- a/uptimekuma/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: uptimekuma -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/uptimekuma/templates/deployment.yaml b/uptimekuma/templates/deployment.yaml deleted file mode 100644 index 21ce3c0..0000000 --- a/uptimekuma/templates/deployment.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - component: uptime-kuma - name: deployment -spec: - selector: - matchLabels: - component: uptime-kuma - replicas: 1 - strategy: - type: Recreate - - template: - metadata: - labels: - component: uptime-kuma - spec: - containers: - - name: app - image: registry.internal.durp.info/louislam/uptime-kuma:1 - ports: - - containerPort: 3001 - volumeMounts: - - mountPath: /app/data - name: storage - #livenessProbe: - #exec: - #command: - #- node - #- extra/healthcheck.js - readinessProbe: - httpGet: - path: / - port: 3001 - scheme: HTTP - - volumes: - - name: storage - persistentVolumeClaim: - claimName: uptimekuma-pvc diff --git a/uptimekuma/templates/ingress.yaml b/uptimekuma/templates/ingress.yaml deleted file mode 100644 index 3df2689..0000000 --- a/uptimekuma/templates/ingress.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kuma-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kuma.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: service - port: 3001 - tls: - secretName: kuma-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kuma-tls -spec: - secretName: kuma-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kuma.durp.info" - dnsNames: - - "kuma.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: heimdall-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kuma.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/uptimekuma/templates/kuma-pv.yaml b/uptimekuma/templates/kuma-pv.yaml deleted file mode 100644 index e17e5a7..0000000 --- a/uptimekuma/templates/kuma-pv.yaml +++ /dev/null @@ -1,25 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: uptimekuma-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: uptimekuma-pvc -# namespace: uptimekuma -# nfs: -# path: /mnt/user/k3s/uptimekuma -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem -# \ No newline at end of file diff --git a/uptimekuma/templates/kuma-pvc.yaml b/uptimekuma/templates/kuma-pvc.yaml deleted file mode 100644 index ab76bf0..0000000 --- a/uptimekuma/templates/kuma-pvc.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: uptimekuma-pvc - namespace: uptimekuma -spec: - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi - storageClassName: longhorn \ No newline at end of file diff --git a/uptimekuma/templates/service.yaml b/uptimekuma/templates/service.yaml deleted file mode 100644 index cad08e7..0000000 --- a/uptimekuma/templates/service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: service -spec: - selector: - component: uptime-kuma - type: ClusterIP - ports: - - name: http - port: 3001 - targetPort: 3001 - protocol: TCP \ No newline at end of file diff --git a/vault/Chart.yaml b/vault/Chart.yaml deleted file mode 100644 index 1ad2d4a..0000000 --- a/vault/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: vault -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: vault - repository: https://helm.releases.hashicorp.com - version: 0.28.1 - diff --git a/vault/templates/ingress.yaml b/vault/templates/ingress.yaml deleted file mode 100644 index 8998087..0000000 --- a/vault/templates/ingress.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: vault-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`vault.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: vault - port: 8200 - scheme: http - tls: - secretName: vault-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: vault-tls -spec: - secretName: vault-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "vault.internal.durp.info" - dnsNames: - - "vault.internal.durp.info" - diff --git a/vault/templates/secret-store.yaml b/vault/templates/secret-store.yaml deleted file mode 100644 index e7cca3a..0000000 --- a/vault/templates/secret-store.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ClusterSecretStore -metadata: - name: vault -spec: - provider: - vault: - server: "http://vault.vault.svc.cluster.local:8200" - path: "secrets" - version: "v2" - auth: - kubernetes: - mountPath: "kubernetes" - role: "external-secrets" diff --git a/vault/values.yaml b/vault/values.yaml deleted file mode 100644 index b7c6d88..0000000 --- a/vault/values.yaml +++ /dev/null @@ -1,65 +0,0 @@ -vault: - - global: - - image: - repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.4.2" - pullPolicy: Always - - agentImage: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - - injector: - enabled: "-" - - replicas: 3 - leaderElector: - enabled: true - - metrics: - enabled: true - - image: - repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.4.2" - pullPolicy: Always - - agentImage: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - - server: - enabled: "-" - image: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - pullPolicy: Always - ha: - enabled: false - replicas: 3 - resources: - requests: - memory: 256Mi - cpu: 250m - limits: - memory: 256Mi - cpu: 250m - - dataStorage: - enabled: true - size: 10Gi - storageClass: longhorn - accessMode: ReadWriteOnce - auditStorage: - enabled: false - size: 10Gi - mountPath: "/vault/audit" - storageClass: longhorn - accessMode: ReadWriteOnce - ui: - enabled: false - externalPort: 8200 - targetPort: 8200 - From 46724e763cb5ff16ddbaabaacd4e8439ce867d9a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 11 Jan 2025 14:27:01 +0000 Subject: [PATCH 0222/1058] Update file s3.yaml --- master/internalproxy/templates/s3.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/master/internalproxy/templates/s3.yaml b/master/internalproxy/templates/s3.yaml index cd52fb6..6e22c5e 100644 --- a/master/internalproxy/templates/s3.yaml +++ b/master/internalproxy/templates/s3.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 9768 + port: 9769 protocol: TCP - targetPort: 9768 + targetPort: 9769 clusterIP: None type: ClusterIP @@ -22,7 +22,7 @@ subsets: - ip: 192.168.20.253 ports: - name: app - port: 9768 + port: 9769 protocol: TCP --- @@ -42,7 +42,7 @@ spec: kind: Rule services: - name: s3 - port: 9768 + port: 9769 scheme: http tls: secretName: s3-tls From 14a659df5becdd55d4403d0f4189a4098c4148aa Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 11 Jan 2025 14:30:36 +0000 Subject: [PATCH 0223/1058] Update file values.yaml --- master/traefik/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/master/traefik/values.yaml b/master/traefik/values.yaml index de51762..a3dbd8c 100644 --- a/master/traefik/values.yaml +++ b/master/traefik/values.yaml @@ -822,10 +822,10 @@ traefik: resources: requests: cpu: "100m" - memory: "128Mi" - limits: - cpu: "300m" memory: "256Mi" + limits: + #cpu: "300m" + memory: "512Mi" # This example pod anti-affinity forces the scheduler to put traefik pods # on nodes where no other traefik pods are scheduled. From 5f693d002015f9187b4d647b4f2143742f76cc81 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 11 Jan 2025 14:40:35 +0000 Subject: [PATCH 0224/1058] Update file values.yaml --- master/traefik/values.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/master/traefik/values.yaml b/master/traefik/values.yaml index a3dbd8c..6b07f2b 100644 --- a/master/traefik/values.yaml +++ b/master/traefik/values.yaml @@ -734,12 +734,12 @@ traefik: minReplicas: 3 maxReplicas: 10 metrics: - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: 80 + #- type: Resource + # resource: + # name: memory + # target: + # type: Utilization + # averageUtilization: 80 - type: Resource resource: name: cpu From f3684f197c97f46c997e06a678ef11f7c4257732 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 11 Jan 2025 14:41:37 +0000 Subject: [PATCH 0225/1058] Update file values.yaml --- master/traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/traefik/values.yaml b/master/traefik/values.yaml index 6b07f2b..5bb0a04 100644 --- a/master/traefik/values.yaml +++ b/master/traefik/values.yaml @@ -822,7 +822,7 @@ traefik: resources: requests: cpu: "100m" - memory: "256Mi" + memory: "512Mi" limits: #cpu: "300m" memory: "512Mi" From 54a82177f25130a0263dc11bfa4783f05a74029e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 14 Jan 2025 21:43:53 +0000 Subject: [PATCH 0226/1058] Update file deployment.yaml --- master/bitwarden/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/bitwarden/templates/deployment.yaml b/master/bitwarden/templates/deployment.yaml index 7d9c28b..a992f38 100644 --- a/master/bitwarden/templates/deployment.yaml +++ b/master/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.internal.durp.info/vaultwarden/server:1.32.0 + image: registry.internal.durp.info/vaultwarden/server:1.32.7 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc From b47edf477b4225d7860cbc4d5f691212363e99b8 Mon Sep 17 00:00:00 2001 From: user Date: Wed, 15 Jan 2025 04:49:31 -0600 Subject: [PATCH 0227/1058] Add infra --- infra/argocd/Chart.yaml | 12 ++++++ infra/argocd/templates/argocd.yaml | 20 ++++++++++ infra/argocd/values.yaml | 62 ++++++++++++++++++++++++++++++ 3 files changed, 94 insertions(+) create mode 100644 infra/argocd/Chart.yaml create mode 100644 infra/argocd/templates/argocd.yaml create mode 100644 infra/argocd/values.yaml diff --git a/infra/argocd/Chart.yaml b/infra/argocd/Chart.yaml new file mode 100644 index 0000000..a2c346c --- /dev/null +++ b/infra/argocd/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: argocd +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: argo-cd + repository: https://argoproj.github.io/argo-helm + version: 6.11.1 diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml new file mode 100644 index 0000000..e2b106e --- /dev/null +++ b/infra/argocd/templates/argocd.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/argocd + destination: + namespace: argocd + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml new file mode 100644 index 0000000..47a56e3 --- /dev/null +++ b/infra/argocd/values.yaml @@ -0,0 +1,62 @@ +argo-cd: + + global: + revisionHistoryLimit: 1 + image: + repository: registry.internal.durp.info/argoproj/argocd + imagePullPolicy: Always + + server: + #extraArgs: + # - --dex-server-plaintext + # - --dex-server=argocd-dex-server:5556 + # oidc.config: | + # name: AzureAD + # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 + # clientID: CLIENT_ID + # clientSecret: $oidc.azuread.clientSecret + # requestedIDTokenClaims: + # groups: + # essential: true + # requestedScopes: + # - openid + # - profile + # - email + + dex: + enabled: true + image: + repository: registry.internal.durp.info/dexidp/dex + imagePullPolicy: Always + + configs: + cm: + create: true + annotations: {} + url: https://argocd.internal.durp.info + oidc.tls.insecure.skip.verify: "true" + dex.config: | + connectors: + - config: + issuer: https://authentik.durp.info/application/o/argocd/ + clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625 + clientSecret: $client-secret:clientSecret + insecureEnableGroups: true + scopes: + - openid + - profile + - email + - groups + name: authentik + type: oidc + id: authentik + + rbac: + create: true + policy.csv: | + g, ArgoCD Admins, role:admin + scopes: "[groups]" + + server: + route: + enabled: false From f8899caf7841552681b117563bb25d44f9742561 Mon Sep 17 00:00:00 2001 From: user Date: Wed, 15 Jan 2025 05:12:37 -0600 Subject: [PATCH 0228/1058] update --- infra/argocd/templates/argocd.yaml | 20 +++ infra/argocd/templates/longhorn.yaml | 21 +++ infra/longhorn/Chart.yaml | 12 ++ infra/longhorn/templates/ingress.yaml | 41 ++++++ infra/longhorn/templates/secrets.yaml | 23 +++ infra/longhorn/values.yaml | 195 ++++++++++++++++++++++++++ 6 files changed, 312 insertions(+) create mode 100644 infra/argocd/templates/longhorn.yaml create mode 100644 infra/longhorn/Chart.yaml create mode 100644 infra/longhorn/templates/ingress.yaml create mode 100644 infra/longhorn/templates/secrets.yaml create mode 100644 infra/longhorn/values.yaml diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index e2b106e..af5d266 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -18,3 +18,23 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true + +--- + +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: vault-argocd +# labels: +# app.kubernetes.io/part-of: argocd +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: client-secret +# data: +# - secretKey: clientSecret +# remoteRef: +# key: secrets/argocd/authentik +# property: clientsecret diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml new file mode 100644 index 0000000..9690120 --- /dev/null +++ b/infra/argocd/templates/longhorn.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: longhorn-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/longhorn + destination: + namespace: longhorn-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/longhorn/Chart.yaml b/infra/longhorn/Chart.yaml new file mode 100644 index 0000000..85720ac --- /dev/null +++ b/infra/longhorn/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: longhorn-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: longhorn + repository: https://charts.longhorn.io + version: 1.7.2 diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml new file mode 100644 index 0000000..84b973b --- /dev/null +++ b/infra/longhorn/templates/ingress.yaml @@ -0,0 +1,41 @@ +#apiVersion: traefik.containo.us/v1alpha1 +#kind: IngressRoute +#metadata: +# name: longhorn-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: whitelist +# namespace: traefik +# - name: authentik-proxy-provider +# namespace: traefik +# kind: Rule +# services: +# - name: longhorn-frontend +# port: 80 +# - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) +# kind: Rule +# services: +# - name: ak-outpost-authentik-embedded-outpost +# namespace: authentik +# port: 9000 +# tls: +# secretName: longhorn-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: longhorn-tls +#spec: +# secretName: longhorn-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "longhorn.internal.durp.info" +# dnsNames: +# - "longhorn.internal.durp.info" diff --git a/infra/longhorn/templates/secrets.yaml b/infra/longhorn/templates/secrets.yaml new file mode 100644 index 0000000..d7cb88b --- /dev/null +++ b/infra/longhorn/templates/secrets.yaml @@ -0,0 +1,23 @@ +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: external-longhorn-backup-token-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: longhorn-backup-token-secret +# data: +# - secretKey: AWS_ACCESS_KEY_ID +# remoteRef: +# key: secrets/longhorn/backup +# property: AWS_ACCESS_KEY_ID +# - secretKey: AWS_ENDPOINTS +# remoteRef: +# key: secrets/longhorn/backup +# property: AWS_ENDPOINTS +# - secretKey: AWS_SECRET_ACCESS_KEY +# remoteRef: +# key: secrets/longhorn/backup +# property: AWS_SECRET_ACCESS_KEY diff --git a/infra/longhorn/values.yaml b/infra/longhorn/values.yaml new file mode 100644 index 0000000..e3e609c --- /dev/null +++ b/infra/longhorn/values.yaml @@ -0,0 +1,195 @@ +longhorn: + global: + cattle: + systemDefaultRegistry: "" + + image: + longhorn: + engine: + repository: longhornio/longhorn-engine + manager: + repository: longhornio/longhorn-manager + ui: + repository: longhornio/longhorn-ui + instanceManager: + repository: longhornio/longhorn-instance-manager + shareManager: + repository: longhornio/longhorn-share-manager + backingImageManager: + repository: longhornio/backing-image-manager + csi: + attacher: + repository: longhornio/csi-attacher + provisioner: + repository: longhornio/csi-provisioner + nodeDriverRegistrar: + repository: longhornio/csi-node-driver-registrar + resizer: + repository: longhornio/csi-resizer + snapshotter: + repository: longhornio/csi-snapshotter + pullPolicy: Always + + service: + ui: + type: ClusterIP + nodePort: null + manager: + type: ClusterIP + nodePort: "" + loadBalancerIP: "" + loadBalancerSourceRanges: "" + + persistence: + defaultClass: true + defaultFsType: ext4 + defaultClassReplicaCount: 3 + defaultDataLocality: disabled # best-effort otherwise + reclaimPolicy: Retain + migratable: false + recurringJobSelector: + enable: true + jobList: '[ + { + "name":"backup", + "task":"backup", + "cron":"0 0 * * ?", + "retain":24 + } + ]' + backingImage: + enable: false + name: ~ + dataSourceType: ~ + dataSourceParameters: ~ + expectedChecksum: ~ + + csi: + kubeletRootDir: ~ + attacherReplicaCount: ~ + provisionerReplicaCount: ~ + resizerReplicaCount: ~ + snapshotterReplicaCount: ~ + + defaultSettings: + backupTarget: S3://longhorn-infra@us-east-1/ + backupTargetCredentialSecret: longhorn-backup-token-secret + allowRecurringJobWhileVolumeDetached: ~ + createDefaultDiskLabeledNodes: ~ + defaultDataPath: ~ + defaultDataLocality: ~ + replicaSoftAntiAffinity: ~ + replicaAutoBalance: ~ + storageOverProvisioningPercentage: ~ + storageMinimalAvailablePercentage: ~ + upgradeChecker: ~ + defaultReplicaCount: ~ + defaultLonghornStaticStorageClass: longhorn + backupstorePollInterval: ~ + taintToleration: ~ + systemManagedComponentsNodeSelector: ~ + priorityClass: ~ + autoSalvage: ~ + autoDeletePodWhenVolumeDetachedUnexpectedly: ~ + disableSchedulingOnCordonedNode: ~ + replicaZoneSoftAntiAffinity: ~ + nodeDownPodDeletionPolicy: ~ + allowNodeDrainWithLastHealthyReplica: ~ + mkfsExt4Parameters: ~ + disableReplicaRebuild: ~ + replicaReplenishmentWaitInterval: ~ + concurrentReplicaRebuildPerNodeLimit: ~ + disableRevisionCounter: ~ + systemManagedPodsImagePullPolicy: ~ + allowVolumeCreationWithDegradedAvailability: ~ + autoCleanupSystemGeneratedSnapshot: ~ + concurrentAutomaticEngineUpgradePerNodeLimit: ~ + backingImageCleanupWaitInterval: ~ + backingImageRecoveryWaitInterval: ~ + guaranteedEngineManagerCPU: ~ + guaranteedReplicaManagerCPU: ~ + kubernetesClusterAutoscalerEnabled: ~ + orphanAutoDeletion: ~ + storageNetwork: ~ + privateRegistry: + createSecret: ~ + registryUrl: ~ + registryUser: ~ + registryPasswd: ~ + registrySecret: ~ + + longhornManager: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornDriver: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornUI: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + # + + ingress: + enabled: false + + # Configure a pod security policy in the Longhorn namespace to allow privileged pods + enablePSP: true + + ## Specify override namespace, specifically this is useful for using longhorn as sub-chart + ## and its release namespace is not the `longhorn-system` + namespaceOverride: "" + + # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional. + annotations: {} + + serviceAccount: + # Annotations to add to the service account + annotations: {} + From 41cc7889afb2c2d7d3efb095c8ff7b0ce89276ca Mon Sep 17 00:00:00 2001 From: user Date: Wed, 15 Jan 2025 05:15:41 -0600 Subject: [PATCH 0229/1058] ujpdate --- infra/longhorn/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/longhorn/Chart.yaml b/infra/longhorn/Chart.yaml index 85720ac..e7b37ee 100644 --- a/infra/longhorn/Chart.yaml +++ b/infra/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.7.2 + version: 1.7.1 From e7c28dde45396b1e7c5895ed9dd1d04ff0721782 Mon Sep 17 00:00:00 2001 From: user Date: Wed, 15 Jan 2025 05:18:13 -0600 Subject: [PATCH 0230/1058] update --- infra/longhorn/Chart.yaml | 2 +- infra/longhorn/values.yaml | 3 --- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/infra/longhorn/Chart.yaml b/infra/longhorn/Chart.yaml index e7b37ee..85720ac 100644 --- a/infra/longhorn/Chart.yaml +++ b/infra/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.7.1 + version: 1.7.2 diff --git a/infra/longhorn/values.yaml b/infra/longhorn/values.yaml index e3e609c..5dec749 100644 --- a/infra/longhorn/values.yaml +++ b/infra/longhorn/values.yaml @@ -179,9 +179,6 @@ longhorn: ingress: enabled: false - # Configure a pod security policy in the Longhorn namespace to allow privileged pods - enablePSP: true - ## Specify override namespace, specifically this is useful for using longhorn as sub-chart ## and its release namespace is not the `longhorn-system` namespaceOverride: "" From 0c27dd360cb808ab0b0ec97a2b169b7fca82f1ab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 15 Jan 2025 05:41:59 -0600 Subject: [PATCH 0231/1058] add traefik to infra --- infra/traefik/Chart.yaml | 11 +++++++++ infra/traefik/values.yaml | 47 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 infra/traefik/Chart.yaml create mode 100644 infra/traefik/values.yaml diff --git a/infra/traefik/Chart.yaml b/infra/traefik/Chart.yaml new file mode 100644 index 0000000..30f96ac --- /dev/null +++ b/infra/traefik/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: traefik +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: traefik + repository: https://traefik.github.io/charts + version: 34.0.0 diff --git a/infra/traefik/values.yaml b/infra/traefik/values.yaml new file mode 100644 index 0000000..3d2576e --- /dev/null +++ b/infra/traefik/values.yaml @@ -0,0 +1,47 @@ +traefik: + image: + registry: registry.durp.info + repository: traefik + pullPolicy: Always + + deployment: + replicas: 3 + revisionHistoryLimit: 1 + + ingressRoute: + dashboard: + enabled: true + + additionalArguments: + - "--serversTransport.insecureSkipVerify=true" + - "--log.level=DEBUG" + - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin + - --experimental.plugins.jwt.version=v0.7.0 + + autoscaling: + enabled: true + minReplicas: 3 + maxReplicas: 10 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 60 + + + # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container. + resources: + requests: + cpu: "100m" + memory: "512Mi" + limits: + memory: "512Mi" From e36610cd49474c7d8b66e315d80d8dbac0ae9d63 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 15 Jan 2025 05:42:45 -0600 Subject: [PATCH 0232/1058] update --- infra/argocd/templates/traefik.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 infra/argocd/templates/traefik.yaml diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml new file mode 100644 index 0000000..ee8ba60 --- /dev/null +++ b/infra/argocd/templates/traefik.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: traefik + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/traefik + destination: + namespace: traefik + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From f8d02295804148e69b720ac6d8defa2322292bb6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 15 Jan 2025 05:46:40 -0600 Subject: [PATCH 0233/1058] add metallb --- infra/argocd/templates/metallb-system.yaml | 21 +++++++++++++++++++++ infra/metallb-system/Chart.yaml | 12 ++++++++++++ infra/metallb-system/templates/config.yaml | 17 +++++++++++++++++ infra/metallb-system/values.yaml | 0 4 files changed, 50 insertions(+) create mode 100644 infra/argocd/templates/metallb-system.yaml create mode 100644 infra/metallb-system/Chart.yaml create mode 100644 infra/metallb-system/templates/config.yaml create mode 100644 infra/metallb-system/values.yaml diff --git a/infra/argocd/templates/metallb-system.yaml b/infra/argocd/templates/metallb-system.yaml new file mode 100644 index 0000000..4bf695a --- /dev/null +++ b/infra/argocd/templates/metallb-system.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/metallb-system + destination: + namespace: metallb-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/metallb-system/Chart.yaml b/infra/metallb-system/Chart.yaml new file mode 100644 index 0000000..4fc684f --- /dev/null +++ b/infra/metallb-system/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.14.9 diff --git a/infra/metallb-system/templates/config.yaml b/infra/metallb-system/templates/config.yaml new file mode 100644 index 0000000..e44285d --- /dev/null +++ b/infra/metallb-system/templates/config.yaml @@ -0,0 +1,17 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap +spec: + addresses: + - 192.168.20.130-192.168.20.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: poop + namespace: metallb-system +spec: + ipAddressPools: + - cheap + diff --git a/infra/metallb-system/values.yaml b/infra/metallb-system/values.yaml new file mode 100644 index 0000000..e69de29 From 1966f141dc5a0666a5c9a23d941d96669197691d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 15 Jan 2025 05:47:05 -0600 Subject: [PATCH 0234/1058] update config --- infra/metallb-system/templates/config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/metallb-system/templates/config.yaml b/infra/metallb-system/templates/config.yaml index e44285d..457130f 100644 --- a/infra/metallb-system/templates/config.yaml +++ b/infra/metallb-system/templates/config.yaml @@ -4,12 +4,12 @@ metadata: name: cheap spec: addresses: - - 192.168.20.130-192.168.20.140 + - 192.168.12.130-192.168.12.140 --- apiVersion: metallb.io/v1beta1 kind: L2Advertisement metadata: - name: poop + name: pool namespace: metallb-system spec: ipAddressPools: From f5ceac3ec1a89ab88d3e174caff24cecefb6f880 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 15 Jan 2025 06:00:30 -0600 Subject: [PATCH 0235/1058] add vault --- infra/argocd/templates/vault.yaml | 21 +++++++++++++++++++++ infra/vault/Chart.yaml | 12 ++++++++++++ infra/vault/values.yaml | 25 +++++++++++++++++++++++++ 3 files changed, 58 insertions(+) create mode 100644 infra/argocd/templates/vault.yaml create mode 100644 infra/vault/Chart.yaml create mode 100644 infra/vault/values.yaml diff --git a/infra/argocd/templates/vault.yaml b/infra/argocd/templates/vault.yaml new file mode 100644 index 0000000..3c1ae11 --- /dev/null +++ b/infra/argocd/templates/vault.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/vault + destination: + namespace: vault + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/vault/Chart.yaml b/infra/vault/Chart.yaml new file mode 100644 index 0000000..e52029e --- /dev/null +++ b/infra/vault/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: vault +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: vault + repository: https://helm.releases.hashicorp.com + version: 0.29.1 + diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml new file mode 100644 index 0000000..0fceb68 --- /dev/null +++ b/infra/vault/values.yaml @@ -0,0 +1,25 @@ +vault: + server: + image: + repository: "hashicorp/vault" + pullPolicy: Always + + affinity: "" + ha: + enabled: true + replicas: 3 + raft: + enabled: true + setNodeId: true + config: | + cluster_name = "vault-integrated-storage" + storage "raft" { + path = "/vault/data/" + } + + listener "tcp" { + address = "[::]:8200" + cluster_address = "[::]:8201" + tls_disable = "true" + } + service_registration "kubernetes" {} From b6fa1079b6568d73a820dfd01894010390a0a555 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 15 Jan 2025 06:15:44 -0600 Subject: [PATCH 0236/1058] update --- infra/vault/values.yaml | 97 +++++++++++++++++++++++++++++++++++------ 1 file changed, 84 insertions(+), 13 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 0fceb68..30247f6 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -1,25 +1,96 @@ vault: + global: + enabled: true + tlsDisable: false + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 256Mi + cpu: 250m + server: - image: - repository: "hashicorp/vault" - pullPolicy: Always - - affinity: "" + # These Resource Limits are in line with node requirements in the + # Vault Reference Architecture for a Small Cluster + #resources: + # requests: + # memory: 8Gi + # cpu: 2000m + # limits: + # memory: 16Gi + # cpu: 2000m + + # For HA configuration and because we need to manually init the vault, + # we need to define custom readiness/liveness Probe settings + readinessProbe: + enabled: true + path: "/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204" + livenessProbe: + enabled: true + path: "/v1/sys/health?standbyok=true" + initialDelaySeconds: 60 + + # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be + # used to include variables required for auto-unseal. + extraEnvironmentVars: + VAULT_CACERT: /vault/userconfig/tls-ca/ca.crt + + # extraVolumes is a list of extra volumes to mount. These will be exposed + # to Vault in the path `/vault/userconfig//`. + extraVolumes: + - type: secret + name: tls-server + - type: secret + name: tls-ca + - type: secret + name: kms-creds + + # This configures the Vault Statefulset to create a PVC for audit logs. + # See https://www.vaultproject.io/docs/audit/index.html to know more + auditStorage: + enabled: true + + standalone: + enabled: false + + # Run Vault in "HA" mode. ha: enabled: true replicas: 3 raft: enabled: true setNodeId: true + config: | + ui = true cluster_name = "vault-integrated-storage" - storage "raft" { - path = "/vault/data/" + listener "tcp" { + address = "[::]:8200" + cluster_address = "[::]:8201" + tls_cert_file = "/vault/userconfig/tls-server/tls.crt" + tls_key_file = "/vault/userconfig/tls-server/tls.key" } - listener "tcp" { - address = "[::]:8200" - cluster_address = "[::]:8201" - tls_disable = "true" - } - service_registration "kubernetes" {} + storage "raft" { + path = "/vault/data" + retry_join { + leader_api_addr = "https://vault-0.vault-internal:8200" + leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt" + leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt" + leader_client_key_file = "/vault/userconfig/tls-server/tls.key" + } + retry_join { + leader_api_addr = "https://vault-1.vault-internal:8200" + leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt" + leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt" + leader_client_key_file = "/vault/userconfig/tls-server/tls.key" + } + } + + # Vault UI + ui: + enabled: true + serviceType: "LoadBalancer" + serviceNodePort: null + externalPort: 8200 From 4c2e87944c8de720861669f0d15acc9fca1ace41 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 16 Jan 2025 05:33:47 -0600 Subject: [PATCH 0237/1058] update cert --- infra/vault/values.yaml | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 30247f6..aa14869 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -11,6 +11,8 @@ vault: cpu: 250m server: + image: + repository: "hashicorp/vault" # These Resource Limits are in line with node requirements in the # Vault Reference Architecture for a Small Cluster #resources: @@ -34,17 +36,18 @@ vault: # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be # used to include variables required for auto-unseal. extraEnvironmentVars: - VAULT_CACERT: /vault/userconfig/tls-ca/ca.crt + VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca - # extraVolumes is a list of extra volumes to mount. These will be exposed - # to Vault in the path `/vault/userconfig//`. - extraVolumes: - - type: secret - name: tls-server - - type: secret - name: tls-ca - - type: secret - name: kms-creds + volumes: + - name: userconfig-vault-server-tls + secret: + defaultMode: 420 + secretName: vault-server-tls + + volumeMounts: + - mountPath: /vault/userconfig/vault-server-tls + name: userconfig-vault-server-tls + readOnly: true # This configures the Vault Statefulset to create a PVC for audit logs. # See https://www.vaultproject.io/docs/audit/index.html to know more @@ -68,23 +71,24 @@ vault: listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" - tls_cert_file = "/vault/userconfig/tls-server/tls.crt" - tls_key_file = "/vault/userconfig/tls-server/tls.key" + tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" + tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca" } storage "raft" { path = "/vault/data" retry_join { leader_api_addr = "https://vault-0.vault-internal:8200" - leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt" - leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt" - leader_client_key_file = "/vault/userconfig/tls-server/tls.key" + leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.ca" } retry_join { leader_api_addr = "https://vault-1.vault-internal:8200" - leader_ca_cert_file = "/vault/userconfig/tls-ca/ca.crt" - leader_client_cert_file = "/vault/userconfig/tls-server/tls.crt" - leader_client_key_file = "/vault/userconfig/tls-server/tls.key" + leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.ca" } } From f8f5f27cb0f8728389772647e58cfe72a9be695a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 16 Jan 2025 05:55:52 -0600 Subject: [PATCH 0238/1058] add ingress --- infra/argocd/templates/argocd.yaml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index af5d266..9041651 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -38,3 +38,27 @@ spec: # remoteRef: # key: secrets/argocd/authentik # property: clientsecret + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: argocd-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`argocd.infra.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: argocd-server + port: 443 + scheme: https + tls: + secretName: argocd-tls From 5089d01c067ce105f93b546f5dae6f4032125586 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 16 Jan 2025 05:59:15 -0600 Subject: [PATCH 0239/1058] update --- infra/argocd/templates/argocd.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 9041651..a104655 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -60,5 +60,5 @@ spec: - name: argocd-server port: 443 scheme: https - tls: - secretName: argocd-tls + #tls: + # secretName: argocd-tls From 82ad8815f297605dd0ae5282a91c557cf2a29bc6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 16 Jan 2025 06:00:29 -0600 Subject: [PATCH 0240/1058] update --- infra/argocd/templates/argocd.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index a104655..4886db4 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -52,9 +52,9 @@ spec: - websecure routes: - match: Host(`argocd.infra.durp.info`) - middlewares: - - name: whitelist - namespace: traefik + #middlewares: + # - name: whitelist + # namespace: traefik kind: Rule services: - name: argocd-server From 87dd7d3da014e7cb7a283fc5f747d7f42d2a2b27 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 08:47:39 -0600 Subject: [PATCH 0241/1058] update --- infra/vault/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index aa14869..72054ce 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -82,13 +82,13 @@ vault: leader_api_addr = "https://vault-0.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { leader_api_addr = "https://vault-1.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } } From a9789b1221d4864ab9e17c79f2d8c74172eafb85 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 08:51:53 -0600 Subject: [PATCH 0242/1058] update --- infra/longhorn/templates/ingress.yaml | 56 +++++++-------------------- 1 file changed, 15 insertions(+), 41 deletions(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index 84b973b..077c5e8 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -1,41 +1,15 @@ -#apiVersion: traefik.containo.us/v1alpha1 -#kind: IngressRoute -#metadata: -# name: longhorn-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: whitelist -# namespace: traefik -# - name: authentik-proxy-provider -# namespace: traefik -# kind: Rule -# services: -# - name: longhorn-frontend -# port: 80 -# - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) -# kind: Rule -# services: -# - name: ak-outpost-authentik-embedded-outpost -# namespace: authentik -# port: 9000 -# tls: -# secretName: longhorn-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: longhorn-tls -#spec: -# secretName: longhorn-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "longhorn.internal.durp.info" -# dnsNames: -# - "longhorn.internal.durp.info" +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: longhorn-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: longhorn-frontend + port: 80 + tls: + secretName: longhorn-tls From 535a47a8f2d80abf0bf924b81083cec8ff5604b6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 08:53:43 -0600 Subject: [PATCH 0243/1058] update --- infra/longhorn/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index 077c5e8..ee1683f 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: longhorn-ingress From 8e65ceca52ec85ae0c0d8747961d363e2d4e4da5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 09:03:53 -0600 Subject: [PATCH 0244/1058] update --- master/internalproxy/templates/infra.yaml | 63 +++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 master/internalproxy/templates/infra.yaml diff --git a/master/internalproxy/templates/infra.yaml b/master/internalproxy/templates/infra.yaml new file mode 100644 index 0000000..5c5c9f9 --- /dev/null +++ b/master/internalproxy/templates/infra.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: infra +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: infra +subsets: + - addresses: + - ip: 192.168.12.130 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: infra-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`*.infra.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: infra + port: 443 + scheme: https + tls: + secretName: infra-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: infra-tls +spec: + secretName: infra-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "infra.durp.info" + dnsNames: + - "*.infra.durp.info" From c956f88f435ebbc10edac6f2fd96bd7a332bc5a6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 09:07:29 -0600 Subject: [PATCH 0245/1058] update --- master/internalproxy/templates/infra.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/master/internalproxy/templates/infra.yaml b/master/internalproxy/templates/infra.yaml index 5c5c9f9..51f6a91 100644 --- a/master/internalproxy/templates/infra.yaml +++ b/master/internalproxy/templates/infra.yaml @@ -36,9 +36,6 @@ spec: - websecure routes: - match: Host(`*.infra.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik kind: Rule services: - name: infra From ba198114917a2f903506f4d9881f5dca0b0970df Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 09:26:11 -0600 Subject: [PATCH 0246/1058] update --- infra/vault/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 72054ce..5c83ba8 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -79,13 +79,13 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "https://vault-0.vault-internal:8200" + leader_api_addr = "https://vault-0:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "https://vault-1.vault-internal:8200" + leader_api_addr = "https://vault-1:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From b3c020d810829b504108c7968dc651c304445499 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 09:33:00 -0600 Subject: [PATCH 0247/1058] update --- infra/vault/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 5c83ba8..bb3bff2 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -79,13 +79,13 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "https://vault-0:8200" + leader_api_addr = "https://vault-0.vault.svc.cluster.local:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "https://vault-1:8200" + leader_api_addr = "https://vault-1.vault.svc.cluster.local:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From 7dc22c2051002bc17766d862c04b9c369db59521 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 13:10:58 -0600 Subject: [PATCH 0248/1058] update --- infra/vault/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index bb3bff2..72054ce 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -79,13 +79,13 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "https://vault-0.vault.svc.cluster.local:8200" + leader_api_addr = "https://vault-0.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "https://vault-1.vault.svc.cluster.local:8200" + leader_api_addr = "https://vault-1.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From 7a6313f716ff4cddd416860035c92dc0b66c5de4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 13:12:27 -0600 Subject: [PATCH 0249/1058] update --- infra/vault/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 72054ce..f34c83b 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -79,13 +79,13 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "https://vault-0.vault-internal:8200" + leader_api_addr = "http://vault-0.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "https://vault-1.vault-internal:8200" + leader_api_addr = "http://vault-1.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From f0fd21ec863f219c4a5bc93d0ffbf4a2320fd883 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 13:15:32 -0600 Subject: [PATCH 0250/1058] update --- infra/vault/values.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index f34c83b..9e01b2e 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -73,19 +73,18 @@ vault: cluster_address = "[::]:8201" tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" - tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca" } storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "http://vault-0.vault-internal:8200" + leader_api_addr = "https://vault-0.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "http://vault-1.vault-internal:8200" + leader_api_addr = "https://vault-1.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From 709def73de9178e652721400a952e502c90faedd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 13:25:12 -0600 Subject: [PATCH 0251/1058] update --- infra/vault/templates/ingress.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 infra/vault/templates/ingress.yaml diff --git a/infra/vault/templates/ingress.yaml b/infra/vault/templates/ingress.yaml new file mode 100644 index 0000000..406263a --- /dev/null +++ b/infra/vault/templates/ingress.yaml @@ -0,0 +1,18 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: vault-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`vault.infra.durp.info`) + kind: Rule + services: + - name: vault + port: 8200 + scheme: https + tls: + secretName: vault-tls From 1c4624104a49044d575121ba1bb6f106ef5bd410 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 19 Jan 2025 13:51:52 -0600 Subject: [PATCH 0252/1058] update --- infra/vault/values.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 9e01b2e..fd06921 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -89,6 +89,12 @@ vault: leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } + retry_join { + leader_api_addr = "https://vault-2.vault-internal:8200" + leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" + } } # Vault UI From 98994596523cd3f6f03b57aad00e9cdfd91125e9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 20 Jan 2025 05:01:13 -0600 Subject: [PATCH 0253/1058] update --- infra/vault/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index fd06921..2d2988c 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -73,6 +73,7 @@ vault: cluster_address = "[::]:8201" tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" + tls_disable = "true" } storage "raft" { From 5acce59cd18b0be317904a615445fa7ce7044452 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 20 Jan 2025 05:03:31 -0600 Subject: [PATCH 0254/1058] update --- infra/vault/templates/ingress.yaml | 2 +- infra/vault/values.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/vault/templates/ingress.yaml b/infra/vault/templates/ingress.yaml index 406263a..bcb849e 100644 --- a/infra/vault/templates/ingress.yaml +++ b/infra/vault/templates/ingress.yaml @@ -13,6 +13,6 @@ spec: services: - name: vault port: 8200 - scheme: https + scheme: http tls: secretName: vault-tls diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 2d2988c..1aed970 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -79,19 +79,19 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "https://vault-0.vault-internal:8200" + leader_api_addr = "http://vault-0.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "https://vault-1.vault-internal:8200" + leader_api_addr = "http://vault-1.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "https://vault-2.vault-internal:8200" + leader_api_addr = "http://vault-2.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From a398e63650570621e6b5908b6c8225f4d99d6015 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 04:58:11 -0600 Subject: [PATCH 0255/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 1aed970..4460c75 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -59,7 +59,7 @@ vault: # Run Vault in "HA" mode. ha: - enabled: true + enabled: false replicas: 3 raft: enabled: true From 03d69a40a081b18eaa1e3dfbec119b0115c19be2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:00:25 -0600 Subject: [PATCH 0256/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 4460c75..4209d2a 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -55,7 +55,7 @@ vault: enabled: true standalone: - enabled: false + enabled: true # Run Vault in "HA" mode. ha: From c3110978c749a87aaae1791ac3ca0f9163f0ef0d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:01:41 -0600 Subject: [PATCH 0257/1058] update --- infra/longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/longhorn/values.yaml b/infra/longhorn/values.yaml index 5dec749..27d855f 100644 --- a/infra/longhorn/values.yaml +++ b/infra/longhorn/values.yaml @@ -45,7 +45,7 @@ longhorn: defaultFsType: ext4 defaultClassReplicaCount: 3 defaultDataLocality: disabled # best-effort otherwise - reclaimPolicy: Retain + reclaimPolicy: Delete migratable: false recurringJobSelector: enable: true From d18d64f0eb81cb5a4e3de0100ae1ebd5f9242698 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:02:56 -0600 Subject: [PATCH 0258/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 4209d2a..6701448 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -62,7 +62,7 @@ vault: enabled: false replicas: 3 raft: - enabled: true + enabled: false setNodeId: true config: | From 685dcde9c3cd852b313dbec7f58731c71a365e73 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:12:47 -0600 Subject: [PATCH 0259/1058] update --- infra/vault/values.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 6701448..88fddab 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -75,6 +75,14 @@ vault: tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" tls_disable = "true" } + + seal "transit" { + address = "http://192.168.20.253:8201" + disable_renewal = "false" + key_name = "autounseal" + mount_path = "transit/" + tls_skip_verify = "true" + } storage "raft" { path = "/vault/data" From b45a04349e9f176b9726b48235637ec0d199926d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:36:24 -0600 Subject: [PATCH 0260/1058] update --- infra/vault/values.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 88fddab..c342265 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -56,6 +56,25 @@ vault: standalone: enabled: true + + config: | + ui = true + cluster_name = "vault-integrated-storage" + listener "tcp" { + address = "[::]:8200" + cluster_address = "[::]:8201" + tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" + tls_disable = "true" + } + + seal "transit" { + address = "http://192.168.20.253:8201" + disable_renewal = "false" + key_name = "autounseal" + mount_path = "transit/" + tls_skip_verify = "true" + } # Run Vault in "HA" mode. ha: From 1490ef6c5ec0199a254f80a3cee26d578b3c3561 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:40:38 -0600 Subject: [PATCH 0261/1058] update --- infra/vault/values.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index c342265..2ac6eb2 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -58,13 +58,11 @@ vault: enabled: true config: | + disable_mlock = true ui = true - cluster_name = "vault-integrated-storage" listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" - tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" tls_disable = "true" } @@ -75,6 +73,11 @@ vault: mount_path = "transit/" tls_skip_verify = "true" } + + storage "raft" { + path = "./vault/vault-0" + node_id = "vault-0" + } # Run Vault in "HA" mode. ha: From 985a29193650505a6c531b29d22ad3f2ef55efe1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:42:08 -0600 Subject: [PATCH 0262/1058] update --- infra/vault/values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 2ac6eb2..dd1a187 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -75,8 +75,7 @@ vault: } storage "raft" { - path = "./vault/vault-0" - node_id = "vault-0" + path = "/vault/data" } # Run Vault in "HA" mode. From 2c8321d9b1d815164c6d903a0d1738ae81e17152 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 21 Jan 2025 05:51:57 -0600 Subject: [PATCH 0263/1058] update --- infra/vault/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index dd1a187..2ecc7cf 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -37,6 +37,11 @@ vault: # used to include variables required for auto-unseal. extraEnvironmentVars: VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca + + extraSecretEnvironmentVars: + - envName: VAULT_TOKEN + secretName: autounseal + secretKey: VAULT_TOKEN volumes: - name: userconfig-vault-server-tls From 622114aacecbdf7183f1e2977600c79033dd351f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 05:38:10 -0600 Subject: [PATCH 0264/1058] update --- infra/vault/values.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 2ecc7cf..4426ec7 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -1,7 +1,7 @@ vault: global: enabled: true - tlsDisable: false + tlsDisable: true resources: requests: memory: 256Mi @@ -68,7 +68,6 @@ vault: listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" - tls_disable = "true" } seal "transit" { @@ -99,7 +98,6 @@ vault: cluster_address = "[::]:8201" tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" - tls_disable = "true" } seal "transit" { From b50e31d42da8866fc39baa3e09e8d7e72c1d4503 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 05:39:28 -0600 Subject: [PATCH 0265/1058] update --- infra/vault/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 4426ec7..b4ccc66 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -68,6 +68,8 @@ vault: listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" + tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" } seal "transit" { From e17ffa9f3f22f4de02dc516ea7f0db392e3aa904 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 05:40:34 -0600 Subject: [PATCH 0266/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index b4ccc66..78c165a 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -1,7 +1,7 @@ vault: global: enabled: true - tlsDisable: true + tlsDisable: false resources: requests: memory: 256Mi From 61eb2cb68e917ffdb7c739d69b7f4229ba6574e8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 05:41:34 -0600 Subject: [PATCH 0267/1058] update --- infra/vault/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/templates/ingress.yaml b/infra/vault/templates/ingress.yaml index bcb849e..406263a 100644 --- a/infra/vault/templates/ingress.yaml +++ b/infra/vault/templates/ingress.yaml @@ -13,6 +13,6 @@ spec: services: - name: vault port: 8200 - scheme: http + scheme: https tls: secretName: vault-tls From 881de48183be62045aa8ad28b888e3e551e3aa69 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 05:42:15 -0600 Subject: [PATCH 0268/1058] move back to HA --- infra/vault/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 78c165a..c964ba8 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -60,7 +60,7 @@ vault: enabled: true standalone: - enabled: true + enabled: false config: | disable_mlock = true @@ -86,10 +86,10 @@ vault: # Run Vault in "HA" mode. ha: - enabled: false + enabled: true replicas: 3 raft: - enabled: false + enabled: true setNodeId: true config: | From a47fe24d519bc28cd4efccf83190af864f3309d6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 05:43:12 -0600 Subject: [PATCH 0269/1058] update --- infra/vault/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index c964ba8..e29d050 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -113,19 +113,19 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "http://vault-0.vault-internal:8200" + leader_api_addr = "https://vault-0.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "http://vault-1.vault-internal:8200" + leader_api_addr = "https://vault-1.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "http://vault-2.vault-internal:8200" + leader_api_addr = "https://vault-2.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From b4f701c084b38117beba93938837046a4a9b7e36 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 06:12:57 -0600 Subject: [PATCH 0270/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index e29d050..db52a67 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -103,7 +103,7 @@ vault: } seal "transit" { - address = "http://192.168.20.253:8201" + address = "https://192.168.20.253:8201" disable_renewal = "false" key_name = "autounseal" mount_path = "transit/" From 547ef2ffbc7458c81febebf8a0b8bff0b9f4b6aa Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 06:21:04 -0600 Subject: [PATCH 0271/1058] update --- infra/vault/values.yaml | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index db52a67..2410ddc 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -1,7 +1,7 @@ vault: global: enabled: true - tlsDisable: false + tlsDisable: true resources: requests: memory: 256Mi @@ -68,8 +68,6 @@ vault: listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" - tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" } seal "transit" { @@ -98,8 +96,6 @@ vault: listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" - tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" } seal "transit" { @@ -113,22 +109,14 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "https://vault-0.vault-internal:8200" - leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" - leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" + leader_api_addr = "http://vault-0.vault-internal:8200" + tls_skip_verify = "true" } retry_join { - leader_api_addr = "https://vault-1.vault-internal:8200" - leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" - leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" + leader_api_addr = "http://vault-1.vault-internal:8200" } retry_join { - leader_api_addr = "https://vault-2.vault-internal:8200" - leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" - leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" - leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" + leader_api_addr = "http://vault-2.vault-internal:8200" } } From 08ca20b874de8dc6a57c31c73f37903d4a33c68b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 06:22:56 -0600 Subject: [PATCH 0272/1058] update --- infra/vault/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 2410ddc..0ec7f9c 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -35,8 +35,8 @@ vault: # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be # used to include variables required for auto-unseal. - extraEnvironmentVars: - VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca + extraEnvironmentVars: [] + #VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca extraSecretEnvironmentVars: - envName: VAULT_TOKEN From 7588fa3279de5cd05a848a3bd0afbe1131a5c491 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 06:23:42 -0600 Subject: [PATCH 0273/1058] update --- infra/vault/values.yaml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 0ec7f9c..949389f 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -35,7 +35,7 @@ vault: # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be # used to include variables required for auto-unseal. - extraEnvironmentVars: [] + #extraEnvironmentVars: #VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca extraSecretEnvironmentVars: @@ -43,16 +43,16 @@ vault: secretName: autounseal secretKey: VAULT_TOKEN - volumes: - - name: userconfig-vault-server-tls - secret: - defaultMode: 420 - secretName: vault-server-tls + #volumes: + # - name: userconfig-vault-server-tls + # secret: + # defaultMode: 420 + # secretName: vault-server-tls - volumeMounts: - - mountPath: /vault/userconfig/vault-server-tls - name: userconfig-vault-server-tls - readOnly: true + #volumeMounts: + # - mountPath: /vault/userconfig/vault-server-tls + # name: userconfig-vault-server-tls + # readOnly: true # This configures the Vault Statefulset to create a PVC for audit logs. # See https://www.vaultproject.io/docs/audit/index.html to know more From 37640bd4208626f0996405716ce6db2f6a74606e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Jan 2025 06:26:29 -0600 Subject: [PATCH 0274/1058] update --- infra/vault/values.yaml | 36 +++++++++++++++++++++++------------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 949389f..ad1ff42 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -35,24 +35,24 @@ vault: # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be # used to include variables required for auto-unseal. - #extraEnvironmentVars: - #VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca + extraEnvironmentVars: + VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca extraSecretEnvironmentVars: - envName: VAULT_TOKEN secretName: autounseal secretKey: VAULT_TOKEN - #volumes: - # - name: userconfig-vault-server-tls - # secret: - # defaultMode: 420 - # secretName: vault-server-tls + volumes: + - name: userconfig-vault-server-tls + secret: + defaultMode: 420 + secretName: vault-server-tls - #volumeMounts: - # - mountPath: /vault/userconfig/vault-server-tls - # name: userconfig-vault-server-tls - # readOnly: true + volumeMounts: + - mountPath: /vault/userconfig/vault-server-tls + name: userconfig-vault-server-tls + readOnly: true # This configures the Vault Statefulset to create a PVC for audit logs. # See https://www.vaultproject.io/docs/audit/index.html to know more @@ -96,10 +96,12 @@ vault: listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" + tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" } seal "transit" { - address = "https://192.168.20.253:8201" + address = "http://192.168.20.253:8201" disable_renewal = "false" key_name = "autounseal" mount_path = "transit/" @@ -110,13 +112,21 @@ vault: path = "/vault/data" retry_join { leader_api_addr = "http://vault-0.vault-internal:8200" - tls_skip_verify = "true" + leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { leader_api_addr = "http://vault-1.vault-internal:8200" + leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { leader_api_addr = "http://vault-2.vault-internal:8200" + leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" + leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } } From 4087eb7aaf52c7aa7136a0b5941b076e339c852f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 Jan 2025 05:13:24 -0600 Subject: [PATCH 0275/1058] update --- master/internalproxy/templates/vault.yaml | 63 +++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 master/internalproxy/templates/vault.yaml diff --git a/master/internalproxy/templates/vault.yaml b/master/internalproxy/templates/vault.yaml new file mode 100644 index 0000000..88a7471 --- /dev/null +++ b/master/internalproxy/templates/vault.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: root-vault +spec: + ports: + - name: app + port: 8201 + protocol: TCP + targetPort: 8201 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: root-vault +subsets: + - addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 8201 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: root-vault-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`root-vault.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: root-vault + port: 8201 + scheme: https + tls: + secretName: root-vault-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: root-vault-tls +spec: + secretName: root-vault-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "root-vault.internal.durp.info" + dnsNames: + - "root-vault.internal.durp.info" From 91001c230e989220b9dfe95e02e62e0544fce98a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 Jan 2025 05:55:55 -0600 Subject: [PATCH 0276/1058] update --- infra/vault/values.yaml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index ad1ff42..408c7d6 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -60,7 +60,7 @@ vault: enabled: true standalone: - enabled: false + enabled: true config: | disable_mlock = true @@ -68,10 +68,12 @@ vault: listener "tcp" { address = "[::]:8200" cluster_address = "[::]:8201" + tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" + tls_key_file = "/vault/userconfig/vault-server-tls/vault.key" } seal "transit" { - address = "http://192.168.20.253:8201" + address = "https://root-vault.internal.durp.info" disable_renewal = "false" key_name = "autounseal" mount_path = "transit/" @@ -84,10 +86,10 @@ vault: # Run Vault in "HA" mode. ha: - enabled: true + enabled: false replicas: 3 raft: - enabled: true + enabled: false setNodeId: true config: | @@ -101,7 +103,7 @@ vault: } seal "transit" { - address = "http://192.168.20.253:8201" + address = "https://192.168.20.253:8201" disable_renewal = "false" key_name = "autounseal" mount_path = "transit/" @@ -111,19 +113,19 @@ vault: storage "raft" { path = "/vault/data" retry_join { - leader_api_addr = "http://vault-0.vault-internal:8200" + leader_api_addr = "https://vault-0.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "http://vault-1.vault-internal:8200" + leader_api_addr = "https://vault-1.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" } retry_join { - leader_api_addr = "http://vault-2.vault-internal:8200" + leader_api_addr = "https://vault-2.vault-internal:8200" leader_ca_cert_file = "/vault/userconfig/vault-server-tls/vault.ca" leader_client_cert_file = "/vault/userconfig/vault-server-tls/vault.crt" leader_client_key_file = "/vault/userconfig/vault-server-tls/vault.key" From 09d140bb643809a063ff910a38b4c3926233e06a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 Jan 2025 05:56:26 -0600 Subject: [PATCH 0277/1058] update --- infra/vault/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 408c7d6..5b23a84 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -60,7 +60,7 @@ vault: enabled: true standalone: - enabled: true + enabled: false config: | disable_mlock = true @@ -86,10 +86,10 @@ vault: # Run Vault in "HA" mode. ha: - enabled: false + enabled: true replicas: 3 raft: - enabled: false + enabled: true setNodeId: true config: | From f9096df6583c71a11f26de97eb3e7621a9114739 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 Jan 2025 06:05:24 -0600 Subject: [PATCH 0278/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 5b23a84..7acb498 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -1,7 +1,7 @@ vault: global: enabled: true - tlsDisable: true + tlsDisable: false resources: requests: memory: 256Mi From f1333aa0eecd5f11da637f4a3f84336a71954d71 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 Jan 2025 15:36:31 -0600 Subject: [PATCH 0279/1058] update --- master/internalproxy/templates/redlib.yaml | 70 ++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 master/internalproxy/templates/redlib.yaml diff --git a/master/internalproxy/templates/redlib.yaml b/master/internalproxy/templates/redlib.yaml new file mode 100644 index 0000000..4aef445 --- /dev/null +++ b/master/internalproxy/templates/redlib.yaml @@ -0,0 +1,70 @@ +apiVersion: v1 +kind: Service +metadata: + name: redlib +spec: + ports: + - name: app + port: 8082 + protocol: TCP + targetPort: 8082 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: redlib +subsets: +- addresses: + - ip: 192.168.20.253 + ports: + - name: app + port: 8082 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: redlib-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`redlib.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: redlib + port: 8082 + - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: redlib-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: redlib-tls +spec: + secretName: redlib-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "redlib.durp.info" + dnsNames: + - "redlib.durp.info" From cdd9419cff10489c7afc8a74784f5839c63b7869 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 23 Jan 2025 15:36:53 -0600 Subject: [PATCH 0280/1058] update --- master/internalproxy/templates/redlib.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/master/internalproxy/templates/redlib.yaml b/master/internalproxy/templates/redlib.yaml index 4aef445..90a3b54 100644 --- a/master/internalproxy/templates/redlib.yaml +++ b/master/internalproxy/templates/redlib.yaml @@ -37,8 +37,6 @@ spec: routes: - match: Host(`redlib.durp.info`) && PathPrefix(`/`) middlewares: - - name: whitelist - namespace: traefik - name: authentik-proxy-provider namespace: traefik kind: Rule From c5077c097d1e4417b480ed428d4ded3bf4675072 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 24 Jan 2025 04:56:01 -0600 Subject: [PATCH 0281/1058] update --- infra/argocd/templates/external-secrets.yaml | 21 + infra/external-secrets/Chart.yaml | 11 + infra/external-secrets/values.yaml | 463 +++++++++++++++++++ 3 files changed, 495 insertions(+) create mode 100644 infra/argocd/templates/external-secrets.yaml create mode 100644 infra/external-secrets/Chart.yaml create mode 100644 infra/external-secrets/values.yaml diff --git a/infra/argocd/templates/external-secrets.yaml b/infra/argocd/templates/external-secrets.yaml new file mode 100644 index 0000000..a78c6b3 --- /dev/null +++ b/infra/argocd/templates/external-secrets.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/external-secrets + destination: + namespace: external-secrets + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/external-secrets/Chart.yaml b/infra/external-secrets/Chart.yaml new file mode 100644 index 0000000..d89a403 --- /dev/null +++ b/infra/external-secrets/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-secrets + repository: https://charts.external-secrets.io + version: 0.13.0 diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml new file mode 100644 index 0000000..a720adb --- /dev/null +++ b/infra/external-secrets/values.yaml @@ -0,0 +1,463 @@ +external-secrets: + replicaCount: 3 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: Always + # -- The image tag to use. The default is the chart appVersion. + # There are different image flavours available, like distroless and ubi. + # Please see GitHub release notes for image tags for these flavors. + # By default the distroless image is used. + tag: "" + + # -- If set, install and upgrade CRDs through helm chart. + installCRDs: true + + crds: + # -- If true, create CRDs for Cluster External Secret. + createClusterExternalSecret: true + # -- If true, create CRDs for Cluster Secret Store. + createClusterSecretStore: true + # -- If true, create CRDs for Push Secret. + createPushSecret: true + annotations: {} + conversion: + enabled: true + + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + + # -- If true, external-secrets will perform leader election between instances to ensure no more + # than one instance of external-secrets operates at a time. + leaderElect: true + + # -- If set external secrets will filter matching + # Secret Stores with the appropriate controller values. + controllerClass: "" + + # -- If true external secrets will use recommended kubernetes + # annotations as prometheus metric labels. + extendedMetricLabels: false + + # -- If set external secrets are only reconciled in the + # provided namespace + scopedNamespace: "" + + # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace + # and implicitly disable cluster stores and cluster external secrets + scopedRBAC: false + + # -- if true, the operator will process cluster external secret. Else, it will ignore them. + processClusterExternalSecret: true + + # -- if true, the operator will process cluster store. Else, it will ignore them. + processClusterStore: true + + # -- Specifies whether an external secret operator deployment be created. + createOperator: true + + # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at + # a time. + concurrent: 1 + + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + ## -- Extra containers to add to the pod. + extraContainers: [] + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- namespace where you want to install ServiceMonitors + namespace: "" + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + # -- Let prometheus add an exported_ prefix to conflicting labels + honorLabels: false + + # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) + metricRelabelings: [] + # - action: replace + # regex: (.*) + # replacement: $1 + # sourceLabels: + # - exported_namespace + # targetLabel: namespace + + # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) + relabelings: [] + # - sourceLabels: [__meta_kubernetes_pod_node_name] + # separator: ; + # regex: ^(.*)$ + # targetLabel: nodename + # replacement: $1 + # action: replace + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + + # -- Run the controller on the host network + hostNetwork: false + + webhook: + # -- Specifies whether a webhook deployment be created. + create: true + # -- Specifices the time to check if the cert is valid + certCheckInterval: "5m" + # -- Specifices the lookaheadInterval for certificate validity + lookaheadInterval: "" + replicaCount: 1 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + certDir: /tmp/certs + # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore + failurePolicy: Fail + # -- Specifies if webhook pod should use hostNetwork or not. + hostNetwork: false + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: IfNotPresent + # -- The image tag to use. The default is the chart appVersion. + tag: "" + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + # -- The port the webhook will listen to + port: 10250 + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + + readinessProbe: + # -- Address for readiness probe + address: "" + # -- ReadinessProbe port for kubelet + port: 8081 + + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + # -- Annotations to add to Secret + secretAnnotations: {} + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + certController: + # -- Specifies whether a certificate controller deployment be created. + create: true + requeueInterval: "5m" + replicaCount: 1 + + # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) + revisionHistoryLimit: 10 + + image: + repository: ghcr.io/external-secrets/external-secrets + pullPolicy: Always + tag: "" + imagePullSecrets: [] + nameOverride: "" + fullnameOverride: "" + rbac: + # -- Specifies whether role and rolebinding resources should be created. + create: true + serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Automounts the service account token in all containers of the pod + automount: true + # -- Annotations to add to the service account. + annotations: {} + # -- Extra Labels to add to the service account. + extraLabels: {} + # -- The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template. + name: "" + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # -- Run the certController on the host network + hostNetwork: false + + # -- Pod priority class name. + priorityClassName: "" + + # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ + podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 1 + + prometheus: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + enabled: false + service: + # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead + port: 8080 + + serviceMonitor: + # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics + enabled: false + + # -- Additional labels + additionalLabels: {} + + # -- Interval to scrape metrics + interval: 30s + + # -- Timeout if metrics can't be retrieved in given time interval + scrapeTimeout: 25s + + metrics: + service: + # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics + enabled: false + + # -- Metrics service port to scrape + port: 8080 + + # -- Additional service annotations + annotations: {} + + ## -- Extra environment variables to add to container. + extraEnv: [] + + ## -- Map of extra arguments to pass to container. + extraArgs: {} + + + ## -- Extra volumes to pass to pod. + extraVolumes: [] + + ## -- Extra volumes to mount to the container. + extraVolumeMounts: [] + + # -- Annotations to add to Deployment + deploymentAnnotations: {} + + # -- Annotations to add to Pod + podAnnotations: {} + + podLabels: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + + resources: {} + # requests: + # cpu: 10m + # memory: 32Mi + + # -- Specifies `dnsOptions` to deployment + dnsConfig: {} From 9276abe7cc16c85a5abd5f8f8c7ae32f38bb8e39 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 24 Jan 2025 05:06:33 -0600 Subject: [PATCH 0282/1058] update --- infra/external-secrets/values.yaml | 467 ++---------------------- infra/vault/templates/secret-store.yaml | 14 + 2 files changed, 38 insertions(+), 443 deletions(-) create mode 100644 infra/vault/templates/secret-store.yaml diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index a720adb..93900c1 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -1,463 +1,44 @@ external-secrets: replicaCount: 3 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 + revisionHistoryLimit: 1 image: repository: ghcr.io/external-secrets/external-secrets pullPolicy: Always - # -- The image tag to use. The default is the chart appVersion. - # There are different image flavours available, like distroless and ubi. - # Please see GitHub release notes for image tags for these flavors. - # By default the distroless image is used. - tag: "" - # -- If set, install and upgrade CRDs through helm chart. - installCRDs: true - - crds: - # -- If true, create CRDs for Cluster External Secret. - createClusterExternalSecret: true - # -- If true, create CRDs for Cluster Secret Store. - createClusterSecretStore: true - # -- If true, create CRDs for Push Secret. - createPushSecret: true - annotations: {} - conversion: - enabled: true - - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - - # -- If true, external-secrets will perform leader election between instances to ensure no more - # than one instance of external-secrets operates at a time. - leaderElect: true - - # -- If set external secrets will filter matching - # Secret Stores with the appropriate controller values. - controllerClass: "" - - # -- If true external secrets will use recommended kubernetes - # annotations as prometheus metric labels. - extendedMetricLabels: false - - # -- If set external secrets are only reconciled in the - # provided namespace - scopedNamespace: "" - - # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace - # and implicitly disable cluster stores and cluster external secrets - scopedRBAC: false - - # -- if true, the operator will process cluster external secret. Else, it will ignore them. - processClusterExternalSecret: true - - # -- if true, the operator will process cluster store. Else, it will ignore them. - processClusterStore: true - - # -- Specifies whether an external secret operator deployment be created. - createOperator: true - - # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at - # a time. - concurrent: 1 - - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - ## -- Extra containers to add to the pod. - extraContainers: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- namespace where you want to install ServiceMonitors - namespace: "" - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - # -- Let prometheus add an exported_ prefix to conflicting labels - honorLabels: false - - # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) - metricRelabelings: [] - # - action: replace - # regex: (.*) - # replacement: $1 - # sourceLabels: - # - exported_namespace - # targetLabel: namespace - - # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) - relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # targetLabel: nodename - # replacement: $1 - # action: replace - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - # -- Run the controller on the host network - hostNetwork: false + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m webhook: - # -- Specifies whether a webhook deployment be created. - create: true - # -- Specifices the time to check if the cert is valid - certCheckInterval: "5m" - # -- Specifices the lookaheadInterval for certificate validity - lookaheadInterval: "" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - certDir: /tmp/certs - # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore - failurePolicy: Fail - # -- Specifies if webhook pod should use hostNetwork or not. - hostNetwork: false image: repository: ghcr.io/external-secrets/external-secrets - pullPolicy: IfNotPresent - # -- The image tag to use. The default is the chart appVersion. - tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - # -- The port the webhook will listen to - port: 10250 - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} + pullPolicy: Always - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - - readinessProbe: - # -- Address for readiness probe - address: "" - # -- ReadinessProbe port for kubelet - port: 8081 - - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Secret - secretAnnotations: {} - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m certController: - # -- Specifies whether a certificate controller deployment be created. - create: true - requeueInterval: "5m" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 + revisionHistoryLimit: 1 image: repository: ghcr.io/external-secrets/external-secrets pullPolicy: Always tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Run the certController on the host network - hostNetwork: false - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - # -- Specifies `dnsOptions` to deployment - dnsConfig: {} + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml new file mode 100644 index 0000000..39c5104 --- /dev/null +++ b/infra/vault/templates/secret-store.yaml @@ -0,0 +1,14 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: vault +spec: + provider: + vault: + server: "https://vault.vault.svc.cluster.local:8200" + path: "secrets" + version: "v2" + auth: + kubernetes: + mountPath: "kubernetes" + role: "external-secrets" From 7a3567144f35f59c9b3bff146ed82302d97660a8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 24 Jan 2025 05:28:37 -0600 Subject: [PATCH 0283/1058] update --- infra/external-secrets/templates/ca.yaml | 6 ++++++ infra/external-secrets/values.yaml | 11 +++++++++++ 2 files changed, 17 insertions(+) create mode 100644 infra/external-secrets/templates/ca.yaml diff --git a/infra/external-secrets/templates/ca.yaml b/infra/external-secrets/templates/ca.yaml new file mode 100644 index 0000000..9ce5692 --- /dev/null +++ b/infra/external-secrets/templates/ca.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +data: + vault.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K +kind: Secret +metadata: + name: ca-pemstore diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 93900c1..96e464f 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -6,6 +6,17 @@ external-secrets: repository: ghcr.io/external-secrets/external-secrets pullPolicy: Always + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true + resources: requests: memory: 32Mi From 058d4c943f93c2f66c667c796b5c775f0783216b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 24 Jan 2025 05:33:05 -0600 Subject: [PATCH 0284/1058] update --- infra/external-secrets/templates/ca.yaml | 79 +++++++++++++++++++++++- 1 file changed, 77 insertions(+), 2 deletions(-) diff --git a/infra/external-secrets/templates/ca.yaml b/infra/external-secrets/templates/ca.yaml index 9ce5692..9b2a135 100644 --- a/infra/external-secrets/templates/ca.yaml +++ b/infra/external-secrets/templates/ca.yaml @@ -1,6 +1,81 @@ apiVersion: v1 data: - vault.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K -kind: Secret + vault.pem: | + -----BEGIN CERTIFICATE----- + MIIEszCCA5ugAwIBAgIUZEzzxqEuYiKHkL1df+Cb22NRRJMwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzIyMzQ0MloXDTM1MDEy + MTExMTU1NVowIDEeMBwGA1UEAxMVdmF1bHQuaW5mcmEuZHVycC5pbmZvMIIBIjAN + BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkZM0ue4bMcmmATs+kGYSpR2hLUzq + scGIwCtqmaKCMbd1xhmgjnIR3zvSRptLR2GVGvc1ti6qby0jXYvcqbxkHvay00zW + 2zYN+M2m4lXpuWzg1t6NEoO6XGAsGj2v0vcVktPPU9uj0rGUVGWWfsvjoXqQFg5I + jdxsxK9SvMvw2XtE3FgKxpzCyw94InIHlcPwFTO+3ZdKStZlMbUDIkmszLBrWFcr + XOsPDfLxqMy0Ck//LKIt8djh3254FHB1GG5+kI+JSW1o+tUcL2NymvIINwm/2acS + 1uTm+j9W7iEXav0pJNmm+/dzSskc3Y0ftM0h2HCXgitBIaEZnUVneNHOLwIDAQAB + o4IB7zCCAeswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O + BBYEFCaQ2q7j7LyBGETEZ5qaJAdlISKCMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2 + dfBMWVYeWrQ2MIH0BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6 + Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFo + dHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3Nw + MDEGCCsGAQUFBzAChiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtp + L2NhMDsGCCsGAQUFBzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVy + cC5pbmZvL3YxL3BraS9jYTAgBgNVHREEGTAXghV2YXVsdC5pbmZyYS5kdXJwLmlu + Zm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAx + L3YxL3BraS9jcmwwNqA0oDKGMGh0dHBzOi8vcm9vdC12YXVsdC5pbnRlcm5hbC5k + dXJwLmluZm8vdjEvcGtpL2NybDANBgkqhkiG9w0BAQsFAAOCAQEAuJ+lplY/+A5L + 5LzkljbKDTy3U6PLv1LtxqVCOFGiJXBnXMjtVW07bBEUadzFRNW8GHQ3w5QzOG6k + /vE/TrrJho7l05J/uc+BUrPSNjefLmQV6hn4jrP86PR0vzRfbSqKKBIID9M7+zi6 + GFvHlVkSHsQyMQp7JOoax9KVzW2Y+OIgw7Lgw2tP122WCt2SIF0QenoZHsoW0guj + tzTJRmJDjn6XeJ7L3FPkf37H6ub0Jg3zBGr6eorEFfYZNN5CXezjqMFBpRdq4UIo + 1M3A7o3uyZFcFsp/vGDcMBkwaCsBV9idu/HwkvGaTUNI285ilBORPD0bMZnACq/9 + +Q/cdsO5lg== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIEmzCCA4OgAwIBAgIUQwCAs82sgSuiaVbjANHScO2DSfAwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMjEyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEAn9fjGRqqFsqguz56X6cXZwEMtD9wElwSFCb4Fc8YTzlH + 4fV13QwXKESLE/Q+7bw4y4FJQ8BiGNbxxbQOOgWhfGGlQyFa1lfhJtYLfqRN5C2/ + S7nr0YxDB9duc4OAExVL6Pr4/Koc+vDZY03l7RzwnF2AOM9DjFTASw01TphCQjRk + U+upiN2TUhUPejV/gMR+zXM6pn98UBKG1dNubS0HzAMwAEXAPm141NDyWUCPT9+3 + 6P03Ka8mUTx3X49OCtvJEGEQbtlnTFQaOSkP1yLW+XRMHw3sQaV2PWXu5fInbEpZ + +SuzmgLOXtmQNmHLav9q1qeTVkpBGPWvfh2Vh1JJhQIDAQABo4IB4zCCAd8wDgYD + VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJaP17f1Zw0V + 55Ks9Uf0USVWl0BPMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2dfBMWVYeWrQ2MIH0 + BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6Ly8xOTIuMTY4LjIw + LjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFodHRwczovL3Jvb3Qt + dmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3NwMDEGCCsGAQUFBzAC + hiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtpL2NhMDsGCCsGAQUF + BzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3Br + aS9jYTAUBgNVHREEDTALgglkdXJwLmluZm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0 + cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9jcmwwNqA0oDKGMGh0dHBz + Oi8vcm9vdC12YXVsdC5pbnRlcm5hbC5kdXJwLmluZm8vdjEvcGtpL2NybDANBgkq + hkiG9w0BAQsFAAOCAQEAiqAZ4zNIEkCWcvpDRq0VyJuk59sVtJr5X4FscHQ179nE + QbbvMe+EBDFS6XQml1Elj8jiPa/D5O9Oc6Iisnm5+weZKwApz/lQ+XVkWLCoEplB + ZZ9fcWVCbMLt0xlt8qn5z/mYKfbCT7ZCqDO+prQZt+ADJcQbiknfroAAqEbNKxwN + Y9uUyOWNF3SxJEch4w2dtX+IEVmxeZnhMy8OuP0SQKl8aW40ugiG0ZD5yTBBfOD9 + zsrGSU/iSatn0b7bevBhaL96hz1/rNR1cL+4/albX2hrr8Rv3/SB2DLtNQlQW0ls + AfhXAqP5zL+Ytgf1Of/pVdgnhxrYUY7RKCSGY5Hagw== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIDLzCCAhegAwIBAgIUNHdvOzam2HPVdwXpMHUy4wl8ZRYwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMTUyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEA8XDTVEtRI3+k4yuvqVqfIiLRQJcXbmhfVtAeYk+5j9Ox + p1w9YHdnPLqLFrD1PzadjqYeAp/fwlEFfs6lqwoTS8S9vhaFqcgB57nVMb77dTBb + /08XHXOU6FPRjdFKm5QMpS7tn1XacPMy/o0bKqRREQeiuFDGVRyuF5PUgvWc1dvJ + l27JvvgYktgjfpNS4DlCxg4lGXT5abvaKf2hnr65egaIo/yRWN9wnvAzRiY7oci7 + GA1oKz87Yc1tfL2gcynrwccOOCF/eUKesJR1I6GXNkN/a1fcr+Ld9Z9NhHBtO+vE + N8DsZY+kG7DE3M4BCCTFUzllcYHjaW4HaF9vZW+PYwIDAQABo3kwdzAOBgNVHQ8B + Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7WMLIaSkU75CJHZ1 + 8ExZVh5atDYwHwYDVR0jBBgwFoAU7WMLIaSkU75CJHZ18ExZVh5atDYwFAYDVR0R + BA0wC4IJZHVycC5pbmZvMA0GCSqGSIb3DQEBCwUAA4IBAQAS/qUI/1Yv07xUTK5k + r93kC7GSPpmpkXIsfjChAl93sebN143fu70NUP74jjCc0Wkb8hRofGg10E+/24r1 + AI0KsLhzKzfIASxUVQAn8RTptLruaaPLboSA4MUZ8IB5y8Vy8E3/KtD0gD80j64Y + rm9XGHA0HTJHbPUTb/Rux2g0E7WtiyWSWH8mqzbegU8IrkM3eVT4+ylBE7YkfWDD + dw44sB71tfmDKpzWg6XQ6YMh0YfnyG1fYCj9LhuecNY9Uuo6cjDaAvkzMewWwqDx + Q2Ekas98Di6itCP8vET+gBDjeCc+XR6Hx6vzWmxlZhwDuxEKL1a2/DabUxJyMNzv + 55Fn + -----END CERTIFICATE----- +kind: ConfigMap metadata: name: ca-pemstore From 2de99e68120d96b9c891c1b252d46b8d6130ecd1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 04:55:55 -0600 Subject: [PATCH 0285/1058] update --- infra/vault/templates/secret-store.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 39c5104..a35d7cb 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -11,4 +11,6 @@ spec: auth: kubernetes: mountPath: "kubernetes" - role: "external-secrets" + role: "VaultSecretStore" + serviceAccountRef: + name: "vault" From 23356d2d3e5ce2fc7ce4af5a84d522fdf7b5dff7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:05:59 -0600 Subject: [PATCH 0286/1058] update --- infra/argocd/templates/cert-manager.yaml | 21 ++++++++++++++++ infra/cert-manager/Chart.yaml | 11 ++++++++ infra/cert-manager/templates/letsencrypt.yaml | 16 ++++++++++++ infra/cert-manager/templates/secretvault.yaml | 16 ++++++++++++ infra/cert-manager/vaules.yaml | 25 +++++++++++++++++++ 5 files changed, 89 insertions(+) create mode 100644 infra/argocd/templates/cert-manager.yaml create mode 100644 infra/cert-manager/Chart.yaml create mode 100644 infra/cert-manager/templates/letsencrypt.yaml create mode 100644 infra/cert-manager/templates/secretvault.yaml create mode 100644 infra/cert-manager/vaules.yaml diff --git a/infra/argocd/templates/cert-manager.yaml b/infra/argocd/templates/cert-manager.yaml new file mode 100644 index 0000000..68ac622 --- /dev/null +++ b/infra/argocd/templates/cert-manager.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/cert-manager + destination: + namespace: cert-manager + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/cert-manager/Chart.yaml b/infra/cert-manager/Chart.yaml new file mode 100644 index 0000000..ecf60fa --- /dev/null +++ b/infra/cert-manager/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.16.3 diff --git a/infra/cert-manager/templates/letsencrypt.yaml b/infra/cert-manager/templates/letsencrypt.yaml new file mode 100644 index 0000000..034ed9b --- /dev/null +++ b/infra/cert-manager/templates/letsencrypt.yaml @@ -0,0 +1,16 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml new file mode 100644 index 0000000..37a2e92 --- /dev/null +++ b/infra/cert-manager/templates/secretvault.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: secrets/cert-manager + property: cloudflare-api-token-secret + diff --git a/infra/cert-manager/vaules.yaml b/infra/cert-manager/vaules.yaml new file mode 100644 index 0000000..9834f5b --- /dev/null +++ b/infra/cert-manager/vaules.yaml @@ -0,0 +1,25 @@ +cert-manager: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-controller + pullPolicy: Always + installCRDs: true + replicaCount: 3 + extraArgs: + - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + - --dns01-recursive-nameservers-only + podDnsPolicy: None + podDnsConfig: + nameservers: + - "1.1.1.1" + - "1.0.0.1" + webhook: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-webhook + pullPolicy: Always + cainjector: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-cainjector + pullPolicy: Always From 950d5f79506886608cd5b1ef677c3079f03762d7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:12:47 -0600 Subject: [PATCH 0287/1058] update --- infra/cert-manager/vaules.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/infra/cert-manager/vaules.yaml b/infra/cert-manager/vaules.yaml index 9834f5b..a5faef2 100644 --- a/infra/cert-manager/vaules.yaml +++ b/infra/cert-manager/vaules.yaml @@ -1,4 +1,6 @@ cert-manager: + crds: + enabled: true image: registry: registry.internal.durp.info repository: jetstack/cert-manager-controller From 81ed14c3ee795e6ac16dd5340275efa4f0013aae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:14:13 -0600 Subject: [PATCH 0288/1058] update --- infra/cert-manager/templates/letsencrypt.yaml | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/infra/cert-manager/templates/letsencrypt.yaml b/infra/cert-manager/templates/letsencrypt.yaml index 034ed9b..7097c90 100644 --- a/infra/cert-manager/templates/letsencrypt.yaml +++ b/infra/cert-manager/templates/letsencrypt.yaml @@ -1,16 +1,16 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-production -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-production - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret +#apiVersion: cert-manager.io/v1 +#kind: ClusterIssuer +#metadata: +# name: letsencrypt-production +#spec: +# acme: +# server: https://acme-v02.api.letsencrypt.org/directory +# privateKeySecretRef: +# name: letsencrypt-production +# solvers: +# - dns01: +# cloudflare: +# email: developerdurp@durp.info +# apiTokenSecretRef: +# name: cloudflare-api-token-secret +# key: cloudflare-api-token-secret From 142254c94a047d85213cd30871558f1b755f2dc1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:16:19 -0600 Subject: [PATCH 0289/1058] update --- infra/cert-manager/templates/secretvault.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index 37a2e92..a9f9b02 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -6,6 +6,7 @@ spec: secretStoreRef: name: vault kind: ClusterSecretStore + namespace: vault target: name: cloudflare-api-token-secret data: From f9789374550a6a1201dc895f263a056919941f09 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:26:32 -0600 Subject: [PATCH 0290/1058] update --- infra/cert-manager/templates/secretvault.yaml | 1 - infra/vault/templates/secret-store.yaml | 23 +++++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index a9f9b02..37a2e92 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -6,7 +6,6 @@ spec: secretStoreRef: name: vault kind: ClusterSecretStore - namespace: vault target: name: cloudflare-api-token-secret data: diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index a35d7cb..9c46d30 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -14,3 +14,26 @@ spec: role: "VaultSecretStore" serviceAccountRef: name: "vault" + +--- + +apiVersion: external-secrets.io/v1alpha1 +kind: SecretStore +metadata: + name: vault-backend + namespace: example +spec: + provider: + vault: + server: "https://vault.vault.svc.cluster.local:8200" + path: "secret" + version: "v2" + auth: + kubernetes: + mountPath: "kubernetes" + role: "demo" + serviceAccountRef: + name: "my-sa" + secretRef: + name: "my-secret" + key: "vault" From ad18535ce750d74bb5dcb7baeafb5dae51e04311 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:27:14 -0600 Subject: [PATCH 0291/1058] update --- infra/vault/templates/secret-store.yaml | 32 +++++++++++-------------- 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 9c46d30..545ed6c 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -17,23 +17,19 @@ spec: --- -apiVersion: external-secrets.io/v1alpha1 -kind: SecretStore +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret metadata: - name: vault-backend - namespace: example + name: cloudflare-api-token-secret spec: - provider: - vault: - server: "https://vault.vault.svc.cluster.local:8200" - path: "secret" - version: "v2" - auth: - kubernetes: - mountPath: "kubernetes" - role: "demo" - serviceAccountRef: - name: "my-sa" - secretRef: - name: "my-secret" - key: "vault" + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: secrets/cert-manager + property: cloudflare-api-token-secret + From d8ea4a907f2597f55f20aeab1a4bf043b214d83a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:28:59 -0600 Subject: [PATCH 0292/1058] update --- infra/vault/templates/secret-store.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 545ed6c..f681429 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -6,7 +6,7 @@ spec: provider: vault: server: "https://vault.vault.svc.cluster.local:8200" - path: "secrets" + path: "kv" version: "v2" auth: kubernetes: From f885ed4329f61be52d4f9dc4f9e30f06125abb14 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:33:07 -0600 Subject: [PATCH 0293/1058] update --- infra/vault/templates/secret-store.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index f681429..cb0178c 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -11,7 +11,7 @@ spec: auth: kubernetes: mountPath: "kubernetes" - role: "VaultSecretStore" + role: "vaultsecretstore" serviceAccountRef: name: "vault" From 7cae2987a42a651a821e8364da08ce8bdcd693ee Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:40:07 -0600 Subject: [PATCH 0294/1058] update --- infra/vault/templates/secret-store.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index cb0178c..375ef34 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -11,7 +11,7 @@ spec: auth: kubernetes: mountPath: "kubernetes" - role: "vaultsecretstore" + role: "secrets" serviceAccountRef: name: "vault" From edbfe65ce1183095b64b51dc87bec4e2a18a18cd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:43:10 -0600 Subject: [PATCH 0295/1058] update --- infra/vault/templates/secret-store.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 375ef34..042ec24 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -11,7 +11,7 @@ spec: auth: kubernetes: mountPath: "kubernetes" - role: "secrets" + role: "external-secrets" serviceAccountRef: name: "vault" From 4483c0a657617f0f7b694db33c221669b3375c2d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:44:50 -0600 Subject: [PATCH 0296/1058] update --- infra/vault/templates/secret-store.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 042ec24..f72c137 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -30,6 +30,6 @@ spec: data: - secretKey: cloudflare-api-token-secret remoteRef: - key: secrets/cert-manager + key: kv/cert-manager property: cloudflare-api-token-secret From d69480189b7081bbd0149f27595758a0ee80c403 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:45:44 -0600 Subject: [PATCH 0297/1058] update --- infra/cert-manager/templates/secretvault.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index 37a2e92..1ccba49 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -11,6 +11,6 @@ spec: data: - secretKey: cloudflare-api-token-secret remoteRef: - key: secrets/cert-manager + key: kv/cert-manager property: cloudflare-api-token-secret From 080cd1b3c132660e8c6faa17ff17e706930a2220 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:48:19 -0600 Subject: [PATCH 0298/1058] update --- infra/cert-manager/templates/secretvault.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index 1ccba49..f15a739 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -14,3 +14,9 @@ spec: key: kv/cert-manager property: cloudflare-api-token-secret +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault From 32bb9882e2dae621c8c67c6b2a3676346de40680 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:49:38 -0600 Subject: [PATCH 0299/1058] update --- infra/vault/templates/secret-store.yaml | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index f72c137..17f1690 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -14,22 +14,3 @@ spec: role: "external-secrets" serviceAccountRef: name: "vault" - ---- - -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cloudflare-api-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: cloudflare-api-token-secret - data: - - secretKey: cloudflare-api-token-secret - remoteRef: - key: kv/cert-manager - property: cloudflare-api-token-secret - From d48a2c406e478d0aa8472f06e46d932636248b65 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:49:49 -0600 Subject: [PATCH 0300/1058] update --- infra/cert-manager/templates/letsencrypt.yaml | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/infra/cert-manager/templates/letsencrypt.yaml b/infra/cert-manager/templates/letsencrypt.yaml index 7097c90..034ed9b 100644 --- a/infra/cert-manager/templates/letsencrypt.yaml +++ b/infra/cert-manager/templates/letsencrypt.yaml @@ -1,16 +1,16 @@ -#apiVersion: cert-manager.io/v1 -#kind: ClusterIssuer -#metadata: -# name: letsencrypt-production -#spec: -# acme: -# server: https://acme-v02.api.letsencrypt.org/directory -# privateKeySecretRef: -# name: letsencrypt-production -# solvers: -# - dns01: -# cloudflare: -# email: developerdurp@durp.info -# apiTokenSecretRef: -# name: cloudflare-api-token-secret -# key: cloudflare-api-token-secret +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret From 13e648043eed338188c6363f66cd62ef483193e3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:52:46 -0600 Subject: [PATCH 0301/1058] update --- infra/cert-manager/{vaules.yaml => values.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename infra/cert-manager/{vaules.yaml => values.yaml} (100%) diff --git a/infra/cert-manager/vaules.yaml b/infra/cert-manager/values.yaml similarity index 100% rename from infra/cert-manager/vaules.yaml rename to infra/cert-manager/values.yaml From 8eb26560e04260fd7868688659f51368415b3448 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 27 Jan 2025 05:53:46 -0600 Subject: [PATCH 0302/1058] update --- infra/cert-manager/values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/infra/cert-manager/values.yaml b/infra/cert-manager/values.yaml index a5faef2..c9cf12f 100644 --- a/infra/cert-manager/values.yaml +++ b/infra/cert-manager/values.yaml @@ -5,7 +5,6 @@ cert-manager: registry: registry.internal.durp.info repository: jetstack/cert-manager-controller pullPolicy: Always - installCRDs: true replicaCount: 3 extraArgs: - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 From 64396cd6e011944846399c04691b01a0d35565ba Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 28 Jan 2025 04:49:28 -0600 Subject: [PATCH 0303/1058] update --- infra/argocd/templates/vault.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/infra/argocd/templates/vault.yaml b/infra/argocd/templates/vault.yaml index 3c1ae11..26fa571 100644 --- a/infra/argocd/templates/vault.yaml +++ b/infra/argocd/templates/vault.yaml @@ -18,4 +18,8 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle From 2fda03d34e84900b64ffbf88c5457c89e8d0380e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 28 Jan 2025 04:54:07 -0600 Subject: [PATCH 0304/1058] update --- infra/external-secrets/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 96e464f..b38e22a 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -3,7 +3,7 @@ external-secrets: revisionHistoryLimit: 1 image: - repository: ghcr.io/external-secrets/external-secrets + repository: registry.internal.durp.info/external-secrets/external-secrets pullPolicy: Always extraVolumes: @@ -27,7 +27,7 @@ external-secrets: webhook: image: - repository: ghcr.io/external-secrets/external-secrets + repository: registry.internal.durp.info/external-secrets/external-secrets pullPolicy: Always resources: @@ -42,7 +42,7 @@ external-secrets: revisionHistoryLimit: 1 image: - repository: ghcr.io/external-secrets/external-secrets + repository: registry.internal.durp.info/external-secrets/external-secrets pullPolicy: Always tag: "" From e4a429d720aec431d9af89ee31b460b2e75721b8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 28 Jan 2025 05:46:04 -0600 Subject: [PATCH 0305/1058] update --- infra/argocd/values.yaml | 2 +- master/open-webui/templates/deployment.yaml | 4 ++-- master/open-webui/templates/pvc.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 47a56e3..6f35c67 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -55,7 +55,7 @@ argo-cd: create: true policy.csv: | g, ArgoCD Admins, role:admin - scopes: "[groups]" + scopes: "[groups server: route: diff --git a/master/open-webui/templates/deployment.yaml b/master/open-webui/templates/deployment.yaml index 7a51d0f..3bebbd5 100644 --- a/master/open-webui/templates/deployment.yaml +++ b/master/open-webui/templates/deployment.yaml @@ -32,6 +32,6 @@ spec: name: open-webui-secret key: OLLAMA_BASE_URL volumes: - - name: open-webui-pvc + - name: open-webui-pvc1 persistentVolumeClaim: - claimName: open-webui-pvc + claimName: open-webui-pvc1 diff --git a/master/open-webui/templates/pvc.yaml b/master/open-webui/templates/pvc.yaml index 63a3280..a7ba262 100644 --- a/master/open-webui/templates/pvc.yaml +++ b/master/open-webui/templates/pvc.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: PersistentVolumeClaim metadata: - name: open-webui-pvc + name: open-webui-pvc1 spec: storageClassName: longhorn accessModes: From 5a0a17b33f5cc5693e934cc2c54d57c317111541 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 28 Jan 2025 05:51:49 -0600 Subject: [PATCH 0306/1058] update --- master/open-webui/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/open-webui/templates/deployment.yaml b/master/open-webui/templates/deployment.yaml index 3bebbd5..c76ec24 100644 --- a/master/open-webui/templates/deployment.yaml +++ b/master/open-webui/templates/deployment.yaml @@ -20,7 +20,7 @@ spec: image: registry.internal.durp.info/open-webui/open-webui:main imagePullPolicy: Always volumeMounts: - - name: open-webui-pvc + - name: open-webui-pvc1 mountPath: /app/backend/data ports: - name: http From 0642f11a1a13fc9ee391f2c9dd8c62f2b7aed64c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Feb 2025 05:36:54 -0600 Subject: [PATCH 0307/1058] update --- infra/vault/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 7acb498..517c7ea 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -103,11 +103,11 @@ vault: } seal "transit" { - address = "https://192.168.20.253:8201" + address = "https://root-vault.internal.durp.info" disable_renewal = "false" key_name = "autounseal" mount_path = "transit/" - tls_skip_verify = "true" + tls_skip_verify = "false" } storage "raft" { From f7f3719a74f24290ad7f40e73dad5d12230f30e8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Feb 2025 05:37:44 -0600 Subject: [PATCH 0308/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 517c7ea..7a091e3 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -107,7 +107,7 @@ vault: disable_renewal = "false" key_name = "autounseal" mount_path = "transit/" - tls_skip_verify = "false" + tls_skip_verify = "true" } storage "raft" { From 60c66fa3f377a8a431f6e3abb5da5c70896de698 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Feb 2025 05:39:59 -0600 Subject: [PATCH 0309/1058] update --- master/traefik/templates/middlewares.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml index 6ed5f31..453ca61 100644 --- a/master/traefik/templates/middlewares.yaml +++ b/master/traefik/templates/middlewares.yaml @@ -30,8 +30,6 @@ metadata: spec: ipWhiteList: sourceRange: - - 192.168.20.0/24 + - 192.168.0.0/16 + - 172.16.0.0/12 - 10.0.0.0/8 - - 192.168.30.0/24 - - 192.168.130.0/24 - - 192.168.131.0/24 From 27cadcf8ce41f13cd06a8c2ee4c6dd1fe1611422 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Feb 2025 05:56:30 -0600 Subject: [PATCH 0310/1058] update --- master/littlelink/templates/deployment.yaml | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml index b713b86..4ea1d99 100644 --- a/master/littlelink/templates/deployment.yaml +++ b/master/littlelink/templates/deployment.yaml @@ -65,11 +65,13 @@ spec: - name : BIO value: Sup Nerd, - name : BUTTON_ORDER - value: GITHUB,GITLAB,YOUTUBE,TWITTER,COFFEE,EMAIL + value: GITHUB,GITLAB,YOUTUBE,TWITTER,BLUESKY,COFFEE,EMAIL - name : TWITTER value: https://twitter.com/developerdurp - name : GITHUB value: https://github.com/DeveloperDurp + - name: INSTAGRAM + value: https://instagram.com/developerdurp - name : GITLAB value: https://gitlab.com/developerdurp - name: YOUTUBE @@ -81,17 +83,17 @@ spec: - name : FOOTER value: DeveloperDurp © 2022 - name: CUSTOM_BUTTON_TEXT - value: BuyMeACoffee + value: BuyMeACoffee,BlueSky - name: CUSTOM_BUTTON_URL - value: https://www.buymeacoffee.com/DeveloperDurp + value: https://www.buymeacoffee.com/DeveloperDurp,https://bsky.app/profile/durp.info - name: CUSTOM_BUTTON_COLOR - value: '#ffdd00' + value: '#ffdd00,#ffdd00' - name: CUSTOM_BUTTON_TEXT_COLOR - value: '#000000' + value: '#000000,#000000' - name: CUSTOM_BUTTON_ALT_TEXT - value: Support + value: Support,BlueSky - name: CUSTOM_BUTTON_NAME - value: COFFEE + value: COFFEE,BLUESKY - name: CUSTOM_BUTTON_ICON value: fa-solid fa-cup-togo ports: From 0ee046914af425ca50c20443dcbe41272e30f0c1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Feb 2025 06:00:28 -0600 Subject: [PATCH 0311/1058] update --- master/littlelink/templates/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml index 4ea1d99..93561a9 100644 --- a/master/littlelink/templates/deployment.yaml +++ b/master/littlelink/templates/deployment.yaml @@ -65,7 +65,7 @@ spec: - name : BIO value: Sup Nerd, - name : BUTTON_ORDER - value: GITHUB,GITLAB,YOUTUBE,TWITTER,BLUESKY,COFFEE,EMAIL + value: GITHUB,GITLAB,YOUTUBE,INSTAGRAM,TWITTER,BLUESKY,COFFEE,EMAIL - name : TWITTER value: https://twitter.com/developerdurp - name : GITHUB @@ -89,7 +89,7 @@ spec: - name: CUSTOM_BUTTON_COLOR value: '#ffdd00,#ffdd00' - name: CUSTOM_BUTTON_TEXT_COLOR - value: '#000000,#000000' + value: '#000000,#1185fe' - name: CUSTOM_BUTTON_ALT_TEXT value: Support,BlueSky - name: CUSTOM_BUTTON_NAME From 6830296715a3b4b75dbce652842f65e09781b9b2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Feb 2025 06:01:01 -0600 Subject: [PATCH 0312/1058] update --- master/littlelink/templates/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml index 93561a9..7e082b3 100644 --- a/master/littlelink/templates/deployment.yaml +++ b/master/littlelink/templates/deployment.yaml @@ -87,9 +87,9 @@ spec: - name: CUSTOM_BUTTON_URL value: https://www.buymeacoffee.com/DeveloperDurp,https://bsky.app/profile/durp.info - name: CUSTOM_BUTTON_COLOR - value: '#ffdd00,#ffdd00' + value: '#ffdd00,#1185fe' - name: CUSTOM_BUTTON_TEXT_COLOR - value: '#000000,#1185fe' + value: '#000000,#000000' - name: CUSTOM_BUTTON_ALT_TEXT value: Support,BlueSky - name: CUSTOM_BUTTON_NAME From 31437ce7bfd0d965c78feb5984186d1517163dfd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Feb 2025 06:01:54 -0600 Subject: [PATCH 0313/1058] update --- master/littlelink/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml index 7e082b3..ec9ab4d 100644 --- a/master/littlelink/templates/deployment.yaml +++ b/master/littlelink/templates/deployment.yaml @@ -89,7 +89,7 @@ spec: - name: CUSTOM_BUTTON_COLOR value: '#ffdd00,#1185fe' - name: CUSTOM_BUTTON_TEXT_COLOR - value: '#000000,#000000' + value: '#000000,#FFFFFF' - name: CUSTOM_BUTTON_ALT_TEXT value: Support,BlueSky - name: CUSTOM_BUTTON_NAME From f87e727b4006175cba2285ca9ed9cebf3f7091ea Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Feb 2025 19:02:07 -0600 Subject: [PATCH 0314/1058] update --- infra/longhorn/templates/secrets.yaml | 46 +++++++++++++-------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/infra/longhorn/templates/secrets.yaml b/infra/longhorn/templates/secrets.yaml index d7cb88b..8bbe2fa 100644 --- a/infra/longhorn/templates/secrets.yaml +++ b/infra/longhorn/templates/secrets.yaml @@ -1,23 +1,23 @@ -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: external-longhorn-backup-token-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: longhorn-backup-token-secret -# data: -# - secretKey: AWS_ACCESS_KEY_ID -# remoteRef: -# key: secrets/longhorn/backup -# property: AWS_ACCESS_KEY_ID -# - secretKey: AWS_ENDPOINTS -# remoteRef: -# key: secrets/longhorn/backup -# property: AWS_ENDPOINTS -# - secretKey: AWS_SECRET_ACCESS_KEY -# remoteRef: -# key: secrets/longhorn/backup -# property: AWS_SECRET_ACCESS_KEY +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: external-longhorn-backup-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: longhorn-backup-token-secret + data: + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + key: kv/longhorn/backup + property: AWS_ACCESS_KEY_ID + - secretKey: AWS_ENDPOINTS + remoteRef: + key: kv/longhorn/backup + property: AWS_ENDPOINTS + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + key: kv/longhorn/backup + property: AWS_SECRET_ACCESS_KEY From 14da96a2a969c4ed439cae2c5b24e6afa5cb4c3c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Feb 2025 19:03:58 -0600 Subject: [PATCH 0315/1058] update --- infra/longhorn/templates/secrets.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/infra/longhorn/templates/secrets.yaml b/infra/longhorn/templates/secrets.yaml index 8bbe2fa..5acb5c1 100644 --- a/infra/longhorn/templates/secrets.yaml +++ b/infra/longhorn/templates/secrets.yaml @@ -1,3 +1,10 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- + apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: From f3d914e308b64e086f9222c93ac60741ea988b3e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Feb 2025 19:26:49 -0600 Subject: [PATCH 0316/1058] update --- infra/longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/longhorn/values.yaml b/infra/longhorn/values.yaml index 27d855f..9e41b42 100644 --- a/infra/longhorn/values.yaml +++ b/infra/longhorn/values.yaml @@ -53,7 +53,7 @@ longhorn: { "name":"backup", "task":"backup", - "cron":"0 0 * * ?", + "cron":"0 0 * * *", "retain":24 } ]' From 7f774c7dbd450562657afa6ddfc8607d7d6c76ea Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:14:04 -0600 Subject: [PATCH 0317/1058] update --- infra/longhorn/templates/ingress.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index ee1683f..c540b9d 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -2,6 +2,8 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: longhorn-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production spec: entryPoints: - websecure @@ -12,4 +14,4 @@ spec: - name: longhorn-frontend port: 80 tls: - secretName: longhorn-tls + secretName: longhorn-tls \ No newline at end of file From 23edb4e2cc5acc23d38b13e15c73d17745c5451f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:14:44 -0600 Subject: [PATCH 0318/1058] update --- infra/argocd/templates/argocd.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 4886db4..2042fd1 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -60,5 +60,5 @@ spec: - name: argocd-server port: 443 scheme: https - #tls: - # secretName: argocd-tls + tls: + secretName: argocd-tls From a6f6f38769d49644c350e75d945a01dbd5c0a73f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:18:31 -0600 Subject: [PATCH 0319/1058] update --- infra/longhorn/templates/ingress.yaml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index c540b9d..412f930 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -14,4 +14,19 @@ spec: - name: longhorn-frontend port: 80 tls: - secretName: longhorn-tls \ No newline at end of file + secretName: longhorn-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-tls +spec: + secretName: longhorn-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "longhorn.infra.durp.info" + dnsNames: + - "longhorn.infra.durp.info" From 5ad335cc1e6686792496ee24055273166c35535f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:22:07 -0600 Subject: [PATCH 0320/1058] update --- infra/argocd/templates/argocd.yaml | 15 +++++++++++++++ infra/vault/templates/ingress.yaml | 15 +++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 2042fd1..3982501 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -62,3 +62,18 @@ spec: scheme: https tls: secretName: argocd-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-tls +spec: + secretName: longhorn-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "argocd.infra.durp.info" + dnsNames: + - "argocd.infra.durp.info" diff --git a/infra/vault/templates/ingress.yaml b/infra/vault/templates/ingress.yaml index 406263a..09e5d33 100644 --- a/infra/vault/templates/ingress.yaml +++ b/infra/vault/templates/ingress.yaml @@ -16,3 +16,18 @@ spec: scheme: https tls: secretName: vault-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-tls +spec: + secretName: longhorn-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "vault.infra.durp.info" + dnsNames: + - "vault.infra.durp.info" From 4f74f8d575e66b58d39b3a9070ae4f1b9af27879 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:26:53 -0600 Subject: [PATCH 0321/1058] update --- infra/vault/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/values.yaml b/infra/vault/values.yaml index 7a091e3..913df48 100644 --- a/infra/vault/values.yaml +++ b/infra/vault/values.yaml @@ -134,7 +134,7 @@ vault: # Vault UI ui: - enabled: true + enabled: false serviceType: "LoadBalancer" serviceNodePort: null externalPort: 8200 From 435533502bfa5ab8a215f129b6cb3af3bd72846f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:44:29 -0600 Subject: [PATCH 0322/1058] update --- infra/cert-manager/templates/vault-issuer.yaml | 15 +++++++++++++++ infra/vault/templates/sa.yaml | 4 ++++ infra/vault/templates/secret-store.yaml | 1 + 3 files changed, 20 insertions(+) create mode 100644 infra/cert-manager/templates/vault-issuer.yaml create mode 100644 infra/vault/templates/sa.yaml diff --git a/infra/cert-manager/templates/vault-issuer.yaml b/infra/cert-manager/templates/vault-issuer.yaml new file mode 100644 index 0000000..6fca7f6 --- /dev/null +++ b/infra/cert-manager/templates/vault-issuer.yaml @@ -0,0 +1,15 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: vault-issuer + namespace: sandbox +spec: + vault: + path: pki/sign/infra + server: https://vault.local + auth: + kubernetes: + role: vault-issuer-role + mountPath: /v1/auth/jwt-cluster001 + serviceAccountRef: + name: vault-issuer \ No newline at end of file diff --git a/infra/vault/templates/sa.yaml b/infra/vault/templates/sa.yaml new file mode 100644 index 0000000..e298701 --- /dev/null +++ b/infra/vault/templates/sa.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: issuer diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 17f1690..7882420 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -14,3 +14,4 @@ spec: role: "external-secrets" serviceAccountRef: name: "vault" + From 786c034ef636d8f3467178605724fa67a7061cdf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:46:19 -0600 Subject: [PATCH 0323/1058] update --- infra/cert-manager/templates/secretvault.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index f15a739..4a7bad8 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -6,6 +6,7 @@ spec: secretStoreRef: name: vault kind: ClusterSecretStore + namespace: vault target: name: cloudflare-api-token-secret data: From aabd349d60a4c8ee14fc0220563e4c7feb6c3093 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:47:35 -0600 Subject: [PATCH 0324/1058] update --- infra/cert-manager/templates/secretvault.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index 4a7bad8..f15a739 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -6,7 +6,6 @@ spec: secretStoreRef: name: vault kind: ClusterSecretStore - namespace: vault target: name: cloudflare-api-token-secret data: From 1019a69c778e0fabddc8eb5da9192221989692b5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 06:48:31 -0600 Subject: [PATCH 0325/1058] update --- infra/cert-manager/templates/vault-issuer.yaml | 15 --------------- 1 file changed, 15 deletions(-) delete mode 100644 infra/cert-manager/templates/vault-issuer.yaml diff --git a/infra/cert-manager/templates/vault-issuer.yaml b/infra/cert-manager/templates/vault-issuer.yaml deleted file mode 100644 index 6fca7f6..0000000 --- a/infra/cert-manager/templates/vault-issuer.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: vault-issuer - namespace: sandbox -spec: - vault: - path: pki/sign/infra - server: https://vault.local - auth: - kubernetes: - role: vault-issuer-role - mountPath: /v1/auth/jwt-cluster001 - serviceAccountRef: - name: vault-issuer \ No newline at end of file From 03befcb0f8b2b37d1b563a9314cd6cf5631fcdbd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Feb 2025 07:40:44 -0600 Subject: [PATCH 0326/1058] update --- infra/external-secrets/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index b38e22a..ffcd365 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -39,6 +39,7 @@ external-secrets: cpu: 10m certController: + create: false revisionHistoryLimit: 1 image: From 16411788759c39f3044820fa8b8f974afc19d6b1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Feb 2025 13:24:29 -0600 Subject: [PATCH 0327/1058] update --- infra/vault/templates/ingress.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/vault/templates/ingress.yaml b/infra/vault/templates/ingress.yaml index 09e5d33..73abf7e 100644 --- a/infra/vault/templates/ingress.yaml +++ b/infra/vault/templates/ingress.yaml @@ -22,9 +22,9 @@ spec: apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: longhorn-tls + name: vault-tls spec: - secretName: longhorn-tls + secretName: vault-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer From 9003f7f475dac6075bc327fb90998923349fbc23 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 11 Feb 2025 04:43:51 -0600 Subject: [PATCH 0328/1058] update --- infra/argocd/templates/argocd.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 3982501..98e2e30 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -15,9 +15,9 @@ spec: syncPolicy: automated: prune: true - selfHeal: true + selfHeal: true syncOptions: - - CreateNamespace=true + - CreateNamespace=true --- @@ -39,7 +39,7 @@ spec: # key: secrets/argocd/authentik # property: clientsecret ---- +--- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -68,12 +68,12 @@ spec: apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: longhorn-tls + name: argocd-tls spec: - secretName: longhorn-tls + secretName: argocd-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer commonName: "argocd.infra.durp.info" dnsNames: - - "argocd.infra.durp.info" + - "argocd.infra.durp.info" \ No newline at end of file From 5d5fbd7face679e0d4f0ce6f8c14703e44d6e343 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 11 Feb 2025 04:45:24 -0600 Subject: [PATCH 0329/1058] update --- infra/argocd/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 6f35c67..31f9f8c 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -6,7 +6,7 @@ argo-cd: repository: registry.internal.durp.info/argoproj/argocd imagePullPolicy: Always - server: + #server: #extraArgs: # - --dex-server-plaintext # - --dex-server=argocd-dex-server:5556 @@ -59,4 +59,4 @@ argo-cd: server: route: - enabled: false + enabled: false \ No newline at end of file From d550eba84d74c1ff6af1ce04ceac075d47dc3707 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 11 Feb 2025 04:46:05 -0600 Subject: [PATCH 0330/1058] update --- infra/argocd/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 31f9f8c..17166db 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -6,7 +6,7 @@ argo-cd: repository: registry.internal.durp.info/argoproj/argocd imagePullPolicy: Always - #server: + server: #extraArgs: # - --dex-server-plaintext # - --dex-server=argocd-dex-server:5556 @@ -54,9 +54,9 @@ argo-cd: rbac: create: true policy.csv: | - g, ArgoCD Admins, role:admin - scopes: "[groups + g, ArgoCD Admins, role:admin + scopes: "[groups]" server: route: - enabled: false \ No newline at end of file + enabled: false From fa6ca7c7b1337c581395526665f71f8d41421eab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 04:57:45 -0600 Subject: [PATCH 0331/1058] update --- infra/cert-manager/templates/issuer.yaml | 14 ++++++++++++++ infra/cert-manager/templates/secretvault.yaml | 1 + 2 files changed, 15 insertions(+) create mode 100644 infra/cert-manager/templates/issuer.yaml diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml new file mode 100644 index 0000000..5a9a772 --- /dev/null +++ b/infra/cert-manager/templates/issuer.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: issuer + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: issuer-token-lmzpj + annotations: + kubernetes.io/service-account.name: issuer +type: kubernetes.io/service-account-token diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index f15a739..0a5da62 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -20,3 +20,4 @@ apiVersion: v1 kind: ServiceAccount metadata: name: vault + From fa66a33b41192a33f6c50b5e5c77100308d032f5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:02:31 -0600 Subject: [PATCH 0332/1058] update --- infra/vault/templates/secret-store.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 7882420..1094e59 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -5,7 +5,7 @@ metadata: spec: provider: vault: - server: "https://vault.vault.svc.cluster.local:8200" + server: "https://vault.infra.durp.info" path: "kv" version: "v2" auth: From 7d6c60117a169f896828caf7e3b9e8cf153e64fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:07:41 -0600 Subject: [PATCH 0333/1058] update --- infra/external-secrets/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index ffcd365..8a25d4f 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -39,7 +39,7 @@ external-secrets: cpu: 10m certController: - create: false + create: true revisionHistoryLimit: 1 image: From 664bd5b3249981275c9d83cb559201d6d351827e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:13:12 -0600 Subject: [PATCH 0334/1058] update --- infra/external-secrets/values.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 8a25d4f..44a5100 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -26,6 +26,8 @@ external-secrets: cpu: 10m webhook: + log: + level: debug image: repository: registry.internal.durp.info/external-secrets/external-secrets pullPolicy: Always @@ -41,6 +43,8 @@ external-secrets: certController: create: true revisionHistoryLimit: 1 + log: + level: debug image: repository: registry.internal.durp.info/external-secrets/external-secrets From bd45075112ea454a05703696e786489b4d9856b7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:18:31 -0600 Subject: [PATCH 0335/1058] update --- infra/external-secrets/values.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 44a5100..7de64de 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -1,6 +1,16 @@ external-secrets: replicaCount: 3 revisionHistoryLimit: 1 + leaderElect: true + + installCRDs: true + crds: + createClusterExternalSecret: true + createClusterSecretStore: true + createClusterGenerator: true + createPushSecret: true + conversion: + enabled: false image: repository: registry.internal.durp.info/external-secrets/external-secrets @@ -41,7 +51,7 @@ external-secrets: cpu: 10m certController: - create: true + create: false revisionHistoryLimit: 1 log: level: debug From 4a0b91f737dcb87b0e1c7677374ac8a0347bc8cf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:27:59 -0600 Subject: [PATCH 0336/1058] update --- infra/cert-manager/templates/issuer.yaml | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index 5a9a772..0f8775b 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -2,13 +2,5 @@ apiVersion: v1 kind: ServiceAccount metadata: name: issuer - ---- - -apiVersion: v1 -kind: Secret -metadata: - name: issuer-token-lmzpj - annotations: - kubernetes.io/service-account.name: issuer -type: kubernetes.io/service-account-token +secrets: + - name: issuer-token-lmzpj From 80316602d51bd6f0ee42fb985b48d1d142dc15db Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:35:18 -0600 Subject: [PATCH 0337/1058] update --- infra/cert-manager/templates/issuer.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index 0f8775b..2421c81 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -4,3 +4,22 @@ metadata: name: issuer secrets: - name: issuer-token-lmzpj + +--- + +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: vault-issuer + namespace: default +spec: + vault: + server: https://vault.infra.durp.info + path: pki/sign/issue-homelab-certs + auth: + kubernetes: + mountPath: /v1/auth/kubernetes + role: issuer + secretRef: + name: issuer-token-lmzpj + key: token \ No newline at end of file From b94d1808114bf57935832defc4a571281733a744 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:36:32 -0600 Subject: [PATCH 0338/1058] update --- infra/cert-manager/templates/issuer.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index 2421c81..ef1fc81 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -11,7 +11,6 @@ apiVersion: cert-manager.io/v1 kind: Issuer metadata: name: vault-issuer - namespace: default spec: vault: server: https://vault.infra.durp.info From b05b5345edc58bc423570cf81f85f2b703077ea1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:37:44 -0600 Subject: [PATCH 0339/1058] update --- infra/cert-manager/templates/issuer.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index ef1fc81..16a7792 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -13,7 +13,7 @@ metadata: name: vault-issuer spec: vault: - server: https://vault.infra.durp.info + server: https://vault.vault.svc.cluster.local:8200 path: pki/sign/issue-homelab-certs auth: kubernetes: From 7a56cca0ee97469d2fd6c3c696cbc27422dab641 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:41:26 -0600 Subject: [PATCH 0340/1058] update --- infra/cert-manager/values.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/infra/cert-manager/values.yaml b/infra/cert-manager/values.yaml index c9cf12f..eed84df 100644 --- a/infra/cert-manager/values.yaml +++ b/infra/cert-manager/values.yaml @@ -6,14 +6,14 @@ cert-manager: repository: jetstack/cert-manager-controller pullPolicy: Always replicaCount: 3 - extraArgs: - - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 - - --dns01-recursive-nameservers-only + #extraArgs: + # - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + # - --dns01-recursive-nameservers-only podDnsPolicy: None - podDnsConfig: - nameservers: - - "1.1.1.1" - - "1.0.0.1" + #podDnsConfig: + # nameservers: + # - "1.1.1.1" + # - "1.0.0.1" webhook: image: registry: registry.internal.durp.info From fad26e6e13b73c63729fc8bc67ad8ec40bab50da Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:43:28 -0600 Subject: [PATCH 0341/1058] update --- infra/cert-manager/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/cert-manager/values.yaml b/infra/cert-manager/values.yaml index eed84df..0cec0b9 100644 --- a/infra/cert-manager/values.yaml +++ b/infra/cert-manager/values.yaml @@ -9,7 +9,7 @@ cert-manager: #extraArgs: # - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 # - --dns01-recursive-nameservers-only - podDnsPolicy: None + #podDnsPolicy: None #podDnsConfig: # nameservers: # - "1.1.1.1" From 2f202e9993b8850c5856329803231fa23ec43cab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 05:52:17 -0600 Subject: [PATCH 0342/1058] update --- infra/cert-manager/templates/issuer.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index 16a7792..3e8c5a6 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -14,6 +14,7 @@ metadata: spec: vault: server: https://vault.vault.svc.cluster.local:8200 + caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K path: pki/sign/issue-homelab-certs auth: kubernetes: From a891c0ab20d4455286c7b3d9be1764526d5dde9c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 06:04:20 -0600 Subject: [PATCH 0343/1058] update --- infra/cert-manager/templates/issuer.yaml | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index 3e8c5a6..5aabf48 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -22,4 +22,18 @@ spec: role: issuer secretRef: name: issuer-token-lmzpj - key: token \ No newline at end of file + key: token + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: test +spec: + secretName: test-lst + issuerRef: + name: vault-issuer + commonName: test.durp.info + dnsNames: + - test.durp.info From 848096364fc008d55d8fb1aadfae9926d19b61be Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 06:05:11 -0600 Subject: [PATCH 0344/1058] update --- infra/cert-manager/templates/issuer.yaml | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index 5aabf48..c15ed69 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -24,16 +24,3 @@ spec: name: issuer-token-lmzpj key: token ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: test -spec: - secretName: test-lst - issuerRef: - name: vault-issuer - commonName: test.durp.info - dnsNames: - - test.durp.info From c91fe325af91a23a1c48ec1940a0e4f08737ccfa Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 06:06:04 -0600 Subject: [PATCH 0345/1058] update --- infra/longhorn/templates/ingress.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index 412f930..b8085bb 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -25,8 +25,8 @@ metadata: spec: secretName: longhorn-tls issuerRef: - name: letsencrypt-production - kind: ClusterIssuer + name: vault-issuer + namespace: cert-manager commonName: "longhorn.infra.durp.info" dnsNames: - "longhorn.infra.durp.info" From 6cd37b4bd064b5fd8217d16c9e0c6c1054c06044 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 06:08:45 -0600 Subject: [PATCH 0346/1058] update --- infra/longhorn/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index b8085bb..6e3a4c1 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -26,7 +26,7 @@ spec: secretName: longhorn-tls issuerRef: name: vault-issuer - namespace: cert-manager + kind: ClusterIssuer commonName: "longhorn.infra.durp.info" dnsNames: - "longhorn.infra.durp.info" From a66cdf40e35eeae4dcba2808ae89f97547983a36 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 06:14:46 -0600 Subject: [PATCH 0347/1058] update --- infra/longhorn/templates/ingress.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index 6e3a4c1..ee0fb86 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -14,16 +14,16 @@ spec: - name: longhorn-frontend port: 80 tls: - secretName: longhorn-tls + secretName: longhorn-tls1 --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: longhorn-tls + name: longhorn-tls1 spec: - secretName: longhorn-tls + secretName: longhorn-tls1 issuerRef: name: vault-issuer kind: ClusterIssuer From 3e4a682e7bc92ec12670c56ee0945c6958f2b10a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 15:17:37 -0600 Subject: [PATCH 0348/1058] update --- infra/cert-manager/templates/issuer.yaml | 39 ++++++++++--------- infra/cert-manager/templates/letsencrypt.yaml | 19 +++++++++ 2 files changed, 39 insertions(+), 19 deletions(-) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index c15ed69..37f2a29 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -5,22 +5,23 @@ metadata: secrets: - name: issuer-token-lmzpj ---- - -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: vault-issuer -spec: - vault: - server: https://vault.vault.svc.cluster.local:8200 - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - path: pki/sign/issue-homelab-certs - auth: - kubernetes: - mountPath: /v1/auth/kubernetes - role: issuer - secretRef: - name: issuer-token-lmzpj - key: token - +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Issuer +#metadata: +# name: vault-issuer +#spec: +# vault: +# server: https://vault.vault.svc.cluster.local:8200 +# caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K +# path: pki/sign/issue-homelab-certs +# auth: +# kubernetes: +# mountPath: /v1/auth/kubernetes +# role: issuer +# secretRef: +# name: issuer-token-lmzpj +# key: token +# +# \ No newline at end of file diff --git a/infra/cert-manager/templates/letsencrypt.yaml b/infra/cert-manager/templates/letsencrypt.yaml index 034ed9b..c9f3d95 100644 --- a/infra/cert-manager/templates/letsencrypt.yaml +++ b/infra/cert-manager/templates/letsencrypt.yaml @@ -14,3 +14,22 @@ spec: apiTokenSecretRef: name: cloudflare-api-token-secret key: cloudflare-api-token-secret + +--- + +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: vault-issuer +spec: + vault: + server: https://vault.vault.svc.cluster.local:8200 + caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + path: pki/sign/issue-homelab-certs + auth: + kubernetes: + mountPath: /v1/auth/kubernetes + role: issuer + secretRef: + name: issuer-token-lmzpj + key: token From 4ee9c3da061b19fafaf412e49dc801d2e096b73c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 15:20:47 -0600 Subject: [PATCH 0349/1058] update --- infra/longhorn/templates/ingress.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index ee0fb86..6e3a4c1 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -14,16 +14,16 @@ spec: - name: longhorn-frontend port: 80 tls: - secretName: longhorn-tls1 + secretName: longhorn-tls --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: longhorn-tls1 + name: longhorn-tls spec: - secretName: longhorn-tls1 + secretName: longhorn-tls issuerRef: name: vault-issuer kind: ClusterIssuer From 1de9ef55e27d2ec9b4ae50f51311cfde6b2c2102 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 15:22:06 -0600 Subject: [PATCH 0350/1058] update --- infra/argocd/templates/argocd.yaml | 2 +- infra/vault/templates/ingress.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 98e2e30..e20344b 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -72,7 +72,7 @@ metadata: spec: secretName: argocd-tls issuerRef: - name: letsencrypt-production + name: vault-issuer kind: ClusterIssuer commonName: "argocd.infra.durp.info" dnsNames: diff --git a/infra/vault/templates/ingress.yaml b/infra/vault/templates/ingress.yaml index 73abf7e..547cde8 100644 --- a/infra/vault/templates/ingress.yaml +++ b/infra/vault/templates/ingress.yaml @@ -26,7 +26,7 @@ metadata: spec: secretName: vault-tls issuerRef: - name: letsencrypt-production + name: vault-issuer kind: ClusterIssuer commonName: "vault.infra.durp.info" dnsNames: From c3fd5e189411c84a551943f6fa96a0f47a02ddf3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 15:24:25 -0600 Subject: [PATCH 0351/1058] update --- infra/cert-manager/templates/issuer.yaml | 23 +------------------ infra/cert-manager/templates/letsencrypt.yaml | 2 +- 2 files changed, 2 insertions(+), 23 deletions(-) diff --git a/infra/cert-manager/templates/issuer.yaml b/infra/cert-manager/templates/issuer.yaml index 37f2a29..6b889c7 100644 --- a/infra/cert-manager/templates/issuer.yaml +++ b/infra/cert-manager/templates/issuer.yaml @@ -3,25 +3,4 @@ kind: ServiceAccount metadata: name: issuer secrets: - - name: issuer-token-lmzpj - -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Issuer -#metadata: -# name: vault-issuer -#spec: -# vault: -# server: https://vault.vault.svc.cluster.local:8200 -# caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K -# path: pki/sign/issue-homelab-certs -# auth: -# kubernetes: -# mountPath: /v1/auth/kubernetes -# role: issuer -# secretRef: -# name: issuer-token-lmzpj -# key: token -# -# \ No newline at end of file + - name: issuer-token-lmzpj \ No newline at end of file diff --git a/infra/cert-manager/templates/letsencrypt.yaml b/infra/cert-manager/templates/letsencrypt.yaml index c9f3d95..0203412 100644 --- a/infra/cert-manager/templates/letsencrypt.yaml +++ b/infra/cert-manager/templates/letsencrypt.yaml @@ -23,7 +23,7 @@ metadata: name: vault-issuer spec: vault: - server: https://vault.vault.svc.cluster.local:8200 + server: https://vault.infra.durp.info caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K path: pki/sign/issue-homelab-certs auth: From dade7fd1520a1cf18a10af7dc6bffe85ebd98aa1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 12 Feb 2025 19:48:06 -0600 Subject: [PATCH 0352/1058] update --- infra/longhorn/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/longhorn/values.yaml b/infra/longhorn/values.yaml index 9e41b42..e34a1ee 100644 --- a/infra/longhorn/values.yaml +++ b/infra/longhorn/values.yaml @@ -72,7 +72,7 @@ longhorn: snapshotterReplicaCount: ~ defaultSettings: - backupTarget: S3://longhorn-infra@us-east-1/ + backupTarget: S3://longhorn-master@us-east-1/ backupTargetCredentialSecret: longhorn-backup-token-secret allowRecurringJobWhileVolumeDetached: ~ createDefaultDiskLabeledNodes: ~ From 53c494992750be5f207c6f0b0ed0adce4a75b6ef Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 13 Feb 2025 06:06:23 -0600 Subject: [PATCH 0353/1058] Add terraform for infra --- .gitlab/.gitlab-ci.yml | 2 + infra/.gitlab/.gitlab-ci.yml | 94 ++++++++++++++++ infra/authentik/Chart.yaml | 12 ++ infra/authentik/templates/ingress.yaml | 42 +++++++ infra/authentik/templates/secrets.yaml | 28 +++++ infra/authentik/values.yaml | 56 ++++++++++ infra/terraform/main.tf | 149 +++++++++++++++++++++++++ infra/terraform/variables.tf | 14 +++ 8 files changed, 397 insertions(+) create mode 100644 .gitlab/.gitlab-ci.yml create mode 100644 infra/.gitlab/.gitlab-ci.yml create mode 100644 infra/authentik/Chart.yaml create mode 100644 infra/authentik/templates/ingress.yaml create mode 100644 infra/authentik/templates/secrets.yaml create mode 100644 infra/authentik/values.yaml create mode 100644 infra/terraform/main.tf create mode 100644 infra/terraform/variables.tf diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml new file mode 100644 index 0000000..080d92c --- /dev/null +++ b/.gitlab/.gitlab-ci.yml @@ -0,0 +1,2 @@ +include: + - local: infra/.gitlab/.gitlab-ci.yml \ No newline at end of file diff --git a/infra/.gitlab/.gitlab-ci.yml b/infra/.gitlab/.gitlab-ci.yml new file mode 100644 index 0000000..da46909 --- /dev/null +++ b/infra/.gitlab/.gitlab-ci.yml @@ -0,0 +1,94 @@ +stages: + - plan + - apply + - destroy + +variables: + WORKDIR: $CI_PROJECT_DIR/infra + GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/infra + +image: + name: registry.internal.durp.info/opentofu/opentofu:latest + entrypoint: [""] + +.tf-init: + before_script: + - cd $WORKDIR + - | + tofu init -reconfigure -backend-config="address=${GITLAB_TF_ADDRESS}" \ + -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" \ + -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" \ + -backend-config="username=gitlab-ci-token" \ + -backend-config="password=${CI_JOB_TOKEN}" \ + -backend-config="lock_method=POST" \ + -backend-config="unlock_method=DELETE" \ + -backend-config="retry_wait_min=5" + +format: + stage: .pre + allow_failure: false + script: + - cd $WORKDIR + - tofu fmt -diff -check -write=false + rules: + - changes: + - .tf + +validate: + stage: .pre + allow_failure: false + extends: .tf-init + script: + - tofu validate + rules: + - changes: + - .tf + +plan-infrastructure: + stage: plan + variables: + PLAN: plan.tfplan + JSON_PLAN_FILE: tfplan.json + ENVIRONMENT_NAME: infra + allow_failure: false + extends: .tf-init + script: + - apk add --update curl jq + - alias convert_report="jq -r '([.resource_changes[].change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'" + - tofu plan -out=$PLAN $ARGUMENTS + - tofu show --json $PLAN | jq -r '([.resource_changes[].change.actions?]|flatten)|{"create":(map(select(.=="create"))|length),"update":(map(select(.=="update"))|length),"delete":(map(select(.=="delete"))|length)}' > $JSON_PLAN_FILE + artifacts: + reports: + terraform: $WORKDIR/$JSON_PLAN_FILE + needs: ["validate","format"] + rules: + - changes: + - .tf + +apply-infrastructure: + stage: apply + variables: + ENVIRONMENT_NAME: infra + allow_failure: false + extends: .tf-init + script: + - tofu apply -auto-approve $ARGUMENTS + rules: + - changes: + - .tf + when: manual + needs: ["plan-infrastructure"] + +destroy-infrastructure: + stage: destroy + variables: + ENVIRONMENT_NAME: infra + allow_failure: false + extends: .tf-init + script: + - tofu destory -auto-approve $ARGUMENTS + rules: + - changes: + - .tf + when: manual + needs: ["plan-infrastructure"] diff --git a/infra/authentik/Chart.yaml b/infra/authentik/Chart.yaml new file mode 100644 index 0000000..c87b677 --- /dev/null +++ b/infra/authentik/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: authentik +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: authentik + repository: https://charts.goauthentik.io + version: 2024.8.3 \ No newline at end of file diff --git a/infra/authentik/templates/ingress.yaml b/infra/authentik/templates/ingress.yaml new file mode 100644 index 0000000..ac10303 --- /dev/null +++ b/infra/authentik/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 80 + tls: + secretName: authentik-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + secretName: authentik-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/infra/authentik/templates/secrets.yaml b/infra/authentik/templates/secrets.yaml new file mode 100644 index 0000000..07b7747 --- /dev/null +++ b/infra/authentik/templates/secrets.yaml @@ -0,0 +1,28 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: authentik-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: db-pass + data: + - secretKey: dbpass + remoteRef: + key: secrets/authentik/database + property: dbpass + - secretKey: secretkey + remoteRef: + key: secrets/authentik/database + property: secretkey + - secretKey: postgresql-postgres-password + remoteRef: + key: secrets/authentik/database + property: dbpass + - secretKey: postgresql-password + remoteRef: + key: secrets/authentik/database + property: dbpass + diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml new file mode 100644 index 0000000..4fa183b --- /dev/null +++ b/infra/authentik/values.yaml @@ -0,0 +1,56 @@ +authentik: + global: + env: + - name: AUTHENTIK_POSTGRESQL__PASSWORD + valueFrom: + secretKeyRef: + name: db-pass + key: dbpass + - name: AUTHENTIK_SECRET_KEY + valueFrom: + secretKeyRef: + name: db-pass + key: secretkey + revisionHistoryLimit: 1 + image: + repository: registry.durp.info/goauthentik/server + pullPolicy: Always + authentik: + outposts: + container_image_base: registry.durp.info/goauthentik/%(type)s:%(version)s + postgresql: + host: '{{ .Release.Name }}-postgresql-hl' + name: "authentik" + user: "authentik" + port: 5432 + server: + name: server + replicas: 3 + worker: + replicas: 3 + postgresql: + enabled: true + image: + registry: registry.durp.info + repository: bitnami/postgresql + pullPolicy: Always + postgresqlUsername: "authentik" + postgresqlDatabase: "authentik" + existingSecret: db-pass + persistence: + enabled: true + storageClass: longhorn + accessModes: + - ReadWriteMany + redis: + enabled: true + master: + persistence: + enabled: false + image: + registry: registry.durp.info + repository: bitnami/redis + pullPolicy: Always + architecture: standalone + auth: + enabled: false diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf new file mode 100644 index 0000000..9568353 --- /dev/null +++ b/infra/terraform/main.tf @@ -0,0 +1,149 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc6" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + storage = "cache-domains" + emulatessd = true + format = "raw" + dnsserver = "192.168.12.1" + tags = "postgres" + vlan = 12 + postgres = { + count = 3 + name = ["postgres-01", "postgres-02", "postgres-03"] + cores = 2 + memory = "1024" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["31", "32", "33"] + } + postgres = { + count = 3 + name = ["postgres-01", "postgres-02", "postgres-03"] + cores = 4 + memory = "4096" + drive = 40 + node = ["mothership", "overlord", "vanguard"] + ip = ["34", "35", "36"] + } +} + +resource "proxmox_vm_qemu" "postgres" { + count = local.postgres.count + ciuser = "administrator" + vmid = "${local.vlan}${local.postgres.ip[count.index]}" + name = local.postgres.name[count.index] + target_node = local.postgres.node[count.index] + clone = local.template + tags = local.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.postgres.cores + sockets = 1 + cpu_type = "host" + memory = local.postgres.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.postgres.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "postgres" { + count = local.postgres.count + ciuser = "administrator" + vmid = "${local.vlan}${local.postgres.ip[count.index]}" + name = local.postgres.name[count.index] + target_node = local.postgres.node[count.index] + clone = local.template + tags = local.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.postgres.cores + sockets = 1 + cpu_type = "host" + memory = local.postgres.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.postgres.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/infra/terraform/variables.tf b/infra/terraform/variables.tf new file mode 100644 index 0000000..31a92e0 --- /dev/null +++ b/infra/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "UIsername to Proxmox provider" + type = string +} From e14f7ac6279ccb9384d8f9838e059d8da209077d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 13 Feb 2025 06:13:26 -0600 Subject: [PATCH 0354/1058] Add terraform for infra --- infra/.gitlab/.gitlab-ci.yml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/infra/.gitlab/.gitlab-ci.yml b/infra/.gitlab/.gitlab-ci.yml index da46909..5e46e44 100644 --- a/infra/.gitlab/.gitlab-ci.yml +++ b/infra/.gitlab/.gitlab-ci.yml @@ -14,14 +14,15 @@ image: .tf-init: before_script: - cd $WORKDIR - - | - tofu init -reconfigure -backend-config="address=${GITLAB_TF_ADDRESS}" \ - -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" \ - -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" \ - -backend-config="username=gitlab-ci-token" \ - -backend-config="password=${CI_JOB_TOKEN}" \ - -backend-config="lock_method=POST" \ - -backend-config="unlock_method=DELETE" \ + - tofu init + -reconfigure + -backend-config="address=${GITLAB_TF_ADDRESS}" + -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="username=gitlab-ci-token" + -backend-config="password=${CI_JOB_TOKEN}" + -backend-config="lock_method=POST" + -backend-config="unlock_method=DELETE" -backend-config="retry_wait_min=5" format: From 0dab6f4f339722295b1e5305aafbee694ba74776 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 13 Feb 2025 06:15:07 -0600 Subject: [PATCH 0355/1058] Add terraform for infra --- infra/.gitlab/.gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/.gitlab/.gitlab-ci.yml b/infra/.gitlab/.gitlab-ci.yml index 5e46e44..5e8b015 100644 --- a/infra/.gitlab/.gitlab-ci.yml +++ b/infra/.gitlab/.gitlab-ci.yml @@ -4,7 +4,7 @@ stages: - destroy variables: - WORKDIR: $CI_PROJECT_DIR/infra + WORKDIR: $CI_PROJECT_DIR/infra/terraform GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/infra image: From 7b5b1b8aa13dd440f936b4abd089c5da58857f77 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 13 Feb 2025 06:18:36 -0600 Subject: [PATCH 0356/1058] Add terraform for infra --- infra/terraform/main.tf | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 9568353..f1111e7 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -26,9 +26,9 @@ locals { dnsserver = "192.168.12.1" tags = "postgres" vlan = 12 - postgres = { + haproxy = { count = 3 - name = ["postgres-01", "postgres-02", "postgres-03"] + name = ["haproxy-01", "haproxy-02", "haproxy-03"] cores = 2 memory = "1024" drive = 20 @@ -46,22 +46,22 @@ locals { } } -resource "proxmox_vm_qemu" "postgres" { - count = local.postgres.count +resource "proxmox_vm_qemu" "haproxy" { + count = local.haproxy.count ciuser = "administrator" - vmid = "${local.vlan}${local.postgres.ip[count.index]}" - name = local.postgres.name[count.index] - target_node = local.postgres.node[count.index] + vmid = "${local.vlan}${local.haproxy.ip[count.index]}" + name = local.haproxy.name[count.index] + target_node = local.haproxy.node[count.index] clone = local.template tags = local.tags qemu_os = "l26" full_clone = true os_type = "cloud-init" agent = 1 - cores = local.postgres.cores + cores = local.haproxy.cores sockets = 1 cpu_type = "host" - memory = local.postgres.memory + memory = local.haproxy.memory scsihw = "virtio-scsi-pci" #bootdisk = "scsi0" boot = "order=virtio0" @@ -78,7 +78,7 @@ resource "proxmox_vm_qemu" "postgres" { virtio { virtio0 { disk { - size = local.postgres.drive + size = local.haproxy.drive format = local.format storage = local.storage } @@ -92,7 +92,7 @@ resource "proxmox_vm_qemu" "postgres" { tag = local.vlan } #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" searchdomain = "durp.loc" nameserver = local.dnsserver } From 5c2169d1387749fdd6adb32476f0d7042641419a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 13 Feb 2025 06:21:03 -0600 Subject: [PATCH 0357/1058] Add terraform for infra --- infra/terraform/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index f1111e7..31aebd8 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -23,9 +23,9 @@ locals { storage = "cache-domains" emulatessd = true format = "raw" - dnsserver = "192.168.12.1" - tags = "postgres" - vlan = 12 + dnsserver = "192.168.12.1" + tags = "postgres" + vlan = 12 haproxy = { count = 3 name = ["haproxy-01", "haproxy-02", "haproxy-03"] From 48dca828a90ee817740c671fcbb8a5cf9056ec63 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 13 Feb 2025 06:38:43 -0600 Subject: [PATCH 0358/1058] Add terraform for infra --- infra/.gitlab/.gitlab-ci.yml | 10 +++++----- infra/terraform/main.tf | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/infra/.gitlab/.gitlab-ci.yml b/infra/.gitlab/.gitlab-ci.yml index 5e8b015..63301da 100644 --- a/infra/.gitlab/.gitlab-ci.yml +++ b/infra/.gitlab/.gitlab-ci.yml @@ -33,7 +33,7 @@ format: - tofu fmt -diff -check -write=false rules: - changes: - - .tf + - "infra/terraform/*.tf" validate: stage: .pre @@ -43,7 +43,7 @@ validate: - tofu validate rules: - changes: - - .tf + - "infra/terraform/*.tf" plan-infrastructure: stage: plan @@ -64,7 +64,7 @@ plan-infrastructure: needs: ["validate","format"] rules: - changes: - - .tf + - "infra/terraform/*.tf" apply-infrastructure: stage: apply @@ -76,7 +76,7 @@ apply-infrastructure: - tofu apply -auto-approve $ARGUMENTS rules: - changes: - - .tf + - "infra/terraform/*.tf" when: manual needs: ["plan-infrastructure"] @@ -90,6 +90,6 @@ destroy-infrastructure: - tofu destory -auto-approve $ARGUMENTS rules: - changes: - - .tf + - "infra/terraform/*.tf" when: manual needs: ["plan-infrastructure"] diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 31aebd8..e0ff3ec 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -9,7 +9,7 @@ terraform { } provider "proxmox" { - pm_parallel = 1 + pm_parallel = 3 pm_tls_insecure = true pm_api_url = var.pm_api_url pm_user = var.pm_user From 1da4a9e23bf7023a72eda63bceb023843afab6d9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Feb 2025 05:00:28 -0600 Subject: [PATCH 0359/1058] Add terraform for infra --- infra/.gitlab/.gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/.gitlab/.gitlab-ci.yml b/infra/.gitlab/.gitlab-ci.yml index 63301da..d734da9 100644 --- a/infra/.gitlab/.gitlab-ci.yml +++ b/infra/.gitlab/.gitlab-ci.yml @@ -87,7 +87,7 @@ destroy-infrastructure: allow_failure: false extends: .tf-init script: - - tofu destory -auto-approve $ARGUMENTS + - tofu destroy -auto-approve $ARGUMENTS rules: - changes: - "infra/terraform/*.tf" From 4084517dd7adc9172c3c3490ff4128cb6a76bd47 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Feb 2025 05:11:19 -0600 Subject: [PATCH 0360/1058] Add terraform for infra --- infra/terraform/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index e0ff3ec..31aebd8 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -9,7 +9,7 @@ terraform { } provider "proxmox" { - pm_parallel = 3 + pm_parallel = 1 pm_tls_insecure = true pm_api_url = var.pm_api_url pm_user = var.pm_user From 4645e52f2a381857eeb12fdca28da37df56c3b4a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Feb 2025 06:27:56 -0600 Subject: [PATCH 0361/1058] Move pfsense to unifi --- .../templates/{pfsense.yaml => unifi.yaml} | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) rename master/internalproxy/templates/{pfsense.yaml => unifi.yaml} (64%) diff --git a/master/internalproxy/templates/pfsense.yaml b/master/internalproxy/templates/unifi.yaml similarity index 64% rename from master/internalproxy/templates/pfsense.yaml rename to master/internalproxy/templates/unifi.yaml index 45d45e8..76c3110 100644 --- a/master/internalproxy/templates/pfsense.yaml +++ b/master/internalproxy/templates/unifi.yaml @@ -1,13 +1,13 @@ apiVersion: v1 kind: Service metadata: - name: pfsense + name: unifi spec: ports: - name: app - port: 10443 + port: 443 protocol: TCP - targetPort: 10443 + targetPort: 443 clusterIP: None type: ClusterIP @@ -16,13 +16,13 @@ spec: apiVersion: v1 kind: Endpoints metadata: - name: pfsense + name: unifi subsets: - addresses: - ip: 192.168.20.1 ports: - name: app - port: 10443 + port: 443 protocol: TCP --- @@ -30,34 +30,34 @@ subsets: apiVersion: traefik.containo.us/v1alpha1 kind: IngressRoute metadata: - name: pfsense-ingress + name: unifi-ingress spec: entryPoints: - websecure routes: - - match: Host(`pfsense.internal.durp.info`) && PathPrefix(`/`) + - match: Host(`unifi.internal.durp.info`) && PathPrefix(`/`) middlewares: - name: whitelist namespace: traefik kind: Rule services: - - name: pfsense - port: 10443 + - name: unifi + port: 443 scheme: https tls: - secretName: pfsense-tls + secretName: unifi-tls --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: pfsense-tls + name: unifi-tls spec: - secretName: pfsense-tls + secretName: unifi-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "pfsense.internal.durp.info" + commonName: "unifi.internal.durp.info" dnsNames: - - "pfsense.internal.durp.info" + - "unifi.internal.durp.info" From 156a75c0a056f039d2ecd745c7c6d5c078992879 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 15 Feb 2025 06:40:10 -0600 Subject: [PATCH 0362/1058] update proxmox --- master/internalproxy/templates/proxmox.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/internalproxy/templates/proxmox.yaml b/master/internalproxy/templates/proxmox.yaml index fd0343a..d61f416 100644 --- a/master/internalproxy/templates/proxmox.yaml +++ b/master/internalproxy/templates/proxmox.yaml @@ -19,7 +19,7 @@ metadata: name: proxmox subsets: - addresses: - - ip: 192.168.21.252 + - ip: 192.168.21.254 ports: - name: app port: 8006 From 004d2d5155db3f83c2a65f0a64f354d6c671ef48 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 15 Feb 2025 12:59:54 -0600 Subject: [PATCH 0363/1058] Add serial --- infra/terraform/main.tf | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 31aebd8..1258e58 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -67,6 +67,11 @@ resource "proxmox_vm_qemu" "haproxy" { boot = "order=virtio0" onboot = true sshkeys = local.sshkeys + vga = "serial0" + serial { + id = 0 + type = "socket" + } disks { ide { ide2 { @@ -118,6 +123,11 @@ resource "proxmox_vm_qemu" "postgres" { boot = "order=virtio0" onboot = true sshkeys = local.sshkeys + vga = "serial0" + serial { + id = 0 + type = "socket" + } disks { ide { ide2 { From d182b00e750debb14cebd5776a74ecb551a55ee4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 15 Feb 2025 13:01:59 -0600 Subject: [PATCH 0364/1058] Add serial --- infra/terraform/main.tf | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 1258e58..b43ad03 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -67,7 +67,7 @@ resource "proxmox_vm_qemu" "haproxy" { boot = "order=virtio0" onboot = true sshkeys = local.sshkeys - vga = "serial0" + vga = "serial0" serial { id = 0 type = "socket" @@ -123,7 +123,9 @@ resource "proxmox_vm_qemu" "postgres" { boot = "order=virtio0" onboot = true sshkeys = local.sshkeys - vga = "serial0" + vga { + type = "serial0" + } serial { id = 0 type = "socket" From 96f65d5322ff39e1d1d77cdef70951b3b2e95fbf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 15 Feb 2025 13:03:53 -0600 Subject: [PATCH 0365/1058] Add serial --- infra/terraform/main.tf | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index b43ad03..f3bfc63 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -67,7 +67,9 @@ resource "proxmox_vm_qemu" "haproxy" { boot = "order=virtio0" onboot = true sshkeys = local.sshkeys - vga = "serial0" + vga { + type = "serial0" + } serial { id = 0 type = "socket" From ca44e683f64acd4a3b9c21e9ef593074f7142665 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Feb 2025 13:02:18 -0600 Subject: [PATCH 0366/1058] update --- .gitignore | 2 + infra/terraform/k3s.tf | 116 ++++++++++++++++++++++++++++++ infra/terraform/main.tf | 138 ++++++------------------------------ infra/terraform/postgres.tf | 115 ++++++++++++++++++++++++++++++ 4 files changed, 255 insertions(+), 116 deletions(-) create mode 100644 infra/terraform/k3s.tf create mode 100644 infra/terraform/postgres.tf diff --git a/.gitignore b/.gitignore index 485dee6..1dee64d 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,3 @@ .idea +infra/terraform/.terraform +infra/terraform/.terraform.lock.hcl diff --git a/infra/terraform/k3s.tf b/infra/terraform/k3s.tf new file mode 100644 index 0000000..1145ae9 --- /dev/null +++ b/infra/terraform/k3s.tf @@ -0,0 +1,116 @@ +resource "proxmox_vm_qemu" "k3smaster" { + lifecycle { + prevent_destroy = true + } + count = local.k3smaster.count + ciuser = "administrator" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + tags = local.k3smaster.tags + full_clone = false + qemu_os = "l26" + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + lifecycle { + prevent_destroy = true + } + count = local.k3sserver.count + ciuser = "administrator" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = false + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index f3bfc63..25c711d 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -24,9 +24,29 @@ locals { emulatessd = true format = "raw" dnsserver = "192.168.12.1" - tags = "postgres" vlan = 12 + k3smaster = { + tags = "k3s_infra" + count = 3 + name = ["master01-infra", "master02-infra", "master03-infra"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_infra" + count = 3 + name = ["node01-infra", "node02-infra", "node03-infra"] + cores = 4 + memory = "8192" + drive = 240 + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } haproxy = { + tags = "haproxy" count = 3 name = ["haproxy-01", "haproxy-02", "haproxy-03"] cores = 2 @@ -36,6 +56,7 @@ locals { ip = ["31", "32", "33"] } postgres = { + tags = "postgres" count = 3 name = ["postgres-01", "postgres-02", "postgres-03"] cores = 4 @@ -46,118 +67,3 @@ locals { } } -resource "proxmox_vm_qemu" "haproxy" { - count = local.haproxy.count - ciuser = "administrator" - vmid = "${local.vlan}${local.haproxy.ip[count.index]}" - name = local.haproxy.name[count.index] - target_node = local.haproxy.node[count.index] - clone = local.template - tags = local.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.haproxy.cores - sockets = 1 - cpu_type = "host" - memory = local.haproxy.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.haproxy.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "postgres" { - count = local.postgres.count - ciuser = "administrator" - vmid = "${local.vlan}${local.postgres.ip[count.index]}" - name = local.postgres.name[count.index] - target_node = local.postgres.node[count.index] - clone = local.template - tags = local.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.postgres.cores - sockets = 1 - cpu_type = "host" - memory = local.postgres.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.postgres.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf new file mode 100644 index 0000000..5bbf658 --- /dev/null +++ b/infra/terraform/postgres.tf @@ -0,0 +1,115 @@ +resource "proxmox_vm_qemu" "haproxy" { + count = local.haproxy.count + ciuser = "administrator" + vmid = "${local.vlan}${local.haproxy.ip[count.index]}" + name = local.haproxy.name[count.index] + target_node = local.haproxy.node[count.index] + clone = local.template + tags = local.haproxy.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.haproxy.cores + sockets = 1 + cpu_type = "host" + memory = local.haproxy.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.haproxy.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "postgres" { + count = local.postgres.count + ciuser = "administrator" + vmid = "${local.vlan}${local.postgres.ip[count.index]}" + name = local.postgres.name[count.index] + target_node = local.postgres.node[count.index] + clone = local.template + tags = local.postgres.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.postgres.cores + sockets = 1 + cpu_type = "host" + memory = local.postgres.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.postgres.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} From 37fdb0a1ac5540d6e29e7db58eaa45a20d881fd8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Feb 2025 13:06:08 -0600 Subject: [PATCH 0367/1058] update --- infra/terraform/k3s.tf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/terraform/k3s.tf b/infra/terraform/k3s.tf index 1145ae9..29426bd 100644 --- a/infra/terraform/k3s.tf +++ b/infra/terraform/k3s.tf @@ -7,7 +7,7 @@ resource "proxmox_vm_qemu" "k3smaster" { name = local.k3smaster.name[count.index] target_node = local.k3smaster.node[count.index] tags = local.k3smaster.tags - full_clone = false + full_clone = false qemu_os = "l26" os_type = "cloud-init" agent = 1 @@ -16,9 +16,9 @@ resource "proxmox_vm_qemu" "k3smaster" { cpu_type = "host" memory = local.k3smaster.memory scsihw = "virtio-scsi-pci" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys vga { type = "serial0" } From 95bfaf4a70fcfdcb8f84049acf7c7cf79e0503d8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Feb 2025 17:28:09 -0600 Subject: [PATCH 0368/1058] add authentik --- infra/argocd/templates/authentik.yaml | 21 +++++++ infra/authentik/templates/ingress.yaml | 84 +++++++++++++------------- infra/authentik/templates/secrets.yaml | 8 +-- 3 files changed, 67 insertions(+), 46 deletions(-) create mode 100644 infra/argocd/templates/authentik.yaml diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml new file mode 100644 index 0000000..16ff58a --- /dev/null +++ b/infra/argocd/templates/authentik.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: authentik + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/authentik + destination: + namespace: authentik + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/authentik/templates/ingress.yaml b/infra/authentik/templates/ingress.yaml index ac10303..2e17729 100644 --- a/infra/authentik/templates/ingress.yaml +++ b/infra/authentik/templates/ingress.yaml @@ -1,42 +1,42 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: authentik-server - port: 80 - tls: - secretName: authentik-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - secretName: authentik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: traefik.containo.us/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: authentik-server +# port: 80 +# tls: +# secretName: authentik-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-tls +#spec: +# secretName: authentik-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "authentik.durp.info" +# dnsNames: +# - "authentik.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: authentik-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/infra/authentik/templates/secrets.yaml b/infra/authentik/templates/secrets.yaml index 07b7747..53585a3 100644 --- a/infra/authentik/templates/secrets.yaml +++ b/infra/authentik/templates/secrets.yaml @@ -11,18 +11,18 @@ spec: data: - secretKey: dbpass remoteRef: - key: secrets/authentik/database + key: kv/authentik/database property: dbpass - secretKey: secretkey remoteRef: - key: secrets/authentik/database + key: kv/authentik/database property: secretkey - secretKey: postgresql-postgres-password remoteRef: - key: secrets/authentik/database + key: kv/authentik/database property: dbpass - secretKey: postgresql-password remoteRef: - key: secrets/authentik/database + key: kv/authentik/database property: dbpass From 7b65ae059952e52b03d8092010f749d7896eee24 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Feb 2025 17:29:44 -0600 Subject: [PATCH 0369/1058] update --- infra/authentik/templates/secrets.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/infra/authentik/templates/secrets.yaml b/infra/authentik/templates/secrets.yaml index 53585a3..6778128 100644 --- a/infra/authentik/templates/secrets.yaml +++ b/infra/authentik/templates/secrets.yaml @@ -25,4 +25,11 @@ spec: remoteRef: key: kv/authentik/database property: dbpass - + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + From e20429f6a711c281f5a57342e5cfd5088909591f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Feb 2025 17:37:31 -0600 Subject: [PATCH 0370/1058] remove postgres --- infra/authentik/values.yaml | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index 4fa183b..ccd9db9 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -29,19 +29,7 @@ authentik: worker: replicas: 3 postgresql: - enabled: true - image: - registry: registry.durp.info - repository: bitnami/postgresql - pullPolicy: Always - postgresqlUsername: "authentik" - postgresqlDatabase: "authentik" - existingSecret: db-pass - persistence: - enabled: true - storageClass: longhorn - accessModes: - - ReadWriteMany + enabled: false redis: enabled: true master: From 0859efa0c714130f6ba1adaee281a25dcdb97ed9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Feb 2025 20:29:30 -0600 Subject: [PATCH 0371/1058] add ansible base role --- ansible/roles/base/files/10periodic | 4 + ansible/roles/base/files/authorized_keys_user | 1 + ansible/roles/base/files/issue | 4 + ansible/roles/base/files/motd | 4 + ansible/roles/base/files/sshd_config_secured | 95 +++++++++++++ ansible/roles/base/tasks/main.yaml | 132 ++++++++++++++++++ ansible/roles/base/vars/main.yaml | 17 +++ 7 files changed, 257 insertions(+) create mode 100644 ansible/roles/base/files/10periodic create mode 100644 ansible/roles/base/files/authorized_keys_user create mode 100644 ansible/roles/base/files/issue create mode 100644 ansible/roles/base/files/motd create mode 100644 ansible/roles/base/files/sshd_config_secured create mode 100644 ansible/roles/base/tasks/main.yaml create mode 100644 ansible/roles/base/vars/main.yaml diff --git a/ansible/roles/base/files/10periodic b/ansible/roles/base/files/10periodic new file mode 100644 index 0000000..5d37e9f --- /dev/null +++ b/ansible/roles/base/files/10periodic @@ -0,0 +1,4 @@ +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Download-Upgradeable-Packages "1"; +APT::Periodic::AutocleanInterval "7"; +APT::Periodic::Unattended-Upgrade "1"; diff --git a/ansible/roles/base/files/authorized_keys_user b/ansible/roles/base/files/authorized_keys_user new file mode 100644 index 0000000..4c456ea --- /dev/null +++ b/ansible/roles/base/files/authorized_keys_user @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhPVgL8gXdRTw0E2FvlOUoUI4vd794nB0nZVIsc+U5M diff --git a/ansible/roles/base/files/issue b/ansible/roles/base/files/issue new file mode 100644 index 0000000..5acb66f --- /dev/null +++ b/ansible/roles/base/files/issue @@ -0,0 +1,4 @@ +Use of this system is restricted to authorized users only, and all use is subjected to an acceptable use policy. + +IF YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM, DISCONNECT NOW. + diff --git a/ansible/roles/base/files/motd b/ansible/roles/base/files/motd new file mode 100644 index 0000000..fa6c8db --- /dev/null +++ b/ansible/roles/base/files/motd @@ -0,0 +1,4 @@ +THIS SYSTEM IS FOR AUTHORIZED USE ONLY + +All activities are logged and monitored. + diff --git a/ansible/roles/base/files/sshd_config_secured b/ansible/roles/base/files/sshd_config_secured new file mode 100644 index 0000000..88bfedb --- /dev/null +++ b/ansible/roles/base/files/sshd_config_secured @@ -0,0 +1,95 @@ +# Package generated configuration file +# See the sshd_config(5) manpage for details + +# What ports, IPs and protocols we listen for +Port 22 +# Use these options to restrict which interfaces/protocols sshd will bind to +#ListenAddress :: +#ListenAddress 0.0.0.0 +Protocol 2 +# HostKeys for protocol version 2 +HostKey /etc/ssh/ssh_host_rsa_key +HostKey /etc/ssh/ssh_host_dsa_key +HostKey /etc/ssh/ssh_host_ecdsa_key +HostKey /etc/ssh/ssh_host_ed25519_key +#Privilege Separation is turned on for security +UsePrivilegeSeparation yes + +# Lifetime and size of ephemeral version 1 server key +KeyRegenerationInterval 3600 +ServerKeyBits 1024 + +# Logging +SyslogFacility AUTH +LogLevel INFO + +# Authentication: +LoginGraceTime 120 +PermitRootLogin no +StrictModes yes + +RSAAuthentication yes +PubkeyAuthentication yes +#AuthorizedKeysFile %h/.ssh/authorized_keys + +# Don't read the user's ~/.rhosts and ~/.shosts files +IgnoreRhosts yes +# For this to work you will also need host keys in /etc/ssh_known_hosts +RhostsRSAAuthentication no +# similar for protocol version 2 +HostbasedAuthentication no +# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication +#IgnoreUserKnownHosts yes + +# To enable empty passwords, change to yes (NOT RECOMMENDED) +PermitEmptyPasswords no + +# Change to yes to enable challenge-response passwords (beware issues with +# some PAM modules and threads) +ChallengeResponseAuthentication no + +# Change to no to disable tunnelled clear text passwords +PasswordAuthentication no + +# Kerberos options +#KerberosAuthentication no +#KerberosGetAFSToken no +#KerberosOrLocalPasswd yes +#KerberosTicketCleanup yes + +# GSSAPI options +#GSSAPIAuthentication no +#GSSAPICleanupCredentials yes + +X11Forwarding no +X11DisplayOffset 10 +PrintMotd no +PrintLastLog yes +TCPKeepAlive yes +#UseLogin no + +#MaxStartups 10:30:60 +#Banner /etc/issue.net + +# Allow client to pass locale environment variables +AcceptEnv LANG LC_* + +Subsystem sftp /usr/lib/openssh/sftp-server + +# Set this to 'yes' to enable PAM authentication, account processing, +# and session processing. If this is enabled, PAM authentication will +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. +UsePAM yes + +ClientAliveInterval 300 + +#enable remote powershell +#Subsystem powershell /usr/bin/pwsh -sshs -NoLogo + + diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml new file mode 100644 index 0000000..6e0d0b1 --- /dev/null +++ b/ansible/roles/base/tasks/main.yaml @@ -0,0 +1,132 @@ +- name: Update packages + apt: + name: '*' + state: latest + update_cache: yes + only_upgrade: yes + retries: 300 + delay: 10 + +- name: Remove packages not needed anymore + apt: + autoremove: yes + retries: 300 + delay: 10 + +- name: Install required packages Debian + apt: + state: latest + pkg: "{{ item }}" + with_items: "{{ required_packages }}" + retries: 300 + delay: 10 + +- name: Create user account + user: + name: "user" + shell: /bin/bash + state: present + createhome: yes + +- name: ensure ssh folder exists for user + file: + path: /home/user/.ssh + owner: user + group: user + mode: "0700" + state: directory + +- name: Deploy SSH Key (user) + copy: + dest: /home/user/.ssh/authorized_keys + src: files/authorized_keys_user + owner: user + group: user + force: true + +- name: Remove Root SSH Configuration + file: + path: /root/.ssh + state: absent + +- name: Copy Secured SSHD Configuration + copy: + src: files/sshd_config_secured + dest: /etc/ssh/sshd_config + owner: root + group: root + mode: "0644" + when: ansible_os_family == "Debian" + +- name: Copy Secured SSHD Configuration + copy: + src: files/sshd_config_secured_redhat + dest: /etc/ssh/sshd_config + owner: root + group: root + mode: "0644" + when: ansible_os_family == "RedHat" + +- name: Restart SSHD + systemd: + name: sshd + daemon_reload: yes + state: restarted + enabled: yes + ignore_errors: yes + + +- name: Copy unattended-upgrades file + copy: + src: files/10periodic + dest: /etc/apt/apt.conf.d/10periodic + owner: root + group: root + mode: "0644" + force: yes + when: ansible_os_family == "Debian" + +- name: Remove undesirable packages + package: + name: "{{ unnecessary_software }}" + state: absent + when: ansible_os_family == "Debian" + +- name: Stop and disable unnecessary services + service: + name: "{{ item }}" + state: stopped + enabled: no + with_items: "{{ unnecessary_services }}" + ignore_errors: yes + +- name: Set a message of the day + copy: + dest: /etc/motd + src: files/motd + owner: root + group: root + mode: 0644 + +- name: Set a login banner + copy: + dest: "{{ item }}" + src: files/issue + owner: root + group: root + mode: 0644 + with_items: + - /etc/issue + - /etc/issue.net + +- name: set timezone + shell: timedatectl set-timezone America/Chicago + +- name: Enable cockpit + systemd: + name: cockpit + daemon_reload: yes + state: restarted + enabled: yes + when: ansible_os_family == "RedHat" + diff --git a/ansible/roles/base/vars/main.yaml b/ansible/roles/base/vars/main.yaml new file mode 100644 index 0000000..2670ac2 --- /dev/null +++ b/ansible/roles/base/vars/main.yaml @@ -0,0 +1,17 @@ +required_packages: + - ufw + - qemu-guest-agent + - fail2ban + - unattended-upgrades + - cockpit + - nfs-common + - open-iscsi + +unnecessary_services: + - postfix + - telnet + +unnecessary_software: + - tcpdump + - nmap-ncat + - wpa_supplicant From 7443e025e0096cc5a3f0eef86398a583d0e882fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Feb 2025 20:37:24 -0600 Subject: [PATCH 0372/1058] update --- ansible/base.yaml | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 ansible/base.yaml diff --git a/ansible/base.yaml b/ansible/base.yaml new file mode 100644 index 0000000..9093cdb --- /dev/null +++ b/ansible/base.yaml @@ -0,0 +1,5 @@ +- hosts: all + gather_facts: yes + become: yes + roles: + - base From 628793d5df6ce6e891c3e4b897a8300887158adb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Feb 2025 04:55:34 -0600 Subject: [PATCH 0373/1058] remove postgres to rebuild --- infra/terraform/main.tf | 1 - infra/terraform/postgres.tf | 114 ++++++++++++++++++------------------ 2 files changed, 57 insertions(+), 58 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 25c711d..f2f4f44 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -66,4 +66,3 @@ locals { ip = ["34", "35", "36"] } } - diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf index 5bbf658..23ac884 100644 --- a/infra/terraform/postgres.tf +++ b/infra/terraform/postgres.tf @@ -56,60 +56,60 @@ resource "proxmox_vm_qemu" "haproxy" { nameserver = local.dnsserver } -resource "proxmox_vm_qemu" "postgres" { - count = local.postgres.count - ciuser = "administrator" - vmid = "${local.vlan}${local.postgres.ip[count.index]}" - name = local.postgres.name[count.index] - target_node = local.postgres.node[count.index] - clone = local.template - tags = local.postgres.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.postgres.cores - sockets = 1 - cpu_type = "host" - memory = local.postgres.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.postgres.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} +//resource "proxmox_vm_qemu" "postgres" { +// count = local.postgres.count +// ciuser = "administrator" +// vmid = "${local.vlan}${local.postgres.ip[count.index]}" +// name = local.postgres.name[count.index] +// target_node = local.postgres.node[count.index] +// clone = local.template +// tags = local.postgres.tags +// qemu_os = "l26" +// full_clone = true +// os_type = "cloud-init" +// agent = 1 +// cores = local.postgres.cores +// sockets = 1 +// cpu_type = "host" +// memory = local.postgres.memory +// scsihw = "virtio-scsi-pci" +// #bootdisk = "scsi0" +// boot = "order=virtio0" +// onboot = true +// sshkeys = local.sshkeys +// vga { +// type = "serial0" +// } +// serial { +// id = 0 +// type = "socket" +// } +// disks { +// ide { +// ide2 { +// cloudinit { +// storage = local.storage +// } +// } +// } +// virtio { +// virtio0 { +// disk { +// size = local.postgres.drive +// format = local.format +// storage = local.storage +// } +// } +// } +// } +// network { +// id = 0 +// model = "virtio" +// bridge = "vmbr0" +// tag = local.vlan +// } +// #Cloud Init Settings +// ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" +// searchdomain = "durp.loc" +// nameserver = local.dnsserver +//} From 94554fe6fa2e96118d974c31c3d01278e7fdf4b2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Feb 2025 04:57:23 -0600 Subject: [PATCH 0374/1058] update --- master/gitlab-runner/Dockerfile | 4 ---- master/gitlab-runner/values.yaml | 4 ++-- 2 files changed, 2 insertions(+), 6 deletions(-) delete mode 100644 master/gitlab-runner/Dockerfile diff --git a/master/gitlab-runner/Dockerfile b/master/gitlab-runner/Dockerfile deleted file mode 100644 index 498fcc3..0000000 --- a/master/gitlab-runner/Dockerfile +++ /dev/null @@ -1,4 +0,0 @@ -FROM ubuntu:latest -LABEL authors="user" - -ENTRYPOINT ["top", "-b"] \ No newline at end of file diff --git a/master/gitlab-runner/values.yaml b/master/gitlab-runner/values.yaml index 0cc62b8..9535eb7 100644 --- a/master/gitlab-runner/values.yaml +++ b/master/gitlab-runner/values.yaml @@ -6,7 +6,7 @@ gitlab-runner: imagePullPolicy: Always gitlabUrl: https://gitlab.com/ - unregisterRunner: true + unregisterRunner: false terminationGracePeriodSeconds: 3600 concurrent: 10 checkInterval: 30 @@ -68,4 +68,4 @@ gitlab-runner: memory: 2Gi requests: memory: 128Mi - cpu: 500m \ No newline at end of file + cpu: 500m From 0e5aa931f6fe89cbe5c316d5429a0972f26a05fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Feb 2025 05:04:20 -0600 Subject: [PATCH 0375/1058] update --- infra/terraform/postgres.tf | 114 ++++++++++++++++++------------------ 1 file changed, 57 insertions(+), 57 deletions(-) diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf index 23ac884..5bbf658 100644 --- a/infra/terraform/postgres.tf +++ b/infra/terraform/postgres.tf @@ -56,60 +56,60 @@ resource "proxmox_vm_qemu" "haproxy" { nameserver = local.dnsserver } -//resource "proxmox_vm_qemu" "postgres" { -// count = local.postgres.count -// ciuser = "administrator" -// vmid = "${local.vlan}${local.postgres.ip[count.index]}" -// name = local.postgres.name[count.index] -// target_node = local.postgres.node[count.index] -// clone = local.template -// tags = local.postgres.tags -// qemu_os = "l26" -// full_clone = true -// os_type = "cloud-init" -// agent = 1 -// cores = local.postgres.cores -// sockets = 1 -// cpu_type = "host" -// memory = local.postgres.memory -// scsihw = "virtio-scsi-pci" -// #bootdisk = "scsi0" -// boot = "order=virtio0" -// onboot = true -// sshkeys = local.sshkeys -// vga { -// type = "serial0" -// } -// serial { -// id = 0 -// type = "socket" -// } -// disks { -// ide { -// ide2 { -// cloudinit { -// storage = local.storage -// } -// } -// } -// virtio { -// virtio0 { -// disk { -// size = local.postgres.drive -// format = local.format -// storage = local.storage -// } -// } -// } -// } -// network { -// id = 0 -// model = "virtio" -// bridge = "vmbr0" -// tag = local.vlan -// } -// #Cloud Init Settings -// ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" -// searchdomain = "durp.loc" -// nameserver = local.dnsserver -//} +resource "proxmox_vm_qemu" "postgres" { + count = local.postgres.count + ciuser = "administrator" + vmid = "${local.vlan}${local.postgres.ip[count.index]}" + name = local.postgres.name[count.index] + target_node = local.postgres.node[count.index] + clone = local.template + tags = local.postgres.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.postgres.cores + sockets = 1 + cpu_type = "host" + memory = local.postgres.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.postgres.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} From 354a9c63a9ca78e565ae737421de0c7176f55bad Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Feb 2025 04:48:16 -0600 Subject: [PATCH 0376/1058] update --- infra/terraform/main.tf | 10 +++++++ infra/terraform/pihole.tf | 57 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 infra/terraform/pihole.tf diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index f2f4f44..b7c2a05 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -65,4 +65,14 @@ locals { node = ["mothership", "overlord", "vanguard"] ip = ["34", "35", "36"] } + pihole = { + tags = "pihole" + count = 3 + name = ["pihole-01", "pihole-02", "pihole-03"] + cores = 2 + memory = "2048" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["41", "42", "43"] + } } diff --git a/infra/terraform/pihole.tf b/infra/terraform/pihole.tf new file mode 100644 index 0000000..faeda60 --- /dev/null +++ b/infra/terraform/pihole.tf @@ -0,0 +1,57 @@ +resource "proxmox_vm_qemu" "pihole" { + count = local.pihole.count + ciuser = "administrator" + vmid = "${local.vlan}${local.pihole.ip[count.index]}" + name = local.pihole.name[count.index] + target_node = local.pihole.node[count.index] + clone = local.template + tags = local.pihole.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.pihole.cores + sockets = 1 + cpu_type = "host" + memory = local.pihole.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.pihole.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.pihole.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} From 8f97c4cd33bcca17ccf0641f2f951e33f6ecf16b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 23 Feb 2025 12:38:27 -0600 Subject: [PATCH 0377/1058] update dns --- infra/terraform/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index b7c2a05..0203f28 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -23,7 +23,7 @@ locals { storage = "cache-domains" emulatessd = true format = "raw" - dnsserver = "192.168.12.1" + dnsserver = "192.168.12.41,192.168.12.42,192.168.12.43" vlan = 12 k3smaster = { tags = "k3s_infra" From d53bb7b37c3fa904aa3601cbd64cbc3046adcd84 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Feb 2025 05:00:01 -0600 Subject: [PATCH 0378/1058] update --- infra/terraform/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 0203f28..b7c2a05 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -23,7 +23,7 @@ locals { storage = "cache-domains" emulatessd = true format = "raw" - dnsserver = "192.168.12.41,192.168.12.42,192.168.12.43" + dnsserver = "192.168.12.1" vlan = 12 k3smaster = { tags = "k3s_infra" From fc2d1e8a1aab311b06740ca40002a6f8d45cc968 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Feb 2025 05:20:54 -0600 Subject: [PATCH 0379/1058] update --- infra/argocd/values.yaml | 4 ++-- infra/authentik/values.yaml | 14 +++++++++++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 17166db..24924a5 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -3,7 +3,7 @@ argo-cd: global: revisionHistoryLimit: 1 image: - repository: registry.internal.durp.info/argoproj/argocd + repository: registry.durp.info/argoproj/argocd imagePullPolicy: Always server: @@ -26,7 +26,7 @@ argo-cd: dex: enabled: true image: - repository: registry.internal.durp.info/dexidp/dex + repository: registry.durp.info/dexidp/dex imagePullPolicy: Always configs: diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index ccd9db9..4fa183b 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -29,7 +29,19 @@ authentik: worker: replicas: 3 postgresql: - enabled: false + enabled: true + image: + registry: registry.durp.info + repository: bitnami/postgresql + pullPolicy: Always + postgresqlUsername: "authentik" + postgresqlDatabase: "authentik" + existingSecret: db-pass + persistence: + enabled: true + storageClass: longhorn + accessModes: + - ReadWriteMany redis: enabled: true master: From 2af0e7a3aed68cad11ed668efba62799230831e0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Feb 2025 05:52:49 -0600 Subject: [PATCH 0380/1058] update --- infra/authentik/templates/ingress.yaml | 73 +++++++++++--------------- 1 file changed, 31 insertions(+), 42 deletions(-) diff --git a/infra/authentik/templates/ingress.yaml b/infra/authentik/templates/ingress.yaml index 2e17729..b6935a7 100644 --- a/infra/authentik/templates/ingress.yaml +++ b/infra/authentik/templates/ingress.yaml @@ -1,42 +1,31 @@ -#apiVersion: traefik.containo.us/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: authentik-server -# port: 80 -# tls: -# secretName: authentik-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-tls -#spec: -# secretName: authentik-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "authentik.durp.info" -# dnsNames: -# - "authentik.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: authentik-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.infra.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 80 + tls: + secretName: authentik-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + secretName: authentik-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "authentik.infra.durp.info" + dnsNames: + - "authentik.infra.durp.info" + From 701f6d1f9671010006977d6e7a37a35f303cc20d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Feb 2025 05:54:08 -0600 Subject: [PATCH 0381/1058] update --- infra/authentik/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/templates/ingress.yaml b/infra/authentik/templates/ingress.yaml index b6935a7..0936580 100644 --- a/infra/authentik/templates/ingress.yaml +++ b/infra/authentik/templates/ingress.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: authentik-ingress From b549c9cfb28483755500c761c71738786a49b157 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Feb 2025 06:12:36 -0600 Subject: [PATCH 0382/1058] update --- .gitlab/.gitlab-ci.yml | 3 +- dmz/.gitlab/.gitlab-ci.yml | 95 ++++++++++++++++++++++++++++++ dmz/terraform/k3s.tf | 116 +++++++++++++++++++++++++++++++++++++ dmz/terraform/main.tf | 78 +++++++++++++++++++++++++ dmz/terraform/variables.tf | 14 +++++ 5 files changed, 305 insertions(+), 1 deletion(-) create mode 100644 dmz/.gitlab/.gitlab-ci.yml create mode 100644 dmz/terraform/k3s.tf create mode 100644 dmz/terraform/main.tf create mode 100644 dmz/terraform/variables.tf diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index 080d92c..a568021 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -1,2 +1,3 @@ include: - - local: infra/.gitlab/.gitlab-ci.yml \ No newline at end of file + - local: infra/.gitlab/.gitlab-ci.yml + - local: dmz/.gitlab/.gitlab-ci.yml diff --git a/dmz/.gitlab/.gitlab-ci.yml b/dmz/.gitlab/.gitlab-ci.yml new file mode 100644 index 0000000..61ab572 --- /dev/null +++ b/dmz/.gitlab/.gitlab-ci.yml @@ -0,0 +1,95 @@ +stages: + - plan + - apply + - destroy + +variables: + WORKDIR: $CI_PROJECT_DIR/dmz/terraform + GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/dmz + +image: + name: registry.internal.durp.info/opentofu/opentofu:latest + entrypoint: [""] + +.tf-init: + before_script: + - cd $WORKDIR + - tofu init + -reconfigure + -backend-config="address=${GITLAB_TF_ADDRESS}" + -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="username=gitlab-ci-token" + -backend-config="password=${CI_JOB_TOKEN}" + -backend-config="lock_method=POST" + -backend-config="unlock_method=DELETE" + -backend-config="retry_wait_min=5" + +format: + stage: .pre + allow_failure: false + script: + - cd $WORKDIR + - tofu fmt -diff -check -write=false + rules: + - changes: + - "dmz/terraform/*.tf" + +validate: + stage: .pre + allow_failure: false + extends: .tf-init + script: + - tofu validate + rules: + - changes: + - "dmz/terraform/*.tf" + +plan-dmzstructure: + stage: plan + variables: + PLAN: plan.tfplan + JSON_PLAN_FILE: tfplan.json + ENVIRONMENT_NAME: dmz + allow_failure: false + extends: .tf-init + script: + - apk add --update curl jq + - alias convert_report="jq -r '([.resource_changes[].change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'" + - tofu plan -out=$PLAN $ARGUMENTS + - tofu show --json $PLAN | jq -r '([.resource_changes[].change.actions?]|flatten)|{"create":(map(select(.=="create"))|length),"update":(map(select(.=="update"))|length),"delete":(map(select(.=="delete"))|length)}' > $JSON_PLAN_FILE + artifacts: + reports: + terraform: $WORKDIR/$JSON_PLAN_FILE + needs: ["validate","format"] + rules: + - changes: + - "dmz/terraform/*.tf" + +apply-dmzstructure: + stage: apply + variables: + ENVIRONMENT_NAME: dmz + allow_failure: false + extends: .tf-init + script: + - tofu apply -auto-approve $ARGUMENTS + rules: + - changes: + - "dmz/terraform/*.tf" + when: manual + needs: ["plan-dmzstructure"] + +destroy-dmzstructure: + stage: destroy + variables: + ENVIRONMENT_NAME: dmz + allow_failure: false + extends: .tf-init + script: + - tofu destroy -auto-approve $ARGUMENTS + rules: + - changes: + - "dmz/terraform/*.tf" + when: manual + needs: ["plan-dmzstructure"] diff --git a/dmz/terraform/k3s.tf b/dmz/terraform/k3s.tf new file mode 100644 index 0000000..29426bd --- /dev/null +++ b/dmz/terraform/k3s.tf @@ -0,0 +1,116 @@ +resource "proxmox_vm_qemu" "k3smaster" { + lifecycle { + prevent_destroy = true + } + count = local.k3smaster.count + ciuser = "administrator" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + tags = local.k3smaster.tags + full_clone = false + qemu_os = "l26" + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + lifecycle { + prevent_destroy = true + } + count = local.k3sserver.count + ciuser = "administrator" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = false + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf new file mode 100644 index 0000000..97fe0b5 --- /dev/null +++ b/dmz/terraform/main.tf @@ -0,0 +1,78 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc6" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + storage = "cache-domains" + emulatessd = true + format = "raw" + dnsserver = "192.168.98.1" + vlan = 98 + k3smaster = { + tags = "k3s_dmz" + count = 3 + name = ["master01-dmz", "master02-dmz", "master03-dmz"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_dmz" + count = 3 + name = ["node01-dmz", "node02-dmz", "node03-dmz"] + cores = 4 + memory = "8192" + drive = 240 + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } + haproxy = { + tags = "haproxy" + count = 3 + name = ["haproxy-01", "haproxy-02", "haproxy-03"] + cores = 2 + memory = "1024" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["31", "32", "33"] + } + postgres = { + tags = "postgres" + count = 3 + name = ["postgres-01", "postgres-02", "postgres-03"] + cores = 4 + memory = "4096" + drive = 40 + node = ["mothership", "overlord", "vanguard"] + ip = ["34", "35", "36"] + } + pihole = { + tags = "pihole" + count = 3 + name = ["pihole-01", "pihole-02", "pihole-03"] + cores = 2 + memory = "2048" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["41", "42", "43"] + } +} diff --git a/dmz/terraform/variables.tf b/dmz/terraform/variables.tf new file mode 100644 index 0000000..31a92e0 --- /dev/null +++ b/dmz/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "UIsername to Proxmox provider" + type = string +} From 3c8bd3ffd07412ce7e35597ef54520cd9e194974 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Feb 2025 06:21:11 -0600 Subject: [PATCH 0383/1058] update --- dmz/.gitlab/.gitlab-ci.yml | 12 ++++++------ dmz/terraform/k3s.tf | 21 ++++++++++----------- dmz/terraform/main.tf | 30 ------------------------------ 3 files changed, 16 insertions(+), 47 deletions(-) diff --git a/dmz/.gitlab/.gitlab-ci.yml b/dmz/.gitlab/.gitlab-ci.yml index 61ab572..e0532bc 100644 --- a/dmz/.gitlab/.gitlab-ci.yml +++ b/dmz/.gitlab/.gitlab-ci.yml @@ -8,7 +8,7 @@ variables: GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/dmz image: - name: registry.internal.durp.info/opentofu/opentofu:latest + name: registry.durp.info/opentofu/opentofu:latest entrypoint: [""] .tf-init: @@ -45,7 +45,7 @@ validate: - changes: - "dmz/terraform/*.tf" -plan-dmzstructure: +plan-dmz-infrastructure: stage: plan variables: PLAN: plan.tfplan @@ -66,7 +66,7 @@ plan-dmzstructure: - changes: - "dmz/terraform/*.tf" -apply-dmzstructure: +apply-dmz-infrastructure: stage: apply variables: ENVIRONMENT_NAME: dmz @@ -78,9 +78,9 @@ apply-dmzstructure: - changes: - "dmz/terraform/*.tf" when: manual - needs: ["plan-dmzstructure"] + needs: ["plan-dmz-infrastructure"] -destroy-dmzstructure: +destroy-dmz-infrastructure: stage: destroy variables: ENVIRONMENT_NAME: dmz @@ -92,4 +92,4 @@ destroy-dmzstructure: - changes: - "dmz/terraform/*.tf" when: manual - needs: ["plan-dmzstructure"] + needs: ["plan-dmz-infrastructure"] diff --git a/dmz/terraform/k3s.tf b/dmz/terraform/k3s.tf index 29426bd..bca2f62 100644 --- a/dmz/terraform/k3s.tf +++ b/dmz/terraform/k3s.tf @@ -1,14 +1,13 @@ resource "proxmox_vm_qemu" "k3smaster" { - lifecycle { - prevent_destroy = true - } count = local.k3smaster.count ciuser = "administrator" + vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" name = local.k3smaster.name[count.index] target_node = local.k3smaster.node[count.index] + clone = local.template tags = local.k3smaster.tags - full_clone = false qemu_os = "l26" + full_clone = true os_type = "cloud-init" agent = 1 cores = local.k3smaster.cores @@ -16,9 +15,10 @@ resource "proxmox_vm_qemu" "k3smaster" { cpu_type = "host" memory = local.k3smaster.memory scsihw = "virtio-scsi-pci" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys vga { type = "serial0" } @@ -57,16 +57,15 @@ resource "proxmox_vm_qemu" "k3smaster" { } resource "proxmox_vm_qemu" "k3sserver" { - lifecycle { - prevent_destroy = true - } count = local.k3sserver.count ciuser = "administrator" + vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" name = local.k3sserver.name[count.index] target_node = local.k3sserver.node[count.index] + clone = local.template tags = local.k3sserver.tags qemu_os = "l26" - full_clone = false + full_clone = true os_type = "cloud-init" agent = 1 cores = local.k3sserver.cores diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf index 97fe0b5..55a74b7 100644 --- a/dmz/terraform/main.tf +++ b/dmz/terraform/main.tf @@ -45,34 +45,4 @@ locals { node = ["mothership", "overlord", "vanguard"] ip = ["21", "22", "23"] } - haproxy = { - tags = "haproxy" - count = 3 - name = ["haproxy-01", "haproxy-02", "haproxy-03"] - cores = 2 - memory = "1024" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["31", "32", "33"] - } - postgres = { - tags = "postgres" - count = 3 - name = ["postgres-01", "postgres-02", "postgres-03"] - cores = 4 - memory = "4096" - drive = 40 - node = ["mothership", "overlord", "vanguard"] - ip = ["34", "35", "36"] - } - pihole = { - tags = "pihole" - count = 3 - name = ["pihole-01", "pihole-02", "pihole-03"] - cores = 2 - memory = "2048" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["41", "42", "43"] - } } From dc075d4247a46643fde37651bde94e251859fdca Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 05:09:32 -0600 Subject: [PATCH 0384/1058] update --- infra/argocd/templates/traefik.yaml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index ee8ba60..8467697 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -19,3 +19,26 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: traefik + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/traefik + destination: + namespace: traefik + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From 29fbf7ec7b5d151e47c5a6fd20aaa1939e7d1ccf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 05:10:35 -0600 Subject: [PATCH 0385/1058] update --- infra/argocd/templates/traefik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index 8467697..cfcb141 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -24,7 +24,7 @@ spec: apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: traefik + name: traefik-dmz namespace: argocd spec: project: default From ee464ed40f33a489cecfd70226a87323bbdc9772 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 05:28:31 -0600 Subject: [PATCH 0386/1058] update --- dmz/metallb-system/Chart.yaml | 12 ++++++ dmz/metallb-system/templates/config.yaml | 17 ++++++++ dmz/metallb-system/values.yaml | 0 dmz/traefik/Chart.yaml | 11 +++++ dmz/traefik/values.yaml | 47 ++++++++++++++++++++++ infra/argocd/templates/metallb-system.yaml | 23 +++++++++++ infra/argocd/templates/traefik.yaml | 2 +- 7 files changed, 111 insertions(+), 1 deletion(-) create mode 100644 dmz/metallb-system/Chart.yaml create mode 100644 dmz/metallb-system/templates/config.yaml create mode 100644 dmz/metallb-system/values.yaml create mode 100644 dmz/traefik/Chart.yaml create mode 100644 dmz/traefik/values.yaml diff --git a/dmz/metallb-system/Chart.yaml b/dmz/metallb-system/Chart.yaml new file mode 100644 index 0000000..4fc684f --- /dev/null +++ b/dmz/metallb-system/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.14.9 diff --git a/dmz/metallb-system/templates/config.yaml b/dmz/metallb-system/templates/config.yaml new file mode 100644 index 0000000..f08a885 --- /dev/null +++ b/dmz/metallb-system/templates/config.yaml @@ -0,0 +1,17 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap +spec: + addresses: + - 192.168.98.130-192.168.98.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: pool + namespace: metallb-system +spec: + ipAddressPools: + - cheap + diff --git a/dmz/metallb-system/values.yaml b/dmz/metallb-system/values.yaml new file mode 100644 index 0000000..e69de29 diff --git a/dmz/traefik/Chart.yaml b/dmz/traefik/Chart.yaml new file mode 100644 index 0000000..30f96ac --- /dev/null +++ b/dmz/traefik/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: traefik +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: traefik + repository: https://traefik.github.io/charts + version: 34.0.0 diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml new file mode 100644 index 0000000..3d2576e --- /dev/null +++ b/dmz/traefik/values.yaml @@ -0,0 +1,47 @@ +traefik: + image: + registry: registry.durp.info + repository: traefik + pullPolicy: Always + + deployment: + replicas: 3 + revisionHistoryLimit: 1 + + ingressRoute: + dashboard: + enabled: true + + additionalArguments: + - "--serversTransport.insecureSkipVerify=true" + - "--log.level=DEBUG" + - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin + - --experimental.plugins.jwt.version=v0.7.0 + + autoscaling: + enabled: true + minReplicas: 3 + maxReplicas: 10 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 60 + + + # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container. + resources: + requests: + cpu: "100m" + memory: "512Mi" + limits: + memory: "512Mi" diff --git a/infra/argocd/templates/metallb-system.yaml b/infra/argocd/templates/metallb-system.yaml index 4bf695a..503fe57 100644 --- a/infra/argocd/templates/metallb-system.yaml +++ b/infra/argocd/templates/metallb-system.yaml @@ -19,3 +19,26 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb-system-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/metallb-system + destination: + namespace: metallb-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index cfcb141..9122420 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -31,7 +31,7 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: infra/traefik + path: dmz/traefik destination: namespace: traefik name: dmz From cb70aecd1ddacdb9242dbedc72c0d8f784c36567 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 05:31:46 -0600 Subject: [PATCH 0387/1058] update --- infra/argocd/templates/metallb-system.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/templates/metallb-system.yaml b/infra/argocd/templates/metallb-system.yaml index 503fe57..a113c53 100644 --- a/infra/argocd/templates/metallb-system.yaml +++ b/infra/argocd/templates/metallb-system.yaml @@ -34,7 +34,7 @@ spec: path: dmz/metallb-system destination: namespace: metallb-system - name: in-cluster + name: dmz syncPolicy: automated: prune: true From 62097968d7138dc6b5ab5ee1e855b0b1d430564f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 05:40:16 -0600 Subject: [PATCH 0388/1058] update --- ansible/roles/base/tasks/main.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml index 6e0d0b1..952e4cb 100644 --- a/ansible/roles/base/tasks/main.yaml +++ b/ansible/roles/base/tasks/main.yaml @@ -128,5 +128,9 @@ daemon_reload: yes state: restarted enabled: yes - when: ansible_os_family == "RedHat" +- name: change password + ansible.builtin.user: + name: "administrator" + state: present + password: "{{ lookup('ansible.builtin.env', 'ADMIN_PASSWORD') | password_hash('sha512') }}" From de7c9b5c137b7571f3ea304f1d4018f351b1f504 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 06:16:17 -0600 Subject: [PATCH 0389/1058] update --- dmz/internalproxy/templates/authentik.yaml | 25 +++ dmz/internalproxy/templates/ollama.yaml | 202 ++++++++++----------- infra/argocd/templates/internalproxy.yaml | 21 +++ 3 files changed, 147 insertions(+), 101 deletions(-) create mode 100644 dmz/internalproxy/templates/authentik.yaml create mode 100644 infra/argocd/templates/internalproxy.yaml diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml new file mode 100644 index 0000000..59ff185 --- /dev/null +++ b/dmz/internalproxy/templates/authentik.yaml @@ -0,0 +1,25 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`test.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 443 + tls: + secretName: authentik-tls + +--- + +apiVersion: v1 +kind: Service +metadata: + name: authentik-server +spec: + type: ExternalName + externalName: authentik.infra.durp.info diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 4834ff5..d5dc745 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -1,101 +1,101 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: ollama-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: ollama-secret - data: - - secretKey: users - remoteRef: - key: secrets/internalproxy/ollama - property: users - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: ollama-basic-auth -spec: - basicAuth: - secret: ollama-secret - ---- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: ollama-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`ollama.durp.info`) && PathPrefix(`/`) - middlewares: - - name: ollama-basic-auth - kind: Rule - services: - - name: ollama - port: 11435 - tls: - secretName: ollama-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: ollama-tls -spec: - secretName: ollama-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "ollama.durp.info" - dnsNames: - - "ollama.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: ollama-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: ollama-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: ollama-secret +# data: +# - secretKey: users +# remoteRef: +# key: secrets/internalproxy/ollama +# property: users +# +#--- +# +#apiVersion: traefik.containo.us/v1alpha1 +#kind: Middleware +#metadata: +# name: ollama-basic-auth +#spec: +# basicAuth: +# secret: ollama-secret +# +#--- +# +#apiVersion: v1 +#kind: Service +#metadata: +# name: ollama +#spec: +# ports: +# - name: app +# port: 11435 +# protocol: TCP +# targetPort: 11435 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: ollama +#subsets: +# - addresses: +# - ip: 192.168.20.104 +# ports: +# - name: app +# port: 11435 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.containo.us/v1alpha1 +#kind: IngressRoute +#metadata: +# name: ollama-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`ollama.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: ollama-basic-auth +# kind: Rule +# services: +# - name: ollama +# port: 11435 +# tls: +# secretName: ollama-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: ollama-tls +#spec: +# secretName: ollama-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "ollama.durp.info" +# dnsNames: +# - "ollama.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: ollama-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/infra/argocd/templates/internalproxy.yaml b/infra/argocd/templates/internalproxy.yaml new file mode 100644 index 0000000..57e2c60 --- /dev/null +++ b/infra/argocd/templates/internalproxy.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: internal-proxy + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/internalproxy + destination: + namespace: internalproxy + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From 49a46eba48473d02c00a5e5b553e1b19510dffd2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 06:17:50 -0600 Subject: [PATCH 0390/1058] update --- dmz/internalproxy/Chart.yaml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 dmz/internalproxy/Chart.yaml diff --git a/dmz/internalproxy/Chart.yaml b/dmz/internalproxy/Chart.yaml new file mode 100644 index 0000000..71c9b0d --- /dev/null +++ b/dmz/internalproxy/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: internalproxy +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "0.1.0" From 04d21b3909f6f5c193dae26c582314d204785ddb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 06:21:11 -0600 Subject: [PATCH 0391/1058] update --- dmz/traefik/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 3d2576e..3438f0e 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -4,6 +4,9 @@ traefik: repository: traefik pullPolicy: Always + providers: + allowExternalNameServices: true + deployment: replicas: 3 revisionHistoryLimit: 1 From 5ad8140324065561ae421f361fedc387a9ed2ad9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 06:22:11 -0600 Subject: [PATCH 0392/1058] update --- dmz/traefik/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 3438f0e..12fba73 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -5,6 +5,7 @@ traefik: pullPolicy: Always providers: + kubernetesCRD: allowExternalNameServices: true deployment: From 1ee6edb43dff7eed4b2eb69d3bd21cff50d9f42e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 06:23:01 -0600 Subject: [PATCH 0393/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 59ff185..d46798c 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -11,8 +11,6 @@ spec: services: - name: authentik-server port: 443 - tls: - secretName: authentik-tls --- From ed3d4941b334b7a4eab14c6c197050f7ec85de96 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Feb 2025 06:27:03 -0600 Subject: [PATCH 0394/1058] update --- dmz/internalproxy/templates/authentik.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index d46798c..1e1e9fe 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -11,6 +11,8 @@ spec: services: - name: authentik-server port: 443 + tls: + secretName: authentik-tls --- @@ -21,3 +23,15 @@ metadata: spec: type: ExternalName externalName: authentik.infra.durp.info + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + secretName: authentik-tls + commonName: "test.durp.info" + dnsNames: + - "test.durp.info" From ba79286ce69e1a5b122f3adaf512c0fec9202e7c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 04:49:40 -0600 Subject: [PATCH 0395/1058] add cert manager to dmz --- dmz/cert-manager/Chart.yaml | 11 +++++++ dmz/cert-manager/templates/issuer.yaml | 6 ++++ dmz/cert-manager/templates/letsencrypt.yaml | 35 +++++++++++++++++++++ dmz/cert-manager/templates/secretvault.yaml | 23 ++++++++++++++ dmz/cert-manager/values.yaml | 26 +++++++++++++++ infra/argocd/templates/cert-manager.yaml | 23 ++++++++++++++ 6 files changed, 124 insertions(+) create mode 100644 dmz/cert-manager/Chart.yaml create mode 100644 dmz/cert-manager/templates/issuer.yaml create mode 100644 dmz/cert-manager/templates/letsencrypt.yaml create mode 100644 dmz/cert-manager/templates/secretvault.yaml create mode 100644 dmz/cert-manager/values.yaml diff --git a/dmz/cert-manager/Chart.yaml b/dmz/cert-manager/Chart.yaml new file mode 100644 index 0000000..ecf60fa --- /dev/null +++ b/dmz/cert-manager/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.16.3 diff --git a/dmz/cert-manager/templates/issuer.yaml b/dmz/cert-manager/templates/issuer.yaml new file mode 100644 index 0000000..6b889c7 --- /dev/null +++ b/dmz/cert-manager/templates/issuer.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: issuer +secrets: + - name: issuer-token-lmzpj \ No newline at end of file diff --git a/dmz/cert-manager/templates/letsencrypt.yaml b/dmz/cert-manager/templates/letsencrypt.yaml new file mode 100644 index 0000000..0203412 --- /dev/null +++ b/dmz/cert-manager/templates/letsencrypt.yaml @@ -0,0 +1,35 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret + +--- + +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: vault-issuer +spec: + vault: + server: https://vault.infra.durp.info + caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + path: pki/sign/issue-homelab-certs + auth: + kubernetes: + mountPath: /v1/auth/kubernetes + role: issuer + secretRef: + name: issuer-token-lmzpj + key: token diff --git a/dmz/cert-manager/templates/secretvault.yaml b/dmz/cert-manager/templates/secretvault.yaml new file mode 100644 index 0000000..0a5da62 --- /dev/null +++ b/dmz/cert-manager/templates/secretvault.yaml @@ -0,0 +1,23 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: kv/cert-manager + property: cloudflare-api-token-secret + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + diff --git a/dmz/cert-manager/values.yaml b/dmz/cert-manager/values.yaml new file mode 100644 index 0000000..0cec0b9 --- /dev/null +++ b/dmz/cert-manager/values.yaml @@ -0,0 +1,26 @@ +cert-manager: + crds: + enabled: true + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-controller + pullPolicy: Always + replicaCount: 3 + #extraArgs: + # - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + # - --dns01-recursive-nameservers-only + #podDnsPolicy: None + #podDnsConfig: + # nameservers: + # - "1.1.1.1" + # - "1.0.0.1" + webhook: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-webhook + pullPolicy: Always + cainjector: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-cainjector + pullPolicy: Always diff --git a/infra/argocd/templates/cert-manager.yaml b/infra/argocd/templates/cert-manager.yaml index 68ac622..e7ac95d 100644 --- a/infra/argocd/templates/cert-manager.yaml +++ b/infra/argocd/templates/cert-manager.yaml @@ -19,3 +19,26 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: cert-manager-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/cert-manager + destination: + namespace: cert-manager + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From 7f75de1fe1f62339088e3b39271ba44739bcf5cc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 04:51:50 -0600 Subject: [PATCH 0396/1058] update --- dmz/cert-manager/templates/issuer.yaml | 12 +++--- dmz/cert-manager/templates/letsencrypt.yaml | 32 +++++++------- dmz/cert-manager/templates/secretvault.yaml | 46 ++++++++++----------- 3 files changed, 45 insertions(+), 45 deletions(-) diff --git a/dmz/cert-manager/templates/issuer.yaml b/dmz/cert-manager/templates/issuer.yaml index 6b889c7..9c204fb 100644 --- a/dmz/cert-manager/templates/issuer.yaml +++ b/dmz/cert-manager/templates/issuer.yaml @@ -1,6 +1,6 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: issuer -secrets: - - name: issuer-token-lmzpj \ No newline at end of file +#apiVersion: v1 +#kind: ServiceAccount +#metadata: +# name: issuer +#secrets: +# - name: issuer-token-lmzpj diff --git a/dmz/cert-manager/templates/letsencrypt.yaml b/dmz/cert-manager/templates/letsencrypt.yaml index 0203412..dc1c65d 100644 --- a/dmz/cert-manager/templates/letsencrypt.yaml +++ b/dmz/cert-manager/templates/letsencrypt.yaml @@ -1,19 +1,19 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-production -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-production - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret +#apiVersion: cert-manager.io/v1 +#kind: ClusterIssuer +#metadata: +# name: letsencrypt-production +#spec: +# acme: +# server: https://acme-v02.api.letsencrypt.org/directory +# privateKeySecretRef: +# name: letsencrypt-production +# solvers: +# - dns01: +# cloudflare: +# email: developerdurp@durp.info +# apiTokenSecretRef: +# name: cloudflare-api-token-secret +# key: cloudflare-api-token-secret --- diff --git a/dmz/cert-manager/templates/secretvault.yaml b/dmz/cert-manager/templates/secretvault.yaml index 0a5da62..45db5e8 100644 --- a/dmz/cert-manager/templates/secretvault.yaml +++ b/dmz/cert-manager/templates/secretvault.yaml @@ -1,23 +1,23 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: cloudflare-api-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: cloudflare-api-token-secret - data: - - secretKey: cloudflare-api-token-secret - remoteRef: - key: kv/cert-manager - property: cloudflare-api-token-secret - ---- - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault - +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: cloudflare-api-token-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: cloudflare-api-token-secret +# data: +# - secretKey: cloudflare-api-token-secret +# remoteRef: +# key: kv/cert-manager +# property: cloudflare-api-token-secret +# +#--- +# +#apiVersion: v1 +#kind: ServiceAccount +#metadata: +# name: vault +# From a15a57af34fd92a752d61a44b3cd52eda97ae2e4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 04:58:20 -0600 Subject: [PATCH 0397/1058] update --- dmz/internalproxy/templates/authentik.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 1e1e9fe..bd9aa77 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -31,6 +31,9 @@ kind: Certificate metadata: name: authentik-tls spec: + issuerRef: + name: vault-issuer + kind: ClusterIssuer secretName: authentik-tls commonName: "test.durp.info" dnsNames: From daa528630a0f2f2efa76c15b09f7e0278a7aa999 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:00:06 -0600 Subject: [PATCH 0398/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index bd9aa77..6fa7e9d 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -22,7 +22,7 @@ metadata: name: authentik-server spec: type: ExternalName - externalName: authentik.infra.durp.info + externalName: https://authentik.infra.durp.info --- From e9426a2f77b1b2b3621ce8b43f760c2b25d82103 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:00:34 -0600 Subject: [PATCH 0399/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 6fa7e9d..9a6e8c3 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -22,7 +22,7 @@ metadata: name: authentik-server spec: type: ExternalName - externalName: https://authentik.infra.durp.info + externalName: authentik.durp.info --- From 8510dbe76658010881541185ff85080c77c53c5e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:05:11 -0600 Subject: [PATCH 0400/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 9a6e8c3..943444b 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -22,7 +22,7 @@ metadata: name: authentik-server spec: type: ExternalName - externalName: authentik.durp.info + externalName: google.com --- From b829e8303ca205207fcde97da709db093ffdd90f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:09:02 -0600 Subject: [PATCH 0401/1058] update --- dmz/internalproxy/templates/authentik.yaml | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 943444b..c19d34e 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -11,18 +11,23 @@ spec: services: - name: authentik-server port: 443 + services: + authentik-server: + loadBalancer: + servers: + - url: https://google.com tls: secretName: authentik-tls --- -apiVersion: v1 -kind: Service -metadata: - name: authentik-server -spec: - type: ExternalName - externalName: google.com +#apiVersion: v1 +#kind: Service +#metadata: +# name: authentik-server +#spec: +# type: ExternalName +# externalName: google.com --- From b9b5046e8b4217b542469ce4437061a43494d149 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:23:31 -0600 Subject: [PATCH 0402/1058] update --- dmz/internalproxy/templates/authentik.yaml | 73 ++++++++++------------ dmz/traefik/templates/config.yaml | 22 +++++++ dmz/traefik/values.yaml | 4 ++ 3 files changed, 60 insertions(+), 39 deletions(-) create mode 100644 dmz/traefik/templates/config.yaml diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index c19d34e..498ac89 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,45 +1,40 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`test.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: authentik-server - port: 443 - services: - authentik-server: - loadBalancer: - servers: - - url: https://google.com - tls: - secretName: authentik-tls - ---- - +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`test.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: authentik-server +# port: 443 +# tls: +# secretName: authentik-tls +# +#--- +# #apiVersion: v1 #kind: Service #metadata: # name: authentik-server #spec: # type: ExternalName -# externalName: google.com - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: vault-issuer - kind: ClusterIssuer - secretName: authentik-tls - commonName: "test.durp.info" - dnsNames: - - "test.durp.info" +# externalName: authentik.durp.info +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-tls +#spec: +# issuerRef: +# name: vault-issuer +# kind: ClusterIssuer +# secretName: authentik-tls +# commonName: "test.durp.info" +# dnsNames: +# - "test.durp.info" diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml new file mode 100644 index 0000000..28b1191 --- /dev/null +++ b/dmz/traefik/templates/config.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: traefik-configmap +data: + traefik.yaml: | + http: + routers: + router0: + entryPoints: + - web + service: service-foo + rule: host(`test.durp.info`) + tls: + cert-resolver: default + + services: + service-foo: + loadBalancer: + servers: + - url: https://authentik.infra.durp.info + passHostHeader: true diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 12fba73..7d40f11 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -11,6 +11,10 @@ traefik: deployment: replicas: 3 revisionHistoryLimit: 1 + additionalVolumes: + - name: traefik-configmap + mountPath: "/config" + type: configMap ingressRoute: dashboard: From a9b6632a1548ceaef6274bf3010d9835e7f96d6a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:25:31 -0600 Subject: [PATCH 0403/1058] update --- dmz/traefik/templates/config.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 28b1191..56f5d17 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -11,12 +11,10 @@ data: - web service: service-foo rule: host(`test.durp.info`) - tls: - cert-resolver: default services: service-foo: loadBalancer: servers: - - url: https://authentik.infra.durp.info + - url: https://google.com passHostHeader: true From eb94cf66d62e20f2dfb6e4d5eee77d21488199ba Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:27:51 -0600 Subject: [PATCH 0404/1058] update --- dmz/traefik/templates/authentik.yaml | 30 ++++++++++++++++++++++++++++ dmz/traefik/templates/config.yaml | 9 +-------- 2 files changed, 31 insertions(+), 8 deletions(-) create mode 100644 dmz/traefik/templates/authentik.yaml diff --git a/dmz/traefik/templates/authentik.yaml b/dmz/traefik/templates/authentik.yaml new file mode 100644 index 0000000..7032b47 --- /dev/null +++ b/dmz/traefik/templates/authentik.yaml @@ -0,0 +1,30 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`test.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 443 + tls: + secretName: authentik-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: vault-issuer + kind: ClusterIssuer + secretName: authentik-tls + commonName: "test.durp.info" + dnsNames: + - "test.durp.info" diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 56f5d17..e386cb0 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,15 +5,8 @@ metadata: data: traefik.yaml: | http: - routers: - router0: - entryPoints: - - web - service: service-foo - rule: host(`test.durp.info`) - services: - service-foo: + authentik-service: loadBalancer: servers: - url: https://google.com From ff9ed9cb65e0647c76b2f9309a82500d09bd0d05 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:38:19 -0600 Subject: [PATCH 0405/1058] update --- dmz/traefik/values.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 7d40f11..3dfca8f 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -11,10 +11,11 @@ traefik: deployment: replicas: 3 revisionHistoryLimit: 1 - additionalVolumes: - - name: traefik-configmap - mountPath: "/config" - type: configMap + + volumes: + - name: traefik-configmap + mountPath: "/config" + type: configMap ingressRoute: dashboard: From 6a04c3dd85d3d9db888374b5f7d971bd4cb3ac30 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:41:25 -0600 Subject: [PATCH 0406/1058] update --- dmz/traefik/templates/authentik.yaml | 60 ++++++++++++++-------------- dmz/traefik/templates/config.yaml | 11 ++++- 2 files changed, 40 insertions(+), 31 deletions(-) diff --git a/dmz/traefik/templates/authentik.yaml b/dmz/traefik/templates/authentik.yaml index 7032b47..9d82551 100644 --- a/dmz/traefik/templates/authentik.yaml +++ b/dmz/traefik/templates/authentik.yaml @@ -1,30 +1,30 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`test.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: authentik-server - port: 443 - tls: - secretName: authentik-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: vault-issuer - kind: ClusterIssuer - secretName: authentik-tls - commonName: "test.durp.info" - dnsNames: - - "test.durp.info" +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`test.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: authentik-server +# port: 443 +# tls: +# secretName: authentik-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-tls +#spec: +# issuerRef: +# name: vault-issuer +# kind: ClusterIssuer +# secretName: authentik-tls +# commonName: "test.durp.info" +# dnsNames: +# - "test.durp.info" diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index e386cb0..988813a 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,8 +5,17 @@ metadata: data: traefik.yaml: | http: + routers: + router0: + entryPoints: + - websecure + service: service-foo + rule: host(`test.durp.info`) + tls: + cert-resolver: default + services: - authentik-service: + service-foo: loadBalancer: servers: - url: https://google.com From e260f2c0c8e1e11ae1b385b80291a0a6729a0392 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:44:46 -0600 Subject: [PATCH 0407/1058] update --- dmz/traefik/templates/config.yaml | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 988813a..777b049 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -7,16 +7,11 @@ data: http: routers: router0: - entryPoints: - - websecure - service: service-foo - rule: host(`test.durp.info`) - tls: - cert-resolver: default + service: service0 + rule: Host(`test.durp.info`) services: - service-foo: + service0: loadBalancer: servers: - - url: https://google.com - passHostHeader: true + - url: https://google.com From bcb090a117c85d7b153af08cbc019911e2253cc5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:46:23 -0600 Subject: [PATCH 0408/1058] update --- dmz/traefik/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 3dfca8f..a717ae2 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -7,6 +7,7 @@ traefik: providers: kubernetesCRD: allowExternalNameServices: true + allowEmptyServices: false deployment: replicas: 3 From 4e497f094556f571516aa4897ef41a2caf87f214 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:47:48 -0600 Subject: [PATCH 0409/1058] update --- dmz/traefik/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index a717ae2..7e668f9 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -55,3 +55,6 @@ traefik: memory: "512Mi" limits: memory: "512Mi" + + logs: + level: "DEBUG" From 3b722331c9f3b29cebe727fda9e0dae0c763d8c7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:49:47 -0600 Subject: [PATCH 0410/1058] update --- dmz/traefik/templates/traefik-dashboard.yaml | 30 ++++++++++++++++++++ dmz/traefik/values.yaml | 3 -- 2 files changed, 30 insertions(+), 3 deletions(-) create mode 100644 dmz/traefik/templates/traefik-dashboard.yaml diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml new file mode 100644 index 0000000..8657056 --- /dev/null +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -0,0 +1,30 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: traefik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`traefik.durp.info`) + kind: Rule + services: + - name: api@internal + kind: TraefikService + tls: + secretName: traefik-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: traefik-tls + namespace: traefik +spec: + secretName: traefik-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "traefik.durp.info" + dnsNames: + - "traefik.durp.info" diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 7e668f9..a717ae2 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -55,6 +55,3 @@ traefik: memory: "512Mi" limits: memory: "512Mi" - - logs: - level: "DEBUG" From 5a65a188be93f98430f76eb35e0f5b7255515ece Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:50:50 -0600 Subject: [PATCH 0411/1058] update --- dmz/traefik/templates/traefik-dashboard.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 8657056..052fefb 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: traefik-ingress From adb83da5504feeb28d608e1db7d51a5d4696ee34 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:57:40 -0600 Subject: [PATCH 0412/1058] update --- dmz/traefik/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 777b049..2beda69 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -3,7 +3,7 @@ kind: ConfigMap metadata: name: traefik-configmap data: - traefik.yaml: | + traefik.yml: | http: routers: router0: From ded9d4b18c15af73efb4e36082d167b9722f50fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 05:59:26 -0600 Subject: [PATCH 0413/1058] update --- dmz/traefik/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index a717ae2..d10e40e 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -23,6 +23,7 @@ traefik: enabled: true additionalArguments: + - "--configFile=/config/traefik.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin From 3e7d6961fcb26732825440cc2f51944add102eeb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 06:04:50 -0600 Subject: [PATCH 0414/1058] update --- dmz/traefik/values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index d10e40e..a717ae2 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -23,7 +23,6 @@ traefik: enabled: true additionalArguments: - - "--configFile=/config/traefik.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin From a8040986d79162b88522dfe460a99e367fe57879 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 06:06:22 -0600 Subject: [PATCH 0415/1058] update --- dmz/traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index a717ae2..9027409 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -15,7 +15,7 @@ traefik: volumes: - name: traefik-configmap - mountPath: "/config" + mountPath: "/etc/traefik" type: configMap ingressRoute: From 01904f7ca7fec995e3585b239fa8bfd7b0d606fd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Feb 2025 06:07:05 -0600 Subject: [PATCH 0416/1058] update --- dmz/traefik/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 2beda69..d09b955 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -3,7 +3,7 @@ kind: ConfigMap metadata: name: traefik-configmap data: - traefik.yml: | + config.yml: | http: routers: router0: From 990f93ff26cc16c78358fb221abc67ea2f8fa881 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 04:56:05 -0600 Subject: [PATCH 0417/1058] update --- dmz/traefik/templates/config.yaml | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index d09b955..c966bdb 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -10,8 +10,20 @@ data: service: service0 rule: Host(`test.durp.info`) - services: - service0: - loadBalancer: - servers: - - url: https://google.com +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: test-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`test.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: service0 + port: 443 + tls: + secretName: test From 529a38d2e5b6bbfd9d4b4bc2da300617cf041f6e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 04:59:00 -0600 Subject: [PATCH 0418/1058] update --- dmz/traefik/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index c966bdb..bb89532 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -24,6 +24,6 @@ spec: kind: Rule services: - name: service0 - port: 443 + kind: TraefikService tls: secretName: test From 820147d04c6c5f03277080a66c26de85a6bcd794 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:04:49 -0600 Subject: [PATCH 0419/1058] update --- dmz/traefik/templates/config.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index bb89532..a6f70b5 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -24,6 +24,5 @@ spec: kind: Rule services: - name: service0 - kind: TraefikService tls: secretName: test From 3dc3dbbaba42d74cb62ce7326aad57e12e161873 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:28:32 -0600 Subject: [PATCH 0420/1058] update --- dmz/traefik/templates/config.yaml | 21 +++++---------------- dmz/vault/Chart.yaml | 12 ++++++++++++ dmz/vault/values.yaml | 13 +++++++++++++ infra/argocd/templates/vault.yaml | 28 ++++++++++++++++++++++++++++ 4 files changed, 58 insertions(+), 16 deletions(-) create mode 100644 dmz/vault/Chart.yaml create mode 100644 dmz/vault/values.yaml diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index a6f70b5..d09b955 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -10,19 +10,8 @@ data: service: service0 rule: Host(`test.durp.info`) ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: test-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`test.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: service0 - tls: - secretName: test + services: + service0: + loadBalancer: + servers: + - url: https://google.com diff --git a/dmz/vault/Chart.yaml b/dmz/vault/Chart.yaml new file mode 100644 index 0000000..e52029e --- /dev/null +++ b/dmz/vault/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: vault +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: vault + repository: https://helm.releases.hashicorp.com + version: 0.29.1 + diff --git a/dmz/vault/values.yaml b/dmz/vault/values.yaml new file mode 100644 index 0000000..877d8fe --- /dev/null +++ b/dmz/vault/values.yaml @@ -0,0 +1,13 @@ +vault: + global: + enabled: true + tlsDisable: false + externalVaultAddr: "https://vault.infra.durp.info" + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 256Mi + cpu: 250m + diff --git a/infra/argocd/templates/vault.yaml b/infra/argocd/templates/vault.yaml index 26fa571..351d06f 100644 --- a/infra/argocd/templates/vault.yaml +++ b/infra/argocd/templates/vault.yaml @@ -23,3 +23,31 @@ spec: kind: MutatingWebhookConfiguration jqPathExpressions: - .webhooks[]?.clientConfig.caBundle + +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: vault-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/vault + destination: + namespace: vault + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle From 0a18126a39b5dacbf70392178bf10daca2e854dd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:32:45 -0600 Subject: [PATCH 0421/1058] update --- dmz/vault/templates/secrets.yaml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 dmz/vault/templates/secrets.yaml diff --git a/dmz/vault/templates/secrets.yaml b/dmz/vault/templates/secrets.yaml new file mode 100644 index 0000000..de082ff --- /dev/null +++ b/dmz/vault/templates/secrets.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +metadata: + name: vault-token-g955r + annotations: + kubernetes.io/service-account.name: vault +type: kubernetes.io/service-account-token From 02c9ab34865cc0588fb9abef45a8b4c4f39532ce Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:33:26 -0600 Subject: [PATCH 0422/1058] update --- dmz/vault/templates/secrets.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/vault/templates/secrets.yaml b/dmz/vault/templates/secrets.yaml index de082ff..b1dd3f4 100644 --- a/dmz/vault/templates/secrets.yaml +++ b/dmz/vault/templates/secrets.yaml @@ -3,5 +3,5 @@ kind: Secret metadata: name: vault-token-g955r annotations: - kubernetes.io/service-account.name: vault + kubernetes.io/service-account.name: vault-dmz type: kubernetes.io/service-account-token From b2ad83f1bac7058c3afe44e4de8e52961f004559 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:41:41 -0600 Subject: [PATCH 0423/1058] update --- dmz/external-secrets/Chart.yaml | 11 +++ dmz/external-secrets/templates/ca.yaml | 81 ++++++++++++++++++++ dmz/external-secrets/values.yaml | 70 +++++++++++++++++ infra/argocd/templates/external-secrets.yaml | 23 ++++++ 4 files changed, 185 insertions(+) create mode 100644 dmz/external-secrets/Chart.yaml create mode 100644 dmz/external-secrets/templates/ca.yaml create mode 100644 dmz/external-secrets/values.yaml diff --git a/dmz/external-secrets/Chart.yaml b/dmz/external-secrets/Chart.yaml new file mode 100644 index 0000000..d89a403 --- /dev/null +++ b/dmz/external-secrets/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-secrets + repository: https://charts.external-secrets.io + version: 0.13.0 diff --git a/dmz/external-secrets/templates/ca.yaml b/dmz/external-secrets/templates/ca.yaml new file mode 100644 index 0000000..9b2a135 --- /dev/null +++ b/dmz/external-secrets/templates/ca.yaml @@ -0,0 +1,81 @@ +apiVersion: v1 +data: + vault.pem: | + -----BEGIN CERTIFICATE----- + MIIEszCCA5ugAwIBAgIUZEzzxqEuYiKHkL1df+Cb22NRRJMwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzIyMzQ0MloXDTM1MDEy + MTExMTU1NVowIDEeMBwGA1UEAxMVdmF1bHQuaW5mcmEuZHVycC5pbmZvMIIBIjAN + BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkZM0ue4bMcmmATs+kGYSpR2hLUzq + scGIwCtqmaKCMbd1xhmgjnIR3zvSRptLR2GVGvc1ti6qby0jXYvcqbxkHvay00zW + 2zYN+M2m4lXpuWzg1t6NEoO6XGAsGj2v0vcVktPPU9uj0rGUVGWWfsvjoXqQFg5I + jdxsxK9SvMvw2XtE3FgKxpzCyw94InIHlcPwFTO+3ZdKStZlMbUDIkmszLBrWFcr + XOsPDfLxqMy0Ck//LKIt8djh3254FHB1GG5+kI+JSW1o+tUcL2NymvIINwm/2acS + 1uTm+j9W7iEXav0pJNmm+/dzSskc3Y0ftM0h2HCXgitBIaEZnUVneNHOLwIDAQAB + o4IB7zCCAeswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O + BBYEFCaQ2q7j7LyBGETEZ5qaJAdlISKCMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2 + dfBMWVYeWrQ2MIH0BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6 + Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFo + dHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3Nw + MDEGCCsGAQUFBzAChiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtp + L2NhMDsGCCsGAQUFBzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVy + cC5pbmZvL3YxL3BraS9jYTAgBgNVHREEGTAXghV2YXVsdC5pbmZyYS5kdXJwLmlu + Zm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAx + L3YxL3BraS9jcmwwNqA0oDKGMGh0dHBzOi8vcm9vdC12YXVsdC5pbnRlcm5hbC5k + dXJwLmluZm8vdjEvcGtpL2NybDANBgkqhkiG9w0BAQsFAAOCAQEAuJ+lplY/+A5L + 5LzkljbKDTy3U6PLv1LtxqVCOFGiJXBnXMjtVW07bBEUadzFRNW8GHQ3w5QzOG6k + /vE/TrrJho7l05J/uc+BUrPSNjefLmQV6hn4jrP86PR0vzRfbSqKKBIID9M7+zi6 + GFvHlVkSHsQyMQp7JOoax9KVzW2Y+OIgw7Lgw2tP122WCt2SIF0QenoZHsoW0guj + tzTJRmJDjn6XeJ7L3FPkf37H6ub0Jg3zBGr6eorEFfYZNN5CXezjqMFBpRdq4UIo + 1M3A7o3uyZFcFsp/vGDcMBkwaCsBV9idu/HwkvGaTUNI285ilBORPD0bMZnACq/9 + +Q/cdsO5lg== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIEmzCCA4OgAwIBAgIUQwCAs82sgSuiaVbjANHScO2DSfAwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMjEyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEAn9fjGRqqFsqguz56X6cXZwEMtD9wElwSFCb4Fc8YTzlH + 4fV13QwXKESLE/Q+7bw4y4FJQ8BiGNbxxbQOOgWhfGGlQyFa1lfhJtYLfqRN5C2/ + S7nr0YxDB9duc4OAExVL6Pr4/Koc+vDZY03l7RzwnF2AOM9DjFTASw01TphCQjRk + U+upiN2TUhUPejV/gMR+zXM6pn98UBKG1dNubS0HzAMwAEXAPm141NDyWUCPT9+3 + 6P03Ka8mUTx3X49OCtvJEGEQbtlnTFQaOSkP1yLW+XRMHw3sQaV2PWXu5fInbEpZ + +SuzmgLOXtmQNmHLav9q1qeTVkpBGPWvfh2Vh1JJhQIDAQABo4IB4zCCAd8wDgYD + VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJaP17f1Zw0V + 55Ks9Uf0USVWl0BPMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2dfBMWVYeWrQ2MIH0 + BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6Ly8xOTIuMTY4LjIw + LjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFodHRwczovL3Jvb3Qt + dmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3NwMDEGCCsGAQUFBzAC + hiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtpL2NhMDsGCCsGAQUF + BzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3Br + aS9jYTAUBgNVHREEDTALgglkdXJwLmluZm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0 + cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9jcmwwNqA0oDKGMGh0dHBz + Oi8vcm9vdC12YXVsdC5pbnRlcm5hbC5kdXJwLmluZm8vdjEvcGtpL2NybDANBgkq + hkiG9w0BAQsFAAOCAQEAiqAZ4zNIEkCWcvpDRq0VyJuk59sVtJr5X4FscHQ179nE + QbbvMe+EBDFS6XQml1Elj8jiPa/D5O9Oc6Iisnm5+weZKwApz/lQ+XVkWLCoEplB + ZZ9fcWVCbMLt0xlt8qn5z/mYKfbCT7ZCqDO+prQZt+ADJcQbiknfroAAqEbNKxwN + Y9uUyOWNF3SxJEch4w2dtX+IEVmxeZnhMy8OuP0SQKl8aW40ugiG0ZD5yTBBfOD9 + zsrGSU/iSatn0b7bevBhaL96hz1/rNR1cL+4/albX2hrr8Rv3/SB2DLtNQlQW0ls + AfhXAqP5zL+Ytgf1Of/pVdgnhxrYUY7RKCSGY5Hagw== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIDLzCCAhegAwIBAgIUNHdvOzam2HPVdwXpMHUy4wl8ZRYwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMTUyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEA8XDTVEtRI3+k4yuvqVqfIiLRQJcXbmhfVtAeYk+5j9Ox + p1w9YHdnPLqLFrD1PzadjqYeAp/fwlEFfs6lqwoTS8S9vhaFqcgB57nVMb77dTBb + /08XHXOU6FPRjdFKm5QMpS7tn1XacPMy/o0bKqRREQeiuFDGVRyuF5PUgvWc1dvJ + l27JvvgYktgjfpNS4DlCxg4lGXT5abvaKf2hnr65egaIo/yRWN9wnvAzRiY7oci7 + GA1oKz87Yc1tfL2gcynrwccOOCF/eUKesJR1I6GXNkN/a1fcr+Ld9Z9NhHBtO+vE + N8DsZY+kG7DE3M4BCCTFUzllcYHjaW4HaF9vZW+PYwIDAQABo3kwdzAOBgNVHQ8B + Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7WMLIaSkU75CJHZ1 + 8ExZVh5atDYwHwYDVR0jBBgwFoAU7WMLIaSkU75CJHZ18ExZVh5atDYwFAYDVR0R + BA0wC4IJZHVycC5pbmZvMA0GCSqGSIb3DQEBCwUAA4IBAQAS/qUI/1Yv07xUTK5k + r93kC7GSPpmpkXIsfjChAl93sebN143fu70NUP74jjCc0Wkb8hRofGg10E+/24r1 + AI0KsLhzKzfIASxUVQAn8RTptLruaaPLboSA4MUZ8IB5y8Vy8E3/KtD0gD80j64Y + rm9XGHA0HTJHbPUTb/Rux2g0E7WtiyWSWH8mqzbegU8IrkM3eVT4+ylBE7YkfWDD + dw44sB71tfmDKpzWg6XQ6YMh0YfnyG1fYCj9LhuecNY9Uuo6cjDaAvkzMewWwqDx + Q2Ekas98Di6itCP8vET+gBDjeCc+XR6Hx6vzWmxlZhwDuxEKL1a2/DabUxJyMNzv + 55Fn + -----END CERTIFICATE----- +kind: ConfigMap +metadata: + name: ca-pemstore diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml new file mode 100644 index 0000000..7de64de --- /dev/null +++ b/dmz/external-secrets/values.yaml @@ -0,0 +1,70 @@ +external-secrets: + replicaCount: 3 + revisionHistoryLimit: 1 + leaderElect: true + + installCRDs: true + crds: + createClusterExternalSecret: true + createClusterSecretStore: true + createClusterGenerator: true + createPushSecret: true + conversion: + enabled: false + + image: + repository: registry.internal.durp.info/external-secrets/external-secrets + pullPolicy: Always + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + webhook: + log: + level: debug + image: + repository: registry.internal.durp.info/external-secrets/external-secrets + pullPolicy: Always + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + certController: + create: false + revisionHistoryLimit: 1 + log: + level: debug + + image: + repository: registry.internal.durp.info/external-secrets/external-secrets + pullPolicy: Always + tag: "" + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m diff --git a/infra/argocd/templates/external-secrets.yaml b/infra/argocd/templates/external-secrets.yaml index a78c6b3..0583fea 100644 --- a/infra/argocd/templates/external-secrets.yaml +++ b/infra/argocd/templates/external-secrets.yaml @@ -19,3 +19,26 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-secrets-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/external-secrets + destination: + namespace: external-secrets + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From 9dbe6dc4451d8c98c911126c62881b61bcae6f18 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:44:09 -0600 Subject: [PATCH 0424/1058] update --- dmz/vault/templates/secret-store.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 dmz/vault/templates/secret-store.yaml diff --git a/dmz/vault/templates/secret-store.yaml b/dmz/vault/templates/secret-store.yaml new file mode 100644 index 0000000..60b7e93 --- /dev/null +++ b/dmz/vault/templates/secret-store.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: vault +spec: + provider: + vault: + server: "https://vault.infra.durp.info" + path: "kv" + version: "v2" + auth: + kubernetes: + mountPath: "kubernetes" + role: "external-secrets" + serviceAccountRef: + name: "vault-dmz" From 207cc5f7c8765864f4fa869aa03efbf9c2f3b225 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:49:00 -0600 Subject: [PATCH 0425/1058] update --- dmz/external-secrets/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 7de64de..915352e 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -36,6 +36,7 @@ external-secrets: cpu: 10m webhook: + failurePolicy: Ignore log: level: debug image: From a2706177c695e2a617e59649e71baaf4a44ab391 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 05:55:04 -0600 Subject: [PATCH 0426/1058] update --- dmz/external-secrets/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 915352e..abc8d17 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -52,7 +52,7 @@ external-secrets: cpu: 10m certController: - create: false + create: true revisionHistoryLimit: 1 log: level: debug From b199c8f6ed86041830eda1ec71443288ba8fb33b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Feb 2025 06:00:55 -0600 Subject: [PATCH 0427/1058] update --- dmz/external-secrets/values.yaml | 19 ------------------- 1 file changed, 19 deletions(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index abc8d17..bf342a0 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -50,22 +50,3 @@ external-secrets: limits: memory: 32Mi cpu: 10m - - certController: - create: true - revisionHistoryLimit: 1 - log: - level: debug - - image: - repository: registry.internal.durp.info/external-secrets/external-secrets - pullPolicy: Always - tag: "" - - resources: - requests: - memory: 32Mi - cpu: 10m - limits: - memory: 32Mi - cpu: 10m From 8b5342c168afe48b3bb1f471efe5406f497d6523 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 04:44:41 -0600 Subject: [PATCH 0428/1058] update --- dmz/external-secrets/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index bf342a0..2bd0708 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -50,3 +50,6 @@ external-secrets: limits: memory: 32Mi cpu: 10m + + certController: + create: false From 0742770dbea4516a4cd3bf21a697b8bcdc57300c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 04:47:44 -0600 Subject: [PATCH 0429/1058] update --- dmz/external-secrets/values.yaml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 2bd0708..abc8d17 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -52,4 +52,20 @@ external-secrets: cpu: 10m certController: - create: false + create: true + revisionHistoryLimit: 1 + log: + level: debug + + image: + repository: registry.internal.durp.info/external-secrets/external-secrets + pullPolicy: Always + tag: "" + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m From 6344b58687844aa8191b43fa0aaa64a2dcca6881 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 04:51:47 -0600 Subject: [PATCH 0430/1058] update --- dmz/external-secrets/values.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index abc8d17..5a08ffb 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -69,3 +69,14 @@ external-secrets: limits: memory: 32Mi cpu: 10m + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true From acbaf37e8a3104923ee7752dab65e50dfb5dcc7f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 04:58:22 -0600 Subject: [PATCH 0431/1058] update --- dmz/external-secrets/values.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 5a08ffb..0baef97 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -43,6 +43,17 @@ external-secrets: repository: registry.internal.durp.info/external-secrets/external-secrets pullPolicy: Always + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true + resources: requests: memory: 32Mi From 61dcae2e9797eb670e653f6fe138da0fe3de57a5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 05:01:56 -0600 Subject: [PATCH 0432/1058] update --- dmz/external-secrets/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 0baef97..e95fec6 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -36,6 +36,7 @@ external-secrets: cpu: 10m webhook: + create: false failurePolicy: Ignore log: level: debug @@ -63,7 +64,7 @@ external-secrets: cpu: 10m certController: - create: true + create: false revisionHistoryLimit: 1 log: level: debug From c57cfc7d5a5171552932743e4b4291f5c36d2a49 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 05:43:07 -0600 Subject: [PATCH 0433/1058] update --- ansible/roles/base/tasks/main.yaml | 57 ++++++++++++++++++------------ 1 file changed, 35 insertions(+), 22 deletions(-) diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml index 952e4cb..2944ec8 100644 --- a/ansible/roles/base/tasks/main.yaml +++ b/ansible/roles/base/tasks/main.yaml @@ -1,25 +1,25 @@ -- name: Update packages - apt: - name: '*' - state: latest - update_cache: yes - only_upgrade: yes - retries: 300 - delay: 10 - -- name: Remove packages not needed anymore - apt: - autoremove: yes - retries: 300 - delay: 10 - -- name: Install required packages Debian - apt: - state: latest - pkg: "{{ item }}" - with_items: "{{ required_packages }}" - retries: 300 - delay: 10 +#- name: Update packages +# apt: +# name: '*' +# state: latest +# update_cache: yes +# only_upgrade: yes +# retries: 300 +# delay: 10 +# +#- name: Remove packages not needed anymore +# apt: +# autoremove: yes +# retries: 300 +# delay: 10 +# +#- name: Install required packages Debian +# apt: +# state: latest +# pkg: "{{ item }}" +# with_items: "{{ required_packages }}" +# retries: 300 +# delay: 10 - name: Create user account user: @@ -134,3 +134,16 @@ name: "administrator" state: present password: "{{ lookup('ansible.builtin.env', 'ADMIN_PASSWORD') | password_hash('sha512') }}" + +- name: change password + ansible.builtin.user: + name: "user" + state: present + password: "{{ lookup('ansible.builtin.env', 'USER_PASSWORD') | password_hash('sha512') }}" + +- name: add user to sudoers + community.general.sudoers: + name: user + state: present + user: user + commands: ALL From 2b9947223b52633b9eaeb0541ad62ff690b77f0a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 05:53:29 -0600 Subject: [PATCH 0434/1058] update --- ansible/roles/base/tasks/main.yaml | 44 +++++++++++++++--------------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml index 2944ec8..0cbecfd 100644 --- a/ansible/roles/base/tasks/main.yaml +++ b/ansible/roles/base/tasks/main.yaml @@ -1,25 +1,25 @@ -#- name: Update packages -# apt: -# name: '*' -# state: latest -# update_cache: yes -# only_upgrade: yes -# retries: 300 -# delay: 10 -# -#- name: Remove packages not needed anymore -# apt: -# autoremove: yes -# retries: 300 -# delay: 10 -# -#- name: Install required packages Debian -# apt: -# state: latest -# pkg: "{{ item }}" -# with_items: "{{ required_packages }}" -# retries: 300 -# delay: 10 +- name: Update packages + apt: + name: '*' + state: latest + update_cache: yes + only_upgrade: yes + retries: 300 + delay: 10 + +- name: Remove packages not needed anymore + apt: + autoremove: yes + retries: 300 + delay: 10 + +- name: Install required packages Debian + apt: + state: latest + pkg: "{{ item }}" + with_items: "{{ required_packages }}" + retries: 300 + delay: 10 - name: Create user account user: From ed3ecba7df01d5ce8121746588e110b0bd6082b0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Feb 2025 06:07:32 -0600 Subject: [PATCH 0435/1058] update --- ansible/roles/base/tasks/main.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml index 0cbecfd..3d1be45 100644 --- a/ansible/roles/base/tasks/main.yaml +++ b/ansible/roles/base/tasks/main.yaml @@ -129,12 +129,6 @@ state: restarted enabled: yes -- name: change password - ansible.builtin.user: - name: "administrator" - state: present - password: "{{ lookup('ansible.builtin.env', 'ADMIN_PASSWORD') | password_hash('sha512') }}" - - name: change password ansible.builtin.user: name: "user" From a92b9cda21dcf41afd8cfcbb6f91bd330c89b659 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:09:42 -0600 Subject: [PATCH 0436/1058] update --- dmz/cert-manager/templates/secretvault.yaml | 45 ++++++++++----------- 1 file changed, 22 insertions(+), 23 deletions(-) diff --git a/dmz/cert-manager/templates/secretvault.yaml b/dmz/cert-manager/templates/secretvault.yaml index 45db5e8..a56b898 100644 --- a/dmz/cert-manager/templates/secretvault.yaml +++ b/dmz/cert-manager/templates/secretvault.yaml @@ -1,23 +1,22 @@ -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: cloudflare-api-token-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: cloudflare-api-token-secret -# data: -# - secretKey: cloudflare-api-token-secret -# remoteRef: -# key: kv/cert-manager -# property: cloudflare-api-token-secret -# -#--- -# -#apiVersion: v1 -#kind: ServiceAccount -#metadata: -# name: vault -# +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: kv/cert-manager + property: cloudflare-api-token-secret + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault-dmz From 933cc9dadd1b3b1317a8d7c6dafb4e58d47c61b1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:10:30 -0600 Subject: [PATCH 0437/1058] update --- Untitled | 4 +++ dmz/cert-manager/templates/letsencrypt.yaml | 32 ++++++++++----------- 2 files changed, 20 insertions(+), 16 deletions(-) create mode 100644 Untitled diff --git a/Untitled b/Untitled new file mode 100644 index 0000000..c59860f --- /dev/null +++ b/Untitled @@ -0,0 +1,4 @@ +VAULT_HELM_SECRET_NAME=$(kubectl get secrets -n vault --output=json | jq -r '.items[].metadata | select(.name|startswith("vault-token-")).name') +TOKEN_REVIEW_JWT=$(kubectl get secret $VAULT_HELM_SECRET_NAME -n vault --output='go-template={{ .data.token }}' | base64 --decode) +KUBE_CA_CERT=$(kubectl config view --raw --minify --flatten --output='jsonpath={.clusters[].cluster.certificate-authority-data}' | base64 --decode) +KUBE_HOST=$(kubectl config view --raw --minify --flatten --output='jsonpath={.clusters[].cluster.server}') diff --git a/dmz/cert-manager/templates/letsencrypt.yaml b/dmz/cert-manager/templates/letsencrypt.yaml index dc1c65d..4d77082 100644 --- a/dmz/cert-manager/templates/letsencrypt.yaml +++ b/dmz/cert-manager/templates/letsencrypt.yaml @@ -17,19 +17,19 @@ --- -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: vault-issuer -spec: - vault: - server: https://vault.infra.durp.info - caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K - path: pki/sign/issue-homelab-certs - auth: - kubernetes: - mountPath: /v1/auth/kubernetes - role: issuer - secretRef: - name: issuer-token-lmzpj - key: token +#apiVersion: cert-manager.io/v1 +#kind: ClusterIssuer +#metadata: +# name: vault-issuer +#spec: +# vault: +# server: https://vault.infra.durp.info +# caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K +# path: pki/sign/issue-homelab-certs +# auth: +# kubernetes: +# mountPath: /v1/auth/kubernetes +# role: issuer +# secretRef: +# name: issuer-token-lmzpj +# key: token From 733b933a007459fd11a279e8f030acd7281a84e1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:14:30 -0600 Subject: [PATCH 0438/1058] update --- dmz/vault/templates/secrets.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/dmz/vault/templates/secrets.yaml b/dmz/vault/templates/secrets.yaml index b1dd3f4..ba9f7bf 100644 --- a/dmz/vault/templates/secrets.yaml +++ b/dmz/vault/templates/secrets.yaml @@ -5,3 +5,17 @@ metadata: annotations: kubernetes.io/service-account.name: vault-dmz type: kubernetes.io/service-account-token +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: role-tokenreview-binding + namespace: vault +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: +- kind: ServiceAccount + name: vault-auth + namespace: default From b6b17c5ced88e1238ffbb6dee6d1a7ac9837f66e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:15:06 -0600 Subject: [PATCH 0439/1058] update --- dmz/vault/templates/secrets.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/vault/templates/secrets.yaml b/dmz/vault/templates/secrets.yaml index ba9f7bf..c77f997 100644 --- a/dmz/vault/templates/secrets.yaml +++ b/dmz/vault/templates/secrets.yaml @@ -18,4 +18,4 @@ roleRef: subjects: - kind: ServiceAccount name: vault-auth - namespace: default + namespace: vault From 10087d55f79f21c3d0bed64276dac8966c1a6d9d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:15:50 -0600 Subject: [PATCH 0440/1058] update --- dmz/vault/templates/secrets.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/dmz/vault/templates/secrets.yaml b/dmz/vault/templates/secrets.yaml index c77f997..c449ffe 100644 --- a/dmz/vault/templates/secrets.yaml +++ b/dmz/vault/templates/secrets.yaml @@ -5,7 +5,16 @@ metadata: annotations: kubernetes.io/service-account.name: vault-dmz type: kubernetes.io/service-account-token + --- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault-auth + +--- + apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: From 58feb47a9da5edab8572d3ddbc3db2f6f5ae811e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:29:21 -0600 Subject: [PATCH 0441/1058] update --- dmz/vault/templates/secret-store.yaml | 2 +- dmz/vault/templates/secrets.yaml | 30 --------------------------- 2 files changed, 1 insertion(+), 31 deletions(-) delete mode 100644 dmz/vault/templates/secrets.yaml diff --git a/dmz/vault/templates/secret-store.yaml b/dmz/vault/templates/secret-store.yaml index 60b7e93..da2addb 100644 --- a/dmz/vault/templates/secret-store.yaml +++ b/dmz/vault/templates/secret-store.yaml @@ -13,4 +13,4 @@ spec: mountPath: "kubernetes" role: "external-secrets" serviceAccountRef: - name: "vault-dmz" + name: "vault" diff --git a/dmz/vault/templates/secrets.yaml b/dmz/vault/templates/secrets.yaml deleted file mode 100644 index c449ffe..0000000 --- a/dmz/vault/templates/secrets.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: vault-token-g955r - annotations: - kubernetes.io/service-account.name: vault-dmz -type: kubernetes.io/service-account-token - ---- - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault-auth - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: role-tokenreview-binding - namespace: vault -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: system:auth-delegator -subjects: -- kind: ServiceAccount - name: vault-auth - namespace: vault From d0ea0ff250cf77ca0b23a03cfd740cf84736ef19 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:33:40 -0600 Subject: [PATCH 0442/1058] update --- dmz/vault/templates/secret-store.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dmz/vault/templates/secret-store.yaml b/dmz/vault/templates/secret-store.yaml index da2addb..b54cafc 100644 --- a/dmz/vault/templates/secret-store.yaml +++ b/dmz/vault/templates/secret-store.yaml @@ -14,3 +14,10 @@ spec: role: "external-secrets" serviceAccountRef: name: "vault" + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault From b22eda0a0a84aeecfde8e103ff7763e176b2fd68 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:35:02 -0600 Subject: [PATCH 0443/1058] update --- dmz/cert-manager/templates/secretvault.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/cert-manager/templates/secretvault.yaml b/dmz/cert-manager/templates/secretvault.yaml index a56b898..f15a739 100644 --- a/dmz/cert-manager/templates/secretvault.yaml +++ b/dmz/cert-manager/templates/secretvault.yaml @@ -19,4 +19,4 @@ spec: apiVersion: v1 kind: ServiceAccount metadata: - name: vault-dmz + name: vault From 06349d5f0e423f505335a018bf152d2c3a47f818 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 05:45:22 -0600 Subject: [PATCH 0444/1058] update --- dmz/vault/templates/secret-store.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/vault/templates/secret-store.yaml b/dmz/vault/templates/secret-store.yaml index b54cafc..0486cfd 100644 --- a/dmz/vault/templates/secret-store.yaml +++ b/dmz/vault/templates/secret-store.yaml @@ -10,7 +10,7 @@ spec: version: "v2" auth: kubernetes: - mountPath: "kubernetes" + mountPath: "dmz-cluster" role: "external-secrets" serviceAccountRef: name: "vault" From 2ba68c75079c0771f30aa46964b8491be303e380 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 3 Mar 2025 06:11:46 -0600 Subject: [PATCH 0445/1058] update --- dmz/internalproxy/templates/authentik.yaml | 80 +++++++++++----------- dmz/traefik/templates/authentik.yaml | 30 -------- 2 files changed, 40 insertions(+), 70 deletions(-) delete mode 100644 dmz/traefik/templates/authentik.yaml diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 498ac89..b1deaeb 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,40 +1,40 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`test.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: authentik-server -# port: 443 -# tls: -# secretName: authentik-tls -# -#--- -# -#apiVersion: v1 -#kind: Service -#metadata: -# name: authentik-server -#spec: -# type: ExternalName -# externalName: authentik.durp.info -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-tls -#spec: -# issuerRef: -# name: vault-issuer -# kind: ClusterIssuer -# secretName: authentik-tls -# commonName: "test.durp.info" -# dnsNames: -# - "test.durp.info" +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`test.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 443 + tls: + secretName: authentik-tls + +--- + +apiVersion: v1 +kind: Service +metadata: + name: authentik-server +spec: + type: ExternalName + externalName: authentik.durp.info + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "test.durp.info" + dnsNames: + - "test.durp.info" diff --git a/dmz/traefik/templates/authentik.yaml b/dmz/traefik/templates/authentik.yaml deleted file mode 100644 index 9d82551..0000000 --- a/dmz/traefik/templates/authentik.yaml +++ /dev/null @@ -1,30 +0,0 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`test.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: authentik-server -# port: 443 -# tls: -# secretName: authentik-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-tls -#spec: -# issuerRef: -# name: vault-issuer -# kind: ClusterIssuer -# secretName: authentik-tls -# commonName: "test.durp.info" -# dnsNames: -# - "test.durp.info" From 9e44ebc46c9e01c9eb65a4f8ab57805ab475fd76 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 04:48:38 -0600 Subject: [PATCH 0446/1058] update --- dmz/cert-manager/templates/letsencrypt.yaml | 32 ++++++++++----------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/dmz/cert-manager/templates/letsencrypt.yaml b/dmz/cert-manager/templates/letsencrypt.yaml index 4d77082..5c63095 100644 --- a/dmz/cert-manager/templates/letsencrypt.yaml +++ b/dmz/cert-manager/templates/letsencrypt.yaml @@ -1,19 +1,19 @@ -#apiVersion: cert-manager.io/v1 -#kind: ClusterIssuer -#metadata: -# name: letsencrypt-production -#spec: -# acme: -# server: https://acme-v02.api.letsencrypt.org/directory -# privateKeySecretRef: -# name: letsencrypt-production -# solvers: -# - dns01: -# cloudflare: -# email: developerdurp@durp.info -# apiTokenSecretRef: -# name: cloudflare-api-token-secret -# key: cloudflare-api-token-secret +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret --- From fcc9cb0e639895e0ae4eb65fb51a20da95412f32 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 04:50:58 -0600 Subject: [PATCH 0447/1058] update --- dmz/cert-manager/values.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/dmz/cert-manager/values.yaml b/dmz/cert-manager/values.yaml index 0cec0b9..c9cf12f 100644 --- a/dmz/cert-manager/values.yaml +++ b/dmz/cert-manager/values.yaml @@ -6,14 +6,14 @@ cert-manager: repository: jetstack/cert-manager-controller pullPolicy: Always replicaCount: 3 - #extraArgs: - # - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 - # - --dns01-recursive-nameservers-only - #podDnsPolicy: None - #podDnsConfig: - # nameservers: - # - "1.1.1.1" - # - "1.0.0.1" + extraArgs: + - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + - --dns01-recursive-nameservers-only + podDnsPolicy: None + podDnsConfig: + nameservers: + - "1.1.1.1" + - "1.0.0.1" webhook: image: registry: registry.internal.durp.info From 3b65e9401966537c6db49f3e349762e668ca31d8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 04:54:30 -0600 Subject: [PATCH 0448/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index b1deaeb..f31cc00 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -9,7 +9,7 @@ spec: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: authentik-server + - name: service0 port: 443 tls: secretName: authentik-tls From bdf93b5a06966f3aa8bef39c17cfc5537714accd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 04:57:12 -0600 Subject: [PATCH 0449/1058] update --- dmz/internalproxy/templates/authentik.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index f31cc00..5d0f06a 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -8,6 +8,9 @@ spec: routes: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - name: example-redirectregex + namespace: traefik services: - name: service0 port: 443 @@ -38,3 +41,14 @@ spec: commonName: "test.durp.info" dnsNames: - "test.durp.info" + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: example-redirectregex +spec: + redirectRegex: + regex: ^https://example.com/(.*) + replacement: https://google.com/${1} From 041cf0933d846faf5d883c503f6f02e400c5c037 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 04:57:38 -0600 Subject: [PATCH 0450/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 5d0f06a..0eb5b9b 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -44,7 +44,7 @@ spec: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: example-redirectregex From d273f215059077f621d9434508519d27096d8418 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 04:58:29 -0600 Subject: [PATCH 0451/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 0eb5b9b..8fb6803 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -50,5 +50,5 @@ metadata: name: example-redirectregex spec: redirectRegex: - regex: ^https://example.com/(.*) + regex: ^https://test.durp.info/(.*) replacement: https://google.com/${1} From f9b1ae184dd5fecbf780d07bdfc1aec73a8886eb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:04:13 -0600 Subject: [PATCH 0452/1058] update --- dmz/internalproxy/templates/authentik.yaml | 3 ++- dmz/traefik/templates/config.yaml | 12 ++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 8fb6803..d67ea43 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -50,5 +50,6 @@ metadata: name: example-redirectregex spec: redirectRegex: - regex: ^https://test.durp.info/(.*) + regex: (.)* replacement: https://google.com/${1} + permanent: true diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index d09b955..ae36dbf 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -15,3 +15,15 @@ data: loadBalancer: servers: - url: https://google.com + + https: + routers: + router0: + service: service0 + rule: Host(`test.durp.info`) + + services: + service0: + loadBalancer: + servers: + - url: https://google.com From f4f58bfedced202e13f35b3cb768c8e45b2be5fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:11:26 -0600 Subject: [PATCH 0453/1058] update --- dmz/internalproxy/templates/authentik.yaml | 5 +---- dmz/traefik/templates/config.yaml | 18 +----------------- 2 files changed, 2 insertions(+), 21 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index d67ea43..0588974 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -8,11 +8,8 @@ spec: routes: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule - middlewares: - - name: example-redirectregex - namespace: traefik services: - - name: service0 + - name: test port: 443 tls: secretName: authentik-tls diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index ae36dbf..8304b37 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,25 +5,9 @@ metadata: data: config.yml: | http: - routers: - router0: - service: service0 - rule: Host(`test.durp.info`) - services: - service0: + test: loadBalancer: servers: - url: https://google.com - https: - routers: - router0: - service: service0 - rule: Host(`test.durp.info`) - - services: - service0: - loadBalancer: - servers: - - url: https://google.com From 947835171c41ab54b10507b0f8d768b858182dd0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:12:59 -0600 Subject: [PATCH 0454/1058] update --- dmz/internalproxy/templates/authentik.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 0588974..8a8ab29 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -10,6 +10,7 @@ spec: kind: Rule services: - name: test + namespace: traefik port: 443 tls: secretName: authentik-tls From d39ab5d5a3cc36865d9fb8f3f960a3231ad58b22 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:14:17 -0600 Subject: [PATCH 0455/1058] update --- dmz/traefik/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 9027409..9f8a0e8 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -6,6 +6,7 @@ traefik: providers: kubernetesCRD: + allowCrossNamespace: false allowExternalNameServices: true allowEmptyServices: false From d6427b326d371a4233eca06eac6ace5e24648db7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:18:00 -0600 Subject: [PATCH 0456/1058] update --- dmz/internalproxy/templates/authentik.yaml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 8a8ab29..f8a7dec 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -8,9 +8,11 @@ spec: routes: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule - services: - - name: test + middlewares: + - name: example-redirectregex namespace: traefik + services: + - name: authentik-server port: 443 tls: secretName: authentik-tls @@ -49,5 +51,5 @@ metadata: spec: redirectRegex: regex: (.)* - replacement: https://google.com/${1} + replacement: https://authentik.durp.info/${1} permanent: true From 53313df223cbfe2e5f2c91c8b88398b24187fda5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:18:47 -0600 Subject: [PATCH 0457/1058] update --- dmz/internalproxy/templates/authentik.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index f8a7dec..7a97173 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -10,7 +10,6 @@ spec: kind: Rule middlewares: - name: example-redirectregex - namespace: traefik services: - name: authentik-server port: 443 From d724b929da9fac37eb76eec647cdd2e5ee272a89 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:19:17 -0600 Subject: [PATCH 0458/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 7a97173..55b6926 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -51,4 +51,4 @@ spec: redirectRegex: regex: (.)* replacement: https://authentik.durp.info/${1} - permanent: true + permanent: false From d180197086cda4e1cb40bdf4a63d96e7193ec050 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:19:42 -0600 Subject: [PATCH 0459/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 55b6926..1d74f2a 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -8,8 +8,6 @@ spec: routes: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule - middlewares: - - name: example-redirectregex services: - name: authentik-server port: 443 From a314f60d389d50749dade2b7d08b9a2e71fc054c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:23:48 -0600 Subject: [PATCH 0460/1058] update --- dmz/internalproxy/templates/authentik.yaml | 30 +++++++++++----------- dmz/traefik/templates/config.yaml | 17 +++++++++--- 2 files changed, 28 insertions(+), 19 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 1d74f2a..da283f6 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,18 +1,18 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`test.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: authentik-server - port: 443 - tls: - secretName: authentik-tls +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`test.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: authentik-server +# port: 443 +# tls: +# secretName: authentik-tls --- diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 8304b37..525f136 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,9 +5,18 @@ metadata: data: config.yml: | http: - services: - test: + routers: + foobar: + entryPoints: + - websecure + middlewares: + - strip + service: myexthost + rule: Host(`test.durp.info`) && Path(`/`) + tls: {} + + myexthost: + foobar: loadBalancer: servers: - - url: https://google.com - + - url: https://google.com From e0f4cf206d0187a24bbb1bb6c7a8d37cbd6eaa61 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:28:38 -0600 Subject: [PATCH 0461/1058] update --- dmz/internalproxy/templates/authentik.yaml | 30 +++++++++++----------- dmz/traefik/templates/config.yaml | 2 +- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index da283f6..1d74f2a 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,18 +1,18 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`test.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: authentik-server -# port: 443 -# tls: -# secretName: authentik-tls +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`test.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 443 + tls: + secretName: authentik-tls --- diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 525f136..7e3e714 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -12,7 +12,7 @@ data: middlewares: - strip service: myexthost - rule: Host(`test.durp.info`) && Path(`/`) + rule: Host(`1test.durp.info`) && Path(`/`) tls: {} myexthost: From 36685f382d5943b95c863730651c7c5148b1b69f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:32:02 -0600 Subject: [PATCH 0462/1058] update --- dmz/internalproxy/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 1d74f2a..280a060 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -9,7 +9,7 @@ spec: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: authentik-server + - name: foobar@internal port: 443 tls: secretName: authentik-tls From 2e798f2a0605aaab3fcb47ea567149c779fc04de Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:35:48 -0600 Subject: [PATCH 0463/1058] update --- dmz/internalproxy/templates/authentik.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 280a060..998f5a9 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -9,7 +9,8 @@ spec: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: foobar@internal + - name: foobar + namespace: traefik port: 443 tls: secretName: authentik-tls From d6b3091454b0f7023e81a82cfce37caef566b36f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:38:10 -0600 Subject: [PATCH 0464/1058] update --- dmz/internalproxy/templates/authentik.yaml | 53 ------------------ dmz/traefik/templates/traefik-dashboard.yaml | 56 ++++++++++++++++++++ 2 files changed, 56 insertions(+), 53 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 998f5a9..e69de29 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,53 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`test.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: foobar - namespace: traefik - port: 443 - tls: - secretName: authentik-tls - ---- - -apiVersion: v1 -kind: Service -metadata: - name: authentik-server -spec: - type: ExternalName - externalName: authentik.durp.info - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "test.durp.info" - dnsNames: - - "test.durp.info" - ---- - -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: example-redirectregex -spec: - redirectRegex: - regex: (.)* - replacement: https://authentik.durp.info/${1} - permanent: false diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 052fefb..1ca6993 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -15,6 +15,7 @@ spec: secretName: traefik-tls --- + apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -28,3 +29,58 @@ spec: commonName: "traefik.durp.info" dnsNames: - "traefik.durp.info" + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`test.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: foobar + port: 443 + tls: + secretName: authentik-tls + +--- + +apiVersion: v1 +kind: Service +metadata: + name: authentik-server +spec: + type: ExternalName + externalName: authentik.durp.info + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "test.durp.info" + dnsNames: + - "test.durp.info" + +--- + +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: example-redirectregex +spec: + redirectRegex: + regex: (.)* + replacement: https://authentik.durp.info/${1} + permanent: false From 59d5fb98dfd17a0ceea072231a797149b0b0a644 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:44:11 -0600 Subject: [PATCH 0465/1058] update --- dmz/traefik/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 9f8a0e8..4718e63 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -16,7 +16,7 @@ traefik: volumes: - name: traefik-configmap - mountPath: "/etc/traefik" + mountPath: "/config" type: configMap ingressRoute: @@ -24,6 +24,7 @@ traefik: enabled: true additionalArguments: + - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin From 2ffacfd4b9c10b6da2175651e61b9359032f4f65 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:45:43 -0600 Subject: [PATCH 0466/1058] update --- dmz/traefik/templates/config.yaml | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 7e3e714..ef6b341 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -3,20 +3,10 @@ kind: ConfigMap metadata: name: traefik-configmap data: - config.yml: | + traefik.yaml: | http: - routers: - foobar: - entryPoints: - - websecure - middlewares: - - strip - service: myexthost - rule: Host(`1test.durp.info`) && Path(`/`) - tls: {} - - myexthost: - foobar: + services: + service0: loadBalancer: servers: - - url: https://google.com + - url: https://google.com From d06f96c3ade062309f5a7613f5c80bcf80095627 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:46:11 -0600 Subject: [PATCH 0467/1058] update --- dmz/traefik/templates/traefik-dashboard.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 1ca6993..c1862a9 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -43,7 +43,7 @@ spec: - match: Host(`test.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: foobar + - name: service0 port: 443 tls: secretName: authentik-tls From 8f282427b7bd32ea65d6799cd413c0819a38e9e0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:47:12 -0600 Subject: [PATCH 0468/1058] update --- dmz/traefik/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index ef6b341..86b9972 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -3,7 +3,7 @@ kind: ConfigMap metadata: name: traefik-configmap data: - traefik.yaml: | + config.yml: | http: services: service0: From 25082c9e4d584ab3e6525ff2fe59d56b5fb88e51 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:49:03 -0600 Subject: [PATCH 0469/1058] update --- dmz/traefik/templates/config.yaml | 4 +++ dmz/traefik/templates/traefik-dashboard.yaml | 34 ++++++++++---------- 2 files changed, 21 insertions(+), 17 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 86b9972..606255a 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,6 +5,10 @@ metadata: data: config.yml: | http: + routers: + router0: + service: service0 + rule: Host(`test.durp.info`) services: service0: loadBalancer: diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index c1862a9..3f45853 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -31,23 +31,23 @@ spec: - "traefik.durp.info" --- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`test.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: service0 - port: 443 - tls: - secretName: authentik-tls - +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`test.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: service0 +# port: 443 +# tls: +# secretName: authentik-tls +# --- apiVersion: v1 From 6f2a3d014ec3edc9977470d56641b4e11e7202d2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 05:51:35 -0600 Subject: [PATCH 0470/1058] update --- dmz/traefik/templates/config.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 606255a..0d6a1c3 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -9,8 +9,10 @@ data: router0: service: service0 rule: Host(`test.durp.info`) + tls: + secretName: authentik-tls services: service0: loadBalancer: servers: - - url: https://google.com + - url: https://authentik.durp.info From 29bf3e7c9243ac3c6b83d70459e932c0f15d85b1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:02:22 -0600 Subject: [PATCH 0471/1058] update --- dmz/traefik/templates/config.yaml | 6 ---- dmz/traefik/templates/traefik-dashboard.yaml | 34 ++++++++++---------- 2 files changed, 17 insertions(+), 23 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 0d6a1c3..8e28886 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,12 +5,6 @@ metadata: data: config.yml: | http: - routers: - router0: - service: service0 - rule: Host(`test.durp.info`) - tls: - secretName: authentik-tls services: service0: loadBalancer: diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 3f45853..c1862a9 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -31,23 +31,23 @@ spec: - "traefik.durp.info" --- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`test.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: service0 -# port: 443 -# tls: -# secretName: authentik-tls -# + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`test.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: service0 + port: 443 + tls: + secretName: authentik-tls + --- apiVersion: v1 From 90ebb30286146a1d969202e60b305e0be39c4c55 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:07:48 -0600 Subject: [PATCH 0472/1058] update --- dmz/traefik/templates/config.yaml | 4 +++ dmz/traefik/templates/traefik-dashboard.yaml | 34 ++++++++++---------- 2 files changed, 21 insertions(+), 17 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 8e28886..610a46b 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,6 +5,10 @@ metadata: data: config.yml: | http: + routers: + router0: + service: service0 + rule: Host(`test.durp.info`) services: service0: loadBalancer: diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index c1862a9..3f45853 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -31,23 +31,23 @@ spec: - "traefik.durp.info" --- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`test.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: service0 - port: 443 - tls: - secretName: authentik-tls - +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`test.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: service0 +# port: 443 +# tls: +# secretName: authentik-tls +# --- apiVersion: v1 From 35d002cb3bbafb9fd86324a097cec623c7acfacb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:09:03 -0600 Subject: [PATCH 0473/1058] update --- dmz/traefik/templates/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 610a46b..606255a 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -13,4 +13,4 @@ data: service0: loadBalancer: servers: - - url: https://authentik.durp.info + - url: https://google.com From 092ec28ea9e519f933e483f0424cfd35651298fd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:14:21 -0600 Subject: [PATCH 0474/1058] update --- dmz/traefik/templates/config.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 606255a..ec1cfb7 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,10 +5,15 @@ metadata: data: config.yml: | http: + middlewares: + strip-host-and-path-middleware: + stripHost: "test.durp.info" routers: router0: service: service0 rule: Host(`test.durp.info`) + middleware: + - name: strip-host-and-path-middleware services: service0: loadBalancer: From 5bdee88d2967f3ed7e9f908c4ae66bb8b793ba4b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:20:56 -0600 Subject: [PATCH 0475/1058] update --- dmz/traefik/templates/config.yaml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index ec1cfb7..3e2e0c5 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -5,17 +5,12 @@ metadata: data: config.yml: | http: - middlewares: - strip-host-and-path-middleware: - stripHost: "test.durp.info" routers: router0: service: service0 - rule: Host(`test.durp.info`) - middleware: - - name: strip-host-and-path-middleware + rule: Host(`authentik.durp.info`) services: service0: loadBalancer: servers: - - url: https://google.com + - url: https://authentik.durp.info From 6e558c52b4b1e802c723ecf86dfdfa46d1bd9cea Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:25:25 -0600 Subject: [PATCH 0476/1058] update --- dmz/traefik/templates/config.yaml | 4 +- dmz/traefik/templates/traefik-dashboard.yaml | 65 ++++++++++++-------- 2 files changed, 41 insertions(+), 28 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 3e2e0c5..96ea5d3 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -8,9 +8,9 @@ data: routers: router0: service: service0 - rule: Host(`authentik.durp.info`) + rule: Host(`testing.durp.info`) services: service0: loadBalancer: servers: - - url: https://authentik.durp.info + - url: https://192.168.20.130 diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 3f45853..2a3ba2c 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -31,23 +31,23 @@ spec: - "traefik.durp.info" --- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`test.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: service0 -# port: 443 -# tls: -# secretName: authentik-tls -# + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: master-cluster + port: 443 + tls: + secretName: authentik-tls + --- apiVersion: v1 @@ -69,18 +69,31 @@ spec: name: letsencrypt-production kind: ClusterIssuer secretName: authentik-tls - commonName: "test.durp.info" + commonName: "authentik.durp.info" dnsNames: - - "test.durp.info" + - "authentik.durp.info" + --- -apiVersion: traefik.io/v1alpha1 -kind: Middleware +apiVersion: v1 +kind: Endpoints metadata: - name: example-redirectregex + name: master-cluster +subsets: + - addresses: + - ip: 192.168.20.130 + ports: + - port: 443 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: master-cluster spec: - redirectRegex: - regex: (.)* - replacement: https://authentik.durp.info/${1} - permanent: false + ports: + - protocol: TCP + port: 8080 + targetPort: 9376 From 8a7930b7c48774e91562742354400d38d7581407 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:29:58 -0600 Subject: [PATCH 0477/1058] update --- dmz/traefik/templates/traefik-dashboard.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 2a3ba2c..eb7d667 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -95,5 +95,5 @@ metadata: spec: ports: - protocol: TCP - port: 8080 - targetPort: 9376 + port: 443 + targetPort: 443 From bc56685869cfd60d39244e9df9e142ce81f993e1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:31:41 -0600 Subject: [PATCH 0478/1058] update --- dmz/traefik/templates/traefik-dashboard.yaml | 36 ++++++++++++++------ 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index eb7d667..6b62845 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -43,23 +43,13 @@ spec: - match: Host(`authentik.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: master-cluster + - name: infra-cluster port: 443 tls: secretName: authentik-tls --- -apiVersion: v1 -kind: Service -metadata: - name: authentik-server -spec: - type: ExternalName - externalName: authentik.durp.info - ---- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -97,3 +87,27 @@ spec: - protocol: TCP port: 443 targetPort: 443 + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: infra-cluster +subsets: + - addresses: + - ip: 192.168.12.130 + ports: + - port: 443 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: infra-cluster +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 From 5635fe8a06fbbafb3f444357a77b196871b1b593 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 4 Mar 2025 06:33:37 -0600 Subject: [PATCH 0479/1058] update --- infra/authentik/templates/ingress.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/authentik/templates/ingress.yaml b/infra/authentik/templates/ingress.yaml index 0936580..f946fb3 100644 --- a/infra/authentik/templates/ingress.yaml +++ b/infra/authentik/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`authentik.infra.durp.info`) && PathPrefix(`/`) + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: authentik-server @@ -25,7 +25,7 @@ spec: issuerRef: name: vault-issuer kind: ClusterIssuer - commonName: "authentik.infra.durp.info" + commonName: "authentik.durp.info" dnsNames: - - "authentik.infra.durp.info" + - "authentik.durp.info" From 2ad04019a8a43a5087fb6dc889c61d93e8121bd4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 05:03:41 -0600 Subject: [PATCH 0480/1058] update --- master/authentik/Chart.yaml | 4 +- master/authentik/templates/ingress.yaml | 84 +++++++-------- master/authentik/values.yaml | 137 +++++++++++++++--------- 3 files changed, 128 insertions(+), 97 deletions(-) diff --git a/master/authentik/Chart.yaml b/master/authentik/Chart.yaml index c87b677..62c0fa1 100644 --- a/master/authentik/Chart.yaml +++ b/master/authentik/Chart.yaml @@ -7,6 +7,6 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: -- name: authentik +- name: authentik-remote-cluster repository: https://charts.goauthentik.io - version: 2024.8.3 \ No newline at end of file + version: 2.0.0 diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml index ac10303..2e17729 100644 --- a/master/authentik/templates/ingress.yaml +++ b/master/authentik/templates/ingress.yaml @@ -1,42 +1,42 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: authentik-server - port: 80 - tls: - secretName: authentik-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - secretName: authentik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: traefik.containo.us/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: authentik-server +# port: 80 +# tls: +# secretName: authentik-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-tls +#spec: +# secretName: authentik-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "authentik.durp.info" +# dnsNames: +# - "authentik.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: authentik-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/master/authentik/values.yaml b/master/authentik/values.yaml index 716e081..ea38f16 100644 --- a/master/authentik/values.yaml +++ b/master/authentik/values.yaml @@ -1,56 +1,87 @@ authentik: + # -- Provide a name in place of `authentik`. Prefer using global.nameOverride if possible + nameOverride: "" + # -- String to fully override `"authentik.fullname"`. Prefer using global.fullnameOverride if possible + fullnameOverride: "" + # -- Override the Kubernetes version, which is used to evaluate certain manifests + kubeVersionOverride: "" + + ## Globally shared configuration for authentik components. global: - env: - - name: AUTHENTIK_POSTGRESQL__PASSWORD - valueFrom: - secretKeyRef: - name: db-pass - key: dbpass - - name: AUTHENTIK_SECRET_KEY - valueFrom: - secretKeyRef: - name: db-pass - key: secretkey - revisionHistoryLimit: 1 - image: - repository: registry.internal.durp.info/goauthentik/server - pullPolicy: Always - authentik: - outposts: - container_image_base: registry.internal.durp.info/goauthentik/%(type)s:%(version)s - postgresql: - host: '{{ .Release.Name }}-postgresql-hl' - name: "authentik" - user: "authentik" - port: 5432 - server: - name: server - replicas: 3 - worker: - replicas: 3 - postgresql: + # -- Provide a name in place of `authentik` + nameOverride: "" + # -- String to fully override `"authentik.fullname"` + fullnameOverride: "" + # -- A custom namespace to override the default namespace for the deployed resources. + namespaceOverride: "" + # -- Common labels for all resources. + additionalLabels: {} + # app: authentik + + # -- Annotations to apply to all resources + annotations: {} + + serviceAccountSecret: + # -- Create a secret with the service account credentials enabled: true - image: - registry: registry.internal.durp.info - repository: bitnami/postgresql - pullPolicy: Always - postgresqlUsername: "authentik" - postgresqlDatabase: "authentik" - existingSecret: db-pass - persistence: - enabled: true - storageClass: longhorn - accessModes: - - ReadWriteMany - redis: - enabled: true - master: - persistence: - enabled: false - image: - registry: registry.internal.durp.info - repository: bitnami/redis - pullPolicy: Always - architecture: standalone - auth: - enabled: false + + clusterRole: + # -- Create a clusterole in addition to a namespaced role. + enabled: true# + + + # global: + # env: + # - name: AUTHENTIK_POSTGRESQL__PASSWORD + # valueFrom: + # secretKeyRef: + # name: db-pass + # key: dbpass + # - name: AUTHENTIK_SECRET_KEY + # valueFrom: + # secretKeyRef: + # name: db-pass + # key: secretkey + # revisionHistoryLimit: 1 + # image: + # repository: registry.internal.durp.info/goauthentik/server + # pullPolicy: Always + # authentik: + # outposts: + # container_image_base: registry.internal.durp.info/goauthentik/%(type)s:%(version)s + # postgresql: + # host: '{{ .Release.Name }}-postgresql-hl' + # name: "authentik" + # user: "authentik" + # port: 5432 + # server: + # name: server + # replicas: 3 + # worker: + # replicas: 3 + # postgresql: + # enabled: true + # image: + # registry: registry.internal.durp.info + # repository: bitnami/postgresql + # pullPolicy: Always + # postgresqlUsername: "authentik" + # postgresqlDatabase: "authentik" + # existingSecret: db-pass + # persistence: + # enabled: true + # storageClass: longhorn + # accessModes: + # - ReadWriteMany + # redis: + # enabled: true + # master: + # persistence: + # enabled: false + # image: + # registry: registry.internal.durp.info + # repository: bitnami/redis + # pullPolicy: Always + # architecture: standalone + # auth: + # enabled: false From 2bfdb7570539a55cf501691cb33f5d596860fb0f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 05:49:13 -0600 Subject: [PATCH 0481/1058] update --- master/authentik/values.yaml | 61 +------------------ .../templates/duplicati-ingress.yaml | 4 +- 2 files changed, 4 insertions(+), 61 deletions(-) diff --git a/master/authentik/values.yaml b/master/authentik/values.yaml index ea38f16..83be2f9 100644 --- a/master/authentik/values.yaml +++ b/master/authentik/values.yaml @@ -1,4 +1,4 @@ -authentik: +authentik-remote-cluster: # -- Provide a name in place of `authentik`. Prefer using global.nameOverride if possible nameOverride: "" # -- String to fully override `"authentik.fullname"`. Prefer using global.fullnameOverride if possible @@ -27,61 +27,4 @@ authentik: clusterRole: # -- Create a clusterole in addition to a namespaced role. - enabled: true# - - - # global: - # env: - # - name: AUTHENTIK_POSTGRESQL__PASSWORD - # valueFrom: - # secretKeyRef: - # name: db-pass - # key: dbpass - # - name: AUTHENTIK_SECRET_KEY - # valueFrom: - # secretKeyRef: - # name: db-pass - # key: secretkey - # revisionHistoryLimit: 1 - # image: - # repository: registry.internal.durp.info/goauthentik/server - # pullPolicy: Always - # authentik: - # outposts: - # container_image_base: registry.internal.durp.info/goauthentik/%(type)s:%(version)s - # postgresql: - # host: '{{ .Release.Name }}-postgresql-hl' - # name: "authentik" - # user: "authentik" - # port: 5432 - # server: - # name: server - # replicas: 3 - # worker: - # replicas: 3 - # postgresql: - # enabled: true - # image: - # registry: registry.internal.durp.info - # repository: bitnami/postgresql - # pullPolicy: Always - # postgresqlUsername: "authentik" - # postgresqlDatabase: "authentik" - # existingSecret: db-pass - # persistence: - # enabled: true - # storageClass: longhorn - # accessModes: - # - ReadWriteMany - # redis: - # enabled: true - # master: - # persistence: - # enabled: false - # image: - # registry: registry.internal.durp.info - # repository: bitnami/redis - # pullPolicy: Always - # architecture: standalone - # auth: - # enabled: false + enabled: true diff --git a/master/internalproxy/templates/duplicati-ingress.yaml b/master/internalproxy/templates/duplicati-ingress.yaml index d51c391..c2d78ff 100644 --- a/master/internalproxy/templates/duplicati-ingress.yaml +++ b/master/internalproxy/templates/duplicati-ingress.yaml @@ -48,7 +48,7 @@ spec: - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) kind: Rule services: - - name: ak-outpost-authentik-embedded-outpost + - name: ak-outpost-master-embedded-outpost namespace: authentik port: 9000 tls: @@ -67,4 +67,4 @@ spec: kind: ClusterIssuer commonName: "duplicati.internal.durp.info" dnsNames: - - "duplicati.internal.durp.info" \ No newline at end of file + - "duplicati.internal.durp.info" From 4f514963426457cd4a5cf6d96f3fcee38f90e6da Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 05:55:56 -0600 Subject: [PATCH 0482/1058] update --- master/traefik/templates/ingress.yaml | 4 ++-- master/traefik/templates/middlewares.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/master/traefik/templates/ingress.yaml b/master/traefik/templates/ingress.yaml index a165566..c3db450 100644 --- a/master/traefik/templates/ingress.yaml +++ b/master/traefik/templates/ingress.yaml @@ -17,7 +17,7 @@ spec: - match: Host(`traefik.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) kind: Rule services: - - name: ak-outpost-authentik-embedded-outpost + - name: ak-outpost-master-embedded-outpost namespace: authentik port: 9000 tls: @@ -36,4 +36,4 @@ spec: kind: ClusterIssuer commonName: "traefik.internal.durp.info" dnsNames: - - "traefik.internal.durp.info" \ No newline at end of file + - "traefik.internal.durp.info" diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml index 453ca61..6e58514 100644 --- a/master/traefik/templates/middlewares.yaml +++ b/master/traefik/templates/middlewares.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik trustForwardHeader: true authResponseHeaders: - X-authentik-username From 0cffd50693faa6d16d043a1bb9aa09668195c777 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 06:15:23 -0600 Subject: [PATCH 0483/1058] update --- master/traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml index 6e58514..f92a3ef 100644 --- a/master/traefik/templates/middlewares.yaml +++ b/master/traefik/templates/middlewares.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + address: https://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik trustForwardHeader: true authResponseHeaders: - X-authentik-username From 26c910fa687982c3c9131a293d807c0dd6116cd3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 06:16:00 -0600 Subject: [PATCH 0484/1058] update --- master/traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml index f92a3ef..6e58514 100644 --- a/master/traefik/templates/middlewares.yaml +++ b/master/traefik/templates/middlewares.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik trustForwardHeader: true authResponseHeaders: - X-authentik-username From 26c56ff358455b3fbfc11c0503c534a5f18262ae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 06:22:29 -0600 Subject: [PATCH 0485/1058] update --- master/authentik/templates/ingress.yaml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml index 2e17729..dc44eca 100644 --- a/master/authentik/templates/ingress.yaml +++ b/master/authentik/templates/ingress.yaml @@ -40,3 +40,21 @@ #spec: # type: ExternalName # externalName: durp.info + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: outpost-ingress +spec: + ingressClassName: traefik + rules: + - host: outpost.internal.durp.info + http: + paths: + - backend: + service: + name: ak-outpost + port: + number: 9000 + path: / + pathType: Prefix From 9a28ec8af24cda24bafaedd4e96e5ecc17ade238 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 06:24:10 -0600 Subject: [PATCH 0486/1058] update --- master/authentik/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml index dc44eca..a142421 100644 --- a/master/authentik/templates/ingress.yaml +++ b/master/authentik/templates/ingress.yaml @@ -49,7 +49,7 @@ spec: ingressClassName: traefik rules: - host: outpost.internal.durp.info - http: + https: paths: - backend: service: From 77b5b9033eae3eeb7c1df5e76fb6e7a4edaae5f4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 06:26:22 -0600 Subject: [PATCH 0487/1058] update --- master/authentik/templates/ingress.yaml | 48 +++++++++++++++++-------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml index a142421..ccc8947 100644 --- a/master/authentik/templates/ingress.yaml +++ b/master/authentik/templates/ingress.yaml @@ -14,21 +14,21 @@ # tls: # secretName: authentik-tls # -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-tls -#spec: -# secretName: authentik-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "authentik.durp.info" -# dnsNames: -# - "authentik.durp.info" -# +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + secretName: authentik-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "outpost.internal.durp.info" + dnsNames: + - "outpost.internal.durp.info" + #--- # #kind: Service @@ -58,3 +58,21 @@ spec: number: 9000 path: / pathType: Prefix + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: outpost-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`outpost.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: ak-outpost-master-embedded-outpost + port: 9000 + tls: + secretName: authentik-tls From e2dabca525e08fca33fc84060b27faae03cc0c3c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 06:27:02 -0600 Subject: [PATCH 0488/1058] update --- master/authentik/templates/ingress.yaml | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml index ccc8947..83e1efa 100644 --- a/master/authentik/templates/ingress.yaml +++ b/master/authentik/templates/ingress.yaml @@ -41,24 +41,6 @@ spec: # type: ExternalName # externalName: durp.info -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: outpost-ingress -spec: - ingressClassName: traefik - rules: - - host: outpost.internal.durp.info - https: - paths: - - backend: - service: - name: ak-outpost - port: - number: 9000 - path: / - pathType: Prefix - --- apiVersion: traefik.containo.us/v1alpha1 From f6bd6425a1cf0ffb2f0ae8fda9a3654b80a37bc1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 5 Mar 2025 06:28:07 -0600 Subject: [PATCH 0489/1058] update --- master/traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml index 6e58514..b00c183 100644 --- a/master/traefik/templates/middlewares.yaml +++ b/master/traefik/templates/middlewares.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + address: https://outpost.internal.durp.info/outpost.goauthentik.io/auth/traefik trustForwardHeader: true authResponseHeaders: - X-authentik-username From 93725b3f5506021c9303cc8761c2775c6408ec3e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Mar 2025 14:56:11 -0600 Subject: [PATCH 0490/1058] update --- master/internalproxy/templates/nexus.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/master/internalproxy/templates/nexus.yaml b/master/internalproxy/templates/nexus.yaml index 7074102..5d3632e 100644 --- a/master/internalproxy/templates/nexus.yaml +++ b/master/internalproxy/templates/nexus.yaml @@ -19,7 +19,7 @@ metadata: name: nexus subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 8081 @@ -68,4 +68,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: nexus.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info From 566f722c89a712d0c8afd40ccdbe5bcd2ce1d51d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 8 Mar 2025 14:57:56 -0600 Subject: [PATCH 0491/1058] update --- master/internalproxy/templates/duplicati-ingress.yaml | 2 +- master/internalproxy/templates/gitea.yaml | 4 ++-- master/internalproxy/templates/jellyfin.yaml | 2 +- master/internalproxy/templates/minio.yaml | 2 +- master/internalproxy/templates/plex.yaml | 2 +- master/internalproxy/templates/redlib.yaml | 2 +- master/internalproxy/templates/registry-internal.yaml | 2 +- master/internalproxy/templates/registry.yaml | 4 ++-- master/internalproxy/templates/s3.yaml | 2 +- master/internalproxy/templates/semaphore.yaml | 2 +- master/internalproxy/templates/smokeping.yaml | 4 ++-- master/internalproxy/templates/speedtest.yaml | 4 ++-- master/internalproxy/templates/tdarr.yaml | 2 +- master/internalproxy/templates/unraid.yaml | 2 +- master/internalproxy/templates/vault.yaml | 2 +- 15 files changed, 19 insertions(+), 19 deletions(-) diff --git a/master/internalproxy/templates/duplicati-ingress.yaml b/master/internalproxy/templates/duplicati-ingress.yaml index c2d78ff..de08a38 100644 --- a/master/internalproxy/templates/duplicati-ingress.yaml +++ b/master/internalproxy/templates/duplicati-ingress.yaml @@ -19,7 +19,7 @@ metadata: name: duplicati subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 8200 diff --git a/master/internalproxy/templates/gitea.yaml b/master/internalproxy/templates/gitea.yaml index ec29631..0bde4e4 100644 --- a/master/internalproxy/templates/gitea.yaml +++ b/master/internalproxy/templates/gitea.yaml @@ -19,7 +19,7 @@ metadata: name: gitea subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 3000 @@ -69,4 +69,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: gitea.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info diff --git a/master/internalproxy/templates/jellyfin.yaml b/master/internalproxy/templates/jellyfin.yaml index 1b919bf..709b50a 100644 --- a/master/internalproxy/templates/jellyfin.yaml +++ b/master/internalproxy/templates/jellyfin.yaml @@ -19,7 +19,7 @@ metadata: name: jellyfin subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 8096 diff --git a/master/internalproxy/templates/minio.yaml b/master/internalproxy/templates/minio.yaml index aa191b6..71dd261 100644 --- a/master/internalproxy/templates/minio.yaml +++ b/master/internalproxy/templates/minio.yaml @@ -19,7 +19,7 @@ metadata: name: minio subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 9769 diff --git a/master/internalproxy/templates/plex.yaml b/master/internalproxy/templates/plex.yaml index 81f6426..45bba44 100644 --- a/master/internalproxy/templates/plex.yaml +++ b/master/internalproxy/templates/plex.yaml @@ -19,7 +19,7 @@ metadata: name: plex subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 32400 diff --git a/master/internalproxy/templates/redlib.yaml b/master/internalproxy/templates/redlib.yaml index 90a3b54..b71e4c3 100644 --- a/master/internalproxy/templates/redlib.yaml +++ b/master/internalproxy/templates/redlib.yaml @@ -19,7 +19,7 @@ metadata: name: redlib subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 8082 diff --git a/master/internalproxy/templates/registry-internal.yaml b/master/internalproxy/templates/registry-internal.yaml index 27561fe..c32c167 100644 --- a/master/internalproxy/templates/registry-internal.yaml +++ b/master/internalproxy/templates/registry-internal.yaml @@ -19,7 +19,7 @@ metadata: name: registry-internal subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 5000 diff --git a/master/internalproxy/templates/registry.yaml b/master/internalproxy/templates/registry.yaml index b4ac19a..1906614 100644 --- a/master/internalproxy/templates/registry.yaml +++ b/master/internalproxy/templates/registry.yaml @@ -19,7 +19,7 @@ metadata: name: registry subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 5000 @@ -68,4 +68,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: registry.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info diff --git a/master/internalproxy/templates/s3.yaml b/master/internalproxy/templates/s3.yaml index 6e22c5e..3a807d8 100644 --- a/master/internalproxy/templates/s3.yaml +++ b/master/internalproxy/templates/s3.yaml @@ -19,7 +19,7 @@ metadata: name: s3 subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 9769 diff --git a/master/internalproxy/templates/semaphore.yaml b/master/internalproxy/templates/semaphore.yaml index ffd81dc..e7256da 100644 --- a/master/internalproxy/templates/semaphore.yaml +++ b/master/internalproxy/templates/semaphore.yaml @@ -19,7 +19,7 @@ metadata: name: semaphore subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 3001 diff --git a/master/internalproxy/templates/smokeping.yaml b/master/internalproxy/templates/smokeping.yaml index 8a76738..9840993 100644 --- a/master/internalproxy/templates/smokeping.yaml +++ b/master/internalproxy/templates/smokeping.yaml @@ -19,7 +19,7 @@ metadata: name: smokeping subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 81 @@ -79,4 +79,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info diff --git a/master/internalproxy/templates/speedtest.yaml b/master/internalproxy/templates/speedtest.yaml index e034917..275b708 100644 --- a/master/internalproxy/templates/speedtest.yaml +++ b/master/internalproxy/templates/speedtest.yaml @@ -19,7 +19,7 @@ metadata: name: speedtest subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 6580 @@ -71,4 +71,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info diff --git a/master/internalproxy/templates/tdarr.yaml b/master/internalproxy/templates/tdarr.yaml index c4403b9..96eca07 100644 --- a/master/internalproxy/templates/tdarr.yaml +++ b/master/internalproxy/templates/tdarr.yaml @@ -19,7 +19,7 @@ metadata: name: tdarr subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 8267 diff --git a/master/internalproxy/templates/unraid.yaml b/master/internalproxy/templates/unraid.yaml index 9c62edc..c5cde07 100644 --- a/master/internalproxy/templates/unraid.yaml +++ b/master/internalproxy/templates/unraid.yaml @@ -19,7 +19,7 @@ metadata: name: unraid subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 443 diff --git a/master/internalproxy/templates/vault.yaml b/master/internalproxy/templates/vault.yaml index 88a7471..af97b25 100644 --- a/master/internalproxy/templates/vault.yaml +++ b/master/internalproxy/templates/vault.yaml @@ -19,7 +19,7 @@ metadata: name: root-vault subsets: - addresses: - - ip: 192.168.20.253 + - ip: 192.168.20.200 ports: - name: app port: 8201 From 3392892b512853e8a8626d33bbe0b551e24db769 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Mar 2025 08:34:34 -0500 Subject: [PATCH 0492/1058] update --- master/traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml index b00c183..6e58514 100644 --- a/master/traefik/templates/middlewares.yaml +++ b/master/traefik/templates/middlewares.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://outpost.internal.durp.info/outpost.goauthentik.io/auth/traefik + address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik trustForwardHeader: true authResponseHeaders: - X-authentik-username From b743ca035af038e3d093724aac5682d35927ad17 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Mar 2025 08:59:25 -0500 Subject: [PATCH 0493/1058] update --- infra/traefik/templates/middleware.yaml | 35 +++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 infra/traefik/templates/middleware.yaml diff --git a/infra/traefik/templates/middleware.yaml b/infra/traefik/templates/middleware.yaml new file mode 100644 index 0000000..453ca61 --- /dev/null +++ b/infra/traefik/templates/middleware.yaml @@ -0,0 +1,35 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: authentik-proxy-provider + namespace: traefik +spec: + forwardAuth: + address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: whitelist + namespace: traefik +spec: + ipWhiteList: + sourceRange: + - 192.168.0.0/16 + - 172.16.0.0/12 + - 10.0.0.0/8 From 91e8082e0040cb34b0112967bf36188c0f198ae0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Mar 2025 09:00:49 -0500 Subject: [PATCH 0494/1058] update --- {infra => dmz}/traefik/templates/middleware.yaml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename {infra => dmz}/traefik/templates/middleware.yaml (100%) diff --git a/infra/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml similarity index 100% rename from infra/traefik/templates/middleware.yaml rename to dmz/traefik/templates/middleware.yaml From 44008f5f43c5dc28460dc5e55113a99d269def82 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Mar 2025 09:06:39 -0500 Subject: [PATCH 0495/1058] update --- dmz/traefik/templates/middleware.yaml | 35 --------------------------- 1 file changed, 35 deletions(-) delete mode 100644 dmz/traefik/templates/middleware.yaml diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml deleted file mode 100644 index 453ca61..0000000 --- a/dmz/traefik/templates/middleware.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: authentik-proxy-provider - namespace: traefik -spec: - forwardAuth: - address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik - trustForwardHeader: true - authResponseHeaders: - - X-authentik-username - - X-authentik-groups - - X-authentik-email - - X-authentik-name - - X-authentik-uid - - X-authentik-jwt - - X-authentik-meta-jwks - - X-authentik-meta-outpost - - X-authentik-meta-provider - - X-authentik-meta-app - - X-authentik-meta-version - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: whitelist - namespace: traefik -spec: - ipWhiteList: - sourceRange: - - 192.168.0.0/16 - - 172.16.0.0/12 - - 10.0.0.0/8 From b1f85151d82290cada2bbde8c942d71ad1b7cf2f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 9 Mar 2025 09:32:06 -0500 Subject: [PATCH 0496/1058] update --- master/traefik/templates/middlewares.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml index 6e58514..dfa36c4 100644 --- a/master/traefik/templates/middlewares.yaml +++ b/master/traefik/templates/middlewares.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From ab91170043e3fa58bda82d2a69e88c16a8b25e62 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:09:28 -0500 Subject: [PATCH 0497/1058] update --- infra/argocd/templates/istio.yaml | 25 ++ infra/istio-system/Chart.yaml | 14 + infra/istio-system/values.yaml | 555 ++++++++++++++++++++++++++++++ 3 files changed, 594 insertions(+) create mode 100644 infra/argocd/templates/istio.yaml create mode 100644 infra/istio-system/Chart.yaml create mode 100644 infra/istio-system/values.yaml diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml new file mode 100644 index 0000000..a179ea7 --- /dev/null +++ b/infra/argocd/templates/istio.yaml @@ -0,0 +1,25 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: istio-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/istio-system + destination: + namespace: istio-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - .webhooks[]?.clientConfig.caBundle diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml new file mode 100644 index 0000000..9ea13e4 --- /dev/null +++ b/infra/istio-system/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v2 +name: traefik +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: base + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 +- name: istiod + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 diff --git a/infra/istio-system/values.yaml b/infra/istio-system/values.yaml new file mode 100644 index 0000000..fcd29da --- /dev/null +++ b/infra/istio-system/values.yaml @@ -0,0 +1,555 @@ +istiod: + autoscaleEnabled: true + autoscaleMin: 1 + autoscaleMax: 5 + autoscaleBehavior: {} + replicaCount: 1 + rollingMaxSurge: 100% + rollingMaxUnavailable: 25% + + hub: "" + tag: "" + variant: "" + + # Can be a full hub/image:tag + image: pilot + traceSampling: 1.0 + + # Resources for a small pilot install + resources: + requests: + cpu: 500m + memory: 2048Mi + + # Set to `type: RuntimeDefault` to use the default profile if available. + seccompProfile: {} + + # Whether to use an existing CNI installation + cni: + enabled: false + provider: default + + # Additional container arguments + extraContainerArgs: [] + + env: {} + + # Settings related to the untaint controller + # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready + # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes + taint: + # Controls whether or not the untaint controller is active + enabled: false + # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod + namespace: "" + + affinity: {} + + tolerations: [] + + cpu: + targetAverageUtilization: 80 + memory: {} + # targetAverageUtilization: 80 + + # Additional volumeMounts to the istiod container + volumeMounts: [] + + # Additional volumes to the istiod pod + volumes: [] + + # Inject initContainers into the istiod pod + initContainers: [] + + nodeSelector: {} + podAnnotations: {} + serviceAnnotations: {} + serviceAccountAnnotations: {} + sidecarInjectorWebhookAnnotations: {} + + topologySpreadConstraints: [] + + # You can use jwksResolverExtraRootCA to provide a root certificate + # in PEM format. This will then be trusted by pilot when resolving + # JWKS URIs. + jwksResolverExtraRootCA: "" + + # The following is used to limit how long a sidecar can be connected + # to a pilot. It balances out load across pilot instances at the cost of + # increasing system churn. + keepaliveMaxServerConnectionAge: 30m + + # Additional labels to apply to the deployment. + deploymentLabels: {} + + ## Mesh config settings + + # Install the mesh config map, generated from values.yaml. + # If false, pilot wil use default values (by default) or user-supplied values. + configMap: true + + # Additional labels to apply on the pod level for monitoring and logging configuration. + podLabels: {} + + # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + ipFamilyPolicy: "" + ipFamilies: [] + + # Ambient mode only. + # Set this if you install ztunnel to a different namespace from `istiod`. + # If set, `istiod` will allow connections from trusted node proxy ztunnels + # in the provided namespace. + # If unset, `istiod` will assume the trusted node proxy ztunnel resides + # in the same namespace as itself. + trustedZtunnelNamespace: "" + + sidecarInjectorWebhook: + # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or + # always skip the injection on pods that match that label selector, regardless of the global policy. + # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions + neverInjectSelector: [] + alwaysInjectSelector: [] + + # injectedAnnotations are additional annotations that will be added to the pod spec after injection + # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations: + # + # annotations: + # apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default + # apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default + # + # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before + # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify: + # injectedAnnotations: + # container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default + # container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default + injectedAnnotations: {} + + # This enables injection of sidecar in all namespaces, + # with the exception of namespaces with "istio-injection:disabled" annotation + # Only one environment should have this enabled. + enableNamespacesByDefault: false + + # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run + # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten. + # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur. + reinvocationPolicy: Never + + rewriteAppHTTPProbe: true + + # Templates defines a set of custom injection templates that can be used. For example, defining: + # + # templates: + # hello: | + # metadata: + # labels: + # hello: world + # + # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod + # being injected with the hello=world labels. + # This is intended for advanced configuration only; most users should use the built in template + templates: {} + + # Default templates specifies a set of default templates that are used in sidecar injection. + # By default, a template `sidecar` is always provided, which contains the template of default sidecar. + # To inject other additional templates, define it using the `templates` option, and add it to + # the default templates list. + # For example: + # + # templates: + # hello: | + # metadata: + # labels: + # hello: world + # + # defaultTemplates: ["sidecar", "hello"] + defaultTemplates: [] + istiodRemote: + # If `true`, indicates that this cluster/install should consume a "remote istiod" installation, + # and istiod itself will NOT be installed in this cluster - only the support resources necessary + # to utilize a remote instance. + enabled: false + # Sidecar injector mutating webhook configuration clientConfig.url value. + # For example: https://$remotePilotAddress:15017/inject + # The host should not refer to a service running in the cluster; use a service reference by specifying + # the clientConfig.service field instead. + injectionURL: "" + + # Sidecar injector mutating webhook configuration path value for the clientConfig.service field. + # Override to pass env variables, for example: /inject/cluster/remote/net/network2 + injectionPath: "/inject" + + injectionCABundle: "" + telemetry: + enabled: true + v2: + # For Null VM case now. + # This also enables metadata exchange. + enabled: true + # Indicate if prometheus stats filter is enabled or not + prometheus: + enabled: true + # stackdriver filter settings. + stackdriver: + enabled: false + # Revision is set as 'version' label and part of the resource names when installing multiple control planes. + revision: "" + + # Revision tags are aliases to Istio control plane revisions + revisionTags: [] + + # For Helm compatibility. + ownerName: "" + + # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior + # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options + meshConfig: + enablePrometheusMerge: true + + experimental: + stableValidationPolicy: false + + global: + # Used to locate istiod. + istioNamespace: istio-system + # List of cert-signers to allow "approve" action in the istio cluster role + # + # certSigners: + # - clusterissuers.cert-manager.io/istio-ca + certSigners: [] + # enable pod disruption budget for the control plane, which is used to + # ensure Istio control plane components are gradually upgraded or recovered. + defaultPodDisruptionBudget: + enabled: true + # The values aren't mutable due to a current PodDisruptionBudget limitation + # minAvailable: 1 + + # A minimal set of requested resources to applied to all deployments so that + # Horizontal Pod Autoscaler will be able to function (if set). + # Each component can overwrite these default values by adding its own resources + # block in the relevant section below and setting the desired resources values. + defaultResources: + requests: + cpu: 10m + # memory: 128Mi + # limits: + # cpu: 100m + # memory: 128Mi + + # Default hub for Istio images. + # Releases are published to docker hub under 'istio' project. + # Dev builds from prow are on gcr.io + hub: docker.io/istio + # Default tag for Istio images. + tag: 1.25.0 + # Variant of the image to use. + # Currently supported are: [debug, distroless] + variant: "" + + # Specify image pull policy if default behavior isn't desired. + # Default behavior: latest images will be Always else IfNotPresent. + imagePullPolicy: "" + + # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace + # to use for pulling any images in pods that reference this ServiceAccount. + # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing) + # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects. + # Must be set for any cluster configured with private docker registry. + imagePullSecrets: [] + # - private-registry-key + + # Enabled by default in master for maximising testing. + istiod: + enableAnalysis: false + + # To output all istio components logs in json format by adding --log_as_json argument to each container argument + logAsJson: false + + # Comma-separated minimum per-scope logging level of messages to output, in the form of :,: + # The control plane has different scopes depending on component, but can configure default log level across all components + # If empty, default scope and level will be used as configured in code + logging: + level: "default:info" + + omitSidecarInjectorConfigMap: false + + # Configure whether Operator manages webhook configurations. The current behavior + # of Istiod is to manage its own webhook configurations. + # When this option is set as true, Istio Operator, instead of webhooks, manages the + # webhook configurations. When this option is set as false, webhooks manage their + # own webhook configurations. + operatorManageWebhooks: false + + # Custom DNS config for the pod to resolve names of services in other + # clusters. Use this to add additional search domains, and other settings. + # see + # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config + # This does not apply to gateway pods as they typically need a different + # set of DNS settings than the normal application pods (e.g., in + # multicluster scenarios). + # NOTE: If using templates, follow the pattern in the commented example below. + #podDNSSearchNamespaces: + #- global + #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global" + + # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and + # system-node-critical, it is better to configure this in order to make sure your Istio pods + # will not be killed because of low priority class. + # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + # for more detail. + priorityClassName: "" + + proxy: + image: proxyv2 + + # This controls the 'policy' in the sidecar injector. + autoInject: enabled + + # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value + # cluster domain. Default value is "cluster.local". + clusterDomain: "cluster.local" + + # Per Component log level for proxy, applies to gateways and sidecars. If a component level is + # not set, then the global "logLevel" will be used. + componentLogLevel: "misc:error" + + # istio ingress capture allowlist + # examples: + # Redirect only selected ports: --includeInboundPorts="80,8080" + excludeInboundPorts: "" + includeInboundPorts: "*" + + # istio egress capture allowlist + # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly + # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16" + # would only capture egress traffic on those two IP Ranges, all other outbound traffic would + # be allowed by the sidecar + includeIPRanges: "*" + excludeIPRanges: "" + includeOutboundPorts: "" + excludeOutboundPorts: "" + + # Log level for proxy, applies to gateways and sidecars. + # Expected values are: trace|debug|info|warning|error|critical|off + logLevel: warning + + # Specify the path to the outlier event log. + # Example: /dev/stdout + outlierLogPath: "" + + #If set to true, istio-proxy container will have privileged securityContext + privileged: false + + # The number of successive failed probes before indicating readiness failure. + readinessFailureThreshold: 4 + + # The initial delay for readiness probes in seconds. + readinessInitialDelaySeconds: 0 + + # The period between readiness probes. + readinessPeriodSeconds: 15 + + # Enables or disables a startup probe. + # For optimal startup times, changing this should be tied to the readiness probe values. + # + # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4. + # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval), + # and doesn't spam the readiness endpoint too much + # + # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30. + # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly. + startupProbe: + enabled: true + failureThreshold: 600 # 10 minutes + + # Resources for the sidecar. + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 2000m + memory: 1024Mi + + # Default port for Pilot agent health checks. A value of 0 will disable health checking. + statusPort: 15020 + + # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none. + # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file. + tracer: "none" + + proxy_init: + # Base name for the proxy_init container, used to configure iptables. + image: proxyv2 + # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures. + # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases. + forceApplyIptables: false + + # configure remote pilot and istiod service and endpoint + remotePilotAddress: "" + + ############################################################################################## + # The following values are found in other charts. To effectively modify these values, make # + # make sure they are consistent across your Istio helm charts # + ############################################################################################## + + # The customized CA address to retrieve certificates for the pods in the cluster. + # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint. + # If not set explicitly, default to the Istio discovery address. + caAddress: "" + + # Enable control of remote clusters. + externalIstiod: true + + # Configure a remote cluster as the config cluster for an external istiod. + configCluster: false + + # configValidation enables the validation webhook for Istio configuration. + configValidation: true + + # Mesh ID means Mesh Identifier. It should be unique within the scope where + # meshes will interact with each other, but it is not required to be + # globally/universally unique. For example, if any of the following are true, + # then two meshes must have different Mesh IDs: + # - Meshes will have their telemetry aggregated in one place + # - Meshes will be federated together + # - Policy will be written referencing one mesh from the other + # + # If an administrator expects that any of these conditions may become true in + # the future, they should ensure their meshes have different Mesh IDs + # assigned. + # + # Within a multicluster mesh, each cluster must be (manually or auto) + # configured to have the same Mesh ID value. If an existing cluster 'joins' a + # multicluster mesh, it will need to be migrated to the new mesh ID. Details + # of migration TBD, and it may be a disruptive operation to change the Mesh + # ID post-install. + # + # If the mesh admin does not specify a value, Istio will use the value of the + # mesh's Trust Domain. The best practice is to select a proper Trust Domain + # value. + meshID: "mesh1" + + # Configure the mesh networks to be used by the Split Horizon EDS. + # + # The following example defines two networks with different endpoints association methods. + # For `network1` all endpoints that their IP belongs to the provided CIDR range will be + # mapped to network1. The gateway for this network example is specified by its public IP + # address and port. + # The second network, `network2`, in this example is defined differently with all endpoints + # retrieved through the specified Multi-Cluster registry being mapped to network2. The + # gateway is also defined differently with the name of the gateway service on the remote + # cluster. The public IP for the gateway will be determined from that remote service (only + # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service, + # it still need to be configured manually). + # + # meshNetworks: + # network1: + # endpoints: + # - fromCidr: "192.168.0.1/24" + # gateways: + # - address: 1.1.1.1 + # port: 80 + # network2: + # endpoints: + # - fromRegistry: reg1 + # gateways: + # - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local + # port: 443 + # + meshNetworks: {} + + # Use the user-specified, secret volume mounted key and certs for Pilot and workloads. + mountMtlsCerts: false + + multiCluster: + # Set to true to connect two kubernetes clusters via their respective + # ingressgateway services when pods in each cluster cannot directly + # talk to one another. All clusters should be using Istio mTLS and must + # have a shared root CA for this model to work. + enabled: false + # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection + # to properly label proxies + clusterName: "infra" + + # Network defines the network this cluster belong to. This name + # corresponds to the networks in the map of mesh networks. + network: "network1" + + # Configure the certificate provider for control plane communication. + # Currently, two providers are supported: "kubernetes" and "istiod". + # As some platforms may not have kubernetes signing APIs, + # Istiod is the default + pilotCertProvider: istiod + + sds: + # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3. + # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the + # JWT is intended for the CA. + token: + aud: istio-ca + + sts: + # The service port used by Security Token Service (STS) server to handle token exchange requests. + # Setting this port to a non-zero value enables STS server. + servicePort: 0 + + # The name of the CA for workload certificates. + # For example, when caName=GkeWorkloadCertificate, GKE workload certificates + # will be used as the certificates for workloads. + # The default value is "" and when caName="", the CA will be configured by other + # mechanisms (e.g., environmental variable CA_PROVIDER). + caName: "" + + waypoint: + # Resources for the waypoint proxy. + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: "2" + memory: 1Gi + + # If specified, affinity defines the scheduling constraints of waypoint pods. + affinity: {} + + # Topology Spread Constraints for the waypoint proxy. + topologySpreadConstraints: [] + + # Node labels for the waypoint proxy. + nodeSelector: {} + + # Tolerations for the waypoint proxy. + tolerations: [] + + base: + # For istioctl usage to disable istio config crds in base + enableIstioConfigCRDs: true + + # Gateway Settings + gateways: + # Define the security context for the pod. + # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. + # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. + securityContext: {} + + # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it + seccompProfile: {} + +base: + global: + imagePullSecrets: [] + + istioNamespace: istio-system + base: + excludedCRDs: [] + enableCRDTemplates: true + + validationURL: "" + validationCABundle: "" + + enableIstioConfigCRDs: true + + defaultRevision: "default" + experimental: + stableValidationPolicy: false From 5cccda199f2ca89f058ae7ec443ce2efc2abf456 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:14:50 -0500 Subject: [PATCH 0498/1058] update --- infra/argocd/templates/istio.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index a179ea7..c445d4d 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -20,6 +20,6 @@ spec: - CreateNamespace=true ignoreDifferences: - group: admissionregistration.k8s.io - kind: MutatingWebhookConfiguration - jqPathExpressions: - - .webhooks[]?.clientConfig.caBundle + kind: ValidatingWebhookConfiguration + jsonPointers: + - /webhooks/0/failurePolicy From a81951925b8a03d9992a92c80ca7e5e8619b188a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:17:31 -0500 Subject: [PATCH 0499/1058] update --- infra/istio-system/templates/expose.yaml | 53 ++++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 infra/istio-system/templates/expose.yaml diff --git a/infra/istio-system/templates/expose.yaml b/infra/istio-system/templates/expose.yaml new file mode 100644 index 0000000..e15971c --- /dev/null +++ b/infra/istio-system/templates/expose.yaml @@ -0,0 +1,53 @@ +apiVersion: networking.istio.io/v1 +kind: Gateway +metadata: + name: istiod-gateway +spec: + selector: + istio: eastwestgateway + servers: + - port: + name: tls-istiod + number: 15012 + protocol: tls + tls: + mode: PASSTHROUGH + hosts: + - "*" + - port: + name: tls-istiodwebhook + number: 15017 + protocol: tls + tls: + mode: PASSTHROUGH + hosts: + - "*" +--- +apiVersion: networking.istio.io/v1 +kind: VirtualService +metadata: + name: istiod-vs +spec: + hosts: + - "*" + gateways: + - istiod-gateway + tls: + - match: + - port: 15012 + sniHosts: + - "*" + route: + - destination: + host: istiod.istio-system.svc.cluster.local + port: + number: 15012 + - match: + - port: 15017 + sniHosts: + - "*" + route: + - destination: + host: istiod.istio-system.svc.cluster.local + port: + number: 443 From 5900798f5f80960db4b9404af6c01e9868624bf2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:36:31 -0500 Subject: [PATCH 0500/1058] update --- infra/istio-system/Chart.yaml | 2 +- infra/istio-system/values.yaml | 169 +++++++++++++++++++++++++++++++++ 2 files changed, 170 insertions(+), 1 deletion(-) diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index 9ea13e4..f117e2f 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -name: traefik +name: istio-system description: A Helm chart for Kubernetes type: application version: 0.0.1 diff --git a/infra/istio-system/values.yaml b/infra/istio-system/values.yaml index fcd29da..522ee34 100644 --- a/infra/istio-system/values.yaml +++ b/infra/istio-system/values.yaml @@ -553,3 +553,172 @@ base: defaultRevision: "default" experimental: stableValidationPolicy: false + +gateway: + # Name allows overriding the release name. Generally this should not be set + name: "istio-eastwestgateway" + # revision declares which revision this gateway is a part of + revision: "" + + # Controls the spec.replicas setting for the Gateway deployment if set. + # Otherwise defaults to Kubernetes Deployment default (1). + replicaCount: + + kind: Deployment + + rbac: + # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed + # when using http://gateway-api.org/. + enabled: true + + serviceAccount: + # If set, a service account will be created. Otherwise, the default is used + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set, the release name is used + name: "" + + podAnnotations: + prometheus.io/port: "15020" + prometheus.io/scrape: "true" + prometheus.io/path: "/stats/prometheus" + inject.istio.io/templates: "gateway" + sidecar.istio.io/inject: "true" + + # Define the security context for the pod. + # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. + # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. + securityContext: {} + containerSecurityContext: {} + + service: + # Type of service. Set to "None" to disable the service entirely + type: LoadBalancer + ports: + - name: status-port + port: 15021 + protocol: TCP + targetPort: 15021 + - name: http2 + port: 80 + protocol: TCP + targetPort: 80 + - name: https + port: 443 + protocol: TCP + targetPort: 443 + annotations: {} + loadBalancerIP: "" + loadBalancerSourceRanges: [] + externalTrafficPolicy: "" + externalIPs: [] + ipFamilyPolicy: "" + ipFamilies: [] + ## Whether to automatically allocate NodePorts (only for LoadBalancers). + # allocateLoadBalancerNodePorts: false + ## Set LoadBalancer class (only for LoadBalancers). + # loadBalancerClass: "" + + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 2000m + memory: 1024Mi + + autoscaling: + enabled: true + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: {} + autoscaleBehavior: {} + + # Pod environment variables + env: {} + + # Deployment Update strategy + strategy: {} + + # Sets the Deployment minReadySeconds value + minReadySeconds: + + # Optionally configure a custom readinessProbe. By default the control plane + # automatically injects the readinessProbe. If you wish to override that + # behavior, you may define your own readinessProbe here. + readinessProbe: {} + + # Labels to apply to all resources + labels: + # By default, don't enroll gateways into the ambient dataplane + "istio.io/dataplane-mode": none + + # Annotations to apply to all resources + annotations: {} + + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # If specified, the gateway will act as a network gateway for the given network. + networkGateway: "network1" + + # Specify image pull policy if default behavior isn't desired. + # Default behavior: latest images will be Always else IfNotPresent + imagePullPolicy: "" + + imagePullSecrets: [] + + # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway. + # + # By default, the `podDisruptionBudget` is disabled (set to `{}`), + # which means that no PodDisruptionBudget resource will be created. + # + # To enable the PodDisruptionBudget, configure it by specifying the + # `minAvailable` or `maxUnavailable`. For example, to set the + # minimum number of available replicas to 1, you can update this value as follows: + # + # podDisruptionBudget: + # minAvailable: 1 + # + # Or, to allow a maximum of 1 unavailable replica, you can set: + # + # podDisruptionBudget: + # maxUnavailable: 1 + # + # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`. + # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows: + # + # podDisruptionBudget: + # minAvailable: 1 + # unhealthyPodEvictionPolicy: AlwaysAllow + # + # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`: + # + # podDisruptionBudget: {} + # + podDisruptionBudget: {} + + # Sets the per-pod terminationGracePeriodSeconds setting. + terminationGracePeriodSeconds: 30 + + # A list of `Volumes` added into the Gateway Pods. See + # https://kubernetes.io/docs/concepts/storage/volumes/. + volumes: [] + + # A list of `VolumeMounts` added into the Gateway Pods. See + # https://kubernetes.io/docs/concepts/storage/volumes/. + volumeMounts: [] + + # Configure this to a higher priority class in order to make sure your Istio gateway pods + # will not be killed because of low priority class. + # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + # for more detail. + priorityClassName: "" From 70a2b51314a23464fa3270210e1b8da6b66cc12e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:37:56 -0500 Subject: [PATCH 0501/1058] update --- infra/istio-system/Chart.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index f117e2f..6ced8b7 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -12,3 +12,6 @@ dependencies: - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.25.0 +- name: gateway + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 From 8f2086854dab865287967d65d5181be89e1856f1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:47:15 -0500 Subject: [PATCH 0502/1058] update --- dmz/istio-system/Chart.yaml | 14 + dmz/istio-system/templates/annotate.yaml | 15 + dmz/istio-system/values.yaml | 556 +++++++++++++++++++++++ 3 files changed, 585 insertions(+) create mode 100644 dmz/istio-system/Chart.yaml create mode 100644 dmz/istio-system/templates/annotate.yaml create mode 100644 dmz/istio-system/values.yaml diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml new file mode 100644 index 0000000..f117e2f --- /dev/null +++ b/dmz/istio-system/Chart.yaml @@ -0,0 +1,14 @@ +apiVersion: v2 +name: istio-system +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: base + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 +- name: istiod + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 diff --git a/dmz/istio-system/templates/annotate.yaml b/dmz/istio-system/templates/annotate.yaml new file mode 100644 index 0000000..a39e4da --- /dev/null +++ b/dmz/istio-system/templates/annotate.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Namespace +metadata: + annotations: + kubectl.kubernetes.io/last-applied-configuration: | + {"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"creationTimestamp":null,"name":"istio-system"},"spec":{},"status":{}} + topology.istio.io/controlPlaneClusters: cluster1 + labels: + kubernetes.io/metadata.name: istio-system + name: istio-system +spec: + finalizers: + - kubernetes +status: + phase: Active diff --git a/dmz/istio-system/values.yaml b/dmz/istio-system/values.yaml new file mode 100644 index 0000000..a6dbc7e --- /dev/null +++ b/dmz/istio-system/values.yaml @@ -0,0 +1,556 @@ +istiod: + profile: remote + autoscaleEnabled: true + autoscaleMin: 1 + autoscaleMax: 5 + autoscaleBehavior: {} + replicaCount: 1 + rollingMaxSurge: 100% + rollingMaxUnavailable: 25% + + hub: "" + tag: "" + variant: "" + + # Can be a full hub/image:tag + image: pilot + traceSampling: 1.0 + + # Resources for a small pilot install + resources: + requests: + cpu: 500m + memory: 2048Mi + + # Set to `type: RuntimeDefault` to use the default profile if available. + seccompProfile: {} + + # Whether to use an existing CNI installation + cni: + enabled: false + provider: default + + # Additional container arguments + extraContainerArgs: [] + + env: {} + + # Settings related to the untaint controller + # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready + # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes + taint: + # Controls whether or not the untaint controller is active + enabled: false + # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod + namespace: "" + + affinity: {} + + tolerations: [] + + cpu: + targetAverageUtilization: 80 + memory: {} + # targetAverageUtilization: 80 + + # Additional volumeMounts to the istiod container + volumeMounts: [] + + # Additional volumes to the istiod pod + volumes: [] + + # Inject initContainers into the istiod pod + initContainers: [] + + nodeSelector: {} + podAnnotations: {} + serviceAnnotations: {} + serviceAccountAnnotations: {} + sidecarInjectorWebhookAnnotations: {} + + topologySpreadConstraints: [] + + # You can use jwksResolverExtraRootCA to provide a root certificate + # in PEM format. This will then be trusted by pilot when resolving + # JWKS URIs. + jwksResolverExtraRootCA: "" + + # The following is used to limit how long a sidecar can be connected + # to a pilot. It balances out load across pilot instances at the cost of + # increasing system churn. + keepaliveMaxServerConnectionAge: 30m + + # Additional labels to apply to the deployment. + deploymentLabels: {} + + ## Mesh config settings + + # Install the mesh config map, generated from values.yaml. + # If false, pilot wil use default values (by default) or user-supplied values. + configMap: true + + # Additional labels to apply on the pod level for monitoring and logging configuration. + podLabels: {} + + # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services + ipFamilyPolicy: "" + ipFamilies: [] + + # Ambient mode only. + # Set this if you install ztunnel to a different namespace from `istiod`. + # If set, `istiod` will allow connections from trusted node proxy ztunnels + # in the provided namespace. + # If unset, `istiod` will assume the trusted node proxy ztunnel resides + # in the same namespace as itself. + trustedZtunnelNamespace: "" + + sidecarInjectorWebhook: + # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or + # always skip the injection on pods that match that label selector, regardless of the global policy. + # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions + neverInjectSelector: [] + alwaysInjectSelector: [] + + # injectedAnnotations are additional annotations that will be added to the pod spec after injection + # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations: + # + # annotations: + # apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default + # apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default + # + # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before + # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify: + # injectedAnnotations: + # container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default + # container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default + injectedAnnotations: {} + + # This enables injection of sidecar in all namespaces, + # with the exception of namespaces with "istio-injection:disabled" annotation + # Only one environment should have this enabled. + enableNamespacesByDefault: false + + # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run + # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten. + # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur. + reinvocationPolicy: Never + + rewriteAppHTTPProbe: true + + # Templates defines a set of custom injection templates that can be used. For example, defining: + # + # templates: + # hello: | + # metadata: + # labels: + # hello: world + # + # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod + # being injected with the hello=world labels. + # This is intended for advanced configuration only; most users should use the built in template + templates: {} + + # Default templates specifies a set of default templates that are used in sidecar injection. + # By default, a template `sidecar` is always provided, which contains the template of default sidecar. + # To inject other additional templates, define it using the `templates` option, and add it to + # the default templates list. + # For example: + # + # templates: + # hello: | + # metadata: + # labels: + # hello: world + # + # defaultTemplates: ["sidecar", "hello"] + defaultTemplates: [] + istiodRemote: + # If `true`, indicates that this cluster/install should consume a "remote istiod" installation, + # and istiod itself will NOT be installed in this cluster - only the support resources necessary + # to utilize a remote instance. + enabled: false + # Sidecar injector mutating webhook configuration clientConfig.url value. + # For example: https://$remotePilotAddress:15017/inject + # The host should not refer to a service running in the cluster; use a service reference by specifying + # the clientConfig.service field instead. + injectionURL: "" + + # Sidecar injector mutating webhook configuration path value for the clientConfig.service field. + # Override to pass env variables, for example: /inject/cluster/remote/net/network2 + injectionPath: "/inject/cluster/cluster2/net/network1" + + injectionCABundle: "" + telemetry: + enabled: true + v2: + # For Null VM case now. + # This also enables metadata exchange. + enabled: true + # Indicate if prometheus stats filter is enabled or not + prometheus: + enabled: true + # stackdriver filter settings. + stackdriver: + enabled: false + # Revision is set as 'version' label and part of the resource names when installing multiple control planes. + revision: "" + + # Revision tags are aliases to Istio control plane revisions + revisionTags: [] + + # For Helm compatibility. + ownerName: "" + + # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior + # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options + meshConfig: + enablePrometheusMerge: true + + experimental: + stableValidationPolicy: false + + global: + # Used to locate istiod. + istioNamespace: istio-system + # List of cert-signers to allow "approve" action in the istio cluster role + # + # certSigners: + # - clusterissuers.cert-manager.io/istio-ca + certSigners: [] + # enable pod disruption budget for the control plane, which is used to + # ensure Istio control plane components are gradually upgraded or recovered. + defaultPodDisruptionBudget: + enabled: true + # The values aren't mutable due to a current PodDisruptionBudget limitation + # minAvailable: 1 + + # A minimal set of requested resources to applied to all deployments so that + # Horizontal Pod Autoscaler will be able to function (if set). + # Each component can overwrite these default values by adding its own resources + # block in the relevant section below and setting the desired resources values. + defaultResources: + requests: + cpu: 10m + # memory: 128Mi + # limits: + # cpu: 100m + # memory: 128Mi + + # Default hub for Istio images. + # Releases are published to docker hub under 'istio' project. + # Dev builds from prow are on gcr.io + hub: docker.io/istio + # Default tag for Istio images. + tag: 1.25.0 + # Variant of the image to use. + # Currently supported are: [debug, distroless] + variant: "" + + # Specify image pull policy if default behavior isn't desired. + # Default behavior: latest images will be Always else IfNotPresent. + imagePullPolicy: "" + + # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace + # to use for pulling any images in pods that reference this ServiceAccount. + # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing) + # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects. + # Must be set for any cluster configured with private docker registry. + imagePullSecrets: [] + # - private-registry-key + + # Enabled by default in master for maximising testing. + istiod: + enableAnalysis: false + + # To output all istio components logs in json format by adding --log_as_json argument to each container argument + logAsJson: false + + # Comma-separated minimum per-scope logging level of messages to output, in the form of :,: + # The control plane has different scopes depending on component, but can configure default log level across all components + # If empty, default scope and level will be used as configured in code + logging: + level: "default:info" + + omitSidecarInjectorConfigMap: false + + # Configure whether Operator manages webhook configurations. The current behavior + # of Istiod is to manage its own webhook configurations. + # When this option is set as true, Istio Operator, instead of webhooks, manages the + # webhook configurations. When this option is set as false, webhooks manage their + # own webhook configurations. + operatorManageWebhooks: false + + # Custom DNS config for the pod to resolve names of services in other + # clusters. Use this to add additional search domains, and other settings. + # see + # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config + # This does not apply to gateway pods as they typically need a different + # set of DNS settings than the normal application pods (e.g., in + # multicluster scenarios). + # NOTE: If using templates, follow the pattern in the commented example below. + #podDNSSearchNamespaces: + #- global + #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global" + + # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and + # system-node-critical, it is better to configure this in order to make sure your Istio pods + # will not be killed because of low priority class. + # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + # for more detail. + priorityClassName: "" + + proxy: + image: proxyv2 + + # This controls the 'policy' in the sidecar injector. + autoInject: enabled + + # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value + # cluster domain. Default value is "cluster.local". + clusterDomain: "cluster.local" + + # Per Component log level for proxy, applies to gateways and sidecars. If a component level is + # not set, then the global "logLevel" will be used. + componentLogLevel: "misc:error" + + # istio ingress capture allowlist + # examples: + # Redirect only selected ports: --includeInboundPorts="80,8080" + excludeInboundPorts: "" + includeInboundPorts: "*" + + # istio egress capture allowlist + # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly + # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16" + # would only capture egress traffic on those two IP Ranges, all other outbound traffic would + # be allowed by the sidecar + includeIPRanges: "*" + excludeIPRanges: "" + includeOutboundPorts: "" + excludeOutboundPorts: "" + + # Log level for proxy, applies to gateways and sidecars. + # Expected values are: trace|debug|info|warning|error|critical|off + logLevel: warning + + # Specify the path to the outlier event log. + # Example: /dev/stdout + outlierLogPath: "" + + #If set to true, istio-proxy container will have privileged securityContext + privileged: false + + # The number of successive failed probes before indicating readiness failure. + readinessFailureThreshold: 4 + + # The initial delay for readiness probes in seconds. + readinessInitialDelaySeconds: 0 + + # The period between readiness probes. + readinessPeriodSeconds: 15 + + # Enables or disables a startup probe. + # For optimal startup times, changing this should be tied to the readiness probe values. + # + # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4. + # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval), + # and doesn't spam the readiness endpoint too much + # + # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30. + # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly. + startupProbe: + enabled: true + failureThreshold: 600 # 10 minutes + + # Resources for the sidecar. + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 2000m + memory: 1024Mi + + # Default port for Pilot agent health checks. A value of 0 will disable health checking. + statusPort: 15020 + + # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none. + # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file. + tracer: "none" + + proxy_init: + # Base name for the proxy_init container, used to configure iptables. + image: proxyv2 + # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures. + # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases. + forceApplyIptables: false + + # configure remote pilot and istiod service and endpoint + remotePilotAddress: "192.168.12.131" + + ############################################################################################## + # The following values are found in other charts. To effectively modify these values, make # + # make sure they are consistent across your Istio helm charts # + ############################################################################################## + + # The customized CA address to retrieve certificates for the pods in the cluster. + # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint. + # If not set explicitly, default to the Istio discovery address. + caAddress: "" + + # Enable control of remote clusters. + externalIstiod: false + + # Configure a remote cluster as the config cluster for an external istiod. + configCluster: true + + # configValidation enables the validation webhook for Istio configuration. + configValidation: true + + # Mesh ID means Mesh Identifier. It should be unique within the scope where + # meshes will interact with each other, but it is not required to be + # globally/universally unique. For example, if any of the following are true, + # then two meshes must have different Mesh IDs: + # - Meshes will have their telemetry aggregated in one place + # - Meshes will be federated together + # - Policy will be written referencing one mesh from the other + # + # If an administrator expects that any of these conditions may become true in + # the future, they should ensure their meshes have different Mesh IDs + # assigned. + # + # Within a multicluster mesh, each cluster must be (manually or auto) + # configured to have the same Mesh ID value. If an existing cluster 'joins' a + # multicluster mesh, it will need to be migrated to the new mesh ID. Details + # of migration TBD, and it may be a disruptive operation to change the Mesh + # ID post-install. + # + # If the mesh admin does not specify a value, Istio will use the value of the + # mesh's Trust Domain. The best practice is to select a proper Trust Domain + # value. + meshID: "" + + # Configure the mesh networks to be used by the Split Horizon EDS. + # + # The following example defines two networks with different endpoints association methods. + # For `network1` all endpoints that their IP belongs to the provided CIDR range will be + # mapped to network1. The gateway for this network example is specified by its public IP + # address and port. + # The second network, `network2`, in this example is defined differently with all endpoints + # retrieved through the specified Multi-Cluster registry being mapped to network2. The + # gateway is also defined differently with the name of the gateway service on the remote + # cluster. The public IP for the gateway will be determined from that remote service (only + # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service, + # it still need to be configured manually). + # + # meshNetworks: + # network1: + # endpoints: + # - fromCidr: "192.168.0.1/24" + # gateways: + # - address: 1.1.1.1 + # port: 80 + # network2: + # endpoints: + # - fromRegistry: reg1 + # gateways: + # - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local + # port: 443 + # + meshNetworks: {} + + # Use the user-specified, secret volume mounted key and certs for Pilot and workloads. + mountMtlsCerts: false + + multiCluster: + # Set to true to connect two kubernetes clusters via their respective + # ingressgateway services when pods in each cluster cannot directly + # talk to one another. All clusters should be using Istio mTLS and must + # have a shared root CA for this model to work. + enabled: false + # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection + # to properly label proxies + clusterName: "dmz" + + # Network defines the network this cluster belong to. This name + # corresponds to the networks in the map of mesh networks. + network: "" + + # Configure the certificate provider for control plane communication. + # Currently, two providers are supported: "kubernetes" and "istiod". + # As some platforms may not have kubernetes signing APIs, + # Istiod is the default + pilotCertProvider: istiod + + sds: + # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3. + # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the + # JWT is intended for the CA. + token: + aud: istio-ca + + sts: + # The service port used by Security Token Service (STS) server to handle token exchange requests. + # Setting this port to a non-zero value enables STS server. + servicePort: 0 + + # The name of the CA for workload certificates. + # For example, when caName=GkeWorkloadCertificate, GKE workload certificates + # will be used as the certificates for workloads. + # The default value is "" and when caName="", the CA will be configured by other + # mechanisms (e.g., environmental variable CA_PROVIDER). + caName: "" + + waypoint: + # Resources for the waypoint proxy. + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: "2" + memory: 1Gi + + # If specified, affinity defines the scheduling constraints of waypoint pods. + affinity: {} + + # Topology Spread Constraints for the waypoint proxy. + topologySpreadConstraints: [] + + # Node labels for the waypoint proxy. + nodeSelector: {} + + # Tolerations for the waypoint proxy. + tolerations: [] + + base: + # For istioctl usage to disable istio config crds in base + enableIstioConfigCRDs: true + + # Gateway Settings + gateways: + # Define the security context for the pod. + # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. + # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. + securityContext: {} + + # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it + seccompProfile: {} +base: + profile: remote + global: + imagePullSecrets: [] + + istioNamespace: istio-system + base: + excludedCRDs: [] + enableCRDTemplates: true + + validationURL: "" + validationCABundle: "" + + enableIstioConfigCRDs: true + + defaultRevision: "default" + experimental: + stableValidationPolicy: false From 839f9d1d7e498a81699022259942e19c301cf760 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:49:26 -0500 Subject: [PATCH 0503/1058] update --- infra/argocd/templates/istio.yaml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index c445d4d..c05cb9a 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -23,3 +23,31 @@ spec: kind: ValidatingWebhookConfiguration jsonPointers: - /webhooks/0/failurePolicy + +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: istio-system + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/istio-system + destination: + namespace: istio-system + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jsonPointers: + - /webhooks/0/failurePolicy From 6ef8bee91289619d535cc701289bc05ddbd1bcdf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:50:09 -0500 Subject: [PATCH 0504/1058] update --- infra/argocd/templates/istio.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index c05cb9a..808d46a 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -29,7 +29,7 @@ spec: apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: istio-system + name: istio-system-dmz namespace: argocd spec: project: default From 3c65f2e76ab63e239410b83fc24ee1b5b897a0b7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 10 Mar 2025 05:53:53 -0500 Subject: [PATCH 0505/1058] update --- dmz/istio-system/templates/annotate.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/dmz/istio-system/templates/annotate.yaml b/dmz/istio-system/templates/annotate.yaml index a39e4da..a8a0dc6 100644 --- a/dmz/istio-system/templates/annotate.yaml +++ b/dmz/istio-system/templates/annotate.yaml @@ -2,8 +2,6 @@ apiVersion: v1 kind: Namespace metadata: annotations: - kubectl.kubernetes.io/last-applied-configuration: | - {"apiVersion":"v1","kind":"Namespace","metadata":{"annotations":{},"creationTimestamp":null,"name":"istio-system"},"spec":{},"status":{}} topology.istio.io/controlPlaneClusters: cluster1 labels: kubernetes.io/metadata.name: istio-system From 3cf69d0883f9d05674c07b1f8a080a609e46153f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 11 Mar 2025 05:15:52 -0500 Subject: [PATCH 0506/1058] update --- infra/argocd/templates/authentik.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index 16ff58a..7c91765 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -13,6 +13,9 @@ spec: namespace: authentik name: in-cluster syncPolicy: + managedNamespaceMetadata: + labels: + istio-injection: enabled automated: prune: true selfHeal: true From 8452f0ee77007a48397f98c8e34f7b523a1d7609 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 11 Mar 2025 05:18:52 -0500 Subject: [PATCH 0507/1058] update --- infra/argocd/templates/traefik.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index 9122420..d55b815 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -13,6 +13,9 @@ spec: namespace: traefik name: in-cluster syncPolicy: + managedNamespaceMetadata: + labels: + istio-injection: enabled automated: prune: true selfHeal: true @@ -36,6 +39,9 @@ spec: namespace: traefik name: dmz syncPolicy: + managedNamespaceMetadata: + labels: + istio-injection: enabled automated: prune: true selfHeal: true From 52382885b069193b8fa2afc16961662788fa8735 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 11 Mar 2025 05:46:55 -0500 Subject: [PATCH 0508/1058] update --- dmz/istio-system/Chart.yaml | 3 + dmz/istio-system/values.yaml | 169 +++++++++++++++++++++++++++++++++++ 2 files changed, 172 insertions(+) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index f117e2f..6ced8b7 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -12,3 +12,6 @@ dependencies: - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.25.0 +- name: gateway + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 diff --git a/dmz/istio-system/values.yaml b/dmz/istio-system/values.yaml index a6dbc7e..5ca6719 100644 --- a/dmz/istio-system/values.yaml +++ b/dmz/istio-system/values.yaml @@ -554,3 +554,172 @@ base: defaultRevision: "default" experimental: stableValidationPolicy: false + +gateway: + # Name allows overriding the release name. Generally this should not be set + name: "istio-eastwestgateway" + # revision declares which revision this gateway is a part of + revision: "" + + # Controls the spec.replicas setting for the Gateway deployment if set. + # Otherwise defaults to Kubernetes Deployment default (1). + replicaCount: + + kind: Deployment + + rbac: + # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed + # when using http://gateway-api.org/. + enabled: true + + serviceAccount: + # If set, a service account will be created. Otherwise, the default is used + create: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set, the release name is used + name: "" + + podAnnotations: + prometheus.io/port: "15020" + prometheus.io/scrape: "true" + prometheus.io/path: "/stats/prometheus" + inject.istio.io/templates: "gateway" + sidecar.istio.io/inject: "true" + + # Define the security context for the pod. + # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. + # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. + securityContext: {} + containerSecurityContext: {} + + service: + # Type of service. Set to "None" to disable the service entirely + type: LoadBalancer + ports: + - name: status-port + port: 15021 + protocol: TCP + targetPort: 15021 + - name: http2 + port: 80 + protocol: TCP + targetPort: 80 + - name: https + port: 443 + protocol: TCP + targetPort: 443 + annotations: {} + loadBalancerIP: "" + loadBalancerSourceRanges: [] + externalTrafficPolicy: "" + externalIPs: [] + ipFamilyPolicy: "" + ipFamilies: [] + ## Whether to automatically allocate NodePorts (only for LoadBalancers). + # allocateLoadBalancerNodePorts: false + ## Set LoadBalancer class (only for LoadBalancers). + # loadBalancerClass: "" + + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 2000m + memory: 1024Mi + + autoscaling: + enabled: true + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: {} + autoscaleBehavior: {} + + # Pod environment variables + env: {} + + # Deployment Update strategy + strategy: {} + + # Sets the Deployment minReadySeconds value + minReadySeconds: + + # Optionally configure a custom readinessProbe. By default the control plane + # automatically injects the readinessProbe. If you wish to override that + # behavior, you may define your own readinessProbe here. + readinessProbe: {} + + # Labels to apply to all resources + labels: + # By default, don't enroll gateways into the ambient dataplane + "istio.io/dataplane-mode": none + + # Annotations to apply to all resources + annotations: {} + + nodeSelector: {} + + tolerations: [] + + topologySpreadConstraints: [] + + affinity: {} + + # If specified, the gateway will act as a network gateway for the given network. + networkGateway: "network1" + + # Specify image pull policy if default behavior isn't desired. + # Default behavior: latest images will be Always else IfNotPresent + imagePullPolicy: "" + + imagePullSecrets: [] + + # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway. + # + # By default, the `podDisruptionBudget` is disabled (set to `{}`), + # which means that no PodDisruptionBudget resource will be created. + # + # To enable the PodDisruptionBudget, configure it by specifying the + # `minAvailable` or `maxUnavailable`. For example, to set the + # minimum number of available replicas to 1, you can update this value as follows: + # + # podDisruptionBudget: + # minAvailable: 1 + # + # Or, to allow a maximum of 1 unavailable replica, you can set: + # + # podDisruptionBudget: + # maxUnavailable: 1 + # + # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`. + # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows: + # + # podDisruptionBudget: + # minAvailable: 1 + # unhealthyPodEvictionPolicy: AlwaysAllow + # + # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`: + # + # podDisruptionBudget: {} + # + podDisruptionBudget: {} + + # Sets the per-pod terminationGracePeriodSeconds setting. + terminationGracePeriodSeconds: 30 + + # A list of `Volumes` added into the Gateway Pods. See + # https://kubernetes.io/docs/concepts/storage/volumes/. + volumes: [] + + # A list of `VolumeMounts` added into the Gateway Pods. See + # https://kubernetes.io/docs/concepts/storage/volumes/. + volumeMounts: [] + + # Configure this to a higher priority class in order to make sure your Istio gateway pods + # will not be killed because of low priority class. + # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass + # for more detail. + priorityClassName: "" From b35fe6bc6621f7169b30cfd6d827e4d0e98b413f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 11 Mar 2025 06:21:43 -0500 Subject: [PATCH 0509/1058] update --- master/internalproxy/templates/s3.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/master/internalproxy/templates/s3.yaml b/master/internalproxy/templates/s3.yaml index 3a807d8..e48d6ce 100644 --- a/master/internalproxy/templates/s3.yaml +++ b/master/internalproxy/templates/s3.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 9769 + port: 9768 protocol: TCP - targetPort: 9769 + targetPort: 9768 clusterIP: None type: ClusterIP @@ -22,7 +22,7 @@ subsets: - ip: 192.168.20.200 ports: - name: app - port: 9769 + port: 9768 protocol: TCP --- @@ -42,7 +42,7 @@ spec: kind: Rule services: - name: s3 - port: 9769 + port: 9768 scheme: http tls: secretName: s3-tls From 700f1864748407d5740bcc8ab6d8a7ded038c760 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 13 Mar 2025 14:47:27 -0500 Subject: [PATCH 0510/1058] update storage --- infra/authentik/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index 4fa183b..579302f 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -40,6 +40,7 @@ authentik: persistence: enabled: true storageClass: longhorn + size: 16Gi accessModes: - ReadWriteMany redis: From 158ff3c97db09b0e72bf94b22ccf8aad2dd04402 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Mar 2025 05:07:06 -0500 Subject: [PATCH 0511/1058] update --- infra/argocd/templates/litellm.yaml | 20 +++ infra/litellm/Chart.yaml | 12 ++ infra/litellm/values.yaml | 197 ++++++++++++++++++++++++++++ 3 files changed, 229 insertions(+) create mode 100644 infra/argocd/templates/litellm.yaml create mode 100644 infra/litellm/Chart.yaml create mode 100644 infra/litellm/values.yaml diff --git a/infra/argocd/templates/litellm.yaml b/infra/argocd/templates/litellm.yaml new file mode 100644 index 0000000..3b52349 --- /dev/null +++ b/infra/argocd/templates/litellm.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: litellm + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/litellm + destination: + namespace: litellm + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml new file mode 100644 index 0000000..67fa471 --- /dev/null +++ b/infra/litellm/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: litellm +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: "litellm-helm" + version: 0.1.636 + repository: oci://ghcr.io/berriai/litellm diff --git a/infra/litellm/values.yaml b/infra/litellm/values.yaml new file mode 100644 index 0000000..b7ce066 --- /dev/null +++ b/infra/litellm/values.yaml @@ -0,0 +1,197 @@ +litellm: + # Default values for litellm. + # This is a YAML-formatted file. + # Declare variables to be passed into your templates. + + replicaCount: 1 + + image: + # Use "ghcr.io/berriai/litellm-database" for optimized image with database + repository: ghcr.io/berriai/litellm-database + pullPolicy: Always + # Overrides the image tag whose default is the chart appVersion. + # tag: "main-latest" + tag: "" + + imagePullSecrets: [] + nameOverride: "litellm" + fullnameOverride: "" + + serviceAccount: + # Specifies whether a service account should be created + create: false + # Automatically mount a ServiceAccount's API credentials? + automount: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" + + podAnnotations: {} + podLabels: {} + + # At the time of writing, the litellm docker image requires write access to the + # filesystem on startup so that prisma can install some dependencies. + podSecurityContext: {} + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: false + # runAsNonRoot: true + # runAsUser: 1000 + + # A list of Kubernetes Secret objects that will be exported to the LiteLLM proxy + # pod as environment variables. These secrets can then be referenced in the + # configuration file (or "litellm" ConfigMap) with `os.environ/` + environmentSecrets: [] + # - litellm-env-secret + + # A list of Kubernetes ConfigMap objects that will be exported to the LiteLLM proxy + # pod as environment variables. The ConfigMap kv-pairs can then be referenced in the + # configuration file (or "litellm" ConfigMap) with `os.environ/` + environmentConfigMaps: [] + # - litellm-env-configmap + + service: + type: ClusterIP + port: 4000 + + ingress: + enabled: false + className: "nginx" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: api.example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + + # masterkey: changeit + + # The elements within proxy_config are rendered as config.yaml for the proxy + # Examples: https://github.com/BerriAI/litellm/tree/main/litellm/proxy/example_config_yaml + # Reference: https://docs.litellm.ai/docs/proxy/configs + proxy_config: + model_list: + # At least one model must exist for the proxy to start. + - model_name: gpt-3.5-turbo + litellm_params: + model: gpt-3.5-turbo + api_key: eXaMpLeOnLy + - model_name: fake-openai-endpoint + litellm_params: + model: openai/fake + api_key: fake-key + api_base: https://exampleopenaiendpoint-production.up.railway.app/ + general_settings: + master_key: os.environ/PROXY_MASTER_KEY + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + + # Additional volumes on the output Deployment definition. + volumes: [] + # - name: foo + # secret: + # secretName: mysecret + # optional: false + + # Additional volumeMounts on the output Deployment definition. + volumeMounts: [] + # - name: foo + # mountPath: "/etc/foo" + # readOnly: true + + nodeSelector: {} + + tolerations: [] + + affinity: {} + + db: + # Use an existing postgres server/cluster + useExisting: false + + # How to connect to the existing postgres server/cluster + endpoint: localhost + database: litellm + url: postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_HOST)/$(DATABASE_NAME) + secret: + name: postgres + usernameKey: username + passwordKey: password + + # Use the Stackgres Helm chart to deploy an instance of a Stackgres cluster. + # The Stackgres Operator must already be installed within the target + # Kubernetes cluster. + # TODO: Stackgres deployment currently unsupported + useStackgresOperator: false + + # Use the Postgres Helm chart to create a single node, stand alone postgres + # instance. See the "postgresql" top level key for additional configuration. + deployStandalone: true + + # Settings for Bitnami postgresql chart (if db.deployStandalone is true, ignored + # otherwise) + postgresql: + architecture: standalone + auth: + username: litellm + database: litellm + + # You should override these on the helm command line with + # `--set postgresql.auth.postgres-password=,postgresql.auth.password=` + password: NoTaGrEaTpAsSwOrD + postgres-password: NoTaGrEaTpAsSwOrD + + # A secret is created by this chart (litellm-helm) with the credentials that + # the new Postgres instance should use. + # existingSecret: "" + # secretKeys: + # userPasswordKey: password + + # requires cache: true in config file + # either enable this or pass a secret for REDIS_HOST, REDIS_PORT, REDIS_PASSWORD or REDIS_URL + # with cache: true to use existing redis instance + redis: + enabled: false + architecture: standalone + + # Prisma migration job settings + migrationJob: + enabled: true # Enable or disable the schema migration Job + retries: 3 # Number of retries for the Job in case of failure + backoffLimit: 4 # Backoff limit for Job restarts + disableSchemaUpdate: false # Skip schema migrations for specific environments. When True, the job will exit with code 0. + annotations: {} + ttlSecondsAfterFinished: 120 + + # Additional environment variables to be added to the deployment + envVars: { + # USE_DDTRACE: "true" + } + From 59c2db2c0f6aa8111c5eb9cf656a65fb3be73aac Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Mar 2025 05:09:53 -0500 Subject: [PATCH 0512/1058] update --- infra/litellm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index 67fa471..baf487c 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: "litellm-helm" version: 0.1.636 - repository: oci://ghcr.io/berriai/litellm + repository: oci://ghcr.io/berriai/litellm-helm From 0fede19fdf209a784716703882798d3d50e1ee6a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Mar 2025 05:10:24 -0500 Subject: [PATCH 0513/1058] update --- infra/litellm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index baf487c..14170b9 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: "litellm-helm" version: 0.1.636 - repository: oci://ghcr.io/berriai/litellm-helm + repository: oci://ghcr.io/berriai From ace5603daa0447382b085076723c005e06b4c540 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Mar 2025 05:23:13 -0500 Subject: [PATCH 0514/1058] update --- infra/litellm/Chart.yaml | 20 +- infra/litellm/templates/NOTES.txt | 22 ++ infra/litellm/templates/_helpers.tpl | 84 +++++ .../litellm/templates/configmap-litellm.yaml | 7 + infra/litellm/templates/deployment.yaml | 182 ++++++++++ infra/litellm/templates/hpa.yaml | 32 ++ infra/litellm/templates/ingress.yaml | 61 ++++ infra/litellm/templates/migrations-job.yaml | 70 ++++ .../templates/secret-dbcredentials.yaml | 12 + infra/litellm/templates/secret-masterkey.yaml | 8 + infra/litellm/templates/service.yaml | 15 + infra/litellm/templates/serviceaccount.yaml | 13 + .../templates/tests/test-connection.yaml | 25 ++ .../templates/tests/test-env-vars.yaml | 43 +++ infra/litellm/values.yaml | 337 +++++++++--------- 15 files changed, 754 insertions(+), 177 deletions(-) create mode 100644 infra/litellm/templates/NOTES.txt create mode 100644 infra/litellm/templates/_helpers.tpl create mode 100644 infra/litellm/templates/configmap-litellm.yaml create mode 100644 infra/litellm/templates/deployment.yaml create mode 100644 infra/litellm/templates/hpa.yaml create mode 100644 infra/litellm/templates/ingress.yaml create mode 100644 infra/litellm/templates/migrations-job.yaml create mode 100644 infra/litellm/templates/secret-dbcredentials.yaml create mode 100644 infra/litellm/templates/secret-masterkey.yaml create mode 100644 infra/litellm/templates/service.yaml create mode 100644 infra/litellm/templates/serviceaccount.yaml create mode 100644 infra/litellm/templates/tests/test-connection.yaml create mode 100644 infra/litellm/templates/tests/test-env-vars.yaml diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index 14170b9..5edfc47 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -1,12 +1,16 @@ apiVersion: v2 -name: litellm -description: A Helm chart for Kubernetes +name: litellm-helm +description: Call all LLM APIs using the OpenAI format type: application - -version: 0.1.0 -appVersion: "1.16.0" +version: 0.4.1 +appVersion: v1.50.2 dependencies: - - name: "litellm-helm" - version: 0.1.636 - repository: oci://ghcr.io/berriai + - name: "postgresql" + version: ">=13.3.0" + repository: oci://registry-1.docker.io/bitnamicharts + condition: db.deployStandalone + - name: redis + version: ">=18.0.0" + repository: oci://registry-1.docker.io/bitnamicharts + condition: redis.enabled diff --git a/infra/litellm/templates/NOTES.txt b/infra/litellm/templates/NOTES.txt new file mode 100644 index 0000000..e72c991 --- /dev/null +++ b/infra/litellm/templates/NOTES.txt @@ -0,0 +1,22 @@ +1. Get the application URL by running these commands: +{{- if .Values.ingress.enabled }} +{{- range $host := .Values.ingress.hosts }} + {{- range .paths }} + http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} + {{- end }} +{{- end }} +{{- else if contains "NodePort" .Values.service.type }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "litellm.fullname" . }}) + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + echo http://$NODE_IP:$NODE_PORT +{{- else if contains "LoadBalancer" .Values.service.type }} + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "litellm.fullname" . }}' + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "litellm.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + echo http://$SERVICE_IP:{{ .Values.service.port }} +{{- else if contains "ClusterIP" .Values.service.type }} + export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "litellm.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") + export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") + echo "Visit http://127.0.0.1:8080 to use your application" + kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT +{{- end }} diff --git a/infra/litellm/templates/_helpers.tpl b/infra/litellm/templates/_helpers.tpl new file mode 100644 index 0000000..a1eda28 --- /dev/null +++ b/infra/litellm/templates/_helpers.tpl @@ -0,0 +1,84 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "litellm.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "litellm.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "litellm.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "litellm.labels" -}} +helm.sh/chart: {{ include "litellm.chart" . }} +{{ include "litellm.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "litellm.selectorLabels" -}} +app.kubernetes.io/name: {{ include "litellm.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "litellm.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "litellm.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Get redis service name +*/}} +{{- define "litellm.redis.serviceName" -}} +{{- if and (eq .Values.redis.architecture "standalone") .Values.redis.sentinel.enabled -}} +{{- printf "%s-%s" .Release.Name (default "redis" .Values.redis.nameOverride | trunc 63 | trimSuffix "-") -}} +{{- else -}} +{{- printf "%s-%s-master" .Release.Name (default "redis" .Values.redis.nameOverride | trunc 63 | trimSuffix "-") -}} +{{- end -}} +{{- end -}} + +{{/* +Get redis service port +*/}} +{{- define "litellm.redis.port" -}} +{{- if .Values.redis.sentinel.enabled -}} +{{ .Values.redis.sentinel.service.ports.sentinel }} +{{- else -}} +{{ .Values.redis.master.service.ports.redis }} +{{- end -}} +{{- end -}} diff --git a/infra/litellm/templates/configmap-litellm.yaml b/infra/litellm/templates/configmap-litellm.yaml new file mode 100644 index 0000000..4598054 --- /dev/null +++ b/infra/litellm/templates/configmap-litellm.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "litellm.fullname" . }}-config +data: + config.yaml: | +{{ .Values.proxy_config | toYaml | indent 6 }} \ No newline at end of file diff --git a/infra/litellm/templates/deployment.yaml b/infra/litellm/templates/deployment.yaml new file mode 100644 index 0000000..697148a --- /dev/null +++ b/infra/litellm/templates/deployment.yaml @@ -0,0 +1,182 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "litellm.fullname" . }} + labels: + {{- include "litellm.labels" . | nindent 4 }} +spec: + {{- if not .Values.autoscaling.enabled }} + replicas: {{ .Values.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "litellm.selectorLabels" . | nindent 6 }} + template: + metadata: + annotations: + checksum/config: {{ include (print $.Template.BasePath "/configmap-litellm.yaml") . | sha256sum }} + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "litellm.labels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "litellm.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: {{ include "litellm.name" . }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "main-%s" .Chart.AppVersion) }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + env: + - name: HOST + value: "{{ .Values.listen | default "0.0.0.0" }}" + - name: PORT + value: {{ .Values.service.port | quote}} + {{- if .Values.db.deployStandalone }} + - name: DATABASE_USERNAME + valueFrom: + secretKeyRef: + name: {{ include "litellm.fullname" . }}-dbcredentials + key: username + - name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "litellm.fullname" . }}-dbcredentials + key: password + - name: DATABASE_HOST + value: {{ .Release.Name }}-postgresql + - name: DATABASE_NAME + value: litellm + {{- else if .Values.db.useExisting }} + - name: DATABASE_USERNAME + valueFrom: + secretKeyRef: + name: {{ .Values.db.secret.name }} + key: {{ .Values.db.secret.usernameKey }} + - name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.db.secret.name }} + key: {{ .Values.db.secret.passwordKey }} + - name: DATABASE_HOST + value: {{ .Values.db.endpoint }} + - name: DATABASE_NAME + value: {{ .Values.db.database }} + - name: DATABASE_URL + value: {{ .Values.db.url | quote }} + {{- end }} + - name: PROXY_MASTER_KEY + valueFrom: + secretKeyRef: + name: {{ include "litellm.fullname" . }}-masterkey + key: masterkey + {{- if .Values.redis.enabled }} + - name: REDIS_HOST + value: {{ include "litellm.redis.serviceName" . }} + - name: REDIS_PORT + value: {{ include "litellm.redis.port" . | quote }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "redis.secretName" .Subcharts.redis }} + key: {{include "redis.secretPasswordKey" .Subcharts.redis }} + {{- end }} + {{- if .Values.envVars }} + {{- range $key, $val := .Values.envVars }} + - name: {{ $key }} + value: {{ $val | quote }} + {{- end }} + {{- end }} + envFrom: + {{- range .Values.environmentSecrets }} + - secretRef: + name: {{ . }} + {{- end }} + {{- range .Values.environmentConfigMaps }} + - configMapRef: + name: {{ . }} + {{- end }} + args: + - --config + - /etc/litellm/config.yaml + ports: + - name: http + containerPort: {{ .Values.service.port }} + protocol: TCP + livenessProbe: + httpGet: + path: /health/liveliness + port: http + readinessProbe: + httpGet: + path: /health/readiness + port: http + # Give the container time to start up. Up to 5 minutes (10 * 30 seconds) + startupProbe: + httpGet: + path: /health/readiness + port: http + failureThreshold: 30 + periodSeconds: 10 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + - name: litellm-config + mountPath: /etc/litellm/ + {{ if .Values.securityContext.readOnlyRootFilesystem }} + - name: tmp + mountPath: /tmp + - name: cache + mountPath: /.cache + - name: npm + mountPath: /.npm + {{- end }} + {{- with .Values.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.extraContainers }} + {{- toYaml . | nindent 8 }} + {{- end }} + volumes: + {{ if .Values.securityContext.readOnlyRootFilesystem }} + - name: tmp + emptyDir: + sizeLimit: 500Mi + - name: cache + emptyDir: + sizeLimit: 500Mi + - name: npm + emptyDir: + sizeLimit: 500Mi + {{- end }} + - name: litellm-config + configMap: + name: {{ include "litellm.fullname" . }}-config + items: + - key: "config.yaml" + path: "config.yaml" + {{- with .Values.volumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/infra/litellm/templates/hpa.yaml b/infra/litellm/templates/hpa.yaml new file mode 100644 index 0000000..71e199c --- /dev/null +++ b/infra/litellm/templates/hpa.yaml @@ -0,0 +1,32 @@ +{{- if .Values.autoscaling.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "litellm.fullname" . }} + labels: + {{- include "litellm.labels" . | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "litellm.fullname" . }} + minReplicas: {{ .Values.autoscaling.minReplicas }} + maxReplicas: {{ .Values.autoscaling.maxReplicas }} + metrics: + {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/infra/litellm/templates/ingress.yaml b/infra/litellm/templates/ingress.yaml new file mode 100644 index 0000000..09e8d71 --- /dev/null +++ b/infra/litellm/templates/ingress.yaml @@ -0,0 +1,61 @@ +{{- if .Values.ingress.enabled -}} +{{- $fullName := include "litellm.fullname" . -}} +{{- $svcPort := .Values.service.port -}} +{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + labels: + {{- include "litellm.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.className }} + {{- end }} + {{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/infra/litellm/templates/migrations-job.yaml b/infra/litellm/templates/migrations-job.yaml new file mode 100644 index 0000000..e994c45 --- /dev/null +++ b/infra/litellm/templates/migrations-job.yaml @@ -0,0 +1,70 @@ +{{- if .Values.migrationJob.enabled }} +# This job runs the prisma migrations for the LiteLLM DB. +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "litellm.fullname" . }}-migrations + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation # delete old migration on a new deploy in case the migration needs to make updates + checksum/config: {{ toYaml .Values | sha256sum }} +spec: + template: + metadata: + annotations: + {{- with .Values.migrationJob.annotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + containers: + - name: prisma-migrations + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "main-%s" .Chart.AppVersion) }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + command: ["python", "litellm/proxy/prisma_migration.py"] + workingDir: "/app" + env: + {{- if .Values.db.useExisting }} + - name: DATABASE_USERNAME + valueFrom: + secretKeyRef: + name: {{ .Values.db.secret.name }} + key: {{ .Values.db.secret.usernameKey }} + - name: DATABASE_PASSWORD + valueFrom: + secretKeyRef: + name: {{ .Values.db.secret.name }} + key: {{ .Values.db.secret.passwordKey }} + - name: DATABASE_HOST + value: {{ .Values.db.endpoint }} + - name: DATABASE_NAME + value: {{ .Values.db.database }} + - name: DATABASE_URL + value: {{ .Values.db.url | quote }} + {{- else }} + - name: DATABASE_URL + value: postgresql://{{ .Values.postgresql.auth.username }}:{{ .Values.postgresql.auth.password }}@{{ .Release.Name }}-postgresql/{{ .Values.postgresql.auth.database }} + {{- end }} + - name: DISABLE_SCHEMA_UPDATE + value: "false" # always run the migration from the Helm PreSync hook, override the value set + {{- with .Values.volumeMounts }} + volumeMounts: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.volumes }} + volumes: + {{- toYaml . | nindent 8 }} + {{- end }} + restartPolicy: OnFailure + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + ttlSecondsAfterFinished: {{ .Values.migrationJob.ttlSecondsAfterFinished }} + backoffLimit: {{ .Values.migrationJob.backoffLimit }} +{{- end }} diff --git a/infra/litellm/templates/secret-dbcredentials.yaml b/infra/litellm/templates/secret-dbcredentials.yaml new file mode 100644 index 0000000..8851f58 --- /dev/null +++ b/infra/litellm/templates/secret-dbcredentials.yaml @@ -0,0 +1,12 @@ +{{- if .Values.db.deployStandalone -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "litellm.fullname" . }}-dbcredentials +data: + # Password for the "postgres" user + postgres-password: {{ ( index .Values.postgresql.auth "postgres-password") | default "litellm" | b64enc }} + username: {{ .Values.postgresql.auth.username | default "litellm" | b64enc }} + password: {{ .Values.postgresql.auth.password | default "litellm" | b64enc }} +type: Opaque +{{- end -}} \ No newline at end of file diff --git a/infra/litellm/templates/secret-masterkey.yaml b/infra/litellm/templates/secret-masterkey.yaml new file mode 100644 index 0000000..57b854c --- /dev/null +++ b/infra/litellm/templates/secret-masterkey.yaml @@ -0,0 +1,8 @@ +{{ $masterkey := (.Values.masterkey | default (randAlphaNum 17)) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "litellm.fullname" . }}-masterkey +data: + masterkey: {{ $masterkey | b64enc }} +type: Opaque \ No newline at end of file diff --git a/infra/litellm/templates/service.yaml b/infra/litellm/templates/service.yaml new file mode 100644 index 0000000..40e7f27 --- /dev/null +++ b/infra/litellm/templates/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "litellm.fullname" . }} + labels: + {{- include "litellm.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "litellm.selectorLabels" . | nindent 4 }} diff --git a/infra/litellm/templates/serviceaccount.yaml b/infra/litellm/templates/serviceaccount.yaml new file mode 100644 index 0000000..7655470 --- /dev/null +++ b/infra/litellm/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "litellm.serviceAccountName" . }} + labels: + {{- include "litellm.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} +{{- end }} diff --git a/infra/litellm/templates/tests/test-connection.yaml b/infra/litellm/templates/tests/test-connection.yaml new file mode 100644 index 0000000..86a8f66 --- /dev/null +++ b/infra/litellm/templates/tests/test-connection.yaml @@ -0,0 +1,25 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "litellm.fullname" . }}-test-connection" + labels: + {{- include "litellm.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['sh', '-c'] + args: + - | + # Wait for a bit to allow the service to be ready + sleep 10 + # Try multiple times with a delay between attempts + for i in $(seq 1 30); do + wget -T 5 "{{ include "litellm.fullname" . }}:{{ .Values.service.port }}/health/readiness" && exit 0 + echo "Attempt $i failed, waiting..." + sleep 2 + done + exit 1 + restartPolicy: Never \ No newline at end of file diff --git a/infra/litellm/templates/tests/test-env-vars.yaml b/infra/litellm/templates/tests/test-env-vars.yaml new file mode 100644 index 0000000..9f02775 --- /dev/null +++ b/infra/litellm/templates/tests/test-env-vars.yaml @@ -0,0 +1,43 @@ +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "litellm.fullname" . }}-env-test" + labels: + {{- include "litellm.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: + containers: + - name: test + image: busybox + command: ['sh', '-c'] + args: + - | + # Test DD_ENV + if [ "$DD_ENV" != "dev_helm" ]; then + echo "❌ Environment variable DD_ENV mismatch. Expected: dev_helm, Got: $DD_ENV" + exit 1 + fi + echo "✅ Environment variable DD_ENV matches expected value: $DD_ENV" + + # Test DD_SERVICE + if [ "$DD_SERVICE" != "litellm" ]; then + echo "❌ Environment variable DD_SERVICE mismatch. Expected: litellm, Got: $DD_SERVICE" + exit 1 + fi + echo "✅ Environment variable DD_SERVICE matches expected value: $DD_SERVICE" + + # Test USE_DDTRACE + if [ "$USE_DDTRACE" != "true" ]; then + echo "❌ Environment variable USE_DDTRACE mismatch. Expected: true, Got: $USE_DDTRACE" + exit 1 + fi + echo "✅ Environment variable USE_DDTRACE matches expected value: $USE_DDTRACE" + env: + - name: DD_ENV + value: {{ .Values.envVars.DD_ENV | quote }} + - name: DD_SERVICE + value: {{ .Values.envVars.DD_SERVICE | quote }} + - name: USE_DDTRACE + value: {{ .Values.envVars.USE_DDTRACE | quote }} + restartPolicy: Never \ No newline at end of file diff --git a/infra/litellm/values.yaml b/infra/litellm/values.yaml index b7ce066..2ea3221 100644 --- a/infra/litellm/values.yaml +++ b/infra/litellm/values.yaml @@ -1,197 +1,196 @@ -litellm: - # Default values for litellm. - # This is a YAML-formatted file. - # Declare variables to be passed into your templates. +# Default values for litellm. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. - replicaCount: 1 +replicaCount: 1 - image: - # Use "ghcr.io/berriai/litellm-database" for optimized image with database - repository: ghcr.io/berriai/litellm-database - pullPolicy: Always - # Overrides the image tag whose default is the chart appVersion. - # tag: "main-latest" - tag: "" +image: + # Use "ghcr.io/berriai/litellm-database" for optimized image with database + repository: ghcr.io/berriai/litellm-database + pullPolicy: Always + # Overrides the image tag whose default is the chart appVersion. + # tag: "main-latest" + tag: "" - imagePullSecrets: [] - nameOverride: "litellm" - fullnameOverride: "" +imagePullSecrets: [] +nameOverride: "litellm" +fullnameOverride: "" - serviceAccount: - # Specifies whether a service account should be created - create: false - # Automatically mount a ServiceAccount's API credentials? - automount: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" +serviceAccount: + # Specifies whether a service account should be created + create: false + # Automatically mount a ServiceAccount's API credentials? + automount: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" - podAnnotations: {} - podLabels: {} +podAnnotations: {} +podLabels: {} - # At the time of writing, the litellm docker image requires write access to the - # filesystem on startup so that prisma can install some dependencies. - podSecurityContext: {} - securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: false - # runAsNonRoot: true - # runAsUser: 1000 +# At the time of writing, the litellm docker image requires write access to the +# filesystem on startup so that prisma can install some dependencies. +podSecurityContext: {} +securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: false + # runAsNonRoot: true + # runAsUser: 1000 - # A list of Kubernetes Secret objects that will be exported to the LiteLLM proxy - # pod as environment variables. These secrets can then be referenced in the - # configuration file (or "litellm" ConfigMap) with `os.environ/` - environmentSecrets: [] - # - litellm-env-secret +# A list of Kubernetes Secret objects that will be exported to the LiteLLM proxy +# pod as environment variables. These secrets can then be referenced in the +# configuration file (or "litellm" ConfigMap) with `os.environ/` +environmentSecrets: [] + # - litellm-env-secret - # A list of Kubernetes ConfigMap objects that will be exported to the LiteLLM proxy - # pod as environment variables. The ConfigMap kv-pairs can then be referenced in the - # configuration file (or "litellm" ConfigMap) with `os.environ/` - environmentConfigMaps: [] - # - litellm-env-configmap +# A list of Kubernetes ConfigMap objects that will be exported to the LiteLLM proxy +# pod as environment variables. The ConfigMap kv-pairs can then be referenced in the +# configuration file (or "litellm" ConfigMap) with `os.environ/` +environmentConfigMaps: [] + # - litellm-env-configmap - service: - type: ClusterIP - port: 4000 +service: + type: ClusterIP + port: 4000 - ingress: - enabled: false - className: "nginx" - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - hosts: - - host: api.example.local - paths: - - path: / - pathType: ImplementationSpecific - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local +ingress: + enabled: false + className: "nginx" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: api.example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local - # masterkey: changeit +# masterkey: changeit - # The elements within proxy_config are rendered as config.yaml for the proxy - # Examples: https://github.com/BerriAI/litellm/tree/main/litellm/proxy/example_config_yaml - # Reference: https://docs.litellm.ai/docs/proxy/configs - proxy_config: - model_list: - # At least one model must exist for the proxy to start. - - model_name: gpt-3.5-turbo - litellm_params: - model: gpt-3.5-turbo - api_key: eXaMpLeOnLy - - model_name: fake-openai-endpoint - litellm_params: - model: openai/fake - api_key: fake-key - api_base: https://exampleopenaiendpoint-production.up.railway.app/ - general_settings: - master_key: os.environ/PROXY_MASTER_KEY +# The elements within proxy_config are rendered as config.yaml for the proxy +# Examples: https://github.com/BerriAI/litellm/tree/main/litellm/proxy/example_config_yaml +# Reference: https://docs.litellm.ai/docs/proxy/configs +proxy_config: + model_list: + # At least one model must exist for the proxy to start. + - model_name: gpt-3.5-turbo + litellm_params: + model: gpt-3.5-turbo + api_key: eXaMpLeOnLy + - model_name: fake-openai-endpoint + litellm_params: + model: openai/fake + api_key: fake-key + api_base: https://exampleopenaiendpoint-production.up.railway.app/ + general_settings: + master_key: os.environ/PROXY_MASTER_KEY - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi - autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 100 - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 - # Additional volumes on the output Deployment definition. - volumes: [] - # - name: foo - # secret: - # secretName: mysecret - # optional: false +# Additional volumes on the output Deployment definition. +volumes: [] +# - name: foo +# secret: +# secretName: mysecret +# optional: false - # Additional volumeMounts on the output Deployment definition. - volumeMounts: [] - # - name: foo - # mountPath: "/etc/foo" - # readOnly: true +# Additional volumeMounts on the output Deployment definition. +volumeMounts: [] +# - name: foo +# mountPath: "/etc/foo" +# readOnly: true - nodeSelector: {} +nodeSelector: {} - tolerations: [] +tolerations: [] - affinity: {} +affinity: {} - db: - # Use an existing postgres server/cluster - useExisting: false +db: + # Use an existing postgres server/cluster + useExisting: false - # How to connect to the existing postgres server/cluster - endpoint: localhost + # How to connect to the existing postgres server/cluster + endpoint: localhost + database: litellm + url: postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_HOST)/$(DATABASE_NAME) + secret: + name: postgres + usernameKey: username + passwordKey: password + + # Use the Stackgres Helm chart to deploy an instance of a Stackgres cluster. + # The Stackgres Operator must already be installed within the target + # Kubernetes cluster. + # TODO: Stackgres deployment currently unsupported + useStackgresOperator: false + + # Use the Postgres Helm chart to create a single node, stand alone postgres + # instance. See the "postgresql" top level key for additional configuration. + deployStandalone: true + +# Settings for Bitnami postgresql chart (if db.deployStandalone is true, ignored +# otherwise) +postgresql: + architecture: standalone + auth: + username: litellm database: litellm - url: postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_HOST)/$(DATABASE_NAME) - secret: - name: postgres - usernameKey: username - passwordKey: password - # Use the Stackgres Helm chart to deploy an instance of a Stackgres cluster. - # The Stackgres Operator must already be installed within the target - # Kubernetes cluster. - # TODO: Stackgres deployment currently unsupported - useStackgresOperator: false + # You should override these on the helm command line with + # `--set postgresql.auth.postgres-password=,postgresql.auth.password=` + password: NoTaGrEaTpAsSwOrD + postgres-password: NoTaGrEaTpAsSwOrD - # Use the Postgres Helm chart to create a single node, stand alone postgres - # instance. See the "postgresql" top level key for additional configuration. - deployStandalone: true + # A secret is created by this chart (litellm-helm) with the credentials that + # the new Postgres instance should use. + # existingSecret: "" + # secretKeys: + # userPasswordKey: password - # Settings for Bitnami postgresql chart (if db.deployStandalone is true, ignored - # otherwise) - postgresql: - architecture: standalone - auth: - username: litellm - database: litellm +# requires cache: true in config file +# either enable this or pass a secret for REDIS_HOST, REDIS_PORT, REDIS_PASSWORD or REDIS_URL +# with cache: true to use existing redis instance +redis: + enabled: false + architecture: standalone - # You should override these on the helm command line with - # `--set postgresql.auth.postgres-password=,postgresql.auth.password=` - password: NoTaGrEaTpAsSwOrD - postgres-password: NoTaGrEaTpAsSwOrD +# Prisma migration job settings +migrationJob: + enabled: true # Enable or disable the schema migration Job + retries: 3 # Number of retries for the Job in case of failure + backoffLimit: 4 # Backoff limit for Job restarts + disableSchemaUpdate: false # Skip schema migrations for specific environments. When True, the job will exit with code 0. + annotations: {} + ttlSecondsAfterFinished: 120 - # A secret is created by this chart (litellm-helm) with the credentials that - # the new Postgres instance should use. - # existingSecret: "" - # secretKeys: - # userPasswordKey: password - - # requires cache: true in config file - # either enable this or pass a secret for REDIS_HOST, REDIS_PORT, REDIS_PASSWORD or REDIS_URL - # with cache: true to use existing redis instance - redis: - enabled: false - architecture: standalone - - # Prisma migration job settings - migrationJob: - enabled: true # Enable or disable the schema migration Job - retries: 3 # Number of retries for the Job in case of failure - backoffLimit: 4 # Backoff limit for Job restarts - disableSchemaUpdate: false # Skip schema migrations for specific environments. When True, the job will exit with code 0. - annotations: {} - ttlSecondsAfterFinished: 120 - - # Additional environment variables to be added to the deployment - envVars: { - # USE_DDTRACE: "true" - } +# Additional environment variables to be added to the deployment +envVars: { + # USE_DDTRACE: "true" +} From a833b3f92169dc234142e8533215e177e75716c5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 14 Mar 2025 05:25:41 -0500 Subject: [PATCH 0515/1058] update --- infra/litellm/Chart.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index 5edfc47..3d11143 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -8,9 +8,9 @@ appVersion: v1.50.2 dependencies: - name: "postgresql" version: ">=13.3.0" - repository: oci://registry-1.docker.io/bitnamicharts + repository: https://charts.bitnami.com/bitnami condition: db.deployStandalone - name: redis version: ">=18.0.0" - repository: oci://registry-1.docker.io/bitnamicharts + repository: oci://registry-1.docker.io/bitnamicharts condition: redis.enabled From 12f0ca23882286475118d6c949598c1bcac84fa8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 13:24:13 -0500 Subject: [PATCH 0516/1058] update --- dmz/internalproxy/templates/authentik.yaml | 0 dmz/internalproxy/templates/gitea.yaml | 72 ++++++++ dmz/internalproxy/templates/kasm.yaml | 72 ++++++++ dmz/internalproxy/templates/nexus.yaml | 71 +++++++ dmz/internalproxy/templates/ollama.yaml | 203 +++++++++++---------- dmz/internalproxy/templates/plex.yaml | 72 ++++++++ dmz/internalproxy/templates/redlib.yaml | 68 +++++++ dmz/internalproxy/templates/registry.yaml | 71 +++++++ dmz/internalproxy/templates/smokeping.yaml | 82 +++++++++ dmz/internalproxy/templates/speedtest.yaml | 74 ++++++++ 10 files changed, 684 insertions(+), 101 deletions(-) delete mode 100644 dmz/internalproxy/templates/authentik.yaml create mode 100644 dmz/internalproxy/templates/gitea.yaml create mode 100644 dmz/internalproxy/templates/kasm.yaml create mode 100644 dmz/internalproxy/templates/nexus.yaml create mode 100644 dmz/internalproxy/templates/plex.yaml create mode 100644 dmz/internalproxy/templates/redlib.yaml create mode 100644 dmz/internalproxy/templates/registry.yaml create mode 100644 dmz/internalproxy/templates/smokeping.yaml create mode 100644 dmz/internalproxy/templates/speedtest.yaml diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/gitea.yaml new file mode 100644 index 0000000..0bde4e4 --- /dev/null +++ b/dmz/internalproxy/templates/gitea.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitea +spec: + ports: + - name: app + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: gitea +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 3000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: gitea-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gitea.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: gitea + port: 3000 + scheme: http + tls: + secretName: gitea-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitea-tls +spec: + secretName: gitea-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gitea.durp.info" + dnsNames: + - "gitea.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: gitea-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: gitea.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/kasm.yaml b/dmz/internalproxy/templates/kasm.yaml new file mode 100644 index 0000000..7f756e0 --- /dev/null +++ b/dmz/internalproxy/templates/kasm.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: kasm +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: kasm +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: kasm-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kasm.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: kasm + port: 443 + scheme: https + tls: + secretName: kasm-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kasm-tls +spec: + secretName: kasm-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kasm.durp.info" + dnsNames: + - "kasm.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: kasm-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kasm.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/nexus.yaml b/dmz/internalproxy/templates/nexus.yaml new file mode 100644 index 0000000..5d3632e --- /dev/null +++ b/dmz/internalproxy/templates/nexus.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: Service +metadata: + name: nexus +spec: + ports: + - name: app + port: 8081 + protocol: TCP + targetPort: 8081 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: nexus +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8081 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: nexus-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`nexus.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: nexus + port: 8081 + tls: + secretName: nexus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: nexus-tls +spec: + secretName: nexus-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "nexus.durp.info" + dnsNames: + - "nexus.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: nexus-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: nexus.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index d5dc745..75e8691 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -1,101 +1,102 @@ -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: ollama-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: ollama-secret -# data: -# - secretKey: users -# remoteRef: -# key: secrets/internalproxy/ollama -# property: users -# -#--- -# -#apiVersion: traefik.containo.us/v1alpha1 -#kind: Middleware -#metadata: -# name: ollama-basic-auth -#spec: -# basicAuth: -# secret: ollama-secret -# -#--- -# -#apiVersion: v1 -#kind: Service -#metadata: -# name: ollama -#spec: -# ports: -# - name: app -# port: 11435 -# protocol: TCP -# targetPort: 11435 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: ollama -#subsets: -# - addresses: -# - ip: 192.168.20.104 -# ports: -# - name: app -# port: 11435 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.containo.us/v1alpha1 -#kind: IngressRoute -#metadata: -# name: ollama-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`ollama.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: ollama-basic-auth -# kind: Rule -# services: -# - name: ollama -# port: 11435 -# tls: -# secretName: ollama-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: ollama-tls -#spec: -# secretName: ollama-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "ollama.durp.info" -# dnsNames: -# - "ollama.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: ollama-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ollama-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: ollama-secret + data: + - secretKey: users + remoteRef: + key: secrets/internalproxy/ollama + property: users + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: ollama-basic-auth +spec: + basicAuth: + headerField: x-api-key + secret: ollama-secret + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: ollama-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`ollama.durp.info`) && PathPrefix(`/`) + middlewares: + - name: ollama-basic-auth + kind: Rule + services: + - name: ollama + port: 11435 + tls: + secretName: ollama-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls +spec: + secretName: ollama-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "ollama.durp.info" + dnsNames: + - "ollama.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: ollama-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/plex.yaml b/dmz/internalproxy/templates/plex.yaml new file mode 100644 index 0000000..45bba44 --- /dev/null +++ b/dmz/internalproxy/templates/plex.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: plex +spec: + ports: + - name: app + port: 32400 + protocol: TCP + targetPort: 32400 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: plex +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 32400 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: plex-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`plex.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: plex + port: 32400 + scheme: https + tls: + secretName: plex-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: plex-tls +spec: + secretName: plex-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "plex.durp.info" + dnsNames: + - "plex.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: plex-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: plex.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml new file mode 100644 index 0000000..b71e4c3 --- /dev/null +++ b/dmz/internalproxy/templates/redlib.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: Service +metadata: + name: redlib +spec: + ports: + - name: app + port: 8082 + protocol: TCP + targetPort: 8082 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: redlib +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8082 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: redlib-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`redlib.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: redlib + port: 8082 + - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: redlib-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: redlib-tls +spec: + secretName: redlib-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "redlib.durp.info" + dnsNames: + - "redlib.durp.info" diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml new file mode 100644 index 0000000..1906614 --- /dev/null +++ b/dmz/internalproxy/templates/registry.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: Service +metadata: + name: registry +spec: + ports: + - name: app + port: 5000 + protocol: TCP + targetPort: 5000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: registry +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 5000 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: registry-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`registry.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: registry + port: 5000 + tls: + secretName: registry-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: registry-tls +spec: + secretName: registry-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "registry.durp.info" + dnsNames: + - "registry.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: registry-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: registry.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/smokeping.yaml b/dmz/internalproxy/templates/smokeping.yaml new file mode 100644 index 0000000..9840993 --- /dev/null +++ b/dmz/internalproxy/templates/smokeping.yaml @@ -0,0 +1,82 @@ +apiVersion: v1 +kind: Service +metadata: + name: smokeping +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: smokeping +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 81 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: smokeping-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: smokeping + port: 81 + - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: smokeping-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: smokeping-tls +spec: + secretName: smokeping-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "smokeping.durp.info" + dnsNames: + - "smokeping.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: smokeping-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/speedtest.yaml b/dmz/internalproxy/templates/speedtest.yaml new file mode 100644 index 0000000..275b708 --- /dev/null +++ b/dmz/internalproxy/templates/speedtest.yaml @@ -0,0 +1,74 @@ +apiVersion: v1 +kind: Service +metadata: + name: speedtest +spec: + ports: + - name: app + port: 6580 + protocol: TCP + targetPort: 6580 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: speedtest +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 6580 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: speedtest-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: speedtest + port: 6580 + tls: + secretName: speedtest-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: speedtest-tls +spec: + secretName: speedtest-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "speedtest.durp.info" + dnsNames: + - "speedtest.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: speedtest-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info +spec: + type: ExternalName + externalName: durp.info From 1c63f8028a1afd0519ce497acf55e1100b866564 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 13:27:48 -0500 Subject: [PATCH 0517/1058] update --- dmz/internalproxy/templates/gitea.yaml | 2 +- dmz/internalproxy/templates/kasm.yaml | 2 +- dmz/internalproxy/templates/nexus.yaml | 2 +- dmz/internalproxy/templates/ollama.yaml | 4 ++-- dmz/internalproxy/templates/plex.yaml | 2 +- dmz/internalproxy/templates/redlib.yaml | 2 +- dmz/internalproxy/templates/registry.yaml | 2 +- dmz/internalproxy/templates/smokeping.yaml | 2 +- dmz/internalproxy/templates/speedtest.yaml | 2 +- 9 files changed, 10 insertions(+), 10 deletions(-) diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/gitea.yaml index 0bde4e4..bbd976c 100644 --- a/dmz/internalproxy/templates/gitea.yaml +++ b/dmz/internalproxy/templates/gitea.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: gitea-ingress diff --git a/dmz/internalproxy/templates/kasm.yaml b/dmz/internalproxy/templates/kasm.yaml index 7f756e0..3e53772 100644 --- a/dmz/internalproxy/templates/kasm.yaml +++ b/dmz/internalproxy/templates/kasm.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: kasm-ingress diff --git a/dmz/internalproxy/templates/nexus.yaml b/dmz/internalproxy/templates/nexus.yaml index 5d3632e..683fe8d 100644 --- a/dmz/internalproxy/templates/nexus.yaml +++ b/dmz/internalproxy/templates/nexus.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: nexus-ingress diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 75e8691..a39dd33 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -16,7 +16,7 @@ spec: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: ollama-basic-auth @@ -56,7 +56,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: ollama-ingress diff --git a/dmz/internalproxy/templates/plex.yaml b/dmz/internalproxy/templates/plex.yaml index 45bba44..6f38d38 100644 --- a/dmz/internalproxy/templates/plex.yaml +++ b/dmz/internalproxy/templates/plex.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: plex-ingress diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index b71e4c3..5a7cff8 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: redlib-ingress diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml index 1906614..a33997d 100644 --- a/dmz/internalproxy/templates/registry.yaml +++ b/dmz/internalproxy/templates/registry.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: registry-ingress diff --git a/dmz/internalproxy/templates/smokeping.yaml b/dmz/internalproxy/templates/smokeping.yaml index 9840993..0d5c0c0 100644 --- a/dmz/internalproxy/templates/smokeping.yaml +++ b/dmz/internalproxy/templates/smokeping.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: smokeping-ingress diff --git a/dmz/internalproxy/templates/speedtest.yaml b/dmz/internalproxy/templates/speedtest.yaml index 275b708..ccc88ed 100644 --- a/dmz/internalproxy/templates/speedtest.yaml +++ b/dmz/internalproxy/templates/speedtest.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: speedtest-ingress From 2df7ebbf4c0b177b84ace55e13cd1eead11b6f08 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 13:33:00 -0500 Subject: [PATCH 0518/1058] update --- dmz/internalproxy/templates/authentik.yaml | 31 ++++++++ dmz/internalproxy/templates/endpoints.yaml | 45 +++++++++++ dmz/traefik/templates/traefik-dashboard.yaml | 79 -------------------- 3 files changed, 76 insertions(+), 79 deletions(-) create mode 100644 dmz/internalproxy/templates/authentik.yaml create mode 100644 dmz/internalproxy/templates/endpoints.yaml diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml new file mode 100644 index 0000000..1835ded --- /dev/null +++ b/dmz/internalproxy/templates/authentik.yaml @@ -0,0 +1,31 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: authentik-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml new file mode 100644 index 0000000..c5d00c4 --- /dev/null +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -0,0 +1,45 @@ +apiVersion: v1 +kind: Endpoints +metadata: + name: master-cluster +subsets: + - addresses: + - ip: 192.168.20.130 + ports: + - port: 443 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: master-cluster +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: infra-cluster +subsets: + - addresses: + - ip: 192.168.12.130 + ports: + - port: 443 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: infra-cluster +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 6b62845..8fee673 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -32,82 +32,3 @@ spec: --- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: authentik-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: master-cluster -subsets: - - addresses: - - ip: 192.168.20.130 - ports: - - port: 443 - ---- - -apiVersion: v1 -kind: Service -metadata: - name: master-cluster -spec: - ports: - - protocol: TCP - port: 443 - targetPort: 443 - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: infra-cluster -subsets: - - addresses: - - ip: 192.168.12.130 - ports: - - port: 443 - ---- - -apiVersion: v1 -kind: Service -metadata: - name: infra-cluster -spec: - ports: - - protocol: TCP - port: 443 - targetPort: 443 From f68327747a5f8c61a631ec7b2b98f469a406c958 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 13:35:16 -0500 Subject: [PATCH 0519/1058] update --- dmz/internalproxy/templates/authentik.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 1835ded..2d74aae 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -29,3 +29,14 @@ spec: dnsNames: - "authentik.durp.info" +--- + +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info From ce6b64840ede1854b6d728a17c14b8b5963819bc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 21:15:28 -0500 Subject: [PATCH 0520/1058] update --- dmz/traefik/templates/config.yaml | 32 +++++++++++++++---------------- dmz/traefik/values.yaml | 14 +++++++------- 2 files changed, 23 insertions(+), 23 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 96ea5d3..06a9d11 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -1,16 +1,16 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: traefik-configmap -data: - config.yml: | - http: - routers: - router0: - service: service0 - rule: Host(`testing.durp.info`) - services: - service0: - loadBalancer: - servers: - - url: https://192.168.20.130 +#apiVersion: v1 +#kind: ConfigMap +#metadata: +# name: traefik-configmap +#data: +# config.yml: | +# http: +# routers: +# router0: +# service: service0 +# rule: Host(`testing.durp.info`) +# services: +# service0: +# loadBalancer: +# servers: +# - url: https://192.168.20.130 diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 4718e63..2ec0a46 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -1,7 +1,7 @@ traefik: image: - registry: registry.durp.info - repository: traefik + #registry: registry.durp.info + #repository: traefik pullPolicy: Always providers: @@ -14,17 +14,17 @@ traefik: replicas: 3 revisionHistoryLimit: 1 - volumes: - - name: traefik-configmap - mountPath: "/config" - type: configMap +# volumes: +# - name: traefik-configmap +# mountPath: "/config" +# type: configMap ingressRoute: dashboard: enabled: true additionalArguments: - - "--providers.file.filename=/config/config.yml" + # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin From 3590ea3840a83929b5dce6887a2eb329737960ec Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 21:22:07 -0500 Subject: [PATCH 0521/1058] update --- dmz/traefik/values.yaml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 2ec0a46..2138c22 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -1,7 +1,5 @@ traefik: image: - #registry: registry.durp.info - #repository: traefik pullPolicy: Always providers: @@ -14,17 +12,11 @@ traefik: replicas: 3 revisionHistoryLimit: 1 -# volumes: -# - name: traefik-configmap -# mountPath: "/config" -# type: configMap - ingressRoute: dashboard: enabled: true additionalArguments: - # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin From fa64786dcf66025839f6d5db9529f2c2e76e74b0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 21:29:37 -0500 Subject: [PATCH 0522/1058] update --- dmz/internalproxy/templates/redlib.yaml | 136 ++++++++--------- dmz/internalproxy/templates/smokeping.yaml | 164 ++++++++++----------- dmz/internalproxy/templates/speedtest.yaml | 148 +++++++++---------- 3 files changed, 224 insertions(+), 224 deletions(-) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index 5a7cff8..6ab62a1 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -1,68 +1,68 @@ -apiVersion: v1 -kind: Service -metadata: - name: redlib -spec: - ports: - - name: app - port: 8082 - protocol: TCP - targetPort: 8082 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: redlib -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8082 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: redlib-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`redlib.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: redlib - port: 8082 - - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: redlib-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: redlib-tls -spec: - secretName: redlib-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "redlib.durp.info" - dnsNames: - - "redlib.durp.info" +#apiVersion: v1 +#kind: Service +#metadata: +# name: redlib +#spec: +# ports: +# - name: app +# port: 8082 +# protocol: TCP +# targetPort: 8082 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: redlib +#subsets: +#- addresses: +# - ip: 192.168.20.200 +# ports: +# - name: app +# port: 8082 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: redlib-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`redlib.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# kind: Rule +# services: +# - name: redlib +# port: 8082 +# - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) +# kind: Rule +# services: +# - name: ak-outpost-authentik-embedded-outpost +# namespace: authentik +# port: 9000 +# tls: +# secretName: redlib-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: redlib-tls +#spec: +# secretName: redlib-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "redlib.durp.info" +# dnsNames: +# - "redlib.durp.info" diff --git a/dmz/internalproxy/templates/smokeping.yaml b/dmz/internalproxy/templates/smokeping.yaml index 0d5c0c0..dd58774 100644 --- a/dmz/internalproxy/templates/smokeping.yaml +++ b/dmz/internalproxy/templates/smokeping.yaml @@ -1,82 +1,82 @@ -apiVersion: v1 -kind: Service -metadata: - name: smokeping -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: smokeping -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: smokeping-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: smokeping - port: 81 - - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: smokeping-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: smokeping-tls -spec: - secretName: smokeping-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "smokeping.durp.info" - dnsNames: - - "smokeping.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: smokeping-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: smokeping +#spec: +# ports: +# - name: app +# port: 81 +# protocol: TCP +# targetPort: 81 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: smokeping +#subsets: +#- addresses: +# - ip: 192.168.20.200 +# ports: +# - name: app +# port: 81 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: smokeping-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: whitelist +# namespace: traefik +# - name: authentik-proxy-provider +# namespace: traefik +# kind: Rule +# services: +# - name: smokeping +# port: 81 +# - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) +# kind: Rule +# services: +# - name: ak-outpost-authentik-embedded-outpost +# namespace: authentik +# port: 9000 +# tls: +# secretName: smokeping-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: smokeping-tls +#spec: +# secretName: smokeping-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "smokeping.durp.info" +# dnsNames: +# - "smokeping.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: smokeping-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/dmz/internalproxy/templates/speedtest.yaml b/dmz/internalproxy/templates/speedtest.yaml index ccc88ed..59ca0ce 100644 --- a/dmz/internalproxy/templates/speedtest.yaml +++ b/dmz/internalproxy/templates/speedtest.yaml @@ -1,74 +1,74 @@ -apiVersion: v1 -kind: Service -metadata: - name: speedtest -spec: - ports: - - name: app - port: 6580 - protocol: TCP - targetPort: 6580 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: speedtest -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 6580 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: speedtest-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: speedtest - port: 6580 - tls: - secretName: speedtest-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: speedtest-tls -spec: - secretName: speedtest-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "speedtest.durp.info" - dnsNames: - - "speedtest.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: speedtest-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: speedtest +#spec: +# ports: +# - name: app +# port: 6580 +# protocol: TCP +# targetPort: 6580 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: speedtest +#subsets: +#- addresses: +# - ip: 192.168.20.200 +# ports: +# - name: app +# port: 6580 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: speedtest-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) +# kind: Rule +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# services: +# - name: speedtest +# port: 6580 +# tls: +# secretName: speedtest-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: speedtest-tls +#spec: +# secretName: speedtest-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "speedtest.durp.info" +# dnsNames: +# - "speedtest.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: speedtest-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info +#spec: +# type: ExternalName +# externalName: durp.info From 8d63bc4ea93e7857de56818440de95d20ab5b6e6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 16 Mar 2025 21:32:29 -0500 Subject: [PATCH 0523/1058] update --- dmz/internalproxy/templates/ollama.yaml | 204 ++++++++++++------------ 1 file changed, 102 insertions(+), 102 deletions(-) diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index a39dd33..450364c 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -1,102 +1,102 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: ollama-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: ollama-secret - data: - - secretKey: users - remoteRef: - key: secrets/internalproxy/ollama - property: users - ---- - -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: ollama-basic-auth -spec: - basicAuth: - headerField: x-api-key - secret: ollama-secret - ---- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: ollama-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`ollama.durp.info`) && PathPrefix(`/`) - middlewares: - - name: ollama-basic-auth - kind: Rule - services: - - name: ollama - port: 11435 - tls: - secretName: ollama-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: ollama-tls -spec: - secretName: ollama-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "ollama.durp.info" - dnsNames: - - "ollama.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: ollama-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: ollama-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: ollama-secret +# data: +# - secretKey: users +# remoteRef: +# key: secrets/internalproxy/ollama +# property: users +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: Middleware +#metadata: +# name: ollama-basic-auth +#spec: +# basicAuth: +# headerField: x-api-key +# secret: ollama-secret +# +#--- +# +#apiVersion: v1 +#kind: Service +#metadata: +# name: ollama +#spec: +# ports: +# - name: app +# port: 11435 +# protocol: TCP +# targetPort: 11435 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: ollama +#subsets: +# - addresses: +# - ip: 192.168.20.104 +# ports: +# - name: app +# port: 11435 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: ollama-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`ollama.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: ollama-basic-auth +# kind: Rule +# services: +# - name: ollama +# port: 11435 +# tls: +# secretName: ollama-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: ollama-tls +#spec: +# secretName: ollama-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "ollama.durp.info" +# dnsNames: +# - "ollama.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: ollama-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +#spec: +# type: ExternalName +# externalName: durp.info From 961e332e71de906bfbaf82082e9c52fbd01bf161 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 04:59:19 -0500 Subject: [PATCH 0524/1058] update --- dmz/traefik/values.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 2138c22..eda55e5 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -1,5 +1,7 @@ traefik: image: + # registry: registry.durp.info + # repository: traefik pullPolicy: Always providers: @@ -12,11 +14,17 @@ traefik: replicas: 3 revisionHistoryLimit: 1 + volumes: + - name: traefik-configmap + mountPath: "/config" + type: configMap + ingressRoute: dashboard: enabled: true additionalArguments: + - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin From 9d45ebf641da5bc612eb01e89ce640e3950b3f79 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 05:00:00 -0500 Subject: [PATCH 0525/1058] update --- dmz/traefik/templates/config.yaml | 32 +++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 06a9d11..96ea5d3 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -1,16 +1,16 @@ -#apiVersion: v1 -#kind: ConfigMap -#metadata: -# name: traefik-configmap -#data: -# config.yml: | -# http: -# routers: -# router0: -# service: service0 -# rule: Host(`testing.durp.info`) -# services: -# service0: -# loadBalancer: -# servers: -# - url: https://192.168.20.130 +apiVersion: v1 +kind: ConfigMap +metadata: + name: traefik-configmap +data: + config.yml: | + http: + routers: + router0: + service: service0 + rule: Host(`testing.durp.info`) + services: + service0: + loadBalancer: + servers: + - url: https://192.168.20.130 From a50b3ca1d4501059d3d0a8309a8ab8cc6e44072a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 05:13:50 -0500 Subject: [PATCH 0526/1058] update --- dmz/traefik/templates/config.yaml | 32 ++++----- dmz/traefik/templates/traefik-dashboard.yaml | 68 ++++++++++---------- dmz/traefik/values.yaml | 10 +-- 3 files changed, 55 insertions(+), 55 deletions(-) diff --git a/dmz/traefik/templates/config.yaml b/dmz/traefik/templates/config.yaml index 96ea5d3..06a9d11 100644 --- a/dmz/traefik/templates/config.yaml +++ b/dmz/traefik/templates/config.yaml @@ -1,16 +1,16 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: traefik-configmap -data: - config.yml: | - http: - routers: - router0: - service: service0 - rule: Host(`testing.durp.info`) - services: - service0: - loadBalancer: - servers: - - url: https://192.168.20.130 +#apiVersion: v1 +#kind: ConfigMap +#metadata: +# name: traefik-configmap +#data: +# config.yml: | +# http: +# routers: +# router0: +# service: service0 +# rule: Host(`testing.durp.info`) +# services: +# service0: +# loadBalancer: +# servers: +# - url: https://192.168.20.130 diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 8fee673..0c6afaa 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -1,34 +1,34 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: traefik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`traefik.durp.info`) - kind: Rule - services: - - name: api@internal - kind: TraefikService - tls: - secretName: traefik-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: traefik-tls - namespace: traefik -spec: - secretName: traefik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "traefik.durp.info" - dnsNames: - - "traefik.durp.info" - ---- - +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: traefik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`traefik.durp.info`) +# kind: Rule +# services: +# - name: api@internal +# kind: TraefikService +# tls: +# secretName: traefik-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: traefik-tls +# namespace: traefik +#spec: +# secretName: traefik-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "traefik.durp.info" +# dnsNames: +# - "traefik.durp.info" +# +#--- +# diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index eda55e5..02736ef 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -14,17 +14,17 @@ traefik: replicas: 3 revisionHistoryLimit: 1 - volumes: - - name: traefik-configmap - mountPath: "/config" - type: configMap + # volumes: + # - name: traefik-configmap + # mountPath: "/config" + # type: configMap ingressRoute: dashboard: enabled: true additionalArguments: - - "--providers.file.filename=/config/config.yml" + # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin From 0907c0fdc886f6b81f0b16584b7035c73572cdac Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 05:20:34 -0500 Subject: [PATCH 0527/1058] update --- infra/argocd/templates/istio.yaml | 50 +++++++++++++++---------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index 808d46a..9a33f34 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -26,28 +26,28 @@ spec: --- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: istio-system-dmz - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: dmz/istio-system - destination: - namespace: istio-system - name: dmz - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ignoreDifferences: - - group: admissionregistration.k8s.io - kind: ValidatingWebhookConfiguration - jsonPointers: - - /webhooks/0/failurePolicy +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: istio-system-dmz +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: dmz/istio-system +# destination: +# namespace: istio-system +# name: dmz +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# ignoreDifferences: +# - group: admissionregistration.k8s.io +# kind: ValidatingWebhookConfiguration +# jsonPointers: +# - /webhooks/0/failurePolicy From b2a369b479d1cdb03f6388a692abb4ac8aa24cab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 05:24:13 -0500 Subject: [PATCH 0528/1058] update --- infra/argocd/templates/istio.yaml | 50 +++++++++++++++---------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index 9a33f34..808d46a 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -26,28 +26,28 @@ spec: --- -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: istio-system-dmz -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: dmz/istio-system -# destination: -# namespace: istio-system -# name: dmz -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# ignoreDifferences: -# - group: admissionregistration.k8s.io -# kind: ValidatingWebhookConfiguration -# jsonPointers: -# - /webhooks/0/failurePolicy +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: istio-system-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/istio-system + destination: + namespace: istio-system + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jsonPointers: + - /webhooks/0/failurePolicy From 813e8a8eb3ebcd37018186b3782a92cdb1043de4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 05:26:24 -0500 Subject: [PATCH 0529/1058] update --- infra/argocd/templates/traefik.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index d55b815..a2e901e 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -39,9 +39,9 @@ spec: namespace: traefik name: dmz syncPolicy: - managedNamespaceMetadata: - labels: - istio-injection: enabled + # managedNamespaceMetadata: + # labels: + # istio-injection: enabled automated: prune: true selfHeal: true From 7f3961964da7991e8c10fe578f2a82584f299455 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 05:35:46 -0500 Subject: [PATCH 0530/1058] update --- infra/litellm/Chart.yaml | 20 +- infra/litellm/templates/NOTES.txt | 22 -- infra/litellm/templates/_helpers.tpl | 84 ----- .../litellm/templates/configmap-litellm.yaml | 7 - infra/litellm/templates/deployment.yaml | 182 ---------- infra/litellm/templates/hpa.yaml | 32 -- infra/litellm/templates/ingress.yaml | 61 ---- infra/litellm/templates/migrations-job.yaml | 70 ---- .../templates/secret-dbcredentials.yaml | 12 - infra/litellm/templates/secret-masterkey.yaml | 8 - infra/litellm/templates/service.yaml | 15 - infra/litellm/templates/serviceaccount.yaml | 13 - .../templates/tests/test-connection.yaml | 25 -- .../templates/tests/test-env-vars.yaml | 43 --- infra/litellm/values.yaml | 337 +++++++++--------- 15 files changed, 177 insertions(+), 754 deletions(-) delete mode 100644 infra/litellm/templates/NOTES.txt delete mode 100644 infra/litellm/templates/_helpers.tpl delete mode 100644 infra/litellm/templates/configmap-litellm.yaml delete mode 100644 infra/litellm/templates/deployment.yaml delete mode 100644 infra/litellm/templates/hpa.yaml delete mode 100644 infra/litellm/templates/ingress.yaml delete mode 100644 infra/litellm/templates/migrations-job.yaml delete mode 100644 infra/litellm/templates/secret-dbcredentials.yaml delete mode 100644 infra/litellm/templates/secret-masterkey.yaml delete mode 100644 infra/litellm/templates/service.yaml delete mode 100644 infra/litellm/templates/serviceaccount.yaml delete mode 100644 infra/litellm/templates/tests/test-connection.yaml delete mode 100644 infra/litellm/templates/tests/test-env-vars.yaml diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index 3d11143..baf487c 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -1,16 +1,12 @@ apiVersion: v2 -name: litellm-helm -description: Call all LLM APIs using the OpenAI format +name: litellm +description: A Helm chart for Kubernetes type: application -version: 0.4.1 -appVersion: v1.50.2 + +version: 0.1.0 +appVersion: "1.16.0" dependencies: - - name: "postgresql" - version: ">=13.3.0" - repository: https://charts.bitnami.com/bitnami - condition: db.deployStandalone - - name: redis - version: ">=18.0.0" - repository: oci://registry-1.docker.io/bitnamicharts - condition: redis.enabled + - name: "litellm-helm" + version: 0.1.636 + repository: oci://ghcr.io/berriai/litellm-helm diff --git a/infra/litellm/templates/NOTES.txt b/infra/litellm/templates/NOTES.txt deleted file mode 100644 index e72c991..0000000 --- a/infra/litellm/templates/NOTES.txt +++ /dev/null @@ -1,22 +0,0 @@ -1. Get the application URL by running these commands: -{{- if .Values.ingress.enabled }} -{{- range $host := .Values.ingress.hosts }} - {{- range .paths }} - http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }} - {{- end }} -{{- end }} -{{- else if contains "NodePort" .Values.service.type }} - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "litellm.fullname" . }}) - export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - echo http://$NODE_IP:$NODE_PORT -{{- else if contains "LoadBalancer" .Values.service.type }} - NOTE: It may take a few minutes for the LoadBalancer IP to be available. - You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "litellm.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "litellm.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") - echo http://$SERVICE_IP:{{ .Values.service.port }} -{{- else if contains "ClusterIP" .Values.service.type }} - export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "litellm.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}") - echo "Visit http://127.0.0.1:8080 to use your application" - kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT -{{- end }} diff --git a/infra/litellm/templates/_helpers.tpl b/infra/litellm/templates/_helpers.tpl deleted file mode 100644 index a1eda28..0000000 --- a/infra/litellm/templates/_helpers.tpl +++ /dev/null @@ -1,84 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "litellm.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "litellm.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "litellm.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "litellm.labels" -}} -helm.sh/chart: {{ include "litellm.chart" . }} -{{ include "litellm.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "litellm.selectorLabels" -}} -app.kubernetes.io/name: {{ include "litellm.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} - -{{/* -Create the name of the service account to use -*/}} -{{- define "litellm.serviceAccountName" -}} -{{- if .Values.serviceAccount.create }} -{{- default (include "litellm.fullname" .) .Values.serviceAccount.name }} -{{- else }} -{{- default "default" .Values.serviceAccount.name }} -{{- end }} -{{- end }} - -{{/* -Get redis service name -*/}} -{{- define "litellm.redis.serviceName" -}} -{{- if and (eq .Values.redis.architecture "standalone") .Values.redis.sentinel.enabled -}} -{{- printf "%s-%s" .Release.Name (default "redis" .Values.redis.nameOverride | trunc 63 | trimSuffix "-") -}} -{{- else -}} -{{- printf "%s-%s-master" .Release.Name (default "redis" .Values.redis.nameOverride | trunc 63 | trimSuffix "-") -}} -{{- end -}} -{{- end -}} - -{{/* -Get redis service port -*/}} -{{- define "litellm.redis.port" -}} -{{- if .Values.redis.sentinel.enabled -}} -{{ .Values.redis.sentinel.service.ports.sentinel }} -{{- else -}} -{{ .Values.redis.master.service.ports.redis }} -{{- end -}} -{{- end -}} diff --git a/infra/litellm/templates/configmap-litellm.yaml b/infra/litellm/templates/configmap-litellm.yaml deleted file mode 100644 index 4598054..0000000 --- a/infra/litellm/templates/configmap-litellm.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ include "litellm.fullname" . }}-config -data: - config.yaml: | -{{ .Values.proxy_config | toYaml | indent 6 }} \ No newline at end of file diff --git a/infra/litellm/templates/deployment.yaml b/infra/litellm/templates/deployment.yaml deleted file mode 100644 index 697148a..0000000 --- a/infra/litellm/templates/deployment.yaml +++ /dev/null @@ -1,182 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "litellm.fullname" . }} - labels: - {{- include "litellm.labels" . | nindent 4 }} -spec: - {{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} - {{- end }} - selector: - matchLabels: - {{- include "litellm.selectorLabels" . | nindent 6 }} - template: - metadata: - annotations: - checksum/config: {{ include (print $.Template.BasePath "/configmap-litellm.yaml") . | sha256sum }} - {{- with .Values.podAnnotations }} - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "litellm.labels" . | nindent 8 }} - {{- with .Values.podLabels }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - serviceAccountName: {{ include "litellm.serviceAccountName" . }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - containers: - - name: {{ include "litellm.name" . }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "main-%s" .Chart.AppVersion) }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - env: - - name: HOST - value: "{{ .Values.listen | default "0.0.0.0" }}" - - name: PORT - value: {{ .Values.service.port | quote}} - {{- if .Values.db.deployStandalone }} - - name: DATABASE_USERNAME - valueFrom: - secretKeyRef: - name: {{ include "litellm.fullname" . }}-dbcredentials - key: username - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "litellm.fullname" . }}-dbcredentials - key: password - - name: DATABASE_HOST - value: {{ .Release.Name }}-postgresql - - name: DATABASE_NAME - value: litellm - {{- else if .Values.db.useExisting }} - - name: DATABASE_USERNAME - valueFrom: - secretKeyRef: - name: {{ .Values.db.secret.name }} - key: {{ .Values.db.secret.usernameKey }} - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Values.db.secret.name }} - key: {{ .Values.db.secret.passwordKey }} - - name: DATABASE_HOST - value: {{ .Values.db.endpoint }} - - name: DATABASE_NAME - value: {{ .Values.db.database }} - - name: DATABASE_URL - value: {{ .Values.db.url | quote }} - {{- end }} - - name: PROXY_MASTER_KEY - valueFrom: - secretKeyRef: - name: {{ include "litellm.fullname" . }}-masterkey - key: masterkey - {{- if .Values.redis.enabled }} - - name: REDIS_HOST - value: {{ include "litellm.redis.serviceName" . }} - - name: REDIS_PORT - value: {{ include "litellm.redis.port" . | quote }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ include "redis.secretName" .Subcharts.redis }} - key: {{include "redis.secretPasswordKey" .Subcharts.redis }} - {{- end }} - {{- if .Values.envVars }} - {{- range $key, $val := .Values.envVars }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end }} - {{- end }} - envFrom: - {{- range .Values.environmentSecrets }} - - secretRef: - name: {{ . }} - {{- end }} - {{- range .Values.environmentConfigMaps }} - - configMapRef: - name: {{ . }} - {{- end }} - args: - - --config - - /etc/litellm/config.yaml - ports: - - name: http - containerPort: {{ .Values.service.port }} - protocol: TCP - livenessProbe: - httpGet: - path: /health/liveliness - port: http - readinessProbe: - httpGet: - path: /health/readiness - port: http - # Give the container time to start up. Up to 5 minutes (10 * 30 seconds) - startupProbe: - httpGet: - path: /health/readiness - port: http - failureThreshold: 30 - periodSeconds: 10 - resources: - {{- toYaml .Values.resources | nindent 12 }} - volumeMounts: - - name: litellm-config - mountPath: /etc/litellm/ - {{ if .Values.securityContext.readOnlyRootFilesystem }} - - name: tmp - mountPath: /tmp - - name: cache - mountPath: /.cache - - name: npm - mountPath: /.npm - {{- end }} - {{- with .Values.volumeMounts }} - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.extraContainers }} - {{- toYaml . | nindent 8 }} - {{- end }} - volumes: - {{ if .Values.securityContext.readOnlyRootFilesystem }} - - name: tmp - emptyDir: - sizeLimit: 500Mi - - name: cache - emptyDir: - sizeLimit: 500Mi - - name: npm - emptyDir: - sizeLimit: 500Mi - {{- end }} - - name: litellm-config - configMap: - name: {{ include "litellm.fullname" . }}-config - items: - - key: "config.yaml" - path: "config.yaml" - {{- with .Values.volumes }} - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} diff --git a/infra/litellm/templates/hpa.yaml b/infra/litellm/templates/hpa.yaml deleted file mode 100644 index 71e199c..0000000 --- a/infra/litellm/templates/hpa.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if .Values.autoscaling.enabled }} -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "litellm.fullname" . }} - labels: - {{- include "litellm.labels" . | nindent 4 }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "litellm.fullname" . }} - minReplicas: {{ .Values.autoscaling.minReplicas }} - maxReplicas: {{ .Values.autoscaling.maxReplicas }} - metrics: - {{- if .Values.autoscaling.targetCPUUtilizationPercentage }} - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }} - {{- end }} - {{- if .Values.autoscaling.targetMemoryUtilizationPercentage }} - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }} - {{- end }} -{{- end }} diff --git a/infra/litellm/templates/ingress.yaml b/infra/litellm/templates/ingress.yaml deleted file mode 100644 index 09e8d71..0000000 --- a/infra/litellm/templates/ingress.yaml +++ /dev/null @@ -1,61 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "litellm.fullname" . -}} -{{- $svcPort := .Values.service.port -}} -{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} - {{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }} - {{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}} - {{- end }} -{{- end }} -{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1 -{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -apiVersion: networking.k8s.io/v1beta1 -{{- else -}} -apiVersion: extensions/v1beta1 -{{- end }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - {{- include "litellm.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} - ingressClassName: {{ .Values.ingress.className }} - {{- end }} - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ .host | quote }} - http: - paths: - {{- range .paths }} - - path: {{ .path }} - {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} - pathType: {{ .pathType }} - {{- end }} - backend: - {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} - service: - name: {{ $fullName }} - port: - number: {{ $svcPort }} - {{- else }} - serviceName: {{ $fullName }} - servicePort: {{ $svcPort }} - {{- end }} - {{- end }} - {{- end }} -{{- end }} diff --git a/infra/litellm/templates/migrations-job.yaml b/infra/litellm/templates/migrations-job.yaml deleted file mode 100644 index e994c45..0000000 --- a/infra/litellm/templates/migrations-job.yaml +++ /dev/null @@ -1,70 +0,0 @@ -{{- if .Values.migrationJob.enabled }} -# This job runs the prisma migrations for the LiteLLM DB. -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "litellm.fullname" . }}-migrations - annotations: - argocd.argoproj.io/hook: PreSync - argocd.argoproj.io/hook-delete-policy: BeforeHookCreation # delete old migration on a new deploy in case the migration needs to make updates - checksum/config: {{ toYaml .Values | sha256sum }} -spec: - template: - metadata: - annotations: - {{- with .Values.migrationJob.annotations }} - {{- toYaml . | nindent 8 }} - {{- end }} - spec: - containers: - - name: prisma-migrations - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default (printf "main-%s" .Chart.AppVersion) }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - command: ["python", "litellm/proxy/prisma_migration.py"] - workingDir: "/app" - env: - {{- if .Values.db.useExisting }} - - name: DATABASE_USERNAME - valueFrom: - secretKeyRef: - name: {{ .Values.db.secret.name }} - key: {{ .Values.db.secret.usernameKey }} - - name: DATABASE_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Values.db.secret.name }} - key: {{ .Values.db.secret.passwordKey }} - - name: DATABASE_HOST - value: {{ .Values.db.endpoint }} - - name: DATABASE_NAME - value: {{ .Values.db.database }} - - name: DATABASE_URL - value: {{ .Values.db.url | quote }} - {{- else }} - - name: DATABASE_URL - value: postgresql://{{ .Values.postgresql.auth.username }}:{{ .Values.postgresql.auth.password }}@{{ .Release.Name }}-postgresql/{{ .Values.postgresql.auth.database }} - {{- end }} - - name: DISABLE_SCHEMA_UPDATE - value: "false" # always run the migration from the Helm PreSync hook, override the value set - {{- with .Values.volumeMounts }} - volumeMounts: - {{- toYaml . | nindent 12 }} - {{- end }} - {{- with .Values.volumes }} - volumes: - {{- toYaml . | nindent 8 }} - {{- end }} - restartPolicy: OnFailure - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - ttlSecondsAfterFinished: {{ .Values.migrationJob.ttlSecondsAfterFinished }} - backoffLimit: {{ .Values.migrationJob.backoffLimit }} -{{- end }} diff --git a/infra/litellm/templates/secret-dbcredentials.yaml b/infra/litellm/templates/secret-dbcredentials.yaml deleted file mode 100644 index 8851f58..0000000 --- a/infra/litellm/templates/secret-dbcredentials.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.db.deployStandalone -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "litellm.fullname" . }}-dbcredentials -data: - # Password for the "postgres" user - postgres-password: {{ ( index .Values.postgresql.auth "postgres-password") | default "litellm" | b64enc }} - username: {{ .Values.postgresql.auth.username | default "litellm" | b64enc }} - password: {{ .Values.postgresql.auth.password | default "litellm" | b64enc }} -type: Opaque -{{- end -}} \ No newline at end of file diff --git a/infra/litellm/templates/secret-masterkey.yaml b/infra/litellm/templates/secret-masterkey.yaml deleted file mode 100644 index 57b854c..0000000 --- a/infra/litellm/templates/secret-masterkey.yaml +++ /dev/null @@ -1,8 +0,0 @@ -{{ $masterkey := (.Values.masterkey | default (randAlphaNum 17)) }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "litellm.fullname" . }}-masterkey -data: - masterkey: {{ $masterkey | b64enc }} -type: Opaque \ No newline at end of file diff --git a/infra/litellm/templates/service.yaml b/infra/litellm/templates/service.yaml deleted file mode 100644 index 40e7f27..0000000 --- a/infra/litellm/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "litellm.fullname" . }} - labels: - {{- include "litellm.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: http - protocol: TCP - name: http - selector: - {{- include "litellm.selectorLabels" . | nindent 4 }} diff --git a/infra/litellm/templates/serviceaccount.yaml b/infra/litellm/templates/serviceaccount.yaml deleted file mode 100644 index 7655470..0000000 --- a/infra/litellm/templates/serviceaccount.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "litellm.serviceAccountName" . }} - labels: - {{- include "litellm.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -automountServiceAccountToken: {{ .Values.serviceAccount.automount }} -{{- end }} diff --git a/infra/litellm/templates/tests/test-connection.yaml b/infra/litellm/templates/tests/test-connection.yaml deleted file mode 100644 index 86a8f66..0000000 --- a/infra/litellm/templates/tests/test-connection.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "litellm.fullname" . }}-test-connection" - labels: - {{- include "litellm.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": test -spec: - containers: - - name: wget - image: busybox - command: ['sh', '-c'] - args: - - | - # Wait for a bit to allow the service to be ready - sleep 10 - # Try multiple times with a delay between attempts - for i in $(seq 1 30); do - wget -T 5 "{{ include "litellm.fullname" . }}:{{ .Values.service.port }}/health/readiness" && exit 0 - echo "Attempt $i failed, waiting..." - sleep 2 - done - exit 1 - restartPolicy: Never \ No newline at end of file diff --git a/infra/litellm/templates/tests/test-env-vars.yaml b/infra/litellm/templates/tests/test-env-vars.yaml deleted file mode 100644 index 9f02775..0000000 --- a/infra/litellm/templates/tests/test-env-vars.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: v1 -kind: Pod -metadata: - name: "{{ include "litellm.fullname" . }}-env-test" - labels: - {{- include "litellm.labels" . | nindent 4 }} - annotations: - "helm.sh/hook": test -spec: - containers: - - name: test - image: busybox - command: ['sh', '-c'] - args: - - | - # Test DD_ENV - if [ "$DD_ENV" != "dev_helm" ]; then - echo "❌ Environment variable DD_ENV mismatch. Expected: dev_helm, Got: $DD_ENV" - exit 1 - fi - echo "✅ Environment variable DD_ENV matches expected value: $DD_ENV" - - # Test DD_SERVICE - if [ "$DD_SERVICE" != "litellm" ]; then - echo "❌ Environment variable DD_SERVICE mismatch. Expected: litellm, Got: $DD_SERVICE" - exit 1 - fi - echo "✅ Environment variable DD_SERVICE matches expected value: $DD_SERVICE" - - # Test USE_DDTRACE - if [ "$USE_DDTRACE" != "true" ]; then - echo "❌ Environment variable USE_DDTRACE mismatch. Expected: true, Got: $USE_DDTRACE" - exit 1 - fi - echo "✅ Environment variable USE_DDTRACE matches expected value: $USE_DDTRACE" - env: - - name: DD_ENV - value: {{ .Values.envVars.DD_ENV | quote }} - - name: DD_SERVICE - value: {{ .Values.envVars.DD_SERVICE | quote }} - - name: USE_DDTRACE - value: {{ .Values.envVars.USE_DDTRACE | quote }} - restartPolicy: Never \ No newline at end of file diff --git a/infra/litellm/values.yaml b/infra/litellm/values.yaml index 2ea3221..b7ce066 100644 --- a/infra/litellm/values.yaml +++ b/infra/litellm/values.yaml @@ -1,196 +1,197 @@ -# Default values for litellm. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. +litellm: + # Default values for litellm. + # This is a YAML-formatted file. + # Declare variables to be passed into your templates. -replicaCount: 1 + replicaCount: 1 -image: - # Use "ghcr.io/berriai/litellm-database" for optimized image with database - repository: ghcr.io/berriai/litellm-database - pullPolicy: Always - # Overrides the image tag whose default is the chart appVersion. - # tag: "main-latest" - tag: "" + image: + # Use "ghcr.io/berriai/litellm-database" for optimized image with database + repository: ghcr.io/berriai/litellm-database + pullPolicy: Always + # Overrides the image tag whose default is the chart appVersion. + # tag: "main-latest" + tag: "" -imagePullSecrets: [] -nameOverride: "litellm" -fullnameOverride: "" + imagePullSecrets: [] + nameOverride: "litellm" + fullnameOverride: "" -serviceAccount: - # Specifies whether a service account should be created - create: false - # Automatically mount a ServiceAccount's API credentials? - automount: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - name: "" + serviceAccount: + # Specifies whether a service account should be created + create: false + # Automatically mount a ServiceAccount's API credentials? + automount: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" -podAnnotations: {} -podLabels: {} + podAnnotations: {} + podLabels: {} -# At the time of writing, the litellm docker image requires write access to the -# filesystem on startup so that prisma can install some dependencies. -podSecurityContext: {} -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: false - # runAsNonRoot: true - # runAsUser: 1000 + # At the time of writing, the litellm docker image requires write access to the + # filesystem on startup so that prisma can install some dependencies. + podSecurityContext: {} + securityContext: {} + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: false + # runAsNonRoot: true + # runAsUser: 1000 -# A list of Kubernetes Secret objects that will be exported to the LiteLLM proxy -# pod as environment variables. These secrets can then be referenced in the -# configuration file (or "litellm" ConfigMap) with `os.environ/` -environmentSecrets: [] - # - litellm-env-secret + # A list of Kubernetes Secret objects that will be exported to the LiteLLM proxy + # pod as environment variables. These secrets can then be referenced in the + # configuration file (or "litellm" ConfigMap) with `os.environ/` + environmentSecrets: [] + # - litellm-env-secret -# A list of Kubernetes ConfigMap objects that will be exported to the LiteLLM proxy -# pod as environment variables. The ConfigMap kv-pairs can then be referenced in the -# configuration file (or "litellm" ConfigMap) with `os.environ/` -environmentConfigMaps: [] - # - litellm-env-configmap + # A list of Kubernetes ConfigMap objects that will be exported to the LiteLLM proxy + # pod as environment variables. The ConfigMap kv-pairs can then be referenced in the + # configuration file (or "litellm" ConfigMap) with `os.environ/` + environmentConfigMaps: [] + # - litellm-env-configmap -service: - type: ClusterIP - port: 4000 + service: + type: ClusterIP + port: 4000 -ingress: - enabled: false - className: "nginx" - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - hosts: - - host: api.example.local - paths: - - path: / - pathType: ImplementationSpecific - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local + ingress: + enabled: false + className: "nginx" + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: api.example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local -# masterkey: changeit + # masterkey: changeit -# The elements within proxy_config are rendered as config.yaml for the proxy -# Examples: https://github.com/BerriAI/litellm/tree/main/litellm/proxy/example_config_yaml -# Reference: https://docs.litellm.ai/docs/proxy/configs -proxy_config: - model_list: - # At least one model must exist for the proxy to start. - - model_name: gpt-3.5-turbo - litellm_params: - model: gpt-3.5-turbo - api_key: eXaMpLeOnLy - - model_name: fake-openai-endpoint - litellm_params: - model: openai/fake - api_key: fake-key - api_base: https://exampleopenaiendpoint-production.up.railway.app/ - general_settings: - master_key: os.environ/PROXY_MASTER_KEY + # The elements within proxy_config are rendered as config.yaml for the proxy + # Examples: https://github.com/BerriAI/litellm/tree/main/litellm/proxy/example_config_yaml + # Reference: https://docs.litellm.ai/docs/proxy/configs + proxy_config: + model_list: + # At least one model must exist for the proxy to start. + - model_name: gpt-3.5-turbo + litellm_params: + model: gpt-3.5-turbo + api_key: eXaMpLeOnLy + - model_name: fake-openai-endpoint + litellm_params: + model: openai/fake + api_key: fake-key + api_base: https://exampleopenaiendpoint-production.up.railway.app/ + general_settings: + master_key: os.environ/PROXY_MASTER_KEY -resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi -autoscaling: - enabled: false - minReplicas: 1 - maxReplicas: 100 - targetCPUUtilizationPercentage: 80 - # targetMemoryUtilizationPercentage: 80 + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 -# Additional volumes on the output Deployment definition. -volumes: [] -# - name: foo -# secret: -# secretName: mysecret -# optional: false + # Additional volumes on the output Deployment definition. + volumes: [] + # - name: foo + # secret: + # secretName: mysecret + # optional: false -# Additional volumeMounts on the output Deployment definition. -volumeMounts: [] -# - name: foo -# mountPath: "/etc/foo" -# readOnly: true + # Additional volumeMounts on the output Deployment definition. + volumeMounts: [] + # - name: foo + # mountPath: "/etc/foo" + # readOnly: true -nodeSelector: {} + nodeSelector: {} -tolerations: [] + tolerations: [] -affinity: {} + affinity: {} -db: - # Use an existing postgres server/cluster - useExisting: false + db: + # Use an existing postgres server/cluster + useExisting: false - # How to connect to the existing postgres server/cluster - endpoint: localhost - database: litellm - url: postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_HOST)/$(DATABASE_NAME) - secret: - name: postgres - usernameKey: username - passwordKey: password - - # Use the Stackgres Helm chart to deploy an instance of a Stackgres cluster. - # The Stackgres Operator must already be installed within the target - # Kubernetes cluster. - # TODO: Stackgres deployment currently unsupported - useStackgresOperator: false - - # Use the Postgres Helm chart to create a single node, stand alone postgres - # instance. See the "postgresql" top level key for additional configuration. - deployStandalone: true - -# Settings for Bitnami postgresql chart (if db.deployStandalone is true, ignored -# otherwise) -postgresql: - architecture: standalone - auth: - username: litellm + # How to connect to the existing postgres server/cluster + endpoint: localhost database: litellm + url: postgresql://$(DATABASE_USERNAME):$(DATABASE_PASSWORD)@$(DATABASE_HOST)/$(DATABASE_NAME) + secret: + name: postgres + usernameKey: username + passwordKey: password - # You should override these on the helm command line with - # `--set postgresql.auth.postgres-password=,postgresql.auth.password=` - password: NoTaGrEaTpAsSwOrD - postgres-password: NoTaGrEaTpAsSwOrD + # Use the Stackgres Helm chart to deploy an instance of a Stackgres cluster. + # The Stackgres Operator must already be installed within the target + # Kubernetes cluster. + # TODO: Stackgres deployment currently unsupported + useStackgresOperator: false - # A secret is created by this chart (litellm-helm) with the credentials that - # the new Postgres instance should use. - # existingSecret: "" - # secretKeys: - # userPasswordKey: password + # Use the Postgres Helm chart to create a single node, stand alone postgres + # instance. See the "postgresql" top level key for additional configuration. + deployStandalone: true -# requires cache: true in config file -# either enable this or pass a secret for REDIS_HOST, REDIS_PORT, REDIS_PASSWORD or REDIS_URL -# with cache: true to use existing redis instance -redis: - enabled: false - architecture: standalone + # Settings for Bitnami postgresql chart (if db.deployStandalone is true, ignored + # otherwise) + postgresql: + architecture: standalone + auth: + username: litellm + database: litellm -# Prisma migration job settings -migrationJob: - enabled: true # Enable or disable the schema migration Job - retries: 3 # Number of retries for the Job in case of failure - backoffLimit: 4 # Backoff limit for Job restarts - disableSchemaUpdate: false # Skip schema migrations for specific environments. When True, the job will exit with code 0. - annotations: {} - ttlSecondsAfterFinished: 120 + # You should override these on the helm command line with + # `--set postgresql.auth.postgres-password=,postgresql.auth.password=` + password: NoTaGrEaTpAsSwOrD + postgres-password: NoTaGrEaTpAsSwOrD -# Additional environment variables to be added to the deployment -envVars: { - # USE_DDTRACE: "true" -} + # A secret is created by this chart (litellm-helm) with the credentials that + # the new Postgres instance should use. + # existingSecret: "" + # secretKeys: + # userPasswordKey: password + + # requires cache: true in config file + # either enable this or pass a secret for REDIS_HOST, REDIS_PORT, REDIS_PASSWORD or REDIS_URL + # with cache: true to use existing redis instance + redis: + enabled: false + architecture: standalone + + # Prisma migration job settings + migrationJob: + enabled: true # Enable or disable the schema migration Job + retries: 3 # Number of retries for the Job in case of failure + backoffLimit: 4 # Backoff limit for Job restarts + disableSchemaUpdate: false # Skip schema migrations for specific environments. When True, the job will exit with code 0. + annotations: {} + ttlSecondsAfterFinished: 120 + + # Additional environment variables to be added to the deployment + envVars: { + # USE_DDTRACE: "true" + } From 2e45f7b89914654d16dd93834c2af401a14471d2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 17 Mar 2025 06:17:20 -0500 Subject: [PATCH 0531/1058] update --- master/uptimekuma/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/uptimekuma/templates/deployment.yaml b/master/uptimekuma/templates/deployment.yaml index 21ce3c0..d823327 100644 --- a/master/uptimekuma/templates/deployment.yaml +++ b/master/uptimekuma/templates/deployment.yaml @@ -19,7 +19,7 @@ spec: spec: containers: - name: app - image: registry.internal.durp.info/louislam/uptime-kuma:1 + image: registry.durp.info/louislam/uptime-kuma:1 ports: - containerPort: 3001 volumeMounts: From 04e76a3e9005989472afc78b5f90a0ccf2a0c6a9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 05:06:45 -0500 Subject: [PATCH 0532/1058] update --- master/longhorn/templates/ingress.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/master/longhorn/templates/ingress.yaml b/master/longhorn/templates/ingress.yaml index df2e071..09c5ef2 100644 --- a/master/longhorn/templates/ingress.yaml +++ b/master/longhorn/templates/ingress.yaml @@ -10,18 +10,18 @@ spec: middlewares: - name: whitelist namespace: traefik - - name: authentik-proxy-provider - namespace: traefik + # - name: authentik-proxy-provider + # namespace: traefik kind: Rule services: - name: longhorn-frontend port: 80 - - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 + # - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + # kind: Rule + # services: + # - name: ak-outpost-authentik-embedded-outpost + # namespace: authentik + # port: 9000 tls: secretName: longhorn-tls From d73f626ae587aba455b2212d38e38f712de68e2e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 05:55:10 -0500 Subject: [PATCH 0533/1058] update --- dmz/internalproxy/templates/ollama.yaml | 204 ++++++++++++------------ 1 file changed, 102 insertions(+), 102 deletions(-) diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 450364c..1afeac9 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -1,102 +1,102 @@ -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: ollama-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: ollama-secret -# data: -# - secretKey: users -# remoteRef: -# key: secrets/internalproxy/ollama -# property: users -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: Middleware -#metadata: -# name: ollama-basic-auth -#spec: -# basicAuth: -# headerField: x-api-key -# secret: ollama-secret -# -#--- -# -#apiVersion: v1 -#kind: Service -#metadata: -# name: ollama -#spec: -# ports: -# - name: app -# port: 11435 -# protocol: TCP -# targetPort: 11435 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: ollama -#subsets: -# - addresses: -# - ip: 192.168.20.104 -# ports: -# - name: app -# port: 11435 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: ollama-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`ollama.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: ollama-basic-auth -# kind: Rule -# services: -# - name: ollama -# port: 11435 -# tls: -# secretName: ollama-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: ollama-tls -#spec: -# secretName: ollama-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "ollama.durp.info" -# dnsNames: -# - "ollama.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: ollama-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ollama-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: ollama-secret + data: + - secretKey: users + remoteRef: + key: secrets/ollama + property: users + +--- + +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: ollama-basic-auth +spec: + basicAuth: + headerField: x-api-key + secret: ollama-secret + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: ollama-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`ollama.durp.info`) && PathPrefix(`/`) + middlewares: + - name: ollama-basic-auth + kind: Rule + services: + - name: ollama + port: 11435 + tls: + secretName: ollama-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls +spec: + secretName: ollama-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "ollama.durp.info" + dnsNames: + - "ollama.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: ollama-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +spec: + type: ExternalName + externalName: durp.info From 2450688ab8eac1c8b04d4132ab12029d8bfaea03 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 05:56:39 -0500 Subject: [PATCH 0534/1058] update --- dmz/internalproxy/templates/serviceaccount.yaml | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 dmz/internalproxy/templates/serviceaccount.yaml diff --git a/dmz/internalproxy/templates/serviceaccount.yaml b/dmz/internalproxy/templates/serviceaccount.yaml new file mode 100644 index 0000000..ddac6a5 --- /dev/null +++ b/dmz/internalproxy/templates/serviceaccount.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault From 22aad9eb543277d79b7d11fbcd8ecbbea56aa860 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 05:58:53 -0500 Subject: [PATCH 0535/1058] update --- dmz/internalproxy/templates/ollama.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 1afeac9..f312669 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -11,7 +11,7 @@ spec: data: - secretKey: users remoteRef: - key: secrets/ollama + key: kv/ollama property: users --- From 39fae09f5837f0988966499ac0fd8a815f4e6d84 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:15:05 -0500 Subject: [PATCH 0536/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 11 ++++++++ dmz/internalproxy/templates/open-webui.yaml | 30 +++++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 dmz/internalproxy/templates/open-webui.yaml diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index c5d00c4..1da7c9f 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -43,3 +43,14 @@ spec: - protocol: TCP port: 443 targetPort: 443 + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.20.130 + diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml new file mode 100644 index 0000000..87ea79f --- /dev/null +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -0,0 +1,30 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: open-webui-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: master-cluster + port: 443 + tls: + secretName: open-webui-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: open-webui-tls +spec: + secretName: open-webui-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "open-webui.durp.info" + dnsNames: + - "open-webui.durp.info" From 4c4f67525d980400b6d2e93a8190bfafe121e509 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:15:33 -0500 Subject: [PATCH 0537/1058] update --- dmz/internalproxy/templates/open-webui.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index 87ea79f..4d31b99 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: open-webui-ingress From 513298f3be0de210319e3503e6df1104ff8f30c4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:16:52 -0500 Subject: [PATCH 0538/1058] update --- dmz/internalproxy/templates/gitea.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/gitea.yaml index bbd976c..efaab18 100644 --- a/dmz/internalproxy/templates/gitea.yaml +++ b/dmz/internalproxy/templates/gitea.yaml @@ -38,7 +38,7 @@ spec: - match: Host(`gitea.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: gitea + - name: unraid port: 3000 scheme: http tls: From 3b69fdcf8fd46e94b2c08d58d5e0cdd91a606398 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:19:13 -0500 Subject: [PATCH 0539/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 1da7c9f..bf23715 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -52,5 +52,5 @@ metadata: name: unraid subsets: - addresses: - - ip: 192.168.20.130 + - ip: 192.168.21.200 From d217345a259166f0fdcad11b963f2167217f06b3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:20:22 -0500 Subject: [PATCH 0540/1058] update --- dmz/internalproxy/templates/gitea.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/gitea.yaml index efaab18..58c28d7 100644 --- a/dmz/internalproxy/templates/gitea.yaml +++ b/dmz/internalproxy/templates/gitea.yaml @@ -19,7 +19,7 @@ metadata: name: gitea subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 3000 @@ -38,7 +38,7 @@ spec: - match: Host(`gitea.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid + - name: gitea port: 3000 scheme: http tls: From 093bf40127bb19412292b54fcfd99741133afabb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:21:58 -0500 Subject: [PATCH 0541/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 4 +++- dmz/internalproxy/templates/gitea.yaml | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index bf23715..b8a5926 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -53,4 +53,6 @@ metadata: subsets: - addresses: - ip: 192.168.21.200 - + ports: + - port: 443 + - port: 3000 diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/gitea.yaml index 58c28d7..021eee9 100644 --- a/dmz/internalproxy/templates/gitea.yaml +++ b/dmz/internalproxy/templates/gitea.yaml @@ -38,7 +38,7 @@ spec: - match: Host(`gitea.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: gitea + - name: unraid port: 3000 scheme: http tls: From 9165bd44a926b2bbd4daec407c5f7ae6218007de Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:24:03 -0500 Subject: [PATCH 0542/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index b8a5926..b0b7700 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -53,6 +53,15 @@ metadata: subsets: - addresses: - ip: 192.168.21.200 - ports: - - port: 443 - - port: 3000 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - protocol: TCP + port: 3000 + targetPort: 3000 From 399fadef3ffaedf070915048f08c7120ebb9b679 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:24:54 -0500 Subject: [PATCH 0543/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index b0b7700..608d984 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -53,6 +53,8 @@ metadata: subsets: - addresses: - ip: 192.168.21.200 + ports: + - port: 3000 --- From c6d963d6354839b846a0b06f0856362a830b9cd2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:25:39 -0500 Subject: [PATCH 0544/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 24 ---------------------- dmz/internalproxy/templates/gitea.yaml | 2 +- 2 files changed, 1 insertion(+), 25 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 608d984..c5d00c4 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -43,27 +43,3 @@ spec: - protocol: TCP port: 443 targetPort: 443 - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unraid -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - port: 3000 - ---- - -apiVersion: v1 -kind: Service -metadata: - name: unraid -spec: - ports: - - protocol: TCP - port: 3000 - targetPort: 3000 diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/gitea.yaml index 021eee9..58c28d7 100644 --- a/dmz/internalproxy/templates/gitea.yaml +++ b/dmz/internalproxy/templates/gitea.yaml @@ -38,7 +38,7 @@ spec: - match: Host(`gitea.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: unraid + - name: gitea port: 3000 scheme: http tls: From e6c9a0b9ed7bda351babdcfb2395cbf35ccf6403 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:31:01 -0500 Subject: [PATCH 0545/1058] update --- dmz/external-dns/Chart.yaml | 12 ++++++++++ dmz/external-dns/templates/secrets.yaml | 30 ++++++++++++++++++++++++ dmz/external-dns/values.yaml | 16 +++++++++++++ infra/argocd/templates/external-dns.yaml | 21 +++++++++++++++++ 4 files changed, 79 insertions(+) create mode 100644 dmz/external-dns/Chart.yaml create mode 100644 dmz/external-dns/templates/secrets.yaml create mode 100644 dmz/external-dns/values.yaml create mode 100644 infra/argocd/templates/external-dns.yaml diff --git a/dmz/external-dns/Chart.yaml b/dmz/external-dns/Chart.yaml new file mode 100644 index 0000000..8fb36bc --- /dev/null +++ b/dmz/external-dns/Chart.yaml @@ -0,0 +1,12 @@ + +apiVersion: v2 +name: external-dns +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-dns + repository: https://charts.bitnami.com/bitnami + version: 8.3.8 diff --git a/dmz/external-dns/templates/secrets.yaml b/dmz/external-dns/templates/secrets.yaml new file mode 100644 index 0000000..0420a5d --- /dev/null +++ b/dmz/external-dns/templates/secrets.yaml @@ -0,0 +1,30 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: external-dns-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: external-dns + data: + - secretKey: cloudflare_api_email + remoteRef: + key: kv/cloudflare + property: cloudflare_api_email + - secretKey: cloudflare_api_key + remoteRef: + key: kv/cloudflare + property: cloudflare_api_key + - secretKey: cloudflare_api_token + remoteRef: + key: kv/cloudflare + property: cloudflare_api_token + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/dmz/external-dns/values.yaml b/dmz/external-dns/values.yaml new file mode 100644 index 0000000..f25b1e2 --- /dev/null +++ b/dmz/external-dns/values.yaml @@ -0,0 +1,16 @@ +external-dns: + global: + imageRegistry: "registry.durp.info" + + image: + pullPolicy: Always + + sources: + - service + + provider: cloudflare + cloudflare: + secretName : "external-dns" + proxied: false + + policy: sync diff --git a/infra/argocd/templates/external-dns.yaml b/infra/argocd/templates/external-dns.yaml new file mode 100644 index 0000000..63e1543 --- /dev/null +++ b/infra/argocd/templates/external-dns.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: external-dns-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/external-secrets + destination: + namespace: external-secrets + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From a24fc8a60579315348b0a103d673f280b82d884a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:34:13 -0500 Subject: [PATCH 0546/1058] update --- infra/argocd/templates/external-dns.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/templates/external-dns.yaml b/infra/argocd/templates/external-dns.yaml index 63e1543..6edb645 100644 --- a/infra/argocd/templates/external-dns.yaml +++ b/infra/argocd/templates/external-dns.yaml @@ -8,9 +8,9 @@ spec: source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main - path: dmz/external-secrets + path: dmz/external-dns destination: - namespace: external-secrets + namespace: external-dns name: dmz syncPolicy: automated: From f7434b081096b3cbdfa325b1acd83d95b76ce345 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 18 Mar 2025 06:38:22 -0500 Subject: [PATCH 0547/1058] update --- dmz/external-dns/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/dmz/external-dns/values.yaml b/dmz/external-dns/values.yaml index f25b1e2..2052942 100644 --- a/dmz/external-dns/values.yaml +++ b/dmz/external-dns/values.yaml @@ -5,6 +5,8 @@ external-dns: image: pullPolicy: Always + txtPrefix: "dmz-" + sources: - service From 144d9d547a5053c76c78d561bd9dcc0058025b4b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 04:46:58 -0500 Subject: [PATCH 0548/1058] update --- dmz/internalproxy/templates/redlib.yaml | 136 ++++++++++++------------ 1 file changed, 68 insertions(+), 68 deletions(-) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index 6ab62a1..43f748c 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -1,68 +1,68 @@ -#apiVersion: v1 -#kind: Service -#metadata: -# name: redlib -#spec: -# ports: -# - name: app -# port: 8082 -# protocol: TCP -# targetPort: 8082 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: redlib -#subsets: -#- addresses: -# - ip: 192.168.20.200 -# ports: -# - name: app -# port: 8082 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: redlib-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`redlib.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: authentik-proxy-provider -# namespace: traefik -# kind: Rule -# services: -# - name: redlib -# port: 8082 -# - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) -# kind: Rule -# services: -# - name: ak-outpost-authentik-embedded-outpost -# namespace: authentik -# port: 9000 -# tls: -# secretName: redlib-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: redlib-tls -#spec: -# secretName: redlib-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "redlib.durp.info" -# dnsNames: -# - "redlib.durp.info" +apiVersion: v1 +kind: Service +metadata: + name: redlib +spec: + ports: + - name: app + port: 8082 + protocol: TCP + targetPort: 8082 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: redlib +subsets: +- addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8082 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: redlib-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`redlib.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: redlib + port: 8082 + - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-master-embedded-outpost + namespace: authentik + port: 9000 + tls: + secretName: redlib-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: redlib-tls +spec: + secretName: redlib-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "redlib.durp.info" + dnsNames: + - "redlib.durp.info" From 32dd761dc44f00fbc69aa039597590d47c84d5c9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 04:51:22 -0500 Subject: [PATCH 0549/1058] update --- dmz/traefik/templates/middleware.yaml | 35 +++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 dmz/traefik/templates/middleware.yaml diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml new file mode 100644 index 0000000..dfa36c4 --- /dev/null +++ b/dmz/traefik/templates/middleware.yaml @@ -0,0 +1,35 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: authentik-proxy-provider + namespace: traefik +spec: + forwardAuth: + address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: whitelist + namespace: traefik +spec: + ipWhiteList: + sourceRange: + - 192.168.0.0/16 + - 172.16.0.0/12 + - 10.0.0.0/8 From 78796fce97cd492252b6764096118dafaf564f69 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 04:52:06 -0500 Subject: [PATCH 0550/1058] update --- dmz/traefik/templates/middleware.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index dfa36c4..eea7444 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: authentik-proxy-provider @@ -22,7 +22,7 @@ spec: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: whitelist From f1d96f60c1c3bda8c1586b1ed6f765ac4706ec5a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 04:53:20 -0500 Subject: [PATCH 0551/1058] update --- dmz/internalproxy/templates/redlib.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index 43f748c..ae10b45 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -66,3 +66,15 @@ spec: commonName: "redlib.durp.info" dnsNames: - "redlib.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: redlib-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: redlib.durp.info +spec: + type: ExternalName + externalName: durp.info From c0b2f5ede3b0fb9043222270e19ddb8df7ea9388 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 04:55:15 -0500 Subject: [PATCH 0552/1058] update --- dmz/internalproxy/templates/redlib.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index ae10b45..e55907c 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -36,19 +36,19 @@ spec: - websecure routes: - match: Host(`redlib.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik + # middlewares: + # - name: authentik-proxy-provider + # namespace: traefik kind: Rule services: - name: redlib port: 8082 - - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-master-embedded-outpost - namespace: authentik - port: 9000 + # - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + # kind: Rule + # services: + # - name: ak-outpost-master-embedded-outpost + # namespace: authentik + # port: 9000 tls: secretName: redlib-tls From 47125c5d684f1a332fbf1540f1aeca49676f354a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 04:57:53 -0500 Subject: [PATCH 0553/1058] update --- dmz/internalproxy/templates/redlib.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index e55907c..8a4e5d5 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -19,7 +19,7 @@ metadata: name: redlib subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 8082 From b682553b27257073dc37fc7fd3abfa0478f620c1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 04:58:39 -0500 Subject: [PATCH 0554/1058] update --- dmz/internalproxy/templates/redlib.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index 8a4e5d5..8b041b9 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -36,19 +36,19 @@ spec: - websecure routes: - match: Host(`redlib.durp.info`) && PathPrefix(`/`) - # middlewares: - # - name: authentik-proxy-provider - # namespace: traefik + middlewares: + - name: authentik-proxy-provider + namespace: traefik kind: Rule services: - name: redlib port: 8082 - # - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - # kind: Rule - # services: - # - name: ak-outpost-master-embedded-outpost - # namespace: authentik - # port: 9000 + - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-master-embedded-outpost + namespace: authentik + port: 9000 tls: secretName: redlib-tls From e7c26050970aeeb857e885044bb619721320e0c2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:00:50 -0500 Subject: [PATCH 0555/1058] update --- dmz/authentik/Chart.yaml | 12 ++++++++++++ dmz/authentik/values.yaml | 30 ++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 dmz/authentik/Chart.yaml create mode 100644 dmz/authentik/values.yaml diff --git a/dmz/authentik/Chart.yaml b/dmz/authentik/Chart.yaml new file mode 100644 index 0000000..62c0fa1 --- /dev/null +++ b/dmz/authentik/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: authentik +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: authentik-remote-cluster + repository: https://charts.goauthentik.io + version: 2.0.0 diff --git a/dmz/authentik/values.yaml b/dmz/authentik/values.yaml new file mode 100644 index 0000000..83be2f9 --- /dev/null +++ b/dmz/authentik/values.yaml @@ -0,0 +1,30 @@ +authentik-remote-cluster: + # -- Provide a name in place of `authentik`. Prefer using global.nameOverride if possible + nameOverride: "" + # -- String to fully override `"authentik.fullname"`. Prefer using global.fullnameOverride if possible + fullnameOverride: "" + # -- Override the Kubernetes version, which is used to evaluate certain manifests + kubeVersionOverride: "" + + ## Globally shared configuration for authentik components. + global: + # -- Provide a name in place of `authentik` + nameOverride: "" + # -- String to fully override `"authentik.fullname"` + fullnameOverride: "" + # -- A custom namespace to override the default namespace for the deployed resources. + namespaceOverride: "" + # -- Common labels for all resources. + additionalLabels: {} + # app: authentik + + # -- Annotations to apply to all resources + annotations: {} + + serviceAccountSecret: + # -- Create a secret with the service account credentials + enabled: true + + clusterRole: + # -- Create a clusterole in addition to a namespaced role. + enabled: true From 55341ba0d6abddda1218b86994766d4d45f7ce47 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:01:38 -0500 Subject: [PATCH 0556/1058] update --- infra/argocd/templates/authentik.yaml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index 7c91765..4f4c684 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -22,3 +22,26 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: authentik-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/authentik + destination: + namespace: authentik + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From e6fa7ebb78d160ada8cbe1b551419e2be702f371 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:04:06 -0500 Subject: [PATCH 0557/1058] update --- infra/argocd/templates/authentik.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index 4f4c684..dce273e 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -37,7 +37,7 @@ spec: path: dmz/authentik destination: namespace: authentik - name: in-cluster + name: dmz syncPolicy: automated: prune: true From e3857454b73d2f7ec6e514512614399f15c6ecea Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:11:50 -0500 Subject: [PATCH 0558/1058] update --- dmz/internalproxy/templates/redlib.yaml | 2 +- dmz/traefik/templates/middleware.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index 8b041b9..f640070 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -46,7 +46,7 @@ spec: - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) kind: Rule services: - - name: ak-outpost-master-embedded-outpost + - name: ak-outpost-dmz-embedded-outpost namespace: authentik port: 9000 tls: diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index eea7444..7e95660 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: http://ak-outpost-dmz-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From 28ddc5cceaca439a114487f9d8fe06c2f519d948 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:13:25 -0500 Subject: [PATCH 0559/1058] update --- dmz/traefik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 02736ef..f0d0404 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -6,7 +6,7 @@ traefik: providers: kubernetesCRD: - allowCrossNamespace: false + allowCrossNamespace: true allowExternalNameServices: true allowEmptyServices: false From c24dcdfe2c1fb5654a21296ce9745f80c46d61bb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:22:46 -0500 Subject: [PATCH 0560/1058] update --- dmz/internalproxy/templates/speedtest.yaml | 148 ++++++++++----------- 1 file changed, 74 insertions(+), 74 deletions(-) diff --git a/dmz/internalproxy/templates/speedtest.yaml b/dmz/internalproxy/templates/speedtest.yaml index 59ca0ce..1eea45b 100644 --- a/dmz/internalproxy/templates/speedtest.yaml +++ b/dmz/internalproxy/templates/speedtest.yaml @@ -1,74 +1,74 @@ -#apiVersion: v1 -#kind: Service -#metadata: -# name: speedtest -#spec: -# ports: -# - name: app -# port: 6580 -# protocol: TCP -# targetPort: 6580 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: speedtest -#subsets: -#- addresses: -# - ip: 192.168.20.200 -# ports: -# - name: app -# port: 6580 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: speedtest-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) -# kind: Rule -# middlewares: -# - name: authentik-proxy-provider -# namespace: traefik -# services: -# - name: speedtest -# port: 6580 -# tls: -# secretName: speedtest-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: speedtest-tls -#spec: -# secretName: speedtest-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "speedtest.durp.info" -# dnsNames: -# - "speedtest.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: speedtest-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: v1 +kind: Service +metadata: + name: speedtest +spec: + ports: + - name: app + port: 6580 + protocol: TCP + targetPort: 6580 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: speedtest +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 6580 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: speedtest-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: speedtest + port: 6580 + tls: + secretName: speedtest-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: speedtest-tls +spec: + secretName: speedtest-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "speedtest.durp.info" + dnsNames: + - "speedtest.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: speedtest-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info +spec: + type: ExternalName + externalName: durp.info From 843f050195b81aa5bc97b97f878a2a38a3147bd7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:26:29 -0500 Subject: [PATCH 0561/1058] update --- dmz/internalproxy/templates/smokeping.yaml | 158 ++++++++++----------- 1 file changed, 76 insertions(+), 82 deletions(-) diff --git a/dmz/internalproxy/templates/smokeping.yaml b/dmz/internalproxy/templates/smokeping.yaml index dd58774..2d78b2f 100644 --- a/dmz/internalproxy/templates/smokeping.yaml +++ b/dmz/internalproxy/templates/smokeping.yaml @@ -1,82 +1,76 @@ -#apiVersion: v1 -#kind: Service -#metadata: -# name: smokeping -#spec: -# ports: -# - name: app -# port: 81 -# protocol: TCP -# targetPort: 81 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: smokeping -#subsets: -#- addresses: -# - ip: 192.168.20.200 -# ports: -# - name: app -# port: 81 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: smokeping-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: whitelist -# namespace: traefik -# - name: authentik-proxy-provider -# namespace: traefik -# kind: Rule -# services: -# - name: smokeping -# port: 81 -# - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) -# kind: Rule -# services: -# - name: ak-outpost-authentik-embedded-outpost -# namespace: authentik -# port: 9000 -# tls: -# secretName: smokeping-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: smokeping-tls -#spec: -# secretName: smokeping-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "smokeping.durp.info" -# dnsNames: -# - "smokeping.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: smokeping-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: v1 +kind: Service +metadata: + name: smokeping +spec: + ports: + - name: app + port: 81 + protocol: TCP + targetPort: 81 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: smokeping +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 81 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: smokeping-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: smokeping + port: 81 + tls: + secretName: smokeping-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: smokeping-tls +spec: + secretName: smokeping-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "smokeping.durp.info" + dnsNames: + - "smokeping.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: smokeping-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info +spec: + type: ExternalName + externalName: durp.info From f475828569ce4952a8a50890473ef7c51e48aaaf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:28:58 -0500 Subject: [PATCH 0562/1058] update --- dmz/internalproxy/templates/redlib.yaml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index f640070..eee1201 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -43,12 +43,6 @@ spec: services: - name: redlib port: 8082 - - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-dmz-embedded-outpost - namespace: authentik - port: 9000 tls: secretName: redlib-tls From 64c978a14fbd83ba47f1f0475268b798f4bad391 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:30:45 -0500 Subject: [PATCH 0563/1058] update --- dmz/cert-manager/templates/issuer.yaml | 12 ++-- dmz/internalproxy/templates/root-vault.yaml | 63 +++++++++++++++++++++ 2 files changed, 69 insertions(+), 6 deletions(-) create mode 100644 dmz/internalproxy/templates/root-vault.yaml diff --git a/dmz/cert-manager/templates/issuer.yaml b/dmz/cert-manager/templates/issuer.yaml index 9c204fb..0f8775b 100644 --- a/dmz/cert-manager/templates/issuer.yaml +++ b/dmz/cert-manager/templates/issuer.yaml @@ -1,6 +1,6 @@ -#apiVersion: v1 -#kind: ServiceAccount -#metadata: -# name: issuer -#secrets: -# - name: issuer-token-lmzpj +apiVersion: v1 +kind: ServiceAccount +metadata: + name: issuer +secrets: + - name: issuer-token-lmzpj diff --git a/dmz/internalproxy/templates/root-vault.yaml b/dmz/internalproxy/templates/root-vault.yaml new file mode 100644 index 0000000..af97b25 --- /dev/null +++ b/dmz/internalproxy/templates/root-vault.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: root-vault +spec: + ports: + - name: app + port: 8201 + protocol: TCP + targetPort: 8201 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: root-vault +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 8201 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: root-vault-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`root-vault.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: root-vault + port: 8201 + scheme: https + tls: + secretName: root-vault-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: root-vault-tls +spec: + secretName: root-vault-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "root-vault.internal.durp.info" + dnsNames: + - "root-vault.internal.durp.info" From 2f7b994044b1fe24452f81b2d4b489899bd5ed6b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:31:43 -0500 Subject: [PATCH 0564/1058] update --- dmz/internalproxy/templates/root-vault.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/root-vault.yaml b/dmz/internalproxy/templates/root-vault.yaml index af97b25..3f02c21 100644 --- a/dmz/internalproxy/templates/root-vault.yaml +++ b/dmz/internalproxy/templates/root-vault.yaml @@ -56,7 +56,7 @@ metadata: spec: secretName: root-vault-tls issuerRef: - name: letsencrypt-production + name: vault-issuer kind: ClusterIssuer commonName: "root-vault.internal.durp.info" dnsNames: From 1366c2e6b11d631e340c9a5009626527f96840f4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 05:32:22 -0500 Subject: [PATCH 0565/1058] update --- dmz/internalproxy/templates/root-vault.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/root-vault.yaml b/dmz/internalproxy/templates/root-vault.yaml index 3f02c21..d88bb26 100644 --- a/dmz/internalproxy/templates/root-vault.yaml +++ b/dmz/internalproxy/templates/root-vault.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: root-vault-ingress From 0d72b08ff2a822f5387958e71d16aaf8f4309e53 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 06:18:36 -0500 Subject: [PATCH 0566/1058] update --- dmz/cert-manager/templates/issuer.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/dmz/cert-manager/templates/issuer.yaml b/dmz/cert-manager/templates/issuer.yaml index 0f8775b..cf61c83 100644 --- a/dmz/cert-manager/templates/issuer.yaml +++ b/dmz/cert-manager/templates/issuer.yaml @@ -4,3 +4,13 @@ metadata: name: issuer secrets: - name: issuer-token-lmzpj + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: issuer-token-lmzpj + annotations: + kubernetes.io/service-account.name: issuer +type: kubernetes.io/service-account-token From c338eb860cf221c0698d82c2c1e63e877c90cadc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 19 Mar 2025 06:31:17 -0500 Subject: [PATCH 0567/1058] update --- dmz/cert-manager/templates/letsencrypt.yaml | 32 ++++++++++----------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/dmz/cert-manager/templates/letsencrypt.yaml b/dmz/cert-manager/templates/letsencrypt.yaml index 5c63095..0203412 100644 --- a/dmz/cert-manager/templates/letsencrypt.yaml +++ b/dmz/cert-manager/templates/letsencrypt.yaml @@ -17,19 +17,19 @@ spec: --- -#apiVersion: cert-manager.io/v1 -#kind: ClusterIssuer -#metadata: -# name: vault-issuer -#spec: -# vault: -# server: https://vault.infra.durp.info -# caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K -# path: pki/sign/issue-homelab-certs -# auth: -# kubernetes: -# mountPath: /v1/auth/kubernetes -# role: issuer -# secretRef: -# name: issuer-token-lmzpj -# key: token +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: vault-issuer +spec: + vault: + server: https://vault.infra.durp.info + caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + path: pki/sign/issue-homelab-certs + auth: + kubernetes: + mountPath: /v1/auth/kubernetes + role: issuer + secretRef: + name: issuer-token-lmzpj + key: token From 409d39dcc5ccd808276d140c7bb92a78e3eb611e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 04:46:44 -0500 Subject: [PATCH 0568/1058] update --- dmz/cert-manager/templates/letsencrypt.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/cert-manager/templates/letsencrypt.yaml b/dmz/cert-manager/templates/letsencrypt.yaml index 0203412..67a4e24 100644 --- a/dmz/cert-manager/templates/letsencrypt.yaml +++ b/dmz/cert-manager/templates/letsencrypt.yaml @@ -28,7 +28,7 @@ spec: path: pki/sign/issue-homelab-certs auth: kubernetes: - mountPath: /v1/auth/kubernetes + mountPath: /v1/auth/dmz role: issuer secretRef: name: issuer-token-lmzpj From 04e8cd913723b86e0313d89f7802db1607b97c64 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 04:47:26 -0500 Subject: [PATCH 0569/1058] update --- dmz/cert-manager/templates/letsencrypt.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/cert-manager/templates/letsencrypt.yaml b/dmz/cert-manager/templates/letsencrypt.yaml index 67a4e24..56b8374 100644 --- a/dmz/cert-manager/templates/letsencrypt.yaml +++ b/dmz/cert-manager/templates/letsencrypt.yaml @@ -28,7 +28,7 @@ spec: path: pki/sign/issue-homelab-certs auth: kubernetes: - mountPath: /v1/auth/dmz + mountPath: /v1/auth/dmz-cluster role: issuer secretRef: name: issuer-token-lmzpj From 1160ba317aabaa86fd452419348ea342f4a5cfae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 04:51:34 -0500 Subject: [PATCH 0570/1058] update --- dmz/internalproxy/templates/root-vault.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/root-vault.yaml b/dmz/internalproxy/templates/root-vault.yaml index d88bb26..c32ca62 100644 --- a/dmz/internalproxy/templates/root-vault.yaml +++ b/dmz/internalproxy/templates/root-vault.yaml @@ -19,7 +19,7 @@ metadata: name: root-vault subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 8201 From 6cd07850094ca40a573f824b54b92bcc8fb113e3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:10:35 -0500 Subject: [PATCH 0571/1058] update --- dmz/internalproxy/templates/duplicati.yaml | 64 ++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 dmz/internalproxy/templates/duplicati.yaml diff --git a/dmz/internalproxy/templates/duplicati.yaml b/dmz/internalproxy/templates/duplicati.yaml new file mode 100644 index 0000000..e62bd95 --- /dev/null +++ b/dmz/internalproxy/templates/duplicati.yaml @@ -0,0 +1,64 @@ +apiVersion: v1 +kind: Service +metadata: + name: duplicati +spec: + ports: + - name: app + port: 8200 + protocol: TCP + targetPort: 8200 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: duplicati +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8200 + protocol: TCP + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: duplicati-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: duplicati + port: 8200 + tls: + secretName: duplicati-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: duplicati-tls +spec: + secretName: duplicati-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "duplicati.internal.durp.info" + dnsNames: + - "duplicati.internal.durp.info" From 1e328b5644ed89710fa30d687b8d93239d2f68f3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:11:45 -0500 Subject: [PATCH 0572/1058] update --- dmz/internalproxy/templates/duplicati.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/duplicati.yaml b/dmz/internalproxy/templates/duplicati.yaml index e62bd95..d2563d0 100644 --- a/dmz/internalproxy/templates/duplicati.yaml +++ b/dmz/internalproxy/templates/duplicati.yaml @@ -27,7 +27,7 @@ subsets: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: duplicati-ingress From 296c837bde6c8556354dc999334f529f6b222d81 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:16:37 -0500 Subject: [PATCH 0573/1058] update --- dmz/internalproxy/templates/kuma.yaml | 42 +++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 dmz/internalproxy/templates/kuma.yaml diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml new file mode 100644 index 0000000..8ec8aa0 --- /dev/null +++ b/dmz/internalproxy/templates/kuma.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: kuma-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kuma.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: kuma-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kuma-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: kuma-tls + commonName: "kuma.durp.info" + dnsNames: + - "kuma.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: kuma-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kuma.durp.info +spec: + type: ExternalName + externalName: durp.info From ead660ccc9529417f5e929fa1cb1bfa09e9af28f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:17:42 -0500 Subject: [PATCH 0574/1058] update --- dmz/internalproxy/templates/kuma.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml index 8ec8aa0..3d30b82 100644 --- a/dmz/internalproxy/templates/kuma.yaml +++ b/dmz/internalproxy/templates/kuma.yaml @@ -9,7 +9,7 @@ spec: - match: Host(`kuma.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: infra-cluster + - name: master-cluster port: 443 tls: secretName: kuma-tls From b1e4fc4ee32324ecd08ec402b0edc5b658a6abbe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:18:45 -0500 Subject: [PATCH 0575/1058] updat --- dmz/internalproxy/templates/plex.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/plex.yaml b/dmz/internalproxy/templates/plex.yaml index 6f38d38..abbdabf 100644 --- a/dmz/internalproxy/templates/plex.yaml +++ b/dmz/internalproxy/templates/plex.yaml @@ -19,7 +19,7 @@ metadata: name: plex subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 32400 From 57d47c851399e5be8a8ce5e1dfe09e2b6777d76f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:27:52 -0500 Subject: [PATCH 0576/1058] update --- dmz/internalproxy/templates/kuma.yaml | 3 +++ master/uptimekuma/templates/ingress.yaml | 3 --- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml index 3d30b82..0651763 100644 --- a/dmz/internalproxy/templates/kuma.yaml +++ b/dmz/internalproxy/templates/kuma.yaml @@ -8,6 +8,9 @@ spec: routes: - match: Host(`kuma.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik services: - name: master-cluster port: 443 diff --git a/master/uptimekuma/templates/ingress.yaml b/master/uptimekuma/templates/ingress.yaml index 3df2689..86b65c8 100644 --- a/master/uptimekuma/templates/ingress.yaml +++ b/master/uptimekuma/templates/ingress.yaml @@ -7,9 +7,6 @@ spec: - websecure routes: - match: Host(`kuma.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik kind: Rule services: - name: service From 65b6f1b63b59dcc1242af6f79249e3b520b2cfab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:32:43 -0500 Subject: [PATCH 0577/1058] update --- dmz/internalproxy/templates/open-webui.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index 4d31b99..9ca866f 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -28,3 +28,15 @@ spec: commonName: "open-webui.durp.info" dnsNames: - "open-webui.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: plex-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info +spec: + type: ExternalName + externalName: durp.info From 64d8e1d9ef5795b06b0556fd7a35e0d48fdc88e5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:42:41 -0500 Subject: [PATCH 0578/1058] update --- dmz/internalproxy/templates/bitwarden.yaml | 42 ++++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 dmz/internalproxy/templates/bitwarden.yaml diff --git a/dmz/internalproxy/templates/bitwarden.yaml b/dmz/internalproxy/templates/bitwarden.yaml new file mode 100644 index 0000000..f36ac6e --- /dev/null +++ b/dmz/internalproxy/templates/bitwarden.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: bitwarden-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: master-cluster + port: 443 + tls: + secretName: bitwarden-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: bitwarden-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: bitwarden-tls + commonName: "bitwarden.durp.info" + dnsNames: + - "bitwarden.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: bitwarden-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info +spec: + type: ExternalName + externalName: durp.info From a88d9cf29cacdaa1a0ef26ba3540a06b4fbdee49 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:43:28 -0500 Subject: [PATCH 0579/1058] update --- dmz/internalproxy/templates/open-webui.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index 9ca866f..9236aba 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -34,7 +34,7 @@ spec: kind: Service apiVersion: v1 metadata: - name: plex-external-dns + name: open-webui-external-dns annotations: external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info spec: From 07577ce83603d48a237468e83cc7ad451d28621d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:47:29 -0500 Subject: [PATCH 0580/1058] update --- dmz/internalproxy/templates/portainer.yaml | 62 ++++++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 dmz/internalproxy/templates/portainer.yaml diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml new file mode 100644 index 0000000..2d13ca5 --- /dev/null +++ b/dmz/internalproxy/templates/portainer.yaml @@ -0,0 +1,62 @@ +apiVersion: v1 +kind: Service +metadata: + name: portainer +spec: + ports: + - name: app + port: 8200 + protocol: TCP + targetPort: 8200 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: portainer +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8200 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: portainer-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: portainer + port: 8200 + tls: + secretName: portainer-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: portainer-tls +spec: + secretName: portainer-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "portainer.internal.durp.info" + dnsNames: + - "portainer.internal.durp.info" From 6caf043848e37893e64b6659183dac8bb74b9447 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:49:06 -0500 Subject: [PATCH 0581/1058] update --- dmz/internalproxy/templates/portainer.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index 2d13ca5..9d58178 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 8200 + port: 9443 protocol: TCP - targetPort: 8200 + targetPort: 9443 clusterIP: None type: ClusterIP @@ -19,10 +19,10 @@ metadata: name: portainer subsets: - addresses: - - ip: 192.168.21.200 + - ip: 192.168.20.104 ports: - name: app - port: 8200 + port: 9443 protocol: TCP --- @@ -42,7 +42,7 @@ spec: kind: Rule services: - name: portainer - port: 8200 + port: 9443 tls: secretName: portainer-tls From f0252b7791cc1b4d5c0fde02308a5aefe0680ff4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:50:17 -0500 Subject: [PATCH 0582/1058] update --- dmz/internalproxy/templates/unifi.yaml | 63 ++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 dmz/internalproxy/templates/unifi.yaml diff --git a/dmz/internalproxy/templates/unifi.yaml b/dmz/internalproxy/templates/unifi.yaml new file mode 100644 index 0000000..d33a8af --- /dev/null +++ b/dmz/internalproxy/templates/unifi.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: unifi +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unifi +subsets: + - addresses: + - ip: 192.168.98.1 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: unifi-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`unifi.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: unifi + port: 443 + scheme: https + tls: + secretName: unifi-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: unifi-tls +spec: + secretName: unifi-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "unifi.internal.durp.info" + dnsNames: + - "unifi.internal.durp.info" From cf1ffc1c97498ea691715bc321ef8320d0f9d616 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 05:56:25 -0500 Subject: [PATCH 0583/1058] update --- dmz/internalproxy/templates/tdarr.yaml | 67 ++++++++++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 dmz/internalproxy/templates/tdarr.yaml diff --git a/dmz/internalproxy/templates/tdarr.yaml b/dmz/internalproxy/templates/tdarr.yaml new file mode 100644 index 0000000..c9ace7f --- /dev/null +++ b/dmz/internalproxy/templates/tdarr.yaml @@ -0,0 +1,67 @@ +apiVersion: v1 +kind: Service +metadata: + name: tdarr +spec: + ports: + - name: app + port: 8267 + protocol: TCP + targetPort: 8267 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: tdarr +subsets: +- addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8267 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: tdarr-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`tdarr.internal.durp.info`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: tdarr + port: 8267 + scheme: http + tls: + secretName: tdarr-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: tdarr-tls +spec: + secretName: tdarr-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "tdarr.internal.durp.info" + dnsNames: + - "tdarr.internal.durp.info" From 2fda7414f2164e8689a1e64366f788235bfd1637 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:00:05 -0500 Subject: [PATCH 0584/1058] update --- dmz/internalproxy/templates/registry.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml index a33997d..25f6261 100644 --- a/dmz/internalproxy/templates/registry.yaml +++ b/dmz/internalproxy/templates/registry.yaml @@ -19,7 +19,7 @@ metadata: name: registry subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 5000 From 48077bdce56cfb2b595740a65fef6b405628ff83 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:05:33 -0500 Subject: [PATCH 0585/1058] update --- master/argocd/templates/authentik.yaml | 42 +++++++++++++------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/master/argocd/templates/authentik.yaml b/master/argocd/templates/authentik.yaml index 5abfb3b..8d003fb 100644 --- a/master/argocd/templates/authentik.yaml +++ b/master/argocd/templates/authentik.yaml @@ -1,21 +1,21 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: authentik - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/authentik - destination: - namespace: authentik - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: authentik +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/authentik +# destination: +# namespace: authentik +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# From e4e0132735978b052ef8daebb77173c48abe9726 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:05:54 -0500 Subject: [PATCH 0586/1058] update --- master/argocd/templates/crossplane.yml | 40 +++++++++++++------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/master/argocd/templates/crossplane.yml b/master/argocd/templates/crossplane.yml index 91473eb..21d8835 100644 --- a/master/argocd/templates/crossplane.yml +++ b/master/argocd/templates/crossplane.yml @@ -1,20 +1,20 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: crossplane - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/crossplane - destination: - namespace: crossplane - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: crossplane +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/crossplane +# destination: +# namespace: crossplane +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true From 6678b38ad9058b499db5af81fb96ca2124cadb26 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:12:38 -0500 Subject: [PATCH 0587/1058] update --- master/argocd/templates/gatekeeper.yaml | 40 ++++++++++++------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/master/argocd/templates/gatekeeper.yaml b/master/argocd/templates/gatekeeper.yaml index d9a0265..e50e284 100644 --- a/master/argocd/templates/gatekeeper.yaml +++ b/master/argocd/templates/gatekeeper.yaml @@ -1,20 +1,20 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: gatekeeper - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/gatekeeper - destination: - namespace: gatekeeper - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: gatekeeper +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/gatekeeper +# destination: +# namespace: gatekeeper +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true From 9addbbde4b9350508430a07bc02085db8aab0de9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:13:38 -0500 Subject: [PATCH 0588/1058] update --- master/argocd/templates/InternalProxy.yaml | 46 +++++++++++----------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/master/argocd/templates/InternalProxy.yaml b/master/argocd/templates/InternalProxy.yaml index ca9bcc0..76c8229 100644 --- a/master/argocd/templates/InternalProxy.yaml +++ b/master/argocd/templates/InternalProxy.yaml @@ -1,23 +1,23 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: internalproxy - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/internalproxy - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: internalproxy - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: internalproxy +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/internalproxy +# directory: +# recurse: true +# destination: +# server: https://kubernetes.default.svc +# namespace: internalproxy +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# From 336880a9b0b2e5fe112d33249e63867c459e0f7a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:18:45 -0500 Subject: [PATCH 0589/1058] update --- dmz/gitlab-runner/Chart.yaml | 11 ++++ dmz/gitlab-runner/templates/secrets.yaml | 22 +++++++ dmz/gitlab-runner/values.yaml | 71 ++++++++++++++++++++++ master/argocd/templates/gitlab-runner.yaml | 42 ++++++------- 4 files changed, 125 insertions(+), 21 deletions(-) create mode 100644 dmz/gitlab-runner/Chart.yaml create mode 100644 dmz/gitlab-runner/templates/secrets.yaml create mode 100644 dmz/gitlab-runner/values.yaml diff --git a/dmz/gitlab-runner/Chart.yaml b/dmz/gitlab-runner/Chart.yaml new file mode 100644 index 0000000..f64e829 --- /dev/null +++ b/dmz/gitlab-runner/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: gitlab-runner +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: gitlab-runner + repository: https://charts.gitlab.io/ + version: 0.69.0 diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml new file mode 100644 index 0000000..8360d34 --- /dev/null +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: runner-registration-token + remoteRef: + key: secrets/gitlab/runner + property: runner-registration-token + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml new file mode 100644 index 0000000..9535eb7 --- /dev/null +++ b/dmz/gitlab-runner/values.yaml @@ -0,0 +1,71 @@ +gitlab-runner: + + image: + registry: registry.internal.durp.info + image: gitlab-org/gitlab-runner + + imagePullPolicy: Always + gitlabUrl: https://gitlab.com/ + unregisterRunner: false + terminationGracePeriodSeconds: 3600 + concurrent: 10 + checkInterval: 30 + + rbac: + create: true + rules: [] + clusterWideAccess: false + podSecurityPolicy: + enabled: false + resourceNames: + - gitlab-runner + + metrics: + enabled: true + serviceMonitor: + enabled: true + service: + enabled: true + annotations: {} + + runners: + config: | + [[runners]] + [runners.kubernetes] + namespace = "{{.Release.Namespace}}" + image = "ubuntu:22.04" + privileged = true + + executor: kubernetes + name: "k3s" + runUntagged: true + privileged: true + secret: gitlab-secret + #builds: + #cpuLimit: 200m + #cpuLimitOverwriteMaxAllowed: 400m + #memoryLimit: 256Mi + #memoryLimitOverwriteMaxAllowed: 512Mi + #cpuRequests: 100m + #cpuRequestsOverwriteMaxAllowed: 200m + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + privileged: false + capabilities: + drop: ["ALL"] + + podSecurityContext: + runAsUser: 100 + fsGroup: 65533 + + resources: + limits: + memory: 2Gi + requests: + memory: 128Mi + cpu: 500m diff --git a/master/argocd/templates/gitlab-runner.yaml b/master/argocd/templates/gitlab-runner.yaml index 13f4ebd..8a1afec 100644 --- a/master/argocd/templates/gitlab-runner.yaml +++ b/master/argocd/templates/gitlab-runner.yaml @@ -1,21 +1,21 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: gitlab-runner - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/gitlab-runner - destination: - namespace: gitlab-runner - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: gitlab-runner +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/gitlab-runner +# destination: +# namespace: gitlab-runner +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# From 22e9d5a08e3093501fea0575a4ff82526388e3d8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:20:32 -0500 Subject: [PATCH 0590/1058] update --- infra/argocd/templates/gitlab-runner.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 infra/argocd/templates/gitlab-runner.yaml diff --git a/infra/argocd/templates/gitlab-runner.yaml b/infra/argocd/templates/gitlab-runner.yaml new file mode 100644 index 0000000..de73c0c --- /dev/null +++ b/infra/argocd/templates/gitlab-runner.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: gitlab-runner-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/gitlab-runner + destination: + namespace: gitlab-runner + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From 5efe416248b5216d8a18faa711d5a3f2c81000de Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:21:53 -0500 Subject: [PATCH 0591/1058] update --- dmz/gitlab-runner/templates/secrets.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml index 8360d34..14517ab 100644 --- a/dmz/gitlab-runner/templates/secrets.yaml +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -11,7 +11,7 @@ spec: data: - secretKey: runner-registration-token remoteRef: - key: secrets/gitlab/runner + key: kv/gitlab/runner property: runner-registration-token --- From e5007648b69065ab60d20ae6967bc4e4e95d5789 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:25:50 -0500 Subject: [PATCH 0592/1058] update --- dmz/gitlab-runner/templates/secrets.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml index 14517ab..5bf0f42 100644 --- a/dmz/gitlab-runner/templates/secrets.yaml +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -13,6 +13,10 @@ spec: remoteRef: key: kv/gitlab/runner property: runner-registration-token + - secretKey: runner-token + remoteRef: + key: kv/gitlab/runner + property: runner-token --- From b0a9deb35f5d1af305b81602b60c20ab37b95ad0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 20 Mar 2025 06:27:21 -0500 Subject: [PATCH 0593/1058] update --- dmz/gitlab-runner/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml index 9535eb7..1f2d9bd 100644 --- a/dmz/gitlab-runner/values.yaml +++ b/dmz/gitlab-runner/values.yaml @@ -1,7 +1,7 @@ gitlab-runner: image: - registry: registry.internal.durp.info + registry: registry.durp.info image: gitlab-org/gitlab-runner imagePullPolicy: Always From 698daaab4c4b70c209ac9202afba8f66ea3793fd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 04:49:13 -0500 Subject: [PATCH 0594/1058] update --- dmz/external-secrets/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index e95fec6..304180d 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -13,7 +13,7 @@ external-secrets: enabled: false image: - repository: registry.internal.durp.info/external-secrets/external-secrets + repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always extraVolumes: @@ -41,7 +41,7 @@ external-secrets: log: level: debug image: - repository: registry.internal.durp.info/external-secrets/external-secrets + repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always extraVolumes: @@ -70,7 +70,7 @@ external-secrets: level: debug image: - repository: registry.internal.durp.info/external-secrets/external-secrets + repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always tag: "" From 9514e7c27ce8f3250b6ec98bf2b1562156c89d9b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:01:31 -0500 Subject: [PATCH 0595/1058] update --- dmz/gitlab-runner/Chart.yaml | 4 ++ dmz/gitlab-runner/templates/secrets.yaml | 18 ++++++ dmz/gitlab-runner/values.yaml | 72 ++++++++++++++++++++++++ 3 files changed, 94 insertions(+) diff --git a/dmz/gitlab-runner/Chart.yaml b/dmz/gitlab-runner/Chart.yaml index f64e829..35d92ec 100644 --- a/dmz/gitlab-runner/Chart.yaml +++ b/dmz/gitlab-runner/Chart.yaml @@ -9,3 +9,7 @@ dependencies: - name: gitlab-runner repository: https://charts.gitlab.io/ version: 0.69.0 +- name: gitlab-runner + repository: https://charts.gitlab.io/ + version: 0.69.0 + alias: personal diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml index 5bf0f42..5e1b045 100644 --- a/dmz/gitlab-runner/templates/secrets.yaml +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -24,3 +24,21 @@ apiVersion: v1 kind: ServiceAccount metadata: name: vault + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-secret-personal +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: runner-token + remoteRef: + key: kv/gitlab/runner + property: runner-token-personal diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml index 1f2d9bd..cbf56dc 100644 --- a/dmz/gitlab-runner/values.yaml +++ b/dmz/gitlab-runner/values.yaml @@ -69,3 +69,75 @@ gitlab-runner: requests: memory: 128Mi cpu: 500m + +personal: + + image: + registry: registry.durp.info + image: gitlab-org/gitlab-runner + + imagePullPolicy: Always + gitlabUrl: https://gitlab.com/ + unregisterRunner: false + terminationGracePeriodSeconds: 3600 + concurrent: 10 + checkInterval: 30 + + rbac: + create: true + rules: [] + clusterWideAccess: false + podSecurityPolicy: + enabled: false + resourceNames: + - gitlab-runner + + metrics: + enabled: true + serviceMonitor: + enabled: true + service: + enabled: true + annotations: {} + + runners: + config: | + [[runners]] + [runners.kubernetes] + namespace = "{{.Release.Namespace}}" + image = "ubuntu:22.04" + privileged = true + + executor: kubernetes + name: "k3s" + runUntagged: true + privileged: true + secret: gitlab-secret-personal + #builds: + #cpuLimit: 200m + #cpuLimitOverwriteMaxAllowed: 400m + #memoryLimit: 256Mi + #memoryLimitOverwriteMaxAllowed: 512Mi + #cpuRequests: 100m + #cpuRequestsOverwriteMaxAllowed: 200m + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi + + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + privileged: false + capabilities: + drop: ["ALL"] + + podSecurityContext: + runAsUser: 100 + fsGroup: 65533 + + resources: + limits: + memory: 2Gi + requests: + memory: 128Mi + cpu: 500m From 8949f640b7b694d1aae92ff736de172f52f8775c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:03:43 -0500 Subject: [PATCH 0596/1058] update --- dmz/gitlab-runner/templates/secrets.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml index 5e1b045..02f4e4c 100644 --- a/dmz/gitlab-runner/templates/secrets.yaml +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -41,4 +41,4 @@ spec: - secretKey: runner-token remoteRef: key: kv/gitlab/runner - property: runner-token-personal + property: personal-runner-token From d9e448249eb820791ea35870a9d0d28b60dc93a8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:05:26 -0500 Subject: [PATCH 0597/1058] update --- dmz/gitlab-runner/templates/secrets.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml index 02f4e4c..e847ede 100644 --- a/dmz/gitlab-runner/templates/secrets.yaml +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -36,7 +36,7 @@ spec: name: vault kind: ClusterSecretStore target: - name: gitlab-secret + name: gitlab-secret-personal data: - secretKey: runner-token remoteRef: From cd8f0e32d78185d8d45117515abb7f5c257db049 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:07:24 -0500 Subject: [PATCH 0598/1058] update --- dmz/gitlab-runner/templates/secrets.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml index e847ede..cad8394 100644 --- a/dmz/gitlab-runner/templates/secrets.yaml +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -42,3 +42,7 @@ spec: remoteRef: key: kv/gitlab/runner property: personal-runner-token + - secretKey: runner-registration-token + remoteRef: + key: kv/gitlab/runner + property: personal-runner-token From f248087e8033a86dd1c2fba32b3e068a99261f09 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:12:52 -0500 Subject: [PATCH 0599/1058] update --- dmz/internalproxy/templates/proxmox.yaml | 63 ++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 dmz/internalproxy/templates/proxmox.yaml diff --git a/dmz/internalproxy/templates/proxmox.yaml b/dmz/internalproxy/templates/proxmox.yaml new file mode 100644 index 0000000..14d301d --- /dev/null +++ b/dmz/internalproxy/templates/proxmox.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: proxmox +spec: + ports: + - name: app + port: 8006 + protocol: TCP + targetPort: 8006 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: proxmox +subsets: + - addresses: + - ip: 192.168.21.254 + ports: + - name: app + port: 8006 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: proxmox-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: proxmox + port: 8006 + scheme: https + tls: + secretName: proxmox-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: proxmox-tls +spec: + secretName: proxmox-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "proxmox.internal.durp.info" + dnsNames: + - "proxmox.internal.durp.info" From 83ff1238ac8964f0ea7cde31f4f6322c4fd200fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:16:40 -0500 Subject: [PATCH 0600/1058] update --- dmz/internalproxy/templates/unraid.yaml | 64 +++++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 dmz/internalproxy/templates/unraid.yaml diff --git a/dmz/internalproxy/templates/unraid.yaml b/dmz/internalproxy/templates/unraid.yaml new file mode 100644 index 0000000..4f3eada --- /dev/null +++ b/dmz/internalproxy/templates/unraid.yaml @@ -0,0 +1,64 @@ + +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - name: app + port: 443 + protocol: TCP + targetPort: 443 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.21.254 + ports: + - name: app + port: 443 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: unraid-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: unraid + port: 443 + scheme: https + tls: + secretName: unraid-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: unraid-tls +spec: + secretName: unraid-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "unraid.internal.durp.info" + dnsNames: + - "unraid.internal.durp.info" From fa8d36f4b0f88be71b9cef15688cb11f8a962d73 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:20:36 -0500 Subject: [PATCH 0601/1058] update --- dmz/internalproxy/templates/unraid.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/unraid.yaml b/dmz/internalproxy/templates/unraid.yaml index 4f3eada..f79f4a8 100644 --- a/dmz/internalproxy/templates/unraid.yaml +++ b/dmz/internalproxy/templates/unraid.yaml @@ -20,7 +20,7 @@ metadata: name: unraid subsets: - addresses: - - ip: 192.168.21.254 + - ip: 192.168.21.200 ports: - name: app port: 443 From d5b9b82f471a2c200cc9a1eb304c45f5e07170c2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:37:33 -0500 Subject: [PATCH 0602/1058] update --- dmz/internalproxy/templates/s3.yaml | 63 +++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 dmz/internalproxy/templates/s3.yaml diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml new file mode 100644 index 0000000..ceb437e --- /dev/null +++ b/dmz/internalproxy/templates/s3.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: s3 +spec: + ports: + - name: app + port: 9768 + protocol: TCP + targetPort: 9768 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: s3 +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 9768 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: s3-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: s3 + port: 9768 + scheme: http + tls: + secretName: s3-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: s3-tls +spec: + secretName: s3-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "s3.internal.durp.info" + dnsNames: + - "s3.internal.durp.info" From 3809150c22d75ee0780f77eca47cdce225c5a145 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:39:56 -0500 Subject: [PATCH 0603/1058] update --- dmz/internalproxy/templates/minio.yaml | 63 ++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 dmz/internalproxy/templates/minio.yaml diff --git a/dmz/internalproxy/templates/minio.yaml b/dmz/internalproxy/templates/minio.yaml new file mode 100644 index 0000000..f6aaa1e --- /dev/null +++ b/dmz/internalproxy/templates/minio.yaml @@ -0,0 +1,63 @@ +apiVersion: v1 +kind: Service +metadata: + name: minio +spec: + ports: + - name: app + port: 9769 + protocol: TCP + targetPort: 9769 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: minio +subsets: + - addresses: + - ip: 192.168.20.200 + ports: + - name: app + port: 9769 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: minio-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: minio + port: 9769 + scheme: http + tls: + secretName: minio-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: minio-tls +spec: + secretName: minio-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "minio.internal.durp.info" + dnsNames: + - "minio.internal.durp.info" From fcf1e095d7547310a82822b79fc1ac90c4929a9e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 21 Mar 2025 05:41:02 -0500 Subject: [PATCH 0604/1058] ujpdate --- dmz/internalproxy/templates/minio.yaml | 2 +- dmz/internalproxy/templates/s3.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/minio.yaml b/dmz/internalproxy/templates/minio.yaml index f6aaa1e..c30a923 100644 --- a/dmz/internalproxy/templates/minio.yaml +++ b/dmz/internalproxy/templates/minio.yaml @@ -19,7 +19,7 @@ metadata: name: minio subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 9769 diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index ceb437e..bf6ecc0 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -19,7 +19,7 @@ metadata: name: s3 subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 9768 From a970df0de1ad3550815c82e083e840b24ca76fd2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 08:05:48 -0500 Subject: [PATCH 0605/1058] update --- dmz/internalproxy/templates/semaphore.yaml | 64 ++++++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 dmz/internalproxy/templates/semaphore.yaml diff --git a/dmz/internalproxy/templates/semaphore.yaml b/dmz/internalproxy/templates/semaphore.yaml new file mode 100644 index 0000000..2f384a1 --- /dev/null +++ b/dmz/internalproxy/templates/semaphore.yaml @@ -0,0 +1,64 @@ + +apiVersion: v1 +kind: Service +metadata: + name: semaphore +spec: + ports: + - name: app + port: 3001 + protocol: TCP + targetPort: 3001 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: semaphore +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 3001 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: semaphore-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + kind: Rule + services: + - name: semaphore + port: 3001 + scheme: https + tls: + secretName: semaphore-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: semaphore-tls +spec: + secretName: semaphore-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "semaphore.internal.durp.info" + dnsNames: + - "semaphore.internal.durp.info" From c95b6fc3d22cd7e52a9bb0488b9b16756caaa808 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 08:06:59 -0500 Subject: [PATCH 0606/1058] update --- dmz/internalproxy/templates/semaphore.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/semaphore.yaml b/dmz/internalproxy/templates/semaphore.yaml index 2f384a1..3005b94 100644 --- a/dmz/internalproxy/templates/semaphore.yaml +++ b/dmz/internalproxy/templates/semaphore.yaml @@ -44,7 +44,7 @@ spec: services: - name: semaphore port: 3001 - scheme: https + scheme: http tls: secretName: semaphore-tls From c52743df54b129888fc86ce71e7a5a0d90f8dcd6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 10:52:27 -0500 Subject: [PATCH 0607/1058] update --- infra/argocd/templates/nebula-sync.yaml | 20 +++++ infra/nebula-sync/Chart.yaml | 7 ++ infra/nebula-sync/templates/deployment.yaml | 84 +++++++++++++++++++++ infra/nebula-sync/templates/secrets.yaml | 27 +++++++ 4 files changed, 138 insertions(+) create mode 100644 infra/argocd/templates/nebula-sync.yaml create mode 100644 infra/nebula-sync/Chart.yaml create mode 100644 infra/nebula-sync/templates/deployment.yaml create mode 100644 infra/nebula-sync/templates/secrets.yaml diff --git a/infra/argocd/templates/nebula-sync.yaml b/infra/argocd/templates/nebula-sync.yaml new file mode 100644 index 0000000..dea50a7 --- /dev/null +++ b/infra/argocd/templates/nebula-sync.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: nebula-sync + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/nebula-sync + destination: + namespace: nebula-sync + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/nebula-sync/Chart.yaml b/infra/nebula-sync/Chart.yaml new file mode 100644 index 0000000..114f728 --- /dev/null +++ b/infra/nebula-sync/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: nebula-sync +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/infra/nebula-sync/templates/deployment.yaml b/infra/nebula-sync/templates/deployment.yaml new file mode 100644 index 0000000..08a39a0 --- /dev/null +++ b/infra/nebula-sync/templates/deployment.yaml @@ -0,0 +1,84 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: nebula-sync + name: nebula-sync + labels: + app: nebula-sync +spec: + selector: + matchLabels: + app: nebula-sync + replicas: 1 + template: + metadata: + labels: + app: nebula-sync + spec: + volumes: + - name: nebula-sync-configmap + configMap: + name: nebula-sync-configmap + items: + - key: .env + path: .env + containers: + - name: nebula-sync + image: registry.durp.info/lovelaze/nebula-sync:latest + imagePullPolicy: Always + volumeMounts: + - mountPath: /app + name: .env + env: + - name: PRIMARY + valueFrom: + secretKeyRef: + name: nebula-sync-secret + key: ADMIN_TOKEN + - name: REPLICAS + valueFrom: + secretKeyRef: + name: nebula-sync-secret + key: ADMIN_TOKEN + + - name: FULL_SYNC + value: false + - name: RUN_GRAVITY + value: false + - name: CRON + value: "*/15 * * * *" + - name: CLIENT_SKIP_TLS_VERIFICATION + value: true + - name: TZ + value: America/Chicago + - name: SYNC_CONFIG_DNS + value: true + - name: SYNC_CONFIG_DHCP + value: true + - name: SYNC_CONFIG_NTP + value: true + - name: SYNC_CONFIG_RESOLVER + value: true + - name: SYNC_CONFIG_DATABASE + value: true + - name: SYNC_CONFIG_MISC + value: true + - name: SYNC_CONFIG_DEBUG + value: true + - name: SYNC_GRAVITY_DHCP_LEASES + value: true + - name: SYNC_GRAVITY_GROUP + value: true + - name: SYNC_GRAVITY_AD_LIST + value: true + - name: SYNC_GRAVITY_AD_LIST_BY_GROUP + value: true + - name: SYNC_GRAVITY_DOMAIN_LIST + value: true + - name: SYNC_GRAVITY_DOMAIN_LIST_BY_GROUP + value: true + - name: SYNC_GRAVITY_CLIENT + value: true + - name: SYNC_GRAVITY_CLIENT_BY_GROUP + value: true + diff --git a/infra/nebula-sync/templates/secrets.yaml b/infra/nebula-sync/templates/secrets.yaml new file mode 100644 index 0000000..fa841a3 --- /dev/null +++ b/infra/nebula-sync/templates/secrets.yaml @@ -0,0 +1,27 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: nebula-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: nebula-secret + data: + - secretKey: primary + remoteRef: + key: kv/pihole + property: primary + - secretKey: replicas + remoteRef: + key: kv/pihole + property: replicas + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + From 59db1a9a9f45763d3108b16d33d39b34915dfdf4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 10:53:47 -0500 Subject: [PATCH 0608/1058] update --- infra/nebula-sync/templates/deployment.yaml | 36 ++++++++++----------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/infra/nebula-sync/templates/deployment.yaml b/infra/nebula-sync/templates/deployment.yaml index 08a39a0..c91cf3a 100644 --- a/infra/nebula-sync/templates/deployment.yaml +++ b/infra/nebula-sync/templates/deployment.yaml @@ -42,43 +42,43 @@ spec: key: ADMIN_TOKEN - name: FULL_SYNC - value: false + value: "false" - name: RUN_GRAVITY - value: false + value: "false" - name: CRON value: "*/15 * * * *" - name: CLIENT_SKIP_TLS_VERIFICATION - value: true + value: "true" - name: TZ value: America/Chicago - name: SYNC_CONFIG_DNS - value: true + value: "true" - name: SYNC_CONFIG_DHCP - value: true + value: "true" - name: SYNC_CONFIG_NTP - value: true + value: "true" - name: SYNC_CONFIG_RESOLVER - value: true + value: "true" - name: SYNC_CONFIG_DATABASE - value: true + value: "true" - name: SYNC_CONFIG_MISC - value: true + value: "true" - name: SYNC_CONFIG_DEBUG - value: true + value: "true" - name: SYNC_GRAVITY_DHCP_LEASES - value: true + value: "true" - name: SYNC_GRAVITY_GROUP - value: true + value: "true" - name: SYNC_GRAVITY_AD_LIST - value: true + value: "true" - name: SYNC_GRAVITY_AD_LIST_BY_GROUP - value: true + value: "true" - name: SYNC_GRAVITY_DOMAIN_LIST - value: true + value: "true" - name: SYNC_GRAVITY_DOMAIN_LIST_BY_GROUP - value: true + value: "true" - name: SYNC_GRAVITY_CLIENT - value: true + value: "true" - name: SYNC_GRAVITY_CLIENT_BY_GROUP - value: true + value: "true" From 584ba8d8f06aa4f3632b95426d05df67938ba4e5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 10:54:21 -0500 Subject: [PATCH 0609/1058] update --- infra/nebula-sync/templates/deployment.yaml | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/infra/nebula-sync/templates/deployment.yaml b/infra/nebula-sync/templates/deployment.yaml index c91cf3a..df8804f 100644 --- a/infra/nebula-sync/templates/deployment.yaml +++ b/infra/nebula-sync/templates/deployment.yaml @@ -15,20 +15,10 @@ spec: labels: app: nebula-sync spec: - volumes: - - name: nebula-sync-configmap - configMap: - name: nebula-sync-configmap - items: - - key: .env - path: .env containers: - name: nebula-sync image: registry.durp.info/lovelaze/nebula-sync:latest imagePullPolicy: Always - volumeMounts: - - mountPath: /app - name: .env env: - name: PRIMARY valueFrom: @@ -40,7 +30,6 @@ spec: secretKeyRef: name: nebula-sync-secret key: ADMIN_TOKEN - - name: FULL_SYNC value: "false" - name: RUN_GRAVITY From 0c32bafdd99be6f7b10b700c121d465bb8db8a7e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 10:54:56 -0500 Subject: [PATCH 0610/1058] update --- infra/nebula-sync/templates/secrets.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/nebula-sync/templates/secrets.yaml b/infra/nebula-sync/templates/secrets.yaml index fa841a3..3b88885 100644 --- a/infra/nebula-sync/templates/secrets.yaml +++ b/infra/nebula-sync/templates/secrets.yaml @@ -1,13 +1,13 @@ apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: - name: nebula-secret + name: nebula-sync-secret spec: secretStoreRef: name: vault kind: ClusterSecretStore target: - name: nebula-secret + name: nebula-sync-secret data: - secretKey: primary remoteRef: From f1580bfc60f74640c275972420669a0d3cef6890 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 10:55:59 -0500 Subject: [PATCH 0611/1058] update --- infra/nebula-sync/templates/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/nebula-sync/templates/deployment.yaml b/infra/nebula-sync/templates/deployment.yaml index df8804f..51e2607 100644 --- a/infra/nebula-sync/templates/deployment.yaml +++ b/infra/nebula-sync/templates/deployment.yaml @@ -24,12 +24,12 @@ spec: valueFrom: secretKeyRef: name: nebula-sync-secret - key: ADMIN_TOKEN + key: primary - name: REPLICAS valueFrom: secretKeyRef: name: nebula-sync-secret - key: ADMIN_TOKEN + key: replicas - name: FULL_SYNC value: "false" - name: RUN_GRAVITY From 7b2558d492fb8c674105a56b109bbaa96cfd871a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 15:35:58 -0500 Subject: [PATCH 0612/1058] update --- infra/argocd/templates/argocd.yaml | 52 +++++++++++++++++------------- 1 file changed, 29 insertions(+), 23 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index e20344b..c0f3cbb 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -21,23 +21,23 @@ spec: --- -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: vault-argocd -# labels: -# app.kubernetes.io/part-of: argocd -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: client-secret -# data: -# - secretKey: clientSecret -# remoteRef: -# key: secrets/argocd/authentik -# property: clientsecret +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: vault-argocd + labels: + app.kubernetes.io/part-of: argocd +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: client-secret + data: + - secretKey: clientSecret + remoteRef: + key: kv/authentik/argocd + property: clientsecret --- @@ -45,16 +45,14 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: argocd-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production spec: entryPoints: - websecure routes: - match: Host(`argocd.infra.durp.info`) - #middlewares: - # - name: whitelist - # namespace: traefik + middlewares: + - name: whitelist + namespace: traefik kind: Rule services: - name: argocd-server @@ -76,4 +74,12 @@ spec: kind: ClusterIssuer commonName: "argocd.infra.durp.info" dnsNames: - - "argocd.infra.durp.info" \ No newline at end of file + - "argocd.infra.durp.info" + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + From 79bff35307093b93e18cac21d31b67d5ec085748 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 15:41:05 -0500 Subject: [PATCH 0613/1058] update --- infra/traefik/templates/middleware.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 infra/traefik/templates/middleware.yaml diff --git a/infra/traefik/templates/middleware.yaml b/infra/traefik/templates/middleware.yaml new file mode 100644 index 0000000..cb729ab --- /dev/null +++ b/infra/traefik/templates/middleware.yaml @@ -0,0 +1,11 @@ +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: whitelist + namespace: traefik +spec: + ipWhiteList: + sourceRange: + - 192.168.0.0/16 + - 172.16.0.0/12 + - 10.0.0.0/8 From c7763fbe48973d498c76d4a73002601d9bf61671 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 15:43:17 -0500 Subject: [PATCH 0614/1058] update --- infra/traefik/values.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/traefik/values.yaml b/infra/traefik/values.yaml index 3d2576e..3c75dd1 100644 --- a/infra/traefik/values.yaml +++ b/infra/traefik/values.yaml @@ -3,6 +3,12 @@ traefik: registry: registry.durp.info repository: traefik pullPolicy: Always + + providers: + kubernetesCRD: + allowCrossNamespace: true + allowExternalNameServices: true + allowEmptyServices: false deployment: replicas: 3 From f172469d920518b9deb7ae8d77733a55fd024ec3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 15:44:38 -0500 Subject: [PATCH 0615/1058] update --- infra/argocd/templates/argocd.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index c0f3cbb..683db03 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -50,9 +50,9 @@ spec: - websecure routes: - match: Host(`argocd.infra.durp.info`) - middlewares: - - name: whitelist - namespace: traefik + #middlewares: + # - name: whitelist + # namespace: traefik kind: Rule services: - name: argocd-server From bd406e4ce14cc754823763dacb414a4749f628cd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 22 Mar 2025 15:45:44 -0500 Subject: [PATCH 0616/1058] update --- infra/argocd/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 24924a5..442b8c5 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -33,7 +33,7 @@ argo-cd: cm: create: true annotations: {} - url: https://argocd.internal.durp.info + url: https://argocd.infra.durp.info oidc.tls.insecure.skip.verify: "true" dex.config: | connectors: From 85bf89b4e8f4cba5021a87acf88e4efabf03ae27 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 23 Mar 2025 08:27:44 -0500 Subject: [PATCH 0617/1058] update --- dmz/internalproxy/templates/portainer.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index 9d58178..1094708 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -36,9 +36,9 @@ spec: - websecure routes: - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik + #middlewares: + #- name: whitelist + # namespace: traefik kind: Rule services: - name: portainer From 95f07b94034b611d3f5c37528419a20e5a211f09 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 23 Mar 2025 08:29:56 -0500 Subject: [PATCH 0618/1058] update --- dmz/internalproxy/templates/portainer.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index 1094708..c27e0ff 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -43,6 +43,7 @@ spec: services: - name: portainer port: 9443 + scheme: https tls: secretName: portainer-tls From d6563a7dbc346cc54692dc4cdf49a57b363568eb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 23 Mar 2025 08:32:55 -0500 Subject: [PATCH 0619/1058] update --- dmz/internalproxy/templates/s3.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index bf6ecc0..5fb2506 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -56,7 +56,7 @@ metadata: spec: secretName: s3-tls issuerRef: - name: vault-issuer + name: letsencrypt-production kind: ClusterIssuer commonName: "s3.internal.durp.info" dnsNames: From e542d2941e1eba46724c2bd003506b9ed3b3834a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Mar 2025 04:48:11 -0500 Subject: [PATCH 0620/1058] update --- infra/external-secrets/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 7de64de..c5068a8 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -13,7 +13,7 @@ external-secrets: enabled: false image: - repository: registry.internal.durp.info/external-secrets/external-secrets + repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always extraVolumes: @@ -39,7 +39,7 @@ external-secrets: log: level: debug image: - repository: registry.internal.durp.info/external-secrets/external-secrets + repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always resources: @@ -57,7 +57,7 @@ external-secrets: level: debug image: - repository: registry.internal.durp.info/external-secrets/external-secrets + repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always tag: "" From 4a2fcd11a0c189db0d82483ba2b5ec21285f411a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Mar 2025 04:50:51 -0500 Subject: [PATCH 0621/1058] update --- infra/argocd/templates/istio.yaml | 50 +++++++++++++++---------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index 808d46a..9a33f34 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -26,28 +26,28 @@ spec: --- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: istio-system-dmz - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: dmz/istio-system - destination: - namespace: istio-system - name: dmz - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ignoreDifferences: - - group: admissionregistration.k8s.io - kind: ValidatingWebhookConfiguration - jsonPointers: - - /webhooks/0/failurePolicy +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: istio-system-dmz +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: dmz/istio-system +# destination: +# namespace: istio-system +# name: dmz +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# ignoreDifferences: +# - group: admissionregistration.k8s.io +# kind: ValidatingWebhookConfiguration +# jsonPointers: +# - /webhooks/0/failurePolicy From 29042353567b6dfef7cb5239615f7ccdbc98b8fa Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Mar 2025 04:51:49 -0500 Subject: [PATCH 0622/1058] update --- infra/litellm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index baf487c..9051cff 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: "litellm-helm" version: 0.1.636 - repository: oci://ghcr.io/berriai/litellm-helm + repository: https://ghcr.io/berriai/litellm-helm From 0b1aec8ea1ed6ac9f02bc0fc18bb1843b15a56d6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Mar 2025 04:54:11 -0500 Subject: [PATCH 0623/1058] update --- infra/litellm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index 9051cff..baf487c 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: "litellm-helm" version: 0.1.636 - repository: https://ghcr.io/berriai/litellm-helm + repository: oci://ghcr.io/berriai/litellm-helm From 51c63131f7c3adbd86509e42f7b00669c9685a1a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Mar 2025 04:56:36 -0500 Subject: [PATCH 0624/1058] update --- infra/litellm/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/litellm/Chart.yaml b/infra/litellm/Chart.yaml index baf487c..1444a2c 100644 --- a/infra/litellm/Chart.yaml +++ b/infra/litellm/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: "litellm-helm" - version: 0.1.636 + version: 0.1.643 repository: oci://ghcr.io/berriai/litellm-helm From d3ee85912cb0b44eefeb86544eb6de9a80d3f03a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Mar 2025 06:11:23 -0500 Subject: [PATCH 0625/1058] update --- dmz/internalproxy/templates/litellm.yaml | 71 ++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 dmz/internalproxy/templates/litellm.yaml diff --git a/dmz/internalproxy/templates/litellm.yaml b/dmz/internalproxy/templates/litellm.yaml new file mode 100644 index 0000000..e70cbd8 --- /dev/null +++ b/dmz/internalproxy/templates/litellm.yaml @@ -0,0 +1,71 @@ +apiVersion: v1 +kind: Service +metadata: + name: litellm +spec: + ports: + - name: app + port: 4000 + protocol: TCP + targetPort: 4000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: litellm +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 4000 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: litellm-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`litellm.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: litellm + port: 4000 + tls: + secretName: litellm-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: litellm-tls +spec: + secretName: litellm-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "litellm.durp.info" + dnsNames: + - "litellm.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: litellm-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: litellm.durp.info +spec: + type: ExternalName + externalName: durp.info From eacbe21387f2cc566e67de9d964ad28c59c7cc36 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 24 Mar 2025 06:34:50 -0500 Subject: [PATCH 0626/1058] update --- dmz/internalproxy/templates/ollama.yaml | 204 ++++++++++++------------ 1 file changed, 102 insertions(+), 102 deletions(-) diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index f312669..c57f6a7 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -1,102 +1,102 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: ollama-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: ollama-secret - data: - - secretKey: users - remoteRef: - key: kv/ollama - property: users - ---- - -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: ollama-basic-auth -spec: - basicAuth: - headerField: x-api-key - secret: ollama-secret - ---- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: ollama-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`ollama.durp.info`) && PathPrefix(`/`) - middlewares: - - name: ollama-basic-auth - kind: Rule - services: - - name: ollama - port: 11435 - tls: - secretName: ollama-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: ollama-tls -spec: - secretName: ollama-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "ollama.durp.info" - dnsNames: - - "ollama.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: ollama-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: ollama-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: ollama-secret +# data: +# - secretKey: users +# remoteRef: +# key: kv/ollama +# property: users +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: Middleware +#metadata: +# name: ollama-basic-auth +#spec: +# basicAuth: +# headerField: x-api-key +# secret: ollama-secret +# +#--- +# +#apiVersion: v1 +#kind: Service +#metadata: +# name: ollama +#spec: +# ports: +# - name: app +# port: 11435 +# protocol: TCP +# targetPort: 11435 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: ollama +#subsets: +# - addresses: +# - ip: 192.168.20.104 +# ports: +# - name: app +# port: 11435 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: ollama-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`ollama.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: ollama-basic-auth +# kind: Rule +# services: +# - name: ollama +# port: 11435 +# tls: +# secretName: ollama-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: ollama-tls +#spec: +# secretName: ollama-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "ollama.durp.info" +# dnsNames: +# - "ollama.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: ollama-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +#spec: +# type: ExternalName +# externalName: durp.info From 19b50efc81c245c0de9168f168b1616ea50c09ba Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Mar 2025 05:58:17 -0500 Subject: [PATCH 0627/1058] update storage --- infra/terraform/k3s.tf | 8 ++-- infra/terraform/main.tf | 87 +++++++++++++++++++------------------ infra/terraform/pihole.tf | 4 +- infra/terraform/postgres.tf | 4 +- 4 files changed, 53 insertions(+), 50 deletions(-) diff --git a/infra/terraform/k3s.tf b/infra/terraform/k3s.tf index 29426bd..24e00e6 100644 --- a/infra/terraform/k3s.tf +++ b/infra/terraform/k3s.tf @@ -30,7 +30,7 @@ resource "proxmox_vm_qemu" "k3smaster" { ide { ide2 { cloudinit { - storage = local.storage + storage = local.k3smaster.storage } } } @@ -39,7 +39,7 @@ resource "proxmox_vm_qemu" "k3smaster" { disk { size = local.k3smaster.drive format = local.format - storage = local.storage + storage = local.k3smaster.storage } } } @@ -89,7 +89,7 @@ resource "proxmox_vm_qemu" "k3sserver" { ide { ide2 { cloudinit { - storage = local.storage + storage = local.k3sserver.storage } } } @@ -98,7 +98,7 @@ resource "proxmox_vm_qemu" "k3sserver" { disk { size = local.k3sserver.drive format = local.format - storage = local.storage + storage = local.k3sserver.storage } } } diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index b7c2a05..685ce1e 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -20,59 +20,62 @@ provider "proxmox" { locals { sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" template = "Debian12-Template" - storage = "cache-domains" - emulatessd = true format = "raw" dnsserver = "192.168.12.1" vlan = 12 k3smaster = { - tags = "k3s_infra" - count = 3 - name = ["master01-infra", "master02-infra", "master03-infra"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] + tags = "k3s_infra" + count = 3 + name = ["master01-infra", "master02-infra", "master03-infra"] + cores = 2 + memory = "4096" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] } k3sserver = { - tags = "k3s_infra" - count = 3 - name = ["node01-infra", "node02-infra", "node03-infra"] - cores = 4 - memory = "8192" - drive = 240 - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] + tags = "k3s_infra" + count = 3 + name = ["node01-infra", "node02-infra", "node03-infra"] + cores = 4 + memory = "8192" + drive = 240 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] } haproxy = { - tags = "haproxy" - count = 3 - name = ["haproxy-01", "haproxy-02", "haproxy-03"] - cores = 2 - memory = "1024" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["31", "32", "33"] + tags = "haproxy" + count = 3 + name = ["haproxy-01", "haproxy-02", "haproxy-03"] + cores = 2 + memory = "1024" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["31", "32", "33"] } postgres = { - tags = "postgres" - count = 3 - name = ["postgres-01", "postgres-02", "postgres-03"] - cores = 4 - memory = "4096" - drive = 40 - node = ["mothership", "overlord", "vanguard"] - ip = ["34", "35", "36"] + tags = "postgres" + count = 3 + name = ["postgres-01", "postgres-02", "postgres-03"] + cores = 4 + memory = "4096" + drive = 40 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["34", "35", "36"] } pihole = { - tags = "pihole" - count = 3 - name = ["pihole-01", "pihole-02", "pihole-03"] - cores = 2 - memory = "2048" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["41", "42", "43"] + tags = "pihole" + count = 3 + name = ["pihole-01", "pihole-02", "pihole-03"] + cores = 2 + memory = "2048" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["41", "42", "43"] } } diff --git a/infra/terraform/pihole.tf b/infra/terraform/pihole.tf index faeda60..ced2aac 100644 --- a/infra/terraform/pihole.tf +++ b/infra/terraform/pihole.tf @@ -30,7 +30,7 @@ resource "proxmox_vm_qemu" "pihole" { ide { ide2 { cloudinit { - storage = local.storage + storage = local.pihole.storage } } } @@ -39,7 +39,7 @@ resource "proxmox_vm_qemu" "pihole" { disk { size = local.pihole.drive format = local.format - storage = local.storage + storage = local.pihole.storage } } } diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf index 5bbf658..8a44728 100644 --- a/infra/terraform/postgres.tf +++ b/infra/terraform/postgres.tf @@ -30,7 +30,7 @@ resource "proxmox_vm_qemu" "haproxy" { ide { ide2 { cloudinit { - storage = local.storage + storage = local.haproxy.storage } } } @@ -39,7 +39,7 @@ resource "proxmox_vm_qemu" "haproxy" { disk { size = local.haproxy.drive format = local.format - storage = local.storage + storage = local.haproxy.storage } } } From 0e24910675dc0e37e92b806120596c7b5a4f06f7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Mar 2025 05:59:14 -0500 Subject: [PATCH 0628/1058] update storage --- infra/terraform/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 685ce1e..8745f12 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -52,7 +52,7 @@ locals { cores = 2 memory = "1024" drive = 20 - storage = "cache-domains" + storage = "domains" node = ["mothership", "overlord", "vanguard"] ip = ["31", "32", "33"] } @@ -63,7 +63,7 @@ locals { cores = 4 memory = "4096" drive = 40 - storage = "cache-domains" + storage = "domains" node = ["mothership", "overlord", "vanguard"] ip = ["34", "35", "36"] } @@ -74,7 +74,7 @@ locals { cores = 2 memory = "2048" drive = 20 - storage = "cache-domains" + storage = "domains" node = ["mothership", "overlord", "vanguard"] ip = ["41", "42", "43"] } From db45c8e1deeaf50aaf036ab6ddd7f3a96b669f26 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Mar 2025 06:06:49 -0500 Subject: [PATCH 0629/1058] test --- .gitlab/.gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index a568021..47adb02 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -1,3 +1,3 @@ include: - local: infra/.gitlab/.gitlab-ci.yml - - local: dmz/.gitlab/.gitlab-ci.yml + #- local: dmz/.gitlab/.gitlab-ci.yml From 1d66e0f0db45d2b3ff15ff3c927888643ee27a40 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Mar 2025 06:09:13 -0500 Subject: [PATCH 0630/1058] test --- infra/.gitlab/.gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/.gitlab/.gitlab-ci.yml b/infra/.gitlab/.gitlab-ci.yml index d734da9..78c6ee1 100644 --- a/infra/.gitlab/.gitlab-ci.yml +++ b/infra/.gitlab/.gitlab-ci.yml @@ -8,7 +8,7 @@ variables: GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/infra image: - name: registry.internal.durp.info/opentofu/opentofu:latest + name: registry.durp.info/opentofu/opentofu:latest entrypoint: [""] .tf-init: From 4c02da883131cf9ff902819469e533dfcd26a7be Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Mar 2025 06:10:14 -0500 Subject: [PATCH 0631/1058] test --- infra/terraform/main.tf | 100 ++++++++++++++++++++-------------------- 1 file changed, 50 insertions(+), 50 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 8745f12..58b2ee7 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -18,64 +18,64 @@ provider "proxmox" { } locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.12.1" - vlan = 12 + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.12.1" + vlan = 12 k3smaster = { - tags = "k3s_infra" - count = 3 - name = ["master01-infra", "master02-infra", "master03-infra"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] + tags = "k3s_infra" + count = 3 + name = ["master01-infra", "master02-infra", "master03-infra"] + cores = 2 + memory = "4096" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] } k3sserver = { - tags = "k3s_infra" - count = 3 - name = ["node01-infra", "node02-infra", "node03-infra"] - cores = 4 - memory = "8192" - drive = 240 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] + tags = "k3s_infra" + count = 3 + name = ["node01-infra", "node02-infra", "node03-infra"] + cores = 4 + memory = "8192" + drive = 240 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] } haproxy = { - tags = "haproxy" - count = 3 - name = ["haproxy-01", "haproxy-02", "haproxy-03"] - cores = 2 - memory = "1024" - drive = 20 - storage = "domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["31", "32", "33"] + tags = "haproxy" + count = 3 + name = ["haproxy-01", "haproxy-02", "haproxy-03"] + cores = 2 + memory = "1024" + drive = 20 + storage = "domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["31", "32", "33"] } postgres = { - tags = "postgres" - count = 3 - name = ["postgres-01", "postgres-02", "postgres-03"] - cores = 4 - memory = "4096" - drive = 40 - storage = "domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["34", "35", "36"] + tags = "postgres" + count = 3 + name = ["postgres-01", "postgres-02", "postgres-03"] + cores = 4 + memory = "4096" + drive = 40 + storage = "domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["34", "35", "36"] } pihole = { - tags = "pihole" - count = 3 - name = ["pihole-01", "pihole-02", "pihole-03"] - cores = 2 - memory = "2048" - drive = 20 - storage = "domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["41", "42", "43"] + tags = "pihole" + count = 3 + name = ["pihole-01", "pihole-02", "pihole-03"] + cores = 2 + memory = "2048" + drive = 20 + storage = "domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["41", "42", "43"] } } From 9b5f1a0feeea9d072d3ef5b8b66bf645cf665686 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 25 Mar 2025 06:12:38 -0500 Subject: [PATCH 0632/1058] test --- infra/terraform/postgres.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf index 8a44728..5d7274f 100644 --- a/infra/terraform/postgres.tf +++ b/infra/terraform/postgres.tf @@ -88,7 +88,7 @@ resource "proxmox_vm_qemu" "postgres" { ide { ide2 { cloudinit { - storage = local.storage + storage = local.postgres.storage } } } @@ -97,7 +97,7 @@ resource "proxmox_vm_qemu" "postgres" { disk { size = local.postgres.drive format = local.format - storage = local.storage + storage = local.postgres.storage } } } From 06be8dc6cc610e5125f54cb7c6d2ac2a7be6c749 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 04:45:23 -0500 Subject: [PATCH 0633/1058] Update to child pipelines --- .gitlab/.gitlab-ci.yml | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index 47adb02..b2dc768 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -1,3 +1,18 @@ -include: - - local: infra/.gitlab/.gitlab-ci.yml - #- local: dmz/.gitlab/.gitlab-ci.yml +stages: + - triggers + +build_windows: + stage: triggers + trigger: + include: infra/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "dmz/terraform/*.tf" + +build_linux: + stage: triggers + trigger: + include: dmz/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "infra/terraform/*.tf" From 58ec1995df4c39e17f8fd4b37e5317e2de715544 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 04:51:50 -0500 Subject: [PATCH 0634/1058] Add dev --- .gitlab/.gitlab-ci.yml | 4 +- dev/.gitlab/.gitlab-ci.yml | 95 +++++++++++++++ dev/cert-manager/Chart.yaml | 11 ++ dev/cert-manager/templates/issuer.yaml | 16 +++ dev/cert-manager/templates/letsencrypt.yaml | 35 ++++++ dev/cert-manager/templates/secretvault.yaml | 22 ++++ dev/cert-manager/values.yaml | 26 +++++ dev/external-dns/Chart.yaml | 12 ++ dev/external-dns/templates/secrets.yaml | 30 +++++ dev/external-dns/values.yaml | 18 +++ dev/external-secrets/Chart.yaml | 11 ++ dev/external-secrets/templates/ca.yaml | 81 +++++++++++++ dev/external-secrets/values.yaml | 94 +++++++++++++++ dev/metallb-system/Chart.yaml | 12 ++ dev/metallb-system/templates/config.yaml | 17 +++ dev/metallb-system/values.yaml | 0 dev/terraform/k3s.tf | 115 +++++++++++++++++++ dev/terraform/main.tf | 48 ++++++++ dev/terraform/variables.tf | 14 +++ dev/traefik/Chart.yaml | 11 ++ dev/traefik/templates/config.yaml | 16 +++ dev/traefik/templates/middleware.yaml | 35 ++++++ dev/traefik/templates/traefik-dashboard.yaml | 34 ++++++ dev/traefik/values.yaml | 59 ++++++++++ dev/vault/Chart.yaml | 12 ++ dev/vault/templates/secret-store.yaml | 23 ++++ dev/vault/values.yaml | 13 +++ 27 files changed, 862 insertions(+), 2 deletions(-) create mode 100644 dev/.gitlab/.gitlab-ci.yml create mode 100644 dev/cert-manager/Chart.yaml create mode 100644 dev/cert-manager/templates/issuer.yaml create mode 100644 dev/cert-manager/templates/letsencrypt.yaml create mode 100644 dev/cert-manager/templates/secretvault.yaml create mode 100644 dev/cert-manager/values.yaml create mode 100644 dev/external-dns/Chart.yaml create mode 100644 dev/external-dns/templates/secrets.yaml create mode 100644 dev/external-dns/values.yaml create mode 100644 dev/external-secrets/Chart.yaml create mode 100644 dev/external-secrets/templates/ca.yaml create mode 100644 dev/external-secrets/values.yaml create mode 100644 dev/metallb-system/Chart.yaml create mode 100644 dev/metallb-system/templates/config.yaml create mode 100644 dev/metallb-system/values.yaml create mode 100644 dev/terraform/k3s.tf create mode 100644 dev/terraform/main.tf create mode 100644 dev/terraform/variables.tf create mode 100644 dev/traefik/Chart.yaml create mode 100644 dev/traefik/templates/config.yaml create mode 100644 dev/traefik/templates/middleware.yaml create mode 100644 dev/traefik/templates/traefik-dashboard.yaml create mode 100644 dev/traefik/values.yaml create mode 100644 dev/vault/Chart.yaml create mode 100644 dev/vault/templates/secret-store.yaml create mode 100644 dev/vault/values.yaml diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index b2dc768..eaca343 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -1,7 +1,7 @@ stages: - triggers -build_windows: +build_dmz: stage: triggers trigger: include: infra/.gitlab/.gitlab-ci.yml @@ -9,7 +9,7 @@ build_windows: - changes: - "dmz/terraform/*.tf" -build_linux: +build_infra: stage: triggers trigger: include: dmz/.gitlab/.gitlab-ci.yml diff --git a/dev/.gitlab/.gitlab-ci.yml b/dev/.gitlab/.gitlab-ci.yml new file mode 100644 index 0000000..e0532bc --- /dev/null +++ b/dev/.gitlab/.gitlab-ci.yml @@ -0,0 +1,95 @@ +stages: + - plan + - apply + - destroy + +variables: + WORKDIR: $CI_PROJECT_DIR/dmz/terraform + GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/dmz + +image: + name: registry.durp.info/opentofu/opentofu:latest + entrypoint: [""] + +.tf-init: + before_script: + - cd $WORKDIR + - tofu init + -reconfigure + -backend-config="address=${GITLAB_TF_ADDRESS}" + -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="username=gitlab-ci-token" + -backend-config="password=${CI_JOB_TOKEN}" + -backend-config="lock_method=POST" + -backend-config="unlock_method=DELETE" + -backend-config="retry_wait_min=5" + +format: + stage: .pre + allow_failure: false + script: + - cd $WORKDIR + - tofu fmt -diff -check -write=false + rules: + - changes: + - "dmz/terraform/*.tf" + +validate: + stage: .pre + allow_failure: false + extends: .tf-init + script: + - tofu validate + rules: + - changes: + - "dmz/terraform/*.tf" + +plan-dmz-infrastructure: + stage: plan + variables: + PLAN: plan.tfplan + JSON_PLAN_FILE: tfplan.json + ENVIRONMENT_NAME: dmz + allow_failure: false + extends: .tf-init + script: + - apk add --update curl jq + - alias convert_report="jq -r '([.resource_changes[].change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'" + - tofu plan -out=$PLAN $ARGUMENTS + - tofu show --json $PLAN | jq -r '([.resource_changes[].change.actions?]|flatten)|{"create":(map(select(.=="create"))|length),"update":(map(select(.=="update"))|length),"delete":(map(select(.=="delete"))|length)}' > $JSON_PLAN_FILE + artifacts: + reports: + terraform: $WORKDIR/$JSON_PLAN_FILE + needs: ["validate","format"] + rules: + - changes: + - "dmz/terraform/*.tf" + +apply-dmz-infrastructure: + stage: apply + variables: + ENVIRONMENT_NAME: dmz + allow_failure: false + extends: .tf-init + script: + - tofu apply -auto-approve $ARGUMENTS + rules: + - changes: + - "dmz/terraform/*.tf" + when: manual + needs: ["plan-dmz-infrastructure"] + +destroy-dmz-infrastructure: + stage: destroy + variables: + ENVIRONMENT_NAME: dmz + allow_failure: false + extends: .tf-init + script: + - tofu destroy -auto-approve $ARGUMENTS + rules: + - changes: + - "dmz/terraform/*.tf" + when: manual + needs: ["plan-dmz-infrastructure"] diff --git a/dev/cert-manager/Chart.yaml b/dev/cert-manager/Chart.yaml new file mode 100644 index 0000000..ecf60fa --- /dev/null +++ b/dev/cert-manager/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.16.3 diff --git a/dev/cert-manager/templates/issuer.yaml b/dev/cert-manager/templates/issuer.yaml new file mode 100644 index 0000000..cf61c83 --- /dev/null +++ b/dev/cert-manager/templates/issuer.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: issuer +secrets: + - name: issuer-token-lmzpj + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: issuer-token-lmzpj + annotations: + kubernetes.io/service-account.name: issuer +type: kubernetes.io/service-account-token diff --git a/dev/cert-manager/templates/letsencrypt.yaml b/dev/cert-manager/templates/letsencrypt.yaml new file mode 100644 index 0000000..56b8374 --- /dev/null +++ b/dev/cert-manager/templates/letsencrypt.yaml @@ -0,0 +1,35 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret + +--- + +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: vault-issuer +spec: + vault: + server: https://vault.infra.durp.info + caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + path: pki/sign/issue-homelab-certs + auth: + kubernetes: + mountPath: /v1/auth/dmz-cluster + role: issuer + secretRef: + name: issuer-token-lmzpj + key: token diff --git a/dev/cert-manager/templates/secretvault.yaml b/dev/cert-manager/templates/secretvault.yaml new file mode 100644 index 0000000..f15a739 --- /dev/null +++ b/dev/cert-manager/templates/secretvault.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: kv/cert-manager + property: cloudflare-api-token-secret + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/dev/cert-manager/values.yaml b/dev/cert-manager/values.yaml new file mode 100644 index 0000000..c9cf12f --- /dev/null +++ b/dev/cert-manager/values.yaml @@ -0,0 +1,26 @@ +cert-manager: + crds: + enabled: true + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-controller + pullPolicy: Always + replicaCount: 3 + extraArgs: + - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + - --dns01-recursive-nameservers-only + podDnsPolicy: None + podDnsConfig: + nameservers: + - "1.1.1.1" + - "1.0.0.1" + webhook: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-webhook + pullPolicy: Always + cainjector: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-cainjector + pullPolicy: Always diff --git a/dev/external-dns/Chart.yaml b/dev/external-dns/Chart.yaml new file mode 100644 index 0000000..8fb36bc --- /dev/null +++ b/dev/external-dns/Chart.yaml @@ -0,0 +1,12 @@ + +apiVersion: v2 +name: external-dns +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-dns + repository: https://charts.bitnami.com/bitnami + version: 8.3.8 diff --git a/dev/external-dns/templates/secrets.yaml b/dev/external-dns/templates/secrets.yaml new file mode 100644 index 0000000..0420a5d --- /dev/null +++ b/dev/external-dns/templates/secrets.yaml @@ -0,0 +1,30 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: external-dns-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: external-dns + data: + - secretKey: cloudflare_api_email + remoteRef: + key: kv/cloudflare + property: cloudflare_api_email + - secretKey: cloudflare_api_key + remoteRef: + key: kv/cloudflare + property: cloudflare_api_key + - secretKey: cloudflare_api_token + remoteRef: + key: kv/cloudflare + property: cloudflare_api_token + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/dev/external-dns/values.yaml b/dev/external-dns/values.yaml new file mode 100644 index 0000000..2052942 --- /dev/null +++ b/dev/external-dns/values.yaml @@ -0,0 +1,18 @@ +external-dns: + global: + imageRegistry: "registry.durp.info" + + image: + pullPolicy: Always + + txtPrefix: "dmz-" + + sources: + - service + + provider: cloudflare + cloudflare: + secretName : "external-dns" + proxied: false + + policy: sync diff --git a/dev/external-secrets/Chart.yaml b/dev/external-secrets/Chart.yaml new file mode 100644 index 0000000..d89a403 --- /dev/null +++ b/dev/external-secrets/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-secrets + repository: https://charts.external-secrets.io + version: 0.13.0 diff --git a/dev/external-secrets/templates/ca.yaml b/dev/external-secrets/templates/ca.yaml new file mode 100644 index 0000000..9b2a135 --- /dev/null +++ b/dev/external-secrets/templates/ca.yaml @@ -0,0 +1,81 @@ +apiVersion: v1 +data: + vault.pem: | + -----BEGIN CERTIFICATE----- + MIIEszCCA5ugAwIBAgIUZEzzxqEuYiKHkL1df+Cb22NRRJMwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzIyMzQ0MloXDTM1MDEy + MTExMTU1NVowIDEeMBwGA1UEAxMVdmF1bHQuaW5mcmEuZHVycC5pbmZvMIIBIjAN + BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkZM0ue4bMcmmATs+kGYSpR2hLUzq + scGIwCtqmaKCMbd1xhmgjnIR3zvSRptLR2GVGvc1ti6qby0jXYvcqbxkHvay00zW + 2zYN+M2m4lXpuWzg1t6NEoO6XGAsGj2v0vcVktPPU9uj0rGUVGWWfsvjoXqQFg5I + jdxsxK9SvMvw2XtE3FgKxpzCyw94InIHlcPwFTO+3ZdKStZlMbUDIkmszLBrWFcr + XOsPDfLxqMy0Ck//LKIt8djh3254FHB1GG5+kI+JSW1o+tUcL2NymvIINwm/2acS + 1uTm+j9W7iEXav0pJNmm+/dzSskc3Y0ftM0h2HCXgitBIaEZnUVneNHOLwIDAQAB + o4IB7zCCAeswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O + BBYEFCaQ2q7j7LyBGETEZ5qaJAdlISKCMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2 + dfBMWVYeWrQ2MIH0BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6 + Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFo + dHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3Nw + MDEGCCsGAQUFBzAChiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtp + L2NhMDsGCCsGAQUFBzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVy + cC5pbmZvL3YxL3BraS9jYTAgBgNVHREEGTAXghV2YXVsdC5pbmZyYS5kdXJwLmlu + Zm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAx + L3YxL3BraS9jcmwwNqA0oDKGMGh0dHBzOi8vcm9vdC12YXVsdC5pbnRlcm5hbC5k + dXJwLmluZm8vdjEvcGtpL2NybDANBgkqhkiG9w0BAQsFAAOCAQEAuJ+lplY/+A5L + 5LzkljbKDTy3U6PLv1LtxqVCOFGiJXBnXMjtVW07bBEUadzFRNW8GHQ3w5QzOG6k + /vE/TrrJho7l05J/uc+BUrPSNjefLmQV6hn4jrP86PR0vzRfbSqKKBIID9M7+zi6 + GFvHlVkSHsQyMQp7JOoax9KVzW2Y+OIgw7Lgw2tP122WCt2SIF0QenoZHsoW0guj + tzTJRmJDjn6XeJ7L3FPkf37H6ub0Jg3zBGr6eorEFfYZNN5CXezjqMFBpRdq4UIo + 1M3A7o3uyZFcFsp/vGDcMBkwaCsBV9idu/HwkvGaTUNI285ilBORPD0bMZnACq/9 + +Q/cdsO5lg== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIEmzCCA4OgAwIBAgIUQwCAs82sgSuiaVbjANHScO2DSfAwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMjEyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEAn9fjGRqqFsqguz56X6cXZwEMtD9wElwSFCb4Fc8YTzlH + 4fV13QwXKESLE/Q+7bw4y4FJQ8BiGNbxxbQOOgWhfGGlQyFa1lfhJtYLfqRN5C2/ + S7nr0YxDB9duc4OAExVL6Pr4/Koc+vDZY03l7RzwnF2AOM9DjFTASw01TphCQjRk + U+upiN2TUhUPejV/gMR+zXM6pn98UBKG1dNubS0HzAMwAEXAPm141NDyWUCPT9+3 + 6P03Ka8mUTx3X49OCtvJEGEQbtlnTFQaOSkP1yLW+XRMHw3sQaV2PWXu5fInbEpZ + +SuzmgLOXtmQNmHLav9q1qeTVkpBGPWvfh2Vh1JJhQIDAQABo4IB4zCCAd8wDgYD + VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJaP17f1Zw0V + 55Ks9Uf0USVWl0BPMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2dfBMWVYeWrQ2MIH0 + BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6Ly8xOTIuMTY4LjIw + LjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFodHRwczovL3Jvb3Qt + dmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3NwMDEGCCsGAQUFBzAC + hiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtpL2NhMDsGCCsGAQUF + BzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3Br + aS9jYTAUBgNVHREEDTALgglkdXJwLmluZm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0 + cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9jcmwwNqA0oDKGMGh0dHBz + Oi8vcm9vdC12YXVsdC5pbnRlcm5hbC5kdXJwLmluZm8vdjEvcGtpL2NybDANBgkq + hkiG9w0BAQsFAAOCAQEAiqAZ4zNIEkCWcvpDRq0VyJuk59sVtJr5X4FscHQ179nE + QbbvMe+EBDFS6XQml1Elj8jiPa/D5O9Oc6Iisnm5+weZKwApz/lQ+XVkWLCoEplB + ZZ9fcWVCbMLt0xlt8qn5z/mYKfbCT7ZCqDO+prQZt+ADJcQbiknfroAAqEbNKxwN + Y9uUyOWNF3SxJEch4w2dtX+IEVmxeZnhMy8OuP0SQKl8aW40ugiG0ZD5yTBBfOD9 + zsrGSU/iSatn0b7bevBhaL96hz1/rNR1cL+4/albX2hrr8Rv3/SB2DLtNQlQW0ls + AfhXAqP5zL+Ytgf1Of/pVdgnhxrYUY7RKCSGY5Hagw== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIDLzCCAhegAwIBAgIUNHdvOzam2HPVdwXpMHUy4wl8ZRYwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMTUyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEA8XDTVEtRI3+k4yuvqVqfIiLRQJcXbmhfVtAeYk+5j9Ox + p1w9YHdnPLqLFrD1PzadjqYeAp/fwlEFfs6lqwoTS8S9vhaFqcgB57nVMb77dTBb + /08XHXOU6FPRjdFKm5QMpS7tn1XacPMy/o0bKqRREQeiuFDGVRyuF5PUgvWc1dvJ + l27JvvgYktgjfpNS4DlCxg4lGXT5abvaKf2hnr65egaIo/yRWN9wnvAzRiY7oci7 + GA1oKz87Yc1tfL2gcynrwccOOCF/eUKesJR1I6GXNkN/a1fcr+Ld9Z9NhHBtO+vE + N8DsZY+kG7DE3M4BCCTFUzllcYHjaW4HaF9vZW+PYwIDAQABo3kwdzAOBgNVHQ8B + Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7WMLIaSkU75CJHZ1 + 8ExZVh5atDYwHwYDVR0jBBgwFoAU7WMLIaSkU75CJHZ18ExZVh5atDYwFAYDVR0R + BA0wC4IJZHVycC5pbmZvMA0GCSqGSIb3DQEBCwUAA4IBAQAS/qUI/1Yv07xUTK5k + r93kC7GSPpmpkXIsfjChAl93sebN143fu70NUP74jjCc0Wkb8hRofGg10E+/24r1 + AI0KsLhzKzfIASxUVQAn8RTptLruaaPLboSA4MUZ8IB5y8Vy8E3/KtD0gD80j64Y + rm9XGHA0HTJHbPUTb/Rux2g0E7WtiyWSWH8mqzbegU8IrkM3eVT4+ylBE7YkfWDD + dw44sB71tfmDKpzWg6XQ6YMh0YfnyG1fYCj9LhuecNY9Uuo6cjDaAvkzMewWwqDx + Q2Ekas98Di6itCP8vET+gBDjeCc+XR6Hx6vzWmxlZhwDuxEKL1a2/DabUxJyMNzv + 55Fn + -----END CERTIFICATE----- +kind: ConfigMap +metadata: + name: ca-pemstore diff --git a/dev/external-secrets/values.yaml b/dev/external-secrets/values.yaml new file mode 100644 index 0000000..304180d --- /dev/null +++ b/dev/external-secrets/values.yaml @@ -0,0 +1,94 @@ +external-secrets: + replicaCount: 3 + revisionHistoryLimit: 1 + leaderElect: true + + installCRDs: true + crds: + createClusterExternalSecret: true + createClusterSecretStore: true + createClusterGenerator: true + createPushSecret: true + conversion: + enabled: false + + image: + repository: registry.durp.info/external-secrets/external-secrets + pullPolicy: Always + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + webhook: + create: false + failurePolicy: Ignore + log: + level: debug + image: + repository: registry.durp.info/external-secrets/external-secrets + pullPolicy: Always + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + certController: + create: false + revisionHistoryLimit: 1 + log: + level: debug + + image: + repository: registry.durp.info/external-secrets/external-secrets + pullPolicy: Always + tag: "" + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true diff --git a/dev/metallb-system/Chart.yaml b/dev/metallb-system/Chart.yaml new file mode 100644 index 0000000..4fc684f --- /dev/null +++ b/dev/metallb-system/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.14.9 diff --git a/dev/metallb-system/templates/config.yaml b/dev/metallb-system/templates/config.yaml new file mode 100644 index 0000000..f08a885 --- /dev/null +++ b/dev/metallb-system/templates/config.yaml @@ -0,0 +1,17 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap +spec: + addresses: + - 192.168.98.130-192.168.98.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: pool + namespace: metallb-system +spec: + ipAddressPools: + - cheap + diff --git a/dev/metallb-system/values.yaml b/dev/metallb-system/values.yaml new file mode 100644 index 0000000..e69de29 diff --git a/dev/terraform/k3s.tf b/dev/terraform/k3s.tf new file mode 100644 index 0000000..4d02a21 --- /dev/null +++ b/dev/terraform/k3s.tf @@ -0,0 +1,115 @@ +resource "proxmox_vm_qemu" "k3smaster" { + count = local.k3smaster.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + clone = local.template + tags = local.k3smaster.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3smaster.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.k3smaster.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + count = local.k3sserver.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + clone = local.template + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3sserver.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.k3sserver.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf new file mode 100644 index 0000000..9ee7aac --- /dev/null +++ b/dev/terraform/main.tf @@ -0,0 +1,48 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc6" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.12.41,192.168.12.42,192.168.12.43" + vlan = 10 + k3smaster = { + tags = "k3s_dev" + count = 3 + name = ["master01-dev", "master02-dev", "master03-dev"] + cores = 2 + memory = "4096" + drive = 20 + storage = "domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_dev" + count = 3 + name = ["node01-dev", "node02-dev", "node03-dev"] + cores = 4 + memory = "8192" + drive = 120 + storage = "domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } +} diff --git a/dev/terraform/variables.tf b/dev/terraform/variables.tf new file mode 100644 index 0000000..29a1c9d --- /dev/null +++ b/dev/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "Username to Proxmox provider" + type = string +} diff --git a/dev/traefik/Chart.yaml b/dev/traefik/Chart.yaml new file mode 100644 index 0000000..30f96ac --- /dev/null +++ b/dev/traefik/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: traefik +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: traefik + repository: https://traefik.github.io/charts + version: 34.0.0 diff --git a/dev/traefik/templates/config.yaml b/dev/traefik/templates/config.yaml new file mode 100644 index 0000000..06a9d11 --- /dev/null +++ b/dev/traefik/templates/config.yaml @@ -0,0 +1,16 @@ +#apiVersion: v1 +#kind: ConfigMap +#metadata: +# name: traefik-configmap +#data: +# config.yml: | +# http: +# routers: +# router0: +# service: service0 +# rule: Host(`testing.durp.info`) +# services: +# service0: +# loadBalancer: +# servers: +# - url: https://192.168.20.130 diff --git a/dev/traefik/templates/middleware.yaml b/dev/traefik/templates/middleware.yaml new file mode 100644 index 0000000..7e95660 --- /dev/null +++ b/dev/traefik/templates/middleware.yaml @@ -0,0 +1,35 @@ +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: authentik-proxy-provider + namespace: traefik +spec: + forwardAuth: + address: http://ak-outpost-dmz-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version + +--- + +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: whitelist + namespace: traefik +spec: + ipWhiteList: + sourceRange: + - 192.168.0.0/16 + - 172.16.0.0/12 + - 10.0.0.0/8 diff --git a/dev/traefik/templates/traefik-dashboard.yaml b/dev/traefik/templates/traefik-dashboard.yaml new file mode 100644 index 0000000..0c6afaa --- /dev/null +++ b/dev/traefik/templates/traefik-dashboard.yaml @@ -0,0 +1,34 @@ +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: traefik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`traefik.durp.info`) +# kind: Rule +# services: +# - name: api@internal +# kind: TraefikService +# tls: +# secretName: traefik-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: traefik-tls +# namespace: traefik +#spec: +# secretName: traefik-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "traefik.durp.info" +# dnsNames: +# - "traefik.durp.info" +# +#--- +# diff --git a/dev/traefik/values.yaml b/dev/traefik/values.yaml new file mode 100644 index 0000000..f0d0404 --- /dev/null +++ b/dev/traefik/values.yaml @@ -0,0 +1,59 @@ +traefik: + image: + # registry: registry.durp.info + # repository: traefik + pullPolicy: Always + + providers: + kubernetesCRD: + allowCrossNamespace: true + allowExternalNameServices: true + allowEmptyServices: false + + deployment: + replicas: 3 + revisionHistoryLimit: 1 + + # volumes: + # - name: traefik-configmap + # mountPath: "/config" + # type: configMap + + ingressRoute: + dashboard: + enabled: true + + additionalArguments: + # - "--providers.file.filename=/config/config.yml" + - "--serversTransport.insecureSkipVerify=true" + - "--log.level=DEBUG" + - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin + - --experimental.plugins.jwt.version=v0.7.0 + + autoscaling: + enabled: true + minReplicas: 3 + maxReplicas: 10 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 60 + + + # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container. + resources: + requests: + cpu: "100m" + memory: "512Mi" + limits: + memory: "512Mi" diff --git a/dev/vault/Chart.yaml b/dev/vault/Chart.yaml new file mode 100644 index 0000000..e52029e --- /dev/null +++ b/dev/vault/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: vault +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: vault + repository: https://helm.releases.hashicorp.com + version: 0.29.1 + diff --git a/dev/vault/templates/secret-store.yaml b/dev/vault/templates/secret-store.yaml new file mode 100644 index 0000000..0486cfd --- /dev/null +++ b/dev/vault/templates/secret-store.yaml @@ -0,0 +1,23 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: vault +spec: + provider: + vault: + server: "https://vault.infra.durp.info" + path: "kv" + version: "v2" + auth: + kubernetes: + mountPath: "dmz-cluster" + role: "external-secrets" + serviceAccountRef: + name: "vault" + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/dev/vault/values.yaml b/dev/vault/values.yaml new file mode 100644 index 0000000..877d8fe --- /dev/null +++ b/dev/vault/values.yaml @@ -0,0 +1,13 @@ +vault: + global: + enabled: true + tlsDisable: false + externalVaultAddr: "https://vault.infra.durp.info" + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 256Mi + cpu: 250m + From a593d314e152681d5f75346f1419375edf242e4e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 04:52:49 -0500 Subject: [PATCH 0635/1058] Add dev --- .gitlab/.gitlab-ci.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index eaca343..d3507e7 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -12,7 +12,15 @@ build_dmz: build_infra: stage: triggers trigger: - include: dmz/.gitlab/.gitlab-ci.yml + include: infra/.gitlab/.gitlab-ci.yml rules: - changes: - "infra/terraform/*.tf" + +build_dev: + stage: triggers + trigger: + include: dev/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "dev/terraform/*.tf" From d9e49452249d719f4428b4bf2d59ea44f9c44077 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 05:06:16 -0500 Subject: [PATCH 0636/1058] Add dev --- dev/.gitlab/.gitlab-ci.yml | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/dev/.gitlab/.gitlab-ci.yml b/dev/.gitlab/.gitlab-ci.yml index e0532bc..16cef81 100644 --- a/dev/.gitlab/.gitlab-ci.yml +++ b/dev/.gitlab/.gitlab-ci.yml @@ -4,8 +4,8 @@ stages: - destroy variables: - WORKDIR: $CI_PROJECT_DIR/dmz/terraform - GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/dmz + WORKDIR: $CI_PROJECT_DIR/dev/terraform + GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/dev image: name: registry.durp.info/opentofu/opentofu:latest @@ -33,7 +33,7 @@ format: - tofu fmt -diff -check -write=false rules: - changes: - - "dmz/terraform/*.tf" + - "dev/terraform/*.tf" validate: stage: .pre @@ -43,14 +43,14 @@ validate: - tofu validate rules: - changes: - - "dmz/terraform/*.tf" + - "dev/terraform/*.tf" -plan-dmz-infrastructure: +plan-dev-infrastructure: stage: plan variables: PLAN: plan.tfplan JSON_PLAN_FILE: tfplan.json - ENVIRONMENT_NAME: dmz + ENVIRONMENT_NAME: dev allow_failure: false extends: .tf-init script: @@ -64,32 +64,32 @@ plan-dmz-infrastructure: needs: ["validate","format"] rules: - changes: - - "dmz/terraform/*.tf" + - "dev/terraform/*.tf" -apply-dmz-infrastructure: +apply-dev-infrastructure: stage: apply variables: - ENVIRONMENT_NAME: dmz + ENVIRONMENT_NAME: dev allow_failure: false extends: .tf-init script: - tofu apply -auto-approve $ARGUMENTS rules: - changes: - - "dmz/terraform/*.tf" + - "dev/terraform/*.tf" when: manual - needs: ["plan-dmz-infrastructure"] + needs: ["plan-dev-infrastructure"] -destroy-dmz-infrastructure: +destroy-dev-infrastructure: stage: destroy variables: - ENVIRONMENT_NAME: dmz + ENVIRONMENT_NAME: dev allow_failure: false extends: .tf-init script: - tofu destroy -auto-approve $ARGUMENTS rules: - changes: - - "dmz/terraform/*.tf" + - "dev/terraform/*.tf" when: manual - needs: ["plan-dmz-infrastructure"] + needs: ["plan-dev-infrastructure"] From fad9f96101837e10b7f22562630459a0922f58a2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 05:08:17 -0500 Subject: [PATCH 0637/1058] Add dev --- dev/terraform/main.tf | 46 +++++++++++++++++++++---------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf index 9ee7aac..bf5564c 100644 --- a/dev/terraform/main.tf +++ b/dev/terraform/main.tf @@ -18,31 +18,31 @@ provider "proxmox" { } locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.12.41,192.168.12.42,192.168.12.43" - vlan = 10 + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.12.41,192.168.12.42,192.168.12.43" + vlan = 10 k3smaster = { - tags = "k3s_dev" - count = 3 - name = ["master01-dev", "master02-dev", "master03-dev"] - cores = 2 - memory = "4096" - drive = 20 - storage = "domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] + tags = "k3s_dev" + count = 3 + name = ["master01-dev", "master02-dev", "master03-dev"] + cores = 2 + memory = "4096" + drive = 20 + storage = "domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] } k3sserver = { - tags = "k3s_dev" - count = 3 - name = ["node01-dev", "node02-dev", "node03-dev"] - cores = 4 - memory = "8192" - drive = 120 - storage = "domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] + tags = "k3s_dev" + count = 3 + name = ["node01-dev", "node02-dev", "node03-dev"] + cores = 4 + memory = "8192" + drive = 120 + storage = "domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] } } From 21dc6adcfb63b7a2d9453cb7fca77f935dabdcd2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 18:26:32 -0500 Subject: [PATCH 0638/1058] update --- dev/terraform/main.tf | 2 +- dmz/internalproxy/templates/open-webui.yaml | 33 +++++++++++++++++++-- 2 files changed, 32 insertions(+), 3 deletions(-) diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf index bf5564c..5b9ff10 100644 --- a/dev/terraform/main.tf +++ b/dev/terraform/main.tf @@ -21,7 +21,7 @@ locals { sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" template = "Debian12-Template" format = "raw" - dnsserver = "192.168.12.41,192.168.12.42,192.168.12.43" + dnsserver = "192.168.10.1" vlan = 10 k3smaster = { tags = "k3s_dev" diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index 9236aba..b8c487f 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -1,3 +1,32 @@ +acpiVersion: v1 +kind: Service +metadata: + name: open-webui +spec: + ports: + - name: app + port: 8089 + protocol: TCP + targetPort: 8089 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: open-webui +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8089 + protocol: TCP + +--- + apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -9,8 +38,8 @@ spec: - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: master-cluster - port: 443 + - name: open-webui + port: 8089 tls: secretName: open-webui-tls From 1250df73dfbfc765a30e51b02bcba65d219e85b1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 18:28:38 -0500 Subject: [PATCH 0639/1058] update --- dmz/internalproxy/templates/open-webui.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index b8c487f..bddabf9 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -38,8 +38,9 @@ spec: - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: open-webui - port: 8089 + - name: open-webui + port: 8089 + scheme: http tls: secretName: open-webui-tls @@ -68,4 +69,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info spec: type: ExternalName - externalName: durp.info + externalName: durp.info \ No newline at end of file From be893ea0402086ef29af4c04c05868c20aba386d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 18:30:24 -0500 Subject: [PATCH 0640/1058] update --- dmz/internalproxy/templates/open-webui.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index bddabf9..fab7c8e 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -1,4 +1,4 @@ -acpiVersion: v1 +apiVersion: v1 kind: Service metadata: name: open-webui @@ -35,12 +35,12 @@ spec: entryPoints: - websecure routes: - - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: open-webui - port: 8089 - scheme: http + - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: open-webui + port: 8089 + scheme: https tls: secretName: open-webui-tls @@ -57,7 +57,7 @@ spec: kind: ClusterIssuer commonName: "open-webui.durp.info" dnsNames: - - "open-webui.durp.info" + - "open-webui.durp.info" --- @@ -69,4 +69,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info From a9e4a97447954d65baee774d1ded326179594988 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 26 Mar 2025 18:33:08 -0500 Subject: [PATCH 0641/1058] update --- dmz/internalproxy/templates/open-webui.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index fab7c8e..24ae6fd 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -40,7 +40,7 @@ spec: services: - name: open-webui port: 8089 - scheme: https + scheme: http tls: secretName: open-webui-tls From a5b1ff6dd821c8fbdd58e388dceaf2d98c5009b9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 27 Mar 2025 05:55:37 -0500 Subject: [PATCH 0642/1058] update --- dmz/internalproxy/templates/s3.yaml | 46 +++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 5fb2506..278686d 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -61,3 +61,49 @@ spec: commonName: "s3.internal.durp.info" dnsNames: - "s3.internal.durp.info" + - +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: s3-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`s3.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: s3 + port: 9768 + scheme: http + tls: + secretName: s3-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: s3-tls +spec: + secretName: s3-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "s3.durp.info" + dnsNames: + - "s3.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: s3-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: s3.durp.info +spec: + type: ExternalName + externalName: durp.info From 8b83c6a6c5cfbca55a7418193860a0e72be41c62 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 04:47:12 -0500 Subject: [PATCH 0643/1058] update --- dmz/cert-manager/values.yaml | 6 +++--- infra/cert-manager/values.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dmz/cert-manager/values.yaml b/dmz/cert-manager/values.yaml index c9cf12f..a4b5cae 100644 --- a/dmz/cert-manager/values.yaml +++ b/dmz/cert-manager/values.yaml @@ -2,7 +2,7 @@ cert-manager: crds: enabled: true image: - registry: registry.internal.durp.info + registry: registry.durp.info repository: jetstack/cert-manager-controller pullPolicy: Always replicaCount: 3 @@ -16,11 +16,11 @@ cert-manager: - "1.0.0.1" webhook: image: - registry: registry.internal.durp.info + registry: registry.durp.info repository: jetstack/cert-manager-webhook pullPolicy: Always cainjector: image: - registry: registry.internal.durp.info + registry: registry.durp.info repository: jetstack/cert-manager-cainjector pullPolicy: Always diff --git a/infra/cert-manager/values.yaml b/infra/cert-manager/values.yaml index 0cec0b9..295c5e6 100644 --- a/infra/cert-manager/values.yaml +++ b/infra/cert-manager/values.yaml @@ -2,7 +2,7 @@ cert-manager: crds: enabled: true image: - registry: registry.internal.durp.info + registry: registry.durp.info repository: jetstack/cert-manager-controller pullPolicy: Always replicaCount: 3 @@ -16,11 +16,11 @@ cert-manager: # - "1.0.0.1" webhook: image: - registry: registry.internal.durp.info + registry: registry.durp.info repository: jetstack/cert-manager-webhook pullPolicy: Always cainjector: image: - registry: registry.internal.durp.info + registry: registry.durp.info repository: jetstack/cert-manager-cainjector pullPolicy: Always From cad3dcf4735cc8aff339b23e6b91a2809f0e1514 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 04:50:20 -0500 Subject: [PATCH 0644/1058] update --- dmz/internalproxy/templates/s3.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 278686d..122fd43 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -79,16 +79,16 @@ spec: port: 9768 scheme: http tls: - secretName: s3-tls + secretName: s3-external-tls --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: s3-tls + name: s3-external-tls spec: - secretName: s3-tls + secretName: s3-external-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer From 7cd14dcd59a38aa1ca9de611308718469384e76f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 05:01:14 -0500 Subject: [PATCH 0645/1058] update --- dmz/internalproxy/templates/vault.yaml | 31 ++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 dmz/internalproxy/templates/vault.yaml diff --git a/dmz/internalproxy/templates/vault.yaml b/dmz/internalproxy/templates/vault.yaml new file mode 100644 index 0000000..88648ea --- /dev/null +++ b/dmz/internalproxy/templates/vault.yaml @@ -0,0 +1,31 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: vault-infra-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`vault.infra.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: vault-infra-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: vault-infra-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: vault-infra-tls + commonName: "vault.infra.durp.info" + dnsNames: + - "vault.infra.durp.info" + From 5ab36252cd5b88bb050d6a8fba5dc34e79302905 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 05:02:45 -0500 Subject: [PATCH 0646/1058] update --- dmz/internalproxy/templates/vault.yaml | 31 -------------------------- 1 file changed, 31 deletions(-) delete mode 100644 dmz/internalproxy/templates/vault.yaml diff --git a/dmz/internalproxy/templates/vault.yaml b/dmz/internalproxy/templates/vault.yaml deleted file mode 100644 index 88648ea..0000000 --- a/dmz/internalproxy/templates/vault.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: vault-infra-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`vault.infra.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: vault-infra-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: vault-infra-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: vault-infra-tls - commonName: "vault.infra.durp.info" - dnsNames: - - "vault.infra.durp.info" - From 53544a8ddc48ebfe192e45e7b467e2b93a83550c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 05:11:24 -0500 Subject: [PATCH 0647/1058] update --- dmz/cert-manager/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dmz/cert-manager/values.yaml b/dmz/cert-manager/values.yaml index a4b5cae..cfb41cf 100644 --- a/dmz/cert-manager/values.yaml +++ b/dmz/cert-manager/values.yaml @@ -24,3 +24,8 @@ cert-manager: registry: registry.durp.info repository: jetstack/cert-manager-cainjector pullPolicy: Always + + hostAliases: + - ip: 192.168.12.130 + hostnames: + - vault.infra.durp.info From cabd1ee225d131d47f1c6997004b65285f3db3a5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 05:19:02 -0500 Subject: [PATCH 0648/1058] update --- dmz/external-secrets/Chart.yaml | 2 +- infra/external-secrets/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/external-secrets/Chart.yaml b/dmz/external-secrets/Chart.yaml index d89a403..ff5a3e2 100644 --- a/dmz/external-secrets/Chart.yaml +++ b/dmz/external-secrets/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.13.0 + version: 0.15.0 diff --git a/infra/external-secrets/Chart.yaml b/infra/external-secrets/Chart.yaml index d89a403..ff5a3e2 100644 --- a/infra/external-secrets/Chart.yaml +++ b/infra/external-secrets/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.13.0 + version: 0.15.0 From 93a0074599e802a296d9b6fbf67e99de3bab9f2d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 05:24:05 -0500 Subject: [PATCH 0649/1058] update --- dmz/internalproxy/templates/s3.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 122fd43..12a9e6b 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -67,7 +67,7 @@ spec: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: s3-ingress + name: s3-ingress-external spec: entryPoints: - websecure From 0d71f86fc20dd0ea3006bb9a17e8d688abb3f5df Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 28 Mar 2025 05:27:32 -0500 Subject: [PATCH 0650/1058] update --- dmz/internalproxy/templates/s3.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 12a9e6b..29d509d 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -61,7 +61,7 @@ spec: commonName: "s3.internal.durp.info" dnsNames: - "s3.internal.durp.info" - - + --- apiVersion: traefik.io/v1alpha1 From c66c65140267ed3b58950c7c240596337f1a834c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 29 Mar 2025 07:02:37 -0500 Subject: [PATCH 0651/1058] update --- dmz/internalproxy/templates/ollama.yaml | 204 ++++++++++++------------ 1 file changed, 102 insertions(+), 102 deletions(-) diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index c57f6a7..d336026 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -1,102 +1,102 @@ -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: ollama-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: ollama-secret -# data: -# - secretKey: users -# remoteRef: -# key: kv/ollama -# property: users -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: Middleware -#metadata: -# name: ollama-basic-auth -#spec: -# basicAuth: -# headerField: x-api-key -# secret: ollama-secret -# -#--- -# -#apiVersion: v1 -#kind: Service -#metadata: -# name: ollama -#spec: -# ports: -# - name: app -# port: 11435 -# protocol: TCP -# targetPort: 11435 -# clusterIP: None -# type: ClusterIP -# -#--- -# -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: ollama -#subsets: -# - addresses: -# - ip: 192.168.20.104 -# ports: -# - name: app -# port: 11435 -# protocol: TCP -# -#--- -# -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: ollama-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`ollama.durp.info`) && PathPrefix(`/`) -# middlewares: -# - name: ollama-basic-auth -# kind: Rule -# services: -# - name: ollama -# port: 11435 -# tls: -# secretName: ollama-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: ollama-tls -#spec: -# secretName: ollama-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "ollama.durp.info" -# dnsNames: -# - "ollama.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: ollama-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: ollama-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: ollama-secret + data: + - secretKey: users + remoteRef: + key: kv/ollama + property: users + +--- + +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: ollama-basic-auth +spec: + basicAuth: + headerField: x-api-key + secret: ollama-secret + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ollama +spec: + ports: + - name: app + port: 11435 + protocol: TCP + targetPort: 11435 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ollama +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 11435 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: ollama-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`ollama.durp.info`) && PathPrefix(`/`) + middlewares: + - name: ollama-basic-auth + kind: Rule + services: + - name: ollama + port: 11435 + tls: + secretName: ollama-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: ollama-tls +spec: + secretName: ollama-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "ollama.durp.info" + dnsNames: + - "ollama.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: ollama-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: ollama.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file From 5269bc1e2cf89c45433152f87c1a713d675ee312 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 31 Mar 2025 05:23:01 -0500 Subject: [PATCH 0652/1058] Add openclarity --- infra/openclarity/Chart.yaml | 12 + infra/openclarity/templates/secret.yaml | 30 + infra/openclarity/values.yaml | 915 ++++++++++++++++++++++++ 3 files changed, 957 insertions(+) create mode 100644 infra/openclarity/Chart.yaml create mode 100644 infra/openclarity/templates/secret.yaml create mode 100644 infra/openclarity/values.yaml diff --git a/infra/openclarity/Chart.yaml b/infra/openclarity/Chart.yaml new file mode 100644 index 0000000..e600b41 --- /dev/null +++ b/infra/openclarity/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: openclarity +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: openclarity + repository: oci://ghcr.io/openclarity/charts/openclarity + version: 1.1.3 diff --git a/infra/openclarity/templates/secret.yaml b/infra/openclarity/templates/secret.yaml new file mode 100644 index 0000000..8435129 --- /dev/null +++ b/infra/openclarity/templates/secret.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: openclarity-postgres-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: openclarity-postgres-secret + data: + - secretKey: username + remoteRef: + key: kv/openclarity/postgres + property: username + - secretKey: password + remoteRef: + key: kv/openclarity/postgres + property: password + - secretKey: database + remoteRef: + key: kv/openclarity/postgres + property: database diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml new file mode 100644 index 0000000..1af2179 --- /dev/null +++ b/infra/openclarity/values.yaml @@ -0,0 +1,915 @@ +openclarity: + global: + imageRegistry: registry.durp.info + + apiserver: + # -- Number of replicas for the API Server + replicas: 1 + + database: + postgresql: + # -- Enable/disable Postgresql database + enabled: true + externalPostgresql: + # -- Enable/disable external Postgresql database + enabled: false + # -- External Postgreqsl database host + host: "" + # -- External Postgresql database port + port: 5432 + auth: + # -- Name of existing secret to use for PostgreSQL credentials that has the following keys: + # username + # password + # database + existingSecret: "" + + image: + # -- API Server image registry + registry: ghcr.io + # -- API Server image repository + repository: openclarity/openclarity-api-server + # -- API Server image tag (immutable tags are recommended) + tag: latest + # -- API Server image digest. If set will override the tag. + digest: "" + # -- API Server image pull policy + pullPolicy: IfNotPresent + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + # -- API Server log level + logLevel: info + + resources: + # -- The resources limits for the apiserver containers + limits: {} + # -- The requested resources for the apiserver containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + orchestrator: + # -- Number of replicas for the Orchestrator service + # Currently 1 supported. + replicas: 1 + + image: + # -- Orchestrator image registry + registry: ghcr.io + # -- Orchestrator image repository + repository: openclarity/openclarity-orchestrator + # -- Orchestrator image tag (immutable tags are recommended) + tag: latest + # -- Orchestrator image digest. If set will override the tag. + digest: "" + # -- Orchestrator image pull policy + pullPolicy: IfNotPresent + + podSecurityContext: + # -- Whether Orchestrator pod security context is enabled + enabled: true + # -- Orchestrator pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + # -- Orchestrator service log level + logLevel: info + + resources: + # -- The resources limits for the orchestrator containers + limits: {} + # -- The requested resources for the orchestrator containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + # -- Global policy used to determine when to clean up an AssetScan. + # Possible options are: + # Always - All AssetScans are cleaned up + # OnSuccess - Only Successful AssetScans are cleaned up, Failed ones are left for debugging + # Never - No AssetScans are cleaned up + deleteJobPolicy: Always + + scannerImage: + # -- Scanner Container image registry + registry: ghcr.io + # -- Scanner Container image repository + repository: openclarity/openclarity-cli + # -- Scanner Container image tag (immutable tags are recommended) + tag: latest + # -- Scanner Container image digest. If set will override the tag. + digest: "" + + # -- Address that scanners can use to reach back to the API server + scannerApiserverAddress: "" + + # -- Address that scanners can use to reach back to the Exploits server + exploitsDBAddress: "" + + # -- Address that scanners can use to reach trivy server + trivyServerAddress: "" + + # -- Address that scanners can use to reach the grype server + grypeServerAddress: "" + + # -- Address that scanners can use to reach the freshclam mirror + freshclamMirrorAddress: "" + + # -- Address that scanner can use to reach the yara rule server + yaraRuleServerAddress: "" + + # -- Which provider driver to enable. + # If enabling the Kubernetes provider ensure that the orchestrator + # serviceAccount section is configured to allow access to the Kubernetes API. + provider: "kubernetes" + + kubernetes: {} + + # Only for testing purposes + docker: {} + + ui: + # -- Number of replicas for the UI service + replicas: 1 + + image: + # -- UI image registry + registry: ghcr.io + # -- UI image repository + repository: openclarity/openclarity-ui + # -- UI image tag + tag: latest + # -- UI image digest. If set will override the tag + digest: "" + # -- UI Image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the UI containers + limits: {} + # -- The requested resources for the UI containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: true + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 101 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 101 + # -- Group ID which the containers should run as + runAsGroup: 101 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + uibackend: + # -- Number of replicas for the UI Backend service + replicas: 1 + + image: + # -- UI Backend image registry + registry: ghcr.io + # -- UI Backend image repository + repository: openclarity/openclarity-ui-backend + # -- UI Backend image tag + tag: latest + # -- UI Backend image digest. If set will override the tag. + digest: "" + # -- UI Backend image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the UI backend containers + limits: {} + # -- The requested resources for the UI backend containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + # -- Log level for the UI backend service + logLevel: info + + gateway: + # -- Number of replicas for the gateway + replicas: 1 + + image: + # -- Gateway service container registry + registry: docker.io + # -- Gateway service container repository + repository: nginxinc/nginx-unprivileged + # -- Gateway service container tag + tag: 1.27.3 + # -- Gateway image digest. If set will override the tag. + digest: "" + # -- Gateway service container pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the gateway containers + limits: {} + # -- The requested resources for the gateway containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 101 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 101 + # -- Group ID which the containers should run as + runAsGroup: 101 + # -- Whether the containers should run as a non-root user + runAsNonRoot: false + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + service: + # -- Service type: ClusterIP, NodePort, LoadBalancer + type: ClusterIP + # -- Port configurations + ports: + http: 80 + # -- NodePort configurations + nodePorts: + http: "" + # -- Dedicated IP address used for service + clusterIP: "" + # -- Annotations set for service + annotations: {} + # -- External Traffic Policy configuration + # Set the field to Cluster to route external traffic to all ready endpoints and Local to only route to ready node + # local endpoints. + externalTrafficPolicy: Cluster + + ingress: + # -- Be careful when using ingress. As there is no authentication on openclarity, your instance may be accessible. + # Make sure the ingress remains internal if you decide to enable it. + enabled: false + labels: {} + annotations: {} + + # -- Optionally use ingressClassName instead of default ingress class. + ingressClassName: "" + + hosts: + # Hostname you want to use to access the UI + - host: chart-example.local + # paths will default to: + # paths: + # - pathType: Prefix + # path: / + paths: [] + + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + + postgresql: + image: + # -- Postgresql container registry + registry: docker.io + # -- Postgresql container repository + repository: bitnami/postgresql + # -- Postgresql container tag + tag: 16.6.0-debian-12-r1 + # -- Postgresql image digest. If set will override the tag. + digest: "" + # -- Postgresql container image pull policy + pullPolicy: IfNotPresent + primary: + # -- Postgresql container resource preset + # For more info see: https://github.com/bitnami/charts/blob/main/bitnami/common/templates/_resources.tpl#L15 + resourcesPreset: "small" + + resources: + # -- The resources limits for the postgresql containers + limits: {} + # -- The requested resources for the postgresql containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + auth: + existingSecret: openclarity-postgres-secret + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + service: + ports: + # -- PostgreSQL service port + postgresql: 5432 + + exploitDBServer: + # -- Number of replicas for the exploit-db-server service + replicas: 1 + + image: + # -- Exploit DB Server container registry + registry: ghcr.io + # -- Exploit DB Server container repository + repository: openclarity/exploit-db-server + # -- Exploit DB Server container tag + tag: v0.3.0 + # -- Exploit DB Server image digest. If set will override the tag. + digest: "" + # -- Exploit DB Server image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the exploit-db-server containers + limits: {} + # -- The requested resources for the exploit-db-server containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: false + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + trivyServer: + # -- Number of replicas for the trivy server service + replicas: 1 + + image: + # -- Trivy Server container registry + registry: docker.io + # -- Trivy Server container repository + repository: aquasec/trivy + # -- Trivy Server container tag + tag: 0.58.2 + # -- Trivy Server image digest. If set will override the tag. + digest: "" + # -- Trivy Server image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the trivy server containers + limits: {} + # -- The requested resources for the trivy server containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + grypeServer: + # -- Number of replicas for the grype server service + replicas: 1 + + image: + # -- Grype server container registry + registry: ghcr.io + # -- Grype server container repository + repository: openclarity/grype-server + # -- Grype server container tag + tag: v0.7.5 + # -- Grype server image digest. If set will override the tag. + digest: "" + # -- Grype server image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the grype server containers + limits: {} + # -- The requested resources for the grype server containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: true + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: true + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + # -- Log level for the grype-server service + logLevel: info + + freshclamMirror: + # -- Number of replicas for the freshclam mirror service + replicas: 1 + + image: + # -- Freshclam Mirror container registry + registry: ghcr.io + # -- Freshclam Mirror container repository + repository: openclarity/freshclam-mirror + # -- Freshclam Mirror container tag + tag: v0.3.1 + # -- Freshclam Mirror image digest. If set will override the tag. + digest: "" + # -- Freshclam Mirror image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the freshclam mirror containers + limits: {} + # -- The requested resources for the freshclam mirror containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: false + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: false + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + swaggerUI: + # -- Number of replicas for the swagger-ui service + replicas: 1 + + image: + # -- Swagger UI container registry + registry: docker.io + # -- Swagger UI container repository + repository: swaggerapi/swagger-ui + # -- Swagger UI container tag + tag: v5.18.2 + # -- Swagger UI image digest. If set will override the tag. + digest: "" + # -- Swagger UI image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the swagger ui containers + limits: {} + # -- The requested resources for the swagger ui containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: false + # -- Pod security context fsGroup + fsGroup: 101 + + containerSecurityContext: + # -- Container security context enabled + enabled: false + # -- User ID which the containers should run as + runAsUser: 0 + # -- Group ID which the containers should run as + runAsGroup: 0 + # -- Whether the containers should run as a non-root user + runAsNonRoot: false + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + yaraRuleServer: + # -- Number of replicas for the Yara Rule Server service + replicas: 1 + + image: + # -- Yara Rule Server container registry + registry: ghcr.io + # -- Yara Rule Server container repository + repository: openclarity/yara-rule-server + # -- Yara Rule Server container tag + tag: v0.3.0 + # -- Yara Rule Server image digest. If set will override the tag. + digest: "" + # -- Yara Rule Server image pull policy + pullPolicy: IfNotPresent + + resources: + # -- The resources limits for the Yara Rule Server containers + limits: {} + # -- The requested resources for the Yara Rule Server containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: false + # -- Pod security context fsGroup + fsGroup: 1001 + + containerSecurityContext: + # -- Container security context enabled + enabled: false + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL + + crDiscoveryServer: + nodeSelector: {} + tolerations: [] + affinity: {} + image: + # -- Container Runtime Discovery Server container registry + registry: ghcr.io + # -- Container Runtime Discovery Server container repository + repository: openclarity/openclarity-cr-discovery-server + # -- Container Runtime Discovery Server container tag + tag: latest + # -- Container Runtime Discovery Server image digest. If set will override the tag. + digest: "" + # -- Container Runtime Discovery Server image pull policy + pullPolicy: IfNotPresent + + # -- Environment variables to set in the Container Runtime Discovery Server container + env: [] + # - name: CONTAINERD_SOCK_ADDRESS + # value: /var/run/containerd/containerd.sock + containerRuntimePaths: + - name: containerd + path: /var/run/containerd + readOnly: true + - name: k3s-containerd + path: /run/k3s/containerd + readOnly: true + - name: docker + path: /var/lib/docker + readOnly: true + - name: crio + path: /var/run/crio + readOnly: true + - name: crio-lib + path: /var/lib/containers + - name: crio-run + path: /var/run/containers + - name: crio-containers + path: /etc/containers + readOnly: true + resources: + # -- The resources limits for the container runtime discovery server containers + limits: {} + # -- The requested resources for the container runtime discovery server containers + requests: {} + + serviceAccount: + # -- Enable creation of ServiceAccount + create: true + # -- The name of the ServiceAccount to use. + # If not set and create is true, it will use the component's calculated name. + name: "" + # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. + # Can be set to false if pods using this serviceAccount do not need to use K8s API. + automountServiceAccountToken: false + + podSecurityContext: + # -- Pod security context enabled + enabled: false + # -- Pod security context fsGroup + fsGroup: 1001 + + # In order to use CRI-O runtime you need to run OpenClarity + # with the following configuration: + # + # containerSecurityContext: + # enabled: true + # privileged: true + # readOnlyRootFilesystem: false + containerSecurityContext: + # -- Container security context enabled + enabled: false + # -- User ID which the containers should run as + runAsUser: 1001 + # -- Group ID which the containers should run as + runAsGroup: 1001 + # -- Whether the containers should run as a non-root user + runAsNonRoot: true + # -- Whether the container should run in privileged mode + privileged: false + # -- Force the child process to run as non-privileged + allowPrivilegeEscalation: false + # -- Mounts the container file system as ReadOnly + readOnlyRootFilesystem: true + capabilities: + # -- List of capabilities to be dropped + drop: + - ALL \ No newline at end of file From 050a0b30e085a7bf7523d6941b6557de8bcfac10 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 31 Mar 2025 05:23:44 -0500 Subject: [PATCH 0653/1058] Add openclarity --- infra/argocd/templates/openclarity.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 infra/argocd/templates/openclarity.yaml diff --git a/infra/argocd/templates/openclarity.yaml b/infra/argocd/templates/openclarity.yaml new file mode 100644 index 0000000..64307d6 --- /dev/null +++ b/infra/argocd/templates/openclarity.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openclarity + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/openclarity + destination: + namespace: openclarity + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 98b90c43212849f3fd3584b131faa69dc1f8f180 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 31 Mar 2025 05:27:31 -0500 Subject: [PATCH 0654/1058] Add openclarity --- infra/openclarity/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/Chart.yaml b/infra/openclarity/Chart.yaml index e600b41..c05889c 100644 --- a/infra/openclarity/Chart.yaml +++ b/infra/openclarity/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: openclarity - repository: oci://ghcr.io/openclarity/charts/openclarity + repository: oci://ghcr.io/openclarity/charts/openclarity:1.1.3 version: 1.1.3 From e34ff55f1a4ff8d7b39d76119d222813dc3d028f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 31 Mar 2025 05:28:26 -0500 Subject: [PATCH 0655/1058] Add openclarity --- infra/openclarity/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/Chart.yaml b/infra/openclarity/Chart.yaml index c05889c..e4028f3 100644 --- a/infra/openclarity/Chart.yaml +++ b/infra/openclarity/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: openclarity - repository: oci://ghcr.io/openclarity/charts/openclarity:1.1.3 + repository: oci://ghcr.io/openclarity/charts version: 1.1.3 From 5de76051a3efbc0ed8a0307215e3160bde137f19 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 31 Mar 2025 05:32:33 -0500 Subject: [PATCH 0656/1058] Add openclarity --- infra/openclarity/templates/secret.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infra/openclarity/templates/secret.yaml b/infra/openclarity/templates/secret.yaml index 8435129..6c9a2aa 100644 --- a/infra/openclarity/templates/secret.yaml +++ b/infra/openclarity/templates/secret.yaml @@ -20,6 +20,10 @@ spec: remoteRef: key: kv/openclarity/postgres property: username + - secretKey: postgres-password + remoteRef: + key: kv/openclarity/postgres + property: password - secretKey: password remoteRef: key: kv/openclarity/postgres From a794c4660ba4d48822ac2dbccd9eece6a8dc8091 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 31 Mar 2025 05:42:14 -0500 Subject: [PATCH 0657/1058] Add openclarity --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 1af2179..0cb1730 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -141,7 +141,7 @@ openclarity: name: "" # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. # Can be set to false if pods using this serviceAccount do not need to use K8s API. - automountServiceAccountToken: false + automountServiceAccountToken: true # -- Global policy used to determine when to clean up an AssetScan. # Possible options are: From ee9c701c7c8876c5a19a9bec094d2d2dc9f1cbcc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 1 Apr 2025 05:34:22 -0500 Subject: [PATCH 0658/1058] update --- dev/traefik/templates/config.yaml | 16 --------- dev/traefik/templates/middleware.yaml | 35 ------------------ dev/traefik/templates/traefik-dashboard.yaml | 34 ------------------ dev/traefik/values.yaml | 37 ++++++++++---------- infra/argocd/templates/traefik.yaml | 26 ++++++++++++++ 5 files changed, 44 insertions(+), 104 deletions(-) delete mode 100644 dev/traefik/templates/config.yaml delete mode 100644 dev/traefik/templates/middleware.yaml delete mode 100644 dev/traefik/templates/traefik-dashboard.yaml diff --git a/dev/traefik/templates/config.yaml b/dev/traefik/templates/config.yaml deleted file mode 100644 index 06a9d11..0000000 --- a/dev/traefik/templates/config.yaml +++ /dev/null @@ -1,16 +0,0 @@ -#apiVersion: v1 -#kind: ConfigMap -#metadata: -# name: traefik-configmap -#data: -# config.yml: | -# http: -# routers: -# router0: -# service: service0 -# rule: Host(`testing.durp.info`) -# services: -# service0: -# loadBalancer: -# servers: -# - url: https://192.168.20.130 diff --git a/dev/traefik/templates/middleware.yaml b/dev/traefik/templates/middleware.yaml deleted file mode 100644 index 7e95660..0000000 --- a/dev/traefik/templates/middleware.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: authentik-proxy-provider - namespace: traefik -spec: - forwardAuth: - address: http://ak-outpost-dmz-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri - trustForwardHeader: true - authResponseHeaders: - - X-authentik-username - - X-authentik-groups - - X-authentik-email - - X-authentik-name - - X-authentik-uid - - X-authentik-jwt - - X-authentik-meta-jwks - - X-authentik-meta-outpost - - X-authentik-meta-provider - - X-authentik-meta-app - - X-authentik-meta-version - ---- - -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: whitelist - namespace: traefik -spec: - ipWhiteList: - sourceRange: - - 192.168.0.0/16 - - 172.16.0.0/12 - - 10.0.0.0/8 diff --git a/dev/traefik/templates/traefik-dashboard.yaml b/dev/traefik/templates/traefik-dashboard.yaml deleted file mode 100644 index 0c6afaa..0000000 --- a/dev/traefik/templates/traefik-dashboard.yaml +++ /dev/null @@ -1,34 +0,0 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: traefik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`traefik.durp.info`) -# kind: Rule -# services: -# - name: api@internal -# kind: TraefikService -# tls: -# secretName: traefik-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: traefik-tls -# namespace: traefik -#spec: -# secretName: traefik-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "traefik.durp.info" -# dnsNames: -# - "traefik.durp.info" -# -#--- -# diff --git a/dev/traefik/values.yaml b/dev/traefik/values.yaml index f0d0404..3d1d660 100644 --- a/dev/traefik/values.yaml +++ b/dev/traefik/values.yaml @@ -1,10 +1,10 @@ traefik: - image: + image: # registry: registry.durp.info # repository: traefik pullPolicy: Always - - providers: + + providers: kubernetesCRD: allowCrossNamespace: true allowExternalNameServices: true @@ -18,40 +18,39 @@ traefik: # - name: traefik-configmap # mountPath: "/config" # type: configMap - + ingressRoute: dashboard: enabled: true - - additionalArguments: + + additionalArguments: # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin - --experimental.plugins.jwt.version=v0.7.0 - + autoscaling: enabled: true minReplicas: 3 maxReplicas: 10 metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 80 + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 behavior: scaleDown: stabilizationWindowSeconds: 300 policies: - - type: Pods - value: 1 - periodSeconds: 60 - - + - type: Pods + value: 1 + periodSeconds: 60 + # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container. - resources: + resources: requests: cpu: "100m" memory: "512Mi" diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index a2e901e..0136c94 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -48,3 +48,29 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: traefik-dev + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dev/traefik + destination: + namespace: traefik + name: dev + syncPolicy: + # managedNamespaceMetadata: + # labels: + # istio-injection: enabled + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From 494301a3cd029e775f73382b881f26753df96fa0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 1 Apr 2025 06:00:46 -0500 Subject: [PATCH 0659/1058] update --- ansible/newcluster.yaml | 2 ++ master/bitwarden/templates/deployment.yaml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 ansible/newcluster.yaml diff --git a/ansible/newcluster.yaml b/ansible/newcluster.yaml new file mode 100644 index 0000000..724d6d4 --- /dev/null +++ b/ansible/newcluster.yaml @@ -0,0 +1,2 @@ +argocd login --insecure +argocd cluster add --name diff --git a/master/bitwarden/templates/deployment.yaml b/master/bitwarden/templates/deployment.yaml index a992f38..f787ba1 100644 --- a/master/bitwarden/templates/deployment.yaml +++ b/master/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.internal.durp.info/vaultwarden/server:1.32.7 + image: registry.durp.info/vaultwarden/server:1.32.7 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc From 6e0579cc0f616323fa60c017632f2504961d63c1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 4 Apr 2025 06:14:13 -0500 Subject: [PATCH 0660/1058] update --- infra/openclarity/values.yaml | 2 +- master/argocd/values.yaml | 4 ++-- master/durpapi/values.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 0cb1730..4abc89d 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -792,7 +792,7 @@ openclarity: serviceAccount: # -- Enable creation of ServiceAccount create: true - # -- The name of the ServiceAccount to use. + #false -- The name of the ServiceAccount to use. # If not set and create is true, it will use the component's calculated name. name: "" # -- Allows auto mount of ServiceAccountToken on the serviceAccount created. diff --git a/master/argocd/values.yaml b/master/argocd/values.yaml index 47a56e3..82b19ac 100644 --- a/master/argocd/values.yaml +++ b/master/argocd/values.yaml @@ -3,7 +3,7 @@ argo-cd: global: revisionHistoryLimit: 1 image: - repository: registry.internal.durp.info/argoproj/argocd + repository: registry.durp.info/argoproj/argocd imagePullPolicy: Always server: @@ -26,7 +26,7 @@ argo-cd: dex: enabled: true image: - repository: registry.internal.durp.info/dexidp/dex + repository: registry.durp.info/dexidp/dex imagePullPolicy: Always configs: diff --git a/master/durpapi/values.yaml b/master/durpapi/values.yaml index 9e9eeab..41b152b 100644 --- a/master/durpapi/values.yaml +++ b/master/durpapi/values.yaml @@ -1,7 +1,7 @@ ingress: enabled: false deployment: - image: registry.internal.durp.info/developerdurp/durpapi + image: registry.durp.info/developerdurp/durpapi secretfile: durpapi-secret imagePullPolicy: Always hpa: From 4e3e7c558afce53865376cb14b8c083e72ee9aee Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 10 Apr 2025 16:33:13 -0500 Subject: [PATCH 0661/1058] update --- infra/argocd/templates/litellm.yaml | 41 +++++++++++++++-------------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/infra/argocd/templates/litellm.yaml b/infra/argocd/templates/litellm.yaml index 3b52349..267dc36 100644 --- a/infra/argocd/templates/litellm.yaml +++ b/infra/argocd/templates/litellm.yaml @@ -1,20 +1,21 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: litellm - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: infra/litellm - destination: - namespace: litellm - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: litellm +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: infra/litellm +# destination: +# namespace: litellm +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# \ No newline at end of file From b42c981f39c3a7dcbe84afebd2ca9c2997f2252f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 07:20:14 -0500 Subject: [PATCH 0662/1058] update --- dmz/istio-system/Chart.yaml | 18 +++++++++--------- infra/argocd/templates/litellm.yaml | 1 - 2 files changed, 9 insertions(+), 10 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index 6ced8b7..cbba267 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -6,12 +6,12 @@ version: 0.0.1 appVersion: 0.0.1 dependencies: -- name: base - repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 -- name: istiod - repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 -- name: gateway - repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 + - name: base + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 + - name: istiod + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 + - name: gateway + repository: https://istio-release.storage.googleapis.com/charts + version: 1.25.0 \ No newline at end of file diff --git a/infra/argocd/templates/litellm.yaml b/infra/argocd/templates/litellm.yaml index 267dc36..7c818dc 100644 --- a/infra/argocd/templates/litellm.yaml +++ b/infra/argocd/templates/litellm.yaml @@ -18,4 +18,3 @@ # selfHeal: true # syncOptions: # - CreateNamespace=true -# \ No newline at end of file From 6292d1730e1ece33d07bde1a32af281758c2aed1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 07:21:35 -0500 Subject: [PATCH 0663/1058] update --- infra/istio-system/templates/expose.yaml | 103 +++++++++++++---------- 1 file changed, 60 insertions(+), 43 deletions(-) diff --git a/infra/istio-system/templates/expose.yaml b/infra/istio-system/templates/expose.yaml index e15971c..34c77f7 100644 --- a/infra/istio-system/templates/expose.yaml +++ b/infra/istio-system/templates/expose.yaml @@ -1,53 +1,70 @@ +#apiVersion: networking.istio.io/v1 +#kind: Gateway +#metadata: +# name: istiod-gateway +#spec: +# selector: +# istio: eastwestgateway +# servers: +# - port: +# name: tls-istiod +# number: 15012 +# protocol: tls +# tls: +# mode: PASSTHROUGH +# hosts: +# - "*" +# - port: +# name: tls-istiodwebhook +# number: 15017 +# protocol: tls +# tls: +# mode: PASSTHROUGH +# hosts: +# - "*" +#--- +#apiVersion: networking.istio.io/v1 +#kind: VirtualService +#metadata: +# name: istiod-vs +#spec: +# hosts: +# - "*" +# gateways: +# - istiod-gateway +# tls: +# - match: +# - port: 15012 +# sniHosts: +# - "*" +# route: +# - destination: +# host: istiod.istio-system.svc.cluster.local +# port: +# number: 15012 +# - match: +# - port: 15017 +# sniHosts: +# - "*" +# route: +# - destination: +# host: istiod.istio-system.svc.cluster.local +# port: +# number: 443 +--- apiVersion: networking.istio.io/v1 kind: Gateway metadata: - name: istiod-gateway + name: cross-network-gateway spec: selector: istio: eastwestgateway servers: - port: - name: tls-istiod - number: 15012 - protocol: tls + number: 15443 + name: tls + protocol: TLS tls: - mode: PASSTHROUGH + mode: AUTO_PASSTHROUGH hosts: - - "*" - - port: - name: tls-istiodwebhook - number: 15017 - protocol: tls - tls: - mode: PASSTHROUGH - hosts: - - "*" ---- -apiVersion: networking.istio.io/v1 -kind: VirtualService -metadata: - name: istiod-vs -spec: - hosts: - - "*" - gateways: - - istiod-gateway - tls: - - match: - - port: 15012 - sniHosts: - - "*" - route: - - destination: - host: istiod.istio-system.svc.cluster.local - port: - number: 15012 - - match: - - port: 15017 - sniHosts: - - "*" - route: - - destination: - host: istiod.istio-system.svc.cluster.local - port: - number: 443 + - "*.local" From 5603924b25055083098d2bfcc51a6b8b0f5b809c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 07:24:18 -0500 Subject: [PATCH 0664/1058] update --- dmz/istio-system/templates/annotate.yaml | 27 ++++++++++++------------ dmz/istio-system/templates/expose.yaml | 16 ++++++++++++++ dmz/istio-system/values.yaml | 4 ++-- 3 files changed, 32 insertions(+), 15 deletions(-) create mode 100644 dmz/istio-system/templates/expose.yaml diff --git a/dmz/istio-system/templates/annotate.yaml b/dmz/istio-system/templates/annotate.yaml index a8a0dc6..620b2af 100644 --- a/dmz/istio-system/templates/annotate.yaml +++ b/dmz/istio-system/templates/annotate.yaml @@ -1,13 +1,14 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - topology.istio.io/controlPlaneClusters: cluster1 - labels: - kubernetes.io/metadata.name: istio-system - name: istio-system -spec: - finalizers: - - kubernetes -status: - phase: Active +#apiVersion: v1 +#kind: Namespace +#metadata: +# annotations: +# topology.istio.io/controlPlaneClusters: cluster1 +# labels: +# kubernetes.io/metadata.name: istio-system +# name: istio-system +#spec: +# finalizers: +# - kubernetes +#status: +# phase: Active +# \ No newline at end of file diff --git a/dmz/istio-system/templates/expose.yaml b/dmz/istio-system/templates/expose.yaml new file mode 100644 index 0000000..eb693e0 --- /dev/null +++ b/dmz/istio-system/templates/expose.yaml @@ -0,0 +1,16 @@ +apiVersion: networking.istio.io/v1 +kind: Gateway +metadata: + name: cross-network-gateway +spec: + selector: + istio: eastwestgateway + servers: + - port: + number: 15443 + name: tls + protocol: TLS + tls: + mode: AUTO_PASSTHROUGH + hosts: + - "*.local" diff --git a/dmz/istio-system/values.yaml b/dmz/istio-system/values.yaml index 5ca6719..097b372 100644 --- a/dmz/istio-system/values.yaml +++ b/dmz/istio-system/values.yaml @@ -428,7 +428,7 @@ istiod: # If the mesh admin does not specify a value, Istio will use the value of the # mesh's Trust Domain. The best practice is to select a proper Trust Domain # value. - meshID: "" + meshID: "mesh1" # Configure the mesh networks to be used by the Split Horizon EDS. # @@ -474,7 +474,7 @@ istiod: # Network defines the network this cluster belong to. This name # corresponds to the networks in the map of mesh networks. - network: "" + network: "network2" # Configure the certificate provider for control plane communication. # Currently, two providers are supported: "kubernetes" and "istiod". From 828331153637e458d20aa7f0918142b7e2517d05 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 07:42:22 -0500 Subject: [PATCH 0665/1058] update --- infra/argocd/templates/istio.yaml | 50 +++++++++++++++---------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index 9a33f34..ffd5915 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -26,28 +26,28 @@ spec: --- -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: istio-system-dmz -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: dmz/istio-system -# destination: -# namespace: istio-system -# name: dmz -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# ignoreDifferences: -# - group: admissionregistration.k8s.io -# kind: ValidatingWebhookConfiguration -# jsonPointers: -# - /webhooks/0/failurePolicy +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: istio-system-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/istio-system + destination: + namespace: istio-system + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + ignoreDifferences: + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jsonPointers: + - /webhooks/0/failurePolicy From 69d486010ca8bd37ff7857a8671f0a08f535ea0f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 07:52:03 -0500 Subject: [PATCH 0666/1058] update --- infra/argocd/templates/istio.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index ffd5915..b687887 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -13,6 +13,9 @@ spec: namespace: istio-system name: in-cluster syncPolicy: + managedNamespaceMetadata: + labels: + topology.istio.io/network: network1 automated: prune: true selfHeal: true @@ -41,6 +44,9 @@ spec: namespace: istio-system name: dmz syncPolicy: + managedNamespaceMetadata: + labels: + topology.istio.io/network: network2 automated: prune: true selfHeal: true From bea5f40ccea6683fa82febc55871e55d51bf1d8b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 08:05:20 -0500 Subject: [PATCH 0667/1058] update --- dmz/istio-system/values.yaml | 43 ++++++++++++++++++------------------ 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/dmz/istio-system/values.yaml b/dmz/istio-system/values.yaml index 097b372..662c0f2 100644 --- a/dmz/istio-system/values.yaml +++ b/dmz/istio-system/values.yaml @@ -1,5 +1,4 @@ istiod: - profile: remote autoscaleEnabled: true autoscaleMin: 1 autoscaleMax: 5 @@ -51,7 +50,7 @@ istiod: cpu: targetAverageUtilization: 80 memory: {} - # targetAverageUtilization: 80 + # targetAverageUtilization: 80 # Additional volumeMounts to the istiod container volumeMounts: [] @@ -177,7 +176,7 @@ istiod: # Sidecar injector mutating webhook configuration path value for the clientConfig.service field. # Override to pass env variables, for example: /inject/cluster/remote/net/network2 - injectionPath: "/inject/cluster/cluster2/net/network1" + injectionPath: "/inject" injectionCABundle: "" telemetry: @@ -386,7 +385,7 @@ istiod: forceApplyIptables: false # configure remote pilot and istiod service and endpoint - remotePilotAddress: "192.168.12.131" + remotePilotAddress: "" ############################################################################################## # The following values are found in other charts. To effectively modify these values, make # @@ -399,10 +398,10 @@ istiod: caAddress: "" # Enable control of remote clusters. - externalIstiod: false + externalIstiod: true # Configure a remote cluster as the config cluster for an external istiod. - configCluster: true + configCluster: false # configValidation enables the validation webhook for Istio configuration. configValidation: true @@ -536,8 +535,8 @@ istiod: # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it seccompProfile: {} + base: - profile: remote global: imagePullSecrets: [] @@ -598,18 +597,18 @@ gateway: # Type of service. Set to "None" to disable the service entirely type: LoadBalancer ports: - - name: status-port - port: 15021 - protocol: TCP - targetPort: 15021 - - name: http2 - port: 80 - protocol: TCP - targetPort: 80 - - name: https - port: 443 - protocol: TCP - targetPort: 443 + - name: status-port + port: 15021 + protocol: TCP + targetPort: 15021 + - name: http2 + port: 80 + protocol: TCP + targetPort: 80 + - name: https + port: 443 + protocol: TCP + targetPort: 443 annotations: {} loadBalancerIP: "" loadBalancerSourceRanges: [] @@ -643,10 +642,10 @@ gateway: # Deployment Update strategy strategy: {} - + # Sets the Deployment minReadySeconds value minReadySeconds: - + # Optionally configure a custom readinessProbe. By default the control plane # automatically injects the readinessProbe. If you wish to override that # behavior, you may define your own readinessProbe here. @@ -669,7 +668,7 @@ gateway: affinity: {} # If specified, the gateway will act as a network gateway for the given network. - networkGateway: "network1" + networkGateway: "network2" # Specify image pull policy if default behavior isn't desired. # Default behavior: latest images will be Always else IfNotPresent From c98b9c685982a75c6c55fd8eccfd6ed995004d2b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 09:00:58 -0500 Subject: [PATCH 0668/1058] update --- dmz/istio-system/values.yaml | 724 +-------------------------------- infra/istio-system/values.yaml | 724 +-------------------------------- 2 files changed, 6 insertions(+), 1442 deletions(-) diff --git a/dmz/istio-system/values.yaml b/dmz/istio-system/values.yaml index 662c0f2..65991be 100644 --- a/dmz/istio-system/values.yaml +++ b/dmz/istio-system/values.yaml @@ -1,724 +1,6 @@ istiod: - autoscaleEnabled: true - autoscaleMin: 1 - autoscaleMax: 5 - autoscaleBehavior: {} - replicaCount: 1 - rollingMaxSurge: 100% - rollingMaxUnavailable: 25% - - hub: "" - tag: "" - variant: "" - - # Can be a full hub/image:tag - image: pilot - traceSampling: 1.0 - - # Resources for a small pilot install - resources: - requests: - cpu: 500m - memory: 2048Mi - - # Set to `type: RuntimeDefault` to use the default profile if available. - seccompProfile: {} - - # Whether to use an existing CNI installation - cni: - enabled: false - provider: default - - # Additional container arguments - extraContainerArgs: [] - - env: {} - - # Settings related to the untaint controller - # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready - # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes - taint: - # Controls whether or not the untaint controller is active - enabled: false - # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod - namespace: "" - - affinity: {} - - tolerations: [] - - cpu: - targetAverageUtilization: 80 - memory: {} - # targetAverageUtilization: 80 - - # Additional volumeMounts to the istiod container - volumeMounts: [] - - # Additional volumes to the istiod pod - volumes: [] - - # Inject initContainers into the istiod pod - initContainers: [] - - nodeSelector: {} - podAnnotations: {} - serviceAnnotations: {} - serviceAccountAnnotations: {} - sidecarInjectorWebhookAnnotations: {} - - topologySpreadConstraints: [] - - # You can use jwksResolverExtraRootCA to provide a root certificate - # in PEM format. This will then be trusted by pilot when resolving - # JWKS URIs. - jwksResolverExtraRootCA: "" - - # The following is used to limit how long a sidecar can be connected - # to a pilot. It balances out load across pilot instances at the cost of - # increasing system churn. - keepaliveMaxServerConnectionAge: 30m - - # Additional labels to apply to the deployment. - deploymentLabels: {} - - ## Mesh config settings - - # Install the mesh config map, generated from values.yaml. - # If false, pilot wil use default values (by default) or user-supplied values. - configMap: true - - # Additional labels to apply on the pod level for monitoring and logging configuration. - podLabels: {} - - # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - ipFamilyPolicy: "" - ipFamilies: [] - - # Ambient mode only. - # Set this if you install ztunnel to a different namespace from `istiod`. - # If set, `istiod` will allow connections from trusted node proxy ztunnels - # in the provided namespace. - # If unset, `istiod` will assume the trusted node proxy ztunnel resides - # in the same namespace as itself. - trustedZtunnelNamespace: "" - - sidecarInjectorWebhook: - # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or - # always skip the injection on pods that match that label selector, regardless of the global policy. - # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions - neverInjectSelector: [] - alwaysInjectSelector: [] - - # injectedAnnotations are additional annotations that will be added to the pod spec after injection - # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations: - # - # annotations: - # apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default - # apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default - # - # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before - # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify: - # injectedAnnotations: - # container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default - # container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default - injectedAnnotations: {} - - # This enables injection of sidecar in all namespaces, - # with the exception of namespaces with "istio-injection:disabled" annotation - # Only one environment should have this enabled. - enableNamespacesByDefault: false - - # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run - # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten. - # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur. - reinvocationPolicy: Never - - rewriteAppHTTPProbe: true - - # Templates defines a set of custom injection templates that can be used. For example, defining: - # - # templates: - # hello: | - # metadata: - # labels: - # hello: world - # - # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod - # being injected with the hello=world labels. - # This is intended for advanced configuration only; most users should use the built in template - templates: {} - - # Default templates specifies a set of default templates that are used in sidecar injection. - # By default, a template `sidecar` is always provided, which contains the template of default sidecar. - # To inject other additional templates, define it using the `templates` option, and add it to - # the default templates list. - # For example: - # - # templates: - # hello: | - # metadata: - # labels: - # hello: world - # - # defaultTemplates: ["sidecar", "hello"] - defaultTemplates: [] - istiodRemote: - # If `true`, indicates that this cluster/install should consume a "remote istiod" installation, - # and istiod itself will NOT be installed in this cluster - only the support resources necessary - # to utilize a remote instance. - enabled: false - # Sidecar injector mutating webhook configuration clientConfig.url value. - # For example: https://$remotePilotAddress:15017/inject - # The host should not refer to a service running in the cluster; use a service reference by specifying - # the clientConfig.service field instead. - injectionURL: "" - - # Sidecar injector mutating webhook configuration path value for the clientConfig.service field. - # Override to pass env variables, for example: /inject/cluster/remote/net/network2 - injectionPath: "/inject" - - injectionCABundle: "" - telemetry: - enabled: true - v2: - # For Null VM case now. - # This also enables metadata exchange. - enabled: true - # Indicate if prometheus stats filter is enabled or not - prometheus: - enabled: true - # stackdriver filter settings. - stackdriver: - enabled: false - # Revision is set as 'version' label and part of the resource names when installing multiple control planes. - revision: "" - - # Revision tags are aliases to Istio control plane revisions - revisionTags: [] - - # For Helm compatibility. - ownerName: "" - - # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior - # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options - meshConfig: - enablePrometheusMerge: true - - experimental: - stableValidationPolicy: false - global: - # Used to locate istiod. - istioNamespace: istio-system - # List of cert-signers to allow "approve" action in the istio cluster role - # - # certSigners: - # - clusterissuers.cert-manager.io/istio-ca - certSigners: [] - # enable pod disruption budget for the control plane, which is used to - # ensure Istio control plane components are gradually upgraded or recovered. - defaultPodDisruptionBudget: - enabled: true - # The values aren't mutable due to a current PodDisruptionBudget limitation - # minAvailable: 1 - - # A minimal set of requested resources to applied to all deployments so that - # Horizontal Pod Autoscaler will be able to function (if set). - # Each component can overwrite these default values by adding its own resources - # block in the relevant section below and setting the desired resources values. - defaultResources: - requests: - cpu: 10m - # memory: 128Mi - # limits: - # cpu: 100m - # memory: 128Mi - - # Default hub for Istio images. - # Releases are published to docker hub under 'istio' project. - # Dev builds from prow are on gcr.io - hub: docker.io/istio - # Default tag for Istio images. - tag: 1.25.0 - # Variant of the image to use. - # Currently supported are: [debug, distroless] - variant: "" - - # Specify image pull policy if default behavior isn't desired. - # Default behavior: latest images will be Always else IfNotPresent. - imagePullPolicy: "" - - # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace - # to use for pulling any images in pods that reference this ServiceAccount. - # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing) - # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects. - # Must be set for any cluster configured with private docker registry. - imagePullSecrets: [] - # - private-registry-key - - # Enabled by default in master for maximising testing. - istiod: - enableAnalysis: false - - # To output all istio components logs in json format by adding --log_as_json argument to each container argument - logAsJson: false - - # Comma-separated minimum per-scope logging level of messages to output, in the form of :,: - # The control plane has different scopes depending on component, but can configure default log level across all components - # If empty, default scope and level will be used as configured in code - logging: - level: "default:info" - - omitSidecarInjectorConfigMap: false - - # Configure whether Operator manages webhook configurations. The current behavior - # of Istiod is to manage its own webhook configurations. - # When this option is set as true, Istio Operator, instead of webhooks, manages the - # webhook configurations. When this option is set as false, webhooks manage their - # own webhook configurations. - operatorManageWebhooks: false - - # Custom DNS config for the pod to resolve names of services in other - # clusters. Use this to add additional search domains, and other settings. - # see - # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config - # This does not apply to gateway pods as they typically need a different - # set of DNS settings than the normal application pods (e.g., in - # multicluster scenarios). - # NOTE: If using templates, follow the pattern in the commented example below. - #podDNSSearchNamespaces: - #- global - #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global" - - # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and - # system-node-critical, it is better to configure this in order to make sure your Istio pods - # will not be killed because of low priority class. - # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - # for more detail. - priorityClassName: "" - - proxy: - image: proxyv2 - - # This controls the 'policy' in the sidecar injector. - autoInject: enabled - - # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value - # cluster domain. Default value is "cluster.local". - clusterDomain: "cluster.local" - - # Per Component log level for proxy, applies to gateways and sidecars. If a component level is - # not set, then the global "logLevel" will be used. - componentLogLevel: "misc:error" - - # istio ingress capture allowlist - # examples: - # Redirect only selected ports: --includeInboundPorts="80,8080" - excludeInboundPorts: "" - includeInboundPorts: "*" - - # istio egress capture allowlist - # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly - # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16" - # would only capture egress traffic on those two IP Ranges, all other outbound traffic would - # be allowed by the sidecar - includeIPRanges: "*" - excludeIPRanges: "" - includeOutboundPorts: "" - excludeOutboundPorts: "" - - # Log level for proxy, applies to gateways and sidecars. - # Expected values are: trace|debug|info|warning|error|critical|off - logLevel: warning - - # Specify the path to the outlier event log. - # Example: /dev/stdout - outlierLogPath: "" - - #If set to true, istio-proxy container will have privileged securityContext - privileged: false - - # The number of successive failed probes before indicating readiness failure. - readinessFailureThreshold: 4 - - # The initial delay for readiness probes in seconds. - readinessInitialDelaySeconds: 0 - - # The period between readiness probes. - readinessPeriodSeconds: 15 - - # Enables or disables a startup probe. - # For optimal startup times, changing this should be tied to the readiness probe values. - # - # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4. - # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval), - # and doesn't spam the readiness endpoint too much - # - # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30. - # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly. - startupProbe: - enabled: true - failureThreshold: 600 # 10 minutes - - # Resources for the sidecar. - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 2000m - memory: 1024Mi - - # Default port for Pilot agent health checks. A value of 0 will disable health checking. - statusPort: 15020 - - # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none. - # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file. - tracer: "none" - - proxy_init: - # Base name for the proxy_init container, used to configure iptables. - image: proxyv2 - # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures. - # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases. - forceApplyIptables: false - - # configure remote pilot and istiod service and endpoint - remotePilotAddress: "" - - ############################################################################################## - # The following values are found in other charts. To effectively modify these values, make # - # make sure they are consistent across your Istio helm charts # - ############################################################################################## - - # The customized CA address to retrieve certificates for the pods in the cluster. - # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint. - # If not set explicitly, default to the Istio discovery address. - caAddress: "" - - # Enable control of remote clusters. - externalIstiod: true - - # Configure a remote cluster as the config cluster for an external istiod. - configCluster: false - - # configValidation enables the validation webhook for Istio configuration. - configValidation: true - - # Mesh ID means Mesh Identifier. It should be unique within the scope where - # meshes will interact with each other, but it is not required to be - # globally/universally unique. For example, if any of the following are true, - # then two meshes must have different Mesh IDs: - # - Meshes will have their telemetry aggregated in one place - # - Meshes will be federated together - # - Policy will be written referencing one mesh from the other - # - # If an administrator expects that any of these conditions may become true in - # the future, they should ensure their meshes have different Mesh IDs - # assigned. - # - # Within a multicluster mesh, each cluster must be (manually or auto) - # configured to have the same Mesh ID value. If an existing cluster 'joins' a - # multicluster mesh, it will need to be migrated to the new mesh ID. Details - # of migration TBD, and it may be a disruptive operation to change the Mesh - # ID post-install. - # - # If the mesh admin does not specify a value, Istio will use the value of the - # mesh's Trust Domain. The best practice is to select a proper Trust Domain - # value. - meshID: "mesh1" - - # Configure the mesh networks to be used by the Split Horizon EDS. - # - # The following example defines two networks with different endpoints association methods. - # For `network1` all endpoints that their IP belongs to the provided CIDR range will be - # mapped to network1. The gateway for this network example is specified by its public IP - # address and port. - # The second network, `network2`, in this example is defined differently with all endpoints - # retrieved through the specified Multi-Cluster registry being mapped to network2. The - # gateway is also defined differently with the name of the gateway service on the remote - # cluster. The public IP for the gateway will be determined from that remote service (only - # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service, - # it still need to be configured manually). - # - # meshNetworks: - # network1: - # endpoints: - # - fromCidr: "192.168.0.1/24" - # gateways: - # - address: 1.1.1.1 - # port: 80 - # network2: - # endpoints: - # - fromRegistry: reg1 - # gateways: - # - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local - # port: 443 - # - meshNetworks: {} - - # Use the user-specified, secret volume mounted key and certs for Pilot and workloads. - mountMtlsCerts: false - + network: network2 + meshID: mesh1 multiCluster: - # Set to true to connect two kubernetes clusters via their respective - # ingressgateway services when pods in each cluster cannot directly - # talk to one another. All clusters should be using Istio mTLS and must - # have a shared root CA for this model to work. - enabled: false - # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection - # to properly label proxies - clusterName: "dmz" - - # Network defines the network this cluster belong to. This name - # corresponds to the networks in the map of mesh networks. - network: "network2" - - # Configure the certificate provider for control plane communication. - # Currently, two providers are supported: "kubernetes" and "istiod". - # As some platforms may not have kubernetes signing APIs, - # Istiod is the default - pilotCertProvider: istiod - - sds: - # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3. - # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the - # JWT is intended for the CA. - token: - aud: istio-ca - - sts: - # The service port used by Security Token Service (STS) server to handle token exchange requests. - # Setting this port to a non-zero value enables STS server. - servicePort: 0 - - # The name of the CA for workload certificates. - # For example, when caName=GkeWorkloadCertificate, GKE workload certificates - # will be used as the certificates for workloads. - # The default value is "" and when caName="", the CA will be configured by other - # mechanisms (e.g., environmental variable CA_PROVIDER). - caName: "" - - waypoint: - # Resources for the waypoint proxy. - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: "2" - memory: 1Gi - - # If specified, affinity defines the scheduling constraints of waypoint pods. - affinity: {} - - # Topology Spread Constraints for the waypoint proxy. - topologySpreadConstraints: [] - - # Node labels for the waypoint proxy. - nodeSelector: {} - - # Tolerations for the waypoint proxy. - tolerations: [] - - base: - # For istioctl usage to disable istio config crds in base - enableIstioConfigCRDs: true - - # Gateway Settings - gateways: - # Define the security context for the pod. - # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. - # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. - securityContext: {} - - # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it - seccompProfile: {} - -base: - global: - imagePullSecrets: [] - - istioNamespace: istio-system - base: - excludedCRDs: [] - enableCRDTemplates: true - - validationURL: "" - validationCABundle: "" - - enableIstioConfigCRDs: true - - defaultRevision: "default" - experimental: - stableValidationPolicy: false - -gateway: - # Name allows overriding the release name. Generally this should not be set - name: "istio-eastwestgateway" - # revision declares which revision this gateway is a part of - revision: "" - - # Controls the spec.replicas setting for the Gateway deployment if set. - # Otherwise defaults to Kubernetes Deployment default (1). - replicaCount: - - kind: Deployment - - rbac: - # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed - # when using http://gateway-api.org/. - enabled: true - - serviceAccount: - # If set, a service account will be created. Otherwise, the default is used - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set, the release name is used - name: "" - - podAnnotations: - prometheus.io/port: "15020" - prometheus.io/scrape: "true" - prometheus.io/path: "/stats/prometheus" - inject.istio.io/templates: "gateway" - sidecar.istio.io/inject: "true" - - # Define the security context for the pod. - # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. - # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. - securityContext: {} - containerSecurityContext: {} - - service: - # Type of service. Set to "None" to disable the service entirely - type: LoadBalancer - ports: - - name: status-port - port: 15021 - protocol: TCP - targetPort: 15021 - - name: http2 - port: 80 - protocol: TCP - targetPort: 80 - - name: https - port: 443 - protocol: TCP - targetPort: 443 - annotations: {} - loadBalancerIP: "" - loadBalancerSourceRanges: [] - externalTrafficPolicy: "" - externalIPs: [] - ipFamilyPolicy: "" - ipFamilies: [] - ## Whether to automatically allocate NodePorts (only for LoadBalancers). - # allocateLoadBalancerNodePorts: false - ## Set LoadBalancer class (only for LoadBalancers). - # loadBalancerClass: "" - - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 2000m - memory: 1024Mi - - autoscaling: - enabled: true - minReplicas: 1 - maxReplicas: 5 - targetCPUUtilizationPercentage: 80 - targetMemoryUtilizationPercentage: {} - autoscaleBehavior: {} - - # Pod environment variables - env: {} - - # Deployment Update strategy - strategy: {} - - # Sets the Deployment minReadySeconds value - minReadySeconds: - - # Optionally configure a custom readinessProbe. By default the control plane - # automatically injects the readinessProbe. If you wish to override that - # behavior, you may define your own readinessProbe here. - readinessProbe: {} - - # Labels to apply to all resources - labels: - # By default, don't enroll gateways into the ambient dataplane - "istio.io/dataplane-mode": none - - # Annotations to apply to all resources - annotations: {} - - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # If specified, the gateway will act as a network gateway for the given network. - networkGateway: "network2" - - # Specify image pull policy if default behavior isn't desired. - # Default behavior: latest images will be Always else IfNotPresent - imagePullPolicy: "" - - imagePullSecrets: [] - - # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway. - # - # By default, the `podDisruptionBudget` is disabled (set to `{}`), - # which means that no PodDisruptionBudget resource will be created. - # - # To enable the PodDisruptionBudget, configure it by specifying the - # `minAvailable` or `maxUnavailable`. For example, to set the - # minimum number of available replicas to 1, you can update this value as follows: - # - # podDisruptionBudget: - # minAvailable: 1 - # - # Or, to allow a maximum of 1 unavailable replica, you can set: - # - # podDisruptionBudget: - # maxUnavailable: 1 - # - # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`. - # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows: - # - # podDisruptionBudget: - # minAvailable: 1 - # unhealthyPodEvictionPolicy: AlwaysAllow - # - # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`: - # - # podDisruptionBudget: {} - # - podDisruptionBudget: {} - - # Sets the per-pod terminationGracePeriodSeconds setting. - terminationGracePeriodSeconds: 30 - - # A list of `Volumes` added into the Gateway Pods. See - # https://kubernetes.io/docs/concepts/storage/volumes/. - volumes: [] - - # A list of `VolumeMounts` added into the Gateway Pods. See - # https://kubernetes.io/docs/concepts/storage/volumes/. - volumeMounts: [] - - # Configure this to a higher priority class in order to make sure your Istio gateway pods - # will not be killed because of low priority class. - # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - # for more detail. - priorityClassName: "" + clusterName: dmz diff --git a/infra/istio-system/values.yaml b/infra/istio-system/values.yaml index 522ee34..e36bf6a 100644 --- a/infra/istio-system/values.yaml +++ b/infra/istio-system/values.yaml @@ -1,724 +1,6 @@ istiod: - autoscaleEnabled: true - autoscaleMin: 1 - autoscaleMax: 5 - autoscaleBehavior: {} - replicaCount: 1 - rollingMaxSurge: 100% - rollingMaxUnavailable: 25% - - hub: "" - tag: "" - variant: "" - - # Can be a full hub/image:tag - image: pilot - traceSampling: 1.0 - - # Resources for a small pilot install - resources: - requests: - cpu: 500m - memory: 2048Mi - - # Set to `type: RuntimeDefault` to use the default profile if available. - seccompProfile: {} - - # Whether to use an existing CNI installation - cni: - enabled: false - provider: default - - # Additional container arguments - extraContainerArgs: [] - - env: {} - - # Settings related to the untaint controller - # This controller will remove `cni.istio.io/not-ready` from nodes when the istio-cni pod becomes ready - # It should be noted that cluster operator/owner is responsible for having the taint set by their infrastructure provider when new nodes are added to the cluster; the untaint controller does not taint nodes - taint: - # Controls whether or not the untaint controller is active - enabled: false - # What namespace the untaint controller should watch for istio-cni pods. This is only required when istio-cni is running in a different namespace than istiod - namespace: "" - - affinity: {} - - tolerations: [] - - cpu: - targetAverageUtilization: 80 - memory: {} - # targetAverageUtilization: 80 - - # Additional volumeMounts to the istiod container - volumeMounts: [] - - # Additional volumes to the istiod pod - volumes: [] - - # Inject initContainers into the istiod pod - initContainers: [] - - nodeSelector: {} - podAnnotations: {} - serviceAnnotations: {} - serviceAccountAnnotations: {} - sidecarInjectorWebhookAnnotations: {} - - topologySpreadConstraints: [] - - # You can use jwksResolverExtraRootCA to provide a root certificate - # in PEM format. This will then be trusted by pilot when resolving - # JWKS URIs. - jwksResolverExtraRootCA: "" - - # The following is used to limit how long a sidecar can be connected - # to a pilot. It balances out load across pilot instances at the cost of - # increasing system churn. - keepaliveMaxServerConnectionAge: 30m - - # Additional labels to apply to the deployment. - deploymentLabels: {} - - ## Mesh config settings - - # Install the mesh config map, generated from values.yaml. - # If false, pilot wil use default values (by default) or user-supplied values. - configMap: true - - # Additional labels to apply on the pod level for monitoring and logging configuration. - podLabels: {} - - # Setup how istiod Service is configured. See https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - ipFamilyPolicy: "" - ipFamilies: [] - - # Ambient mode only. - # Set this if you install ztunnel to a different namespace from `istiod`. - # If set, `istiod` will allow connections from trusted node proxy ztunnels - # in the provided namespace. - # If unset, `istiod` will assume the trusted node proxy ztunnel resides - # in the same namespace as itself. - trustedZtunnelNamespace: "" - - sidecarInjectorWebhook: - # You can use the field called alwaysInjectSelector and neverInjectSelector which will always inject the sidecar or - # always skip the injection on pods that match that label selector, regardless of the global policy. - # See https://istio.io/docs/setup/kubernetes/additional-setup/sidecar-injection/#more-control-adding-exceptions - neverInjectSelector: [] - alwaysInjectSelector: [] - - # injectedAnnotations are additional annotations that will be added to the pod spec after injection - # This is primarily to support PSP annotations. For example, if you defined a PSP with the annotations: - # - # annotations: - # apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default - # apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default - # - # The PSP controller would add corresponding annotations to the pod spec for each container. However, this happens before - # the inject adds additional containers, so we must specify them explicitly here. With the above example, we could specify: - # injectedAnnotations: - # container.apparmor.security.beta.kubernetes.io/istio-init: runtime/default - # container.apparmor.security.beta.kubernetes.io/istio-proxy: runtime/default - injectedAnnotations: {} - - # This enables injection of sidecar in all namespaces, - # with the exception of namespaces with "istio-injection:disabled" annotation - # Only one environment should have this enabled. - enableNamespacesByDefault: false - - # Mutations that occur after the sidecar injector are not handled by default, as the Istio sidecar injector is only run - # once. For example, an OPA sidecar injected after the Istio sidecar will not have it's liveness/readiness probes rewritten. - # Setting this to `IfNeeded` will result in the sidecar injector being run again if additional mutations occur. - reinvocationPolicy: Never - - rewriteAppHTTPProbe: true - - # Templates defines a set of custom injection templates that can be used. For example, defining: - # - # templates: - # hello: | - # metadata: - # labels: - # hello: world - # - # Then starting a pod with the `inject.istio.io/templates: hello` annotation, will result in the pod - # being injected with the hello=world labels. - # This is intended for advanced configuration only; most users should use the built in template - templates: {} - - # Default templates specifies a set of default templates that are used in sidecar injection. - # By default, a template `sidecar` is always provided, which contains the template of default sidecar. - # To inject other additional templates, define it using the `templates` option, and add it to - # the default templates list. - # For example: - # - # templates: - # hello: | - # metadata: - # labels: - # hello: world - # - # defaultTemplates: ["sidecar", "hello"] - defaultTemplates: [] - istiodRemote: - # If `true`, indicates that this cluster/install should consume a "remote istiod" installation, - # and istiod itself will NOT be installed in this cluster - only the support resources necessary - # to utilize a remote instance. - enabled: false - # Sidecar injector mutating webhook configuration clientConfig.url value. - # For example: https://$remotePilotAddress:15017/inject - # The host should not refer to a service running in the cluster; use a service reference by specifying - # the clientConfig.service field instead. - injectionURL: "" - - # Sidecar injector mutating webhook configuration path value for the clientConfig.service field. - # Override to pass env variables, for example: /inject/cluster/remote/net/network2 - injectionPath: "/inject" - - injectionCABundle: "" - telemetry: - enabled: true - v2: - # For Null VM case now. - # This also enables metadata exchange. - enabled: true - # Indicate if prometheus stats filter is enabled or not - prometheus: - enabled: true - # stackdriver filter settings. - stackdriver: - enabled: false - # Revision is set as 'version' label and part of the resource names when installing multiple control planes. - revision: "" - - # Revision tags are aliases to Istio control plane revisions - revisionTags: [] - - # For Helm compatibility. - ownerName: "" - - # meshConfig defines runtime configuration of components, including Istiod and istio-agent behavior - # See https://istio.io/docs/reference/config/istio.mesh.v1alpha1/ for all available options - meshConfig: - enablePrometheusMerge: true - - experimental: - stableValidationPolicy: false - global: - # Used to locate istiod. - istioNamespace: istio-system - # List of cert-signers to allow "approve" action in the istio cluster role - # - # certSigners: - # - clusterissuers.cert-manager.io/istio-ca - certSigners: [] - # enable pod disruption budget for the control plane, which is used to - # ensure Istio control plane components are gradually upgraded or recovered. - defaultPodDisruptionBudget: - enabled: true - # The values aren't mutable due to a current PodDisruptionBudget limitation - # minAvailable: 1 - - # A minimal set of requested resources to applied to all deployments so that - # Horizontal Pod Autoscaler will be able to function (if set). - # Each component can overwrite these default values by adding its own resources - # block in the relevant section below and setting the desired resources values. - defaultResources: - requests: - cpu: 10m - # memory: 128Mi - # limits: - # cpu: 100m - # memory: 128Mi - - # Default hub for Istio images. - # Releases are published to docker hub under 'istio' project. - # Dev builds from prow are on gcr.io - hub: docker.io/istio - # Default tag for Istio images. - tag: 1.25.0 - # Variant of the image to use. - # Currently supported are: [debug, distroless] - variant: "" - - # Specify image pull policy if default behavior isn't desired. - # Default behavior: latest images will be Always else IfNotPresent. - imagePullPolicy: "" - - # ImagePullSecrets for all ServiceAccount, list of secrets in the same namespace - # to use for pulling any images in pods that reference this ServiceAccount. - # For components that don't use ServiceAccounts (i.e. grafana, servicegraph, tracing) - # ImagePullSecrets will be added to the corresponding Deployment(StatefulSet) objects. - # Must be set for any cluster configured with private docker registry. - imagePullSecrets: [] - # - private-registry-key - - # Enabled by default in master for maximising testing. - istiod: - enableAnalysis: false - - # To output all istio components logs in json format by adding --log_as_json argument to each container argument - logAsJson: false - - # Comma-separated minimum per-scope logging level of messages to output, in the form of :,: - # The control plane has different scopes depending on component, but can configure default log level across all components - # If empty, default scope and level will be used as configured in code - logging: - level: "default:info" - - omitSidecarInjectorConfigMap: false - - # Configure whether Operator manages webhook configurations. The current behavior - # of Istiod is to manage its own webhook configurations. - # When this option is set as true, Istio Operator, instead of webhooks, manages the - # webhook configurations. When this option is set as false, webhooks manage their - # own webhook configurations. - operatorManageWebhooks: false - - # Custom DNS config for the pod to resolve names of services in other - # clusters. Use this to add additional search domains, and other settings. - # see - # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#dns-config - # This does not apply to gateway pods as they typically need a different - # set of DNS settings than the normal application pods (e.g., in - # multicluster scenarios). - # NOTE: If using templates, follow the pattern in the commented example below. - #podDNSSearchNamespaces: - #- global - #- "{{ valueOrDefault .DeploymentMeta.Namespace \"default\" }}.global" - - # Kubernetes >=v1.11.0 will create two PriorityClass, including system-cluster-critical and - # system-node-critical, it is better to configure this in order to make sure your Istio pods - # will not be killed because of low priority class. - # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - # for more detail. - priorityClassName: "" - - proxy: - image: proxyv2 - - # This controls the 'policy' in the sidecar injector. - autoInject: enabled - - # CAUTION: It is important to ensure that all Istio helm charts specify the same clusterDomain value - # cluster domain. Default value is "cluster.local". - clusterDomain: "cluster.local" - - # Per Component log level for proxy, applies to gateways and sidecars. If a component level is - # not set, then the global "logLevel" will be used. - componentLogLevel: "misc:error" - - # istio ingress capture allowlist - # examples: - # Redirect only selected ports: --includeInboundPorts="80,8080" - excludeInboundPorts: "" - includeInboundPorts: "*" - - # istio egress capture allowlist - # https://istio.io/docs/tasks/traffic-management/egress.html#calling-external-services-directly - # example: includeIPRanges: "172.30.0.0/16,172.20.0.0/16" - # would only capture egress traffic on those two IP Ranges, all other outbound traffic would - # be allowed by the sidecar - includeIPRanges: "*" - excludeIPRanges: "" - includeOutboundPorts: "" - excludeOutboundPorts: "" - - # Log level for proxy, applies to gateways and sidecars. - # Expected values are: trace|debug|info|warning|error|critical|off - logLevel: warning - - # Specify the path to the outlier event log. - # Example: /dev/stdout - outlierLogPath: "" - - #If set to true, istio-proxy container will have privileged securityContext - privileged: false - - # The number of successive failed probes before indicating readiness failure. - readinessFailureThreshold: 4 - - # The initial delay for readiness probes in seconds. - readinessInitialDelaySeconds: 0 - - # The period between readiness probes. - readinessPeriodSeconds: 15 - - # Enables or disables a startup probe. - # For optimal startup times, changing this should be tied to the readiness probe values. - # - # If the probe is enabled, it is recommended to have delay=0s,period=15s,failureThreshold=4. - # This ensures the pod is marked ready immediately after the startup probe passes (which has a 1s poll interval), - # and doesn't spam the readiness endpoint too much - # - # If the probe is disabled, it is recommended to have delay=1s,period=2s,failureThreshold=30. - # This ensures the startup is reasonable fast (polling every 2s). 1s delay is used since the startup is not often ready instantly. - startupProbe: - enabled: true - failureThreshold: 600 # 10 minutes - - # Resources for the sidecar. - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 2000m - memory: 1024Mi - - # Default port for Pilot agent health checks. A value of 0 will disable health checking. - statusPort: 15020 - - # Specify which tracer to use. One of: zipkin, lightstep, datadog, stackdriver, none. - # If using stackdriver tracer outside GCP, set env GOOGLE_APPLICATION_CREDENTIALS to the GCP credential file. - tracer: "none" - - proxy_init: - # Base name for the proxy_init container, used to configure iptables. - image: proxyv2 - # Bypasses iptables idempotency handling, and attempts to apply iptables rules regardless of table state, which may cause unrecoverable failures. - # Do not use unless you need to work around an issue of the idempotency handling. This flag will be removed in future releases. - forceApplyIptables: false - - # configure remote pilot and istiod service and endpoint - remotePilotAddress: "" - - ############################################################################################## - # The following values are found in other charts. To effectively modify these values, make # - # make sure they are consistent across your Istio helm charts # - ############################################################################################## - - # The customized CA address to retrieve certificates for the pods in the cluster. - # CSR clients such as the Istio Agent and ingress gateways can use this to specify the CA endpoint. - # If not set explicitly, default to the Istio discovery address. - caAddress: "" - - # Enable control of remote clusters. - externalIstiod: true - - # Configure a remote cluster as the config cluster for an external istiod. - configCluster: false - - # configValidation enables the validation webhook for Istio configuration. - configValidation: true - - # Mesh ID means Mesh Identifier. It should be unique within the scope where - # meshes will interact with each other, but it is not required to be - # globally/universally unique. For example, if any of the following are true, - # then two meshes must have different Mesh IDs: - # - Meshes will have their telemetry aggregated in one place - # - Meshes will be federated together - # - Policy will be written referencing one mesh from the other - # - # If an administrator expects that any of these conditions may become true in - # the future, they should ensure their meshes have different Mesh IDs - # assigned. - # - # Within a multicluster mesh, each cluster must be (manually or auto) - # configured to have the same Mesh ID value. If an existing cluster 'joins' a - # multicluster mesh, it will need to be migrated to the new mesh ID. Details - # of migration TBD, and it may be a disruptive operation to change the Mesh - # ID post-install. - # - # If the mesh admin does not specify a value, Istio will use the value of the - # mesh's Trust Domain. The best practice is to select a proper Trust Domain - # value. - meshID: "mesh1" - - # Configure the mesh networks to be used by the Split Horizon EDS. - # - # The following example defines two networks with different endpoints association methods. - # For `network1` all endpoints that their IP belongs to the provided CIDR range will be - # mapped to network1. The gateway for this network example is specified by its public IP - # address and port. - # The second network, `network2`, in this example is defined differently with all endpoints - # retrieved through the specified Multi-Cluster registry being mapped to network2. The - # gateway is also defined differently with the name of the gateway service on the remote - # cluster. The public IP for the gateway will be determined from that remote service (only - # LoadBalancer gateway service type is currently supported, for a NodePort type gateway service, - # it still need to be configured manually). - # - # meshNetworks: - # network1: - # endpoints: - # - fromCidr: "192.168.0.1/24" - # gateways: - # - address: 1.1.1.1 - # port: 80 - # network2: - # endpoints: - # - fromRegistry: reg1 - # gateways: - # - registryServiceName: istio-ingressgateway.istio-system.svc.cluster.local - # port: 443 - # - meshNetworks: {} - - # Use the user-specified, secret volume mounted key and certs for Pilot and workloads. - mountMtlsCerts: false - + network: network1 + meshID: mesh1 multiCluster: - # Set to true to connect two kubernetes clusters via their respective - # ingressgateway services when pods in each cluster cannot directly - # talk to one another. All clusters should be using Istio mTLS and must - # have a shared root CA for this model to work. - enabled: false - # Should be set to the name of the cluster this installation will run in. This is required for sidecar injection - # to properly label proxies - clusterName: "infra" - - # Network defines the network this cluster belong to. This name - # corresponds to the networks in the map of mesh networks. - network: "network1" - - # Configure the certificate provider for control plane communication. - # Currently, two providers are supported: "kubernetes" and "istiod". - # As some platforms may not have kubernetes signing APIs, - # Istiod is the default - pilotCertProvider: istiod - - sds: - # The JWT token for SDS and the aud field of such JWT. See RFC 7519, section 4.1.3. - # When a CSR is sent from Istio Agent to the CA (e.g. Istiod), this aud is to make sure the - # JWT is intended for the CA. - token: - aud: istio-ca - - sts: - # The service port used by Security Token Service (STS) server to handle token exchange requests. - # Setting this port to a non-zero value enables STS server. - servicePort: 0 - - # The name of the CA for workload certificates. - # For example, when caName=GkeWorkloadCertificate, GKE workload certificates - # will be used as the certificates for workloads. - # The default value is "" and when caName="", the CA will be configured by other - # mechanisms (e.g., environmental variable CA_PROVIDER). - caName: "" - - waypoint: - # Resources for the waypoint proxy. - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: "2" - memory: 1Gi - - # If specified, affinity defines the scheduling constraints of waypoint pods. - affinity: {} - - # Topology Spread Constraints for the waypoint proxy. - topologySpreadConstraints: [] - - # Node labels for the waypoint proxy. - nodeSelector: {} - - # Tolerations for the waypoint proxy. - tolerations: [] - - base: - # For istioctl usage to disable istio config crds in base - enableIstioConfigCRDs: true - - # Gateway Settings - gateways: - # Define the security context for the pod. - # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. - # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. - securityContext: {} - - # Set to `type: RuntimeDefault` to use the default profile for templated gateways, if your container runtime supports it - seccompProfile: {} - -base: - global: - imagePullSecrets: [] - - istioNamespace: istio-system - base: - excludedCRDs: [] - enableCRDTemplates: true - - validationURL: "" - validationCABundle: "" - - enableIstioConfigCRDs: true - - defaultRevision: "default" - experimental: - stableValidationPolicy: false - -gateway: - # Name allows overriding the release name. Generally this should not be set - name: "istio-eastwestgateway" - # revision declares which revision this gateway is a part of - revision: "" - - # Controls the spec.replicas setting for the Gateway deployment if set. - # Otherwise defaults to Kubernetes Deployment default (1). - replicaCount: - - kind: Deployment - - rbac: - # If enabled, roles will be created to enable accessing certificates from Gateways. This is not needed - # when using http://gateway-api.org/. - enabled: true - - serviceAccount: - # If set, a service account will be created. Otherwise, the default is used - create: true - # Annotations to add to the service account - annotations: {} - # The name of the service account to use. - # If not set, the release name is used - name: "" - - podAnnotations: - prometheus.io/port: "15020" - prometheus.io/scrape: "true" - prometheus.io/path: "/stats/prometheus" - inject.istio.io/templates: "gateway" - sidecar.istio.io/inject: "true" - - # Define the security context for the pod. - # If unset, this will be automatically set to the minimum privileges required to bind to port 80 and 443. - # On Kubernetes 1.22+, this only requires the `net.ipv4.ip_unprivileged_port_start` sysctl. - securityContext: {} - containerSecurityContext: {} - - service: - # Type of service. Set to "None" to disable the service entirely - type: LoadBalancer - ports: - - name: status-port - port: 15021 - protocol: TCP - targetPort: 15021 - - name: http2 - port: 80 - protocol: TCP - targetPort: 80 - - name: https - port: 443 - protocol: TCP - targetPort: 443 - annotations: {} - loadBalancerIP: "" - loadBalancerSourceRanges: [] - externalTrafficPolicy: "" - externalIPs: [] - ipFamilyPolicy: "" - ipFamilies: [] - ## Whether to automatically allocate NodePorts (only for LoadBalancers). - # allocateLoadBalancerNodePorts: false - ## Set LoadBalancer class (only for LoadBalancers). - # loadBalancerClass: "" - - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 2000m - memory: 1024Mi - - autoscaling: - enabled: true - minReplicas: 1 - maxReplicas: 5 - targetCPUUtilizationPercentage: 80 - targetMemoryUtilizationPercentage: {} - autoscaleBehavior: {} - - # Pod environment variables - env: {} - - # Deployment Update strategy - strategy: {} - - # Sets the Deployment minReadySeconds value - minReadySeconds: - - # Optionally configure a custom readinessProbe. By default the control plane - # automatically injects the readinessProbe. If you wish to override that - # behavior, you may define your own readinessProbe here. - readinessProbe: {} - - # Labels to apply to all resources - labels: - # By default, don't enroll gateways into the ambient dataplane - "istio.io/dataplane-mode": none - - # Annotations to apply to all resources - annotations: {} - - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # If specified, the gateway will act as a network gateway for the given network. - networkGateway: "network1" - - # Specify image pull policy if default behavior isn't desired. - # Default behavior: latest images will be Always else IfNotPresent - imagePullPolicy: "" - - imagePullSecrets: [] - - # This value is used to configure a Kubernetes PodDisruptionBudget for the gateway. - # - # By default, the `podDisruptionBudget` is disabled (set to `{}`), - # which means that no PodDisruptionBudget resource will be created. - # - # To enable the PodDisruptionBudget, configure it by specifying the - # `minAvailable` or `maxUnavailable`. For example, to set the - # minimum number of available replicas to 1, you can update this value as follows: - # - # podDisruptionBudget: - # minAvailable: 1 - # - # Or, to allow a maximum of 1 unavailable replica, you can set: - # - # podDisruptionBudget: - # maxUnavailable: 1 - # - # You can also specify the `unhealthyPodEvictionPolicy` field, and the valid values are `IfHealthyBudget` and `AlwaysAllow`. - # For example, to set the `unhealthyPodEvictionPolicy` to `AlwaysAllow`, you can update this value as follows: - # - # podDisruptionBudget: - # minAvailable: 1 - # unhealthyPodEvictionPolicy: AlwaysAllow - # - # To disable the PodDisruptionBudget, you can leave it as an empty object `{}`: - # - # podDisruptionBudget: {} - # - podDisruptionBudget: {} - - # Sets the per-pod terminationGracePeriodSeconds setting. - terminationGracePeriodSeconds: 30 - - # A list of `Volumes` added into the Gateway Pods. See - # https://kubernetes.io/docs/concepts/storage/volumes/. - volumes: [] - - # A list of `VolumeMounts` added into the Gateway Pods. See - # https://kubernetes.io/docs/concepts/storage/volumes/. - volumeMounts: [] - - # Configure this to a higher priority class in order to make sure your Istio gateway pods - # will not be killed because of low priority class. - # Refer to https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass - # for more detail. - priorityClassName: "" + clusterName: infra From 3a90a6aca69d153b1e8a6158b36643019e45aa48 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 10:39:58 -0500 Subject: [PATCH 0669/1058] update --- dmz/istio-system/values.yaml | 4 ++++ infra/istio-system/values.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/dmz/istio-system/values.yaml b/dmz/istio-system/values.yaml index 65991be..5778ed0 100644 --- a/dmz/istio-system/values.yaml +++ b/dmz/istio-system/values.yaml @@ -4,3 +4,7 @@ istiod: meshID: mesh1 multiCluster: clusterName: dmz + +gateway: + name: istio-eastwestgateway + networkGateway: network2 \ No newline at end of file diff --git a/infra/istio-system/values.yaml b/infra/istio-system/values.yaml index e36bf6a..5cd90bd 100644 --- a/infra/istio-system/values.yaml +++ b/infra/istio-system/values.yaml @@ -4,3 +4,7 @@ istiod: meshID: mesh1 multiCluster: clusterName: infra + +gateway: + name: istio-eastwestgateway + networkGateway: network1 \ No newline at end of file From a04e93ba9a730c3e3695b32bbb03d4235f7e0f8e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 11:12:56 -0500 Subject: [PATCH 0670/1058] update --- dmz/istio-system/Chart.yaml | 6 +++--- infra/istio-system/Chart.yaml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index cbba267..8a8d342 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -8,10 +8,10 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 + version: 1.25.1 - name: istiod repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 + version: 1.25.1 - name: gateway repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 \ No newline at end of file + version: 1.25.1 \ No newline at end of file diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index 6ced8b7..f56ad65 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -8,10 +8,10 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 + version: 1.25.1 - name: istiod repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 + version: 1.25.1 - name: gateway repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.0 + version: 1.25.1 From f26d1cd366c9b9fcb1fa06e1c2bd98566ec89625 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 11:22:56 -0500 Subject: [PATCH 0671/1058] update --- infra/argocd/templates/authentik.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index dce273e..b98a313 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -13,9 +13,9 @@ spec: namespace: authentik name: in-cluster syncPolicy: - managedNamespaceMetadata: - labels: - istio-injection: enabled + #managedNamespaceMetadata: + # labels: + # istio-injection: enabled automated: prune: true selfHeal: true From 81f26950957491fa9467ac3ecca2669028dd4fdd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Apr 2025 16:50:32 -0500 Subject: [PATCH 0672/1058] update --- infra/istio-system/templates/issuer.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 infra/istio-system/templates/issuer.yaml diff --git a/infra/istio-system/templates/issuer.yaml b/infra/istio-system/templates/issuer.yaml new file mode 100644 index 0000000..4e81111 --- /dev/null +++ b/infra/istio-system/templates/issuer.yaml @@ -0,0 +1,8 @@ +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: vault-issuer + namespace: istio-system +spec: + ca: + secretName: ca-key-pair \ No newline at end of file From 77557ea2bdef0c177071747f6239b5b962b1f998 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 05:33:49 -0500 Subject: [PATCH 0673/1058] remove openwebui --- master/argocd/templates/open-webui.yaml | 41 +++++++++++++------------ 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/master/argocd/templates/open-webui.yaml b/master/argocd/templates/open-webui.yaml index beb59a6..bae227f 100644 --- a/master/argocd/templates/open-webui.yaml +++ b/master/argocd/templates/open-webui.yaml @@ -1,20 +1,21 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: open-webui - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/open-webui - destination: - namespace: open-webui - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: open-webui +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/open-webui +# destination: +# namespace: open-webui +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# \ No newline at end of file From c6ee3c7b785e078e45c2f462b64772660162a95c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 05:34:48 -0500 Subject: [PATCH 0674/1058] remove kube stack --- .../templates/kube-prometheus-stack.yaml | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/master/argocd/templates/kube-prometheus-stack.yaml b/master/argocd/templates/kube-prometheus-stack.yaml index ab57dfa..2de63f1 100644 --- a/master/argocd/templates/kube-prometheus-stack.yaml +++ b/master/argocd/templates/kube-prometheus-stack.yaml @@ -1,21 +1,22 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: kube-prometheus-stack - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/kube-prometheus-stack - destination: - namespace: kube-prometheus-stack - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: kube-prometheus-stack +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/kube-prometheus-stack +# destination: +# namespace: kube-prometheus-stack +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# +# \ No newline at end of file From 3d2a2e37b910b09f39d1d31e8894b2227bf88270 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 05:35:08 -0500 Subject: [PATCH 0675/1058] remove kubeclarity --- master/argocd/templates/kubeclarity.yaml | 41 ++++++++++++------------ 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/master/argocd/templates/kubeclarity.yaml b/master/argocd/templates/kubeclarity.yaml index f2db3c0..b202df7 100644 --- a/master/argocd/templates/kubeclarity.yaml +++ b/master/argocd/templates/kubeclarity.yaml @@ -1,20 +1,21 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: kubeclarity - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/kubeclarity - destination: - namespace: kubeclarity - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: kubeclarity +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: master/kubeclarity +# destination: +# namespace: kubeclarity +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# \ No newline at end of file From 48909154e8b45b550b1557473f174f6d80cbd14b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 06:05:17 -0500 Subject: [PATCH 0676/1058] add bitwarden to infra --- infra/bitwarden/Chart.yaml | 7 +++ infra/bitwarden/templates/bitwarden-pvc.yaml | 11 +++++ infra/bitwarden/templates/deployment.yaml | 50 ++++++++++++++++++++ infra/bitwarden/templates/ingress.yaml | 42 ++++++++++++++++ infra/bitwarden/templates/secrets.yaml | 16 +++++++ infra/bitwarden/templates/service.yaml | 12 +++++ 6 files changed, 138 insertions(+) create mode 100644 infra/bitwarden/Chart.yaml create mode 100644 infra/bitwarden/templates/bitwarden-pvc.yaml create mode 100644 infra/bitwarden/templates/deployment.yaml create mode 100644 infra/bitwarden/templates/ingress.yaml create mode 100644 infra/bitwarden/templates/secrets.yaml create mode 100644 infra/bitwarden/templates/service.yaml diff --git a/infra/bitwarden/Chart.yaml b/infra/bitwarden/Chart.yaml new file mode 100644 index 0000000..cfdd821 --- /dev/null +++ b/infra/bitwarden/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: bitwarden +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/infra/bitwarden/templates/bitwarden-pvc.yaml b/infra/bitwarden/templates/bitwarden-pvc.yaml new file mode 100644 index 0000000..333af4d --- /dev/null +++ b/infra/bitwarden/templates/bitwarden-pvc.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: bitwarden-pvc +spec: + storageClassName: longhorn + accessModes: + - ReadWriteMany + resources: + requests: + storage: 10Gi diff --git a/infra/bitwarden/templates/deployment.yaml b/infra/bitwarden/templates/deployment.yaml new file mode 100644 index 0000000..f787ba1 --- /dev/null +++ b/infra/bitwarden/templates/deployment.yaml @@ -0,0 +1,50 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: bitwarden + name: bitwarden + labels: + app: bitwarden +spec: + selector: + matchLabels: + app: bitwarden + replicas: 1 + template: + metadata: + labels: + app: bitwarden + spec: + containers: + - name: bitwarden + image: registry.durp.info/vaultwarden/server:1.32.7 + imagePullPolicy: Always + volumeMounts: + - name: bitwarden-pvc + mountPath: /data + subPath: bitwaren-data + ports: + - name: http + containerPort: 80 + env: + - name: SIGNUPS_ALLOWED + value: "FALSE" + - name: INVITATIONS_ALLOWED + value: "FALSE" + - name: WEBSOCKET_ENABLED + value: "TRUE" + - name: ROCKET_ENV + value: "staging" + - name: ROCKET_PORT + value: "80" + - name: ROCKET_WORKERS + value: "10" + - name: SECRET_USERNAME + valueFrom: + secretKeyRef: + name: bitwarden-secret + key: ADMIN_TOKEN + volumes: + - name: bitwarden-pvc + persistentVolumeClaim: + claimName: bitwarden-pvc diff --git a/infra/bitwarden/templates/ingress.yaml b/infra/bitwarden/templates/ingress.yaml new file mode 100644 index 0000000..8a9a628 --- /dev/null +++ b/infra/bitwarden/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: bitwarden-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: bitwarden + port: 80 + tls: + secretName: bitwarden-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: bitwarden-tls +spec: + secretName: bitwarden-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "bitwarden.durp.info" + dnsNames: + - "bitwarden.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: bitwarden-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/infra/bitwarden/templates/secrets.yaml b/infra/bitwarden/templates/secrets.yaml new file mode 100644 index 0000000..a9c9829 --- /dev/null +++ b/infra/bitwarden/templates/secrets.yaml @@ -0,0 +1,16 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: bitwarden-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: bitwarden-secret + data: + - secretKey: ADMIN_TOKEN + remoteRef: + key: kv/bitwarden + property: admin_token + diff --git a/infra/bitwarden/templates/service.yaml b/infra/bitwarden/templates/service.yaml new file mode 100644 index 0000000..df30857 --- /dev/null +++ b/infra/bitwarden/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: bitwarden +spec: + ports: + - name: http + port: 80 + targetPort: 80 + protocol: TCP + selector: + app: bitwarden \ No newline at end of file From 787d9602505597ec58c6410bdd15ad64a52dcc94 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 06:06:36 -0500 Subject: [PATCH 0677/1058] update --- infra/argocd/templates/bitwarden.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 infra/argocd/templates/bitwarden.yaml diff --git a/infra/argocd/templates/bitwarden.yaml b/infra/argocd/templates/bitwarden.yaml new file mode 100644 index 0000000..e9b4905 --- /dev/null +++ b/infra/argocd/templates/bitwarden.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: bitwarden + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/bitwarden + destination: + namespace: bitwarden + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From cec03c7f469f9492b5f5d335aade1a424481df5b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 06:07:49 -0500 Subject: [PATCH 0678/1058] update --- infra/bitwarden/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/bitwarden/templates/ingress.yaml b/infra/bitwarden/templates/ingress.yaml index 8a9a628..827dd02 100644 --- a/infra/bitwarden/templates/ingress.yaml +++ b/infra/bitwarden/templates/ingress.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: bitwarden-ingress From 5777d5066aac0ef54b05eb3375ed3966d82bea54 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 06:08:34 -0500 Subject: [PATCH 0679/1058] update --- infra/bitwarden/templates/secrets.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/infra/bitwarden/templates/secrets.yaml b/infra/bitwarden/templates/secrets.yaml index a9c9829..494c0db 100644 --- a/infra/bitwarden/templates/secrets.yaml +++ b/infra/bitwarden/templates/secrets.yaml @@ -14,3 +14,10 @@ spec: key: kv/bitwarden property: admin_token +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + From 53f91d61d19e5e6b0708997897a1fbf770007bb5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 14 Apr 2025 06:11:08 -0500 Subject: [PATCH 0680/1058] update --- dmz/internalproxy/templates/bitwarden.yaml | 2 +- infra/bitwarden/templates/ingress.yaml | 16 ++-------------- 2 files changed, 3 insertions(+), 15 deletions(-) diff --git a/dmz/internalproxy/templates/bitwarden.yaml b/dmz/internalproxy/templates/bitwarden.yaml index f36ac6e..0067f8e 100644 --- a/dmz/internalproxy/templates/bitwarden.yaml +++ b/dmz/internalproxy/templates/bitwarden.yaml @@ -9,7 +9,7 @@ spec: - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: master-cluster + - name: infra-cluster port: 443 tls: secretName: bitwarden-tls diff --git a/infra/bitwarden/templates/ingress.yaml b/infra/bitwarden/templates/ingress.yaml index 827dd02..f69bc78 100644 --- a/infra/bitwarden/templates/ingress.yaml +++ b/infra/bitwarden/templates/ingress.yaml @@ -23,20 +23,8 @@ metadata: spec: secretName: bitwarden-tls issuerRef: - name: letsencrypt-production + name: vault-issuer kind: ClusterIssuer commonName: "bitwarden.durp.info" dnsNames: - - "bitwarden.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: bitwarden-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file + - "bitwarden.durp.info" \ No newline at end of file From dd94e0ab86ba6833fff7cdd70dcd7f3f014255b3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 15 Apr 2025 06:19:16 -0500 Subject: [PATCH 0681/1058] update --- infra/istio-system/templates/issuer.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/infra/istio-system/templates/issuer.yaml b/infra/istio-system/templates/issuer.yaml index 4e81111..4480773 100644 --- a/infra/istio-system/templates/issuer.yaml +++ b/infra/istio-system/templates/issuer.yaml @@ -1,8 +1,8 @@ -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: vault-issuer - namespace: istio-system -spec: - ca: - secretName: ca-key-pair \ No newline at end of file +#apiVersion: cert-manager.io/v1 +#kind: Issuer +#metadata: +# name: vault-issuer +# namespace: istio-system +#spec: +# ca: +# secretName: ca-key-pair From b879a85a164a7184ff3af3b8324480ff05dd26d3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 15 Apr 2025 06:21:29 -0500 Subject: [PATCH 0682/1058] update --- dev/terraform/main.tf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf index 5b9ff10..6f7862b 100644 --- a/dev/terraform/main.tf +++ b/dev/terraform/main.tf @@ -30,7 +30,7 @@ locals { cores = 2 memory = "4096" drive = 20 - storage = "domains" + storage = "cache-domains" node = ["mothership", "overlord", "vanguard"] ip = ["11", "12", "13"] } @@ -41,7 +41,7 @@ locals { cores = 4 memory = "8192" drive = 120 - storage = "domains" + storage = "cache-domains" node = ["mothership", "overlord", "vanguard"] ip = ["21", "22", "23"] } From 4772ff1f3f320eb263d4c3e69307d8f7ee0e1784 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 16 Apr 2025 04:52:41 -0500 Subject: [PATCH 0683/1058] update --- infra/terraform/main.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 58b2ee7..01c28f4 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -52,7 +52,7 @@ locals { cores = 2 memory = "1024" drive = 20 - storage = "domains" + storage = "cache-domains" node = ["mothership", "overlord", "vanguard"] ip = ["31", "32", "33"] } @@ -63,7 +63,7 @@ locals { cores = 4 memory = "4096" drive = 40 - storage = "domains" + storage = "cache-domains" node = ["mothership", "overlord", "vanguard"] ip = ["34", "35", "36"] } @@ -74,7 +74,7 @@ locals { cores = 2 memory = "2048" drive = 20 - storage = "domains" + storage = "cache-domains" node = ["mothership", "overlord", "vanguard"] ip = ["41", "42", "43"] } From 28ee277a907dc970b53596db6aa06979a493383c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 17 Apr 2025 04:54:17 -0500 Subject: [PATCH 0684/1058] update --- infra/argocd/templates/metallb-system.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/infra/argocd/templates/metallb-system.yaml b/infra/argocd/templates/metallb-system.yaml index a113c53..bac4be3 100644 --- a/infra/argocd/templates/metallb-system.yaml +++ b/infra/argocd/templates/metallb-system.yaml @@ -42,3 +42,25 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: metallb-system-dev + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dev/metallb-system + destination: + namespace: metallb-system + name: dev + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 6dcb8076970d48bbae136c3db29040992a1a4784 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 17 Apr 2025 05:16:31 -0500 Subject: [PATCH 0685/1058] add prd --- .gitlab/.gitlab-ci.yml | 8 ++ dev/metallb-system/templates/config.yaml | 2 +- prd/.gitlab/.gitlab-ci.yml | 95 ++++++++++++++++ prd/cert-manager/Chart.yaml | 11 ++ prd/cert-manager/templates/issuer.yaml | 16 +++ prd/cert-manager/templates/letsencrypt.yaml | 35 ++++++ prd/cert-manager/templates/secretvault.yaml | 22 ++++ prd/cert-manager/values.yaml | 26 +++++ prd/external-dns/Chart.yaml | 12 ++ prd/external-dns/templates/secrets.yaml | 30 +++++ prd/external-dns/values.yaml | 18 +++ prd/external-secrets/Chart.yaml | 11 ++ prd/external-secrets/templates/ca.yaml | 81 ++++++++++++++ prd/external-secrets/values.yaml | 94 ++++++++++++++++ prd/metallb-system/Chart.yaml | 12 ++ prd/metallb-system/templates/config.yaml | 17 +++ prd/metallb-system/values.yaml | 0 prd/terraform/k3s.tf | 115 ++++++++++++++++++++ prd/terraform/main.tf | 48 ++++++++ prd/terraform/variables.tf | 14 +++ prd/traefik/Chart.yaml | 11 ++ prd/traefik/values.yaml | 58 ++++++++++ prd/vault/Chart.yaml | 12 ++ prd/vault/templates/secret-store.yaml | 23 ++++ prd/vault/values.yaml | 13 +++ 25 files changed, 783 insertions(+), 1 deletion(-) create mode 100644 prd/.gitlab/.gitlab-ci.yml create mode 100644 prd/cert-manager/Chart.yaml create mode 100644 prd/cert-manager/templates/issuer.yaml create mode 100644 prd/cert-manager/templates/letsencrypt.yaml create mode 100644 prd/cert-manager/templates/secretvault.yaml create mode 100644 prd/cert-manager/values.yaml create mode 100644 prd/external-dns/Chart.yaml create mode 100644 prd/external-dns/templates/secrets.yaml create mode 100644 prd/external-dns/values.yaml create mode 100644 prd/external-secrets/Chart.yaml create mode 100644 prd/external-secrets/templates/ca.yaml create mode 100644 prd/external-secrets/values.yaml create mode 100644 prd/metallb-system/Chart.yaml create mode 100644 prd/metallb-system/templates/config.yaml create mode 100644 prd/metallb-system/values.yaml create mode 100644 prd/terraform/k3s.tf create mode 100644 prd/terraform/main.tf create mode 100644 prd/terraform/variables.tf create mode 100644 prd/traefik/Chart.yaml create mode 100644 prd/traefik/values.yaml create mode 100644 prd/vault/Chart.yaml create mode 100644 prd/vault/templates/secret-store.yaml create mode 100644 prd/vault/values.yaml diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index d3507e7..4c7a36a 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -24,3 +24,11 @@ build_dev: rules: - changes: - "dev/terraform/*.tf" + +build_prd: + stage: triggers + trigger: + include: prd/.gitlab/.gitlab-ci.yml + rules: + - changes: + - "prd/terraform/*.tf" diff --git a/dev/metallb-system/templates/config.yaml b/dev/metallb-system/templates/config.yaml index f08a885..5fb85fe 100644 --- a/dev/metallb-system/templates/config.yaml +++ b/dev/metallb-system/templates/config.yaml @@ -4,7 +4,7 @@ metadata: name: cheap spec: addresses: - - 192.168.98.130-192.168.98.140 + - 192.168.10.130-192.168.10.140 --- apiVersion: metallb.io/v1beta1 kind: L2Advertisement diff --git a/prd/.gitlab/.gitlab-ci.yml b/prd/.gitlab/.gitlab-ci.yml new file mode 100644 index 0000000..99ddf7b --- /dev/null +++ b/prd/.gitlab/.gitlab-ci.yml @@ -0,0 +1,95 @@ +stages: + - plan + - apply + - destroy + +variables: + WORKDIR: $CI_PROJECT_DIR/prd/terraform + GITLAB_TF_ADDRESS: ${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/terraform/state/prd + +image: + name: registry.durp.info/opentofu/opentofu:latest + entrypoint: [""] + +.tf-init: + before_script: + - cd $WORKDIR + - tofu init + -reconfigure + -backend-config="address=${GITLAB_TF_ADDRESS}" + -backend-config="lock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="unlock_address=${GITLAB_TF_ADDRESS}/lock" + -backend-config="username=gitlab-ci-token" + -backend-config="password=${CI_JOB_TOKEN}" + -backend-config="lock_method=POST" + -backend-config="unlock_method=DELETE" + -backend-config="retry_wait_min=5" + +format: + stage: .pre + allow_failure: false + script: + - cd $WORKDIR + - tofu fmt -diff -check -write=false + rules: + - changes: + - "prd/terraform/*.tf" + +validate: + stage: .pre + allow_failure: false + extends: .tf-init + script: + - tofu validate + rules: + - changes: + - "prd/terraform/*.tf" + +plan-prd-infrastructure: + stage: plan + variables: + PLAN: plan.tfplan + JSON_PLAN_FILE: tfplan.json + ENVIRONMENT_NAME: prd + allow_failure: false + extends: .tf-init + script: + - apk add --update curl jq + - alias convert_report="jq -r '([.resource_changes[].change.actions?]|flatten)|{\"create\":(map(select(.==\"create\"))|length),\"update\":(map(select(.==\"update\"))|length),\"delete\":(map(select(.==\"delete\"))|length)}'" + - tofu plan -out=$PLAN $ARGUMENTS + - tofu show --json $PLAN | jq -r '([.resource_changes[].change.actions?]|flatten)|{"create":(map(select(.=="create"))|length),"update":(map(select(.=="update"))|length),"delete":(map(select(.=="delete"))|length)}' > $JSON_PLAN_FILE + artifacts: + reports: + terraform: $WORKDIR/$JSON_PLAN_FILE + needs: ["validate","format"] + rules: + - changes: + - "prd/terraform/*.tf" + +apply-prd-infrastructure: + stage: apply + variables: + ENVIRONMENT_NAME: prd + allow_failure: false + extends: .tf-init + script: + - tofu apply -auto-approve $ARGUMENTS + rules: + - changes: + - "prd/terraform/*.tf" + when: manual + needs: ["plan-prd-infrastructure"] + +destroy-prd-infrastructure: + stage: destroy + variables: + ENVIRONMENT_NAME: prd + allow_failure: false + extends: .tf-init + script: + - tofu destroy -auto-approve $ARGUMENTS + rules: + - changes: + - "prd/terraform/*.tf" + when: manual + needs: ["plan-prd-infrastructure"] diff --git a/prd/cert-manager/Chart.yaml b/prd/cert-manager/Chart.yaml new file mode 100644 index 0000000..ecf60fa --- /dev/null +++ b/prd/cert-manager/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: cert-manager +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: cert-manager + repository: https://charts.jetstack.io + version: v1.16.3 diff --git a/prd/cert-manager/templates/issuer.yaml b/prd/cert-manager/templates/issuer.yaml new file mode 100644 index 0000000..cf61c83 --- /dev/null +++ b/prd/cert-manager/templates/issuer.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: issuer +secrets: + - name: issuer-token-lmzpj + +--- + +apiVersion: v1 +kind: Secret +metadata: + name: issuer-token-lmzpj + annotations: + kubernetes.io/service-account.name: issuer +type: kubernetes.io/service-account-token diff --git a/prd/cert-manager/templates/letsencrypt.yaml b/prd/cert-manager/templates/letsencrypt.yaml new file mode 100644 index 0000000..56b8374 --- /dev/null +++ b/prd/cert-manager/templates/letsencrypt.yaml @@ -0,0 +1,35 @@ +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: letsencrypt-production +spec: + acme: + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-production + solvers: + - dns01: + cloudflare: + email: developerdurp@durp.info + apiTokenSecretRef: + name: cloudflare-api-token-secret + key: cloudflare-api-token-secret + +--- + +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: vault-issuer +spec: + vault: + server: https://vault.infra.durp.info + caBundle: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVzekNDQTV1Z0F3SUJBZ0lVWkV6enhxRXVZaUtIa0wxZGYrQ2IyMk5SUkpNd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekl5TXpRME1sb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dJREVlTUJ3R0ExVUVBeE1WZG1GMWJIUXVhVzVtY21FdVpIVnljQzVwYm1adk1JSUJJakFOCkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQWtaTTB1ZTRiTWNtbUFUcytrR1lTcFIyaExVenEKc2NHSXdDdHFtYUtDTWJkMXhobWdqbklSM3p2U1JwdExSMkdWR3ZjMXRpNnFieTBqWFl2Y3FieGtIdmF5MDB6VwoyellOK00ybTRsWHB1V3pnMXQ2TkVvTzZYR0FzR2oydjB2Y1ZrdFBQVTl1ajByR1VWR1dXZnN2am9YcVFGZzVJCmpkeHN4SzlTdk12dzJYdEUzRmdLeHB6Q3l3OTRJbklIbGNQd0ZUTyszWmRLU3RabE1iVURJa21zekxCcldGY3IKWE9zUERmTHhxTXkwQ2svL0xLSXQ4ZGpoMzI1NEZIQjFHRzUra0krSlNXMW8rdFVjTDJOeW12SUlOd20vMmFjUwoxdVRtK2o5VzdpRVhhdjBwSk5tbSsvZHpTc2tjM1kwZnRNMGgySENYZ2l0QklhRVpuVVZuZU5IT0x3SURBUUFCCm80SUI3ekNDQWVzd0RnWURWUjBQQVFIL0JBUURBZ0VHTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME8KQkJZRUZDYVEycTdqN0x5QkdFVEVaNXFhSkFkbElTS0NNQjhHQTFVZEl3UVlNQmFBRk8xakN5R2twRk8rUWlSMgpkZkJNV1ZZZVdyUTJNSUgwQmdnckJnRUZCUWNCQVFTQjV6Q0I1REF6QmdnckJnRUZCUWN3QVlZbmFIUjBjSE02Ckx5OHhPVEl1TVRZNExqSXdMakkxTXpvNE1qQXhMM1l4TDNCcmFTOXZZM053TUQwR0NDc0dBUVVGQnpBQmhqRm8KZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnJhUzl2WTNOdwpNREVHQ0NzR0FRVUZCekFDaGlWb2RIUndjem92THpFNU1pNHhOamd1TWpBdU1qVXpPamd5TURFdmRqRXZjR3RwCkwyTmhNRHNHQ0NzR0FRVUZCekFDaGk5b2RIUndjem92TDNKdmIzUXRkbUYxYkhRdWFXNTBaWEp1WVd3dVpIVnkKY0M1cGJtWnZMM1l4TDNCcmFTOWpZVEFnQmdOVkhSRUVHVEFYZ2hWMllYVnNkQzVwYm1aeVlTNWtkWEp3TG1sdQpabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3TGpJMU16bzRNakF4CkwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6T2k4dmNtOXZkQzEyWVhWc2RDNXBiblJsY201aGJDNWsKZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQXVKK2xwbFkvK0E1TAo1THprbGpiS0RUeTNVNlBMdjFMdHhxVkNPRkdpSlhCblhNanRWVzA3YkJFVWFkekZSTlc4R0hRM3c1UXpPRzZrCi92RS9UcnJKaG83bDA1Si91YytCVXJQU05qZWZMbVFWNmhuNGpyUDg2UFIwdnpSZmJTcUtLQklJRDlNNyt6aTYKR0Z2SGxWa1NIc1F5TVFwN0pPb2F4OUtWelcyWStPSWd3N0xndzJ0UDEyMldDdDJTSUYwUWVub1pIc29XMGd1agp0elRKUm1KRGpuNlhlSjdMM0ZQa2YzN0g2dWIwSmczekJHcjZlb3JFRmZZWk5ONUNYZXpqcU1GQnBSZHE0VUlvCjFNM0E3bzN1eVpGY0ZzcC92R0RjTUJrd2FDc0JWOWlkdS9Id2t2R2FUVU5JMjg1aWxCT1JQRDBiTVpuQUNxLzkKK1EvY2RzTzVsZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVtekNDQTRPZ0F3SUJBZ0lVUXdDQXM4MnNnU3VpYVZiakFOSFNjTzJEU2ZBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TWpFeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBbjlmakdScXFGc3FndXo1Nlg2Y1had0VNdEQ5d0Vsd1NGQ2I0RmM4WVR6bEgKNGZWMTNRd1hLRVNMRS9RKzdidzR5NEZKUThCaUdOYnh4YlFPT2dXaGZHR2xReUZhMWxmaEp0WUxmcVJONUMyLwpTN25yMFl4REI5ZHVjNE9BRXhWTDZQcjQvS29jK3ZEWlkwM2w3Unp3bkYyQU9NOURqRlRBU3cwMVRwaENRalJrClUrdXBpTjJUVWhVUGVqVi9nTVIrelhNNnBuOThVQktHMWROdWJTMEh6QU13QUVYQVBtMTQxTkR5V1VDUFQ5KzMKNlAwM0thOG1VVHgzWDQ5T0N0dkpFR0VRYnRsblRGUWFPU2tQMXlMVytYUk1IdzNzUWFWMlBXWHU1ZkluYkVwWgorU3V6bWdMT1h0bVFObUhMYXY5cTFxZVRWa3BCR1BXdmZoMlZoMUpKaFFJREFRQUJvNElCNHpDQ0FkOHdEZ1lEClZSMFBBUUgvQkFRREFnRUdNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHdIUVlEVlIwT0JCWUVGSmFQMTdmMVp3MFYKNTVLczlVZjBVU1ZXbDBCUE1COEdBMVVkSXdRWU1CYUFGTzFqQ3lHa3BGTytRaVIyZGZCTVdWWWVXclEyTUlIMApCZ2dyQmdFRkJRY0JBUVNCNXpDQjVEQXpCZ2dyQmdFRkJRY3dBWVluYUhSMGNITTZMeTh4T1RJdU1UWTRMakl3CkxqSTFNem80TWpBeEwzWXhMM0JyYVM5dlkzTndNRDBHQ0NzR0FRVUZCekFCaGpGb2RIUndjem92TDNKdmIzUXQKZG1GMWJIUXVhVzUwWlhKdVlXd3VaSFZ5Y0M1cGJtWnZMM1l4TDNCcmFTOXZZM053TURFR0NDc0dBUVVGQnpBQwpoaVZvZEhSd2N6b3ZMekU1TWk0eE5qZ3VNakF1TWpVek9qZ3lNREV2ZGpFdmNHdHBMMk5oTURzR0NDc0dBUVVGCkJ6QUNoaTlvZEhSd2N6b3ZMM0p2YjNRdGRtRjFiSFF1YVc1MFpYSnVZV3d1WkhWeWNDNXBibVp2TDNZeEwzQnIKYVM5allUQVVCZ05WSFJFRURUQUxnZ2xrZFhKd0xtbHVabTh3YndZRFZSMGZCR2d3WmpBc29DcWdLSVltYUhSMApjSE02THk4eE9USXVNVFk0TGpJd0xqSTFNem80TWpBeEwzWXhMM0JyYVM5amNtd3dOcUEwb0RLR01HaDBkSEJ6Ck9pOHZjbTl2ZEMxMllYVnNkQzVwYm5SbGNtNWhiQzVrZFhKd0xtbHVabTh2ZGpFdmNHdHBMMk55YkRBTkJna3EKaGtpRzl3MEJBUXNGQUFPQ0FRRUFpcUFaNHpOSUVrQ1djdnBEUnEwVnlKdWs1OXNWdEpyNVg0RnNjSFExNzluRQpRYmJ2TWUrRUJERlM2WFFtbDFFbGo4amlQYS9ENU85T2M2SWlzbm01K3dlWkt3QXB6L2xRK1hWa1dMQ29FcGxCClpaOWZjV1ZDYk1MdDB4bHQ4cW41ei9tWUtmYkNUN1pDcURPK3ByUVp0K0FESmNRYmlrbmZyb0FBcUViTkt4d04KWTl1VXlPV05GM1N4SkVjaDR3MmR0WCtJRVZteGVabmhNeThPdVAwU1FLbDhhVzQwdWdpRzBaRDV5VEJCZk9EOQp6c3JHU1UvaVNhdG4wYjdiZXZCaGFMOTZoejEvck5SMWNMKzQvYWxiWDJocnI4UnYzL1NCMkRMdE5RbFFXMGxzCkFmaFhBcVA1ekwrWXRnZjFPZi9wVmRnbmh4cllVWTdSS0NTR1k1SGFndz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KLS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMekNDQWhlZ0F3SUJBZ0lVTkhkdk96YW0ySFBWZHdYcE1IVXk0d2w4WlJZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZERVNNQkFHQTFVRUF4TUpaSFZ5Y0M1cGJtWnZNQjRYRFRJMU1ERXlNekV4TVRVeU5Wb1hEVE0xTURFeQpNVEV4TVRVMU5Wb3dGREVTTUJBR0ExVUVBeE1KWkhWeWNDNXBibVp2TUlJQklqQU5CZ2txaGtpRzl3MEJBUUVGCkFBT0NBUThBTUlJQkNnS0NBUUVBOFhEVFZFdFJJMytrNHl1dnFWcWZJaUxSUUpjWGJtaGZWdEFlWWsrNWo5T3gKcDF3OVlIZG5QTHFMRnJEMVB6YWRqcVllQXAvZndsRUZmczZscXdvVFM4Uzl2aGFGcWNnQjU3blZNYjc3ZFRCYgovMDhYSFhPVTZGUFJqZEZLbTVRTXBTN3RuMVhhY1BNeS9vMGJLcVJSRVFlaXVGREdWUnl1RjVQVWd2V2MxZHZKCmwyN0p2dmdZa3RnamZwTlM0RGxDeGc0bEdYVDVhYnZhS2YyaG5yNjVlZ2FJby95UldOOXdudkF6UmlZN29jaTcKR0Exb0t6ODdZYzF0ZkwyZ2N5bnJ3Y2NPT0NGL2VVS2VzSlIxSTZHWE5rTi9hMWZjcitMZDlaOU5oSEJ0Tyt2RQpOOERzWlkra0c3REUzTTRCQ0NURlV6bGxjWUhqYVc0SGFGOXZaVytQWXdJREFRQUJvM2t3ZHpBT0JnTlZIUThCCkFmOEVCQU1DQVFZd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVTdXTUxJYVNrVTc1Q0pIWjEKOEV4WlZoNWF0RFl3SHdZRFZSMGpCQmd3Rm9BVTdXTUxJYVNrVTc1Q0pIWjE4RXhaVmg1YXREWXdGQVlEVlIwUgpCQTB3QzRJSlpIVnljQzVwYm1adk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQVMvcVVJLzFZdjA3eFVUSzVrCnI5M2tDN0dTUHBtcGtYSXNmakNoQWw5M3NlYk4xNDNmdTcwTlVQNzRqakNjMFdrYjhoUm9mR2cxMEUrLzI0cjEKQUkwS3NMaHpLemZJQVN4VVZRQW44UlRwdExydWFhUExib1NBNE1VWjhJQjV5OFZ5OEUzL0t0RDBnRDgwajY0WQpybTlYR0hBMEhUSkhiUFVUYi9SdXgyZzBFN1d0aXlXU1dIOG1xemJlZ1U4SXJrTTNlVlQ0K3lsQkU3WWtmV0RECmR3NDRzQjcxdGZtREtweldnNlhRNllNaDBZZm55RzFmWUNqOUxodWVjTlk5VXVvNmNqRGFBdmt6TWV3V3dxRHgKUTJFa2FzOThEaTZpdENQOHZFVCtnQkRqZUNjK1hSNkh4NnZ6V214bFpod0R1eEVLTDFhMi9EYWJVeEp5TU56dgo1NUZuCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K + path: pki/sign/issue-homelab-certs + auth: + kubernetes: + mountPath: /v1/auth/dmz-cluster + role: issuer + secretRef: + name: issuer-token-lmzpj + key: token diff --git a/prd/cert-manager/templates/secretvault.yaml b/prd/cert-manager/templates/secretvault.yaml new file mode 100644 index 0000000..f15a739 --- /dev/null +++ b/prd/cert-manager/templates/secretvault.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: cloudflare-api-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: cloudflare-api-token-secret + data: + - secretKey: cloudflare-api-token-secret + remoteRef: + key: kv/cert-manager + property: cloudflare-api-token-secret + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/prd/cert-manager/values.yaml b/prd/cert-manager/values.yaml new file mode 100644 index 0000000..c9cf12f --- /dev/null +++ b/prd/cert-manager/values.yaml @@ -0,0 +1,26 @@ +cert-manager: + crds: + enabled: true + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-controller + pullPolicy: Always + replicaCount: 3 + extraArgs: + - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 + - --dns01-recursive-nameservers-only + podDnsPolicy: None + podDnsConfig: + nameservers: + - "1.1.1.1" + - "1.0.0.1" + webhook: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-webhook + pullPolicy: Always + cainjector: + image: + registry: registry.internal.durp.info + repository: jetstack/cert-manager-cainjector + pullPolicy: Always diff --git a/prd/external-dns/Chart.yaml b/prd/external-dns/Chart.yaml new file mode 100644 index 0000000..8fb36bc --- /dev/null +++ b/prd/external-dns/Chart.yaml @@ -0,0 +1,12 @@ + +apiVersion: v2 +name: external-dns +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-dns + repository: https://charts.bitnami.com/bitnami + version: 8.3.8 diff --git a/prd/external-dns/templates/secrets.yaml b/prd/external-dns/templates/secrets.yaml new file mode 100644 index 0000000..0420a5d --- /dev/null +++ b/prd/external-dns/templates/secrets.yaml @@ -0,0 +1,30 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: external-dns-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: external-dns + data: + - secretKey: cloudflare_api_email + remoteRef: + key: kv/cloudflare + property: cloudflare_api_email + - secretKey: cloudflare_api_key + remoteRef: + key: kv/cloudflare + property: cloudflare_api_key + - secretKey: cloudflare_api_token + remoteRef: + key: kv/cloudflare + property: cloudflare_api_token + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/prd/external-dns/values.yaml b/prd/external-dns/values.yaml new file mode 100644 index 0000000..2052942 --- /dev/null +++ b/prd/external-dns/values.yaml @@ -0,0 +1,18 @@ +external-dns: + global: + imageRegistry: "registry.durp.info" + + image: + pullPolicy: Always + + txtPrefix: "dmz-" + + sources: + - service + + provider: cloudflare + cloudflare: + secretName : "external-dns" + proxied: false + + policy: sync diff --git a/prd/external-secrets/Chart.yaml b/prd/external-secrets/Chart.yaml new file mode 100644 index 0000000..d89a403 --- /dev/null +++ b/prd/external-secrets/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: external-secrets +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: external-secrets + repository: https://charts.external-secrets.io + version: 0.13.0 diff --git a/prd/external-secrets/templates/ca.yaml b/prd/external-secrets/templates/ca.yaml new file mode 100644 index 0000000..9b2a135 --- /dev/null +++ b/prd/external-secrets/templates/ca.yaml @@ -0,0 +1,81 @@ +apiVersion: v1 +data: + vault.pem: | + -----BEGIN CERTIFICATE----- + MIIEszCCA5ugAwIBAgIUZEzzxqEuYiKHkL1df+Cb22NRRJMwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzIyMzQ0MloXDTM1MDEy + MTExMTU1NVowIDEeMBwGA1UEAxMVdmF1bHQuaW5mcmEuZHVycC5pbmZvMIIBIjAN + BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAkZM0ue4bMcmmATs+kGYSpR2hLUzq + scGIwCtqmaKCMbd1xhmgjnIR3zvSRptLR2GVGvc1ti6qby0jXYvcqbxkHvay00zW + 2zYN+M2m4lXpuWzg1t6NEoO6XGAsGj2v0vcVktPPU9uj0rGUVGWWfsvjoXqQFg5I + jdxsxK9SvMvw2XtE3FgKxpzCyw94InIHlcPwFTO+3ZdKStZlMbUDIkmszLBrWFcr + XOsPDfLxqMy0Ck//LKIt8djh3254FHB1GG5+kI+JSW1o+tUcL2NymvIINwm/2acS + 1uTm+j9W7iEXav0pJNmm+/dzSskc3Y0ftM0h2HCXgitBIaEZnUVneNHOLwIDAQAB + o4IB7zCCAeswDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O + BBYEFCaQ2q7j7LyBGETEZ5qaJAdlISKCMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2 + dfBMWVYeWrQ2MIH0BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6 + Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFo + dHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3Nw + MDEGCCsGAQUFBzAChiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtp + L2NhMDsGCCsGAQUFBzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVy + cC5pbmZvL3YxL3BraS9jYTAgBgNVHREEGTAXghV2YXVsdC5pbmZyYS5kdXJwLmlu + Zm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAx + L3YxL3BraS9jcmwwNqA0oDKGMGh0dHBzOi8vcm9vdC12YXVsdC5pbnRlcm5hbC5k + dXJwLmluZm8vdjEvcGtpL2NybDANBgkqhkiG9w0BAQsFAAOCAQEAuJ+lplY/+A5L + 5LzkljbKDTy3U6PLv1LtxqVCOFGiJXBnXMjtVW07bBEUadzFRNW8GHQ3w5QzOG6k + /vE/TrrJho7l05J/uc+BUrPSNjefLmQV6hn4jrP86PR0vzRfbSqKKBIID9M7+zi6 + GFvHlVkSHsQyMQp7JOoax9KVzW2Y+OIgw7Lgw2tP122WCt2SIF0QenoZHsoW0guj + tzTJRmJDjn6XeJ7L3FPkf37H6ub0Jg3zBGr6eorEFfYZNN5CXezjqMFBpRdq4UIo + 1M3A7o3uyZFcFsp/vGDcMBkwaCsBV9idu/HwkvGaTUNI285ilBORPD0bMZnACq/9 + +Q/cdsO5lg== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIEmzCCA4OgAwIBAgIUQwCAs82sgSuiaVbjANHScO2DSfAwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMjEyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEAn9fjGRqqFsqguz56X6cXZwEMtD9wElwSFCb4Fc8YTzlH + 4fV13QwXKESLE/Q+7bw4y4FJQ8BiGNbxxbQOOgWhfGGlQyFa1lfhJtYLfqRN5C2/ + S7nr0YxDB9duc4OAExVL6Pr4/Koc+vDZY03l7RzwnF2AOM9DjFTASw01TphCQjRk + U+upiN2TUhUPejV/gMR+zXM6pn98UBKG1dNubS0HzAMwAEXAPm141NDyWUCPT9+3 + 6P03Ka8mUTx3X49OCtvJEGEQbtlnTFQaOSkP1yLW+XRMHw3sQaV2PWXu5fInbEpZ + +SuzmgLOXtmQNmHLav9q1qeTVkpBGPWvfh2Vh1JJhQIDAQABo4IB4zCCAd8wDgYD + VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJaP17f1Zw0V + 55Ks9Uf0USVWl0BPMB8GA1UdIwQYMBaAFO1jCyGkpFO+QiR2dfBMWVYeWrQ2MIH0 + BggrBgEFBQcBAQSB5zCB5DAzBggrBgEFBQcwAYYnaHR0cHM6Ly8xOTIuMTY4LjIw + LjI1Mzo4MjAxL3YxL3BraS9vY3NwMD0GCCsGAQUFBzABhjFodHRwczovL3Jvb3Qt + dmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3BraS9vY3NwMDEGCCsGAQUFBzAC + hiVodHRwczovLzE5Mi4xNjguMjAuMjUzOjgyMDEvdjEvcGtpL2NhMDsGCCsGAQUF + BzAChi9odHRwczovL3Jvb3QtdmF1bHQuaW50ZXJuYWwuZHVycC5pbmZvL3YxL3Br + aS9jYTAUBgNVHREEDTALgglkdXJwLmluZm8wbwYDVR0fBGgwZjAsoCqgKIYmaHR0 + cHM6Ly8xOTIuMTY4LjIwLjI1Mzo4MjAxL3YxL3BraS9jcmwwNqA0oDKGMGh0dHBz + Oi8vcm9vdC12YXVsdC5pbnRlcm5hbC5kdXJwLmluZm8vdjEvcGtpL2NybDANBgkq + hkiG9w0BAQsFAAOCAQEAiqAZ4zNIEkCWcvpDRq0VyJuk59sVtJr5X4FscHQ179nE + QbbvMe+EBDFS6XQml1Elj8jiPa/D5O9Oc6Iisnm5+weZKwApz/lQ+XVkWLCoEplB + ZZ9fcWVCbMLt0xlt8qn5z/mYKfbCT7ZCqDO+prQZt+ADJcQbiknfroAAqEbNKxwN + Y9uUyOWNF3SxJEch4w2dtX+IEVmxeZnhMy8OuP0SQKl8aW40ugiG0ZD5yTBBfOD9 + zsrGSU/iSatn0b7bevBhaL96hz1/rNR1cL+4/albX2hrr8Rv3/SB2DLtNQlQW0ls + AfhXAqP5zL+Ytgf1Of/pVdgnhxrYUY7RKCSGY5Hagw== + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- + MIIDLzCCAhegAwIBAgIUNHdvOzam2HPVdwXpMHUy4wl8ZRYwDQYJKoZIhvcNAQEL + BQAwFDESMBAGA1UEAxMJZHVycC5pbmZvMB4XDTI1MDEyMzExMTUyNVoXDTM1MDEy + MTExMTU1NVowFDESMBAGA1UEAxMJZHVycC5pbmZvMIIBIjANBgkqhkiG9w0BAQEF + AAOCAQ8AMIIBCgKCAQEA8XDTVEtRI3+k4yuvqVqfIiLRQJcXbmhfVtAeYk+5j9Ox + p1w9YHdnPLqLFrD1PzadjqYeAp/fwlEFfs6lqwoTS8S9vhaFqcgB57nVMb77dTBb + /08XHXOU6FPRjdFKm5QMpS7tn1XacPMy/o0bKqRREQeiuFDGVRyuF5PUgvWc1dvJ + l27JvvgYktgjfpNS4DlCxg4lGXT5abvaKf2hnr65egaIo/yRWN9wnvAzRiY7oci7 + GA1oKz87Yc1tfL2gcynrwccOOCF/eUKesJR1I6GXNkN/a1fcr+Ld9Z9NhHBtO+vE + N8DsZY+kG7DE3M4BCCTFUzllcYHjaW4HaF9vZW+PYwIDAQABo3kwdzAOBgNVHQ8B + Af8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU7WMLIaSkU75CJHZ1 + 8ExZVh5atDYwHwYDVR0jBBgwFoAU7WMLIaSkU75CJHZ18ExZVh5atDYwFAYDVR0R + BA0wC4IJZHVycC5pbmZvMA0GCSqGSIb3DQEBCwUAA4IBAQAS/qUI/1Yv07xUTK5k + r93kC7GSPpmpkXIsfjChAl93sebN143fu70NUP74jjCc0Wkb8hRofGg10E+/24r1 + AI0KsLhzKzfIASxUVQAn8RTptLruaaPLboSA4MUZ8IB5y8Vy8E3/KtD0gD80j64Y + rm9XGHA0HTJHbPUTb/Rux2g0E7WtiyWSWH8mqzbegU8IrkM3eVT4+ylBE7YkfWDD + dw44sB71tfmDKpzWg6XQ6YMh0YfnyG1fYCj9LhuecNY9Uuo6cjDaAvkzMewWwqDx + Q2Ekas98Di6itCP8vET+gBDjeCc+XR6Hx6vzWmxlZhwDuxEKL1a2/DabUxJyMNzv + 55Fn + -----END CERTIFICATE----- +kind: ConfigMap +metadata: + name: ca-pemstore diff --git a/prd/external-secrets/values.yaml b/prd/external-secrets/values.yaml new file mode 100644 index 0000000..304180d --- /dev/null +++ b/prd/external-secrets/values.yaml @@ -0,0 +1,94 @@ +external-secrets: + replicaCount: 3 + revisionHistoryLimit: 1 + leaderElect: true + + installCRDs: true + crds: + createClusterExternalSecret: true + createClusterSecretStore: true + createClusterGenerator: true + createPushSecret: true + conversion: + enabled: false + + image: + repository: registry.durp.info/external-secrets/external-secrets + pullPolicy: Always + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + webhook: + create: false + failurePolicy: Ignore + log: + level: debug + image: + repository: registry.durp.info/external-secrets/external-secrets + pullPolicy: Always + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + certController: + create: false + revisionHistoryLimit: 1 + log: + level: debug + + image: + repository: registry.durp.info/external-secrets/external-secrets + pullPolicy: Always + tag: "" + + resources: + requests: + memory: 32Mi + cpu: 10m + limits: + memory: 32Mi + cpu: 10m + + extraVolumes: + - name: ca-pemstore + configMap: + name: ca-pemstore + + extraVolumeMounts: + - name: ca-pemstore + mountPath: /etc/ssl/certs/vault.pem + subPath: vault.pem + readOnly: true diff --git a/prd/metallb-system/Chart.yaml b/prd/metallb-system/Chart.yaml new file mode 100644 index 0000000..4fc684f --- /dev/null +++ b/prd/metallb-system/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: metallb-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: metallb + repository: https://metallb.github.io/metallb + version: 0.14.9 diff --git a/prd/metallb-system/templates/config.yaml b/prd/metallb-system/templates/config.yaml new file mode 100644 index 0000000..03314b3 --- /dev/null +++ b/prd/metallb-system/templates/config.yaml @@ -0,0 +1,17 @@ +apiVersion: metallb.io/v1beta1 +kind: IPAddressPool +metadata: + name: cheap +spec: + addresses: + - 192.168.11.130-192.168.11.140 +--- +apiVersion: metallb.io/v1beta1 +kind: L2Advertisement +metadata: + name: pool + namespace: metallb-system +spec: + ipAddressPools: + - cheap + diff --git a/prd/metallb-system/values.yaml b/prd/metallb-system/values.yaml new file mode 100644 index 0000000..e69de29 diff --git a/prd/terraform/k3s.tf b/prd/terraform/k3s.tf new file mode 100644 index 0000000..4d02a21 --- /dev/null +++ b/prd/terraform/k3s.tf @@ -0,0 +1,115 @@ +resource "proxmox_vm_qemu" "k3smaster" { + count = local.k3smaster.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" + name = local.k3smaster.name[count.index] + target_node = local.k3smaster.node[count.index] + clone = local.template + tags = local.k3smaster.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3smaster.cores + sockets = 1 + cpu_type = "host" + memory = local.k3smaster.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3smaster.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3smaster.drive + format = local.format + storage = local.k3smaster.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} + +resource "proxmox_vm_qemu" "k3sserver" { + count = local.k3sserver.count + ciuser = "administrator" + vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" + name = local.k3sserver.name[count.index] + target_node = local.k3sserver.node[count.index] + clone = local.template + tags = local.k3sserver.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.k3sserver.cores + sockets = 1 + cpu_type = "host" + memory = local.k3sserver.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.k3sserver.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.k3sserver.drive + format = local.format + storage = local.k3sserver.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} diff --git a/prd/terraform/main.tf b/prd/terraform/main.tf new file mode 100644 index 0000000..c6c6c8e --- /dev/null +++ b/prd/terraform/main.tf @@ -0,0 +1,48 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc6" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.11.1" + vlan = 10 + k3smaster = { + tags = "k3s_prd" + count = 3 + name = ["master01-prd", "master02-prd", "master03-prd"] + cores = 2 + memory = "4096" + drive = 20 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_prd" + count = 3 + name = ["node01-prd", "node02-prd", "node03-prd"] + cores = 4 + memory = "8192" + drive = 120 + storage = "cache-domains" + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } +} diff --git a/prd/terraform/variables.tf b/prd/terraform/variables.tf new file mode 100644 index 0000000..29a1c9d --- /dev/null +++ b/prd/terraform/variables.tf @@ -0,0 +1,14 @@ +variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string +} + +variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string +} + +variable "pm_user" { + description = "Username to Proxmox provider" + type = string +} diff --git a/prd/traefik/Chart.yaml b/prd/traefik/Chart.yaml new file mode 100644 index 0000000..30f96ac --- /dev/null +++ b/prd/traefik/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: traefik +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: traefik + repository: https://traefik.github.io/charts + version: 34.0.0 diff --git a/prd/traefik/values.yaml b/prd/traefik/values.yaml new file mode 100644 index 0000000..3d1d660 --- /dev/null +++ b/prd/traefik/values.yaml @@ -0,0 +1,58 @@ +traefik: + image: + # registry: registry.durp.info + # repository: traefik + pullPolicy: Always + + providers: + kubernetesCRD: + allowCrossNamespace: true + allowExternalNameServices: true + allowEmptyServices: false + + deployment: + replicas: 3 + revisionHistoryLimit: 1 + + # volumes: + # - name: traefik-configmap + # mountPath: "/config" + # type: configMap + + ingressRoute: + dashboard: + enabled: true + + additionalArguments: + # - "--providers.file.filename=/config/config.yml" + - "--serversTransport.insecureSkipVerify=true" + - "--log.level=DEBUG" + - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin + - --experimental.plugins.jwt.version=v0.7.0 + + autoscaling: + enabled: true + minReplicas: 3 + maxReplicas: 10 + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 + behavior: + scaleDown: + stabilizationWindowSeconds: 300 + policies: + - type: Pods + value: 1 + periodSeconds: 60 + + # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container. + resources: + requests: + cpu: "100m" + memory: "512Mi" + limits: + memory: "512Mi" diff --git a/prd/vault/Chart.yaml b/prd/vault/Chart.yaml new file mode 100644 index 0000000..e52029e --- /dev/null +++ b/prd/vault/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: vault +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: +- name: vault + repository: https://helm.releases.hashicorp.com + version: 0.29.1 + diff --git a/prd/vault/templates/secret-store.yaml b/prd/vault/templates/secret-store.yaml new file mode 100644 index 0000000..0486cfd --- /dev/null +++ b/prd/vault/templates/secret-store.yaml @@ -0,0 +1,23 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: vault +spec: + provider: + vault: + server: "https://vault.infra.durp.info" + path: "kv" + version: "v2" + auth: + kubernetes: + mountPath: "dmz-cluster" + role: "external-secrets" + serviceAccountRef: + name: "vault" + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/prd/vault/values.yaml b/prd/vault/values.yaml new file mode 100644 index 0000000..877d8fe --- /dev/null +++ b/prd/vault/values.yaml @@ -0,0 +1,13 @@ +vault: + global: + enabled: true + tlsDisable: false + externalVaultAddr: "https://vault.infra.durp.info" + resources: + requests: + memory: 256Mi + cpu: 250m + limits: + memory: 256Mi + cpu: 250m + From 11d7183d7c52001261cff2db06f0a480b8ed4d33 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 17 Apr 2025 05:19:45 -0500 Subject: [PATCH 0686/1058] update vlan --- prd/terraform/main.tf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/prd/terraform/main.tf b/prd/terraform/main.tf index c6c6c8e..6aad3d7 100644 --- a/prd/terraform/main.tf +++ b/prd/terraform/main.tf @@ -22,7 +22,7 @@ locals { template = "Debian12-Template" format = "raw" dnsserver = "192.168.11.1" - vlan = 10 + vlan = 11 k3smaster = { tags = "k3s_prd" count = 3 From dcc45cbba5aea2dab15714ed2040279a6faf1463 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 17 Apr 2025 05:49:13 -0500 Subject: [PATCH 0687/1058] update --- ansible/roles/base/files/01proxy | 1 + ansible/roles/base/tasks/main.yaml | 10 ++++++++++ 2 files changed, 11 insertions(+) create mode 100644 ansible/roles/base/files/01proxy diff --git a/ansible/roles/base/files/01proxy b/ansible/roles/base/files/01proxy new file mode 100644 index 0000000..179769b --- /dev/null +++ b/ansible/roles/base/files/01proxy @@ -0,0 +1 @@ +Acquire::http::Proxy "http://192.168.20.200:3142"; diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml index 3d1be45..be2bdb5 100644 --- a/ansible/roles/base/tasks/main.yaml +++ b/ansible/roles/base/tasks/main.yaml @@ -86,6 +86,16 @@ force: yes when: ansible_os_family == "Debian" +- name: Copy apt proxy + copy: + src: files/01proxy + dest: /etc/apt/apt.conf.d/01proxy + owner: root + group: root + mode: "0644" + force: yes + when: ansible_os_family == "Debian" + - name: Remove undesirable packages package: name: "{{ unnecessary_software }}" From a7d4e387e782a6cbd796826794c2c00b395c8093 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 17 Apr 2025 05:49:50 -0500 Subject: [PATCH 0688/1058] update --- ansible/roles/base/tasks/main.yaml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml index be2bdb5..a3b7847 100644 --- a/ansible/roles/base/tasks/main.yaml +++ b/ansible/roles/base/tasks/main.yaml @@ -1,3 +1,13 @@ +- name: Copy apt proxy + copy: + src: files/01proxy + dest: /etc/apt/apt.conf.d/01proxy + owner: root + group: root + mode: "0644" + force: yes + when: ansible_os_family == "Debian" + - name: Update packages apt: name: '*' @@ -86,16 +96,6 @@ force: yes when: ansible_os_family == "Debian" -- name: Copy apt proxy - copy: - src: files/01proxy - dest: /etc/apt/apt.conf.d/01proxy - owner: root - group: root - mode: "0644" - force: yes - when: ansible_os_family == "Debian" - - name: Remove undesirable packages package: name: "{{ unnecessary_software }}" From 9e9e03fcb5a69ee14c3725e438747f167040f487 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 17 Apr 2025 06:28:32 -0500 Subject: [PATCH 0689/1058] update --- ansible/roles/base/tasks/main.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml index a3b7847..8cb1553 100644 --- a/ansible/roles/base/tasks/main.yaml +++ b/ansible/roles/base/tasks/main.yaml @@ -6,7 +6,9 @@ group: root mode: "0644" force: yes - when: ansible_os_family == "Debian" + when: + - ansible_os_family == "Debian" + - inventory_hostname not in hosts_deny - name: Update packages apt: From 81fc69710bcaf1d17ec30f5e40dbde1865be5c9e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 18 Apr 2025 04:42:56 -0500 Subject: [PATCH 0690/1058] update --- ansible/roles/base/files/01proxy | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ansible/roles/base/files/01proxy b/ansible/roles/base/files/01proxy index 179769b..947368d 100644 --- a/ansible/roles/base/files/01proxy +++ b/ansible/roles/base/files/01proxy @@ -1 +1 @@ -Acquire::http::Proxy "http://192.168.20.200:3142"; +Acquire::http::Proxy "http://192.168.21.200:3142"; From fc2d721303c3c460a1ae9a76c5ae780458c0e980 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:25:30 -0500 Subject: [PATCH 0691/1058] add octopus --- infra/argocd/templates/octopusdeploy.yaml | 21 +++++++++++++++++++++ infra/octopusdeploy/Chart.yaml | 12 ++++++++++++ infra/octopusdeploy/values.yaml | 5 +++++ 3 files changed, 38 insertions(+) create mode 100644 infra/argocd/templates/octopusdeploy.yaml create mode 100644 infra/octopusdeploy/Chart.yaml create mode 100644 infra/octopusdeploy/values.yaml diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml new file mode 100644 index 0000000..69a7a4f --- /dev/null +++ b/infra/argocd/templates/octopusdeploy.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: octopusdeploy + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/octopusdeploy + destination: + namespace: octopusdeploy + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml new file mode 100644 index 0000000..a71dc5f --- /dev/null +++ b/infra/octopusdeploy/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: octopusdeploy +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: octopus-deploy + repository: oci://ghcr.io/octopusdeploy/octopusdeploy-helm + version: 1.3.1 diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml new file mode 100644 index 0000000..c43780b --- /dev/null +++ b/infra/octopusdeploy/values.yaml @@ -0,0 +1,5 @@ +octopusdeploy: + octopus: + acceptEula: Y + mssql: + enabled: true \ No newline at end of file From e6022fd274e5531a19d1be85f0baa00736d2cb46 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:27:59 -0500 Subject: [PATCH 0692/1058] update --- infra/octopusdeploy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index a71dc5f..c7d4731 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: octopus-deploy - repository: oci://ghcr.io/octopusdeploy/octopusdeploy-helm + repository: https://ghcr.io/octopusdeploy/octopusdeploy-helm version: 1.3.1 From 68f6027dac7b3901e8002c7ad89778dd4927624f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:29:43 -0500 Subject: [PATCH 0693/1058] update --- infra/octopusdeploy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index c7d4731..775a725 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: octopus-deploy - repository: https://ghcr.io/octopusdeploy/octopusdeploy-helm + repository: https://ghcr.io/octopusdeploy version: 1.3.1 From 9ce0fc4112f5740b302d7fb48d9a00742112715d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:31:06 -0500 Subject: [PATCH 0694/1058] update --- infra/octopusdeploy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index 775a725..3b47149 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: octopus-deploy - repository: https://ghcr.io/octopusdeploy + repository: oci://ghcr.io/octopusdeploy version: 1.3.1 From 88bc421ac1406d846a8d3bf2ebf85462f3bb9059 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:31:59 -0500 Subject: [PATCH 0695/1058] update --- infra/octopusdeploy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index 3b47149..a71dc5f 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: octopus-deploy - repository: oci://ghcr.io/octopusdeploy + repository: oci://ghcr.io/octopusdeploy/octopusdeploy-helm version: 1.3.1 From 6dee8029aa08406bcf25caf18a6f79ba18558f48 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:42:48 -0500 Subject: [PATCH 0696/1058] update --- infra/octopusdeploy/Chart.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index a71dc5f..ae87b72 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -7,6 +7,6 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: - - name: octopus-deploy - repository: oci://ghcr.io/octopusdeploy/octopusdeploy-helm + - name: octopusdeploy-helm + repository: oci://ghcr.io/octopusdeploy version: 1.3.1 From e292970da04777eda6e7009897291f33f6507935 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:44:14 -0500 Subject: [PATCH 0697/1058] update --- infra/octopusdeploy/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml index c43780b..7a412c3 100644 --- a/infra/octopusdeploy/values.yaml +++ b/infra/octopusdeploy/values.yaml @@ -1,4 +1,4 @@ -octopusdeploy: +octopusdeploy-helm: octopus: acceptEula: Y mssql: From 392058905a88e06dd910b8d43269234d2e4bd8d1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 07:56:17 -0500 Subject: [PATCH 0698/1058] update --- infra/octopusdeploy/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml index 7a412c3..67882f2 100644 --- a/infra/octopusdeploy/values.yaml +++ b/infra/octopusdeploy/values.yaml @@ -1,5 +1,7 @@ octopusdeploy-helm: octopus: acceptEula: Y + username: admin + password: temp mssql: enabled: true \ No newline at end of file From dff580e9918618fc8ffccc9a60ba6bb84abb88f6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 10:41:15 -0500 Subject: [PATCH 0699/1058] add secrets --- infra/octopusdeploy/templates/secrets.yaml | 76 ++++++++++++++++++++++ 1 file changed, 76 insertions(+) create mode 100644 infra/octopusdeploy/templates/secrets.yaml diff --git a/infra/octopusdeploy/templates/secrets.yaml b/infra/octopusdeploy/templates/secrets.yaml new file mode 100644 index 0000000..c8a3b1f --- /dev/null +++ b/infra/octopusdeploy/templates/secrets.yaml @@ -0,0 +1,76 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: octopusdeploy-adminpassword +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-adminpassword + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: adminpassword + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: octopusdeploy-adminusername +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-adminusername + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: adminusername + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: octopusdeploy-connectionstring +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-connectionstring + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: connectionstring + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: octopusdeploy-connectionstring +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-connectionstring + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: connectionstring From 4ad72ea0d45cc7ee26926219729535c4aaa12497 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 10:41:53 -0500 Subject: [PATCH 0700/1058] update --- infra/octopusdeploy/templates/secrets.yaml | 24 +++++++++++++++++++--- infra/octopusdeploy/values.yaml | 3 +-- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/infra/octopusdeploy/templates/secrets.yaml b/infra/octopusdeploy/templates/secrets.yaml index c8a3b1f..517f019 100644 --- a/infra/octopusdeploy/templates/secrets.yaml +++ b/infra/octopusdeploy/templates/secrets.yaml @@ -62,15 +62,33 @@ spec: apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: - name: octopusdeploy-connectionstring + name: octopusdeploy-masterkey spec: secretStoreRef: name: vault kind: ClusterSecretStore target: - name: octopusdeploy-connectionstring + name: octopusdeploy-masterkey data: - secretKey: secret remoteRef: key: kv/octopusdeploy - property: connectionstring + property: masterkey + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: octopusdeploy-sapassword +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-sapassword + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: sapassword diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml index 67882f2..caf8560 100644 --- a/infra/octopusdeploy/values.yaml +++ b/infra/octopusdeploy/values.yaml @@ -1,7 +1,6 @@ octopusdeploy-helm: octopus: + createSecrets: false acceptEula: Y - username: admin - password: temp mssql: enabled: true \ No newline at end of file From 64b4d9b0b8f9823bcf775b2f14057c0f506a36f5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 20 Apr 2025 11:20:46 -0500 Subject: [PATCH 0701/1058] update --- dmz/internalproxy/templates/octopus.yaml | 42 ++++++++++++++++++++++ infra/octopusdeploy/templates/ingress.yaml | 32 +++++++++++++++++ 2 files changed, 74 insertions(+) create mode 100644 dmz/internalproxy/templates/octopus.yaml create mode 100644 infra/octopusdeploy/templates/ingress.yaml diff --git a/dmz/internalproxy/templates/octopus.yaml b/dmz/internalproxy/templates/octopus.yaml new file mode 100644 index 0000000..4e86f71 --- /dev/null +++ b/dmz/internalproxy/templates/octopus.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: octopus-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`octopus.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: octopus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: octopus-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: octopus-tls + commonName: "octopus.durp.info" + dnsNames: + - "octopus.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: octopus-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: octopus.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/infra/octopusdeploy/templates/ingress.yaml b/infra/octopusdeploy/templates/ingress.yaml new file mode 100644 index 0000000..e399ae8 --- /dev/null +++ b/infra/octopusdeploy/templates/ingress.yaml @@ -0,0 +1,32 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: octopus-ingress + annotations: + cert-manager.io/cluster-issuer: letsencrypt-production +spec: + entryPoints: + - websecure + routes: + - match: Host(`octopus.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: octopusdeploy-octopus-deploy + port: 80 + tls: + secretName: octopus-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: octopus-tls +spec: + secretName: octopus-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "octopus.durp.info" + dnsNames: + - "octopus.durp.info" From 5a8fa58e9bd4fccbe06a99437706430f67924273 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:18:49 -0500 Subject: [PATCH 0702/1058] update --- infra/argocd/templates/nfs.yaml | 18 ++++++++++++++++++ infra/nfs/Chart.yaml | 12 ++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 infra/argocd/templates/nfs.yaml create mode 100644 infra/nfs/Chart.yaml diff --git a/infra/argocd/templates/nfs.yaml b/infra/argocd/templates/nfs.yaml new file mode 100644 index 0000000..f7e964f --- /dev/null +++ b/infra/argocd/templates/nfs.yaml @@ -0,0 +1,18 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: nfs + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/nfs + destination: + namespace: kube-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true diff --git a/infra/nfs/Chart.yaml b/infra/nfs/Chart.yaml new file mode 100644 index 0000000..1a9ffb9 --- /dev/null +++ b/infra/nfs/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: nfs-csi +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: csi-driver-nfs + repository: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts + version: 4.11.0 From 2097a8dd3a5c767e7d9c5c4b415653813d7682af Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:34:33 -0500 Subject: [PATCH 0703/1058] update --- infra/argocd/templates/octopusdeploy.yaml | 23 +++++++++++++++++++++++ infra/octopus-agent/Chart.yaml | 12 ++++++++++++ infra/octopus-agent/templates/secret.yaml | 23 +++++++++++++++++++++++ infra/octopus-agent/values.yaml | 17 +++++++++++++++++ 4 files changed, 75 insertions(+) create mode 100644 infra/octopus-agent/Chart.yaml create mode 100644 infra/octopus-agent/templates/secret.yaml create mode 100644 infra/octopus-agent/values.yaml diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml index 69a7a4f..87d1add 100644 --- a/infra/argocd/templates/octopusdeploy.yaml +++ b/infra/argocd/templates/octopusdeploy.yaml @@ -19,3 +19,26 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: octopusdeploy-agent + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/octopus-agent + destination: + namespace: octpus-agent + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + diff --git a/infra/octopus-agent/Chart.yaml b/infra/octopus-agent/Chart.yaml new file mode 100644 index 0000000..c33a417 --- /dev/null +++ b/infra/octopus-agent/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: octopusdeploy +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: kubernetes-agent + repository: oci://ghcr.io/octopusdeploy + version: 2.*.* diff --git a/infra/octopus-agent/templates/secret.yaml b/infra/octopus-agent/templates/secret.yaml new file mode 100644 index 0000000..68ca864 --- /dev/null +++ b/infra/octopus-agent/templates/secret.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: agent-token +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: agent-token + data: + - secretKey: bearer-token + remoteRef: + key: kv/octopusdeploy + property: infra-bearer-token + diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml new file mode 100644 index 0000000..c87db8f --- /dev/null +++ b/infra/octopus-agent/values.yaml @@ -0,0 +1,17 @@ +kubernetes-agent: + agent: + acceptEula: y + serverUrl: https://octopus.durp.info/" + serverCommsAddress: + - https://octopus.durp.info:10943/ + space: Default + name: Infra + deploymentTarget: + enabled: true + bearerTokenSecretName: agent-token + initial: + environments: + - development + - production + tags: + - infra-cluster From 74ec11d0fe6529b6216e02e849143be2c722b8f1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:35:40 -0500 Subject: [PATCH 0704/1058] update --- infra/octopus-agent/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopus-agent/Chart.yaml b/infra/octopus-agent/Chart.yaml index c33a417..f36dd2d 100644 --- a/infra/octopus-agent/Chart.yaml +++ b/infra/octopus-agent/Chart.yaml @@ -8,5 +8,5 @@ appVersion: "1.16.0" dependencies: - name: kubernetes-agent - repository: oci://ghcr.io/octopusdeploy + repository: oci://registry-1.docker.io/octopusdeploy version: 2.*.* From ec9d97f401d8fc119d2b211780a32d403309b323 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:38:27 -0500 Subject: [PATCH 0705/1058] update --- infra/octopus-agent/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index c87db8f..0c77e3d 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -1,6 +1,6 @@ kubernetes-agent: agent: - acceptEula: y + acceptEula: Y serverUrl: https://octopus.durp.info/" serverCommsAddress: - https://octopus.durp.info:10943/ From 8a2cb45bc73b77fb53f3ebe35974d892e936d262 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:40:53 -0500 Subject: [PATCH 0706/1058] update --- infra/octopus-agent/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 0c77e3d..abe355c 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -1,6 +1,6 @@ kubernetes-agent: agent: - acceptEula: Y + acceptEula: "Y" serverUrl: https://octopus.durp.info/" serverCommsAddress: - https://octopus.durp.info:10943/ From 5e3019d2f3b30b2c4c3d15bd30f7f1a8a9e9e61e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:46:35 -0500 Subject: [PATCH 0707/1058] update --- infra/octopus-agent/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index abe355c..ab433b2 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -8,6 +8,7 @@ kubernetes-agent: name: Infra deploymentTarget: enabled: true + bearerToken: "test" bearerTokenSecretName: agent-token initial: environments: From 09e4a5013a9819a83272a9f4dc43164aed99ffae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:48:17 -0500 Subject: [PATCH 0708/1058] update --- infra/octopus-agent/values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index ab433b2..ecab4ee 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -1,6 +1,7 @@ kubernetes-agent: agent: acceptEula: "Y" + bearerTokenSecretName: agent-token serverUrl: https://octopus.durp.info/" serverCommsAddress: - https://octopus.durp.info:10943/ @@ -8,8 +9,6 @@ kubernetes-agent: name: Infra deploymentTarget: enabled: true - bearerToken: "test" - bearerTokenSecretName: agent-token initial: environments: - development From a2b64f80b48dd2cd7d704861f3ad711fa1252869 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 22 Apr 2025 06:50:16 -0500 Subject: [PATCH 0709/1058] update --- infra/octopus-agent/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index ecab4ee..8640f21 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -4,7 +4,8 @@ kubernetes-agent: bearerTokenSecretName: agent-token serverUrl: https://octopus.durp.info/" serverCommsAddress: - - https://octopus.durp.info:10943/ + - https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943 + #- https://octopus.durp.info:10943/ space: Default name: Infra deploymentTarget: From 42ba7594fb26e94d3005ee6eaa8ea04892b7eff4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 04:54:43 -0500 Subject: [PATCH 0710/1058] update --- infra/octopus-agent/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 8640f21..e5c1e8a 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -4,7 +4,7 @@ kubernetes-agent: bearerTokenSecretName: agent-token serverUrl: https://octopus.durp.info/" serverCommsAddress: - - https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943 + - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" #- https://octopus.durp.info:10943/ space: Default name: Infra From babc384d1718ed78f8e009d7d5147e60fd8fe411 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 04:56:54 -0500 Subject: [PATCH 0711/1058] update --- infra/octopus-agent/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index e5c1e8a..651e83e 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -3,8 +3,8 @@ kubernetes-agent: acceptEula: "Y" bearerTokenSecretName: agent-token serverUrl: https://octopus.durp.info/" - serverCommsAddress: - - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" + serverCommsAddresses: + - https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/ #- https://octopus.durp.info:10943/ space: Default name: Infra From f58716f517913c610dcf193a5078fd4f7c5d5354 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 04:59:00 -0500 Subject: [PATCH 0712/1058] update --- infra/octopus-agent/values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 651e83e..3f886de 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -5,9 +5,8 @@ kubernetes-agent: serverUrl: https://octopus.durp.info/" serverCommsAddresses: - https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/ - #- https://octopus.durp.info:10943/ space: Default - name: Infra + name: infra deploymentTarget: enabled: true initial: From 4adc7323e36ccd91175b86c46f7795e3fedf94d5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 05:04:34 -0500 Subject: [PATCH 0713/1058] update --- infra/octopus-agent/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 3f886de..1b29937 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -2,7 +2,7 @@ kubernetes-agent: agent: acceptEula: "Y" bearerTokenSecretName: agent-token - serverUrl: https://octopus.durp.info/" + serverUrl: http://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local/" serverCommsAddresses: - https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/ space: Default @@ -14,4 +14,4 @@ kubernetes-agent: - development - production tags: - - infra-cluster + - infra-cluster \ No newline at end of file From a950be662b87364ec66644c510606f31cca0cc58 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 05:07:41 -0500 Subject: [PATCH 0714/1058] update --- infra/octopus-agent/values.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 1b29937..e773293 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -10,8 +10,6 @@ kubernetes-agent: deploymentTarget: enabled: true initial: - environments: - - development - - production + environments: {development,production} tags: - infra-cluster \ No newline at end of file From 6fe8eec8f93eaeaf8c5b7df4b3d6f809cb2a1d74 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 05:10:52 -0500 Subject: [PATCH 0715/1058] update --- infra/octopus-agent/values.yaml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index e773293..48f5a12 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -1,15 +1,17 @@ kubernetes-agent: agent: - acceptEula: "Y" bearerTokenSecretName: agent-token - serverUrl: http://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local/" + acceptEula: "Y" + serverUrl: "https://octopus.durp.info/" serverCommsAddresses: - - https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/ - space: Default - name: infra + - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" + space: "Default" + name: "infra" deploymentTarget: - enabled: true initial: - environments: {development,production} + environments: + - "development" + - "production" tags: - - infra-cluster \ No newline at end of file + - "infra-cluster" + enabled: "true" From a6289a905520adbe9e9a91442e4e9699e42bfcaf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 05:59:42 -0500 Subject: [PATCH 0716/1058] update --- infra/octopusdeploy/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml index caf8560..d75acbc 100644 --- a/infra/octopusdeploy/values.yaml +++ b/infra/octopusdeploy/values.yaml @@ -2,5 +2,6 @@ octopusdeploy-helm: octopus: createSecrets: false acceptEula: Y + replicaCount: 3 mssql: enabled: true \ No newline at end of file From 41d2d55807cecae21885f0f4d8724ab8ac3b417b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 06:11:10 -0500 Subject: [PATCH 0717/1058] remove postgres servers --- infra/terraform/postgres.tf | 231 ++++++++++++++++++------------------ 1 file changed, 116 insertions(+), 115 deletions(-) diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf index 5d7274f..47b8daa 100644 --- a/infra/terraform/postgres.tf +++ b/infra/terraform/postgres.tf @@ -1,115 +1,116 @@ -resource "proxmox_vm_qemu" "haproxy" { - count = local.haproxy.count - ciuser = "administrator" - vmid = "${local.vlan}${local.haproxy.ip[count.index]}" - name = local.haproxy.name[count.index] - target_node = local.haproxy.node[count.index] - clone = local.template - tags = local.haproxy.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.haproxy.cores - sockets = 1 - cpu_type = "host" - memory = local.haproxy.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.haproxy.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.haproxy.drive - format = local.format - storage = local.haproxy.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "postgres" { - count = local.postgres.count - ciuser = "administrator" - vmid = "${local.vlan}${local.postgres.ip[count.index]}" - name = local.postgres.name[count.index] - target_node = local.postgres.node[count.index] - clone = local.template - tags = local.postgres.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.postgres.cores - sockets = 1 - cpu_type = "host" - memory = local.postgres.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.postgres.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.postgres.drive - format = local.format - storage = local.postgres.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} +#resource "proxmox_vm_qemu" "haproxy" { +# count = local.haproxy.count +# ciuser = "administrator" +# vmid = "${local.vlan}${local.haproxy.ip[count.index]}" +# name = local.haproxy.name[count.index] +# target_node = local.haproxy.node[count.index] +# clone = local.template +# tags = local.haproxy.tags +# qemu_os = "l26" +# full_clone = true +# os_type = "cloud-init" +# agent = 1 +# cores = local.haproxy.cores +# sockets = 1 +# cpu_type = "host" +# memory = local.haproxy.memory +# scsihw = "virtio-scsi-pci" +# #bootdisk = "scsi0" +# boot = "order=virtio0" +# onboot = true +# sshkeys = local.sshkeys +# vga { +# type = "serial0" +# } +# serial { +# id = 0 +# type = "socket" +# } +# disks { +# ide { +# ide2 { +# cloudinit { +# storage = local.haproxy.storage +# } +# } +# } +# virtio { +# virtio0 { +# disk { +# size = local.haproxy.drive +# format = local.format +# storage = local.haproxy.storage +# } +# } +# } +# } +# network { +# id = 0 +# model = "virtio" +# bridge = "vmbr0" +# tag = local.vlan +# } +# #Cloud Init Settings +# ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" +# searchdomain = "durp.loc" +# nameserver = local.dnsserver +#} +# +#resource "proxmox_vm_qemu" "postgres" { +# count = local.postgres.count +# ciuser = "administrator" +# vmid = "${local.vlan}${local.postgres.ip[count.index]}" +# name = local.postgres.name[count.index] +# target_node = local.postgres.node[count.index] +# clone = local.template +# tags = local.postgres.tags +# qemu_os = "l26" +# full_clone = true +# os_type = "cloud-init" +# agent = 1 +# cores = local.postgres.cores +# sockets = 1 +# cpu_type = "host" +# memory = local.postgres.memory +# scsihw = "virtio-scsi-pci" +# #bootdisk = "scsi0" +# boot = "order=virtio0" +# onboot = true +# sshkeys = local.sshkeys +# vga { +# type = "serial0" +# } +# serial { +# id = 0 +# type = "socket" +# } +# disks { +# ide { +# ide2 { +# cloudinit { +# storage = local.postgres.storage +# } +# } +# } +# virtio { +# virtio0 { +# disk { +# size = local.postgres.drive +# format = local.format +# storage = local.postgres.storage +# } +# } +# } +# } +# network { +# id = 0 +# model = "virtio" +# bridge = "vmbr0" +# tag = local.vlan +# } +# #Cloud Init Settings +# ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" +# searchdomain = "durp.loc" +# nameserver = local.dnsserver +#} +# \ No newline at end of file From 79256a59644e91b06c0de17fe2a0add1ae06191c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 06:16:42 -0500 Subject: [PATCH 0718/1058] update image --- infra/octopusdeploy/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml index d75acbc..71c70b1 100644 --- a/infra/octopusdeploy/values.yaml +++ b/infra/octopusdeploy/values.yaml @@ -1,5 +1,8 @@ octopusdeploy-helm: octopus: + image: + repository: registry.durp.info/octopusdeploy/octopusdeploy + tag: 2025.1 createSecrets: false acceptEula: Y replicaCount: 3 From 408a8048e6631c262681749182ee8f41b3dc8773 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 06:23:27 -0500 Subject: [PATCH 0719/1058] update nodes to 16gb --- infra/terraform/main.tf | 46 ++++++++++++++++++++--------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 01c28f4..2fa173b 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -39,34 +39,34 @@ locals { count = 3 name = ["node01-infra", "node02-infra", "node03-infra"] cores = 4 - memory = "8192" + memory = "16384" drive = 240 storage = "cache-domains" node = ["mothership", "overlord", "vanguard"] ip = ["21", "22", "23"] } - haproxy = { - tags = "haproxy" - count = 3 - name = ["haproxy-01", "haproxy-02", "haproxy-03"] - cores = 2 - memory = "1024" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["31", "32", "33"] - } - postgres = { - tags = "postgres" - count = 3 - name = ["postgres-01", "postgres-02", "postgres-03"] - cores = 4 - memory = "4096" - drive = 40 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["34", "35", "36"] - } + #haproxy = { + # tags = "haproxy" + # count = 3 + # name = ["haproxy-01", "haproxy-02", "haproxy-03"] + # cores = 2 + # memory = "1024" + # drive = 20 + # storage = "cache-domains" + # node = ["mothership", "overlord", "vanguard"] + # ip = ["31", "32", "33"] + #} + #postgres = { + # tags = "postgres" + # count = 3 + # name = ["postgres-01", "postgres-02", "postgres-03"] + # cores = 4 + # memory = "4096" + # drive = 40 + # storage = "cache-domains" + # node = ["mothership", "overlord", "vanguard"] + # ip = ["34", "35", "36"] + #} pihole = { tags = "pihole" count = 3 From 448c8b0ea3aa3dc9fbf2310a240b88993d7a82da Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 15:54:23 -0500 Subject: [PATCH 0720/1058] add littlelink to dmz --- dmz/littlelink/Chart.yaml | 0 dmz/littlelink/templates/deployment.yaml | 101 +++++++++++++++++++++++ dmz/littlelink/templates/ingress.yaml | 42 ++++++++++ dmz/littlelink/templates/service.yaml | 12 +++ infra/argocd/templates/littlelink.yaml | 22 +++++ 5 files changed, 177 insertions(+) create mode 100644 dmz/littlelink/Chart.yaml create mode 100644 dmz/littlelink/templates/deployment.yaml create mode 100644 dmz/littlelink/templates/ingress.yaml create mode 100644 dmz/littlelink/templates/service.yaml create mode 100644 infra/argocd/templates/littlelink.yaml diff --git a/dmz/littlelink/Chart.yaml b/dmz/littlelink/Chart.yaml new file mode 100644 index 0000000..e69de29 diff --git a/dmz/littlelink/templates/deployment.yaml b/dmz/littlelink/templates/deployment.yaml new file mode 100644 index 0000000..ec9ab4d --- /dev/null +++ b/dmz/littlelink/templates/deployment.yaml @@ -0,0 +1,101 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: littlelink + name: littlelink + labels: + app: littlelink +spec: + selector: + matchLabels: + app: littlelink + replicas: 1 + template: + metadata: + labels: + app: littlelink + spec: + containers: + - name: littlelink + image: registry.internal.durp.info/techno-tim/littlelink-server:latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: /healthcheck + port: 3000 + readinessProbe: + httpGet: + path: /healthcheck + port: 3000 + env: + - name: META_TITLE + value: DeveloperDurp + - name: META_DESCRIPTION + value: The Durpy Developer + - name: META_AUTHOR + value: DeveloperDurp + - name: LANG + value: en + - name: META_INDEX_STATUS + value: all + - name: OG_TITLE + value: DeveloperDurp + - name: OG_DESCRIPTION + value: DeveloperDurp + - name: OG_URL + value: https://gitlab.com/developerdurp + - name: OG_IMAGE + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : OG_IMAGE_WIDTH + value: "400" + - name : OG_IMAGE_HEIGHT + value: "400" + - name : THEME + value: Dark + - name : FAVICON_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_2X_URL + value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png + - name : AVATAR_ALT + value: DeveloperDurp Profile Pic + - name : NAME + value: DeveloperDurp + - name : BIO + value: Sup Nerd, + - name : BUTTON_ORDER + value: GITHUB,GITLAB,YOUTUBE,INSTAGRAM,TWITTER,BLUESKY,COFFEE,EMAIL + - name : TWITTER + value: https://twitter.com/developerdurp + - name : GITHUB + value: https://github.com/DeveloperDurp + - name: INSTAGRAM + value: https://instagram.com/developerdurp + - name : GITLAB + value: https://gitlab.com/developerdurp + - name: YOUTUBE + value: https://www.youtube.com/channel/UC1rGa6s6kER_gLpIQsxeMVQ + - name : EMAIL + value: DeveloperDurp@durp.info + - name : EMAIL_TEXT + value: DeveloperDurp@durp.info + - name : FOOTER + value: DeveloperDurp © 2022 + - name: CUSTOM_BUTTON_TEXT + value: BuyMeACoffee,BlueSky + - name: CUSTOM_BUTTON_URL + value: https://www.buymeacoffee.com/DeveloperDurp,https://bsky.app/profile/durp.info + - name: CUSTOM_BUTTON_COLOR + value: '#ffdd00,#1185fe' + - name: CUSTOM_BUTTON_TEXT_COLOR + value: '#000000,#FFFFFF' + - name: CUSTOM_BUTTON_ALT_TEXT + value: Support,BlueSky + - name: CUSTOM_BUTTON_NAME + value: COFFEE,BLUESKY + - name: CUSTOM_BUTTON_ICON + value: fa-solid fa-cup-togo + ports: + - name: http + containerPort: 3000 diff --git a/dmz/littlelink/templates/ingress.yaml b/dmz/littlelink/templates/ingress.yaml new file mode 100644 index 0000000..9590fc5 --- /dev/null +++ b/dmz/littlelink/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: littlelink-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`links.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: littlelink + port: 80 + tls: + secretName: littlelink-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: littlelink-tls +spec: + secretName: littlelink-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "links.durp.info" + dnsNames: + - "links.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: links-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: links.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/dmz/littlelink/templates/service.yaml b/dmz/littlelink/templates/service.yaml new file mode 100644 index 0000000..445d527 --- /dev/null +++ b/dmz/littlelink/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: littlelink +spec: + ports: + - name: http + port: 80 + targetPort: 3000 + protocol: TCP + selector: + app: littlelink \ No newline at end of file diff --git a/infra/argocd/templates/littlelink.yaml b/infra/argocd/templates/littlelink.yaml new file mode 100644 index 0000000..5821718 --- /dev/null +++ b/infra/argocd/templates/littlelink.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: littlelink + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/littlelink + directory: + recurse: true + destination: + name: dmz + namespace: littlelink + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 980eab909d37224b79b5950ba30504b38f45271e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Apr 2025 15:55:43 -0500 Subject: [PATCH 0721/1058] update --- dmz/littlelink/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/littlelink/templates/deployment.yaml b/dmz/littlelink/templates/deployment.yaml index ec9ab4d..6d31068 100644 --- a/dmz/littlelink/templates/deployment.yaml +++ b/dmz/littlelink/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: littlelink - image: registry.internal.durp.info/techno-tim/littlelink-server:latest + image: registry.durp.info/techno-tim/littlelink-server:latest imagePullPolicy: Always livenessProbe: httpGet: From f9edb8b4d2e312284576e7e3be321761e7d277f2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 05:36:10 -0500 Subject: [PATCH 0722/1058] update --- infra/renovate/Chart.yaml | 13 ++ infra/renovate/values.yaml | 320 +++++++++++++++++++++++++++++++++++++ 2 files changed, 333 insertions(+) create mode 100644 infra/renovate/Chart.yaml create mode 100644 infra/renovate/values.yaml diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml new file mode 100644 index 0000000..e91e2d5 --- /dev/null +++ b/infra/renovate/Chart.yaml @@ -0,0 +1,13 @@ +apiVersion: v2 +name: renovate +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: renovate + repository: https://docs.renovatebot.com/helm-charts + version: 39.264.0 + diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml new file mode 100644 index 0000000..c378fc5 --- /dev/null +++ b/infra/renovate/values.yaml @@ -0,0 +1,320 @@ +renovate: + global: + # -- Additional labels to be set on all renovate resources + commonLabels: {} + compatibility: + openshift: + # -- Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: `auto` (apply if the detected running cluster is Openshift), `force` (perform the adaptation always), `disabled` (do not perform adaptation) + adaptSecurityContext: 'auto' + + # -- Override the name of the chart + nameOverride: '' + # -- Override the fully qualified app name + fullnameOverride: '' + # -- Annotations to add to secret + secretAnnotations: {} + + cronjob: + # -- Schedules the job to run using cron notation + schedule: '0 1 * * *' # At 01:00 every day + # -- You can specify a time zone for a CronJob by setting timeZone to the name of a valid time zone. (starting with k8s 1.27) + timeZone: '' # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names + # -- If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. + suspend: false + # -- Annotations to set on the cronjob + annotations: {} + # -- Labels to set on the cronjob + labels: {} + # -- "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run + concurrencyPolicy: '' + # -- "Number of successful completions is reached to mark the job as complete" + completions: '' + # -- "Where the jobs should be NonIndexed or Indexed" + completionMode: '' + # -- Amount of failed jobs to keep in history + failedJobsHistoryLimit: '' + # -- Amount of completed jobs to keep in history + successfulJobsHistoryLimit: '' + # -- Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails + jobRestartPolicy: Never + # -- Time to keep the job after it finished before automatically deleting it + ttlSecondsAfterFinished: '' + # -- Deadline for the job to finish + activeDeadlineSeconds: '' + # -- Number of times to retry running the pod before considering the job as being failed + jobBackoffLimit: '' + # -- Maximal number of failures per index + backoffLimitPerIndex: '' + # -- Maximal number of failed indexes before terminating the Job execution + maxFailedIndexes: '' + # -- Deadline to start the job, skips execution if job misses it's configured deadline + startingDeadlineSeconds: '' + # -- Additional initContainers that can be executed before renovate + initContainers: [] + # initContainers: + # - name: INIT_CONTAINER_NAME + # image: INIT_CONTAINER_IMAGE + # -- Number of pods to run in parallel + parallelism: '' + # -- Custom command to run in the container + commandOverride: [] + # -- Custom arguments to run in the container + argsOverride: [] + # -- Prepend shell commands before renovate runs + preCommand: '' + # preCommand: | + # echo hello + # echo world + + # -- Append shell commands after renovate runs + postCommand: '' + # postCommand: | + # echo hello + # echo world + + pod: + # -- Annotations to set on the pod + annotations: {} + # -- Labels to set on the pod + labels: {} + + image: + # -- Registry to pull image from + registry: registry.durp.info + # -- Image name to pull + repository: renovatebot/renovate + # -- Renovate image tag to pull + #tag: 39.264.0 + # -- "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images + pullPolicy: Always + # -- Set `true` to use the full image. See https://docs.renovatebot.com/getting-started/running/#the-full-image + useFull: false + + # -- Secret to use to pull the image from the repository + imagePullSecrets: {} + + renovate: + # -- Custom exiting global renovate config + existingConfigFile: '' + # -- Inline global renovate config.json + config: '' + # See https://docs.renovatebot.com/self-hosted-configuration + # config: | + # { + # "platform": "gitlab", + # "endpoint": "https://gitlab.example.com/api/v4", + # "token": "your-gitlab-renovate-user-token", + # "autodiscover": "false", + # "dryRun": true, + # "printConfig": true, + # "repositories": ["username/repo", "orgname/repo"] + # } + + # -- Use the Helm tpl function on your configuration. See README for how to use this value + configEnableHelmTpl: false + + # -- Use this to create the renovate-config as a secret instead of a configmap + configIsSecret: true + + # -- Use this to create a config.js instead of a config.json + configIsJavaScript: false + + # -- Renovate Container-level security-context + securityContext: {} + + # Instead of a file system cache, it is highly recommended to use the redis subchart. + # Alternatively, SQLite is also a good choice. + # Take a look at https://github.com/renovatebot/renovate/discussions/30525 for more information. + # -- Options related to persistence + persistence: + cache: + # -- Allow the cache to persist between runs + enabled: false + # -- Storage class of the cache PVC + storageClass: "" + # -- Storage size of the cache PVC + storageSize: "512Mi" + # -- Existing volume, enables binding the pvc to an existing volume + volumeName: "" + # -- Labels to set on the cache PVC + labels: {} + + ssh_config: + # -- Whether to enable the use and creation of a secret containing .ssh files + enabled: false + + # Provide .ssh config file contents + # -- Contents of the id_rsa file + id_rsa: '' + # -- Contents of the id_rsa_pub file + id_rsa_pub: '' + # -- Contents of the config file + config: '' + + # or provide the name of an existing secret to be read instead. + # -- Name of the existing secret containing a valid .ssh configuration + existingSecret: '' + + # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set + secrets: {} + # -- k8s secret to reference environment variables from. Overrides secrets if set + existingSecret: '' + + # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config + extraConfigmaps: [] + # extraConfigmaps: + # - name: netrc-config + # data: + # .netrc: |- + # machine gitlab.example.com + # login gitlab-ci-token + # password some-pass + # - name: yet-another-config + # data: + # ya-config.yaml: |- + # "key"="value" + # "key1"="value1" + + # -- Additional volumes to the pod + extraVolumes: [] + # extraVolumes: + # - name: netrc-config + # configMap: + # name: renovate-extra-netrc-config + + # -- Additional volumeMounts to the container + extraVolumeMounts: [] + # extraVolumeMounts: + # - name: netrc-config + # mountPath: /home/ubuntu/.netrc + # subPath: .netrc + + # -- Additional containers to the pod + extraContainers: [] + # extraContainers: + # - name: vault-agent + # image: vault:1.6.2 + # args: + # - agent + # - -config + # - /vault/config/config.hcl + # env: + # - name: VAULT_ADDR + # value: https://vault:8200 + # - name: VAULT_SKIP_VERIFY + # value: "false" + # - name: VAULT_CACERT + # value: /vault/tls/ca.crt + + serviceAccount: + # -- Specifies whether a service account should be created + create: false + # -- Annotations to add to the service account + annotations: {} + # -- The name of the service account to use + # If not set and create is true, a name is generated using the fullname template + name: '' + + # -- Specify resource limits and requests for the renovate container + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name + envFrom: [] + # envFrom: + # - secretRef: + # name: env-secrets + # - configMapRef: + # name: env-configmap + + # -- Environment variables to set on the renovate container + env: {} + # env: + # VARIABLE_NAME: "value" + + # -- Additional env. Helpful too if you want to use anything other than a `value` source. + envList: [] + # envList: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + + redis: + # Configuration for a Redis subchart. Additional documentation at + # https://github.com/bitnami/charts/tree/master/bitnami/redis + + # -- Enable the Redis subchart? + enabled: false + + # -- Override the prefix of the redisHost + nameOverride: '' + + # -- Disable replication by default + architecture: standalone + + auth: + # -- Don't require a password by default + enabled: false + + # -- Override Kubernetes version for redis chart + kubeVersion: '' + + # -- Override hostname resolution + hostAliases: [] + # See: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ + # hostAliases: + # - ip: "your-ip" + # hostnames: + # - "your-hostname" + + # -- Pod-level security-context + securityContext: {} + + # -- Select the node using labels to specify where the cronjob pod should run on + nodeSelector: {} + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # renovate: true + + # -- Configure the pod(Anti)Affinity and/or node(Anti)Affinity + affinity: {} + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + + # -- Configure which node taints the pod should tolerate + tolerations: [] + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + + # -- Create extra manifests via values. Would be passed through `tpl` for templating + extraObjects: [] + # extraObjects: + # - apiVersion: external-secrets.io/v1beta1 + # kind: ExternalSecret + # metadata: + # name: '{{ include "renovate.fullname" . }}-token' + # spec: + # secretStoreRef: + # name: default + # data: + # - secretKey: token + # remoteRef: + # key: github-token + # - | + # apiVersion: v1 + # kind: ConfigMap + # metadata: + # name: {{ include "renovate.fullname" . }}-config + # data: + # config.json: | + # { + # "platform": "github", + # "repositories": ["username/repo", "orgname/repo"] + # } From 83195cc317ec9b0b8aa2f562bea5ea8e912be680 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 05:36:48 -0500 Subject: [PATCH 0723/1058] update --- infra/argocd/templates/renovate.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 infra/argocd/templates/renovate.yaml diff --git a/infra/argocd/templates/renovate.yaml b/infra/argocd/templates/renovate.yaml new file mode 100644 index 0000000..659d61f --- /dev/null +++ b/infra/argocd/templates/renovate.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: renovate + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/renovate + destination: + namespace: renovate + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 7260fea4c8fdbb59300e0a33964c09761bc7ea9d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 05:41:04 -0500 Subject: [PATCH 0724/1058] update --- infra/renovate/templates/secrets.yaml | 22 ++++++++++++++++++++++ infra/renovate/values.yaml | 2 +- 2 files changed, 23 insertions(+), 1 deletion(-) create mode 100644 infra/renovate/templates/secrets.yaml diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml new file mode 100644 index 0000000..0506c89 --- /dev/null +++ b/infra/renovate/templates/secrets.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: openclarity-postgres-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: openclarity-postgres-secret + data: + - secretKey: renovate-config + remoteRef: + key: kv/renovate + property: config diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index c378fc5..969c10d 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -95,7 +95,7 @@ renovate: renovate: # -- Custom exiting global renovate config - existingConfigFile: '' + existingConfigFile: 'renovate-config' # -- Inline global renovate config.json config: '' # See https://docs.renovatebot.com/self-hosted-configuration From 91c26911ced79a8fe5b64ca89b00cea4a6081392 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 05:42:19 -0500 Subject: [PATCH 0725/1058] update --- infra/renovate/templates/secrets.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index 0506c89..03c99f6 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -8,13 +8,13 @@ metadata: apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: - name: openclarity-postgres-secret + name: renovate-config spec: secretStoreRef: name: vault kind: ClusterSecretStore target: - name: openclarity-postgres-secret + name: renovate-config data: - secretKey: renovate-config remoteRef: From 37ab76ac8e702da389ce41550b003ac29cf6d3ee Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 05:53:47 -0500 Subject: [PATCH 0726/1058] update --- infra/renovate/templates/secrets.yaml | 6 +++--- infra/renovate/values.yaml | 24 ++++++++++-------------- 2 files changed, 13 insertions(+), 17 deletions(-) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index 03c99f6..382e370 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -8,15 +8,15 @@ metadata: apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: - name: renovate-config + name: renovate-config-secret spec: secretStoreRef: name: vault kind: ClusterSecretStore target: - name: renovate-config + name: renovate-config-secret data: - - secretKey: renovate-config + - secretKey: renovate-config-secret remoteRef: key: kv/renovate property: config diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 969c10d..a805a47 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -95,13 +95,13 @@ renovate: renovate: # -- Custom exiting global renovate config - existingConfigFile: 'renovate-config' + existingConfigFile: '/renovate.json' # -- Inline global renovate config.json config: '' # See https://docs.renovatebot.com/self-hosted-configuration # config: | # { - # "platform": "gitlab", + # "": "gitlab", # "endpoint": "https://gitlab.example.com/api/v4", # "token": "your-gitlab-renovate-user-token", # "autodiscover": "false", @@ -175,19 +175,15 @@ renovate: # "key"="value" # "key1"="value1" - # -- Additional volumes to the pod - extraVolumes: [] - # extraVolumes: - # - name: netrc-config - # configMap: - # name: renovate-extra-netrc-config + extraVolumes: + - name: renovate-config + secretName: + name: renovate-config-secret - # -- Additional volumeMounts to the container - extraVolumeMounts: [] - # extraVolumeMounts: - # - name: netrc-config - # mountPath: /home/ubuntu/.netrc - # subPath: .netrc + extraVolumeMounts: + - name: renovate-config + mountPath: / + subPath: renovate.config # -- Additional containers to the pod extraContainers: [] From cb3f240a2ce3f5a0c7a25e5f4485269873259df2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 05:55:23 -0500 Subject: [PATCH 0727/1058] update --- infra/renovate/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index a805a47..da540ca 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -95,7 +95,7 @@ renovate: renovate: # -- Custom exiting global renovate config - existingConfigFile: '/renovate.json' + existingConfigFile: '/config/renovate.json' # -- Inline global renovate config.json config: '' # See https://docs.renovatebot.com/self-hosted-configuration @@ -182,7 +182,7 @@ renovate: extraVolumeMounts: - name: renovate-config - mountPath: / + mountPath: /config subPath: renovate.config # -- Additional containers to the pod From 2729f7e4c207a3bee7cb7354b31b5db48b181b47 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 05:58:57 -0500 Subject: [PATCH 0728/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index da540ca..7de924a 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -183,7 +183,7 @@ renovate: extraVolumeMounts: - name: renovate-config mountPath: /config - subPath: renovate.config + subPath: renovate.json # -- Additional containers to the pod extraContainers: [] From 11b3a1b923a20ca0b2b8e1c5983024a5795ccdf3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 06:02:37 -0500 Subject: [PATCH 0729/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 7de924a..9716a2d 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -182,7 +182,7 @@ renovate: extraVolumeMounts: - name: renovate-config - mountPath: /config + mountPath: /config/renovate.json subPath: renovate.json # -- Additional containers to the pod From c6e52fd256c548d4c76809bd6c704e980390f9b2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 06:06:53 -0500 Subject: [PATCH 0730/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 9716a2d..7de924a 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -182,7 +182,7 @@ renovate: extraVolumeMounts: - name: renovate-config - mountPath: /config/renovate.json + mountPath: /config subPath: renovate.json # -- Additional containers to the pod From e7c75c9c8212a1c43590cc3376c6ac05110b0469 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 06:12:12 -0500 Subject: [PATCH 0731/1058] update --- infra/renovate/templates/secrets.yaml | 2 +- infra/renovate/values.yaml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index 382e370..0ff2cad 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -16,7 +16,7 @@ spec: target: name: renovate-config-secret data: - - secretKey: renovate-config-secret + - secretKey: renovate.json remoteRef: key: kv/renovate property: config diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 7de924a..b774e26 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -181,9 +181,9 @@ renovate: name: renovate-config-secret extraVolumeMounts: - - name: renovate-config - mountPath: /config - subPath: renovate.json + - mountPath: "/config" + name: renovate.json + readOnly: true # -- Additional containers to the pod extraContainers: [] From acfd02d2a2482a7838b98b6a75afea88068b4130 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 06:13:01 -0500 Subject: [PATCH 0732/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index b774e26..a7a7977 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -182,7 +182,7 @@ renovate: extraVolumeMounts: - mountPath: "/config" - name: renovate.json + name: renovate-config readOnly: true # -- Additional containers to the pod From c407e7789d63052626d03f6768ec30b7f82c4f99 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 06:15:44 -0500 Subject: [PATCH 0733/1058] update --- infra/renovate/values.yaml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index a7a7977..248d4aa 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -61,12 +61,10 @@ renovate: # -- Custom arguments to run in the container argsOverride: [] # -- Prepend shell commands before renovate runs - preCommand: '' - # preCommand: | - # echo hello - # echo world + #preCommand: '' + preCommand: | + cat /config/renovate.json - # -- Append shell commands after renovate runs postCommand: '' # postCommand: | # echo hello From 8487172ee8038e2dcefbaaf61089dc57f87bcb85 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 1 May 2025 06:16:15 -0500 Subject: [PATCH 0734/1058] update --- infra/renovate/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 248d4aa..7654ad9 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -63,6 +63,7 @@ renovate: # -- Prepend shell commands before renovate runs #preCommand: '' preCommand: | + ls /config cat /config/renovate.json postCommand: '' From 7845a8fbd12a98b35fcc873effec7d1541481199 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 2 May 2025 05:00:48 -0500 Subject: [PATCH 0735/1058] update --- infra/renovate/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 7654ad9..b166131 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -180,9 +180,9 @@ renovate: name: renovate-config-secret extraVolumeMounts: - - mountPath: "/config" - name: renovate-config - readOnly: true + - name: renovate-config + mountPath: /config/renovate.json + subPath: renovate.json # -- Additional containers to the pod extraContainers: [] From 44fc423272edefbe754b7c35e791cf6188429143 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 2 May 2025 05:01:28 -0500 Subject: [PATCH 0736/1058] update --- infra/renovate/values.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index b166131..c46a99a 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -182,7 +182,6 @@ renovate: extraVolumeMounts: - name: renovate-config mountPath: /config/renovate.json - subPath: renovate.json # -- Additional containers to the pod extraContainers: [] From a271f17ad84077058ea189d5acc6baaebef255d9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 2 May 2025 05:02:43 -0500 Subject: [PATCH 0737/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index c46a99a..355deaf 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -181,7 +181,7 @@ renovate: extraVolumeMounts: - name: renovate-config - mountPath: /config/renovate.json + mountPath: /config # -- Additional containers to the pod extraContainers: [] From 0e547f03cecaee035bec6b00aa48720f99c8198e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 2 May 2025 05:03:52 -0500 Subject: [PATCH 0738/1058] update --- infra/renovate/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 355deaf..f172a09 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -182,6 +182,7 @@ renovate: extraVolumeMounts: - name: renovate-config mountPath: /config + subPath: renovate.json # -- Additional containers to the pod extraContainers: [] From 9d0a1721981bba21e51b57df9d5c5bed29bf013a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 6 May 2025 05:11:58 -0500 Subject: [PATCH 0739/1058] update --- dmz/internalproxy/templates/invidious.yaml | 74 ++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 dmz/internalproxy/templates/invidious.yaml diff --git a/dmz/internalproxy/templates/invidious.yaml b/dmz/internalproxy/templates/invidious.yaml new file mode 100644 index 0000000..cd85414 --- /dev/null +++ b/dmz/internalproxy/templates/invidious.yaml @@ -0,0 +1,74 @@ +apiVersion: v1 +kind: Service +metadata: + name: invidious +spec: + ports: + - name: app + port: 3000 + protocol: TCP + targetPort: 3000 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: invidious +subsets: +- addresses: + - ip: 192.168.20.104 + ports: + - name: app + port: 3000 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: invidious-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`invidious.durp.info`) && PathPrefix(`/`) + middlewares: + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: invidious + port: 3000 + tls: + secretName: invidious-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: invidious-tls +spec: + secretName: invidious-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "invidious.durp.info" + dnsNames: + - "invidious.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: invidious-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: invidious.durp.info +spec: + type: ExternalName + externalName: durp.info From b33158e0fe58e5316208b6580417bd91d2cb97a8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 6 May 2025 05:33:30 -0500 Subject: [PATCH 0740/1058] update --- dmz/internalproxy/templates/redlib.yaml | 148 ++++++++++++------------ dmz/redlib/Chart.yaml | 7 ++ dmz/redlib/templates/deployment.yaml | 33 ++++++ dmz/redlib/templates/ingress.yaml | 42 +++++++ dmz/redlib/templates/service.yaml | 12 ++ dmz/redlib/values.yaml | 0 infra/argocd/templates/redlib.yaml | 22 ++++ 7 files changed, 190 insertions(+), 74 deletions(-) create mode 100644 dmz/redlib/Chart.yaml create mode 100644 dmz/redlib/templates/deployment.yaml create mode 100644 dmz/redlib/templates/ingress.yaml create mode 100644 dmz/redlib/templates/service.yaml create mode 100644 dmz/redlib/values.yaml create mode 100644 infra/argocd/templates/redlib.yaml diff --git a/dmz/internalproxy/templates/redlib.yaml b/dmz/internalproxy/templates/redlib.yaml index eee1201..43b54fb 100644 --- a/dmz/internalproxy/templates/redlib.yaml +++ b/dmz/internalproxy/templates/redlib.yaml @@ -1,74 +1,74 @@ -apiVersion: v1 -kind: Service -metadata: - name: redlib -spec: - ports: - - name: app - port: 8082 - protocol: TCP - targetPort: 8082 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: redlib -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8082 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: redlib-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`redlib.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: redlib - port: 8082 - tls: - secretName: redlib-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: redlib-tls -spec: - secretName: redlib-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "redlib.durp.info" - dnsNames: - - "redlib.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: redlib-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: redlib.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: redlib +#spec: +# ports: +# - name: app +# port: 8082 +# protocol: TCP +# targetPort: 8082 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: redlib +#subsets: +#- addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 8082 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: redlib-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`redlib.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# kind: Rule +# services: +# - name: redlib +# port: 8082 +# tls: +# secretName: redlib-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: redlib-tls +#spec: +# secretName: redlib-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "redlib.durp.info" +# dnsNames: +# - "redlib.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: redlib-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: redlib.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/dmz/redlib/Chart.yaml b/dmz/redlib/Chart.yaml new file mode 100644 index 0000000..ef0a939 --- /dev/null +++ b/dmz/redlib/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: redlib +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml new file mode 100644 index 0000000..0e20610 --- /dev/null +++ b/dmz/redlib/templates/deployment.yaml @@ -0,0 +1,33 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: redlib + name: redlib + labels: + app: redlib +spec: + selector: + matchLabels: + app: redlib + replicas: 3 + template: + metadata: + labels: + app: redlib + spec: + containers: + - name: redlib + image: registry.durp.info/redlib/redlib:latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: / + port: 8080 + readinessProbe: + httpGet: + path: / + port: 8080 + env: + ports: + - name: http + containerPort: 8080 diff --git a/dmz/redlib/templates/ingress.yaml b/dmz/redlib/templates/ingress.yaml new file mode 100644 index 0000000..6b4cbb6 --- /dev/null +++ b/dmz/redlib/templates/ingress.yaml @@ -0,0 +1,42 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: redlib-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`links.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: redlib + port: 8080 + tls: + secretName: redlib-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: redlib-tls +spec: + secretName: redlib-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "redlib.durp.info" + dnsNames: + - "redlib.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: redlib-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: redlib.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/redlib/templates/service.yaml b/dmz/redlib/templates/service.yaml new file mode 100644 index 0000000..36c50c5 --- /dev/null +++ b/dmz/redlib/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: redlib +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP + selector: + app: redlib diff --git a/dmz/redlib/values.yaml b/dmz/redlib/values.yaml new file mode 100644 index 0000000..e69de29 diff --git a/infra/argocd/templates/redlib.yaml b/infra/argocd/templates/redlib.yaml new file mode 100644 index 0000000..901c316 --- /dev/null +++ b/infra/argocd/templates/redlib.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: redlib + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/redlib + directory: + recurse: true + destination: + name: dmz + namespace: redlib + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 59734e07a50d48c07b00da8ec8d8239c1271b210 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 6 May 2025 05:35:48 -0500 Subject: [PATCH 0741/1058] update --- dmz/redlib/templates/ingress.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/dmz/redlib/templates/ingress.yaml b/dmz/redlib/templates/ingress.yaml index 6b4cbb6..d9ea6ae 100644 --- a/dmz/redlib/templates/ingress.yaml +++ b/dmz/redlib/templates/ingress.yaml @@ -6,8 +6,11 @@ spec: entryPoints: - websecure routes: - - match: Host(`links.durp.info`) && PathPrefix(`/`) + - match: Host(`redlib.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik services: - name: redlib port: 8080 From 60053fb88a3412dee2311a9c31695db8edc35a44 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 6 May 2025 09:34:31 -0500 Subject: [PATCH 0742/1058] add openspeedtest --- dmz/internalproxy/templates/speedtest.yaml | 148 ++++++++++---------- dmz/openspeedtest/Chart.yaml | 7 + dmz/openspeedtest/templates/deployment.yaml | 33 +++++ dmz/openspeedtest/templates/ingress.yaml | 45 ++++++ dmz/openspeedtest/templates/service.yaml | 12 ++ infra/argocd/templates/openspeedtest.yaml | 22 +++ 6 files changed, 193 insertions(+), 74 deletions(-) create mode 100644 dmz/openspeedtest/Chart.yaml create mode 100644 dmz/openspeedtest/templates/deployment.yaml create mode 100644 dmz/openspeedtest/templates/ingress.yaml create mode 100644 dmz/openspeedtest/templates/service.yaml create mode 100644 infra/argocd/templates/openspeedtest.yaml diff --git a/dmz/internalproxy/templates/speedtest.yaml b/dmz/internalproxy/templates/speedtest.yaml index 1eea45b..c75d3a6 100644 --- a/dmz/internalproxy/templates/speedtest.yaml +++ b/dmz/internalproxy/templates/speedtest.yaml @@ -1,74 +1,74 @@ -apiVersion: v1 -kind: Service -metadata: - name: speedtest -spec: - ports: - - name: app - port: 6580 - protocol: TCP - targetPort: 6580 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: speedtest -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 6580 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: speedtest-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: speedtest - port: 6580 - tls: - secretName: speedtest-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: speedtest-tls -spec: - secretName: speedtest-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "speedtest.durp.info" - dnsNames: - - "speedtest.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: speedtest-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: speedtest +#spec: +# ports: +# - name: app +# port: 6580 +# protocol: TCP +# targetPort: 6580 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: speedtest +#subsets: +#- addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 6580 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: speedtest-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) +# kind: Rule +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# services: +# - name: speedtest +# port: 6580 +# tls: +# secretName: speedtest-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: speedtest-tls +#spec: +# secretName: speedtest-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "speedtest.durp.info" +# dnsNames: +# - "speedtest.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: speedtest-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/dmz/openspeedtest/Chart.yaml b/dmz/openspeedtest/Chart.yaml new file mode 100644 index 0000000..c8f712e --- /dev/null +++ b/dmz/openspeedtest/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: openspeedtest +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" diff --git a/dmz/openspeedtest/templates/deployment.yaml b/dmz/openspeedtest/templates/deployment.yaml new file mode 100644 index 0000000..062de32 --- /dev/null +++ b/dmz/openspeedtest/templates/deployment.yaml @@ -0,0 +1,33 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: openspeedtest + name: openspeedtest + labels: + app: openspeedtest +spec: + selector: + matchLabels: + app: openspeedtest + replicas: 1 + template: + metadata: + labels: + app: openspeedtest + spec: + containers: + - name: openspeedtest + image: registry.durp.info/openspeedtest/latest + imagePullPolicy: Always + livenessProbe: + httpGet: + path: / + port: 3000 + readinessProbe: + httpGet: + path: / + port: 3000 + env: + ports: + - name: http + containerPort: 3000 diff --git a/dmz/openspeedtest/templates/ingress.yaml b/dmz/openspeedtest/templates/ingress.yaml new file mode 100644 index 0000000..1f2a682 --- /dev/null +++ b/dmz/openspeedtest/templates/ingress.yaml @@ -0,0 +1,45 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: openspeedtest-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: openspeedtest + port: 3000 + tls: + secretName: openspeedtest-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: openspeedtest-tls +spec: + secretName: openspeedtest-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "speedtest.durp.info" + dnsNames: + - "speedtest.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: openspeedtest-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/openspeedtest/templates/service.yaml b/dmz/openspeedtest/templates/service.yaml new file mode 100644 index 0000000..c31f9b5 --- /dev/null +++ b/dmz/openspeedtest/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: openspeedtest +spec: + ports: + - name: http + port: 3000 + targetPort: 3000 + protocol: TCP + selector: + app: openspeedtest diff --git a/infra/argocd/templates/openspeedtest.yaml b/infra/argocd/templates/openspeedtest.yaml new file mode 100644 index 0000000..5d79f9c --- /dev/null +++ b/infra/argocd/templates/openspeedtest.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openspeedtest + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/openspeedtest + directory: + recurse: true + destination: + name: dmz + namespace: openspeedtest + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 7fdc34321f7ba02a795308b32da405aa8960f989 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 7 May 2025 05:07:30 -0500 Subject: [PATCH 0743/1058] update --- dmz/openspeedtest/templates/ingress.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/openspeedtest/templates/ingress.yaml b/dmz/openspeedtest/templates/ingress.yaml index 1f2a682..313f2fe 100644 --- a/dmz/openspeedtest/templates/ingress.yaml +++ b/dmz/openspeedtest/templates/ingress.yaml @@ -8,6 +8,7 @@ spec: routes: - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) kind: Rule + tls: true middlewares: - name: authentik-proxy-provider namespace: traefik From 49cba480ba0282663c95ac71b8e4475cb0dbe73b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 7 May 2025 05:11:19 -0500 Subject: [PATCH 0744/1058] update --- dmz/openspeedtest/templates/ingress.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/dmz/openspeedtest/templates/ingress.yaml b/dmz/openspeedtest/templates/ingress.yaml index 313f2fe..ebf2b8d 100644 --- a/dmz/openspeedtest/templates/ingress.yaml +++ b/dmz/openspeedtest/templates/ingress.yaml @@ -8,10 +8,10 @@ spec: routes: - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) kind: Rule - tls: true middlewares: - name: authentik-proxy-provider namespace: traefik + - name: limit-buffering services: - name: openspeedtest port: 3000 @@ -44,3 +44,13 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: limit-buffering +spec: + buffering: + maxRequestBodyBytes: 10000000000 From a66bd5f10a9454ebab1eeb49459c8f6c4742b2e4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 7 May 2025 05:11:50 -0500 Subject: [PATCH 0745/1058] update --- dmz/openspeedtest/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/openspeedtest/templates/ingress.yaml b/dmz/openspeedtest/templates/ingress.yaml index ebf2b8d..063a751 100644 --- a/dmz/openspeedtest/templates/ingress.yaml +++ b/dmz/openspeedtest/templates/ingress.yaml @@ -47,7 +47,7 @@ spec: --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: name: limit-buffering From 1463788a5e58298ed86646a31376ecb194fdb25b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 7 May 2025 15:06:27 -0500 Subject: [PATCH 0746/1058] update --- ansible/newcluster.yaml | 2 +- dmz/longhorn/Chart.yaml | 12 ++ dmz/longhorn/templates/ingress.yaml | 32 +++++ dmz/longhorn/templates/secrets.yaml | 30 ++++ dmz/longhorn/values.yaml | 192 ++++++++++++++++++++++++++ infra/longhorn/templates/ingress.yaml | 2 +- 6 files changed, 268 insertions(+), 2 deletions(-) create mode 100644 dmz/longhorn/Chart.yaml create mode 100644 dmz/longhorn/templates/ingress.yaml create mode 100644 dmz/longhorn/templates/secrets.yaml create mode 100644 dmz/longhorn/values.yaml diff --git a/ansible/newcluster.yaml b/ansible/newcluster.yaml index 724d6d4..4fb3572 100644 --- a/ansible/newcluster.yaml +++ b/ansible/newcluster.yaml @@ -1,2 +1,2 @@ argocd login --insecure -argocd cluster add --name +argocd cluster add default --name prd --yes --kubeconfig ~/Documents/config-prd diff --git a/dmz/longhorn/Chart.yaml b/dmz/longhorn/Chart.yaml new file mode 100644 index 0000000..85720ac --- /dev/null +++ b/dmz/longhorn/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: longhorn-system +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: +- name: longhorn + repository: https://charts.longhorn.io + version: 1.7.2 diff --git a/dmz/longhorn/templates/ingress.yaml b/dmz/longhorn/templates/ingress.yaml new file mode 100644 index 0000000..dbf05e3 --- /dev/null +++ b/dmz/longhorn/templates/ingress.yaml @@ -0,0 +1,32 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: longhorn-ingress + annotations: + cert-manager.io/cluster-issuer: vault-issuer +spec: + entryPoints: + - websecure + routes: + - match: Host(`longhorn.dmz.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: longhorn-frontend + port: 80 + tls: + secretName: longhorn-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-tls +spec: + secretName: longhorn-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "longhorn.dmz.durp.info" + dnsNames: + - "longhorn.dmz.durp.info" diff --git a/dmz/longhorn/templates/secrets.yaml b/dmz/longhorn/templates/secrets.yaml new file mode 100644 index 0000000..5acb5c1 --- /dev/null +++ b/dmz/longhorn/templates/secrets.yaml @@ -0,0 +1,30 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- + +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: external-longhorn-backup-token-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: longhorn-backup-token-secret + data: + - secretKey: AWS_ACCESS_KEY_ID + remoteRef: + key: kv/longhorn/backup + property: AWS_ACCESS_KEY_ID + - secretKey: AWS_ENDPOINTS + remoteRef: + key: kv/longhorn/backup + property: AWS_ENDPOINTS + - secretKey: AWS_SECRET_ACCESS_KEY + remoteRef: + key: kv/longhorn/backup + property: AWS_SECRET_ACCESS_KEY diff --git a/dmz/longhorn/values.yaml b/dmz/longhorn/values.yaml new file mode 100644 index 0000000..e34a1ee --- /dev/null +++ b/dmz/longhorn/values.yaml @@ -0,0 +1,192 @@ +longhorn: + global: + cattle: + systemDefaultRegistry: "" + + image: + longhorn: + engine: + repository: longhornio/longhorn-engine + manager: + repository: longhornio/longhorn-manager + ui: + repository: longhornio/longhorn-ui + instanceManager: + repository: longhornio/longhorn-instance-manager + shareManager: + repository: longhornio/longhorn-share-manager + backingImageManager: + repository: longhornio/backing-image-manager + csi: + attacher: + repository: longhornio/csi-attacher + provisioner: + repository: longhornio/csi-provisioner + nodeDriverRegistrar: + repository: longhornio/csi-node-driver-registrar + resizer: + repository: longhornio/csi-resizer + snapshotter: + repository: longhornio/csi-snapshotter + pullPolicy: Always + + service: + ui: + type: ClusterIP + nodePort: null + manager: + type: ClusterIP + nodePort: "" + loadBalancerIP: "" + loadBalancerSourceRanges: "" + + persistence: + defaultClass: true + defaultFsType: ext4 + defaultClassReplicaCount: 3 + defaultDataLocality: disabled # best-effort otherwise + reclaimPolicy: Delete + migratable: false + recurringJobSelector: + enable: true + jobList: '[ + { + "name":"backup", + "task":"backup", + "cron":"0 0 * * *", + "retain":24 + } + ]' + backingImage: + enable: false + name: ~ + dataSourceType: ~ + dataSourceParameters: ~ + expectedChecksum: ~ + + csi: + kubeletRootDir: ~ + attacherReplicaCount: ~ + provisionerReplicaCount: ~ + resizerReplicaCount: ~ + snapshotterReplicaCount: ~ + + defaultSettings: + backupTarget: S3://longhorn-master@us-east-1/ + backupTargetCredentialSecret: longhorn-backup-token-secret + allowRecurringJobWhileVolumeDetached: ~ + createDefaultDiskLabeledNodes: ~ + defaultDataPath: ~ + defaultDataLocality: ~ + replicaSoftAntiAffinity: ~ + replicaAutoBalance: ~ + storageOverProvisioningPercentage: ~ + storageMinimalAvailablePercentage: ~ + upgradeChecker: ~ + defaultReplicaCount: ~ + defaultLonghornStaticStorageClass: longhorn + backupstorePollInterval: ~ + taintToleration: ~ + systemManagedComponentsNodeSelector: ~ + priorityClass: ~ + autoSalvage: ~ + autoDeletePodWhenVolumeDetachedUnexpectedly: ~ + disableSchedulingOnCordonedNode: ~ + replicaZoneSoftAntiAffinity: ~ + nodeDownPodDeletionPolicy: ~ + allowNodeDrainWithLastHealthyReplica: ~ + mkfsExt4Parameters: ~ + disableReplicaRebuild: ~ + replicaReplenishmentWaitInterval: ~ + concurrentReplicaRebuildPerNodeLimit: ~ + disableRevisionCounter: ~ + systemManagedPodsImagePullPolicy: ~ + allowVolumeCreationWithDegradedAvailability: ~ + autoCleanupSystemGeneratedSnapshot: ~ + concurrentAutomaticEngineUpgradePerNodeLimit: ~ + backingImageCleanupWaitInterval: ~ + backingImageRecoveryWaitInterval: ~ + guaranteedEngineManagerCPU: ~ + guaranteedReplicaManagerCPU: ~ + kubernetesClusterAutoscalerEnabled: ~ + orphanAutoDeletion: ~ + storageNetwork: ~ + privateRegistry: + createSecret: ~ + registryUrl: ~ + registryUser: ~ + registryPasswd: ~ + registrySecret: ~ + + longhornManager: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornDriver: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + longhornUI: + priorityClass: ~ + tolerations: [] + ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above + ## and uncomment this example block + # - key: "key" + # operator: "Equal" + # value: "value" + # effect: "NoSchedule" + nodeSelector: {} + ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above + ## and uncomment this example block + # label-key1: "label-value1" + # label-key2: "label-value2" + + resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + # + + ingress: + enabled: false + + ## Specify override namespace, specifically this is useful for using longhorn as sub-chart + ## and its release namespace is not the `longhorn-system` + namespaceOverride: "" + + # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional. + annotations: {} + + serviceAccount: + # Annotations to add to the service account + annotations: {} + diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index 6e3a4c1..93db852 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -3,7 +3,7 @@ kind: IngressRoute metadata: name: longhorn-ingress annotations: - cert-manager.io/cluster-issuer: letsencrypt-production + cert-manager.io/cluster-issuer: vault-issuer spec: entryPoints: - websecure From 1baa082434503ec48625ca50125f6aa5560a6995 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 7 May 2025 17:41:55 -0500 Subject: [PATCH 0747/1058] update --- infra/argocd/templates/longhorn.yaml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index 9690120..9c933b2 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -19,3 +19,26 @@ spec: syncOptions: - CreateNamespace=true +--- + +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: longhorn-system-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/longhorn + destination: + namespace: longhorn-system + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + From a43c27d78a1893449613ea2897b85b1ddd0ea2ce Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 7 May 2025 17:42:53 -0500 Subject: [PATCH 0748/1058] update --- infra/argocd/values.yaml | 35 +++++++++++++++++------------------ 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 442b8c5..e8d4628 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -1,27 +1,26 @@ argo-cd: - global: revisionHistoryLimit: 1 image: repository: registry.durp.info/argoproj/argocd imagePullPolicy: Always - server: - #extraArgs: - # - --dex-server-plaintext - # - --dex-server=argocd-dex-server:5556 - # oidc.config: | - # name: AzureAD - # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 - # clientID: CLIENT_ID - # clientSecret: $oidc.azuread.clientSecret - # requestedIDTokenClaims: - # groups: - # essential: true - # requestedScopes: - # - openid - # - profile - # - email + #server: + #extraArgs: + # - --dex-server-plaintext + # - --dex-server=argocd-dex-server:5556 + # oidc.config: | + # name: AzureAD + # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 + # clientID: CLIENT_ID + # clientSecret: $oidc.azuread.clientSecret + # requestedIDTokenClaims: + # groups: + # essential: true + # requestedScopes: + # - openid + # - profile + # - email dex: enabled: true @@ -58,5 +57,5 @@ argo-cd: scopes: "[groups]" server: - route: + route: enabled: false From 03beda78e05b1df0147bcd47f76891fee09f7042 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 7 May 2025 17:45:12 -0500 Subject: [PATCH 0749/1058] update --- infra/argocd/templates/longhorn.yaml | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index 9c933b2..4d9c9f0 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -15,12 +15,11 @@ spec: syncPolicy: automated: prune: true - selfHeal: true + selfHeal: true syncOptions: - - CreateNamespace=true + - CreateNamespace=true --- - apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -34,11 +33,10 @@ spec: path: dmz/longhorn destination: namespace: longhorn-system - name: in-cluster + name: dmz syncPolicy: automated: prune: true - selfHeal: true + selfHeal: true syncOptions: - - CreateNamespace=true - + - CreateNamespace=true From 18366175e9219731b40983b4d45aa1dab444ebcb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 04:44:58 -0500 Subject: [PATCH 0750/1058] update --- dmz/longhorn/templates/ingress.yaml | 14 ++++++++------ infra/longhorn/templates/ingress.yaml | 14 ++++++++------ 2 files changed, 16 insertions(+), 12 deletions(-) diff --git a/dmz/longhorn/templates/ingress.yaml b/dmz/longhorn/templates/ingress.yaml index dbf05e3..7067a2d 100644 --- a/dmz/longhorn/templates/ingress.yaml +++ b/dmz/longhorn/templates/ingress.yaml @@ -8,16 +8,18 @@ spec: entryPoints: - websecure routes: - - match: Host(`longhorn.dmz.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: longhorn-frontend - port: 80 + - match: Host(`longhorn.dmz.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: longhorn-frontend + port: 80 tls: secretName: longhorn-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index 93db852..e9a3a2b 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -8,16 +8,18 @@ spec: entryPoints: - websecure routes: - - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: longhorn-frontend - port: 80 + - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: longhorn-frontend + port: 80 tls: secretName: longhorn-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: From 705f13289c484c58c405134073ff6cfc1f3d85c4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 04:47:51 -0500 Subject: [PATCH 0751/1058] update --- infra/traefik/templates/middleware.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/infra/traefik/templates/middleware.yaml b/infra/traefik/templates/middleware.yaml index cb729ab..e888129 100644 --- a/infra/traefik/templates/middleware.yaml +++ b/infra/traefik/templates/middleware.yaml @@ -1,5 +1,27 @@ apiVersion: traefik.io/v1alpha1 kind: Middleware +metadata: + name: authentik-proxy-provider + namespace: traefik +spec: + forwardAuth: + address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware metadata: name: whitelist namespace: traefik From bf7f3692b85795f3f18be4eda6301199fe426281 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 05:23:25 -0500 Subject: [PATCH 0752/1058] update --- infra/authentik/Chart.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/infra/authentik/Chart.yaml b/infra/authentik/Chart.yaml index c87b677..930d302 100644 --- a/infra/authentik/Chart.yaml +++ b/infra/authentik/Chart.yaml @@ -7,6 +7,7 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: -- name: authentik - repository: https://charts.goauthentik.io - version: 2024.8.3 \ No newline at end of file + - name: authentik + repository: https://charts.goauthentik.io + version: 2025.4.0 + From 765a79aaadabde8259864ae1ff2fdd4cb09227cd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 05:25:23 -0500 Subject: [PATCH 0753/1058] update --- infra/authentik/values.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index 579302f..1cf4c0a 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -1,6 +1,8 @@ authentik: global: - env: + security: + allowInsecureImages: true + env: - name: AUTHENTIK_POSTGRESQL__PASSWORD valueFrom: secretKeyRef: @@ -19,7 +21,7 @@ authentik: outposts: container_image_base: registry.durp.info/goauthentik/%(type)s:%(version)s postgresql: - host: '{{ .Release.Name }}-postgresql-hl' + host: "{{ .Release.Name }}-postgresql-hl" name: "authentik" user: "authentik" port: 5432 @@ -36,7 +38,7 @@ authentik: pullPolicy: Always postgresqlUsername: "authentik" postgresqlDatabase: "authentik" - existingSecret: db-pass + existingSecret: db-pass persistence: enabled: true storageClass: longhorn @@ -47,7 +49,7 @@ authentik: enabled: true master: persistence: - enabled: false + enabled: false image: registry: registry.durp.info repository: bitnami/redis From c1594778b7912890c0367acb9ab1721a70b26bb3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 05:29:34 -0500 Subject: [PATCH 0754/1058] update --- dmz/authentik/Chart.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/authentik/Chart.yaml b/dmz/authentik/Chart.yaml index 62c0fa1..5ee87b6 100644 --- a/dmz/authentik/Chart.yaml +++ b/dmz/authentik/Chart.yaml @@ -7,6 +7,6 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: -- name: authentik-remote-cluster - repository: https://charts.goauthentik.io - version: 2.0.0 + - name: authentik-remote-cluster + repository: https://charts.goauthentik.io + version: 2025.4.0 From d73325c1bc6b2acc6313ad6ffa0e72fdcaa0d181 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 05:31:21 -0500 Subject: [PATCH 0755/1058] update --- dmz/authentik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/authentik/Chart.yaml b/dmz/authentik/Chart.yaml index 5ee87b6..090214c 100644 --- a/dmz/authentik/Chart.yaml +++ b/dmz/authentik/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: authentik-remote-cluster repository: https://charts.goauthentik.io - version: 2025.4.0 + version: 2.1.0 From 2a823e753662b78cbd61cfccca0da09a91fa4952 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 05:39:26 -0500 Subject: [PATCH 0756/1058] update --- infra/renovate/values.yaml | 61 +++++++++++++++++++------------------- 1 file changed, 31 insertions(+), 30 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index f172a09..3c64df8 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -5,20 +5,20 @@ renovate: compatibility: openshift: # -- Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: `auto` (apply if the detected running cluster is Openshift), `force` (perform the adaptation always), `disabled` (do not perform adaptation) - adaptSecurityContext: 'auto' + adaptSecurityContext: "auto" # -- Override the name of the chart - nameOverride: '' + nameOverride: "" # -- Override the fully qualified app name - fullnameOverride: '' + fullnameOverride: "" # -- Annotations to add to secret secretAnnotations: {} cronjob: # -- Schedules the job to run using cron notation - schedule: '0 1 * * *' # At 01:00 every day + schedule: "0 1 * * *" # At 01:00 every day # -- You can specify a time zone for a CronJob by setting timeZone to the name of a valid time zone. (starting with k8s 1.27) - timeZone: '' # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names + timeZone: "" # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names # -- If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. suspend: false # -- Annotations to set on the cronjob @@ -26,36 +26,36 @@ renovate: # -- Labels to set on the cronjob labels: {} # -- "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run - concurrencyPolicy: '' + concurrencyPolicy: "" # -- "Number of successful completions is reached to mark the job as complete" - completions: '' + completions: "" # -- "Where the jobs should be NonIndexed or Indexed" - completionMode: '' + completionMode: "" # -- Amount of failed jobs to keep in history - failedJobsHistoryLimit: '' + failedJobsHistoryLimit: "" # -- Amount of completed jobs to keep in history - successfulJobsHistoryLimit: '' + successfulJobsHistoryLimit: "" # -- Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails jobRestartPolicy: Never # -- Time to keep the job after it finished before automatically deleting it - ttlSecondsAfterFinished: '' + ttlSecondsAfterFinished: "" # -- Deadline for the job to finish - activeDeadlineSeconds: '' + activeDeadlineSeconds: "" # -- Number of times to retry running the pod before considering the job as being failed - jobBackoffLimit: '' + jobBackoffLimit: "" # -- Maximal number of failures per index - backoffLimitPerIndex: '' + backoffLimitPerIndex: "" # -- Maximal number of failed indexes before terminating the Job execution - maxFailedIndexes: '' + maxFailedIndexes: "" # -- Deadline to start the job, skips execution if job misses it's configured deadline - startingDeadlineSeconds: '' + startingDeadlineSeconds: "" # -- Additional initContainers that can be executed before renovate initContainers: [] # initContainers: # - name: INIT_CONTAINER_NAME # image: INIT_CONTAINER_IMAGE # -- Number of pods to run in parallel - parallelism: '' + parallelism: "" # -- Custom command to run in the container commandOverride: [] # -- Custom arguments to run in the container @@ -66,7 +66,7 @@ renovate: ls /config cat /config/renovate.json - postCommand: '' + postCommand: "" # postCommand: | # echo hello # echo world @@ -94,9 +94,9 @@ renovate: renovate: # -- Custom exiting global renovate config - existingConfigFile: '/config/renovate.json' + existingConfigFile: "/config/renovate.json" # -- Inline global renovate config.json - config: '' + config: "" # See https://docs.renovatebot.com/self-hosted-configuration # config: | # { @@ -144,20 +144,20 @@ renovate: # Provide .ssh config file contents # -- Contents of the id_rsa file - id_rsa: '' + id_rsa: "" # -- Contents of the id_rsa_pub file - id_rsa_pub: '' + id_rsa_pub: "" # -- Contents of the config file - config: '' + config: "" # or provide the name of an existing secret to be read instead. # -- Name of the existing secret containing a valid .ssh configuration - existingSecret: '' + existingSecret: "" # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set secrets: {} # -- k8s secret to reference environment variables from. Overrides secrets if set - existingSecret: '' + existingSecret: "" # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config extraConfigmaps: [] @@ -174,7 +174,7 @@ renovate: # "key"="value" # "key1"="value1" - extraVolumes: + extraVolumes: - name: renovate-config secretName: name: renovate-config-secret @@ -208,10 +208,11 @@ renovate: annotations: {} # -- The name of the service account to use # If not set and create is true, a name is generated using the fullname template - name: '' + name: "" # -- Specify resource limits and requests for the renovate container - resources: {} + resources: + {} # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little # resources, such as Minikube. If you do want to specify resources, uncomment the following @@ -252,7 +253,7 @@ renovate: enabled: false # -- Override the prefix of the redisHost - nameOverride: '' + nameOverride: "" # -- Disable replication by default architecture: standalone @@ -262,7 +263,7 @@ renovate: enabled: false # -- Override Kubernetes version for redis chart - kubeVersion: '' + kubeVersion: "" # -- Override hostname resolution hostAliases: [] From f40139702d62949aaa62c6792f1830535bbd14e9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:03:07 -0500 Subject: [PATCH 0757/1058] update --- infra/renovate/values.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 3c64df8..92da1f4 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -174,15 +174,15 @@ renovate: # "key"="value" # "key1"="value1" - extraVolumes: - - name: renovate-config - secretName: - name: renovate-config-secret + #extraVolumes: + # - name: renovate-config + # secretName: + # name: renovate-config-secret - extraVolumeMounts: - - name: renovate-config - mountPath: /config - subPath: renovate.json + #extraVolumeMounts: + # - name: renovate-config + # mountPath: /config + # subPath: renovate.json # -- Additional containers to the pod extraContainers: [] From b293f708e99687c1f8008bf9bba38b5db8b6f92c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:04:02 -0500 Subject: [PATCH 0758/1058] update --- infra/renovate/values.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 92da1f4..3c64df8 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -174,15 +174,15 @@ renovate: # "key"="value" # "key1"="value1" - #extraVolumes: - # - name: renovate-config - # secretName: - # name: renovate-config-secret + extraVolumes: + - name: renovate-config + secretName: + name: renovate-config-secret - #extraVolumeMounts: - # - name: renovate-config - # mountPath: /config - # subPath: renovate.json + extraVolumeMounts: + - name: renovate-config + mountPath: /config + subPath: renovate.json # -- Additional containers to the pod extraContainers: [] From 84832c7455f0d0e1cb26d62899f7c3835c65a6b2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:06:18 -0500 Subject: [PATCH 0759/1058] update --- infra/renovate/values.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 3c64df8..6b2e298 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -178,6 +178,9 @@ renovate: - name: renovate-config secretName: name: renovate-config-secret + items: + - key: renovate.json + path: renovate.json extraVolumeMounts: - name: renovate-config From 9876b3659e78486c16a04fe2ba0800046b8c686a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:09:10 -0500 Subject: [PATCH 0760/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 6b2e298..2335749 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -184,7 +184,7 @@ renovate: extraVolumeMounts: - name: renovate-config - mountPath: /config + mountPath: /config/renovate.json subPath: renovate.json # -- Additional containers to the pod From 92c666bf9d9dd5f78005f3fa423b0c26e4ac5f43 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:10:36 -0500 Subject: [PATCH 0761/1058] update --- infra/renovate/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 2335749..c4256b3 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -64,7 +64,9 @@ renovate: #preCommand: '' preCommand: | ls /config + ls /config/renovate.json cat /config/renovate.json + cat /config/renovate.json/renovate.json postCommand: "" # postCommand: | From 4a6bac7674a032f181089b4dad4602d41d56e724 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:16:10 -0500 Subject: [PATCH 0762/1058] update --- infra/external-secrets/values.yaml | 12 ++++++------ infra/renovate/values.yaml | 8 +++----- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index c5068a8..4fb02fc 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -1,5 +1,5 @@ external-secrets: - replicaCount: 3 + replicaCount: 1 revisionHistoryLimit: 1 leaderElect: true @@ -16,18 +16,18 @@ external-secrets: repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always - extraVolumes: + extraVolumes: - name: ca-pemstore configMap: name: ca-pemstore - extraVolumeMounts: + extraVolumeMounts: - name: ca-pemstore mountPath: /etc/ssl/certs/vault.pem subPath: vault.pem readOnly: true - resources: + resources: requests: memory: 32Mi cpu: 10m @@ -42,7 +42,7 @@ external-secrets: repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always - resources: + resources: requests: memory: 32Mi cpu: 10m @@ -61,7 +61,7 @@ external-secrets: pullPolicy: Always tag: "" - resources: + resources: requests: memory: 32Mi cpu: 10m diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index c4256b3..7c40d36 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -64,9 +64,7 @@ renovate: #preCommand: '' preCommand: | ls /config - ls /config/renovate.json cat /config/renovate.json - cat /config/renovate.json/renovate.json postCommand: "" # postCommand: | @@ -177,7 +175,7 @@ renovate: # "key1"="value1" extraVolumes: - - name: renovate-config + - name: renovate-config-secret secretName: name: renovate-config-secret items: @@ -185,8 +183,8 @@ renovate: path: renovate.json extraVolumeMounts: - - name: renovate-config - mountPath: /config/renovate.json + - name: renovate-config-secret + mountPath: /config subPath: renovate.json # -- Additional containers to the pod From 098186307b36235d2d51e34347ba603255a4bd4d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:24:33 -0500 Subject: [PATCH 0763/1058] update --- infra/renovate/templates/secrets.yaml | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index 0ff2cad..f458d29 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -4,7 +4,6 @@ metadata: name: vault --- - apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: @@ -20,3 +19,23 @@ spec: remoteRef: key: kv/renovate property: config + - secretKey: RENOVATE_AUTODISCOVER + remoteRef: + key: kv/renovate + property: RENOVATE_AUTODISCOVER + - secretKey: RENOVATE_ENDPOINT + remoteRef: + key: kv/renovate + property: RENOVATE_ENDPOINT + - secretKey: RENOVATE_GIT_AUTHOR + remoteRef: + key: kv/renovate + property: RENOVATE_GIT_AUTHOR + - secretKey: RENOVATE_PLATFORM + remoteRef: + key: kv/renovate + property: RENOVATE_PLATFORM + - secretKey: RENOVATE_TOKEN + remoteRef: + key: kv/renovate + property: RENOVATE_TOKEN From 7916ed82471b5dbe2f5077793218978e9e4c151c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:25:00 -0500 Subject: [PATCH 0764/1058] update --- infra/renovate/values.yaml | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 7c40d36..6ecd157 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -157,7 +157,7 @@ renovate: # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set secrets: {} # -- k8s secret to reference environment variables from. Overrides secrets if set - existingSecret: "" + existingSecret: "renovate-config-secret" # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config extraConfigmaps: [] @@ -174,18 +174,18 @@ renovate: # "key"="value" # "key1"="value1" - extraVolumes: - - name: renovate-config-secret - secretName: - name: renovate-config-secret - items: - - key: renovate.json - path: renovate.json + #extraVolumes: + # - name: renovate-config-secret + # secretName: + # name: renovate-config-secret + # items: + # - key: renovate.json + # path: renovate.json - extraVolumeMounts: - - name: renovate-config-secret - mountPath: /config - subPath: renovate.json + #extraVolumeMounts: + # - name: renovate-config-secret + # mountPath: /config + # subPath: renovate.json # -- Additional containers to the pod extraContainers: [] From 0e6aad89dcf2c7b2fc3b442b6c564f49cbcab604 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:25:48 -0500 Subject: [PATCH 0765/1058] update --- infra/renovate/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 6ecd157..10f4246 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -62,9 +62,9 @@ renovate: argsOverride: [] # -- Prepend shell commands before renovate runs #preCommand: '' - preCommand: | - ls /config - cat /config/renovate.json + #preCommand: | + # ls /config + # cat /config/renovate.json postCommand: "" # postCommand: | @@ -94,7 +94,7 @@ renovate: renovate: # -- Custom exiting global renovate config - existingConfigFile: "/config/renovate.json" + #existingConfigFile: "/config/renovate.json" # -- Inline global renovate config.json config: "" # See https://docs.renovatebot.com/self-hosted-configuration From b9d0ef311ba887a0dce6f2cdfdf50cf64bd32195 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:27:02 -0500 Subject: [PATCH 0766/1058] update --- infra/renovate/values.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 10f4246..765bf75 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -96,7 +96,15 @@ renovate: # -- Custom exiting global renovate config #existingConfigFile: "/config/renovate.json" # -- Inline global renovate config.json - config: "" + config: | + { + "platform": "gitlab", + "endpoint": "https://gitlab.com/api/v4", + "autodiscover": "false", + "dryRun": false, + "printConfig": false, + "repositories": ["durfy/DurpCLI"] + } # See https://docs.renovatebot.com/self-hosted-configuration # config: | # { From 4312733b5578450d179d631a192a23c9627931cc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 06:32:43 -0500 Subject: [PATCH 0767/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 765bf75..c4d6131 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -103,7 +103,7 @@ renovate: "autodiscover": "false", "dryRun": false, "printConfig": false, - "repositories": ["durfy/DurpCLI"] + "repositories": ["durfy/DurpCLI","developerdurp/homelab"] } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From 3ae74042c3addbf5f0791803d01a30914eabfc7e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 8 May 2025 11:35:13 +0000 Subject: [PATCH 0768/1058] Configure Renovate --- renovate.json | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..7190a60 --- /dev/null +++ b/renovate.json @@ -0,0 +1,3 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json" +} From 5c84b0bd26bd4bd235184e393fce4805df650925 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 8 May 2025 11:36:32 +0000 Subject: [PATCH 0769/1058] Update Helm release metallb to v0.14.9 --- master/metallb-system/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/metallb-system/Chart.yaml b/master/metallb-system/Chart.yaml index 0f6506f..0f8b8bd 100644 --- a/master/metallb-system/Chart.yaml +++ b/master/metallb-system/Chart.yaml @@ -9,5 +9,5 @@ appVersion: "1.16.0" dependencies: - name: metallb repository: https://metallb.github.io/metallb - version: 0.14.8 + version: 0.14.9 From 6a26e350d3ae43b22b02d3d983dd6dce4e12563d Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 8 May 2025 11:36:35 +0000 Subject: [PATCH 0770/1058] Update Terraform proxmox to v3.0.1-rc8 --- dev/terraform/main.tf | 2 +- dmz/terraform/main.tf | 2 +- infra/terraform/main.tf | 2 +- prd/terraform/main.tf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf index 6f7862b..4b0bca0 100644 --- a/dev/terraform/main.tf +++ b/dev/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc6" + version = "3.0.1-rc8" } } } diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf index 55a74b7..6cb7ee4 100644 --- a/dmz/terraform/main.tf +++ b/dmz/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc6" + version = "3.0.1-rc8" } } } diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index 2fa173b..b4717ce 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc6" + version = "3.0.1-rc8" } } } diff --git a/prd/terraform/main.tf b/prd/terraform/main.tf index 6aad3d7..25e1baa 100644 --- a/prd/terraform/main.tf +++ b/prd/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc6" + version = "3.0.1-rc8" } } } From 10168e7534e9956c7a4cc4a4a2c4a98744c762c4 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 06:01:39 +0000 Subject: [PATCH 0771/1058] Update docker.io/aquasec/trivy Docker tag to v0.62.1 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 4abc89d..640da85 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -542,7 +542,7 @@ openclarity: # -- Trivy Server container repository repository: aquasec/trivy # -- Trivy Server container tag - tag: 0.58.2 + tag: 0.62.1 # -- Trivy Server image digest. If set will override the tag. digest: "" # -- Trivy Server image pull policy From 821c206174b8b0e678baa4372a3b42d46c2dab8d Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 06:01:42 +0000 Subject: [PATCH 0772/1058] Update docker.io/nginxinc/nginx-unprivileged Docker tag to v1.28.0 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 4abc89d..71c7845 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -317,7 +317,7 @@ openclarity: # -- Gateway service container repository repository: nginxinc/nginx-unprivileged # -- Gateway service container tag - tag: 1.27.3 + tag: 1.28.0 # -- Gateway image digest. If set will override the tag. digest: "" # -- Gateway service container pull policy From 08122046551b398d6f696b2670b4ffe1c98458d5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:11:47 -0500 Subject: [PATCH 0773/1058] update --- infra/renovate/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index c4d6131..c1acbbc 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -100,10 +100,10 @@ renovate: { "platform": "gitlab", "endpoint": "https://gitlab.com/api/v4", - "autodiscover": "false", + "autodiscover": "true", "dryRun": false, "printConfig": false, - "repositories": ["durfy/DurpCLI","developerdurp/homelab"] + "autodiscoverFilter": ["developerdurp/*", "durfy/*"] } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From 16e851448091d6a86b032d6497f89eca9dcfbb31 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:17:42 -0500 Subject: [PATCH 0774/1058] update --- infra/renovate/values.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index c1acbbc..8b4a32f 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -103,7 +103,7 @@ renovate: "autodiscover": "true", "dryRun": false, "printConfig": false, - "autodiscoverFilter": ["developerdurp/*", "durfy/*"] + "autodiscoverNamespaces": ["developerdurp", "durfy"] } # See https://docs.renovatebot.com/self-hosted-configuration # config: | @@ -244,7 +244,8 @@ renovate: # name: env-configmap # -- Environment variables to set on the renovate container - env: {} + env: + RENOVATE_AUTODISCOVER: true # env: # VARIABLE_NAME: "value" From c6b300f57265dbbd3b667a270145112196ce7fc8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:19:13 -0500 Subject: [PATCH 0775/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 8b4a32f..aae1266 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -103,7 +103,7 @@ renovate: "autodiscover": "true", "dryRun": false, "printConfig": false, - "autodiscoverNamespaces": ["developerdurp", "durfy"] + "autodiscoverFilter": ["developerdurp/*", "durfy/*"] } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From 2d00ceda68f347afa1d8e54446ec4a3c4836f8fc Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 10:23:00 +0000 Subject: [PATCH 0776/1058] Update docker.io/swaggerapi/swagger-ui Docker tag to v5.21.0 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 4abc89d..7b71580 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -719,7 +719,7 @@ openclarity: # -- Swagger UI container repository repository: swaggerapi/swagger-ui # -- Swagger UI container tag - tag: v5.18.2 + tag: v5.21.0 # -- Swagger UI image digest. If set will override the tag. digest: "" # -- Swagger UI image pull policy From 9a587d2f757f44d1aaff54723ca85dbb7cb433d3 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 10:23:03 +0000 Subject: [PATCH 0777/1058] Update Helm release authentik-remote-cluster to v2.1.0 --- master/authentik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/authentik/Chart.yaml b/master/authentik/Chart.yaml index 62c0fa1..e357c64 100644 --- a/master/authentik/Chart.yaml +++ b/master/authentik/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: authentik-remote-cluster repository: https://charts.goauthentik.io - version: 2.0.0 + version: 2.1.0 From d6162f7046a56587500577a70c4af23834280dfe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:26:25 -0500 Subject: [PATCH 0778/1058] update --- infra/renovate/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index aae1266..4298bb9 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -103,7 +103,8 @@ renovate: "autodiscover": "true", "dryRun": false, "printConfig": false, - "autodiscoverFilter": ["developerdurp/*", "durfy/*"] + "autodiscoverFilter": ["developerdurp/*", "durfy/*"], + "assignees": "developerdurp" } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From ab868d0c2683aace2c36ab30dca4a6bf0b9d9930 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 10:30:38 +0000 Subject: [PATCH 0779/1058] Update Helm release base to v1.26.0 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index 8a8d342..1794b71 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.1 + version: 1.26.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.25.1 diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index f56ad65..846d267 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.1 + version: 1.26.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.25.1 From d35c0757fbafd76dfdde85916e38a93df813ce87 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 10:30:41 +0000 Subject: [PATCH 0780/1058] Update Helm release cert-manager to v1.17.2 --- dev/cert-manager/Chart.yaml | 2 +- dmz/cert-manager/Chart.yaml | 2 +- infra/cert-manager/Chart.yaml | 2 +- master/cert-manager/Chart.yaml | 2 +- prd/cert-manager/Chart.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dev/cert-manager/Chart.yaml b/dev/cert-manager/Chart.yaml index ecf60fa..7280af8 100644 --- a/dev/cert-manager/Chart.yaml +++ b/dev/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.16.3 + version: v1.17.2 diff --git a/dmz/cert-manager/Chart.yaml b/dmz/cert-manager/Chart.yaml index ecf60fa..7280af8 100644 --- a/dmz/cert-manager/Chart.yaml +++ b/dmz/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.16.3 + version: v1.17.2 diff --git a/infra/cert-manager/Chart.yaml b/infra/cert-manager/Chart.yaml index ecf60fa..7280af8 100644 --- a/infra/cert-manager/Chart.yaml +++ b/infra/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.16.3 + version: v1.17.2 diff --git a/master/cert-manager/Chart.yaml b/master/cert-manager/Chart.yaml index e14d98b..7280af8 100644 --- a/master/cert-manager/Chart.yaml +++ b/master/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.15.3 + version: v1.17.2 diff --git a/prd/cert-manager/Chart.yaml b/prd/cert-manager/Chart.yaml index ecf60fa..7280af8 100644 --- a/prd/cert-manager/Chart.yaml +++ b/prd/cert-manager/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: cert-manager repository: https://charts.jetstack.io - version: v1.16.3 + version: v1.17.2 From 16077f452320efb0dda5a6ccd3af6f487dbb5be8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:32:49 -0500 Subject: [PATCH 0781/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 4298bb9..f982da3 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -104,7 +104,7 @@ renovate: "dryRun": false, "printConfig": false, "autodiscoverFilter": ["developerdurp/*", "durfy/*"], - "assignees": "developerdurp" + "assignees": ["developerdurp"], } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From 22d82b00823d0fb766fb8dba44e10b50b006102a Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 10:36:26 +0000 Subject: [PATCH 0782/1058] Update Helm release crossplane to v1.19.1 --- master/crossplane/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/crossplane/Chart.yaml b/master/crossplane/Chart.yaml index b0a80b7..eac3031 100644 --- a/master/crossplane/Chart.yaml +++ b/master/crossplane/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: crossplane repository: https://charts.crossplane.io/stable - version: 1.17.1 + version: 1.19.1 From ad8f5884e7a9c8a7103b8db9be1ba950a7cfe8ee Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 9 May 2025 10:36:29 +0000 Subject: [PATCH 0783/1058] Update Helm release external-dns to v8.8.2 --- dev/external-dns/Chart.yaml | 2 +- dmz/external-dns/Chart.yaml | 2 +- master/external-dns/Chart.yaml | 2 +- prd/external-dns/Chart.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dev/external-dns/Chart.yaml b/dev/external-dns/Chart.yaml index 8fb36bc..c188f01 100644 --- a/dev/external-dns/Chart.yaml +++ b/dev/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.3.8 + version: 8.8.2 diff --git a/dmz/external-dns/Chart.yaml b/dmz/external-dns/Chart.yaml index 8fb36bc..c188f01 100644 --- a/dmz/external-dns/Chart.yaml +++ b/dmz/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.3.8 + version: 8.8.2 diff --git a/master/external-dns/Chart.yaml b/master/external-dns/Chart.yaml index 8fb36bc..c188f01 100644 --- a/master/external-dns/Chart.yaml +++ b/master/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.3.8 + version: 8.8.2 diff --git a/prd/external-dns/Chart.yaml b/prd/external-dns/Chart.yaml index 8fb36bc..c188f01 100644 --- a/prd/external-dns/Chart.yaml +++ b/prd/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.3.8 + version: 8.8.2 From bcc421445c6cbc1b6fbd968949e197d7017d3225 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:42:34 -0500 Subject: [PATCH 0784/1058] update --- dmz/external-secrets/values.yaml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 304180d..89a6a58 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -1,5 +1,5 @@ external-secrets: - replicaCount: 3 + replicaCount: 1 revisionHistoryLimit: 1 leaderElect: true @@ -16,18 +16,18 @@ external-secrets: repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always - extraVolumes: + extraVolumes: - name: ca-pemstore configMap: name: ca-pemstore - extraVolumeMounts: + extraVolumeMounts: - name: ca-pemstore mountPath: /etc/ssl/certs/vault.pem subPath: vault.pem readOnly: true - resources: + resources: requests: memory: 32Mi cpu: 10m @@ -44,18 +44,18 @@ external-secrets: repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always - extraVolumes: + extraVolumes: - name: ca-pemstore configMap: name: ca-pemstore - extraVolumeMounts: + extraVolumeMounts: - name: ca-pemstore mountPath: /etc/ssl/certs/vault.pem subPath: vault.pem readOnly: true - resources: + resources: requests: memory: 32Mi cpu: 10m @@ -74,7 +74,7 @@ external-secrets: pullPolicy: Always tag: "" - resources: + resources: requests: memory: 32Mi cpu: 10m @@ -82,12 +82,12 @@ external-secrets: memory: 32Mi cpu: 10m - extraVolumes: + extraVolumes: - name: ca-pemstore configMap: name: ca-pemstore - extraVolumeMounts: + extraVolumeMounts: - name: ca-pemstore mountPath: /etc/ssl/certs/vault.pem subPath: vault.pem From f99dbcc53340ab9f02533fcb0b27dffc6338cf73 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:49:19 -0500 Subject: [PATCH 0785/1058] update --- infra/argocd/templates/crossplane.yaml | 20 ++++++++++ infra/crossplane/Chart.yaml | 12 ++++++ infra/crossplane/templates/gitlab.yml | 52 ++++++++++++++++++++++++++ 3 files changed, 84 insertions(+) create mode 100644 infra/argocd/templates/crossplane.yaml create mode 100644 infra/crossplane/Chart.yaml create mode 100644 infra/crossplane/templates/gitlab.yml diff --git a/infra/argocd/templates/crossplane.yaml b/infra/argocd/templates/crossplane.yaml new file mode 100644 index 0000000..11a311a --- /dev/null +++ b/infra/argocd/templates/crossplane.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crossplane + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/crossplane + destination: + namespace: crossplane + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/crossplane/Chart.yaml b/infra/crossplane/Chart.yaml new file mode 100644 index 0000000..8e724e3 --- /dev/null +++ b/infra/crossplane/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: crossplane +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: crossplane + repository: https://charts.crossplane.io/stable + version: 1.19.1 diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml new file mode 100644 index 0000000..d0c486e --- /dev/null +++ b/infra/crossplane/templates/gitlab.yml @@ -0,0 +1,52 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-gitlab +spec: + package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: gitlab-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: gitlab-secret + data: + - secretKey: RENOVATE_TOKEN + remoteRef: + key: kv/renovate + property: accesstoken + +--- +apiVersion: gitlab.crossplane.io/v1beta1 +kind: ProviderConfig +metadata: + name: gitlab-provider +spec: + baseURL: https://gitlab.com/ + credentials: + source: Secret + secretRef: + namespace: crossplane + name: gitlab-secret + key: accesstoken +#--- +# +#apiVersion: projects.gitlab.crossplane.io/v1alpha1 +#kind: Project +#metadata: +# name: example-project +#spec: +# deletionPolicy: Orphan +# forProvider: +# name: "Example Project" +# description: "example project description" +# providerConfigRef: +# name: gitlab-provider +# policy: +# resolution: Optional +# resolve: Always From d6f69b58570ce03b34df72c03542465e329058b2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:54:58 -0500 Subject: [PATCH 0786/1058] update --- infra/crossplane/templates/gitlab.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml index d0c486e..b7e48d2 100644 --- a/infra/crossplane/templates/gitlab.yml +++ b/infra/crossplane/templates/gitlab.yml @@ -3,7 +3,7 @@ kind: Provider metadata: name: provider-gitlab spec: - package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 + package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.10.4 --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret From c8dd861c5d4d384c43e053d338b2b861568a8bc5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:56:15 -0500 Subject: [PATCH 0787/1058] update --- infra/crossplane/templates/gitlab.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml index b7e48d2..d62470e 100644 --- a/infra/crossplane/templates/gitlab.yml +++ b/infra/crossplane/templates/gitlab.yml @@ -5,6 +5,12 @@ metadata: spec: package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.10.4 --- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: From b43d205af33045739e0f6484c7316d667d041284 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:57:43 -0500 Subject: [PATCH 0788/1058] update --- infra/crossplane/templates/gitlab.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml index d62470e..b1e188d 100644 --- a/infra/crossplane/templates/gitlab.yml +++ b/infra/crossplane/templates/gitlab.yml @@ -22,10 +22,10 @@ spec: target: name: gitlab-secret data: - - secretKey: RENOVATE_TOKEN + - secretKey: accesstoken remoteRef: key: kv/renovate - property: accesstoken + property: RENOVATE_TOKEN --- apiVersion: gitlab.crossplane.io/v1beta1 From abab7c70db9a0dac797205324269b69e008b7dd6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:59:09 -0500 Subject: [PATCH 0789/1058] update test project --- infra/crossplane/templates/gitlab.yml | 31 +++++++++++++-------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml index b1e188d..0c31df9 100644 --- a/infra/crossplane/templates/gitlab.yml +++ b/infra/crossplane/templates/gitlab.yml @@ -40,19 +40,18 @@ spec: namespace: crossplane name: gitlab-secret key: accesstoken -#--- -# -#apiVersion: projects.gitlab.crossplane.io/v1alpha1 -#kind: Project -#metadata: -# name: example-project -#spec: -# deletionPolicy: Orphan -# forProvider: -# name: "Example Project" -# description: "example project description" -# providerConfigRef: -# name: gitlab-provider -# policy: -# resolution: Optional -# resolve: Always +--- +apiVersion: projects.gitlab.crossplane.io/v1alpha1 +kind: Project +metadata: + name: example-project +spec: + deletionPolicy: Orphan + forProvider: + name: "Example Project" + description: "example project description" + providerConfigRef: + name: gitlab-provider + policy: + resolution: Optional + resolve: Always From 0690679d91d80ee86964fc4cbf58919d433cf3b8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 05:59:57 -0500 Subject: [PATCH 0790/1058] update --- infra/crossplane/templates/gitlab.yml | 30 +++++++++++++-------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml index 0c31df9..fb72271 100644 --- a/infra/crossplane/templates/gitlab.yml +++ b/infra/crossplane/templates/gitlab.yml @@ -40,18 +40,18 @@ spec: namespace: crossplane name: gitlab-secret key: accesstoken ---- -apiVersion: projects.gitlab.crossplane.io/v1alpha1 -kind: Project -metadata: - name: example-project -spec: - deletionPolicy: Orphan - forProvider: - name: "Example Project" - description: "example project description" - providerConfigRef: - name: gitlab-provider - policy: - resolution: Optional - resolve: Always +#--- +#apiVersion: projects.gitlab.crossplane.io/v1alpha1 +#kind: Project +#metadata: +# name: example-project +#spec: +# deletionPolicy: Orphan +# forProvider: +# name: "Example Project" +# description: "example project description" +# providerConfigRef: +# name: gitlab-provider +# policy: +# resolution: Optional +# resolve: Always From 721d9be3775c741d768df900a5d10f8ff7addebb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 9 May 2025 06:45:08 -0500 Subject: [PATCH 0791/1058] update --- dmz/traefik/templates/traefik-dashboard.yaml | 64 +++++++++----------- 1 file changed, 30 insertions(+), 34 deletions(-) diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 0c6afaa..189d983 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -1,34 +1,30 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: traefik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`traefik.durp.info`) -# kind: Rule -# services: -# - name: api@internal -# kind: TraefikService -# tls: -# secretName: traefik-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: traefik-tls -# namespace: traefik -#spec: -# secretName: traefik-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "traefik.durp.info" -# dnsNames: -# - "traefik.durp.info" -# -#--- -# +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: traefik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`traefik.dmz.durp.info`) + kind: Rule + services: + - name: api@internal + kind: TraefikService + tls: + secretName: traefik-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: traefik-tls + namespace: traefik +spec: + secretName: traefik-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "traefik.dmz.durp.info" + dnsNames: + - "traefik.dmz.durp.info" From f9fca17edb25e8db7bc9bdcf03daadff1dfbaf7e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 06:40:49 -0500 Subject: [PATCH 0792/1058] update --- dmz/internalproxy/templates/registry.yaml | 56 +++++++++++------------ 1 file changed, 26 insertions(+), 30 deletions(-) diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml index 25f6261..e7ae183 100644 --- a/dmz/internalproxy/templates/registry.yaml +++ b/dmz/internalproxy/templates/registry.yaml @@ -4,29 +4,27 @@ metadata: name: registry spec: ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 + - name: app + port: 5000 + protocol: TCP + targetPort: 5000 clusterIP: None type: ClusterIP --- - apiVersion: v1 kind: Endpoints metadata: name: registry subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 5000 - protocol: TCP - ---- + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 5000 + protocol: TCP +--- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -35,16 +33,15 @@ spec: entryPoints: - websecure routes: - - match: Host(`registry.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry - port: 5000 + - match: Host(`registry.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: registry + port: 5000 tls: secretName: registry-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -56,16 +53,15 @@ spec: kind: ClusterIssuer commonName: "registry.durp.info" dnsNames: - - "registry.durp.info" + - "registry.durp.info" --- - -kind: Service -apiVersion: v1 -metadata: - name: registry-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: registry.durp.info -spec: - type: ExternalName - externalName: durp.info +#kind: Service +#apiVersion: v1 +#metadata: +# name: registry-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: registry.durp.info +#spec: +# type: ExternalName +# externalName: durp.info From bf3b2023083b69da4adad7c4642dbc880f39a234 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 07:15:05 -0500 Subject: [PATCH 0793/1058] update --- dmz/crowdsec/Chart.yaml | 11 +++++++++++ dmz/crowdsec/templates/secrets.yaml | 29 ++++++++++++++++++++++++++++ dmz/crowdsec/values.yaml | 24 +++++++++++++++++++++++ infra/argocd/templates/crowdsec.yaml | 20 +++++++++++++++++++ 4 files changed, 84 insertions(+) create mode 100644 dmz/crowdsec/Chart.yaml create mode 100644 dmz/crowdsec/templates/secrets.yaml create mode 100644 dmz/crowdsec/values.yaml create mode 100644 infra/argocd/templates/crowdsec.yaml diff --git a/dmz/crowdsec/Chart.yaml b/dmz/crowdsec/Chart.yaml new file mode 100644 index 0000000..84cbb77 --- /dev/null +++ b/dmz/crowdsec/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +name: crowdsec +description: A Helm chart for Kubernetes +type: application +version: 0.0.1 +appVersion: 0.0.1 + +dependencies: + - name: crowdsec + repository: https://crowdsecurity.github.io/helm-charts + version: 0.19.2 diff --git a/dmz/crowdsec/templates/secrets.yaml b/dmz/crowdsec/templates/secrets.yaml new file mode 100644 index 0000000..7eff904 --- /dev/null +++ b/dmz/crowdsec/templates/secrets.yaml @@ -0,0 +1,29 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: enroll-key +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: enroll-key + data: + - secretKey: ENROLL_INSTANCE_NAME + remoteRef: + key: kv/crowdsec/dmz-enroll + property: ENROLL_INSTANCE_NAME + - secretKey: ENROLL_KEY + remoteRef: + key: kv/crowdsec/dmz-enroll + property: ENROLL_KEY + - secretKey: ENROLL_TAGS + remoteRef: + key: kv/crowdsec/dmz-enroll + property: ENROLL_TAGS + +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault diff --git a/dmz/crowdsec/values.yaml b/dmz/crowdsec/values.yaml new file mode 100644 index 0000000..059a2c3 --- /dev/null +++ b/dmz/crowdsec/values.yaml @@ -0,0 +1,24 @@ +crowdsec: + # + image: + repository: registry.durp.info/crowdsecurity/crowdsec + pullPolicy: always + + # for raw logs format: json or cri (docker|containerd) + container_runtime: containerd + agent: + # Specify each pod whose logs you want to process + acquisition: + # The namespace where the pod is located + - namespace: traefik + # The pod name + podName: traefik-* + # as in crowdsec configuration, we need to specify the program name to find a matching parser + program: traefik + env: + - name: COLLECTIONS + value: "crowdsecurity/traefik" + lapi: + envFrom: + - secretRef: + name: enroll-key diff --git a/infra/argocd/templates/crowdsec.yaml b/infra/argocd/templates/crowdsec.yaml new file mode 100644 index 0000000..1a2c2b5 --- /dev/null +++ b/infra/argocd/templates/crowdsec.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: crowdsec + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/crowdsec + destination: + namespace: crowdsec + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 13435c5f47b023fc2fb09d873776b4e46cd3ba8c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 07:16:20 -0500 Subject: [PATCH 0794/1058] update --- dmz/crowdsec/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/crowdsec/values.yaml b/dmz/crowdsec/values.yaml index 059a2c3..6271eb0 100644 --- a/dmz/crowdsec/values.yaml +++ b/dmz/crowdsec/values.yaml @@ -2,7 +2,7 @@ crowdsec: # image: repository: registry.durp.info/crowdsecurity/crowdsec - pullPolicy: always + pullPolicy: Always # for raw logs format: json or cri (docker|containerd) container_runtime: containerd From 6ed5b70eaf9a1b44a97b68e81beffa716016b760 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 07:26:40 -0500 Subject: [PATCH 0795/1058] update --- dmz/traefik/templates/traefik-dashboard.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dmz/traefik/templates/traefik-dashboard.yaml b/dmz/traefik/templates/traefik-dashboard.yaml index 189d983..539c911 100644 --- a/dmz/traefik/templates/traefik-dashboard.yaml +++ b/dmz/traefik/templates/traefik-dashboard.yaml @@ -8,6 +8,11 @@ spec: routes: - match: Host(`traefik.dmz.durp.info`) kind: Rule + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik services: - name: api@internal kind: TraefikService From 137fbd48229104f7c74a781f6a03bf26860e7c8b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 07:26:57 -0500 Subject: [PATCH 0796/1058] update --- dmz/internalproxy/templates/registry.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml index e7ae183..ac3c25a 100644 --- a/dmz/internalproxy/templates/registry.yaml +++ b/dmz/internalproxy/templates/registry.yaml @@ -35,6 +35,9 @@ spec: routes: - match: Host(`registry.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - name: whitelist + namespace: traefik services: - name: registry port: 5000 From d781ccc052881b2052abb1042e7fcd308c2597e3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 07:49:17 -0500 Subject: [PATCH 0797/1058] update --- dmz/external-secrets/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 89a6a58..b65b73f 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -1,7 +1,7 @@ external-secrets: replicaCount: 1 revisionHistoryLimit: 1 - leaderElect: true + leaderElect: false installCRDs: true crds: From de5dc93ecf5395e1d2ecf41cb16c55046e2f22fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 07:49:31 -0500 Subject: [PATCH 0798/1058] update --- infra/external-secrets/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 4fb02fc..3af1bd4 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -1,7 +1,7 @@ external-secrets: replicaCount: 1 revisionHistoryLimit: 1 - leaderElect: true + leaderElect: false installCRDs: true crds: From 04da18d4ee2ab4ff722a13053bfbb934af937f4e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 07:51:37 -0500 Subject: [PATCH 0799/1058] update --- dmz/external-secrets/values.yaml | 2 ++ infra/external-secrets/values.yaml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index b65b73f..ffdf526 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -1,4 +1,6 @@ external-secrets: + log: + level: debug replicaCount: 1 revisionHistoryLimit: 1 leaderElect: false diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 3af1bd4..e78ce66 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -1,4 +1,6 @@ external-secrets: + log: + level: debug replicaCount: 1 revisionHistoryLimit: 1 leaderElect: false From 9514ffc44a004dea33eca2d20a7ef4d5beb8ed6b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 08:55:17 -0500 Subject: [PATCH 0800/1058] update --- dmz/traefik/templates/middleware.yaml | 24 +++++++++++++++++++++--- dmz/traefik/templates/secrets.yaml | 21 +++++++++++++++++++++ 2 files changed, 42 insertions(+), 3 deletions(-) create mode 100644 dmz/traefik/templates/secrets.yaml diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 7e95660..e8dc601 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -1,8 +1,8 @@ apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: - name: authentik-proxy-provider - namespace: traefik + name: authentik-proxy-provider + namespace: traefik spec: forwardAuth: address: http://ak-outpost-dmz-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri @@ -21,7 +21,6 @@ spec: - X-authentik-meta-version --- - apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: @@ -33,3 +32,22 @@ spec: - 192.168.0.0/16 - 172.16.0.0/12 - 10.0.0.0/8 + +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: bouncer + namespace: traefik +spec: + plugin: + bouncer: + enabled: true + crowdsecMode: stream + crowdsecLapiScheme: https + crowdsecLapiHost: crowdsec-service.crowdsec:8080 + crowdsecLapiKey: + valueFrom: + secretKeyRef: + name: crowdsec-lapi-key + key: lapi-key diff --git a/dmz/traefik/templates/secrets.yaml b/dmz/traefik/templates/secrets.yaml new file mode 100644 index 0000000..4d72356 --- /dev/null +++ b/dmz/traefik/templates/secrets.yaml @@ -0,0 +1,21 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: crowdsec-lapi-key +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: crowdsec-lapi-key + data: + - secretKey: lapi-key + remoteRef: + key: kv/crowdsec/api + property: key + +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault From 9f8dc8f8edaaa3b256960bda4ef6d6adea3b3fa5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 08:59:55 -0500 Subject: [PATCH 0801/1058] update --- dmz/external-secrets/Chart.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/external-secrets/Chart.yaml b/dmz/external-secrets/Chart.yaml index ff5a3e2..8e9a627 100644 --- a/dmz/external-secrets/Chart.yaml +++ b/dmz/external-secrets/Chart.yaml @@ -6,6 +6,6 @@ version: 0.0.1 appVersion: 0.0.1 dependencies: -- name: external-secrets - repository: https://charts.external-secrets.io - version: 0.15.0 + - name: external-secrets + repository: https://charts.external-secrets.io + version: 0.16.2 From 3a5a9838b2f7ebce1dd17e1bc0cf6e2884d16915 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:05:32 -0500 Subject: [PATCH 0802/1058] update --- dmz/internalproxy/templates/octopus.yaml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/octopus.yaml b/dmz/internalproxy/templates/octopus.yaml index 4e86f71..b6cf028 100644 --- a/dmz/internalproxy/templates/octopus.yaml +++ b/dmz/internalproxy/templates/octopus.yaml @@ -8,6 +8,9 @@ spec: routes: - match: Host(`octopus.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - name: bouncer + namespace: traefik services: - name: infra-cluster port: 443 @@ -15,7 +18,6 @@ spec: secretName: octopus-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -30,7 +32,6 @@ spec: - "octopus.durp.info" --- - kind: Service apiVersion: v1 metadata: From c5d12501ef3fa1834a7f79d88fcf4a8e5ecfe1b5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:09:22 -0500 Subject: [PATCH 0803/1058] update --- dmz/traefik/values.yaml | 39 ++++++++++++++++++++------------------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index f0d0404..aa0efe0 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -1,10 +1,10 @@ traefik: - image: + image: # registry: registry.durp.info # repository: traefik pullPolicy: Always - - providers: + + providers: kubernetesCRD: allowCrossNamespace: true allowExternalNameServices: true @@ -18,40 +18,41 @@ traefik: # - name: traefik-configmap # mountPath: "/config" # type: configMap - + ingressRoute: dashboard: enabled: true - - additionalArguments: + + additionalArguments: # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" - "--log.level=DEBUG" - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin - --experimental.plugins.jwt.version=v0.7.0 - + - --experimental.plugins.bouncer.moduleName=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin + - --experimental.plugins.bouncer.version=v1.4.2 + autoscaling: enabled: true minReplicas: 3 maxReplicas: 10 metrics: - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 80 + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 80 behavior: scaleDown: stabilizationWindowSeconds: 300 policies: - - type: Pods - value: 1 - periodSeconds: 60 - - + - type: Pods + value: 1 + periodSeconds: 60 + # -- [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container. - resources: + resources: requests: cpu: "100m" memory: "512Mi" From 71340d6b3faf3a7ccdcde1ce56a4601cceb4eead Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:15:08 -0500 Subject: [PATCH 0804/1058] update --- dmz/authentik/templates/cert.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 dmz/authentik/templates/cert.yaml diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml new file mode 100644 index 0000000..e039c6b --- /dev/null +++ b/dmz/authentik/templates/cert.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-outpost-tls +spec: + issuerRef: + name: vault-issuer + kind: ClusterIssuer + secretName: authentik-outpost-tls + commonName: "*" + dnsNames: + - "*" From 36e8dde91db35b8a4180753e6b06ab42e4ba575f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:17:46 -0500 Subject: [PATCH 0805/1058] update --- dmz/traefik/templates/middleware.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index e8dc601..2ea4da8 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -45,6 +45,7 @@ spec: enabled: true crowdsecMode: stream crowdsecLapiScheme: https + crowdsecLapiTLSInsecureVerify: true crowdsecLapiHost: crowdsec-service.crowdsec:8080 crowdsecLapiKey: valueFrom: From f81893afee400876f00f5bb206ae67745ec37df9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:41:50 -0500 Subject: [PATCH 0806/1058] update --- dmz/authentik/templates/cert.yaml | 20 ++++++++++++++++++-- infra/authentik/templates/ingress.yaml | 14 ++++++-------- 2 files changed, 24 insertions(+), 10 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index e039c6b..da2c8f6 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -1,3 +1,19 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: auth-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`auth.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: ak-outpost-dmz-embedded-outpost + port: 9000 + tls: + secretName: authentik-outpost-tls + --- apiVersion: cert-manager.io/v1 kind: Certificate @@ -8,6 +24,6 @@ spec: name: vault-issuer kind: ClusterIssuer secretName: authentik-outpost-tls - commonName: "*" + commonName: "auth.durp.info" dnsNames: - - "*" + - "auth.durp.info" diff --git a/infra/authentik/templates/ingress.yaml b/infra/authentik/templates/ingress.yaml index f946fb3..55c35a2 100644 --- a/infra/authentik/templates/ingress.yaml +++ b/infra/authentik/templates/ingress.yaml @@ -6,16 +6,15 @@ spec: entryPoints: - websecure routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: authentik-server - port: 80 + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: authentik-server + port: 80 tls: secretName: authentik-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -27,5 +26,4 @@ spec: kind: ClusterIssuer commonName: "authentik.durp.info" dnsNames: - - "authentik.durp.info" - + - "authentik.durp.info" From 235806871fd3a80060cba87ebfea7c397dc66e30 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:42:14 -0500 Subject: [PATCH 0807/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 2ea4da8..0452df8 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-dmz-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: https://auth.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From 596420a0539c2a137fe1b62227aa8ad53690964a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:43:43 -0500 Subject: [PATCH 0808/1058] update --- dmz/authentik/templates/cert.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index da2c8f6..8be6e02 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -27,3 +27,14 @@ spec: commonName: "auth.durp.info" dnsNames: - "auth.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: auth-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: auth.durp.info +spec: + type: ExternalName + externalName: durp.info From f4e0a209545db2b52193a10a3a3e08c8021dc562 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 09:46:48 -0500 Subject: [PATCH 0809/1058] update --- dmz/authentik/templates/cert.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index 8be6e02..565aa0d 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -21,7 +21,7 @@ metadata: name: authentik-outpost-tls spec: issuerRef: - name: vault-issuer + name: letsencrypt-production kind: ClusterIssuer secretName: authentik-outpost-tls commonName: "auth.durp.info" From 5d8f11b8ead6b56a938107bdb661b1e734556483 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:12:33 -0500 Subject: [PATCH 0810/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 0452df8..2316dd4 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://auth.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From 16745c9f2b429585140dfc3c2db4e114dd1cf211 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:15:05 -0500 Subject: [PATCH 0811/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 2316dd4..b4dfa89 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: https://authentik.durp.info/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From e74142b072befde5e596ec53239bcf6017d30392 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:19:14 -0500 Subject: [PATCH 0812/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index b4dfa89..2316dd4 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://authentik.durp.info/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri + address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From 19a1c7ebd3d4dbe9fbd25309cefa79d183e66959 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:28:13 -0500 Subject: [PATCH 0813/1058] update --- dmz/authentik/templates/cert.yaml | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index 565aa0d..f920c99 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -24,17 +24,7 @@ spec: name: letsencrypt-production kind: ClusterIssuer secretName: authentik-outpost-tls - commonName: "auth.durp.info" + commonName: "authentik.durp.info" dnsNames: - - "auth.durp.info" - ---- -kind: Service -apiVersion: v1 -metadata: - name: auth-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: auth.durp.info -spec: - type: ExternalName - externalName: durp.info + - "authentik.durp.info" + - "authentik.durp.info" From 263ed8d805bdbb2bf25dbd779b86113b172704da Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:37:55 -0500 Subject: [PATCH 0814/1058] update --- dmz/redlib/templates/ingress.yaml | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/dmz/redlib/templates/ingress.yaml b/dmz/redlib/templates/ingress.yaml index d9ea6ae..236f492 100644 --- a/dmz/redlib/templates/ingress.yaml +++ b/dmz/redlib/templates/ingress.yaml @@ -6,19 +6,18 @@ spec: entryPoints: - websecure routes: - - match: Host(`redlib.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: redlib - port: 8080 + - match: Host(`redlib.durp.info`) && PathPrefix(`/`) + kind: Rule + # middlewares: + # - name: authentik-proxy-provider + # namespace: traefik + services: + - name: redlib + port: 8080 tls: secretName: redlib-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -30,10 +29,9 @@ spec: kind: ClusterIssuer commonName: "redlib.durp.info" dnsNames: - - "redlib.durp.info" + - "redlib.durp.info" --- - kind: Service apiVersion: v1 metadata: From 107dd520b31b028b07a581710ab21f41512eb2d3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:41:51 -0500 Subject: [PATCH 0815/1058] update --- dmz/authentik/templates/cert.yaml | 56 ++++++++++----- dmz/internalproxy/templates/authentik.yaml | 84 +++++++++++----------- 2 files changed, 81 insertions(+), 59 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index f920c99..e9990dd 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -1,20 +1,3 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: auth-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`auth.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: ak-outpost-dmz-embedded-outpost - port: 9000 - tls: - secretName: authentik-outpost-tls - ---- apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -28,3 +11,42 @@ spec: dnsNames: - "authentik.durp.info" - "authentik.durp.info" + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: authentik-outpost-tls + +--- +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: infra-cluster +subsets: + - addresses: + - ip: 192.168.12.130 + ports: + - port: 443 diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 2d74aae..af6e4e3 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,42 +1,42 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: authentik-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: infra-cluster +# port: 443 +# tls: +# secretName: authentik-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-tls +#spec: +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# secretName: authentik-tls +# commonName: "authentik.durp.info" +# dnsNames: +# - "authentik.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: authentik-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +#spec: +# type: ExternalName +# externalName: durp.info From e6c3dc4357a4da635877dda97cf0683828303825 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:44:58 -0500 Subject: [PATCH 0816/1058] update --- dmz/authentik/templates/cert.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index e9990dd..7fb1d1c 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -1,3 +1,20 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: auth-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-dmz-embedded-outpost + port: 9000 + tls: + secretName: authentik-outpost-tls + +--- apiVersion: cert-manager.io/v1 kind: Certificate metadata: From 960a681b6f44b585a07fb63c7579269b401d5474 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 10:48:21 -0500 Subject: [PATCH 0817/1058] update --- dmz/authentik/templates/cert.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index 7fb1d1c..c737b53 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -67,3 +67,14 @@ subsets: - ip: 192.168.12.130 ports: - port: 443 + +--- +apiVersion: v1 +kind: Service +metadata: + name: infra-cluster +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 From bff82fd82f3291e48a1ee4770507d3bf3bcd3c8e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 12:14:01 -0500 Subject: [PATCH 0818/1058] update --- dmz/redlib/templates/ingress.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/redlib/templates/ingress.yaml b/dmz/redlib/templates/ingress.yaml index 236f492..b2cc4e3 100644 --- a/dmz/redlib/templates/ingress.yaml +++ b/dmz/redlib/templates/ingress.yaml @@ -8,9 +8,9 @@ spec: routes: - match: Host(`redlib.durp.info`) && PathPrefix(`/`) kind: Rule - # middlewares: - # - name: authentik-proxy-provider - # namespace: traefik + middlewares: + - name: authentik-proxy-provider + namespace: traefik services: - name: redlib port: 8080 From 8c27fdce5ff31eed8b2b1d84b46a532e070c9b76 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 12:48:38 -0500 Subject: [PATCH 0819/1058] update --- dmz/internalproxy/templates/octopus.yaml | 3 --- 1 file changed, 3 deletions(-) diff --git a/dmz/internalproxy/templates/octopus.yaml b/dmz/internalproxy/templates/octopus.yaml index b6cf028..f68d9e3 100644 --- a/dmz/internalproxy/templates/octopus.yaml +++ b/dmz/internalproxy/templates/octopus.yaml @@ -8,9 +8,6 @@ spec: routes: - match: Host(`octopus.durp.info`) && PathPrefix(`/`) kind: Rule - middlewares: - - name: bouncer - namespace: traefik services: - name: infra-cluster port: 443 From 45af1f9be9c56f26542abfdad0246019ac94c7ab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 13:54:17 -0500 Subject: [PATCH 0820/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 2316dd4..5243d0a 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik trustForwardHeader: true authResponseHeaders: - X-authentik-username From 5e0ce5c39c416eb1dd815ee0a6f6615abba169d3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 10 May 2025 13:56:42 -0500 Subject: [PATCH 0821/1058] update --- dmz/traefik/templates/middleware.yaml | 38 +++++++++++++-------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 5243d0a..5cb657b 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik + address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username @@ -34,21 +34,21 @@ spec: - 10.0.0.0/8 --- -apiVersion: traefik.io/v1alpha1 -kind: Middleware -metadata: - name: bouncer - namespace: traefik -spec: - plugin: - bouncer: - enabled: true - crowdsecMode: stream - crowdsecLapiScheme: https - crowdsecLapiTLSInsecureVerify: true - crowdsecLapiHost: crowdsec-service.crowdsec:8080 - crowdsecLapiKey: - valueFrom: - secretKeyRef: - name: crowdsec-lapi-key - key: lapi-key +#apiVersion: traefik.io/v1alpha1 +#kind: Middleware +#metadata: +# name: bouncer +# namespace: traefik +#spec: +# plugin: +# bouncer: +# enabled: true +# crowdsecMode: stream +# crowdsecLapiScheme: https +# crowdsecLapiTLSInsecureVerify: true +# crowdsecLapiHost: crowdsec-service.crowdsec:8080 +# crowdsecLapiKey: +# valueFrom: +# secretKeyRef: +# name: crowdsec-lapi-key +# key: lapi-key From d506b1964b387bdbcb5f7b5332f6582502f6ee82 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:17:15 -0500 Subject: [PATCH 0822/1058] update --- dmz/authentik/templates/cert.yaml | 23 +++++------------------ 1 file changed, 5 insertions(+), 18 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index c737b53..0bcf9ab 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -1,20 +1,3 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: auth-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-dmz-embedded-outpost - port: 9000 - tls: - secretName: authentik-outpost-tls - ---- apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -27,7 +10,6 @@ spec: commonName: "authentik.durp.info" dnsNames: - "authentik.durp.info" - - "authentik.durp.info" --- apiVersion: traefik.io/v1alpha1 @@ -43,6 +25,11 @@ spec: services: - name: infra-cluster port: 443 + - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-dmz-embedded-outpost + port: 9000 tls: secretName: authentik-outpost-tls From eedb7d8380e9da86dc3f893b4297561819086189 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:23:04 -0500 Subject: [PATCH 0823/1058] update --- dmz/traefik/templates/middleware.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 5cb657b..4402750 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: "https://authentik.durp.info/outpost.goauthentik.io/auth/traefik" trustForwardHeader: true authResponseHeaders: - X-authentik-username @@ -19,6 +19,8 @@ spec: - X-authentik-meta-provider - X-authentik-meta-app - X-authentik-meta-version + query: + uri: "rd=$scheme://$http_host$request_uri" --- apiVersion: traefik.io/v1alpha1 From bd7adf40658ec6ed32ea5cf227aa2dfbc71c2bce Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:24:55 -0500 Subject: [PATCH 0824/1058] update --- dmz/traefik/templates/middleware.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 4402750..26f1d8f 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: "https://authentik.durp.info/outpost.goauthentik.io/auth/traefik" + address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username @@ -19,8 +19,6 @@ spec: - X-authentik-meta-provider - X-authentik-meta-app - X-authentik-meta-version - query: - uri: "rd=$scheme://$http_host$request_uri" --- apiVersion: traefik.io/v1alpha1 From 818123fee130ace23dd0e3320046266271bfbb23 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:25:54 -0500 Subject: [PATCH 0825/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 26f1d8f..d4aea7e 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: http://ak-outpost-dmz-embedded-output.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From 4ce97eca7a65bba94e2b2c32c321915470b4dcf8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:26:59 -0500 Subject: [PATCH 0826/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index d4aea7e..5cb657b 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-dmz-embedded-output.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From 97375239af583d9890b786c0249a53014d8c1cd0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:30:14 -0500 Subject: [PATCH 0827/1058] updateupdate --- dmz/authentik/templates/cert.yaml | 10 +++++----- infra/authentik/templates/ingress.yaml | 5 +++++ 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index 0bcf9ab..b519683 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -25,11 +25,11 @@ spec: services: - name: infra-cluster port: 443 - - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-dmz-embedded-outpost - port: 9000 + # - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + # kind: Rule + # services: + # - name: ak-outpost-dmz-embedded-outpost + # port: 9000 tls: secretName: authentik-outpost-tls diff --git a/infra/authentik/templates/ingress.yaml b/infra/authentik/templates/ingress.yaml index 55c35a2..8e0c956 100644 --- a/infra/authentik/templates/ingress.yaml +++ b/infra/authentik/templates/ingress.yaml @@ -11,6 +11,11 @@ spec: services: - name: authentik-server port: 80 + - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) + kind: Rule + services: + - name: ak-outpost-authentik-embedded-outpost + port: 9000 tls: secretName: authentik-tls From 5f3bd1c5072e72f04c2b578730a2643e73a56f56 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:33:01 -0500 Subject: [PATCH 0828/1058] update --- infra/argocd/templates/authentik.yaml | 48 +++++++++++++-------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index b98a313..b9a8eed 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -18,30 +18,30 @@ spec: # istio-injection: enabled automated: prune: true - selfHeal: true + selfHeal: true syncOptions: - - CreateNamespace=true + - CreateNamespace=true --- - -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: authentik-dmz - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: dmz/authentik - destination: - namespace: authentik - name: dmz - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - +# +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: authentik-dmz +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: dmz/authentik +# destination: +# namespace: authentik +# name: dmz +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# From 95be6528f2bb61e83f915b1e7187a991c12b2522 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:34:21 -0500 Subject: [PATCH 0829/1058] update --- dmz/internalproxy/templates/authentik.yaml | 82 +++++++++++----------- 1 file changed, 40 insertions(+), 42 deletions(-) diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index af6e4e3..e1ad61a 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,42 +1,40 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: infra-cluster -# port: 443 -# tls: -# secretName: authentik-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: authentik-tls -# commonName: "authentik.durp.info" -# dnsNames: -# - "authentik.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: authentik-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: authentik-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info From cdd34130aa357ccfeda3a916892318cb2cf069dd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:48:28 -0500 Subject: [PATCH 0830/1058] update --- dmz/authentik/templates/cert.yaml | 134 +++++++++++++------------- dmz/traefik/templates/middleware.yaml | 2 +- infra/argocd/templates/authentik.yaml | 42 ++++---- 3 files changed, 88 insertions(+), 90 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index b519683..4f510da 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -1,67 +1,67 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-outpost-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-outpost-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - # - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - # kind: Rule - # services: - # - name: ak-outpost-dmz-embedded-outpost - # port: 9000 - tls: - secretName: authentik-outpost-tls - ---- -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: infra-cluster -subsets: - - addresses: - - ip: 192.168.12.130 - ports: - - port: 443 - ---- -apiVersion: v1 -kind: Service -metadata: - name: infra-cluster -spec: - ports: - - protocol: TCP - port: 443 - targetPort: 443 +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-outpost-tls +#spec: +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# secretName: authentik-outpost-tls +# commonName: "authentik.durp.info" +# dnsNames: +# - "authentik.durp.info" +# +#--- +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: infra-cluster +# port: 443 +# # - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) +# # kind: Rule +# # services: +# # - name: ak-outpost-dmz-embedded-outpost +# # port: 9000 +# tls: +# secretName: authentik-outpost-tls +# +#--- +#kind: Service +#apiVersion: v1 +#metadata: +# name: authentik-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +#spec: +# type: ExternalName +# externalName: durp.info +# +#--- +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: infra-cluster +#subsets: +# - addresses: +# - ip: 192.168.12.130 +# ports: +# - port: 443 +# +#--- +#apiVersion: v1 +#kind: Service +#metadata: +# name: infra-cluster +#spec: +# ports: +# - protocol: TCP +# port: 443 +# targetPort: 443 diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 5cb657b..760b42d 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: https://authentik.durp.info/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index b9a8eed..42be478 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -23,25 +23,23 @@ spec: - CreateNamespace=true --- -# -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: authentik-dmz -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: dmz/authentik -# destination: -# namespace: authentik -# name: dmz -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: authentik-dmz + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/authentik + destination: + namespace: authentik + name: dmz + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From e2af26316fd7c5b729870c19030713916419e2a2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:50:17 -0500 Subject: [PATCH 0831/1058] update --- dmz/authentik/templates/cert.yaml | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index 4f510da..1da9a53 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -1,16 +1,15 @@ -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-outpost-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: authentik-outpost-tls -# commonName: "authentik.durp.info" -# dnsNames: -# - "authentik.durp.info" -# +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: value-issuer + kind: ClusterIssuer + secretName: authentik-tls + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" #--- #apiVersion: traefik.io/v1alpha1 #kind: IngressRoute From 72e6598aaefda7b87e9f93f1b7bca1f2cf1c544f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 10:51:02 -0500 Subject: [PATCH 0832/1058] update --- dmz/traefik/templates/middleware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/traefik/templates/middleware.yaml b/dmz/traefik/templates/middleware.yaml index 760b42d..2dad3ee 100644 --- a/dmz/traefik/templates/middleware.yaml +++ b/dmz/traefik/templates/middleware.yaml @@ -5,7 +5,7 @@ metadata: namespace: traefik spec: forwardAuth: - address: http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri + address: http://ak-outpost-authentik-dmz-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri trustForwardHeader: true authResponseHeaders: - X-authentik-username From 643ec165fc91a4b80995fa0da23380a471181015 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 11 May 2025 12:38:40 -0500 Subject: [PATCH 0833/1058] update --- infra/bitwarden/templates/deployment.yaml | 62 +++++++++++------------ 1 file changed, 31 insertions(+), 31 deletions(-) diff --git a/infra/bitwarden/templates/deployment.yaml b/infra/bitwarden/templates/deployment.yaml index f787ba1..044cc28 100644 --- a/infra/bitwarden/templates/deployment.yaml +++ b/infra/bitwarden/templates/deployment.yaml @@ -16,35 +16,35 @@ spec: app: bitwarden spec: containers: - - name: bitwarden - image: registry.durp.info/vaultwarden/server:1.32.7 - imagePullPolicy: Always - volumeMounts: - - name: bitwarden-pvc - mountPath: /data - subPath: bitwaren-data - ports: - - name: http - containerPort: 80 - env: - - name: SIGNUPS_ALLOWED - value: "FALSE" - - name: INVITATIONS_ALLOWED - value: "FALSE" - - name: WEBSOCKET_ENABLED - value: "TRUE" - - name: ROCKET_ENV - value: "staging" - - name: ROCKET_PORT - value: "80" - - name: ROCKET_WORKERS - value: "10" - - name: SECRET_USERNAME - valueFrom: - secretKeyRef: - name: bitwarden-secret - key: ADMIN_TOKEN + - name: bitwarden + image: registry.durp.info/vaultwarden/server:1.33.2 + imagePullPolicy: Always + volumeMounts: + - name: bitwarden-pvc + mountPath: /data + subPath: bitwaren-data + ports: + - name: http + containerPort: 80 + env: + - name: SIGNUPS_ALLOWED + value: "FALSE" + - name: INVITATIONS_ALLOWED + value: "FALSE" + - name: WEBSOCKET_ENABLED + value: "TRUE" + - name: ROCKET_ENV + value: "staging" + - name: ROCKET_PORT + value: "80" + - name: ROCKET_WORKERS + value: "10" + - name: SECRET_USERNAME + valueFrom: + secretKeyRef: + name: bitwarden-secret + key: ADMIN_TOKEN volumes: - - name: bitwarden-pvc - persistentVolumeClaim: - claimName: bitwarden-pvc + - name: bitwarden-pvc + persistentVolumeClaim: + claimName: bitwarden-pvc From 065b4787c8bb83216ed74616d4bb98d5c2bda97c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 12 May 2025 05:11:59 -0500 Subject: [PATCH 0834/1058] update --- dmz/authentik/templates/cert.yaml | 56 +------------------------------ 1 file changed, 1 insertion(+), 55 deletions(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index 1da9a53..074d60b 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -4,63 +4,9 @@ metadata: name: authentik-tls spec: issuerRef: - name: value-issuer + name: vault-issuer kind: ClusterIssuer secretName: authentik-tls commonName: "authentik.durp.info" dnsNames: - "authentik.durp.info" -#--- -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: infra-cluster -# port: 443 -# # - match: Host(`authentik.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) -# # kind: Rule -# # services: -# # - name: ak-outpost-dmz-embedded-outpost -# # port: 9000 -# tls: -# secretName: authentik-outpost-tls -# -#--- -#kind: Service -#apiVersion: v1 -#metadata: -# name: authentik-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -#spec: -# type: ExternalName -# externalName: durp.info -# -#--- -#apiVersion: v1 -#kind: Endpoints -#metadata: -# name: infra-cluster -#subsets: -# - addresses: -# - ip: 192.168.12.130 -# ports: -# - port: 443 -# -#--- -#apiVersion: v1 -#kind: Service -#metadata: -# name: infra-cluster -#spec: -# ports: -# - protocol: TCP -# port: 443 -# targetPort: 443 From 9e4f732d45ae163d31640c613ef6ae67a97b0726 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 13 May 2025 06:03:53 +0000 Subject: [PATCH 0835/1058] Update Helm release gatekeeper to v3.19.1 --- master/gatekeeper/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/gatekeeper/Chart.yaml b/master/gatekeeper/Chart.yaml index ec42676..768f053 100644 --- a/master/gatekeeper/Chart.yaml +++ b/master/gatekeeper/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: gatekeeper repository: https://open-policy-agent.github.io/gatekeeper/charts - version: 3.17.1 + version: 3.19.1 From 5e03a9e40ee77df04678d5952c4e9d1415d6d28e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 14 May 2025 06:04:46 +0000 Subject: [PATCH 0836/1058] Update Helm release gateway to v1.26.0 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index 1794b71..85afa7b 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -14,4 +14,4 @@ dependencies: version: 1.25.1 - name: gateway repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.1 \ No newline at end of file + version: 1.26.0 \ No newline at end of file diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index 846d267..7647dac 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -14,4 +14,4 @@ dependencies: version: 1.25.1 - name: gateway repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.1 + version: 1.26.0 From 72ce4db466cdbfaae4e859cdec4f6a2041487b6e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 15 May 2025 06:04:25 +0000 Subject: [PATCH 0837/1058] Update Helm release crowdsec to v0.19.3 --- dmz/crowdsec/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/crowdsec/Chart.yaml b/dmz/crowdsec/Chart.yaml index 84cbb77..f0b3037 100644 --- a/dmz/crowdsec/Chart.yaml +++ b/dmz/crowdsec/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: crowdsec repository: https://crowdsecurity.github.io/helm-charts - version: 0.19.2 + version: 0.19.3 From f8d47b89d958479d5f048a8a39ca80c15bf60c3f Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 15 May 2025 06:04:40 +0000 Subject: [PATCH 0838/1058] Update Helm release istiod to v1.26.0 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index 1794b71..86823ac 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -11,7 +11,7 @@ dependencies: version: 1.26.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.1 + version: 1.26.0 - name: gateway repository: https://istio-release.storage.googleapis.com/charts version: 1.25.1 \ No newline at end of file diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index 846d267..5050794 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -11,7 +11,7 @@ dependencies: version: 1.26.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts - version: 1.25.1 + version: 1.26.0 - name: gateway repository: https://istio-release.storage.googleapis.com/charts version: 1.25.1 From 6cbba2abecd9c87a346821988e11c33e6d18972a Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 16 May 2025 06:04:25 +0000 Subject: [PATCH 0839/1058] Update Helm release authentik to v2025.4.1 --- infra/authentik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/Chart.yaml b/infra/authentik/Chart.yaml index 930d302..d5927e6 100644 --- a/infra/authentik/Chart.yaml +++ b/infra/authentik/Chart.yaml @@ -9,5 +9,5 @@ appVersion: "1.16.0" dependencies: - name: authentik repository: https://charts.goauthentik.io - version: 2025.4.0 + version: 2025.4.1 From 3acedbfdd2f58f5fadc3c1fc96cebab8a51b32aa Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 16 May 2025 06:04:30 +0000 Subject: [PATCH 0840/1058] Update Terraform proxmox to v3.0.1-rc9 --- dev/terraform/main.tf | 2 +- dmz/terraform/main.tf | 2 +- infra/terraform/main.tf | 2 +- prd/terraform/main.tf | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf index 4b0bca0..c75295e 100644 --- a/dev/terraform/main.tf +++ b/dev/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc8" + version = "3.0.1-rc9" } } } diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf index 6cb7ee4..021675c 100644 --- a/dmz/terraform/main.tf +++ b/dmz/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc8" + version = "3.0.1-rc9" } } } diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf index b4717ce..df2d033 100644 --- a/infra/terraform/main.tf +++ b/infra/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc8" + version = "3.0.1-rc9" } } } diff --git a/prd/terraform/main.tf b/prd/terraform/main.tf index 25e1baa..6be6739 100644 --- a/prd/terraform/main.tf +++ b/prd/terraform/main.tf @@ -3,7 +3,7 @@ terraform { required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc8" + version = "3.0.1-rc9" } } } From 0a1d45d16a46c65fb4a79b73f2d6c8f2a7c2df4e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 16 May 2025 06:04:35 +0000 Subject: [PATCH 0841/1058] Update Helm release external-secrets to v0.17.0 --- dev/external-secrets/Chart.yaml | 2 +- dmz/external-secrets/Chart.yaml | 2 +- infra/external-secrets/Chart.yaml | 2 +- master/external-secrets/Chart.yaml | 2 +- prd/external-secrets/Chart.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dev/external-secrets/Chart.yaml b/dev/external-secrets/Chart.yaml index d89a403..48645c3 100644 --- a/dev/external-secrets/Chart.yaml +++ b/dev/external-secrets/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.13.0 + version: 0.17.0 diff --git a/dmz/external-secrets/Chart.yaml b/dmz/external-secrets/Chart.yaml index 8e9a627..4b30288 100644 --- a/dmz/external-secrets/Chart.yaml +++ b/dmz/external-secrets/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.16.2 + version: 0.17.0 diff --git a/infra/external-secrets/Chart.yaml b/infra/external-secrets/Chart.yaml index ff5a3e2..48645c3 100644 --- a/infra/external-secrets/Chart.yaml +++ b/infra/external-secrets/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.15.0 + version: 0.17.0 diff --git a/master/external-secrets/Chart.yaml b/master/external-secrets/Chart.yaml index 5b9982f..94104aa 100644 --- a/master/external-secrets/Chart.yaml +++ b/master/external-secrets/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.10.4 + version: 0.17.0 diff --git a/prd/external-secrets/Chart.yaml b/prd/external-secrets/Chart.yaml index d89a403..48645c3 100644 --- a/prd/external-secrets/Chart.yaml +++ b/prd/external-secrets/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: external-secrets repository: https://charts.external-secrets.io - version: 0.13.0 + version: 0.17.0 From cd1abb4cec771368ef8f5796d6598fa6901231ca Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 16 May 2025 05:46:00 -0500 Subject: [PATCH 0842/1058] update --- dmz/authentik/templates/cert.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml index 074d60b..5c52e76 100644 --- a/dmz/authentik/templates/cert.yaml +++ b/dmz/authentik/templates/cert.yaml @@ -4,7 +4,7 @@ metadata: name: authentik-tls spec: issuerRef: - name: vault-issuer + name: letsencrypt-production kind: ClusterIssuer secretName: authentik-tls commonName: "authentik.durp.info" From fe79c830cb3b63e02d24ea25189f976e93c75ab3 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 17 May 2025 06:04:30 +0000 Subject: [PATCH 0843/1058] Update Helm release longhorn to v1.8.1 --- dmz/longhorn/Chart.yaml | 2 +- infra/longhorn/Chart.yaml | 2 +- master/longhorn/Chart.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/longhorn/Chart.yaml b/dmz/longhorn/Chart.yaml index 85720ac..cffddaf 100644 --- a/dmz/longhorn/Chart.yaml +++ b/dmz/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.7.2 + version: 1.8.1 diff --git a/infra/longhorn/Chart.yaml b/infra/longhorn/Chart.yaml index 85720ac..cffddaf 100644 --- a/infra/longhorn/Chart.yaml +++ b/infra/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.7.2 + version: 1.8.1 diff --git a/master/longhorn/Chart.yaml b/master/longhorn/Chart.yaml index fde2188..680ec32 100644 --- a/master/longhorn/Chart.yaml +++ b/master/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.7.1 \ No newline at end of file + version: 1.8.1 \ No newline at end of file From a8e7ac07c8a3b62983d1bdaf85de0526c80b2e60 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 17 May 2025 06:04:36 +0000 Subject: [PATCH 0844/1058] Update Helm release postgresql to 12.12.* --- master/durpapi/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/durpapi/Chart.yaml b/master/durpapi/Chart.yaml index 078c7e0..1c97e4c 100644 --- a/master/durpapi/Chart.yaml +++ b/master/durpapi/Chart.yaml @@ -8,6 +8,6 @@ appVersion: 0.1.0 dependencies: - condition: postgresql.enabled - version: 12.5.* + version: 12.12.* repository: https://charts.bitnami.com/bitnami name: postgresql From 29661b9bf7e91d81037b897ac92a3985ed565dd3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 17 May 2025 08:12:47 -0500 Subject: [PATCH 0845/1058] update --- dmz/authentik/templates/cert.yaml | 12 ---- dmz/authentik/templates/ingress.yaml | 62 +++++++++++++++++ dmz/internalproxy/templates/authentik.yaml | 80 +++++++++++----------- 3 files changed, 102 insertions(+), 52 deletions(-) delete mode 100644 dmz/authentik/templates/cert.yaml create mode 100644 dmz/authentik/templates/ingress.yaml diff --git a/dmz/authentik/templates/cert.yaml b/dmz/authentik/templates/cert.yaml deleted file mode 100644 index 5c52e76..0000000 --- a/dmz/authentik/templates/cert.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" diff --git a/dmz/authentik/templates/ingress.yaml b/dmz/authentik/templates/ingress.yaml new file mode 100644 index 0000000..f03751e --- /dev/null +++ b/dmz/authentik/templates/ingress.yaml @@ -0,0 +1,62 @@ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: authentik-tls + +--- +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: infra-cluster +subsets: + - addresses: + - ip: 192.168.12.130 + ports: + - port: 443 + +--- +apiVersion: v1 +kind: Service +metadata: + name: infra-cluster +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index e1ad61a..328d115 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,40 +1,40 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: authentik-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: authentik-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: infra-cluster +# port: 443 +# tls: +# secretName: authentik-tls +# +#--- +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: authentik-tls +#spec: +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# secretName: authentik-tls +# commonName: "authentik.durp.info" +# dnsNames: +# - "authentik.durp.info" +# +#--- +#kind: Service +#apiVersion: v1 +#metadata: +# name: authentik-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +#spec: +# type: ExternalName +# externalName: durp.info From 4708a70a3479bcc3e532128bcd23b838b6bc6448 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 17 May 2025 08:14:40 -0500 Subject: [PATCH 0846/1058] update --- dmz/external-secrets/values.yaml | 4 ++++ infra/external-secrets/values.yaml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index ffdf526..17aaeb1 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -1,4 +1,8 @@ external-secrets: + global: + security: + allowInsecureImages: true + log: level: debug replicaCount: 1 diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index e78ce66..a3e9a63 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -1,4 +1,8 @@ external-secrets: + global: + security: + allowInsecureImages: true + log: level: debug replicaCount: 1 From beef7041024a342cfa8a9fdb7365cc5f427c6d03 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 17 May 2025 08:17:24 -0500 Subject: [PATCH 0847/1058] update --- dmz/external-dns/values.yaml | 6 ++++-- dmz/external-secrets/values.yaml | 2 +- infra/external-secrets/values.yaml | 2 +- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/dmz/external-dns/values.yaml b/dmz/external-dns/values.yaml index 2052942..21d797e 100644 --- a/dmz/external-dns/values.yaml +++ b/dmz/external-dns/values.yaml @@ -1,6 +1,8 @@ external-dns: global: imageRegistry: "registry.durp.info" + security: + allowInsecureImages: true image: pullPolicy: Always @@ -9,10 +11,10 @@ external-dns: sources: - service - + provider: cloudflare cloudflare: - secretName : "external-dns" + secretName: "external-dns" proxied: false policy: sync diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 17aaeb1..0e7015b 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -1,7 +1,7 @@ external-secrets: global: security: - allowInsecureImages: true + allowInsecureImages: true log: level: debug diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index a3e9a63..5fc44b4 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -1,7 +1,7 @@ external-secrets: global: security: - allowInsecureImages: true + allowInsecureImages: true log: level: debug From 17c3e5dddfb03e5029f79dd45b89f48b45ddb9fb Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 18 May 2025 06:04:16 +0000 Subject: [PATCH 0848/1058] Update Helm release traefik to v34.5.0 --- dev/traefik/Chart.yaml | 2 +- dmz/traefik/Chart.yaml | 2 +- infra/traefik/Chart.yaml | 2 +- prd/traefik/Chart.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dev/traefik/Chart.yaml b/dev/traefik/Chart.yaml index 30f96ac..1df1d76 100644 --- a/dev/traefik/Chart.yaml +++ b/dev/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 34.0.0 + version: 34.5.0 diff --git a/dmz/traefik/Chart.yaml b/dmz/traefik/Chart.yaml index 30f96ac..1df1d76 100644 --- a/dmz/traefik/Chart.yaml +++ b/dmz/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 34.0.0 + version: 34.5.0 diff --git a/infra/traefik/Chart.yaml b/infra/traefik/Chart.yaml index 30f96ac..1df1d76 100644 --- a/infra/traefik/Chart.yaml +++ b/infra/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 34.0.0 + version: 34.5.0 diff --git a/prd/traefik/Chart.yaml b/prd/traefik/Chart.yaml index 30f96ac..1df1d76 100644 --- a/prd/traefik/Chart.yaml +++ b/prd/traefik/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: traefik repository: https://traefik.github.io/charts - version: 34.0.0 + version: 34.5.0 From 37fd96179d4719edaeeaf09d564be7a313ffac44 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:20:36 -0500 Subject: [PATCH 0849/1058] update --- infra/crossplane/templates/tofu.yml | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 infra/crossplane/templates/tofu.yml diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml new file mode 100644 index 0000000..f80b7bc --- /dev/null +++ b/infra/crossplane/templates/tofu.yml @@ -0,0 +1,6 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-opentofu +spec: + package: xpkg.upbound.io/upbound/provider-opentofu:0.2.5 From f4eaa739e98579879936c5cfff2954f9b9b6f76f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:21:21 -0500 Subject: [PATCH 0850/1058] update --- infra/crossplane/templates/tofu.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index f80b7bc..da78597 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -3,4 +3,4 @@ kind: Provider metadata: name: provider-opentofu spec: - package: xpkg.upbound.io/upbound/provider-opentofu:0.2.5 + package: xpkg.upbound.io/upbound/provider-opentofu:v0.2.5 From 5525c9bba5510ec1d8adc4c3d578e9e72aaa9818 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:22:18 -0500 Subject: [PATCH 0851/1058] update --- infra/crossplane/templates/tofu.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index da78597..8ba1c12 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -3,4 +3,4 @@ kind: Provider metadata: name: provider-opentofu spec: - package: xpkg.upbound.io/upbound/provider-opentofu:v0.2.5 + package: xpkg.upbound.io/upbound/provider-opentofu:v0 From 9b9f36859f4c27977d1b8cc8f448889b4c64d213 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:33:29 -0500 Subject: [PATCH 0852/1058] update --- infra/crossplane/templates/secrets.yml | 29 ++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 infra/crossplane/templates/secrets.yml diff --git a/infra/crossplane/templates/secrets.yml b/infra/crossplane/templates/secrets.yml new file mode 100644 index 0000000..8e01ca5 --- /dev/null +++ b/infra/crossplane/templates/secrets.yml @@ -0,0 +1,29 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: proxmox-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: db-pass + data: + - secretKey: pm_api_url + remoteRef: + key: kv/crossplane/proxmox + property: pm_api_url + - secretKey: pm_password + remoteRef: + key: kv/crossplane/proxmox + property: pm_password + - secretKey: pm_user + remoteRef: + key: kv/crossplane/proxmox + property: pm_user + +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault From 0ae3c80a8154ae9811623c967e00c7d5d35c7e8a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:34:34 -0500 Subject: [PATCH 0853/1058] update --- infra/crossplane/templates/secrets.yml | 29 -------------------------- infra/crossplane/templates/tofu.yml | 25 ++++++++++++++++++++++ 2 files changed, 25 insertions(+), 29 deletions(-) delete mode 100644 infra/crossplane/templates/secrets.yml diff --git a/infra/crossplane/templates/secrets.yml b/infra/crossplane/templates/secrets.yml deleted file mode 100644 index 8e01ca5..0000000 --- a/infra/crossplane/templates/secrets.yml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: proxmox-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: db-pass - data: - - secretKey: pm_api_url - remoteRef: - key: kv/crossplane/proxmox - property: pm_api_url - - secretKey: pm_password - remoteRef: - key: kv/crossplane/proxmox - property: pm_password - - secretKey: pm_user - remoteRef: - key: kv/crossplane/proxmox - property: pm_user - ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 8ba1c12..6539434 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -4,3 +4,28 @@ metadata: name: provider-opentofu spec: package: xpkg.upbound.io/upbound/provider-opentofu:v0 + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: proxmox-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: db-pass + data: + - secretKey: pm_api_url + remoteRef: + key: kv/crossplane/proxmox + property: pm_api_url + - secretKey: pm_password + remoteRef: + key: kv/crossplane/proxmox + property: pm_password + - secretKey: pm_user + remoteRef: + key: kv/crossplane/proxmox + property: pm_user From af5f6e12579d878d44a51cb819fcd7bb02de2b39 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:43:17 -0500 Subject: [PATCH 0854/1058] update --- infra/crossplane/templates/tofu.yml | 117 +++++++++++++++++++++++++++- 1 file changed, 116 insertions(+), 1 deletion(-) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 6539434..084ce27 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -15,7 +15,7 @@ spec: name: vault kind: ClusterSecretStore target: - name: db-pass + name: proxmox-secret data: - secretKey: pm_api_url remoteRef: @@ -29,3 +29,118 @@ spec: remoteRef: key: kv/crossplane/proxmox property: pm_user + +--- +apiVersion: opentofu.upbound.io/v1beta1 +kind: Workspace +metadata: + name: test-vm + annotations: + crossplane.io/external-name: test +spec: + forProvider: + source: Inline + env: + - name: TF_VAR_pm_api_url + secretKeyRef: + name: proxmox-secret + key: pam_api_url + - name: TF_VAR_pm_password + secretKeyRef: + name: proxmox-secret + key: pam_password + - name: TF_VAR_pm_user + secretKeyRef: + name: proxmox-secret + key: pam_user + module: | + + provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false + } + + locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.10.1" + vlan = 10 + testVM = { + tags = "test" + count = 1 + name = ["test-server"] + cores = 2 + memory = "4096" + drive = 20 + storage = "cache-domains" + node = ["mothership"] + ip = ["99"] + } + } + + resource "proxmox_vm_qemu" "testVM" { + count = local.testVM.count + ciuser = "administrator" + vmid = "${local.vlan}${local.testVM.ip[count.index]}" + name = local.testVM.name[count.index] + target_node = local.testVM.node[count.index] + clone = local.template + tags = local.testVM.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.testVM.cores + sockets = 1 + cpu_type = "host" + memory = local.testVM.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.testVM.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.testVM.drive + format = local.format + storage = local.testVM.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.testVM.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver + } + + writeConnectionSecretToRef: + namespace: default + name: opentofu-workspace-example-inline From 362037c198a6cbfe794e6f87eaeb24c076033a86 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:44:38 -0500 Subject: [PATCH 0855/1058] update --- infra/crossplane/templates/tofu.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 084ce27..72e4a18 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -43,14 +43,17 @@ spec: env: - name: TF_VAR_pm_api_url secretKeyRef: + namespace: crossplane name: proxmox-secret key: pam_api_url - name: TF_VAR_pm_password secretKeyRef: + namespace: crossplane name: proxmox-secret key: pam_password - name: TF_VAR_pm_user secretKeyRef: + namespace: crossplane name: proxmox-secret key: pam_user module: | From 39bf52cae34f91d019d713e8759b4fe4ad2467e4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:45:19 -0500 Subject: [PATCH 0856/1058] update --- infra/crossplane/templates/tofu.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 72e4a18..2724d26 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -145,5 +145,5 @@ spec: } writeConnectionSecretToRef: - namespace: default + namespace: crossplane name: opentofu-workspace-example-inline From cbadf7ce1979df240d461f63d30438d748d46649 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:48:05 -0500 Subject: [PATCH 0857/1058] update --- infra/external-secrets/values.yaml | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/infra/external-secrets/values.yaml b/infra/external-secrets/values.yaml index 5fc44b4..e61f2f1 100644 --- a/infra/external-secrets/values.yaml +++ b/infra/external-secrets/values.yaml @@ -33,13 +33,13 @@ external-secrets: subPath: vault.pem readOnly: true - resources: - requests: - memory: 32Mi - cpu: 10m - limits: - memory: 32Mi - cpu: 10m + # resources: + # requests: + # memory: 32Mi + # cpu: 10m + # limits: + # memory: 32Mi + # cpu: 10m webhook: log: @@ -48,13 +48,13 @@ external-secrets: repository: registry.durp.info/external-secrets/external-secrets pullPolicy: Always - resources: - requests: - memory: 32Mi - cpu: 10m - limits: - memory: 32Mi - cpu: 10m + # resources: + # requests: + # memory: 32Mi + # cpu: 10m + # limits: + # memory: 32Mi + # cpu: 10m certController: create: false From cb64c2d05da1fb2f336e31231e95111b6e8cdf0f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:49:01 -0500 Subject: [PATCH 0858/1058] update --- dmz/external-secrets/values.yaml | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/dmz/external-secrets/values.yaml b/dmz/external-secrets/values.yaml index 0e7015b..3ccc294 100644 --- a/dmz/external-secrets/values.yaml +++ b/dmz/external-secrets/values.yaml @@ -33,13 +33,13 @@ external-secrets: subPath: vault.pem readOnly: true - resources: - requests: - memory: 32Mi - cpu: 10m - limits: - memory: 32Mi - cpu: 10m + # resources: + # requests: + # memory: 32Mi + # cpu: 10m + # limits: + # memory: 32Mi + # cpu: 10m webhook: create: false @@ -61,13 +61,13 @@ external-secrets: subPath: vault.pem readOnly: true - resources: - requests: - memory: 32Mi - cpu: 10m - limits: - memory: 32Mi - cpu: 10m + # resources: + # requests: + # memory: 32Mi + # cpu: 10m + # limits: + # memory: 32Mi + # cpu: 10m certController: create: false From 95386b345ad90608dabea1500778760a8a9c1d55 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:53:16 -0500 Subject: [PATCH 0859/1058] update --- infra/crossplane/templates/tofu.yml | 37 +++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 2724d26..085a238 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -30,6 +30,43 @@ spec: key: kv/crossplane/proxmox property: pm_user +--- +apiVersion: opentofu.upbound.io/v1beta1 +kind: ProviderConfig +metadata: + name: default +spec: + # Note that unlike most provider configs this one supports an array of + # credentials. This is because each tofu workspace uses a single + # Crossplane provider config, but could use multiple Terraform providers each + # with their own credentials. + #credentials: + # - filename: gcp-credentials.json + # source: Secret + # secretRef: + # namespace: upbound-system + # name: opentofu-gcp-creds + # key: credentials + # This optional configuration block can be used to inject HCL into any + # workspace that uses this provider config, for example to setup Terraform + # providers. + configuration: | + + // Modules _must_ use remote state. The provider does not persist state. + terraform { + backend "kubernetes" { + secret_suffix = "providerconfig-default" + namespace = "upbound-system" + in_cluster_config = true + } + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc8" + } + } + } + --- apiVersion: opentofu.upbound.io/v1beta1 kind: Workspace From 7b72bb16f7d8b9378dfea57860341f47bcf39704 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:55:24 -0500 Subject: [PATCH 0860/1058] update --- infra/crossplane/templates/tofu.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 085a238..3147545 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -82,17 +82,17 @@ spec: secretKeyRef: namespace: crossplane name: proxmox-secret - key: pam_api_url + key: pm_api_url - name: TF_VAR_pm_password secretKeyRef: namespace: crossplane name: proxmox-secret - key: pam_password + key: pm_password - name: TF_VAR_pm_user secretKeyRef: namespace: crossplane name: proxmox-secret - key: pam_user + key: pm_user module: | provider "proxmox" { From 302184d65562cdbbfa5ec7aa704c3ba64ce4a021 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:56:44 -0500 Subject: [PATCH 0861/1058] update --- infra/crossplane/templates/tofu.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 3147545..2858ad2 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -56,7 +56,7 @@ spec: terraform { backend "kubernetes" { secret_suffix = "providerconfig-default" - namespace = "upbound-system" + namespace = "crossplane" in_cluster_config = true } required_providers { From 977d652d8b1a30f5e411bbc4baffdb5e966f7c31 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:57:51 -0500 Subject: [PATCH 0862/1058] update --- infra/crossplane/templates/tofu.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 2858ad2..ad784f6 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -104,6 +104,21 @@ spec: pm_debug = false } + variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string + } + + variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string + } + + variable "pm_user" { + description = "Username to Proxmox provider" + type = string + } + locals { sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" template = "Debian12-Template" From f9f1e101a9d3b6fc79e6486e719fcee8087cbe75 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 19 May 2025 05:59:51 -0500 Subject: [PATCH 0863/1058] update --- infra/crossplane/templates/tofu.yml | 269 ++++++++++++++-------------- 1 file changed, 131 insertions(+), 138 deletions(-) diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index ad784f6..02540df 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -36,10 +36,6 @@ kind: ProviderConfig metadata: name: default spec: - # Note that unlike most provider configs this one supports an array of - # credentials. This is because each tofu workspace uses a single - # Crossplane provider config, but could use multiple Terraform providers each - # with their own credentials. #credentials: # - filename: gcp-credentials.json # source: Secret @@ -47,9 +43,6 @@ spec: # namespace: upbound-system # name: opentofu-gcp-creds # key: credentials - # This optional configuration block can be used to inject HCL into any - # workspace that uses this provider config, for example to setup Terraform - # providers. configuration: | // Modules _must_ use remote state. The provider does not persist state. @@ -68,134 +61,134 @@ spec: } --- -apiVersion: opentofu.upbound.io/v1beta1 -kind: Workspace -metadata: - name: test-vm - annotations: - crossplane.io/external-name: test -spec: - forProvider: - source: Inline - env: - - name: TF_VAR_pm_api_url - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_api_url - - name: TF_VAR_pm_password - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_password - - name: TF_VAR_pm_user - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_user - module: | - - provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false - } - - variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string - } - - variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string - } - - variable "pm_user" { - description = "Username to Proxmox provider" - type = string - } - - locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.10.1" - vlan = 10 - testVM = { - tags = "test" - count = 1 - name = ["test-server"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership"] - ip = ["99"] - } - } - - resource "proxmox_vm_qemu" "testVM" { - count = local.testVM.count - ciuser = "administrator" - vmid = "${local.vlan}${local.testVM.ip[count.index]}" - name = local.testVM.name[count.index] - target_node = local.testVM.node[count.index] - clone = local.template - tags = local.testVM.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.testVM.cores - sockets = 1 - cpu_type = "host" - memory = local.testVM.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.testVM.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.testVM.drive - format = local.format - storage = local.testVM.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.testVM.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver - } - - writeConnectionSecretToRef: - namespace: crossplane - name: opentofu-workspace-example-inline +#apiVersion: opentofu.upbound.io/v1beta1 +#kind: Workspace +#metadata: +# name: test-vm +# annotations: +# crossplane.io/external-name: test +#spec: +# forProvider: +# source: Inline +# env: +# - name: TF_VAR_pm_api_url +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_api_url +# - name: TF_VAR_pm_password +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_password +# - name: TF_VAR_pm_user +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_user +# module: | +# +# provider "proxmox" { +# pm_parallel = 1 +# pm_tls_insecure = true +# pm_api_url = var.pm_api_url +# pm_user = var.pm_user +# pm_password = var.pm_password +# pm_debug = false +# } +# +# variable "pm_api_url" { +# description = "API URL to Proxmox provider" +# type = string +# } +# +# variable "pm_password" { +# description = "Passowrd to Proxmox provider" +# type = string +# } +# +# variable "pm_user" { +# description = "Username to Proxmox provider" +# type = string +# } +# +# locals { +# sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" +# template = "Debian12-Template" +# format = "raw" +# dnsserver = "192.168.10.1" +# vlan = 10 +# testVM = { +# tags = "test" +# count = 1 +# name = ["test-server"] +# cores = 2 +# memory = "4096" +# drive = 20 +# storage = "cache-domains" +# node = ["mothership"] +# ip = ["99"] +# } +# } +# +# resource "proxmox_vm_qemu" "testVM" { +# count = local.testVM.count +# ciuser = "administrator" +# vmid = "${local.vlan}${local.testVM.ip[count.index]}" +# name = local.testVM.name[count.index] +# target_node = local.testVM.node[count.index] +# clone = local.template +# tags = local.testVM.tags +# qemu_os = "l26" +# full_clone = true +# os_type = "cloud-init" +# agent = 1 +# cores = local.testVM.cores +# sockets = 1 +# cpu_type = "host" +# memory = local.testVM.memory +# scsihw = "virtio-scsi-pci" +# #bootdisk = "scsi0" +# boot = "order=virtio0" +# onboot = true +# sshkeys = local.sshkeys +# vga { +# type = "serial0" +# } +# serial { +# id = 0 +# type = "socket" +# } +# disks { +# ide { +# ide2 { +# cloudinit { +# storage = local.testVM.storage +# } +# } +# } +# virtio { +# virtio0 { +# disk { +# size = local.testVM.drive +# format = local.format +# storage = local.testVM.storage +# } +# } +# } +# } +# network { +# id = 0 +# model = "virtio" +# bridge = "vmbr0" +# tag = local.vlan +# } +# #Cloud Init Settings +# ipconfig0 = "ip=192.168.${local.vlan}.${local.testVM.ip[count.index]}/24,gw=192.168.${local.vlan}.1" +# searchdomain = "durp.loc" +# nameserver = local.dnsserver +# } +# +# writeConnectionSecretToRef: +# namespace: crossplane +# name: opentofu-workspace-example-inline From 7d0e2f4b22576ec9e06fcc3a96d0b839530a20d8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:32:02 -0500 Subject: [PATCH 0864/1058] update --- infra/argocd/values.yaml | 1 + infra/crossplane/templates/argocd.yaml | 9 +++++++++ 2 files changed, 10 insertions(+) create mode 100644 infra/crossplane/templates/argocd.yaml diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index e8d4628..e3990c4 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -34,6 +34,7 @@ argo-cd: annotations: {} url: https://argocd.infra.durp.info oidc.tls.insecure.skip.verify: "true" + accounts.argocd-provider: apiKey, login dex.config: | connectors: - config: diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml new file mode 100644 index 0000000..b543a8c --- /dev/null +++ b/infra/crossplane/templates/argocd.yaml @@ -0,0 +1,9 @@ +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-argocd +spec: + package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 + +--- + From 5cb7ca72d8ecbf7d0013ddf0438bb91137234bd7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:33:41 -0500 Subject: [PATCH 0865/1058] update --- infra/argocd/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index e3990c4..59414ef 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -34,7 +34,7 @@ argo-cd: annotations: {} url: https://argocd.infra.durp.info oidc.tls.insecure.skip.verify: "true" - accounts.argocd-provider: apiKey, login + accounts.argocd-provider: apiKey dex.config: | connectors: - config: @@ -55,6 +55,7 @@ argo-cd: create: true policy.csv: | g, ArgoCD Admins, role:admin + g, provider-argocd, role:admin scopes: "[groups]" server: From c016db260ea05da3f188a96c81ff2d816d8be249 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:36:48 -0500 Subject: [PATCH 0866/1058] update --- infra/argocd/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 59414ef..c6ea229 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -34,7 +34,7 @@ argo-cd: annotations: {} url: https://argocd.infra.durp.info oidc.tls.insecure.skip.verify: "true" - accounts.argocd-provider: apiKey + accounts.provider-argocd: apiKey dex.config: | connectors: - config: From affd8510171c0ef503c1ecf3f2c065bfa3f3d2ef Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:40:04 -0500 Subject: [PATCH 0867/1058] update --- infra/crossplane/templates/argocd.yaml | 30 ++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index b543a8c..69dec8a 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -6,4 +6,34 @@ spec: package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 --- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + namespace: crossplane + name: argocd-secret + key: authToken From d0f4780b6c48b60b6d1cfae7126e464e643ae34d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:42:34 -0500 Subject: [PATCH 0868/1058] update --- infra/crossplane/templates/argocd.yaml | 35 ++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 69dec8a..948540e 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -22,6 +22,23 @@ spec: key: kv/argocd/provider-argocd property: token +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: prod-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: prod-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/prd + property: kubeconfig + --- apiVersion: argocd.crossplane.io/v1alpha1 kind: ProviderConfig @@ -37,3 +54,21 @@ spec: namespace: crossplane name: argocd-secret key: authToken + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: prd-cluster-kubeconfig + labels: + purpose: prd +spec: + forProvider: + name: prd-cluster-kubeconfig + config: + kubeconfigSecretRef: + name: prod-kubeconfig + namespace: crossplane + key: kubeconfig + providerConfigRef: + name: argocd-provider From 0437fadc152f37ae0e69c805255ac96dba451b04 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:43:21 -0500 Subject: [PATCH 0869/1058] update --- infra/crossplane/templates/argocd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 948540e..25b7762 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -64,7 +64,7 @@ metadata: purpose: prd spec: forProvider: - name: prd-cluster-kubeconfig + name: prd config: kubeconfigSecretRef: name: prod-kubeconfig From 49abd7fb28faaa44550527ab1532a6bad4bcae2a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:44:04 -0500 Subject: [PATCH 0870/1058] update --- infra/crossplane/templates/argocd.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 25b7762..95275e6 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -59,12 +59,12 @@ spec: apiVersion: cluster.argocd.crossplane.io/v1alpha1 kind: Cluster metadata: - name: prd-cluster-kubeconfig + name: prd-cluster labels: purpose: prd spec: forProvider: - name: prd + name: prd-cluster config: kubeconfigSecretRef: name: prod-kubeconfig From 43ef21d99bef0dd441e011ceee8ef165bab6259e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:46:31 -0500 Subject: [PATCH 0871/1058] update --- infra/argocd/templates/crossplane-config.yaml | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 infra/argocd/templates/crossplane-config.yaml diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml new file mode 100644 index 0000000..62ac79b --- /dev/null +++ b/infra/argocd/templates/crossplane-config.yaml @@ -0,0 +1,66 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: prod-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: prod-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/prd + property: kubeconfig + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + namespace: crossplane + name: argocd-secret + key: authToken + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: prd-cluster + labels: + purpose: prd +spec: + forProvider: + name: prd-cluster + config: + kubeconfigSecretRef: + name: prod-kubeconfig + namespace: crossplane + key: kubeconfig + providerConfigRef: + name: argocd-provider From 495ddce8246a3427e05c8bd0cfe9edc32ea1fd83 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:46:41 -0500 Subject: [PATCH 0872/1058] update --- infra/crossplane/templates/argocd.yaml | 68 -------------------------- 1 file changed, 68 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 95275e6..f607167 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -4,71 +4,3 @@ metadata: name: provider-argocd spec: package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: prod-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: prod-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/prd - property: kubeconfig - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: crossplane - name: argocd-secret - key: authToken - ---- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: prd-cluster - labels: - purpose: prd -spec: - forProvider: - name: prd-cluster - config: - kubeconfigSecretRef: - name: prod-kubeconfig - namespace: crossplane - key: kubeconfig - providerConfigRef: - name: argocd-provider From da5f19f9d3f916a3294c6d4efb3cb542c17a0d13 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:48:32 -0500 Subject: [PATCH 0873/1058] update --- infra/argocd/templates/crossplane-config.yaml | 132 +++++++++--------- 1 file changed, 66 insertions(+), 66 deletions(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 62ac79b..4a50b51 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -1,66 +1,66 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: prod-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: prod-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/prd - property: kubeconfig - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: crossplane - name: argocd-secret - key: authToken - ---- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: prd-cluster - labels: - purpose: prd -spec: - forProvider: - name: prd-cluster - config: - kubeconfigSecretRef: - name: prod-kubeconfig - namespace: crossplane - key: kubeconfig - providerConfigRef: - name: argocd-provider +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: argocd-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: argocd-secret +# data: +# - secretKey: authToken +# remoteRef: +# key: kv/argocd/provider-argocd +# property: token +# +#--- +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: prod-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: prod-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/prd +# property: kubeconfig +# +#--- +#apiVersion: argocd.crossplane.io/v1alpha1 +#kind: ProviderConfig +#metadata: +# name: argocd-provider +#spec: +# serverAddr: argocd-server.argocd.svc:443 +# insecure: true +# plainText: false +# credentials: +# source: Secret +# secretRef: +# namespace: crossplane +# name: argocd-secret +# key: authToken +# +#--- +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: prd-cluster +# labels: +# purpose: prd +#spec: +# forProvider: +# name: prd-cluster +# config: +# kubeconfigSecretRef: +# name: prod-kubeconfig +# namespace: crossplane +# key: kubeconfig +# providerConfigRef: +# name: argocd-provider From c6fde4ad402673075d071ae4ba166ee317bedd60 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:52:59 -0500 Subject: [PATCH 0874/1058] update --- infra/argocd/templates/crossplane-config.yaml | 132 +++++++++--------- 1 file changed, 66 insertions(+), 66 deletions(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 4a50b51..064ea4e 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -1,66 +1,66 @@ -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: argocd-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: argocd-secret -# data: -# - secretKey: authToken -# remoteRef: -# key: kv/argocd/provider-argocd -# property: token -# -#--- -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: prod-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: prod-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/prd -# property: kubeconfig -# -#--- -#apiVersion: argocd.crossplane.io/v1alpha1 -#kind: ProviderConfig -#metadata: -# name: argocd-provider -#spec: -# serverAddr: argocd-server.argocd.svc:443 -# insecure: true -# plainText: false -# credentials: -# source: Secret -# secretRef: -# namespace: crossplane -# name: argocd-secret -# key: authToken -# -#--- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: prd-cluster -# labels: -# purpose: prd -#spec: -# forProvider: -# name: prd-cluster -# config: -# kubeconfigSecretRef: -# name: prod-kubeconfig -# namespace: crossplane -# key: kubeconfig -# providerConfigRef: -# name: argocd-provider +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-crossplane-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-crossplane-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: prod-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: prod-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/prd + property: kubeconfig + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + namespace: crossplane + name: argocd-crossplane-secret + key: authToken + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: prd-cluster + labels: + purpose: prd +spec: + forProvider: + name: prd-cluster + config: + kubeconfigSecretRef: + name: prod-kubeconfig + namespace: crossplane + key: kubeconfig + providerConfigRef: + name: argocd-provider From c14346bb2e47f6db109eb2efee4699173c85dfb6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:57:07 -0500 Subject: [PATCH 0875/1058] update --- infra/argocd/templates/crossplane-config.yaml | 34 +------------------ infra/crossplane/templates/argocd.yaml | 33 ++++++++++++++++++ 2 files changed, 34 insertions(+), 33 deletions(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 064ea4e..55e7d39 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -1,22 +1,5 @@ apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret -metadata: - name: argocd-crossplane-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-crossplane-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret metadata: name: prod-kubeconfig spec: @@ -31,22 +14,6 @@ spec: key: kv/argocd/prd property: kubeconfig ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: crossplane - name: argocd-crossplane-secret - key: authToken - --- apiVersion: cluster.argocd.crossplane.io/v1alpha1 kind: Cluster @@ -64,3 +31,4 @@ spec: key: kubeconfig providerConfigRef: name: argocd-provider + namespace: crossplane diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index f607167..7f84bbf 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -4,3 +4,36 @@ metadata: name: provider-argocd spec: package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-crossplane-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-crossplane-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + namespace: crossplane + name: argocd-crossplane-secret + key: authToken From ced106bf3a4aa2255740f2f9371d121da6f34bb8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 05:58:52 -0500 Subject: [PATCH 0876/1058] update --- infra/argocd/templates/crossplane-config.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 55e7d39..c2dfadb 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -27,7 +27,6 @@ spec: config: kubeconfigSecretRef: name: prod-kubeconfig - namespace: crossplane key: kubeconfig providerConfigRef: name: argocd-provider From fe2f50f35117fd8bc5caa3456dbcb4f2d782b794 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:00:50 -0500 Subject: [PATCH 0877/1058] update --- infra/argocd/templates/crossplane-config.yaml | 33 ++++++++++++++++++- infra/crossplane/templates/argocd.yaml | 33 ------------------- 2 files changed, 32 insertions(+), 34 deletions(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index c2dfadb..2b645fd 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -30,4 +30,35 @@ spec: key: kubeconfig providerConfigRef: name: argocd-provider - namespace: crossplane + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-crossplane-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-crossplane-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + name: argocd-crossplane-secret + key: authToken diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 7f84bbf..f607167 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -4,36 +4,3 @@ metadata: name: provider-argocd spec: package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-crossplane-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-crossplane-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: crossplane - name: argocd-crossplane-secret - key: authToken From 756744c37921039e77d70f595e7851376e9bb7e6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:03:10 -0500 Subject: [PATCH 0878/1058] update --- infra/argocd/templates/crossplane-config.yaml | 128 +++++++++--------- 1 file changed, 64 insertions(+), 64 deletions(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 2b645fd..1ced9c7 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -1,64 +1,64 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: prod-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: prod-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/prd - property: kubeconfig - ---- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: prd-cluster - labels: - purpose: prd -spec: - forProvider: - name: prd-cluster - config: - kubeconfigSecretRef: - name: prod-kubeconfig - key: kubeconfig - providerConfigRef: - name: argocd-provider - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-crossplane-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-crossplane-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - name: argocd-crossplane-secret - key: authToken +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: prod-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: prod-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/prd +# property: kubeconfig +# +#--- +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: prd-cluster +# labels: +# purpose: prd +#spec: +# forProvider: +# name: prd-cluster +# config: +# kubeconfigSecretRef: +# name: prod-kubeconfig +# key: kubeconfig +# providerConfigRef: +# name: argocd-provider +# +#--- +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: argocd-crossplane-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: argocd-crossplane-secret +# data: +# - secretKey: authToken +# remoteRef: +# key: kv/argocd/provider-argocd +# property: token +# +#--- +#apiVersion: argocd.crossplane.io/v1alpha1 +#kind: ProviderConfig +#metadata: +# name: argocd-provider +#spec: +# serverAddr: argocd-server.argocd.svc:443 +# insecure: true +# plainText: false +# credentials: +# source: Secret +# secretRef: +# name: argocd-crossplane-secret +# key: authToken From 5a936831f7182d1464c6c5b979a3196e02d363c8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:06:54 -0500 Subject: [PATCH 0879/1058] update --- infra/argocd/templates/crossplane-config.yaml | 128 +++++++++--------- 1 file changed, 64 insertions(+), 64 deletions(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 1ced9c7..2b645fd 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -1,64 +1,64 @@ -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: prod-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: prod-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/prd -# property: kubeconfig -# -#--- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: prd-cluster -# labels: -# purpose: prd -#spec: -# forProvider: -# name: prd-cluster -# config: -# kubeconfigSecretRef: -# name: prod-kubeconfig -# key: kubeconfig -# providerConfigRef: -# name: argocd-provider -# -#--- -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: argocd-crossplane-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: argocd-crossplane-secret -# data: -# - secretKey: authToken -# remoteRef: -# key: kv/argocd/provider-argocd -# property: token -# -#--- -#apiVersion: argocd.crossplane.io/v1alpha1 -#kind: ProviderConfig -#metadata: -# name: argocd-provider -#spec: -# serverAddr: argocd-server.argocd.svc:443 -# insecure: true -# plainText: false -# credentials: -# source: Secret -# secretRef: -# name: argocd-crossplane-secret -# key: authToken +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: prod-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: prod-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/prd + property: kubeconfig + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: prd-cluster + labels: + purpose: prd +spec: + forProvider: + name: prd-cluster + config: + kubeconfigSecretRef: + name: prod-kubeconfig + key: kubeconfig + providerConfigRef: + name: argocd-provider + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-crossplane-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-crossplane-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + name: argocd-crossplane-secret + key: authToken From e8665c437915bc05a15b056351e0cd597fec76cc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:08:36 -0500 Subject: [PATCH 0880/1058] update --- infra/argocd/templates/crossplane-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 2b645fd..415e382 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -60,5 +60,6 @@ spec: credentials: source: Secret secretRef: + namespace: argocd name: argocd-crossplane-secret key: authToken From b0e955a8af84f83cce153928861e6612f63bb785 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:10:14 -0500 Subject: [PATCH 0881/1058] update --- infra/argocd/templates/crossplane-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 415e382..c1b1d7d 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -11,6 +11,7 @@ spec: data: - secretKey: kubeconfig remoteRef: + namespace: argocd key: kv/argocd/prd property: kubeconfig From 177e6740d54127f6a55c654ffaea8b9861180cd2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:12:08 -0500 Subject: [PATCH 0882/1058] update --- infra/argocd/templates/crossplane-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index c1b1d7d..83a2486 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -29,6 +29,7 @@ spec: kubeconfigSecretRef: name: prod-kubeconfig key: kubeconfig + namespace: argocd providerConfigRef: name: argocd-provider From 4dd69bac83e693519421c2c56ae82264eea7d9aa Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:12:19 -0500 Subject: [PATCH 0883/1058] update --- infra/argocd/templates/crossplane-config.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index 83a2486..bda6fe8 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -11,7 +11,6 @@ spec: data: - secretKey: kubeconfig remoteRef: - namespace: argocd key: kv/argocd/prd property: kubeconfig From d616df5b1bdc6377931a697113dd4278c24796e7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:14:45 -0500 Subject: [PATCH 0884/1058] update --- infra/argocd/templates/crossplane-config.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index bda6fe8..f21db97 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -31,6 +31,7 @@ spec: namespace: argocd providerConfigRef: name: argocd-provider + namespace: argocd --- apiVersion: external-secrets.io/v1beta1 From 6638751ee8e0fde94f448bf30632f9c8c8f380ac Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:16:49 -0500 Subject: [PATCH 0885/1058] update --- infra/argocd/templates/crossplane-config.yaml | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml index f21db97..00ae018 100644 --- a/infra/argocd/templates/crossplane-config.yaml +++ b/infra/argocd/templates/crossplane-config.yaml @@ -15,23 +15,23 @@ spec: property: kubeconfig --- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: prd-cluster - labels: - purpose: prd -spec: - forProvider: - name: prd-cluster - config: - kubeconfigSecretRef: - name: prod-kubeconfig - key: kubeconfig - namespace: argocd - providerConfigRef: - name: argocd-provider - namespace: argocd +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: prd-cluster +# labels: +# purpose: prd +#spec: +# forProvider: +# name: prd-cluster +# config: +# kubeconfigSecretRef: +# name: prod-kubeconfig +# key: kubeconfig +# namespace: argocd +# providerConfigRef: +# name: argocd-provider +# namespace: argocd --- apiVersion: external-secrets.io/v1beta1 From 72903cb7ccb9d3963d198fe58dcc6d14b9c530c1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:17:54 -0500 Subject: [PATCH 0886/1058] update --- infra/argocd/templates/crossplane-config.yaml | 67 ------------------ infra/crossplane/templates/argocd.yaml | 68 +++++++++++++++++++ 2 files changed, 68 insertions(+), 67 deletions(-) delete mode 100644 infra/argocd/templates/crossplane-config.yaml diff --git a/infra/argocd/templates/crossplane-config.yaml b/infra/argocd/templates/crossplane-config.yaml deleted file mode 100644 index 00ae018..0000000 --- a/infra/argocd/templates/crossplane-config.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: prod-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: prod-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/prd - property: kubeconfig - ---- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: prd-cluster -# labels: -# purpose: prd -#spec: -# forProvider: -# name: prd-cluster -# config: -# kubeconfigSecretRef: -# name: prod-kubeconfig -# key: kubeconfig -# namespace: argocd -# providerConfigRef: -# name: argocd-provider -# namespace: argocd - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-crossplane-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-crossplane-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: argocd - name: argocd-crossplane-secret - key: authToken diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index f607167..ddf4dd8 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -4,3 +4,71 @@ metadata: name: provider-argocd spec: package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: prod-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: prod-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/prd + property: kubeconfig + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: prd-cluster + labels: + purpose: prd +spec: + forProvider: + name: prd-cluster + config: + kubeconfigSecretRef: + name: prod-kubeconfig + key: kubeconfig + namespace: crossplane + providerConfigRef: + name: argocd-provider + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-crossplane-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-crossplane-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + namespace: crossplane + name: argocd-crossplane-secret + key: authToken From febe9fbdf53125761de3b4edfc1da777fc62062d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:19:53 -0500 Subject: [PATCH 0887/1058] update --- infra/crossplane/templates/argocd.yaml | 72 +++++++++++++------------- 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index ddf4dd8..95275e6 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -5,6 +5,23 @@ metadata: spec: package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret @@ -22,41 +39,6 @@ spec: key: kv/argocd/prd property: kubeconfig ---- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: prd-cluster - labels: - purpose: prd -spec: - forProvider: - name: prd-cluster - config: - kubeconfigSecretRef: - name: prod-kubeconfig - key: kubeconfig - namespace: crossplane - providerConfigRef: - name: argocd-provider - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-crossplane-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-crossplane-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - --- apiVersion: argocd.crossplane.io/v1alpha1 kind: ProviderConfig @@ -70,5 +52,23 @@ spec: source: Secret secretRef: namespace: crossplane - name: argocd-crossplane-secret + name: argocd-secret key: authToken + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: prd-cluster + labels: + purpose: prd +spec: + forProvider: + name: prd-cluster + config: + kubeconfigSecretRef: + name: prod-kubeconfig + namespace: crossplane + key: kubeconfig + providerConfigRef: + name: argocd-provider From 0f30f72039c870ab7dd9aab42496a5d582166501 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:21:12 -0500 Subject: [PATCH 0888/1058] update --- infra/crossplane/templates/argocd.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 95275e6..452648d 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -59,12 +59,12 @@ spec: apiVersion: cluster.argocd.crossplane.io/v1alpha1 kind: Cluster metadata: - name: prd-cluster + name: prd labels: purpose: prd spec: forProvider: - name: prd-cluster + name: prd config: kubeconfigSecretRef: name: prod-kubeconfig From e7f600bb8035c3efd68261158312f0ceef1d0fde Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 20 May 2025 06:24:31 -0500 Subject: [PATCH 0889/1058] update --- infra/crossplane/templates/argocd.yaml | 148 ++++++++++++------------- 1 file changed, 74 insertions(+), 74 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 452648d..5e0bc70 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -1,74 +1,74 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-argocd -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: prod-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: prod-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/prd - property: kubeconfig - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: crossplane - name: argocd-secret - key: authToken - ---- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: prd - labels: - purpose: prd -spec: - forProvider: - name: prd - config: - kubeconfigSecretRef: - name: prod-kubeconfig - namespace: crossplane - key: kubeconfig - providerConfigRef: - name: argocd-provider +#apiVersion: pkg.crossplane.io/v1 +#kind: Provider +#metadata: +# name: provider-argocd +#spec: +# package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 +# +#--- +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: argocd-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: argocd-secret +# data: +# - secretKey: authToken +# remoteRef: +# key: kv/argocd/provider-argocd +# property: token +# +#--- +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: prod-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: prod-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/prd +# property: kubeconfig +# +#--- +#apiVersion: argocd.crossplane.io/v1alpha1 +#kind: ProviderConfig +#metadata: +# name: argocd-provider +#spec: +# serverAddr: argocd-server.argocd.svc:443 +# insecure: true +# plainText: false +# credentials: +# source: Secret +# secretRef: +# namespace: crossplane +# name: argocd-secret +# key: authToken +# +#--- +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: prd +# labels: +# purpose: prd +#spec: +# forProvider: +# name: prd +# config: +# kubeconfigSecretRef: +# name: prod-kubeconfig +# namespace: crossplane +# key: kubeconfig +# providerConfigRef: +# name: argocd-provider From 8d86bd83e32801d18c38daff2e7d944442860e25 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 21 May 2025 05:12:27 -0500 Subject: [PATCH 0890/1058] update --- infra/crossplane/templates/argocd.yaml | 113 ++++++++++++------------- 1 file changed, 56 insertions(+), 57 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 5e0bc70..668fb57 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -1,60 +1,59 @@ -#apiVersion: pkg.crossplane.io/v1 -#kind: Provider -#metadata: -# name: provider-argocd -#spec: -# package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 -# -#--- -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: argocd-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: argocd-secret -# data: -# - secretKey: authToken -# remoteRef: -# key: kv/argocd/provider-argocd -# property: token -# -#--- -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: prod-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: prod-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/prd -# property: kubeconfig -# -#--- -#apiVersion: argocd.crossplane.io/v1alpha1 -#kind: ProviderConfig -#metadata: -# name: argocd-provider -#spec: -# serverAddr: argocd-server.argocd.svc:443 -# insecure: true -# plainText: false -# credentials: -# source: Secret -# secretRef: -# namespace: crossplane -# name: argocd-secret -# key: authToken -# +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-argocd +spec: + package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: prod-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: prod-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/prd + property: kubeconfig + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + namespace: crossplane + name: argocd-secret + key: authToken #--- #apiVersion: cluster.argocd.crossplane.io/v1alpha1 #kind: Cluster From 124da56e0ac4c9ae15941cc31fec797ef498aec3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 21 May 2025 05:26:10 -0500 Subject: [PATCH 0891/1058] update --- infra/crossplane/templates/argocd.yaml | 112 ++++++++++++------------- 1 file changed, 56 insertions(+), 56 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 668fb57..19b4b60 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -1,59 +1,59 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-argocd -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-secret - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: prod-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: prod-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/prd - property: kubeconfig - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: crossplane - name: argocd-secret - key: authToken +#apiVersion: pkg.crossplane.io/v1 +#kind: Provider +#metadata: +# name: provider-argocd +#spec: +# package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 +# +#--- +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: argocd-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: argocd-secret +# data: +# - secretKey: authToken +# remoteRef: +# key: kv/argocd/provider-argocd +# property: token +# +#--- +#apiVersion: external-secrets.io/v1beta1 +#kind: ExternalSecret +#metadata: +# name: prod-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: prod-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/prd +# property: kubeconfig +# +#--- +#apiVersion: argocd.crossplane.io/v1alpha1 +#kind: ProviderConfig +#metadata: +# name: argocd-provider +#spec: +# serverAddr: argocd-server.argocd.svc:443 +# insecure: true +# plainText: false +# credentials: +# source: Secret +# secretRef: +# namespace: crossplane +# name: argocd-secret +# key: authToken #--- #apiVersion: cluster.argocd.crossplane.io/v1alpha1 #kind: Cluster From bf76abaf8327d57b11624b4078d9211f44a31b50 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 21 May 2025 05:28:04 -0500 Subject: [PATCH 0892/1058] update --- infra/crossplane/templates/argocd.yaml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index 19b4b60..bf31720 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -1,10 +1,9 @@ -#apiVersion: pkg.crossplane.io/v1 -#kind: Provider -#metadata: -# name: provider-argocd -#spec: -# package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 -# +apiVersion: pkg.crossplane.io/v1 +kind: Provider +metadata: + name: provider-argocd +spec: + package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 #--- #apiVersion: external-secrets.io/v1beta1 #kind: ExternalSecret From 5580b7dfd017ca9b7c8c1a41e68c8c62581bbc1e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 21 May 2025 05:30:03 -0500 Subject: [PATCH 0893/1058] update --- infra/argocd/templates/argocd-crossplane.yaml | 66 +++++++++++++++++++ infra/crossplane/templates/argocd.yaml | 66 ------------------- 2 files changed, 66 insertions(+), 66 deletions(-) create mode 100644 infra/argocd/templates/argocd-crossplane.yaml diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml new file mode 100644 index 0000000..4148018 --- /dev/null +++ b/infra/argocd/templates/argocd-crossplane.yaml @@ -0,0 +1,66 @@ +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: argocd-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: argocd-secret + data: + - secretKey: authToken + remoteRef: + key: kv/argocd/provider-argocd + property: token + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: prod-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: prod-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/prd + property: kubeconfig + +--- +apiVersion: argocd.crossplane.io/v1alpha1 +kind: ProviderConfig +metadata: + name: argocd-provider +spec: + serverAddr: argocd-server.argocd.svc:443 + insecure: true + plainText: false + credentials: + source: Secret + secretRef: + namespace: argocd + name: argocd-secret + key: authToken + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: prd + labels: + purpose: prd +spec: + forProvider: + name: prd + config: + kubeconfigSecretRef: + name: prod-kubeconfig + namespace: argocd + key: kubeconfig + providerConfigRef: + name: argocd-provider diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index bf31720..f607167 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -4,69 +4,3 @@ metadata: name: provider-argocd spec: package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 -#--- -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: argocd-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: argocd-secret -# data: -# - secretKey: authToken -# remoteRef: -# key: kv/argocd/provider-argocd -# property: token -# -#--- -#apiVersion: external-secrets.io/v1beta1 -#kind: ExternalSecret -#metadata: -# name: prod-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: prod-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/prd -# property: kubeconfig -# -#--- -#apiVersion: argocd.crossplane.io/v1alpha1 -#kind: ProviderConfig -#metadata: -# name: argocd-provider -#spec: -# serverAddr: argocd-server.argocd.svc:443 -# insecure: true -# plainText: false -# credentials: -# source: Secret -# secretRef: -# namespace: crossplane -# name: argocd-secret -# key: authToken -#--- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: prd -# labels: -# purpose: prd -#spec: -# forProvider: -# name: prd -# config: -# kubeconfigSecretRef: -# name: prod-kubeconfig -# namespace: crossplane -# key: kubeconfig -# providerConfigRef: -# name: argocd-provider From 607e02496aa679b2c55c927516f340aa8d776e43 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 21 May 2025 05:30:50 -0500 Subject: [PATCH 0894/1058] update --- infra/argocd/templates/argocd-crossplane.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml index 4148018..5a94aae 100644 --- a/infra/argocd/templates/argocd-crossplane.yaml +++ b/infra/argocd/templates/argocd-crossplane.yaml @@ -1,13 +1,13 @@ apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: - name: argocd-secret + name: argocd-secret-crossplane spec: secretStoreRef: name: vault kind: ClusterSecretStore target: - name: argocd-secret + name: argocd-secret-crossplane data: - secretKey: authToken remoteRef: @@ -44,7 +44,7 @@ spec: source: Secret secretRef: namespace: argocd - name: argocd-secret + name: argocd-secret-crossplane key: authToken --- From 19a8b05fae3eefd8a361811981a7f8cc1c10f798 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 21 May 2025 05:53:00 -0500 Subject: [PATCH 0895/1058] update --- infra/argocd/templates/argocd-crossplane.yaml | 35 +++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml index 5a94aae..cc33157 100644 --- a/infra/argocd/templates/argocd-crossplane.yaml +++ b/infra/argocd/templates/argocd-crossplane.yaml @@ -64,3 +64,38 @@ spec: key: kubeconfig providerConfigRef: name: argocd-provider + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: dev-kubeconfig +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: dev-kubeconfig + data: + - secretKey: kubeconfig + remoteRef: + key: kv/argocd/dev + property: kubeconfig + +--- +apiVersion: cluster.argocd.crossplane.io/v1alpha1 +kind: Cluster +metadata: + name: dev + labels: + purpose: dev +spec: + forProvider: + name: dev + config: + kubeconfigSecretRef: + name: dev-kubeconfig + namespace: argocd + key: kubeconfig + providerConfigRef: + name: argocd-provider From a7be2b0b74cca64e088db327baf9bc46843e8ee5 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Thu, 22 May 2025 06:03:15 +0000 Subject: [PATCH 0896/1058] Update Helm release gitlab-runner to v0.77.2 --- dmz/gitlab-runner/Chart.yaml | 4 ++-- master/gitlab-runner/Chart.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/gitlab-runner/Chart.yaml b/dmz/gitlab-runner/Chart.yaml index 35d92ec..542b033 100644 --- a/dmz/gitlab-runner/Chart.yaml +++ b/dmz/gitlab-runner/Chart.yaml @@ -8,8 +8,8 @@ appVersion: 0.0.1 dependencies: - name: gitlab-runner repository: https://charts.gitlab.io/ - version: 0.69.0 + version: 0.77.2 - name: gitlab-runner repository: https://charts.gitlab.io/ - version: 0.69.0 + version: 0.77.2 alias: personal diff --git a/master/gitlab-runner/Chart.yaml b/master/gitlab-runner/Chart.yaml index f64e829..2915b96 100644 --- a/master/gitlab-runner/Chart.yaml +++ b/master/gitlab-runner/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: gitlab-runner repository: https://charts.gitlab.io/ - version: 0.69.0 + version: 0.77.2 From 0d5a6996150a81be8a9bb318cc315703f463cee7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 May 2025 07:47:17 -0500 Subject: [PATCH 0897/1058] update --- .../templates/proxmoxBackupServer.yaml | 131 +++++++++++++++++ infra/crossplane/templates/tofu.yml | 135 +----------------- 2 files changed, 132 insertions(+), 134 deletions(-) create mode 100644 infra/crossplane/templates/proxmoxBackupServer.yaml diff --git a/infra/crossplane/templates/proxmoxBackupServer.yaml b/infra/crossplane/templates/proxmoxBackupServer.yaml new file mode 100644 index 0000000..99c7a21 --- /dev/null +++ b/infra/crossplane/templates/proxmoxBackupServer.yaml @@ -0,0 +1,131 @@ +apiVersion: opentofu.upbound.io/v1beta1 +kind: Workspace +metadata: + name: proxmoxBackupServer + annotations: + crossplane.io/external-name: proxmoxBackupServer +spec: + forProvider: + source: Inline + env: + - name: TF_VAR_pm_api_url + secretKeyRef: + namespace: crossplane + name: proxmox-secret + key: pm_api_url + - name: TF_VAR_pm_password + secretKeyRef: + namespace: crossplane + name: proxmox-secret + key: pm_password + - name: TF_VAR_pm_user + secretKeyRef: + namespace: crossplane + name: proxmox-secret + key: pm_user + module: | + + provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false + } + + variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string + } + + variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string + } + + variable "pm_user" { + description = "Username to Proxmox provider" + type = string + } + + locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + format = "raw" + dnsserver = "192.168.10.1" + vlan = 21 + proxmoxBackup = { + tags = "Proxmox" + count = 1 + name = ["Proxmox-BackupServer"] + cores = 2 + memory = "4096" + drive = 1024 + storage = "domains" + node = ["mothership"] + ip = ["250"] + } + } + + resource "proxmox_vm_qemu" "proxmoxBackup" { + count = local.proxmoxBackup.count + ciuser = "administrator" + vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" + name = local.proxmoxBackup.name[count.index] + target_node = local.proxmoxBackup.node[count.index] + clone = local.template + tags = local.proxmoxBackup.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.proxmoxBackup.cores + sockets = 1 + cpu_type = "host" + memory = local.proxmoxBackup.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.proxmoxBackup.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.proxmoxBackup.drive + format = local.format + storage = local.proxmoxBackup.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.proxmoxBackup.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver + } + + writeConnectionSecretToRef: + namespace: crossplane + name: opentofu-workspace-example-inline diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index 02540df..df6a530 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -55,140 +55,7 @@ spec: required_providers { proxmox = { source = "Telmate/proxmox" - version = "3.0.1-rc8" + version = "3.0.1-rc9" } } } - ---- -#apiVersion: opentofu.upbound.io/v1beta1 -#kind: Workspace -#metadata: -# name: test-vm -# annotations: -# crossplane.io/external-name: test -#spec: -# forProvider: -# source: Inline -# env: -# - name: TF_VAR_pm_api_url -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_api_url -# - name: TF_VAR_pm_password -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_password -# - name: TF_VAR_pm_user -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_user -# module: | -# -# provider "proxmox" { -# pm_parallel = 1 -# pm_tls_insecure = true -# pm_api_url = var.pm_api_url -# pm_user = var.pm_user -# pm_password = var.pm_password -# pm_debug = false -# } -# -# variable "pm_api_url" { -# description = "API URL to Proxmox provider" -# type = string -# } -# -# variable "pm_password" { -# description = "Passowrd to Proxmox provider" -# type = string -# } -# -# variable "pm_user" { -# description = "Username to Proxmox provider" -# type = string -# } -# -# locals { -# sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" -# template = "Debian12-Template" -# format = "raw" -# dnsserver = "192.168.10.1" -# vlan = 10 -# testVM = { -# tags = "test" -# count = 1 -# name = ["test-server"] -# cores = 2 -# memory = "4096" -# drive = 20 -# storage = "cache-domains" -# node = ["mothership"] -# ip = ["99"] -# } -# } -# -# resource "proxmox_vm_qemu" "testVM" { -# count = local.testVM.count -# ciuser = "administrator" -# vmid = "${local.vlan}${local.testVM.ip[count.index]}" -# name = local.testVM.name[count.index] -# target_node = local.testVM.node[count.index] -# clone = local.template -# tags = local.testVM.tags -# qemu_os = "l26" -# full_clone = true -# os_type = "cloud-init" -# agent = 1 -# cores = local.testVM.cores -# sockets = 1 -# cpu_type = "host" -# memory = local.testVM.memory -# scsihw = "virtio-scsi-pci" -# #bootdisk = "scsi0" -# boot = "order=virtio0" -# onboot = true -# sshkeys = local.sshkeys -# vga { -# type = "serial0" -# } -# serial { -# id = 0 -# type = "socket" -# } -# disks { -# ide { -# ide2 { -# cloudinit { -# storage = local.testVM.storage -# } -# } -# } -# virtio { -# virtio0 { -# disk { -# size = local.testVM.drive -# format = local.format -# storage = local.testVM.storage -# } -# } -# } -# } -# network { -# id = 0 -# model = "virtio" -# bridge = "vmbr0" -# tag = local.vlan -# } -# #Cloud Init Settings -# ipconfig0 = "ip=192.168.${local.vlan}.${local.testVM.ip[count.index]}/24,gw=192.168.${local.vlan}.1" -# searchdomain = "durp.loc" -# nameserver = local.dnsserver -# } -# -# writeConnectionSecretToRef: -# namespace: crossplane -# name: opentofu-workspace-example-inline From 355c88159710a19f072a08e3d4052bb86d39f42b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 May 2025 07:50:40 -0500 Subject: [PATCH 0898/1058] update --- dev/cert-manager/templates/secretvault.yaml | 2 +- dev/external-dns/templates/secrets.yaml | 2 +- dev/vault/templates/secret-store.yaml | 2 +- dmz/cert-manager/templates/secretvault.yaml | 2 +- dmz/crowdsec/templates/secrets.yaml | 2 +- dmz/external-dns/templates/secrets.yaml | 2 +- dmz/gitlab-runner/templates/secrets.yaml | 4 ++-- dmz/internalproxy/templates/ollama.yaml | 2 +- dmz/longhorn/templates/secrets.yaml | 2 +- dmz/traefik/templates/secrets.yaml | 2 +- dmz/vault/templates/secret-store.yaml | 2 +- infra/argocd/templates/argocd-crossplane.yaml | 6 +++--- infra/argocd/templates/argocd.yaml | 2 +- infra/authentik/templates/secrets.yaml | 2 +- infra/bitwarden/templates/secrets.yaml | 2 +- infra/cert-manager/templates/secretvault.yaml | 2 +- infra/crossplane/templates/gitlab.yml | 2 +- infra/crossplane/templates/tofu.yml | 2 +- infra/longhorn/templates/secrets.yaml | 2 +- infra/nebula-sync/templates/secrets.yaml | 2 +- infra/octopus-agent/templates/secret.yaml | 2 +- infra/octopusdeploy/templates/secrets.yaml | 10 +++++----- infra/openclarity/templates/secret.yaml | 2 +- infra/renovate/templates/secrets.yaml | 2 +- infra/renovate/values.yaml | 2 +- infra/vault/templates/secret-store.yaml | 2 +- master/argocd/templates/secrets.yaml | 2 +- master/authentik/templates/secrets.yaml | 2 +- master/bitwarden/templates/secrets.yaml | 2 +- master/cert-manager/templates/sealedsecret.yaml | 2 +- master/crossplane/templates/gitlab.yml | 2 +- master/durpapi/templates/secrets.yaml | 2 +- master/durpot/templates/secrets.yaml | 2 +- master/external-dns/templates/secrets.yaml | 2 +- master/gitlab-runner/templates/secrets.yaml | 2 +- master/internalproxy/templates/ollama.yaml | 2 +- master/krakend/templates/secrets.yaml | 2 +- .../templates/grafana-secrets-sealed.yaml | 4 ++-- master/longhorn/templates/secrets.yaml | 2 +- master/open-webui/templates/secrets.yaml | 2 +- master/vault/templates/secret-store.yaml | 2 +- prd/cert-manager/templates/secretvault.yaml | 2 +- prd/external-dns/templates/secrets.yaml | 2 +- prd/vault/templates/secret-store.yaml | 2 +- 44 files changed, 52 insertions(+), 52 deletions(-) diff --git a/dev/cert-manager/templates/secretvault.yaml b/dev/cert-manager/templates/secretvault.yaml index f15a739..11c82bc 100644 --- a/dev/cert-manager/templates/secretvault.yaml +++ b/dev/cert-manager/templates/secretvault.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: cloudflare-api-token-secret diff --git a/dev/external-dns/templates/secrets.yaml b/dev/external-dns/templates/secrets.yaml index 0420a5d..60f7466 100644 --- a/dev/external-dns/templates/secrets.yaml +++ b/dev/external-dns/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: external-dns-secret diff --git a/dev/vault/templates/secret-store.yaml b/dev/vault/templates/secret-store.yaml index 0486cfd..c48e52f 100644 --- a/dev/vault/templates/secret-store.yaml +++ b/dev/vault/templates/secret-store.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: name: vault diff --git a/dmz/cert-manager/templates/secretvault.yaml b/dmz/cert-manager/templates/secretvault.yaml index f15a739..11c82bc 100644 --- a/dmz/cert-manager/templates/secretvault.yaml +++ b/dmz/cert-manager/templates/secretvault.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: cloudflare-api-token-secret diff --git a/dmz/crowdsec/templates/secrets.yaml b/dmz/crowdsec/templates/secrets.yaml index 7eff904..dfef6d6 100644 --- a/dmz/crowdsec/templates/secrets.yaml +++ b/dmz/crowdsec/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: enroll-key diff --git a/dmz/external-dns/templates/secrets.yaml b/dmz/external-dns/templates/secrets.yaml index 0420a5d..60f7466 100644 --- a/dmz/external-dns/templates/secrets.yaml +++ b/dmz/external-dns/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: external-dns-secret diff --git a/dmz/gitlab-runner/templates/secrets.yaml b/dmz/gitlab-runner/templates/secrets.yaml index cad8394..2098738 100644 --- a/dmz/gitlab-runner/templates/secrets.yaml +++ b/dmz/gitlab-runner/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: gitlab-secret @@ -27,7 +27,7 @@ metadata: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: gitlab-secret-personal diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index d336026..9141647 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: ollama-secret diff --git a/dmz/longhorn/templates/secrets.yaml b/dmz/longhorn/templates/secrets.yaml index 5acb5c1..e3d18af 100644 --- a/dmz/longhorn/templates/secrets.yaml +++ b/dmz/longhorn/templates/secrets.yaml @@ -5,7 +5,7 @@ metadata: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: external-longhorn-backup-token-secret diff --git a/dmz/traefik/templates/secrets.yaml b/dmz/traefik/templates/secrets.yaml index 4d72356..413afbe 100644 --- a/dmz/traefik/templates/secrets.yaml +++ b/dmz/traefik/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: crowdsec-lapi-key diff --git a/dmz/vault/templates/secret-store.yaml b/dmz/vault/templates/secret-store.yaml index 0486cfd..c48e52f 100644 --- a/dmz/vault/templates/secret-store.yaml +++ b/dmz/vault/templates/secret-store.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: name: vault diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml index cc33157..9732b44 100644 --- a/infra/argocd/templates/argocd-crossplane.yaml +++ b/infra/argocd/templates/argocd-crossplane.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: argocd-secret-crossplane @@ -15,7 +15,7 @@ spec: property: token --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: prod-kubeconfig @@ -66,7 +66,7 @@ spec: name: argocd-provider --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: dev-kubeconfig diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 683db03..54e36bd 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -21,7 +21,7 @@ spec: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: vault-argocd diff --git a/infra/authentik/templates/secrets.yaml b/infra/authentik/templates/secrets.yaml index 6778128..df9f37e 100644 --- a/infra/authentik/templates/secrets.yaml +++ b/infra/authentik/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: authentik-secret diff --git a/infra/bitwarden/templates/secrets.yaml b/infra/bitwarden/templates/secrets.yaml index 494c0db..45e2d64 100644 --- a/infra/bitwarden/templates/secrets.yaml +++ b/infra/bitwarden/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: bitwarden-secret diff --git a/infra/cert-manager/templates/secretvault.yaml b/infra/cert-manager/templates/secretvault.yaml index 0a5da62..241e9a6 100644 --- a/infra/cert-manager/templates/secretvault.yaml +++ b/infra/cert-manager/templates/secretvault.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: cloudflare-api-token-secret diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml index fb72271..34bb93e 100644 --- a/infra/crossplane/templates/gitlab.yml +++ b/infra/crossplane/templates/gitlab.yml @@ -11,7 +11,7 @@ metadata: name: vault --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: gitlab-secret diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index df6a530..ddc50a8 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -6,7 +6,7 @@ spec: package: xpkg.upbound.io/upbound/provider-opentofu:v0 --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: proxmox-secret diff --git a/infra/longhorn/templates/secrets.yaml b/infra/longhorn/templates/secrets.yaml index 5acb5c1..e3d18af 100644 --- a/infra/longhorn/templates/secrets.yaml +++ b/infra/longhorn/templates/secrets.yaml @@ -5,7 +5,7 @@ metadata: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: external-longhorn-backup-token-secret diff --git a/infra/nebula-sync/templates/secrets.yaml b/infra/nebula-sync/templates/secrets.yaml index 3b88885..3ab65df 100644 --- a/infra/nebula-sync/templates/secrets.yaml +++ b/infra/nebula-sync/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: nebula-sync-secret diff --git a/infra/octopus-agent/templates/secret.yaml b/infra/octopus-agent/templates/secret.yaml index 68ca864..50a87d8 100644 --- a/infra/octopus-agent/templates/secret.yaml +++ b/infra/octopus-agent/templates/secret.yaml @@ -5,7 +5,7 @@ metadata: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: agent-token diff --git a/infra/octopusdeploy/templates/secrets.yaml b/infra/octopusdeploy/templates/secrets.yaml index 517f019..686a346 100644 --- a/infra/octopusdeploy/templates/secrets.yaml +++ b/infra/octopusdeploy/templates/secrets.yaml @@ -5,7 +5,7 @@ metadata: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: octopusdeploy-adminpassword @@ -23,7 +23,7 @@ spec: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: octopusdeploy-adminusername @@ -41,7 +41,7 @@ spec: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: octopusdeploy-connectionstring @@ -59,7 +59,7 @@ spec: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: octopusdeploy-masterkey @@ -77,7 +77,7 @@ spec: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: octopusdeploy-sapassword diff --git a/infra/openclarity/templates/secret.yaml b/infra/openclarity/templates/secret.yaml index 6c9a2aa..51ba410 100644 --- a/infra/openclarity/templates/secret.yaml +++ b/infra/openclarity/templates/secret.yaml @@ -5,7 +5,7 @@ metadata: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: openclarity-postgres-secret diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index f458d29..f4ac24c 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -4,7 +4,7 @@ metadata: name: vault --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: renovate-config-secret diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index f982da3..b14286c 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -305,7 +305,7 @@ renovate: # -- Create extra manifests via values. Would be passed through `tpl` for templating extraObjects: [] # extraObjects: - # - apiVersion: external-secrets.io/v1beta1 + # - apiVersion: external-secrets.io/v1 # kind: ExternalSecret # metadata: # name: '{{ include "renovate.fullname" . }}-token' diff --git a/infra/vault/templates/secret-store.yaml b/infra/vault/templates/secret-store.yaml index 1094e59..f17884e 100644 --- a/infra/vault/templates/secret-store.yaml +++ b/infra/vault/templates/secret-store.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: name: vault diff --git a/master/argocd/templates/secrets.yaml b/master/argocd/templates/secrets.yaml index baeaaee..ee58a80 100644 --- a/master/argocd/templates/secrets.yaml +++ b/master/argocd/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: vault-argocd diff --git a/master/authentik/templates/secrets.yaml b/master/authentik/templates/secrets.yaml index 07b7747..52df8b1 100644 --- a/master/authentik/templates/secrets.yaml +++ b/master/authentik/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: authentik-secret diff --git a/master/bitwarden/templates/secrets.yaml b/master/bitwarden/templates/secrets.yaml index 7a8d858..a5a9e44 100644 --- a/master/bitwarden/templates/secrets.yaml +++ b/master/bitwarden/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: bitwarden-secret diff --git a/master/cert-manager/templates/sealedsecret.yaml b/master/cert-manager/templates/sealedsecret.yaml index 37a2e92..a85ea4e 100644 --- a/master/cert-manager/templates/sealedsecret.yaml +++ b/master/cert-manager/templates/sealedsecret.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: cloudflare-api-token-secret diff --git a/master/crossplane/templates/gitlab.yml b/master/crossplane/templates/gitlab.yml index 3a20b9c..0211b82 100644 --- a/master/crossplane/templates/gitlab.yml +++ b/master/crossplane/templates/gitlab.yml @@ -6,7 +6,7 @@ spec: package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: gitlab-secret diff --git a/master/durpapi/templates/secrets.yaml b/master/durpapi/templates/secrets.yaml index 0157b5b..36946e9 100644 --- a/master/durpapi/templates/secrets.yaml +++ b/master/durpapi/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: durpapi-secret diff --git a/master/durpot/templates/secrets.yaml b/master/durpot/templates/secrets.yaml index 792f909..f51273c 100644 --- a/master/durpot/templates/secrets.yaml +++ b/master/durpot/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: durpot-secert diff --git a/master/external-dns/templates/secrets.yaml b/master/external-dns/templates/secrets.yaml index 142c03a..ba603aa 100644 --- a/master/external-dns/templates/secrets.yaml +++ b/master/external-dns/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: external-dns-secret diff --git a/master/gitlab-runner/templates/secrets.yaml b/master/gitlab-runner/templates/secrets.yaml index 784ef11..3477844 100644 --- a/master/gitlab-runner/templates/secrets.yaml +++ b/master/gitlab-runner/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: gitlab-secret diff --git a/master/internalproxy/templates/ollama.yaml b/master/internalproxy/templates/ollama.yaml index 75e8691..b845cac 100644 --- a/master/internalproxy/templates/ollama.yaml +++ b/master/internalproxy/templates/ollama.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: ollama-secret diff --git a/master/krakend/templates/secrets.yaml b/master/krakend/templates/secrets.yaml index 2eb1a9d..073e590 100644 --- a/master/krakend/templates/secrets.yaml +++ b/master/krakend/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: krakend-secret diff --git a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml index 716d4e5..7f01c1e 100644 --- a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml +++ b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: vault-grafana-oauth @@ -20,7 +20,7 @@ spec: --- -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: vault-admin-credentials diff --git a/master/longhorn/templates/secrets.yaml b/master/longhorn/templates/secrets.yaml index c10ab89..4bbdc35 100644 --- a/master/longhorn/templates/secrets.yaml +++ b/master/longhorn/templates/secrets.yaml @@ -1,5 +1,5 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: external-longhorn-backup-token-secret diff --git a/master/open-webui/templates/secrets.yaml b/master/open-webui/templates/secrets.yaml index 1fe6fec..c8a22bc 100644 --- a/master/open-webui/templates/secrets.yaml +++ b/master/open-webui/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: open-webui-secret diff --git a/master/vault/templates/secret-store.yaml b/master/vault/templates/secret-store.yaml index e7cca3a..e1feef8 100644 --- a/master/vault/templates/secret-store.yaml +++ b/master/vault/templates/secret-store.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: name: vault diff --git a/prd/cert-manager/templates/secretvault.yaml b/prd/cert-manager/templates/secretvault.yaml index f15a739..11c82bc 100644 --- a/prd/cert-manager/templates/secretvault.yaml +++ b/prd/cert-manager/templates/secretvault.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: cloudflare-api-token-secret diff --git a/prd/external-dns/templates/secrets.yaml b/prd/external-dns/templates/secrets.yaml index 0420a5d..60f7466 100644 --- a/prd/external-dns/templates/secrets.yaml +++ b/prd/external-dns/templates/secrets.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: external-dns-secret diff --git a/prd/vault/templates/secret-store.yaml b/prd/vault/templates/secret-store.yaml index 0486cfd..c48e52f 100644 --- a/prd/vault/templates/secret-store.yaml +++ b/prd/vault/templates/secret-store.yaml @@ -1,4 +1,4 @@ -apiVersion: external-secrets.io/v1beta1 +apiVersion: external-secrets.io/v1 kind: ClusterSecretStore metadata: name: vault From 5250e5ad1577fdd4e0f82be5ccf210d6c8844a52 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 May 2025 07:53:10 -0500 Subject: [PATCH 0899/1058] update --- infra/crossplane/templates/proxmoxBackupServer.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/crossplane/templates/proxmoxBackupServer.yaml b/infra/crossplane/templates/proxmoxBackupServer.yaml index 99c7a21..380a710 100644 --- a/infra/crossplane/templates/proxmoxBackupServer.yaml +++ b/infra/crossplane/templates/proxmoxBackupServer.yaml @@ -1,9 +1,9 @@ apiVersion: opentofu.upbound.io/v1beta1 kind: Workspace metadata: - name: proxmoxBackupServer + name: proxmoxbackupserver annotations: - crossplane.io/external-name: proxmoxBackupServer + crossplane.io/external-name: proxmoxbackupserver spec: forProvider: source: Inline From a6037a6cc15412846756eaf67c1a5f1d177cb245 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 May 2025 07:55:29 -0500 Subject: [PATCH 0900/1058] update --- .../templates/proxmoxBackupServer.yaml | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/infra/crossplane/templates/proxmoxBackupServer.yaml b/infra/crossplane/templates/proxmoxBackupServer.yaml index 380a710..4b23983 100644 --- a/infra/crossplane/templates/proxmoxBackupServer.yaml +++ b/infra/crossplane/templates/proxmoxBackupServer.yaml @@ -50,8 +50,6 @@ spec: } locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" format = "raw" dnsserver = "192.168.10.1" vlan = 21 @@ -74,10 +72,8 @@ spec: vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" name = local.proxmoxBackup.name[count.index] target_node = local.proxmoxBackup.node[count.index] - clone = local.template tags = local.proxmoxBackup.tags qemu_os = "l26" - full_clone = true os_type = "cloud-init" agent = 1 cores = local.proxmoxBackup.cores @@ -88,7 +84,6 @@ spec: #bootdisk = "scsi0" boot = "order=virtio0" onboot = true - sshkeys = local.sshkeys vga { type = "serial0" } @@ -97,13 +92,6 @@ spec: type = "socket" } disks { - ide { - ide2 { - cloudinit { - storage = local.proxmoxBackup.storage - } - } - } virtio { virtio0 { disk { @@ -120,10 +108,6 @@ spec: bridge = "vmbr0" tag = local.vlan } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.proxmoxBackup.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver } writeConnectionSecretToRef: From 1d167cd62c8f39da645ef93f925e42d380bfdc48 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 25 May 2025 07:57:33 -0500 Subject: [PATCH 0901/1058] update --- .../templates/proxmoxBackupServer.yaml | 230 +++++++++--------- 1 file changed, 115 insertions(+), 115 deletions(-) diff --git a/infra/crossplane/templates/proxmoxBackupServer.yaml b/infra/crossplane/templates/proxmoxBackupServer.yaml index 4b23983..736754c 100644 --- a/infra/crossplane/templates/proxmoxBackupServer.yaml +++ b/infra/crossplane/templates/proxmoxBackupServer.yaml @@ -1,115 +1,115 @@ -apiVersion: opentofu.upbound.io/v1beta1 -kind: Workspace -metadata: - name: proxmoxbackupserver - annotations: - crossplane.io/external-name: proxmoxbackupserver -spec: - forProvider: - source: Inline - env: - - name: TF_VAR_pm_api_url - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_api_url - - name: TF_VAR_pm_password - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_password - - name: TF_VAR_pm_user - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_user - module: | - - provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false - } - - variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string - } - - variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string - } - - variable "pm_user" { - description = "Username to Proxmox provider" - type = string - } - - locals { - format = "raw" - dnsserver = "192.168.10.1" - vlan = 21 - proxmoxBackup = { - tags = "Proxmox" - count = 1 - name = ["Proxmox-BackupServer"] - cores = 2 - memory = "4096" - drive = 1024 - storage = "domains" - node = ["mothership"] - ip = ["250"] - } - } - - resource "proxmox_vm_qemu" "proxmoxBackup" { - count = local.proxmoxBackup.count - ciuser = "administrator" - vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" - name = local.proxmoxBackup.name[count.index] - target_node = local.proxmoxBackup.node[count.index] - tags = local.proxmoxBackup.tags - qemu_os = "l26" - os_type = "cloud-init" - agent = 1 - cores = local.proxmoxBackup.cores - sockets = 1 - cpu_type = "host" - memory = local.proxmoxBackup.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - virtio { - virtio0 { - disk { - size = local.proxmoxBackup.drive - format = local.format - storage = local.proxmoxBackup.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - } - - writeConnectionSecretToRef: - namespace: crossplane - name: opentofu-workspace-example-inline +#apiVersion: opentofu.upbound.io/v1beta1 +#kind: Workspace +#metadata: +# name: proxmoxbackupserver +# annotations: +# crossplane.io/external-name: proxmoxbackupserver +#spec: +# forProvider: +# source: Inline +# env: +# - name: TF_VAR_pm_api_url +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_api_url +# - name: TF_VAR_pm_password +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_password +# - name: TF_VAR_pm_user +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_user +# module: | +# +# provider "proxmox" { +# pm_parallel = 1 +# pm_tls_insecure = true +# pm_api_url = var.pm_api_url +# pm_user = var.pm_user +# pm_password = var.pm_password +# pm_debug = false +# } +# +# variable "pm_api_url" { +# description = "API URL to Proxmox provider" +# type = string +# } +# +# variable "pm_password" { +# description = "Passowrd to Proxmox provider" +# type = string +# } +# +# variable "pm_user" { +# description = "Username to Proxmox provider" +# type = string +# } +# +# locals { +# format = "raw" +# dnsserver = "192.168.10.1" +# vlan = 21 +# proxmoxBackup = { +# tags = "Proxmox" +# count = 1 +# name = ["Proxmox-BackupServer"] +# cores = 2 +# memory = "4096" +# drive = 1024 +# storage = "domains" +# node = ["mothership"] +# ip = ["250"] +# } +# } +# +# resource "proxmox_vm_qemu" "proxmoxBackup" { +# count = local.proxmoxBackup.count +# ciuser = "administrator" +# vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" +# name = local.proxmoxBackup.name[count.index] +# target_node = local.proxmoxBackup.node[count.index] +# tags = local.proxmoxBackup.tags +# qemu_os = "l26" +# os_type = "cloud-init" +# agent = 1 +# cores = local.proxmoxBackup.cores +# sockets = 1 +# cpu_type = "host" +# memory = local.proxmoxBackup.memory +# scsihw = "virtio-scsi-pci" +# #bootdisk = "scsi0" +# boot = "order=virtio0" +# onboot = true +# vga { +# type = "serial0" +# } +# serial { +# id = 0 +# type = "socket" +# } +# disks { +# virtio { +# virtio0 { +# disk { +# size = local.proxmoxBackup.drive +# format = local.format +# storage = local.proxmoxBackup.storage +# } +# } +# } +# } +# network { +# id = 0 +# model = "virtio" +# bridge = "vmbr0" +# tag = local.vlan +# } +# } +# +# writeConnectionSecretToRef: +# namespace: crossplane +# name: opentofu-workspace-example-inline From 6257d7a1d409acaaf9784d79997df6f1333bb94f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 26 May 2025 05:57:56 -0500 Subject: [PATCH 0902/1058] update --- .../templates/proxmoxBackupServer.yaml | 230 +++++++++--------- 1 file changed, 115 insertions(+), 115 deletions(-) diff --git a/infra/crossplane/templates/proxmoxBackupServer.yaml b/infra/crossplane/templates/proxmoxBackupServer.yaml index 736754c..4b23983 100644 --- a/infra/crossplane/templates/proxmoxBackupServer.yaml +++ b/infra/crossplane/templates/proxmoxBackupServer.yaml @@ -1,115 +1,115 @@ -#apiVersion: opentofu.upbound.io/v1beta1 -#kind: Workspace -#metadata: -# name: proxmoxbackupserver -# annotations: -# crossplane.io/external-name: proxmoxbackupserver -#spec: -# forProvider: -# source: Inline -# env: -# - name: TF_VAR_pm_api_url -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_api_url -# - name: TF_VAR_pm_password -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_password -# - name: TF_VAR_pm_user -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_user -# module: | -# -# provider "proxmox" { -# pm_parallel = 1 -# pm_tls_insecure = true -# pm_api_url = var.pm_api_url -# pm_user = var.pm_user -# pm_password = var.pm_password -# pm_debug = false -# } -# -# variable "pm_api_url" { -# description = "API URL to Proxmox provider" -# type = string -# } -# -# variable "pm_password" { -# description = "Passowrd to Proxmox provider" -# type = string -# } -# -# variable "pm_user" { -# description = "Username to Proxmox provider" -# type = string -# } -# -# locals { -# format = "raw" -# dnsserver = "192.168.10.1" -# vlan = 21 -# proxmoxBackup = { -# tags = "Proxmox" -# count = 1 -# name = ["Proxmox-BackupServer"] -# cores = 2 -# memory = "4096" -# drive = 1024 -# storage = "domains" -# node = ["mothership"] -# ip = ["250"] -# } -# } -# -# resource "proxmox_vm_qemu" "proxmoxBackup" { -# count = local.proxmoxBackup.count -# ciuser = "administrator" -# vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" -# name = local.proxmoxBackup.name[count.index] -# target_node = local.proxmoxBackup.node[count.index] -# tags = local.proxmoxBackup.tags -# qemu_os = "l26" -# os_type = "cloud-init" -# agent = 1 -# cores = local.proxmoxBackup.cores -# sockets = 1 -# cpu_type = "host" -# memory = local.proxmoxBackup.memory -# scsihw = "virtio-scsi-pci" -# #bootdisk = "scsi0" -# boot = "order=virtio0" -# onboot = true -# vga { -# type = "serial0" -# } -# serial { -# id = 0 -# type = "socket" -# } -# disks { -# virtio { -# virtio0 { -# disk { -# size = local.proxmoxBackup.drive -# format = local.format -# storage = local.proxmoxBackup.storage -# } -# } -# } -# } -# network { -# id = 0 -# model = "virtio" -# bridge = "vmbr0" -# tag = local.vlan -# } -# } -# -# writeConnectionSecretToRef: -# namespace: crossplane -# name: opentofu-workspace-example-inline +apiVersion: opentofu.upbound.io/v1beta1 +kind: Workspace +metadata: + name: proxmoxbackupserver + annotations: + crossplane.io/external-name: proxmoxbackupserver +spec: + forProvider: + source: Inline + env: + - name: TF_VAR_pm_api_url + secretKeyRef: + namespace: crossplane + name: proxmox-secret + key: pm_api_url + - name: TF_VAR_pm_password + secretKeyRef: + namespace: crossplane + name: proxmox-secret + key: pm_password + - name: TF_VAR_pm_user + secretKeyRef: + namespace: crossplane + name: proxmox-secret + key: pm_user + module: | + + provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false + } + + variable "pm_api_url" { + description = "API URL to Proxmox provider" + type = string + } + + variable "pm_password" { + description = "Passowrd to Proxmox provider" + type = string + } + + variable "pm_user" { + description = "Username to Proxmox provider" + type = string + } + + locals { + format = "raw" + dnsserver = "192.168.10.1" + vlan = 21 + proxmoxBackup = { + tags = "Proxmox" + count = 1 + name = ["Proxmox-BackupServer"] + cores = 2 + memory = "4096" + drive = 1024 + storage = "domains" + node = ["mothership"] + ip = ["250"] + } + } + + resource "proxmox_vm_qemu" "proxmoxBackup" { + count = local.proxmoxBackup.count + ciuser = "administrator" + vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" + name = local.proxmoxBackup.name[count.index] + target_node = local.proxmoxBackup.node[count.index] + tags = local.proxmoxBackup.tags + qemu_os = "l26" + os_type = "cloud-init" + agent = 1 + cores = local.proxmoxBackup.cores + sockets = 1 + cpu_type = "host" + memory = local.proxmoxBackup.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + virtio { + virtio0 { + disk { + size = local.proxmoxBackup.drive + format = local.format + storage = local.proxmoxBackup.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + } + + writeConnectionSecretToRef: + namespace: crossplane + name: opentofu-workspace-example-inline From dcc3ae6aa34b3a3f560d5024aa497a3a91468d76 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 26 May 2025 06:05:33 -0500 Subject: [PATCH 0903/1058] update --- .../templates/proxmoxBackupServer.yaml | 230 +++++++++--------- 1 file changed, 115 insertions(+), 115 deletions(-) diff --git a/infra/crossplane/templates/proxmoxBackupServer.yaml b/infra/crossplane/templates/proxmoxBackupServer.yaml index 4b23983..736754c 100644 --- a/infra/crossplane/templates/proxmoxBackupServer.yaml +++ b/infra/crossplane/templates/proxmoxBackupServer.yaml @@ -1,115 +1,115 @@ -apiVersion: opentofu.upbound.io/v1beta1 -kind: Workspace -metadata: - name: proxmoxbackupserver - annotations: - crossplane.io/external-name: proxmoxbackupserver -spec: - forProvider: - source: Inline - env: - - name: TF_VAR_pm_api_url - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_api_url - - name: TF_VAR_pm_password - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_password - - name: TF_VAR_pm_user - secretKeyRef: - namespace: crossplane - name: proxmox-secret - key: pm_user - module: | - - provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false - } - - variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string - } - - variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string - } - - variable "pm_user" { - description = "Username to Proxmox provider" - type = string - } - - locals { - format = "raw" - dnsserver = "192.168.10.1" - vlan = 21 - proxmoxBackup = { - tags = "Proxmox" - count = 1 - name = ["Proxmox-BackupServer"] - cores = 2 - memory = "4096" - drive = 1024 - storage = "domains" - node = ["mothership"] - ip = ["250"] - } - } - - resource "proxmox_vm_qemu" "proxmoxBackup" { - count = local.proxmoxBackup.count - ciuser = "administrator" - vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" - name = local.proxmoxBackup.name[count.index] - target_node = local.proxmoxBackup.node[count.index] - tags = local.proxmoxBackup.tags - qemu_os = "l26" - os_type = "cloud-init" - agent = 1 - cores = local.proxmoxBackup.cores - sockets = 1 - cpu_type = "host" - memory = local.proxmoxBackup.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - virtio { - virtio0 { - disk { - size = local.proxmoxBackup.drive - format = local.format - storage = local.proxmoxBackup.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - } - - writeConnectionSecretToRef: - namespace: crossplane - name: opentofu-workspace-example-inline +#apiVersion: opentofu.upbound.io/v1beta1 +#kind: Workspace +#metadata: +# name: proxmoxbackupserver +# annotations: +# crossplane.io/external-name: proxmoxbackupserver +#spec: +# forProvider: +# source: Inline +# env: +# - name: TF_VAR_pm_api_url +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_api_url +# - name: TF_VAR_pm_password +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_password +# - name: TF_VAR_pm_user +# secretKeyRef: +# namespace: crossplane +# name: proxmox-secret +# key: pm_user +# module: | +# +# provider "proxmox" { +# pm_parallel = 1 +# pm_tls_insecure = true +# pm_api_url = var.pm_api_url +# pm_user = var.pm_user +# pm_password = var.pm_password +# pm_debug = false +# } +# +# variable "pm_api_url" { +# description = "API URL to Proxmox provider" +# type = string +# } +# +# variable "pm_password" { +# description = "Passowrd to Proxmox provider" +# type = string +# } +# +# variable "pm_user" { +# description = "Username to Proxmox provider" +# type = string +# } +# +# locals { +# format = "raw" +# dnsserver = "192.168.10.1" +# vlan = 21 +# proxmoxBackup = { +# tags = "Proxmox" +# count = 1 +# name = ["Proxmox-BackupServer"] +# cores = 2 +# memory = "4096" +# drive = 1024 +# storage = "domains" +# node = ["mothership"] +# ip = ["250"] +# } +# } +# +# resource "proxmox_vm_qemu" "proxmoxBackup" { +# count = local.proxmoxBackup.count +# ciuser = "administrator" +# vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" +# name = local.proxmoxBackup.name[count.index] +# target_node = local.proxmoxBackup.node[count.index] +# tags = local.proxmoxBackup.tags +# qemu_os = "l26" +# os_type = "cloud-init" +# agent = 1 +# cores = local.proxmoxBackup.cores +# sockets = 1 +# cpu_type = "host" +# memory = local.proxmoxBackup.memory +# scsihw = "virtio-scsi-pci" +# #bootdisk = "scsi0" +# boot = "order=virtio0" +# onboot = true +# vga { +# type = "serial0" +# } +# serial { +# id = 0 +# type = "socket" +# } +# disks { +# virtio { +# virtio0 { +# disk { +# size = local.proxmoxBackup.drive +# format = local.format +# storage = local.proxmoxBackup.storage +# } +# } +# } +# } +# network { +# id = 0 +# model = "virtio" +# bridge = "vmbr0" +# tag = local.vlan +# } +# } +# +# writeConnectionSecretToRef: +# namespace: crossplane +# name: opentofu-workspace-example-inline From 6791096b3a7dd0a037381d89a115df1b0b8566b1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 26 May 2025 06:07:04 -0500 Subject: [PATCH 0904/1058] update --- infra/crossplane/Chart.yaml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/infra/crossplane/Chart.yaml b/infra/crossplane/Chart.yaml index 8e724e3..3f7f266 100644 --- a/infra/crossplane/Chart.yaml +++ b/infra/crossplane/Chart.yaml @@ -5,8 +5,7 @@ type: application version: 0.1.0 appVersion: "1.16.0" - -dependencies: - - name: crossplane - repository: https://charts.crossplane.io/stable - version: 1.19.1 +#dependencies: +# - name: crossplane +# repository: https://charts.crossplane.io/stable +# version: 1.19.1 From 25664f4df4975fa6a2c0664a33e384dcb7156be9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 26 May 2025 06:10:29 -0500 Subject: [PATCH 0905/1058] update --- infra/argocd/templates/argocd-crossplane.yaml | 202 +++++++++--------- 1 file changed, 101 insertions(+), 101 deletions(-) diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml index 9732b44..54ac407 100644 --- a/infra/argocd/templates/argocd-crossplane.yaml +++ b/infra/argocd/templates/argocd-crossplane.yaml @@ -1,101 +1,101 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: argocd-secret-crossplane -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: argocd-secret-crossplane - data: - - secretKey: authToken - remoteRef: - key: kv/argocd/provider-argocd - property: token - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: prod-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: prod-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/prd - property: kubeconfig - ---- -apiVersion: argocd.crossplane.io/v1alpha1 -kind: ProviderConfig -metadata: - name: argocd-provider -spec: - serverAddr: argocd-server.argocd.svc:443 - insecure: true - plainText: false - credentials: - source: Secret - secretRef: - namespace: argocd - name: argocd-secret-crossplane - key: authToken - ---- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: prd - labels: - purpose: prd -spec: - forProvider: - name: prd - config: - kubeconfigSecretRef: - name: prod-kubeconfig - namespace: argocd - key: kubeconfig - providerConfigRef: - name: argocd-provider - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: dev-kubeconfig -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: dev-kubeconfig - data: - - secretKey: kubeconfig - remoteRef: - key: kv/argocd/dev - property: kubeconfig - ---- -apiVersion: cluster.argocd.crossplane.io/v1alpha1 -kind: Cluster -metadata: - name: dev - labels: - purpose: dev -spec: - forProvider: - name: dev - config: - kubeconfigSecretRef: - name: dev-kubeconfig - namespace: argocd - key: kubeconfig - providerConfigRef: - name: argocd-provider +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: argocd-secret-crossplane +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: argocd-secret-crossplane +# data: +# - secretKey: authToken +# remoteRef: +# key: kv/argocd/provider-argocd +# property: token +# +#--- +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: prod-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: prod-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/prd +# property: kubeconfig +# +#--- +#apiVersion: argocd.crossplane.io/v1alpha1 +#kind: ProviderConfig +#metadata: +# name: argocd-provider +#spec: +# serverAddr: argocd-server.argocd.svc:443 +# insecure: true +# plainText: false +# credentials: +# source: Secret +# secretRef: +# namespace: argocd +# name: argocd-secret-crossplane +# key: authToken +# +#--- +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: prd +# labels: +# purpose: prd +#spec: +# forProvider: +# name: prd +# config: +# kubeconfigSecretRef: +# name: prod-kubeconfig +# namespace: argocd +# key: kubeconfig +# providerConfigRef: +# name: argocd-provider +# +#--- +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: dev-kubeconfig +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: dev-kubeconfig +# data: +# - secretKey: kubeconfig +# remoteRef: +# key: kv/argocd/dev +# property: kubeconfig +# +#--- +#apiVersion: cluster.argocd.crossplane.io/v1alpha1 +#kind: Cluster +#metadata: +# name: dev +# labels: +# purpose: dev +#spec: +# forProvider: +# name: dev +# config: +# kubeconfigSecretRef: +# name: dev-kubeconfig +# namespace: argocd +# key: kubeconfig +# providerConfigRef: +# name: argocd-provider From 7c7890933bd16a9adc940cc5ea468a4bc182520b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 26 May 2025 06:17:52 -0500 Subject: [PATCH 0906/1058] update --- infra/crossplane/templates/argocd.yaml | 12 +-- infra/crossplane/templates/gitlab.yml | 84 ++++++++--------- infra/crossplane/templates/tofu.yml | 122 ++++++++++++------------- 3 files changed, 109 insertions(+), 109 deletions(-) diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml index f607167..f7ca6c3 100644 --- a/infra/crossplane/templates/argocd.yaml +++ b/infra/crossplane/templates/argocd.yaml @@ -1,6 +1,6 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-argocd -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 +#apiVersion: pkg.crossplane.io/v1 +#kind: Provider +#metadata: +# name: provider-argocd +#spec: +# package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml index 34bb93e..aa938ac 100644 --- a/infra/crossplane/templates/gitlab.yml +++ b/infra/crossplane/templates/gitlab.yml @@ -1,45 +1,45 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-gitlab -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.10.4 ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: accesstoken - remoteRef: - key: kv/renovate - property: RENOVATE_TOKEN - ---- -apiVersion: gitlab.crossplane.io/v1beta1 -kind: ProviderConfig -metadata: - name: gitlab-provider -spec: - baseURL: https://gitlab.com/ - credentials: - source: Secret - secretRef: - namespace: crossplane - name: gitlab-secret - key: accesstoken +#apiVersion: pkg.crossplane.io/v1 +#kind: Provider +#metadata: +# name: provider-gitlab +#spec: +# package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.10.4 +#--- +#apiVersion: v1 +#kind: ServiceAccount +#metadata: +# name: vault +# +#--- +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: gitlab-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: gitlab-secret +# data: +# - secretKey: accesstoken +# remoteRef: +# key: kv/renovate +# property: RENOVATE_TOKEN +# +#--- +#apiVersion: gitlab.crossplane.io/v1beta1 +#kind: ProviderConfig +#metadata: +# name: gitlab-provider +#spec: +# baseURL: https://gitlab.com/ +# credentials: +# source: Secret +# secretRef: +# namespace: crossplane +# name: gitlab-secret +# key: accesstoken #--- #apiVersion: projects.gitlab.crossplane.io/v1alpha1 #kind: Project diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml index ddc50a8..f8f6094 100644 --- a/infra/crossplane/templates/tofu.yml +++ b/infra/crossplane/templates/tofu.yml @@ -1,61 +1,61 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-opentofu -spec: - package: xpkg.upbound.io/upbound/provider-opentofu:v0 - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: proxmox-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: proxmox-secret - data: - - secretKey: pm_api_url - remoteRef: - key: kv/crossplane/proxmox - property: pm_api_url - - secretKey: pm_password - remoteRef: - key: kv/crossplane/proxmox - property: pm_password - - secretKey: pm_user - remoteRef: - key: kv/crossplane/proxmox - property: pm_user - ---- -apiVersion: opentofu.upbound.io/v1beta1 -kind: ProviderConfig -metadata: - name: default -spec: - #credentials: - # - filename: gcp-credentials.json - # source: Secret - # secretRef: - # namespace: upbound-system - # name: opentofu-gcp-creds - # key: credentials - configuration: | - - // Modules _must_ use remote state. The provider does not persist state. - terraform { - backend "kubernetes" { - secret_suffix = "providerconfig-default" - namespace = "crossplane" - in_cluster_config = true - } - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } - } +#apiVersion: pkg.crossplane.io/v1 +#kind: Provider +#metadata: +# name: provider-opentofu +#spec: +# package: xpkg.upbound.io/upbound/provider-opentofu:v0 +# +#--- +#apiVersion: external-secrets.io/v1 +#kind: ExternalSecret +#metadata: +# name: proxmox-secret +#spec: +# secretStoreRef: +# name: vault +# kind: ClusterSecretStore +# target: +# name: proxmox-secret +# data: +# - secretKey: pm_api_url +# remoteRef: +# key: kv/crossplane/proxmox +# property: pm_api_url +# - secretKey: pm_password +# remoteRef: +# key: kv/crossplane/proxmox +# property: pm_password +# - secretKey: pm_user +# remoteRef: +# key: kv/crossplane/proxmox +# property: pm_user +# +#--- +#apiVersion: opentofu.upbound.io/v1beta1 +#kind: ProviderConfig +#metadata: +# name: default +#spec: +# #credentials: +# # - filename: gcp-credentials.json +# # source: Secret +# # secretRef: +# # namespace: upbound-system +# # name: opentofu-gcp-creds +# # key: credentials +# configuration: | +# +# // Modules _must_ use remote state. The provider does not persist state. +# terraform { +# backend "kubernetes" { +# secret_suffix = "providerconfig-default" +# namespace = "crossplane" +# in_cluster_config = true +# } +# required_providers { +# proxmox = { +# source = "Telmate/proxmox" +# version = "3.0.1-rc9" +# } +# } +# } From b0f6e8ead5872f3da9a2cdc7ac371ed1a6867989 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 26 May 2025 06:18:32 -0500 Subject: [PATCH 0907/1058] update --- infra/argocd/templates/crossplane.yaml | 40 +++++++++++++------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/infra/argocd/templates/crossplane.yaml b/infra/argocd/templates/crossplane.yaml index 11a311a..cf982e5 100644 --- a/infra/argocd/templates/crossplane.yaml +++ b/infra/argocd/templates/crossplane.yaml @@ -1,20 +1,20 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: crossplane - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: infra/crossplane - destination: - namespace: crossplane - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: crossplane +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: infra/crossplane +# destination: +# namespace: crossplane +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true From 4d7c1779c31e6f9774263c5301fe9de70abd7b35 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 27 May 2025 06:02:39 +0000 Subject: [PATCH 0908/1058] Update Helm release crossplane to v1.20.0 --- master/crossplane/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/crossplane/Chart.yaml b/master/crossplane/Chart.yaml index eac3031..e725e88 100644 --- a/master/crossplane/Chart.yaml +++ b/master/crossplane/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: crossplane repository: https://charts.crossplane.io/stable - version: 1.19.1 + version: 1.20.0 From 841e26ba2a039a1dd4bfde55360d18d2244d0533 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 27 May 2025 06:02:50 +0000 Subject: [PATCH 0909/1058] Update Helm release postgresql to v16 --- master/durpapi/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/durpapi/Chart.yaml b/master/durpapi/Chart.yaml index 1c97e4c..da0c67e 100644 --- a/master/durpapi/Chart.yaml +++ b/master/durpapi/Chart.yaml @@ -8,6 +8,6 @@ appVersion: 0.1.0 dependencies: - condition: postgresql.enabled - version: 12.12.* + version: 16.7.* repository: https://charts.bitnami.com/bitnami name: postgresql From 29b87531820e0230a9e4885011c4e30fb05ea120 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 30 May 2025 06:06:21 +0000 Subject: [PATCH 0910/1058] Update Helm release external-dns to v8.8.3 --- dev/external-dns/Chart.yaml | 2 +- dmz/external-dns/Chart.yaml | 2 +- master/external-dns/Chart.yaml | 2 +- prd/external-dns/Chart.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dev/external-dns/Chart.yaml b/dev/external-dns/Chart.yaml index c188f01..bc55d8a 100644 --- a/dev/external-dns/Chart.yaml +++ b/dev/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.2 + version: 8.8.3 diff --git a/dmz/external-dns/Chart.yaml b/dmz/external-dns/Chart.yaml index c188f01..bc55d8a 100644 --- a/dmz/external-dns/Chart.yaml +++ b/dmz/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.2 + version: 8.8.3 diff --git a/master/external-dns/Chart.yaml b/master/external-dns/Chart.yaml index c188f01..bc55d8a 100644 --- a/master/external-dns/Chart.yaml +++ b/master/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.2 + version: 8.8.3 diff --git a/prd/external-dns/Chart.yaml b/prd/external-dns/Chart.yaml index c188f01..bc55d8a 100644 --- a/prd/external-dns/Chart.yaml +++ b/prd/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.2 + version: 8.8.3 From 643c89e794c4b22a7c5651d08313ce47e2ab4cb2 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 30 May 2025 06:06:24 +0000 Subject: [PATCH 0911/1058] Update docker.io/swaggerapi/swagger-ui Docker tag to v5.22.0 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index ea209fe..7cfc06b 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -719,7 +719,7 @@ openclarity: # -- Swagger UI container repository repository: swaggerapi/swagger-ui # -- Swagger UI container tag - tag: v5.21.0 + tag: v5.22.0 # -- Swagger UI image digest. If set will override the tag. digest: "" # -- Swagger UI image pull policy From 51006b03d1a9a5fc29cfcf17ac3902825f6fd16c Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 30 May 2025 06:06:48 +0000 Subject: [PATCH 0912/1058] Update Helm release vault to v0.30.0 --- dev/vault/Chart.yaml | 2 +- dmz/vault/Chart.yaml | 2 +- infra/vault/Chart.yaml | 2 +- master/vault/Chart.yaml | 2 +- prd/vault/Chart.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dev/vault/Chart.yaml b/dev/vault/Chart.yaml index e52029e..412c292 100644 --- a/dev/vault/Chart.yaml +++ b/dev/vault/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: vault repository: https://helm.releases.hashicorp.com - version: 0.29.1 + version: 0.30.0 diff --git a/dmz/vault/Chart.yaml b/dmz/vault/Chart.yaml index e52029e..412c292 100644 --- a/dmz/vault/Chart.yaml +++ b/dmz/vault/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: vault repository: https://helm.releases.hashicorp.com - version: 0.29.1 + version: 0.30.0 diff --git a/infra/vault/Chart.yaml b/infra/vault/Chart.yaml index e52029e..412c292 100644 --- a/infra/vault/Chart.yaml +++ b/infra/vault/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: vault repository: https://helm.releases.hashicorp.com - version: 0.29.1 + version: 0.30.0 diff --git a/master/vault/Chart.yaml b/master/vault/Chart.yaml index 1ad2d4a..412c292 100644 --- a/master/vault/Chart.yaml +++ b/master/vault/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: vault repository: https://helm.releases.hashicorp.com - version: 0.28.1 + version: 0.30.0 diff --git a/prd/vault/Chart.yaml b/prd/vault/Chart.yaml index e52029e..412c292 100644 --- a/prd/vault/Chart.yaml +++ b/prd/vault/Chart.yaml @@ -8,5 +8,5 @@ appVersion: 0.0.1 dependencies: - name: vault repository: https://helm.releases.hashicorp.com - version: 0.29.1 + version: 0.30.0 From 0ef216e92ffba60685cc882208949e943badc5b3 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 30 May 2025 06:07:02 +0000 Subject: [PATCH 0913/1058] Update docker.io/bitnami/postgresql Docker tag to v17 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index ea209fe..76409d0 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -414,7 +414,7 @@ openclarity: # -- Postgresql container repository repository: bitnami/postgresql # -- Postgresql container tag - tag: 16.6.0-debian-12-r1 + tag: 17.5.0-debian-12-r1 # -- Postgresql image digest. If set will override the tag. digest: "" # -- Postgresql container image pull policy From b02f5d3727f933c75dddea2f1316939c37ed3a5c Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 31 May 2025 06:03:06 +0000 Subject: [PATCH 0914/1058] Update Helm release argo-cd to v8 --- infra/argocd/Chart.yaml | 2 +- master/argocd/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/Chart.yaml b/infra/argocd/Chart.yaml index a2c346c..b0f1f3e 100644 --- a/infra/argocd/Chart.yaml +++ b/infra/argocd/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 6.11.1 + version: 8.0.14 diff --git a/master/argocd/Chart.yaml b/master/argocd/Chart.yaml index cdccf8c..8a35f93 100644 --- a/master/argocd/Chart.yaml +++ b/master/argocd/Chart.yaml @@ -9,6 +9,6 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 6.11.1 + version: 8.0.14 From 799a8687ca2a86121e1fdcd161730917f287a95e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 3 Jun 2025 06:07:06 +0000 Subject: [PATCH 0915/1058] Update octopusdeploy-helm Docker tag to v1.4.0 --- infra/octopusdeploy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index ae87b72..1e09604 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: octopusdeploy-helm repository: oci://ghcr.io/octopusdeploy - version: 1.3.1 + version: 1.4.0 From 054ee57e6b69cba2747f04204c42d03bdff1e74b Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 3 Jun 2025 06:07:09 +0000 Subject: [PATCH 0916/1058] Update quay.io/frrouting/frr Docker tag to v9.1.3 --- master/metallb-system/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/metallb-system/values.yaml b/master/metallb-system/values.yaml index 260551d..0c6b1b9 100644 --- a/master/metallb-system/values.yaml +++ b/master/metallb-system/values.yaml @@ -180,7 +180,7 @@ metallb: enabled: true image: repository: quay.io/frrouting/frr - tag: 9.0.2 + tag: 9.1.3 pullPolicy: metricsPort: 7473 resources: {} From 66a63be3a238e285e902a31edea071d1bfece4cb Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 3 Jun 2025 06:07:36 +0000 Subject: [PATCH 0917/1058] Update Helm release kube-prometheus-stack to v72 --- master/kube-prometheus-stack/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/kube-prometheus-stack/Chart.yaml b/master/kube-prometheus-stack/Chart.yaml index ecb4ab2..093c443 100644 --- a/master/kube-prometheus-stack/Chart.yaml +++ b/master/kube-prometheus-stack/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: kube-prometheus-stack repository: https://prometheus-community.github.io/helm-charts - version: 63.1.0 + version: 72.9.1 From 0f038a8bb61472cdcd247c6ccabd894b42efe0ba Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 3 Jun 2025 10:55:37 +0000 Subject: [PATCH 0918/1058] Revert "Merge branch 'renovate/docker.io-bitnami-postgresql-17.x' into 'main'" --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 5a6dab0..7cfc06b 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -414,7 +414,7 @@ openclarity: # -- Postgresql container repository repository: bitnami/postgresql # -- Postgresql container tag - tag: 17.5.0-debian-12-r1 + tag: 16.6.0-debian-12-r1 # -- Postgresql image digest. If set will override the tag. digest: "" # -- Postgresql container image pull policy From ac90414c0671322f0290e28bcffa1a26947eb2dd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 3 Jun 2025 06:06:04 -0500 Subject: [PATCH 0919/1058] update --- infra/octopusdeploy/templates/secrets.yaml | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/infra/octopusdeploy/templates/secrets.yaml b/infra/octopusdeploy/templates/secrets.yaml index 686a346..7f9ec8b 100644 --- a/infra/octopusdeploy/templates/secrets.yaml +++ b/infra/octopusdeploy/templates/secrets.yaml @@ -4,7 +4,6 @@ metadata: name: vault --- - apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -22,7 +21,6 @@ spec: property: adminpassword --- - apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -40,7 +38,6 @@ spec: property: adminusername --- - apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -58,7 +55,6 @@ spec: property: connectionstring --- - apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -76,7 +72,6 @@ spec: property: masterkey --- - apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -92,3 +87,20 @@ spec: remoteRef: key: kv/octopusdeploy property: sapassword + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: octopusdeploy-licensekey +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: octopusdeploy-licensekey + data: + - secretKey: secret + remoteRef: + key: kv/octopusdeploy + property: licensekey From 3b52a06603dbba09d4c1d257ec018e355d87bf05 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 4 Jun 2025 05:39:08 -0500 Subject: [PATCH 0920/1058] update --- infra/octopus-agent/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 48f5a12..fcd156e 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -4,7 +4,7 @@ kubernetes-agent: acceptEula: "Y" serverUrl: "https://octopus.durp.info/" serverCommsAddresses: - - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:8080/" space: "Default" name: "infra" deploymentTarget: From 9ded36aa458ff917088b84157b4a9d5eda16d5c0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 05:18:31 -0500 Subject: [PATCH 0921/1058] update --- infra/octopus-agent/values.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index fcd156e..0107f72 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -3,8 +3,7 @@ kubernetes-agent: bearerTokenSecretName: agent-token acceptEula: "Y" serverUrl: "https://octopus.durp.info/" - serverCommsAddresses: - - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:8080/" + serverCommsAddresses: "{https://octopusdeploy-octopus-deploy-0.octohpusdeploy.svc.cluster.local:10943/,https://octopusdeploy-octopus-deploy-1.octopusdeploy.svc.cluster.local:10943/,https://octopusdeploy-octopus-deploy-2.octopusdeploy.svc.cluster.local:10943/}" space: "Default" name: "infra" deploymentTarget: From ecd5ca51634f8648e510bd1e1a8152514693c72b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 05:21:10 -0500 Subject: [PATCH 0922/1058] update --- infra/octopus-agent/values.yaml | 3 ++- infra/octopusdeploy/Chart.yaml | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 0107f72..48f5a12 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -3,7 +3,8 @@ kubernetes-agent: bearerTokenSecretName: agent-token acceptEula: "Y" serverUrl: "https://octopus.durp.info/" - serverCommsAddresses: "{https://octopusdeploy-octopus-deploy-0.octohpusdeploy.svc.cluster.local:10943/,https://octopusdeploy-octopus-deploy-1.octopusdeploy.svc.cluster.local:10943/,https://octopusdeploy-octopus-deploy-2.octopusdeploy.svc.cluster.local:10943/}" + serverCommsAddresses: + - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" space: "Default" name: "infra" deploymentTarget: diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index 1e09604..ae87b72 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: octopusdeploy-helm repository: oci://ghcr.io/octopusdeploy - version: 1.4.0 + version: 1.3.1 From c8fa9b77ada918ff7bb93ad6f5488ede715979c1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 05:22:13 -0500 Subject: [PATCH 0923/1058] update --- infra/octopusdeploy/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index ae87b72..1e09604 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: octopusdeploy-helm repository: oci://ghcr.io/octopusdeploy - version: 1.3.1 + version: 1.4.0 From b28c7ce8fd4e945b471a14e2ee559be4e39644be Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 05:23:57 -0500 Subject: [PATCH 0924/1058] update --- infra/octopus-agent/values.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 48f5a12..3f6b036 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -4,7 +4,9 @@ kubernetes-agent: acceptEula: "Y" serverUrl: "https://octopus.durp.info/" serverCommsAddresses: - - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy-0.octohpusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy-1.octopusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy-2.octopusdeploy.svc.cluster.local:10943/" space: "Default" name: "infra" deploymentTarget: From b39863dee90d20e2686d91c2bc8e3f36c5010490 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 05:28:48 -0500 Subject: [PATCH 0925/1058] update --- infra/argocd/templates/octopusdeploy.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml index 87d1add..3412681 100644 --- a/infra/argocd/templates/octopusdeploy.yaml +++ b/infra/argocd/templates/octopusdeploy.yaml @@ -20,7 +20,6 @@ spec: - CreateNamespace=true --- - apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -33,7 +32,7 @@ spec: targetRevision: main path: infra/octopus-agent destination: - namespace: octpus-agent + namespace: octopus-agent name: in-cluster syncPolicy: automated: @@ -41,4 +40,3 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true - From 8940086c97be9015793ba9bf13b6a149d8851172 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 06:07:08 -0500 Subject: [PATCH 0926/1058] update --- infra/argocd/templates/octopusdeploy.yaml | 40 +++++++++++------------ 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml index 3412681..9550368 100644 --- a/infra/argocd/templates/octopusdeploy.yaml +++ b/infra/argocd/templates/octopusdeploy.yaml @@ -20,23 +20,23 @@ spec: - CreateNamespace=true --- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: octopusdeploy-agent - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: infra/octopus-agent - destination: - namespace: octopus-agent - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: octopusdeploy-agent +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: infra/octopus-agent +# destination: +# namespace: octopus-agent +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true From d4b0dd3c8012f6af3f9403291fa46d8c47f9a16d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 06:18:46 -0500 Subject: [PATCH 0927/1058] update --- infra/argocd/templates/longhorn.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index 4d9c9f0..3de3059 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -16,6 +16,12 @@ spec: automated: prune: true selfHeal: true + ignoreDifferences: + - group: apiextensions.k8s.io + name: engineimages.longhorn.io + kind: CustomResourceDefinition + jsonPointers: + - /spec/preserveUnknownFields syncOptions: - CreateNamespace=true From 2be77594f0897c66dd3543be4ad5fdbaece05191 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Jun 2025 06:22:58 -0500 Subject: [PATCH 0928/1058] update --- infra/argocd/templates/longhorn.yaml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index 3de3059..e138fcc 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -5,6 +5,11 @@ metadata: namespace: argocd spec: project: default + ignoreDifferences: + - group: engineimages.longhorn.io + jsonPointers: + - /spec/preserveUnknownFields + kind: CustomResourceDefinition source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main @@ -16,12 +21,6 @@ spec: automated: prune: true selfHeal: true - ignoreDifferences: - - group: apiextensions.k8s.io - name: engineimages.longhorn.io - kind: CustomResourceDefinition - jsonPointers: - - /spec/preserveUnknownFields syncOptions: - CreateNamespace=true From 69963d1c2f08b68fcb56ad4346c7b56409f35270 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Jun 2025 05:37:34 -0500 Subject: [PATCH 0929/1058] updateu --- infra/argocd/templates/istio.yaml | 21 ++++++------ infra/argocd/templates/longhorn.yaml | 10 +++--- infra/argocd/templates/octopusdeploy.yaml | 40 +++++++++++------------ 3 files changed, 35 insertions(+), 36 deletions(-) diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index b687887..4d9d6d5 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -18,17 +18,16 @@ spec: topology.istio.io/network: network1 automated: prune: true - selfHeal: true + selfHeal: true syncOptions: - - CreateNamespace=true + - CreateNamespace=true ignoreDifferences: - - group: admissionregistration.k8s.io - kind: ValidatingWebhookConfiguration - jsonPointers: - - /webhooks/0/failurePolicy + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jsonPointers: + - /webhooks/0/failurePolicy --- - apiVersion: argoproj.io/v1alpha1 kind: Application metadata: @@ -53,7 +52,7 @@ spec: syncOptions: - CreateNamespace=true ignoreDifferences: - - group: admissionregistration.k8s.io - kind: ValidatingWebhookConfiguration - jsonPointers: - - /webhooks/0/failurePolicy + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jsonPointers: + - /webhooks/0/failurePolicy diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index e138fcc..33eda6e 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -5,11 +5,6 @@ metadata: namespace: argocd spec: project: default - ignoreDifferences: - - group: engineimages.longhorn.io - jsonPointers: - - /spec/preserveUnknownFields - kind: CustomResourceDefinition source: repoURL: https://gitlab.com/developerdurp/homelab.git targetRevision: main @@ -23,6 +18,11 @@ spec: selfHeal: true syncOptions: - CreateNamespace=true + ignoreDifferences: + - group: engineimages.longhorn.io + jsonPointers: + - /spec/preserveUnknownFields + kind: CustomResourceDefinition --- apiVersion: argoproj.io/v1alpha1 diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml index 9550368..3412681 100644 --- a/infra/argocd/templates/octopusdeploy.yaml +++ b/infra/argocd/templates/octopusdeploy.yaml @@ -20,23 +20,23 @@ spec: - CreateNamespace=true --- -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: octopusdeploy-agent -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: infra/octopus-agent -# destination: -# namespace: octopus-agent -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: octopusdeploy-agent + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/octopus-agent + destination: + namespace: octopus-agent + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 3233a8f7697c0166e801c45bcc5a7c7eee46d9fb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Jun 2025 05:39:40 -0500 Subject: [PATCH 0930/1058] update --- infra/octopus-agent/values.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 3f6b036..48f5a12 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -4,9 +4,7 @@ kubernetes-agent: acceptEula: "Y" serverUrl: "https://octopus.durp.info/" serverCommsAddresses: - - "https://octopusdeploy-octopus-deploy-0.octohpusdeploy.svc.cluster.local:10943/" - - "https://octopusdeploy-octopus-deploy-1.octopusdeploy.svc.cluster.local:10943/" - - "https://octopusdeploy-octopus-deploy-2.octopusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" space: "Default" name: "infra" deploymentTarget: From 6a6bccda43bb7e2cc2b9d4366db3ba7b09de3a68 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Jun 2025 05:45:44 -0500 Subject: [PATCH 0931/1058] update --- infra/octopus-agent/values.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 48f5a12..8af100b 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -4,7 +4,9 @@ kubernetes-agent: acceptEula: "Y" serverUrl: "https://octopus.durp.info/" serverCommsAddresses: - - "https://octopusdeploy-octopus-deploy.octopusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy-0.octopusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy-1.octopusdeploy.svc.cluster.local:10943/" + - "https://octopusdeploy-octopus-deploy-2.octopusdeploy.svc.cluster.local:10943/" space: "Default" name: "infra" deploymentTarget: From 006094410cd3bb9c9af3852f53569fa0487c6dfe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Jun 2025 06:03:53 -0500 Subject: [PATCH 0932/1058] update --- infra/octopus-agent/values.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml index 8af100b..8f262a5 100644 --- a/infra/octopus-agent/values.yaml +++ b/infra/octopus-agent/values.yaml @@ -4,9 +4,9 @@ kubernetes-agent: acceptEula: "Y" serverUrl: "https://octopus.durp.info/" serverCommsAddresses: - - "https://octopusdeploy-octopus-deploy-0.octopusdeploy.svc.cluster.local:10943/" - - "https://octopusdeploy-octopus-deploy-1.octopusdeploy.svc.cluster.local:10943/" - - "https://octopusdeploy-octopus-deploy-2.octopusdeploy.svc.cluster.local:10943/" + - "https://octopus-deploy-node0.octopusdeploy.svc.cluster.local:10943/" + - "https://octopus-deploy-node1.octopusdeploy.svc.cluster.local:10943/" + - "https://octopus-deploy-node2.octopusdeploy.svc.cluster.local:10943/" space: "Default" name: "infra" deploymentTarget: From 9715b9ac8731b3f0d80967199e26b77f4adc3a33 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 8 Jun 2025 06:03:32 +0000 Subject: [PATCH 0933/1058] Update Helm release longhorn to v1.9.0 --- dmz/longhorn/Chart.yaml | 2 +- infra/longhorn/Chart.yaml | 2 +- master/longhorn/Chart.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/longhorn/Chart.yaml b/dmz/longhorn/Chart.yaml index cffddaf..c699fa5 100644 --- a/dmz/longhorn/Chart.yaml +++ b/dmz/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.8.1 + version: 1.9.0 diff --git a/infra/longhorn/Chart.yaml b/infra/longhorn/Chart.yaml index cffddaf..c699fa5 100644 --- a/infra/longhorn/Chart.yaml +++ b/infra/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.8.1 + version: 1.9.0 diff --git a/master/longhorn/Chart.yaml b/master/longhorn/Chart.yaml index 680ec32..2c9fea3 100644 --- a/master/longhorn/Chart.yaml +++ b/master/longhorn/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: longhorn repository: https://charts.longhorn.io - version: 1.8.1 \ No newline at end of file + version: 1.9.0 \ No newline at end of file From 7b188327c9a634155667cdbb456719329f152862 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 8 Jun 2025 06:03:37 +0000 Subject: [PATCH 0934/1058] Update Helm release metallb to v0.15.2 --- dev/metallb-system/Chart.yaml | 2 +- dmz/metallb-system/Chart.yaml | 2 +- infra/metallb-system/Chart.yaml | 2 +- master/metallb-system/Chart.yaml | 2 +- prd/metallb-system/Chart.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dev/metallb-system/Chart.yaml b/dev/metallb-system/Chart.yaml index 4fc684f..c92e842 100644 --- a/dev/metallb-system/Chart.yaml +++ b/dev/metallb-system/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: metallb repository: https://metallb.github.io/metallb - version: 0.14.9 + version: 0.15.2 diff --git a/dmz/metallb-system/Chart.yaml b/dmz/metallb-system/Chart.yaml index 4fc684f..c92e842 100644 --- a/dmz/metallb-system/Chart.yaml +++ b/dmz/metallb-system/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: metallb repository: https://metallb.github.io/metallb - version: 0.14.9 + version: 0.15.2 diff --git a/infra/metallb-system/Chart.yaml b/infra/metallb-system/Chart.yaml index 4fc684f..c92e842 100644 --- a/infra/metallb-system/Chart.yaml +++ b/infra/metallb-system/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: metallb repository: https://metallb.github.io/metallb - version: 0.14.9 + version: 0.15.2 diff --git a/master/metallb-system/Chart.yaml b/master/metallb-system/Chart.yaml index 0f8b8bd..7b97113 100644 --- a/master/metallb-system/Chart.yaml +++ b/master/metallb-system/Chart.yaml @@ -9,5 +9,5 @@ appVersion: "1.16.0" dependencies: - name: metallb repository: https://metallb.github.io/metallb - version: 0.14.9 + version: 0.15.2 diff --git a/prd/metallb-system/Chart.yaml b/prd/metallb-system/Chart.yaml index 4fc684f..c92e842 100644 --- a/prd/metallb-system/Chart.yaml +++ b/prd/metallb-system/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: metallb repository: https://metallb.github.io/metallb - version: 0.14.9 + version: 0.15.2 From e0c303c38b0511dd5bd195495d613c9e1c8bf0c8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 21 Jun 2025 06:03:19 +0000 Subject: [PATCH 0935/1058] Update Helm release base to v1.26.2 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index bc998c9..0703aa9 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.0 + version: 1.26.2 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.0 diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index d619b5e..f8e2b39 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.0 + version: 1.26.2 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.0 From d10f200c09e0bcfa270f2a2a3c50fbef333e42ef Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 21 Jun 2025 06:03:25 +0000 Subject: [PATCH 0936/1058] Update Helm release gateway to v1.26.2 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index bc998c9..7792316 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -14,4 +14,4 @@ dependencies: version: 1.26.0 - name: gateway repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.0 \ No newline at end of file + version: 1.26.2 \ No newline at end of file diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index d619b5e..7c8551b 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -14,4 +14,4 @@ dependencies: version: 1.26.0 - name: gateway repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.0 + version: 1.26.2 From 9a6a16dceee6ac4809a473815124c7a578fa139e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 21 Jun 2025 06:03:29 +0000 Subject: [PATCH 0937/1058] Update Helm release istiod to v1.26.2 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index bc998c9..a8ac2ed 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -11,7 +11,7 @@ dependencies: version: 1.26.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.0 + version: 1.26.2 - name: gateway repository: https://istio-release.storage.googleapis.com/charts version: 1.26.0 \ No newline at end of file diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index d619b5e..597bb12 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -11,7 +11,7 @@ dependencies: version: 1.26.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.0 + version: 1.26.2 - name: gateway repository: https://istio-release.storage.googleapis.com/charts version: 1.26.0 From 6f8db8ccdbe1d1c244dc1ab81a5876ef9c2a4893 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 28 Jun 2025 06:02:32 +0000 Subject: [PATCH 0938/1058] Update Helm release authentik to v2025.6.3 --- infra/authentik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/Chart.yaml b/infra/authentik/Chart.yaml index d5927e6..9055a60 100644 --- a/infra/authentik/Chart.yaml +++ b/infra/authentik/Chart.yaml @@ -9,5 +9,5 @@ appVersion: "1.16.0" dependencies: - name: authentik repository: https://charts.goauthentik.io - version: 2025.4.1 + version: 2025.6.3 From 430c2541e515230a700a3831ec7e0c3f2e571ba6 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 4 Jul 2025 06:02:29 +0000 Subject: [PATCH 0939/1058] Update docker.io/aquasec/trivy Docker tag to v0.64.1 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 7cfc06b..058e996 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -542,7 +542,7 @@ openclarity: # -- Trivy Server container repository repository: aquasec/trivy # -- Trivy Server container tag - tag: 0.62.1 + tag: 0.64.1 # -- Trivy Server image digest. If set will override the tag. digest: "" # -- Trivy Server image pull policy From 520a934cd85b7ab45d13bc2c83e79118ec26a759 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Tue, 8 Jul 2025 06:02:59 +0000 Subject: [PATCH 0940/1058] Update docker.io/swaggerapi/swagger-ui Docker tag to v5.26.2 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 7cfc06b..e09a2c5 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -719,7 +719,7 @@ openclarity: # -- Swagger UI container repository repository: swaggerapi/swagger-ui # -- Swagger UI container tag - tag: v5.22.0 + tag: v5.26.2 # -- Swagger UI image digest. If set will override the tag. digest: "" # -- Swagger UI image pull policy From 4bc076a7152b3b0501ecc906683e7eaeda29282d Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Wed, 9 Jul 2025 06:03:05 +0000 Subject: [PATCH 0941/1058] Update Helm release external-dns to v8.9.2 --- dev/external-dns/Chart.yaml | 2 +- dmz/external-dns/Chart.yaml | 2 +- master/external-dns/Chart.yaml | 2 +- prd/external-dns/Chart.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/dev/external-dns/Chart.yaml b/dev/external-dns/Chart.yaml index bc55d8a..937bc49 100644 --- a/dev/external-dns/Chart.yaml +++ b/dev/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.3 + version: 8.9.2 diff --git a/dmz/external-dns/Chart.yaml b/dmz/external-dns/Chart.yaml index bc55d8a..937bc49 100644 --- a/dmz/external-dns/Chart.yaml +++ b/dmz/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.3 + version: 8.9.2 diff --git a/master/external-dns/Chart.yaml b/master/external-dns/Chart.yaml index bc55d8a..937bc49 100644 --- a/master/external-dns/Chart.yaml +++ b/master/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.3 + version: 8.9.2 diff --git a/prd/external-dns/Chart.yaml b/prd/external-dns/Chart.yaml index bc55d8a..937bc49 100644 --- a/prd/external-dns/Chart.yaml +++ b/prd/external-dns/Chart.yaml @@ -9,4 +9,4 @@ appVersion: 0.0.1 dependencies: - name: external-dns repository: https://charts.bitnami.com/bitnami - version: 8.8.3 + version: 8.9.2 From 02a2f4f7c9ee59cf769bf82402227065bd2a534b Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Fri, 11 Jul 2025 06:03:23 +0000 Subject: [PATCH 0942/1058] Update Helm release argo-cd to v8.1.3 --- infra/argocd/Chart.yaml | 2 +- master/argocd/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/Chart.yaml b/infra/argocd/Chart.yaml index b0f1f3e..8da230c 100644 --- a/infra/argocd/Chart.yaml +++ b/infra/argocd/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 8.0.14 + version: 8.1.3 diff --git a/master/argocd/Chart.yaml b/master/argocd/Chart.yaml index 8a35f93..647c3cf 100644 --- a/master/argocd/Chart.yaml +++ b/master/argocd/Chart.yaml @@ -9,6 +9,6 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 8.0.14 + version: 8.1.3 From 10655e1ad75034c7b1e1fa575664095ab2803b03 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 12 Jul 2025 06:03:23 +0000 Subject: [PATCH 0943/1058] Update Helm release crowdsec to v0.19.4 --- dmz/crowdsec/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/crowdsec/Chart.yaml b/dmz/crowdsec/Chart.yaml index f0b3037..a89fad6 100644 --- a/dmz/crowdsec/Chart.yaml +++ b/dmz/crowdsec/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: crowdsec repository: https://crowdsecurity.github.io/helm-charts - version: 0.19.3 + version: 0.19.4 From e653d41331b911351c052b6f8b831ec46ff0ab8c Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 12 Jul 2025 06:03:26 +0000 Subject: [PATCH 0944/1058] Update Helm release gatekeeper to v3.19.2 --- master/gatekeeper/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/master/gatekeeper/Chart.yaml b/master/gatekeeper/Chart.yaml index 768f053..4269281 100644 --- a/master/gatekeeper/Chart.yaml +++ b/master/gatekeeper/Chart.yaml @@ -8,4 +8,4 @@ appVersion: 0.0.1 dependencies: - name: gatekeeper repository: https://open-policy-agent.github.io/gatekeeper/charts - version: 3.19.1 + version: 3.19.2 From 418b365e2d2ee28f3f5660bfbf7c9dc274c46b7c Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 13 Jul 2025 06:03:03 +0000 Subject: [PATCH 0945/1058] Update docker.io/nginxinc/nginx-unprivileged Docker tag to v1.29.0 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 7cfc06b..2a2340a 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -317,7 +317,7 @@ openclarity: # -- Gateway service container repository repository: nginxinc/nginx-unprivileged # -- Gateway service container tag - tag: 1.28.0 + tag: 1.29.0 # -- Gateway image digest. If set will override the tag. digest: "" # -- Gateway service container pull policy From 471dcf907d6f7cbea77f4d2c02ff201986ac3b65 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 13 Jul 2025 12:28:12 +0000 Subject: [PATCH 0946/1058] Revert "Merge branch 'renovate/authentik-2025.x' into 'main'" --- infra/authentik/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/Chart.yaml b/infra/authentik/Chart.yaml index 9055a60..d5927e6 100644 --- a/infra/authentik/Chart.yaml +++ b/infra/authentik/Chart.yaml @@ -9,5 +9,5 @@ appVersion: "1.16.0" dependencies: - name: authentik repository: https://charts.goauthentik.io - version: 2025.6.3 + version: 2025.4.1 From d99920c95c71272e5ffca3fd7675072aaf6178cb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 18:56:09 -0500 Subject: [PATCH 0947/1058] add n8n --- dmz/internalproxy/templates/n8n.yaml | 72 ++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 dmz/internalproxy/templates/n8n.yaml diff --git a/dmz/internalproxy/templates/n8n.yaml b/dmz/internalproxy/templates/n8n.yaml new file mode 100644 index 0000000..b7f5a19 --- /dev/null +++ b/dmz/internalproxy/templates/n8n.yaml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Service +metadata: + name: n8n +spec: + ports: + - name: app + port: 5678 + protocol: TCP + targetPort: 5678 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: n8n +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 5678 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: n8n-ingress-external +spec: + entryPoints: + - websecure + routes: + - match: Host(`n8n.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: n8n + port: 5678 + scheme: http + tls: + secretName: n8n-external-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: n8n-external-tls +spec: + secretName: n8n-external-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "n8n.durp.info" + dnsNames: + - "n8n.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: n8n-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: n8n.durp.info +spec: + type: ExternalName + externalName: durp.info From 87b1b7dbc2922a89d31fbb83fdc96d67b41c6925 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:00:38 -0500 Subject: [PATCH 0948/1058] update --- dmz/internalproxy/templates/n8n.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/dmz/internalproxy/templates/n8n.yaml b/dmz/internalproxy/templates/n8n.yaml index b7f5a19..1b2b8f1 100644 --- a/dmz/internalproxy/templates/n8n.yaml +++ b/dmz/internalproxy/templates/n8n.yaml @@ -30,7 +30,7 @@ subsets: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: n8n-ingress-external + name: n8n-ingress spec: entryPoints: - websecure @@ -42,16 +42,16 @@ spec: port: 5678 scheme: http tls: - secretName: n8n-external-tls + secretName: n8n-tls --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: n8n-external-tls + name: n8n-tls spec: - secretName: n8n-external-tls + secretName: n8n-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer @@ -64,9 +64,9 @@ spec: kind: Service apiVersion: v1 metadata: - name: n8n-external-dns + name: n8n-dns annotations: - external-dns.alpha.kubernetes.io/hostname: n8n.durp.info + dns.alpha.kubernetes.io/hostname: n8n.durp.info spec: type: ExternalName externalName: durp.info From 2cbc329a394e00b74e47ed7dcc243634e25c864f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:10:25 -0500 Subject: [PATCH 0949/1058] update ip --- dmz/internalproxy/templates/n8n.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/n8n.yaml b/dmz/internalproxy/templates/n8n.yaml index 1b2b8f1..fec81fa 100644 --- a/dmz/internalproxy/templates/n8n.yaml +++ b/dmz/internalproxy/templates/n8n.yaml @@ -19,7 +19,7 @@ metadata: name: n8n subsets: - addresses: - - ip: 192.168.21.200 + - ip: 192.168.20.104 ports: - name: app port: 5678 From 3575572a659a828cb2b934bc0cf28ba3a8674829 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:18:53 -0500 Subject: [PATCH 0950/1058] update argocd --- infra/argocd/values.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index c6ea229..aa08554 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -50,6 +50,13 @@ argo-cd: name: authentik type: oidc id: authentik + resource.inclusions: | + - apiGroups: + - "*" + kinds: + - "Endpoints" + clusters: + - "*" rbac: create: true @@ -60,4 +67,4 @@ argo-cd: server: route: - enabled: false + enabled: false \ No newline at end of file From 687d8907333d687cffdde4e8849b19c9623504c2 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:20:00 -0500 Subject: [PATCH 0951/1058] update --- infra/argocd/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index aa08554..3674498 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -54,7 +54,7 @@ argo-cd: - apiGroups: - "*" kinds: - - "Endpoints" + - "*" clusters: - "*" From 472f4064f5bcff0f05bda992896f23f8faa4e8e6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:30:54 -0500 Subject: [PATCH 0952/1058] update --- infra/argocd/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 3674498..4d22b55 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -50,7 +50,7 @@ argo-cd: name: authentik type: oidc id: authentik - resource.inclusions: | + resource.exclusions: | - apiGroups: - "*" kinds: From e7b90862475bc5c6e745214a42b9d2ee1fc77f0d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:35:31 -0500 Subject: [PATCH 0953/1058] update --- infra/argocd/values.yaml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 4d22b55..88f7c9e 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -50,13 +50,6 @@ argo-cd: name: authentik type: oidc id: authentik - resource.exclusions: | - - apiGroups: - - "*" - kinds: - - "*" - clusters: - - "*" rbac: create: true From 2cd9be813e80e94851beff9051246a7a3c59699f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:40:51 -0500 Subject: [PATCH 0954/1058] update --- infra/argocd/values.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 88f7c9e..3674498 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -50,6 +50,13 @@ argo-cd: name: authentik type: oidc id: authentik + resource.inclusions: | + - apiGroups: + - "*" + kinds: + - "*" + clusters: + - "*" rbac: create: true From 06a0653eecb42df9a7b42a521c97817930488b31 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:43:34 -0500 Subject: [PATCH 0955/1058] update --- infra/argocd/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 3674498..898cead 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -57,6 +57,8 @@ argo-cd: - "*" clusters: - "*" + resource: + - "*" rbac: create: true From d0ef9e7586aa781da6d9bf4913f52e581046d6f8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:50:29 -0500 Subject: [PATCH 0956/1058] update --- infra/argocd/values.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 898cead..327e422 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -52,13 +52,13 @@ argo-cd: id: authentik resource.inclusions: | - apiGroups: - - "*" + - "" kinds: - - "*" + - "Endpoints" clusters: - "*" - resource: - - "*" + namespaces: + - "internalproxy" rbac: create: true From 2be3d656206adcea17c243c29f612d1d0722a02b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:51:54 -0500 Subject: [PATCH 0957/1058] update --- infra/argocd/values.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 327e422..8501b90 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -54,11 +54,11 @@ argo-cd: - apiGroups: - "" kinds: - - "Endpoints" + - "*" clusters: - "*" namespaces: - - "internalproxy" + - "*" rbac: create: true From d30a36c96ebdb3816ed030cdebb394d2c1483557 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 23 Jul 2025 19:57:42 -0500 Subject: [PATCH 0958/1058] update --- infra/argocd/values.yaml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/infra/argocd/values.yaml b/infra/argocd/values.yaml index 8501b90..727777e 100644 --- a/infra/argocd/values.yaml +++ b/infra/argocd/values.yaml @@ -50,15 +50,7 @@ argo-cd: name: authentik type: oidc id: authentik - resource.inclusions: | - - apiGroups: - - "" - kinds: - - "*" - clusters: - - "*" - namespaces: - - "*" + resource.exclusions: "" rbac: create: true From 59a85a10f999300061a02df5770bfbfa4ad3e3b6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 Aug 2025 12:35:04 +0000 Subject: [PATCH 0959/1058] update ssh keys --- ansible/roles/base/files/authorized_keys_user | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ansible/roles/base/files/authorized_keys_user b/ansible/roles/base/files/authorized_keys_user index 4c456ea..49d58bb 100644 --- a/ansible/roles/base/files/authorized_keys_user +++ b/ansible/roles/base/files/authorized_keys_user @@ -1 +1,2 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhPVgL8gXdRTw0E2FvlOUoUI4vd794nB0nZVIsc+U5M +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGilcndatMrXg06VxtNKuIo3scoyyXbYX8Z7cOjeA102AAAABHNzaDo= desktop-arch-09-08-2025-yubikey +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINsbNSZ5Wr+50Ahz+IeZxt6F7gZ6wm1J8uKXQLbdbKFaAAAABHNzaDo= desktop-arch-09-08-2025-yubikeyNano \ No newline at end of file From 89a13d81f1c4b6b2c7aaa301da95a71e3ddaebaf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 1 Sep 2025 08:26:26 -0500 Subject: [PATCH 0960/1058] update vaultwarden --- infra/bitwarden/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/bitwarden/templates/deployment.yaml b/infra/bitwarden/templates/deployment.yaml index 044cc28..470ac9b 100644 --- a/infra/bitwarden/templates/deployment.yaml +++ b/infra/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.durp.info/vaultwarden/server:1.33.2 + image: registry.durp.info/vaultwarden/server:1.34.3 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc From fbaa3877a2bda6f681c0eaa736fd83d33aa122ca Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 1 Sep 2025 16:09:18 -0500 Subject: [PATCH 0961/1058] delete crossplane --- infra/argocd/templates/crossplane.yaml | 20 --- infra/crossplane/Chart.yaml | 11 -- infra/crossplane/templates/argocd.yaml | 6 - infra/crossplane/templates/gitlab.yml | 57 --------- .../templates/proxmoxBackupServer.yaml | 115 ------------------ infra/crossplane/templates/tofu.yml | 61 ---------- 6 files changed, 270 deletions(-) delete mode 100644 infra/argocd/templates/crossplane.yaml delete mode 100644 infra/crossplane/Chart.yaml delete mode 100644 infra/crossplane/templates/argocd.yaml delete mode 100644 infra/crossplane/templates/gitlab.yml delete mode 100644 infra/crossplane/templates/proxmoxBackupServer.yaml delete mode 100644 infra/crossplane/templates/tofu.yml diff --git a/infra/argocd/templates/crossplane.yaml b/infra/argocd/templates/crossplane.yaml deleted file mode 100644 index cf982e5..0000000 --- a/infra/argocd/templates/crossplane.yaml +++ /dev/null @@ -1,20 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: crossplane -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: infra/crossplane -# destination: -# namespace: crossplane -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true diff --git a/infra/crossplane/Chart.yaml b/infra/crossplane/Chart.yaml deleted file mode 100644 index 3f7f266..0000000 --- a/infra/crossplane/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: crossplane -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" -#dependencies: -# - name: crossplane -# repository: https://charts.crossplane.io/stable -# version: 1.19.1 diff --git a/infra/crossplane/templates/argocd.yaml b/infra/crossplane/templates/argocd.yaml deleted file mode 100644 index f7ca6c3..0000000 --- a/infra/crossplane/templates/argocd.yaml +++ /dev/null @@ -1,6 +0,0 @@ -#apiVersion: pkg.crossplane.io/v1 -#kind: Provider -#metadata: -# name: provider-argocd -#spec: -# package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.10.1 diff --git a/infra/crossplane/templates/gitlab.yml b/infra/crossplane/templates/gitlab.yml deleted file mode 100644 index aa938ac..0000000 --- a/infra/crossplane/templates/gitlab.yml +++ /dev/null @@ -1,57 +0,0 @@ -#apiVersion: pkg.crossplane.io/v1 -#kind: Provider -#metadata: -# name: provider-gitlab -#spec: -# package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.10.4 -#--- -#apiVersion: v1 -#kind: ServiceAccount -#metadata: -# name: vault -# -#--- -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: gitlab-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: gitlab-secret -# data: -# - secretKey: accesstoken -# remoteRef: -# key: kv/renovate -# property: RENOVATE_TOKEN -# -#--- -#apiVersion: gitlab.crossplane.io/v1beta1 -#kind: ProviderConfig -#metadata: -# name: gitlab-provider -#spec: -# baseURL: https://gitlab.com/ -# credentials: -# source: Secret -# secretRef: -# namespace: crossplane -# name: gitlab-secret -# key: accesstoken -#--- -#apiVersion: projects.gitlab.crossplane.io/v1alpha1 -#kind: Project -#metadata: -# name: example-project -#spec: -# deletionPolicy: Orphan -# forProvider: -# name: "Example Project" -# description: "example project description" -# providerConfigRef: -# name: gitlab-provider -# policy: -# resolution: Optional -# resolve: Always diff --git a/infra/crossplane/templates/proxmoxBackupServer.yaml b/infra/crossplane/templates/proxmoxBackupServer.yaml deleted file mode 100644 index 736754c..0000000 --- a/infra/crossplane/templates/proxmoxBackupServer.yaml +++ /dev/null @@ -1,115 +0,0 @@ -#apiVersion: opentofu.upbound.io/v1beta1 -#kind: Workspace -#metadata: -# name: proxmoxbackupserver -# annotations: -# crossplane.io/external-name: proxmoxbackupserver -#spec: -# forProvider: -# source: Inline -# env: -# - name: TF_VAR_pm_api_url -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_api_url -# - name: TF_VAR_pm_password -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_password -# - name: TF_VAR_pm_user -# secretKeyRef: -# namespace: crossplane -# name: proxmox-secret -# key: pm_user -# module: | -# -# provider "proxmox" { -# pm_parallel = 1 -# pm_tls_insecure = true -# pm_api_url = var.pm_api_url -# pm_user = var.pm_user -# pm_password = var.pm_password -# pm_debug = false -# } -# -# variable "pm_api_url" { -# description = "API URL to Proxmox provider" -# type = string -# } -# -# variable "pm_password" { -# description = "Passowrd to Proxmox provider" -# type = string -# } -# -# variable "pm_user" { -# description = "Username to Proxmox provider" -# type = string -# } -# -# locals { -# format = "raw" -# dnsserver = "192.168.10.1" -# vlan = 21 -# proxmoxBackup = { -# tags = "Proxmox" -# count = 1 -# name = ["Proxmox-BackupServer"] -# cores = 2 -# memory = "4096" -# drive = 1024 -# storage = "domains" -# node = ["mothership"] -# ip = ["250"] -# } -# } -# -# resource "proxmox_vm_qemu" "proxmoxBackup" { -# count = local.proxmoxBackup.count -# ciuser = "administrator" -# vmid = "${local.vlan}${local.proxmoxBackup.ip[count.index]}" -# name = local.proxmoxBackup.name[count.index] -# target_node = local.proxmoxBackup.node[count.index] -# tags = local.proxmoxBackup.tags -# qemu_os = "l26" -# os_type = "cloud-init" -# agent = 1 -# cores = local.proxmoxBackup.cores -# sockets = 1 -# cpu_type = "host" -# memory = local.proxmoxBackup.memory -# scsihw = "virtio-scsi-pci" -# #bootdisk = "scsi0" -# boot = "order=virtio0" -# onboot = true -# vga { -# type = "serial0" -# } -# serial { -# id = 0 -# type = "socket" -# } -# disks { -# virtio { -# virtio0 { -# disk { -# size = local.proxmoxBackup.drive -# format = local.format -# storage = local.proxmoxBackup.storage -# } -# } -# } -# } -# network { -# id = 0 -# model = "virtio" -# bridge = "vmbr0" -# tag = local.vlan -# } -# } -# -# writeConnectionSecretToRef: -# namespace: crossplane -# name: opentofu-workspace-example-inline diff --git a/infra/crossplane/templates/tofu.yml b/infra/crossplane/templates/tofu.yml deleted file mode 100644 index f8f6094..0000000 --- a/infra/crossplane/templates/tofu.yml +++ /dev/null @@ -1,61 +0,0 @@ -#apiVersion: pkg.crossplane.io/v1 -#kind: Provider -#metadata: -# name: provider-opentofu -#spec: -# package: xpkg.upbound.io/upbound/provider-opentofu:v0 -# -#--- -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: proxmox-secret -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: proxmox-secret -# data: -# - secretKey: pm_api_url -# remoteRef: -# key: kv/crossplane/proxmox -# property: pm_api_url -# - secretKey: pm_password -# remoteRef: -# key: kv/crossplane/proxmox -# property: pm_password -# - secretKey: pm_user -# remoteRef: -# key: kv/crossplane/proxmox -# property: pm_user -# -#--- -#apiVersion: opentofu.upbound.io/v1beta1 -#kind: ProviderConfig -#metadata: -# name: default -#spec: -# #credentials: -# # - filename: gcp-credentials.json -# # source: Secret -# # secretRef: -# # namespace: upbound-system -# # name: opentofu-gcp-creds -# # key: credentials -# configuration: | -# -# // Modules _must_ use remote state. The provider does not persist state. -# terraform { -# backend "kubernetes" { -# secret_suffix = "providerconfig-default" -# namespace = "crossplane" -# in_cluster_config = true -# } -# required_providers { -# proxmox = { -# source = "Telmate/proxmox" -# version = "3.0.1-rc9" -# } -# } -# } From 16c41556c3be9e758cc7afc59341e6ec21d25c39 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 07:31:02 -0500 Subject: [PATCH 0962/1058] add kube stack --- .../templates/kube-prometheus-stack.yaml | 20 ++ infra/kube-prometheus-stack/Chart.yaml | 12 ++ .../templates/grafana-secrets-sealed.yaml | 41 ++++ .../templates/ingress.yaml | 80 +++++++ infra/kube-prometheus-stack/values.yaml | 203 ++++++++++++++++++ 5 files changed, 356 insertions(+) create mode 100644 infra/argocd/templates/kube-prometheus-stack.yaml create mode 100644 infra/kube-prometheus-stack/Chart.yaml create mode 100644 infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml create mode 100644 infra/kube-prometheus-stack/templates/ingress.yaml create mode 100644 infra/kube-prometheus-stack/values.yaml diff --git a/infra/argocd/templates/kube-prometheus-stack.yaml b/infra/argocd/templates/kube-prometheus-stack.yaml new file mode 100644 index 0000000..d89dad1 --- /dev/null +++ b/infra/argocd/templates/kube-prometheus-stack.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: kube-prometheus-stack + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/kube-prometheus-stack + destination: + namespace: kube-prometheus-stack + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/kube-prometheus-stack/Chart.yaml b/infra/kube-prometheus-stack/Chart.yaml new file mode 100644 index 0000000..d2de063 --- /dev/null +++ b/infra/kube-prometheus-stack/Chart.yaml @@ -0,0 +1,12 @@ +apiVersion: v2 +name: kube-prometheus-stack +description: A Helm chart for Kubernetes +type: application + +version: 0.1.0 +appVersion: "1.16.0" + +dependencies: + - name: kube-prometheus-stack + repository: https://prometheus-community.github.io/helm-charts + version: 77.10.0 diff --git a/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml new file mode 100644 index 0000000..7f01c1e --- /dev/null +++ b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml @@ -0,0 +1,41 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: vault-grafana-oauth +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: grafana-oauth + data: + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + remoteRef: + key: secrets/kube-prometheus/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET + remoteRef: + key: secrets/kube-prometheus/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET + +--- + +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: vault-admin-credentials +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: grafana-admin-credentials + data: + - secretKey: admin-password + remoteRef: + key: secrets/kube-prometheus/grafana/admin + property: admin-password + - secretKey: admin-user + remoteRef: + key: secrets/kube-prometheus/grafana/admin + property: admin-user diff --git a/infra/kube-prometheus-stack/templates/ingress.yaml b/infra/kube-prometheus-stack/templates/ingress.yaml new file mode 100644 index 0000000..caf0ee1 --- /dev/null +++ b/infra/kube-prometheus-stack/templates/ingress.yaml @@ -0,0 +1,80 @@ +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: grafana-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`grafana.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: grafana + port: 80 + tls: + secretName: grafana-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: grafana-tls +spec: + secretName: grafana-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "grafana.durp.info" + dnsNames: + - "grafana.durp.info" + +--- + +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: alertmanager-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: prometheus-alertmanager + port: 9093 + tls: + secretName: alertmanager-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: alertmanager-tls +spec: + secretName: alertmanager-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "alertmanager.durp.info" + dnsNames: + - "alertmanager.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: grafana-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: grafana.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file diff --git a/infra/kube-prometheus-stack/values.yaml b/infra/kube-prometheus-stack/values.yaml new file mode 100644 index 0000000..df68eba --- /dev/null +++ b/infra/kube-prometheus-stack/values.yaml @@ -0,0 +1,203 @@ +kube-prometheus-stack: + fullnameOverride: prometheus + + defaultRules: + create: true + rules: + alertmanager: true + etcd: true + configReloaders: true + general: true + k8s: true + kubeApiserverAvailability: true + kubeApiserverBurnrate: true + kubeApiserverHistogram: true + kubeApiserverSlos: true + kubelet: true + kubeProxy: true + kubePrometheusGeneral: true + kubePrometheusNodeRecording: true + kubernetesApps: true + kubernetesResources: true + kubernetesStorage: true + kubernetesSystem: true + kubeScheduler: true + kubeStateMetrics: true + network: true + node: true + nodeExporterAlerting: true + nodeExporterRecording: true + prometheus: true + prometheusOperator: true + + alertmanager: + fullnameOverride: alertmanager + enabled: true + ingress: + enabled: false + grafana: + enabled: true + fullnameOverride: grafana + forceDeployDatasources: false + forceDeployDashboards: false + defaultDashboardsEnabled: true + defaultDashboardsTimezone: utc + plugins: + - grafana-polystat-panel + serviceMonitor: + enabled: true + admin: + existingSecret: grafana-admin-credentials + userKey: admin-user + passwordKey: admin-password + ingress: + enabled: false + grafana.ini: + server: + root_url: https://grafana.durp.info + auth.generic_oauth: + enabled: true + scopes: openid profile email + auth_url: https://authentik.durp.info/application/o/authorize/ + token_url: https://authentik.durp.info/application/o/token/ + api_url: https://authentik.durp.info/application/o/userinfo/ + envFromSecret: "grafana-oauth" + + kubeApiServer: + enabled: true + + kubelet: + enabled: true + serviceMonitor: + metricRelabelings: + - action: replace + sourceLabels: + - node + targetLabel: instance + + kubeControllerManager: + enabled: true + endpoints: # ips of servers + - 192.168.12.11 + - 192.168.12.12 + - 192.168.12.13 + + coreDns: + enabled: false + + kubeDns: + enabled: false + + kubeEtcd: + enabled: true + endpoints: # ips of servers + - 192.168.12.11 + - 192.168.12.12 + - 192.168.12.13 + service: + enabled: true + port: 2381 + targetPort: 2381 + + kubeScheduler: + enabled: true + endpoints: # ips of servers + - 192.168.12.11 + - 192.168.12.12 + - 192.168.12.13 + + kubeProxy: + enabled: true + endpoints: # ips of servers + - 192.168.12.11 + - 192.168.12.12 + - 192.168.12.13 + + kubeStateMetrics: + enabled: true + + kube-state-metrics: + fullnameOverride: kube-state-metrics + selfMonitor: + enabled: true + prometheus: + monitor: + enabled: true + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + + nodeExporter: + enabled: true + serviceMonitor: + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + + prometheus-node-exporter: + fullnameOverride: node-exporter + podLabels: + jobLabel: node-exporter + extraArgs: + - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/) + - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$ + service: + portName: http-metrics + prometheus: + monitor: + enabled: true + relabelings: + - action: replace + regex: (.*) + replacement: $1 + sourceLabels: + - __meta_kubernetes_pod_node_name + targetLabel: kubernetes_node + resources: + requests: + memory: 512Mi + cpu: 250m + limits: + memory: 2048Mi + + prometheusOperator: + enabled: true + prometheusConfigReloader: + resources: + requests: + cpu: 200m + memory: 50Mi + limits: + memory: 100Mi + + prometheus: + enabled: true + prometheusSpec: + replicas: 1 + replicaExternalLabelName: "replica" + ruleSelectorNilUsesHelmValues: false + serviceMonitorSelectorNilUsesHelmValues: false + podMonitorSelectorNilUsesHelmValues: false + probeSelectorNilUsesHelmValues: false + retention: 6h + enableAdminAPI: true + walCompression: true + storageSpec: + volumeClaimTemplate: + spec: + storageClassName: longhorn + accessModes: ["ReadWriteMany"] + resources: + requests: + storage: 20Gi + + thanosRuler: + enabled: false From 820e89935921380ac88703d6d853ee686cc52b59 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 07:34:19 -0500 Subject: [PATCH 0963/1058] disable crowdsec --- infra/argocd/templates/crowdsec.yaml | 40 ++++++++++++++-------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/infra/argocd/templates/crowdsec.yaml b/infra/argocd/templates/crowdsec.yaml index 1a2c2b5..69e07a8 100644 --- a/infra/argocd/templates/crowdsec.yaml +++ b/infra/argocd/templates/crowdsec.yaml @@ -1,20 +1,20 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: crowdsec - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: dmz/crowdsec - destination: - namespace: crowdsec - name: dmz - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: crowdsec +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: dmz/crowdsec +# destination: +# namespace: crowdsec +# name: dmz +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true From 4fdddee8e05d1da6b9dccbd87a73ff2614e0df5d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 07:36:42 -0500 Subject: [PATCH 0964/1058] update ingress --- .../templates/ingress.yaml | 45 +++++++++---------- 1 file changed, 21 insertions(+), 24 deletions(-) diff --git a/infra/kube-prometheus-stack/templates/ingress.yaml b/infra/kube-prometheus-stack/templates/ingress.yaml index caf0ee1..5638d6a 100644 --- a/infra/kube-prometheus-stack/templates/ingress.yaml +++ b/infra/kube-prometheus-stack/templates/ingress.yaml @@ -1,4 +1,4 @@ -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: grafana-ingress @@ -6,16 +6,15 @@ spec: entryPoints: - websecure routes: - - match: Host(`grafana.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: grafana - port: 80 + - match: Host(`grafana.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: grafana + port: 80 tls: secretName: grafana-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -27,11 +26,10 @@ spec: kind: ClusterIssuer commonName: "grafana.durp.info" dnsNames: - - "grafana.durp.info" + - "grafana.durp.info" --- - -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: alertmanager-ingress @@ -39,21 +37,20 @@ spec: entryPoints: - websecure routes: - - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: prometheus-alertmanager - port: 9093 + - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) + middlewares: + - name: whitelist + namespace: traefik + - name: authentik-proxy-provider + namespace: traefik + kind: Rule + services: + - name: prometheus-alertmanager + port: 9093 tls: secretName: alertmanager-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -65,10 +62,9 @@ spec: kind: ClusterIssuer commonName: "alertmanager.durp.info" dnsNames: - - "alertmanager.durp.info" + - "alertmanager.durp.info" --- - kind: Service apiVersion: v1 metadata: @@ -77,4 +73,5 @@ metadata: external-dns.alpha.kubernetes.io/hostname: grafana.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info + From 868ceddb22c2f578a17cb1e6e47ae084f32806b4 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 07:51:38 -0500 Subject: [PATCH 0965/1058] update secrets --- .../templates/grafana-secrets-sealed.yaml | 41 +++++++++++-------- 1 file changed, 23 insertions(+), 18 deletions(-) diff --git a/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml index 7f01c1e..a499d01 100644 --- a/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml +++ b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml @@ -1,3 +1,9 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + +--- apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -9,17 +15,16 @@ spec: target: name: grafana-oauth data: - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - ---- + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + remoteRef: + key: secrets/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID + - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET + remoteRef: + key: secrets/grafana/oauth + property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET +--- apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: @@ -31,11 +36,11 @@ spec: target: name: grafana-admin-credentials data: - - secretKey: admin-password - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-password - - secretKey: admin-user - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-user + - secretKey: admin-password + remoteRef: + key: secrets/grafana/admin + property: admin-password + - secretKey: admin-user + remoteRef: + key: secrets/grafana/admin + property: admin-user From ed1a465402019f68fef949bc9d650e00f88f4ef5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 07:55:44 -0500 Subject: [PATCH 0966/1058] fix secrets --- .../templates/grafana-secrets-sealed.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml index a499d01..d3b43d5 100644 --- a/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml +++ b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml @@ -17,11 +17,11 @@ spec: data: - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID remoteRef: - key: secrets/grafana/oauth + key: kv/grafana/oauth property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET remoteRef: - key: secrets/grafana/oauth + key: kv/grafana/oauth property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET --- @@ -38,9 +38,9 @@ spec: data: - secretKey: admin-password remoteRef: - key: secrets/grafana/admin + key: kv/grafana/admin property: admin-password - secretKey: admin-user remoteRef: - key: secrets/grafana/admin + key: kv/grafana/admin property: admin-user From aabec35dd76cc2ee0a396fe5e35e4c91670dd0e5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 07:56:57 -0500 Subject: [PATCH 0967/1058] fix secret --- .../templates/grafana-secrets-sealed.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml index d3b43d5..3328c18 100644 --- a/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml +++ b/infra/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml @@ -39,8 +39,8 @@ spec: - secretKey: admin-password remoteRef: key: kv/grafana/admin - property: admin-password + property: password - secretKey: admin-user remoteRef: key: kv/grafana/admin - property: admin-user + property: user From ac8b8367489c790b58a7a1e116f0831b32599630 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 08:05:50 -0500 Subject: [PATCH 0968/1058] add dmz ingress --- dmz/internalproxy/templates/grafana.yaml | 40 ++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 dmz/internalproxy/templates/grafana.yaml diff --git a/dmz/internalproxy/templates/grafana.yaml b/dmz/internalproxy/templates/grafana.yaml new file mode 100644 index 0000000..0de1a83 --- /dev/null +++ b/dmz/internalproxy/templates/grafana.yaml @@ -0,0 +1,40 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: grafana-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`grafana.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: grafana-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: grafana-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: grafana-tls + commonName: "grafana.durp.info" + dnsNames: + - "grafana.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: grafana-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: grafana.durp.info +spec: + type: ExternalName + externalName: durp.info From 69bfdc98525e41fc0690248e1e6b0aa68be6fa84 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Sep 2025 09:24:21 -0500 Subject: [PATCH 0969/1058] update octopus --- infra/octopusdeploy/Chart.yaml | 2 +- infra/octopusdeploy/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/octopusdeploy/Chart.yaml b/infra/octopusdeploy/Chart.yaml index 1e09604..e1aba0c 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/octopusdeploy/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: octopusdeploy-helm repository: oci://ghcr.io/octopusdeploy - version: 1.4.0 + version: 1.7.0 diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml index 71c70b1..70db7fa 100644 --- a/infra/octopusdeploy/values.yaml +++ b/infra/octopusdeploy/values.yaml @@ -2,7 +2,7 @@ octopusdeploy-helm: octopus: image: repository: registry.durp.info/octopusdeploy/octopusdeploy - tag: 2025.1 + tag: 2025.3 createSecrets: false acceptEula: Y replicaCount: 3 From 5508fe361092cb4e23ce599384eaa7b7ed8fc979 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 9 Oct 2025 06:25:05 -0500 Subject: [PATCH 0970/1058] add gitlab --- dmz/internalproxy/templates/gitlab.yaml | 68 +++++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 dmz/internalproxy/templates/gitlab.yaml diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml new file mode 100644 index 0000000..2dd208e --- /dev/null +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: Service +metadata: + name: gitlab +spec: + ports: + - name: app + port: 9080 + protocol: TCP + targetPort: 9080 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: gitlab +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 9080 + protocol: TCP + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gitlab-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gitlab.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: gitlab + port: 9080 + scheme: http + tls: + secretName: gitlab-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitlab-tls +spec: + secretName: gitlab-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gitlab.durp.info" + dnsNames: + - "gitlab.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: gitlab-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: gitlab.durp.info +spec: + type: ExternalName + externalName: durp.info From 8dac861ae3b003ad764442433e127ea53db99e32 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 22 Oct 2025 05:23:07 -0500 Subject: [PATCH 0971/1058] update n8n --- dmz/internalproxy/templates/n8n.yaml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/dmz/internalproxy/templates/n8n.yaml b/dmz/internalproxy/templates/n8n.yaml index fec81fa..d70038b 100644 --- a/dmz/internalproxy/templates/n8n.yaml +++ b/dmz/internalproxy/templates/n8n.yaml @@ -12,21 +12,19 @@ spec: type: ClusterIP --- - apiVersion: v1 kind: Endpoints metadata: name: n8n subsets: - addresses: - - ip: 192.168.20.104 + - ip: 192.168.21.200 ports: - name: app port: 5678 protocol: TCP --- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -45,7 +43,6 @@ spec: secretName: n8n-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -60,7 +57,6 @@ spec: - "n8n.durp.info" --- - kind: Service apiVersion: v1 metadata: From 3e24e0ec80803da995ad698a5a2303cfad43ae9f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 6 Dec 2025 07:23:03 -0600 Subject: [PATCH 0972/1058] update --- dmz/internalproxy/templates/octopus.yaml | 81 ++++++++++++------------ 1 file changed, 41 insertions(+), 40 deletions(-) diff --git a/dmz/internalproxy/templates/octopus.yaml b/dmz/internalproxy/templates/octopus.yaml index f68d9e3..084200c 100644 --- a/dmz/internalproxy/templates/octopus.yaml +++ b/dmz/internalproxy/templates/octopus.yaml @@ -1,40 +1,41 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: octopus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`octopus.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: octopus-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: octopus-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: octopus-tls - commonName: "octopus.durp.info" - dnsNames: - - "octopus.durp.info" - ---- -kind: Service -apiVersion: v1 -metadata: - name: octopus-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: octopus.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: octopus-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`octopus.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: infra-cluster +# port: 443 +# tls: +# secretName: octopus-tls +# +#--- +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: octopus-tls +#spec: +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# secretName: octopus-tls +# commonName: "octopus.durp.info" +# dnsNames: +# - "octopus.durp.info" +# +#--- +#kind: Service +#apiVersion: v1 +#metadata: +# name: octopus-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: octopus.durp.info +#spec: +# type: ExternalName +# externalName: durp.info +# \ No newline at end of file From 310e73b30d4d080dec6eb6e07123a76176a5b244 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 6 Dec 2025 07:31:10 -0600 Subject: [PATCH 0973/1058] update --- infra/argocd/templates/octopusdeploy.yaml | 85 ++++++++++++----------- 1 file changed, 43 insertions(+), 42 deletions(-) diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml index 3412681..d58d1fd 100644 --- a/infra/argocd/templates/octopusdeploy.yaml +++ b/infra/argocd/templates/octopusdeploy.yaml @@ -1,42 +1,43 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: octopusdeploy - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: infra/octopusdeploy - destination: - namespace: octopusdeploy - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: octopusdeploy-agent - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: infra/octopus-agent - destination: - namespace: octopus-agent - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: octopusdeploy +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: infra/octopusdeploy +# destination: +# namespace: octopusdeploy +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# +#--- +#apiVersion: argoproj.io/v1alpha1 +#kind: Application +#metadata: +# name: octopusdeploy-agent +# namespace: argocd +#spec: +# project: default +# source: +# repoURL: https://gitlab.com/developerdurp/homelab.git +# targetRevision: main +# path: infra/octopus-agent +# destination: +# namespace: octopus-agent +# name: in-cluster +# syncPolicy: +# automated: +# prune: true +# selfHeal: true +# syncOptions: +# - CreateNamespace=true +# \ No newline at end of file From 935f9cd9e20e90974d65f5aee7043117eca7c8b9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 13 Dec 2025 15:11:02 -0600 Subject: [PATCH 0974/1058] update --- infra/argocd/templates/argocd-crossplane.yaml | 101 ------------------ infra/argocd/templates/crowdsec.yaml | 20 ---- 2 files changed, 121 deletions(-) delete mode 100644 infra/argocd/templates/argocd-crossplane.yaml delete mode 100644 infra/argocd/templates/crowdsec.yaml diff --git a/infra/argocd/templates/argocd-crossplane.yaml b/infra/argocd/templates/argocd-crossplane.yaml deleted file mode 100644 index 54ac407..0000000 --- a/infra/argocd/templates/argocd-crossplane.yaml +++ /dev/null @@ -1,101 +0,0 @@ -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: argocd-secret-crossplane -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: argocd-secret-crossplane -# data: -# - secretKey: authToken -# remoteRef: -# key: kv/argocd/provider-argocd -# property: token -# -#--- -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: prod-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: prod-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/prd -# property: kubeconfig -# -#--- -#apiVersion: argocd.crossplane.io/v1alpha1 -#kind: ProviderConfig -#metadata: -# name: argocd-provider -#spec: -# serverAddr: argocd-server.argocd.svc:443 -# insecure: true -# plainText: false -# credentials: -# source: Secret -# secretRef: -# namespace: argocd -# name: argocd-secret-crossplane -# key: authToken -# -#--- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: prd -# labels: -# purpose: prd -#spec: -# forProvider: -# name: prd -# config: -# kubeconfigSecretRef: -# name: prod-kubeconfig -# namespace: argocd -# key: kubeconfig -# providerConfigRef: -# name: argocd-provider -# -#--- -#apiVersion: external-secrets.io/v1 -#kind: ExternalSecret -#metadata: -# name: dev-kubeconfig -#spec: -# secretStoreRef: -# name: vault -# kind: ClusterSecretStore -# target: -# name: dev-kubeconfig -# data: -# - secretKey: kubeconfig -# remoteRef: -# key: kv/argocd/dev -# property: kubeconfig -# -#--- -#apiVersion: cluster.argocd.crossplane.io/v1alpha1 -#kind: Cluster -#metadata: -# name: dev -# labels: -# purpose: dev -#spec: -# forProvider: -# name: dev -# config: -# kubeconfigSecretRef: -# name: dev-kubeconfig -# namespace: argocd -# key: kubeconfig -# providerConfigRef: -# name: argocd-provider diff --git a/infra/argocd/templates/crowdsec.yaml b/infra/argocd/templates/crowdsec.yaml deleted file mode 100644 index 69e07a8..0000000 --- a/infra/argocd/templates/crowdsec.yaml +++ /dev/null @@ -1,20 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: crowdsec -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: dmz/crowdsec -# destination: -# namespace: crowdsec -# name: dmz -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true From d6cf85135c79999e7352272a972a44ba6a10a768 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:02:44 -0600 Subject: [PATCH 0975/1058] update --- infra/argocd/templates/octopusdeploy.yaml | 43 ------- infra/argocd/templates/portainer.yaml | 20 ++++ infra/octopus-agent/Chart.yaml | 12 -- infra/octopus-agent/templates/secret.yaml | 23 ---- infra/octopus-agent/values.yaml | 19 ---- infra/octopusdeploy/templates/ingress.yaml | 32 ------ infra/octopusdeploy/templates/secrets.yaml | 106 ------------------ infra/octopusdeploy/values.yaml | 10 -- infra/{octopusdeploy => portainer}/Chart.yaml | 8 +- infra/portainer/values.yaml | 78 +++++++++++++ 10 files changed, 102 insertions(+), 249 deletions(-) delete mode 100644 infra/argocd/templates/octopusdeploy.yaml create mode 100644 infra/argocd/templates/portainer.yaml delete mode 100644 infra/octopus-agent/Chart.yaml delete mode 100644 infra/octopus-agent/templates/secret.yaml delete mode 100644 infra/octopus-agent/values.yaml delete mode 100644 infra/octopusdeploy/templates/ingress.yaml delete mode 100644 infra/octopusdeploy/templates/secrets.yaml delete mode 100644 infra/octopusdeploy/values.yaml rename infra/{octopusdeploy => portainer}/Chart.yaml (52%) create mode 100644 infra/portainer/values.yaml diff --git a/infra/argocd/templates/octopusdeploy.yaml b/infra/argocd/templates/octopusdeploy.yaml deleted file mode 100644 index d58d1fd..0000000 --- a/infra/argocd/templates/octopusdeploy.yaml +++ /dev/null @@ -1,43 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: octopusdeploy -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: infra/octopusdeploy -# destination: -# namespace: octopusdeploy -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# -#--- -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: octopusdeploy-agent -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: infra/octopus-agent -# destination: -# namespace: octopus-agent -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# \ No newline at end of file diff --git a/infra/argocd/templates/portainer.yaml b/infra/argocd/templates/portainer.yaml new file mode 100644 index 0000000..d8b5d32 --- /dev/null +++ b/infra/argocd/templates/portainer.yaml @@ -0,0 +1,20 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: portainer + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: infra/portainer + destination: + namespace: portainer + name: in-cluster + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/infra/octopus-agent/Chart.yaml b/infra/octopus-agent/Chart.yaml deleted file mode 100644 index f36dd2d..0000000 --- a/infra/octopus-agent/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: octopusdeploy -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: - - name: kubernetes-agent - repository: oci://registry-1.docker.io/octopusdeploy - version: 2.*.* diff --git a/infra/octopus-agent/templates/secret.yaml b/infra/octopus-agent/templates/secret.yaml deleted file mode 100644 index 50a87d8..0000000 --- a/infra/octopus-agent/templates/secret.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault - ---- - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: agent-token -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: agent-token - data: - - secretKey: bearer-token - remoteRef: - key: kv/octopusdeploy - property: infra-bearer-token - diff --git a/infra/octopus-agent/values.yaml b/infra/octopus-agent/values.yaml deleted file mode 100644 index 8f262a5..0000000 --- a/infra/octopus-agent/values.yaml +++ /dev/null @@ -1,19 +0,0 @@ -kubernetes-agent: - agent: - bearerTokenSecretName: agent-token - acceptEula: "Y" - serverUrl: "https://octopus.durp.info/" - serverCommsAddresses: - - "https://octopus-deploy-node0.octopusdeploy.svc.cluster.local:10943/" - - "https://octopus-deploy-node1.octopusdeploy.svc.cluster.local:10943/" - - "https://octopus-deploy-node2.octopusdeploy.svc.cluster.local:10943/" - space: "Default" - name: "infra" - deploymentTarget: - initial: - environments: - - "development" - - "production" - tags: - - "infra-cluster" - enabled: "true" diff --git a/infra/octopusdeploy/templates/ingress.yaml b/infra/octopusdeploy/templates/ingress.yaml deleted file mode 100644 index e399ae8..0000000 --- a/infra/octopusdeploy/templates/ingress.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: octopus-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`octopus.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: octopusdeploy-octopus-deploy - port: 80 - tls: - secretName: octopus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: octopus-tls -spec: - secretName: octopus-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "octopus.durp.info" - dnsNames: - - "octopus.durp.info" diff --git a/infra/octopusdeploy/templates/secrets.yaml b/infra/octopusdeploy/templates/secrets.yaml deleted file mode 100644 index 7f9ec8b..0000000 --- a/infra/octopusdeploy/templates/secrets.yaml +++ /dev/null @@ -1,106 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: vault - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-adminpassword -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-adminpassword - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: adminpassword - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-adminusername -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-adminusername - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: adminusername - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-connectionstring -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-connectionstring - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: connectionstring - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-masterkey -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-masterkey - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: masterkey - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-sapassword -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-sapassword - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: sapassword - ---- -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: octopusdeploy-licensekey -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: octopusdeploy-licensekey - data: - - secretKey: secret - remoteRef: - key: kv/octopusdeploy - property: licensekey diff --git a/infra/octopusdeploy/values.yaml b/infra/octopusdeploy/values.yaml deleted file mode 100644 index 70db7fa..0000000 --- a/infra/octopusdeploy/values.yaml +++ /dev/null @@ -1,10 +0,0 @@ -octopusdeploy-helm: - octopus: - image: - repository: registry.durp.info/octopusdeploy/octopusdeploy - tag: 2025.3 - createSecrets: false - acceptEula: Y - replicaCount: 3 - mssql: - enabled: true \ No newline at end of file diff --git a/infra/octopusdeploy/Chart.yaml b/infra/portainer/Chart.yaml similarity index 52% rename from infra/octopusdeploy/Chart.yaml rename to infra/portainer/Chart.yaml index e1aba0c..1813d7a 100644 --- a/infra/octopusdeploy/Chart.yaml +++ b/infra/portainer/Chart.yaml @@ -1,5 +1,5 @@ apiVersion: v2 -name: octopusdeploy +name: portainer description: A Helm chart for Kubernetes type: application @@ -7,6 +7,6 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: - - name: octopusdeploy-helm - repository: oci://ghcr.io/octopusdeploy - version: 1.7.0 + - name: portainer + repository: https://portainer.github.io/k8s/ + version: 2.33.5 diff --git a/infra/portainer/values.yaml b/infra/portainer/values.yaml new file mode 100644 index 0000000..a63ba2e --- /dev/null +++ b/infra/portainer/values.yaml @@ -0,0 +1,78 @@ +portainer: + replicaCount: 1 + image: + repository: registry.durp.info/portainer/portainer-ce + tag: 2.33.5 + pullPolicy: Always + + imagePullSecrets: [] + + nodeSelector: {} + tolerations: [] + + serviceAccount: + annotations: {} + name: portainer-sa-clusteradmin + + # This flag provides the ability to enable or disable RBAC-related resources during the deployment of the Portainer application + # If you are using Portainer to manage the K8s cluster it is deployed to, this flag must be set to true + localMgmt: true + + service: + # Set the httpNodePort and edgeNodePort only if the type is NodePort + # For Ingress, set the type to be ClusterIP and set ingress.enabled to true + # For Cloud Providers, set the type to be LoadBalancer + type: NodePort + httpPort: 9000 + httpsPort: 9443 + httpNodePort: 30777 + httpsNodePort: 30779 + edgePort: 8000 + edgeNodePort: 30776 + annotations: {} + + tls: + # If set, Portainer will be configured to use TLS only + force: false + # If set, will mount the existing secret into the pod + existingSecret: "" + + trusted_origins: + # If set, Portainer will be configured to trust the domains specified in domains + enabled: false + # specify (in a comma-separated list) the domain(s) used to access Portainer when it is behind a reverse proxy + # example: portainer.mydomain.com,portainer.example.com + domains: "" + + mtls: + # If set, Portainer will be configured to use mTLS only + enable: false + # If set, will mount the existing secret into the pod + existingSecret: "" + + feature: + flags: [] + + ingress: + enabled: false + ingressClassName: "" + annotations: {} + # kubernetes.io/ingress.class: nginx + # Only use below if tls.force=true + # nginx.ingress.kubernetes.io/backend-protocol: HTTPS + # Note: Hosts and paths are of type array + hosts: + - host: + paths: [] + # - path: "/" + tls: [] + + resources: {} + + persistence: + enabled: true + size: "10Gi" + annotations: {} + storageClass: longhorn + existingClaim: + From 2d1497141d65ef26383ccd9eecd0e9db9e642980 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:33:12 -0600 Subject: [PATCH 0976/1058] update --- dmz/internalproxy/templates/octopus.yaml | 41 ---------------------- dmz/internalproxy/templates/portainer.yaml | 36 ++----------------- infra/portainer/templates/ingress.yaml | 30 ++++++++++++++++ 3 files changed, 33 insertions(+), 74 deletions(-) delete mode 100644 dmz/internalproxy/templates/octopus.yaml create mode 100644 infra/portainer/templates/ingress.yaml diff --git a/dmz/internalproxy/templates/octopus.yaml b/dmz/internalproxy/templates/octopus.yaml deleted file mode 100644 index 084200c..0000000 --- a/dmz/internalproxy/templates/octopus.yaml +++ /dev/null @@ -1,41 +0,0 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: octopus-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`octopus.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: infra-cluster -# port: 443 -# tls: -# secretName: octopus-tls -# -#--- -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: octopus-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: octopus-tls -# commonName: "octopus.durp.info" -# dnsNames: -# - "octopus.durp.info" -# -#--- -#kind: Service -#apiVersion: v1 -#metadata: -# name: octopus-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: octopus.durp.info -#spec: -# type: ExternalName -# externalName: durp.info -# \ No newline at end of file diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index c27e0ff..554e052 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: portainer -spec: - ports: - - name: app - port: 9443 - protocol: TCP - targetPort: 9443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: portainer -subsets: -- addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 9443 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,9 +12,8 @@ spec: # namespace: traefik kind: Rule services: - - name: portainer - port: 9443 - scheme: https + - name: infra-cluster + port: 443 tls: secretName: portainer-tls @@ -60,4 +30,4 @@ spec: kind: ClusterIssuer commonName: "portainer.internal.durp.info" dnsNames: - - "portainer.internal.durp.info" + - "portainer.internal.durp.info" diff --git a/infra/portainer/templates/ingress.yaml b/infra/portainer/templates/ingress.yaml new file mode 100644 index 0000000..ed213cb --- /dev/null +++ b/infra/portainer/templates/ingress.yaml @@ -0,0 +1,30 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: portainer-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`portainer.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: portainer + port: 9443 + tls: + secretName: portainer-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: portainer-tls +spec: + secretName: portainer-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "portainer.internal.durp.info" + dnsNames: + - "portainer.internal.durp.info" From b987abbe424092a35f77d36a0540add91346bd8c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:35:44 -0600 Subject: [PATCH 0977/1058] update --- infra/portainer/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/templates/ingress.yaml b/infra/portainer/templates/ingress.yaml index ed213cb..9d6f0fb 100644 --- a/infra/portainer/templates/ingress.yaml +++ b/infra/portainer/templates/ingress.yaml @@ -10,7 +10,7 @@ spec: kind: Rule services: - name: portainer - port: 9443 + port: 9000 tls: secretName: portainer-tls From 0e5337d76219647d67993df7f1d36c2f7afc9faf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 14 Dec 2025 07:43:12 -0600 Subject: [PATCH 0978/1058] update --- infra/portainer/templates/ingress.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/templates/ingress.yaml b/infra/portainer/templates/ingress.yaml index 9d6f0fb..c1e0e38 100644 --- a/infra/portainer/templates/ingress.yaml +++ b/infra/portainer/templates/ingress.yaml @@ -6,7 +6,7 @@ spec: entryPoints: - websecure routes: - - match: Host(`portainer.durp.info`) && PathPrefix(`/`) + - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) kind: Rule services: - name: portainer From cb37d0211e4d32b78676bcdbd98b6829456ca5fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Dec 2025 12:33:58 -0600 Subject: [PATCH 0979/1058] update --- dmz/redlib/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml index 0e20610..3ab54c5 100644 --- a/dmz/redlib/templates/deployment.yaml +++ b/dmz/redlib/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: redlib - image: registry.durp.info/redlib/redlib:latest + image: registry.durp.info/redlib/redlib:sha-ba98178 imagePullPolicy: Always livenessProbe: httpGet: From fa6036b05a10c6eda9d4b29c6621637044ec7477 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Dec 2025 12:40:56 -0600 Subject: [PATCH 0980/1058] update --- dmz/redlib/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml index 3ab54c5..8cfe8b1 100644 --- a/dmz/redlib/templates/deployment.yaml +++ b/dmz/redlib/templates/deployment.yaml @@ -9,7 +9,7 @@ spec: selector: matchLabels: app: redlib - replicas: 3 + replicas: 1 template: metadata: labels: From 2036374917c2ba567b07f08610c2fba7376159a3 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 20 Dec 2025 12:41:47 -0600 Subject: [PATCH 0981/1058] update --- dmz/redlib/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/redlib/templates/deployment.yaml b/dmz/redlib/templates/deployment.yaml index 8cfe8b1..c09a144 100644 --- a/dmz/redlib/templates/deployment.yaml +++ b/dmz/redlib/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: redlib - image: registry.durp.info/redlib/redlib:sha-ba98178 + image: registry.durp.info/redlib/redlib:latest imagePullPolicy: Always livenessProbe: httpGet: From e401910bee154c9fb40aca7b686244d0db7636ab Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 10:44:59 -0600 Subject: [PATCH 0982/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 2dd208e..8a7fa96 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 9080 + port: 9443 protocol: TCP - targetPort: 9080 + targetPort: 9443 clusterIP: None type: ClusterIP @@ -21,7 +21,7 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 9080 + port: 9443 protocol: TCP --- @@ -37,8 +37,8 @@ spec: kind: Rule services: - name: gitlab - port: 9080 - scheme: http + port: 9443 + scheme: https tls: secretName: gitlab-tls From 63fe8a5a33596926bc5fc12c38bb7ceba1738b39 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 10:50:13 -0600 Subject: [PATCH 0983/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 8a7fa96..b825dd0 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -18,7 +18,7 @@ metadata: name: gitlab subsets: - addresses: - - ip: 192.168.21.200 + - ip: 192.168.20.200 ports: - name: app port: 9443 From e2348f012baccd94e064b3122dd40bb39d4806bf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 10:53:24 -0600 Subject: [PATCH 0984/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index b825dd0..8a7fa96 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -18,7 +18,7 @@ metadata: name: gitlab subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 9443 From e427f19c298f73869bb355856fce8fe9ed5e7ac0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:21:37 -0600 Subject: [PATCH 0985/1058] update --- dmz/traefik/values.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index aa0efe0..74e76eb 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -23,6 +23,11 @@ traefik: dashboard: enabled: true + ports: + gitlab-ssh: + port: 9022 + expose: true + additionalArguments: # - "--providers.file.filename=/config/config.yml" - "--serversTransport.insecureSkipVerify=true" From f90b4121498010ed1fe5c3fad92ffa18a1a3c44c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:26:44 -0600 Subject: [PATCH 0986/1058] update --- dmz/traefik/values.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/dmz/traefik/values.yaml b/dmz/traefik/values.yaml index 74e76eb..c762b94 100644 --- a/dmz/traefik/values.yaml +++ b/dmz/traefik/values.yaml @@ -26,7 +26,9 @@ traefik: ports: gitlab-ssh: port: 9022 - expose: true + expose: + default: true + exposedPort: 9022 additionalArguments: # - "--providers.file.filename=/config/config.yml" From c67044655137e5cd91e13a48ffcc20ef84bd2dcd Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:30:20 -0600 Subject: [PATCH 0987/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 44 +++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 8a7fa96..fbebfec 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -1,5 +1,49 @@ apiVersion: v1 kind: Service +metadata: + name: gitlab-ssh +spec: + ports: + - name: app + port: 9022 + protocol: TCP + targetPort: 9022 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: gitlab-ssh +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 9022 + protocol: TCP + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gitlab-ssh-ingress +spec: + entryPoints: + - gitlab-ssh + routes: + - match: HostSNI(`*`) + kind: Rule + services: + - name: gitlab-ssh + port: 9022 + tls: + secretName: gitlab-tls + +--- +apiVersion: v1 +kind: Service metadata: name: gitlab spec: From f021aae87ecb6c07a5e33f14d393912575f8be35 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 11:52:01 -0600 Subject: [PATCH 0988/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index fbebfec..2888cea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -36,7 +36,7 @@ spec: - match: HostSNI(`*`) kind: Rule services: - - name: gitlab-ssh + - name: app port: 9022 tls: secretName: gitlab-tls From 443c5b30bdf941341041610c6ce3344701230340 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:00:30 -0600 Subject: [PATCH 0989/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 2888cea..cd7c92d 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -28,13 +28,12 @@ subsets: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: gitlab-ssh-ingress + name: gitlab-ssh spec: entryPoints: - gitlab-ssh routes: - match: HostSNI(`*`) - kind: Rule services: - name: app port: 9022 From 6b027f04b4937189716b09eb9f04cec0a739adaf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:06:37 -0600 Subject: [PATCH 0990/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index cd7c92d..576d9ea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -7,7 +7,7 @@ spec: - name: app port: 9022 protocol: TCP - targetPort: 9022 + targetPort: 9443 clusterIP: None type: ClusterIP From 121bd8a421a0cd319cf82887d81cb2a264c4fa7c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:08:25 -0600 Subject: [PATCH 0991/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 576d9ea..5b178ea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -5,7 +5,7 @@ metadata: spec: ports: - name: app - port: 9022 + port: 9443 protocol: TCP targetPort: 9443 clusterIP: None @@ -21,7 +21,7 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 9022 + port: 9443 protocol: TCP --- @@ -36,7 +36,7 @@ spec: - match: HostSNI(`*`) services: - name: app - port: 9022 + port: 9443 tls: secretName: gitlab-tls From db506ef0324e9f7fba942bd63b813f40271f6a9e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:10:22 -0600 Subject: [PATCH 0992/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 5b178ea..1ad072b 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 9443 + port: 9022 protocol: TCP - targetPort: 9443 + targetPort: 9022 clusterIP: None type: ClusterIP @@ -21,12 +21,12 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 9443 + port: 9022 protocol: TCP --- apiVersion: traefik.io/v1alpha1 -kind: IngressRoute +kind: IngressRouteTCP metadata: name: gitlab-ssh spec: @@ -36,7 +36,7 @@ spec: - match: HostSNI(`*`) services: - name: app - port: 9443 + port: 9022 tls: secretName: gitlab-tls From 8b892fe6b1d36e6c12297b871443acd97a1ada8d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 29 Dec 2025 12:12:31 -0600 Subject: [PATCH 0993/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 1ad072b..0c79c8b 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -35,10 +35,8 @@ spec: routes: - match: HostSNI(`*`) services: - - name: app + - name: gitlab-ssh port: 9022 - tls: - secretName: gitlab-tls --- apiVersion: v1 From 6bd445af5b076578468b631ff72a53c17ea07c2d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 14 Jan 2026 06:09:21 -0600 Subject: [PATCH 0994/1058] add openvpn server --- dmz/terraform/main.tf | 10 +++++++ dmz/terraform/openVPN.tf | 57 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 dmz/terraform/openVPN.tf diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf index 021675c..4a949bd 100644 --- a/dmz/terraform/main.tf +++ b/dmz/terraform/main.tf @@ -45,4 +45,14 @@ locals { node = ["mothership", "overlord", "vanguard"] ip = ["21", "22", "23"] } + openVPN = { + tags = "openVPN" + count = 1 + name = ["openVPN"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership"] + ip = ["20"] + } } diff --git a/dmz/terraform/openVPN.tf b/dmz/terraform/openVPN.tf new file mode 100644 index 0000000..ea43924 --- /dev/null +++ b/dmz/terraform/openVPN.tf @@ -0,0 +1,57 @@ +resource "proxmox_vm_qemu" "openVPN" { + count = local.openVPN.count + ciuser = "administrator" + vmid = "${local.vlan}${local.openVPN.ip[count.index]}" + name = local.openVPN.name[count.index] + target_node = local.openVPN.node[count.index] + clone = local.template + tags = local.openVPN.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.openVPN.cores + sockets = 1 + cpu_type = "host" + memory = local.openVPN.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.openVPN.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.openVPN.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} From 04b638b8f925a67138a911525aaaa986233b7a61 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 14 Jan 2026 06:13:42 -0600 Subject: [PATCH 0995/1058] fix gitlab pipeline --- .gitlab/.gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml index 4c7a36a..b21e1bf 100644 --- a/.gitlab/.gitlab-ci.yml +++ b/.gitlab/.gitlab-ci.yml @@ -4,7 +4,7 @@ stages: build_dmz: stage: triggers trigger: - include: infra/.gitlab/.gitlab-ci.yml + include: dmz/.gitlab/.gitlab-ci.yml rules: - changes: - "dmz/terraform/*.tf" From a6437bb1097f7deb61269e1414439c393b77a7f1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:46:37 -0600 Subject: [PATCH 0996/1058] add searxng --- dmz/searxng/Chart.yaml | 27 +++++++++ dmz/searxng/templates/NOTES.txt | 1 + dmz/searxng/templates/common.yaml | 17 ++++++ dmz/searxng/templates/configmap.yaml | 11 ++++ dmz/searxng/templates/ingress.yaml | 45 +++++++++++++++ dmz/searxng/values.yaml | 83 ++++++++++++++++++++++++++++ infra/argocd/templates/searxng.yaml | 22 ++++++++ 7 files changed, 206 insertions(+) create mode 100644 dmz/searxng/Chart.yaml create mode 100644 dmz/searxng/templates/NOTES.txt create mode 100644 dmz/searxng/templates/common.yaml create mode 100644 dmz/searxng/templates/configmap.yaml create mode 100644 dmz/searxng/templates/ingress.yaml create mode 100644 dmz/searxng/values.yaml create mode 100644 infra/argocd/templates/searxng.yaml diff --git a/dmz/searxng/Chart.yaml b/dmz/searxng/Chart.yaml new file mode 100644 index 0000000..0a3d722 --- /dev/null +++ b/dmz/searxng/Chart.yaml @@ -0,0 +1,27 @@ +apiVersion: v2 +appVersion: latest +description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. +name: searxng +version: 1.0.1 +kubeVersion: ">=1.16.0-0" +keywords: + - searx + - searxng + - search engine + - privacy +icon: https://github.com/searxng/searxng/blob/master/searx/static/themes/simple/img/favicon.png?raw=true +sources: + - https://github.com/searxng/searxng + - https://docs.searxng.org + - https://hub.docker.com/r/searxng/searxng +maintainers: + - name: unixfox + email: searxng@unixfoxremovemeifyouwanttocontactme.eu +dependencies: + - name: common + repository: https://library-charts.k8s-at-home.com + version: 4.4.2 + - name: redis + version: 0.0.3 + repository: https://charts.pascaliske.dev + condition: redis.enabled diff --git a/dmz/searxng/templates/NOTES.txt b/dmz/searxng/templates/NOTES.txt new file mode 100644 index 0000000..90f7b65 --- /dev/null +++ b/dmz/searxng/templates/NOTES.txt @@ -0,0 +1 @@ +{{- include "common.notes.defaultNotes" . -}} diff --git a/dmz/searxng/templates/common.yaml b/dmz/searxng/templates/common.yaml new file mode 100644 index 0000000..f8490f9 --- /dev/null +++ b/dmz/searxng/templates/common.yaml @@ -0,0 +1,17 @@ +{{/* First Make sure all variables are set and merged properly */}} +{{- include "common.values.setup" . }} + +{{/* Append the configMap volume to the volumes */}} +{{- define "searxng.settingsVolume" -}} +enabled: "true" +mountPath: "/etc/searxng/settings.yml" +subPath: "settings.yml" +type: "custom" +volumeSpec: + secret: + secretName: {{ include "common.names.fullname" . }}-config +{{- end -}} +{{- $_ := set .Values.persistence "searxng-config" (include "searxng.settingsVolume" . | fromYaml) -}} + +{{/* Render the templates */}} +{{ include "common.all" . }} \ No newline at end of file diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml new file mode 100644 index 0000000..f27ea5d --- /dev/null +++ b/dmz/searxng/templates/configmap.yaml @@ -0,0 +1,11 @@ +{{- include "common.values.setup" . -}} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }}-config + labels: + {{- include "common.labels" . | nindent 4 }} +data: + settings.yml: |- +{{ toYaml .Values.searxng.config | b64enc | indent 4 }} \ No newline at end of file diff --git a/dmz/searxng/templates/ingress.yaml b/dmz/searxng/templates/ingress.yaml new file mode 100644 index 0000000..8093211 --- /dev/null +++ b/dmz/searxng/templates/ingress.yaml @@ -0,0 +1,45 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: searxng-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`searxng.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: searxng + port: 3000 + tls: + secretName: searxng-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: searxng-tls +spec: + secretName: searxng-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "searxng.durp.info" + dnsNames: + - "searxng.durp.info" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: searxng-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: searxng.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/searxng/values.yaml b/dmz/searxng/values.yaml new file mode 100644 index 0000000..0f92a3b --- /dev/null +++ b/dmz/searxng/values.yaml @@ -0,0 +1,83 @@ +# +# IMPORTANT NOTE +# +# This chart inherits from our common library chart. You can check the default values/options here: +# https://github.com/k8s-at-home/library-charts/tree/main/charts/stable/common/values.yaml +# + +image: + # -- image repository + repository: registry.durp.info/searxng/searxng + # -- image tag + tag: latest + # -- image pull policy + pullPolicy: Always + +# Explanation about each environment variables here: +# https://docs.searxng.org/admin/installation-docker.html#command-line +env: + INSTANCE_NAME: "durp.info" + BASE_URL: "https://searx.durp.info" + AUTOCOMPLETE: "false" + # MORTY_URL: "http://morty:8080" + # MORTY_KEY: "mysecretkey" + # BIND_ADDRESS: "0.0.0.0:8080" + +controller: + strategy: "RollingUpdate" + +# -- Configures service settings for the chart. +# @default -- See values.yaml +service: + main: + ports: + http: + port: 8080 + +# -- Configure persistence settings for the chart under this key. +# @default -- See values.yaml +persistence: + config: + enabled: false + +ingress: + # -- Enable and configure ingress settings for the chart under this key. + # @default -- See values.yaml + main: + enabled: false + +searxng: + config: + use_default_settings: true + #server: + # secret_key: pleasechangeme + # Uncomment when using the builtin rate limiter + # See https://docs.searxng.org/src/searx.plugins.limiter.html#limiter-plugin + # server.limiter: true + # redis.url: redis://@searxng-redis:6379/0 + +probes: + readiness: + custom: true + spec: + httpGet: + path: /healthz + port: 8080 + liveness: + custom: true + spec: + httpGet: + path: /healthz + port: 8080 + startup: + custom: true + spec: + httpGet: + path: /healthz + port: 8080 + +# Enable when using searxng builtin rate limiter +# Values: https://github.com/pascaliske/helm-charts/tree/master/charts/redis +redis: + enabled: false + \ No newline at end of file diff --git a/infra/argocd/templates/searxng.yaml b/infra/argocd/templates/searxng.yaml new file mode 100644 index 0000000..174c060 --- /dev/null +++ b/infra/argocd/templates/searxng.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: searxng + namespace: argocd +spec: + project: default + source: + repoURL: https://gitlab.com/developerdurp/homelab.git + targetRevision: main + path: dmz/searxng + directory: + recurse: true + destination: + name: dmz + namespace: searxng + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true From 3e062cea4c9671959ac9e0570a38ddfda149c29c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:51:06 -0600 Subject: [PATCH 0997/1058] update --- dmz/searxng/Chart.yaml | 18 ------------------ dmz/searxng/templates/configmap.yaml | 3 +-- 2 files changed, 1 insertion(+), 20 deletions(-) diff --git a/dmz/searxng/Chart.yaml b/dmz/searxng/Chart.yaml index 0a3d722..6d8990f 100644 --- a/dmz/searxng/Chart.yaml +++ b/dmz/searxng/Chart.yaml @@ -3,25 +3,7 @@ appVersion: latest description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. name: searxng version: 1.0.1 -kubeVersion: ">=1.16.0-0" -keywords: - - searx - - searxng - - search engine - - privacy -icon: https://github.com/searxng/searxng/blob/master/searx/static/themes/simple/img/favicon.png?raw=true -sources: - - https://github.com/searxng/searxng - - https://docs.searxng.org - - https://hub.docker.com/r/searxng/searxng -maintainers: - - name: unixfox - email: searxng@unixfoxremovemeifyouwanttocontactme.eu dependencies: - name: common repository: https://library-charts.k8s-at-home.com version: 4.4.2 - - name: redis - version: 0.0.3 - repository: https://charts.pascaliske.dev - condition: redis.enabled diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml index f27ea5d..b05869b 100644 --- a/dmz/searxng/templates/configmap.yaml +++ b/dmz/searxng/templates/configmap.yaml @@ -7,5 +7,4 @@ metadata: labels: {{- include "common.labels" . | nindent 4 }} data: - settings.yml: |- -{{ toYaml .Values.searxng.config | b64enc | indent 4 }} \ No newline at end of file + settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} \ No newline at end of file From 5a0664e1efa7259da1fb228740d026cadee5ad3c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:52:57 -0600 Subject: [PATCH 0998/1058] update --- dmz/searxng/templates/configmap.yaml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml index b05869b..5b3239e 100644 --- a/dmz/searxng/templates/configmap.yaml +++ b/dmz/searxng/templates/configmap.yaml @@ -1,5 +1,3 @@ -{{- include "common.values.setup" . -}} ---- apiVersion: v1 kind: Secret metadata: @@ -7,4 +5,4 @@ metadata: labels: {{- include "common.labels" . | nindent 4 }} data: - settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} \ No newline at end of file + settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} From 6799a84f65c3215a4aa1a89884b59c410711056f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:53:36 -0600 Subject: [PATCH 0999/1058] update --- dmz/searxng/templates/configmap.yaml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml index 5b3239e..c0b5155 100644 --- a/dmz/searxng/templates/configmap.yaml +++ b/dmz/searxng/templates/configmap.yaml @@ -1,8 +1,9 @@ -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "common.names.fullname" . }}-config - labels: - {{- include "common.labels" . | nindent 4 }} -data: - settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} +#apiVersion: v1 +#kind: Secret +#metadata: +# name: {{ include "common.names.fullname" . }}-config +# labels: +# {{- include "common.labels" . | nindent 4 }} +#data: +# settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} +# \ No newline at end of file From 5e39fb1a1dc520514e62cb4cf7e453b66ce9a297 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 18 Jan 2026 06:58:20 -0600 Subject: [PATCH 1000/1058] update --- dmz/searxng/Chart.yaml | 9 +++++---- dmz/searxng/templates/NOTES.txt | 1 - dmz/searxng/templates/common.yaml | 17 ----------------- dmz/searxng/templates/configmap.yaml | 9 --------- dmz/searxng/templates/deployment.yaml | 24 ++++++++++++++++++++++++ dmz/searxng/templates/ingress.yaml | 4 ++-- dmz/searxng/templates/service.yaml | 12 ++++++++++++ 7 files changed, 43 insertions(+), 33 deletions(-) delete mode 100644 dmz/searxng/templates/NOTES.txt delete mode 100644 dmz/searxng/templates/common.yaml delete mode 100644 dmz/searxng/templates/configmap.yaml create mode 100644 dmz/searxng/templates/deployment.yaml create mode 100644 dmz/searxng/templates/service.yaml diff --git a/dmz/searxng/Chart.yaml b/dmz/searxng/Chart.yaml index 6d8990f..263432f 100644 --- a/dmz/searxng/Chart.yaml +++ b/dmz/searxng/Chart.yaml @@ -3,7 +3,8 @@ appVersion: latest description: SearXNG is a free internet metasearch engine which aggregates results from various search services and databases. name: searxng version: 1.0.1 -dependencies: - - name: common - repository: https://library-charts.k8s-at-home.com - version: 4.4.2 +#dependencies: +# - name: common +# repository: https://library-charts.k8s-at-home.com +# version: 4.4.2 +# \ No newline at end of file diff --git a/dmz/searxng/templates/NOTES.txt b/dmz/searxng/templates/NOTES.txt deleted file mode 100644 index 90f7b65..0000000 --- a/dmz/searxng/templates/NOTES.txt +++ /dev/null @@ -1 +0,0 @@ -{{- include "common.notes.defaultNotes" . -}} diff --git a/dmz/searxng/templates/common.yaml b/dmz/searxng/templates/common.yaml deleted file mode 100644 index f8490f9..0000000 --- a/dmz/searxng/templates/common.yaml +++ /dev/null @@ -1,17 +0,0 @@ -{{/* First Make sure all variables are set and merged properly */}} -{{- include "common.values.setup" . }} - -{{/* Append the configMap volume to the volumes */}} -{{- define "searxng.settingsVolume" -}} -enabled: "true" -mountPath: "/etc/searxng/settings.yml" -subPath: "settings.yml" -type: "custom" -volumeSpec: - secret: - secretName: {{ include "common.names.fullname" . }}-config -{{- end -}} -{{- $_ := set .Values.persistence "searxng-config" (include "searxng.settingsVolume" . | fromYaml) -}} - -{{/* Render the templates */}} -{{ include "common.all" . }} \ No newline at end of file diff --git a/dmz/searxng/templates/configmap.yaml b/dmz/searxng/templates/configmap.yaml deleted file mode 100644 index c0b5155..0000000 --- a/dmz/searxng/templates/configmap.yaml +++ /dev/null @@ -1,9 +0,0 @@ -#apiVersion: v1 -#kind: Secret -#metadata: -# name: {{ include "common.names.fullname" . }}-config -# labels: -# {{- include "common.labels" . | nindent 4 }} -#data: -# settings.yml: {{ .Values.searxng.config | toYaml | b64enc | quote }} -# \ No newline at end of file diff --git a/dmz/searxng/templates/deployment.yaml b/dmz/searxng/templates/deployment.yaml new file mode 100644 index 0000000..3ab2d47 --- /dev/null +++ b/dmz/searxng/templates/deployment.yaml @@ -0,0 +1,24 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + namespace: searxng + name: searxng + labels: + app: searxng +spec: + selector: + matchLabels: + app: searxng + replicas: 1 + template: + metadata: + labels: + app: searxng + spec: + containers: + - name: searxng + image: registry.durp.info/searxng/searxng:latest + imagePullPolicy: Always + ports: + - name: http + containerPort: 8080 \ No newline at end of file diff --git a/dmz/searxng/templates/ingress.yaml b/dmz/searxng/templates/ingress.yaml index 8093211..da757e7 100644 --- a/dmz/searxng/templates/ingress.yaml +++ b/dmz/searxng/templates/ingress.yaml @@ -12,8 +12,8 @@ spec: - name: authentik-proxy-provider namespace: traefik services: - - name: searxng - port: 3000 + - name: searxng-service + port: 8080 tls: secretName: searxng-tls diff --git a/dmz/searxng/templates/service.yaml b/dmz/searxng/templates/service.yaml new file mode 100644 index 0000000..8498428 --- /dev/null +++ b/dmz/searxng/templates/service.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: Service +metadata: + name: searxng-service +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + protocol: TCP + selector: + app: searxng From 6912ca701a45ad101e59409ef43ab895d13c8cd9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 2 Feb 2026 05:18:06 -0600 Subject: [PATCH 1001/1058] remove terraform --- dev/terraform/k3s.tf | 115 -- dev/terraform/main.tf | 48 - dev/terraform/variables.tf | 14 - dmz/terraform/k3s.tf | 115 -- dmz/terraform/main.tf | 58 - dmz/terraform/openVPN.tf | 57 - dmz/terraform/variables.tf | 14 - infra/terraform/k3s.tf | 116 -- infra/terraform/main.tf | 81 - infra/terraform/pihole.tf | 57 - infra/terraform/postgres.tf | 116 -- infra/terraform/variables.tf | 14 - master/argocd/Chart.yaml | 14 - master/argocd/templates/InternalProxy.yaml | 23 - master/argocd/templates/argocd.yaml | 59 - master/argocd/templates/authentik.yaml | 21 - master/argocd/templates/bitwarden.yaml | 23 - master/argocd/templates/cert-manager.yaml | 20 - master/argocd/templates/crossplane.yml | 20 - master/argocd/templates/durpapi.yaml | 20 - master/argocd/templates/durpot.yaml | 20 - master/argocd/templates/external-dns.yaml | 20 - master/argocd/templates/external-secrets.yaml | 20 - master/argocd/templates/gatekeeper.yaml | 20 - master/argocd/templates/gitlab-runner.yaml | 21 - master/argocd/templates/heimdall.yaml | 20 - master/argocd/templates/krakend.yaml | 20 - .../templates/kube-prometheus-stack.yaml | 22 - master/argocd/templates/kubeclarity.yaml | 21 - master/argocd/templates/littlelink.yaml | 22 - master/argocd/templates/longhorn.yaml | 21 - master/argocd/templates/metallb-system.yaml | 22 - master/argocd/templates/nfs-client.yaml | 23 - master/argocd/templates/open-webui.yaml | 21 - master/argocd/templates/secrets.yaml | 17 - master/argocd/templates/traefik.yaml | 20 - master/argocd/templates/uptimekuma.yaml | 23 - master/argocd/templates/vault.yaml | 25 - master/argocd/values.yaml | 62 - master/authentik/Chart.yaml | 12 - master/authentik/templates/authentik-pv.yaml | 24 - master/authentik/templates/authentik-pvc.yaml | 18 - master/authentik/templates/ingress.yaml | 60 - master/authentik/templates/secrets.yaml | 28 - master/authentik/values.yaml | 30 - master/bitwarden/Chart.yaml | 7 - master/bitwarden/templates/bitwarden-pv.yaml | 25 - master/bitwarden/templates/bitwarden-pvc.yaml | 11 - master/bitwarden/templates/deployment.yaml | 50 - master/bitwarden/templates/ingress.yaml | 42 - master/bitwarden/templates/secrets.yaml | 16 - master/bitwarden/templates/service.yaml | 12 - master/cert-manager/Chart.yaml | 11 - .../templates/letsencrypt-prroduction.yaml | 16 - .../templates/letsencrypt-staging.yaml | 16 - .../cert-manager/templates/sealedsecret.yaml | 16 - master/cert-manager/values.yaml | 25 - master/crossplane/Chart.yaml | 12 - master/crossplane/templates/gitlab.yml | 55 - master/dashboards/nginx-dashboard.yaml | 1506 ----------------- master/durpapi/Chart.yaml | 13 - master/durpapi/templates/deployment.yaml | 38 - master/durpapi/templates/hpa.yaml | 24 - master/durpapi/templates/ingress.yaml | 44 - master/durpapi/templates/secrets.yaml | 39 - master/durpapi/templates/service.yaml | 12 - master/durpapi/values.yaml | 39 - master/durpot/Chart.yaml | 11 - master/durpot/templates/secrets.yaml | 43 - master/external-dns/Chart.yaml | 12 - master/external-dns/templates/secrets.yaml | 23 - master/external-dns/values.yaml | 16 - master/external-secrets/Chart.yaml | 12 - master/external-secrets/values.yaml | 463 ----- master/gatekeeper/Chart.yaml | 11 - master/gatekeeper/values.yaml | 278 --- master/gitlab-runner/Chart.yaml | 11 - master/gitlab-runner/templates/secrets.yaml | 19 - master/gitlab-runner/values.yaml | 71 - master/heimdall/Chart.yaml | 11 - master/heimdall/templates/ingress.yaml | 52 - master/heimdall/values.yaml | 28 - master/internalproxy/Chart.yaml | 7 - master/internalproxy/templates/argocd.yaml | 46 - master/internalproxy/templates/blueiris.yaml | 63 - .../templates/duplicati-ingress.yaml | 70 - master/internalproxy/templates/gitea.yaml | 72 - master/internalproxy/templates/infra.yaml | 60 - master/internalproxy/templates/jellyfin.yaml | 72 - master/internalproxy/templates/kasm.yaml | 72 - master/internalproxy/templates/minio.yaml | 63 - master/internalproxy/templates/nexus.yaml | 71 - master/internalproxy/templates/octopus.yaml | 63 - master/internalproxy/templates/ollama.yaml | 102 -- master/internalproxy/templates/plex.yaml | 72 - master/internalproxy/templates/portainer.yaml | 63 - master/internalproxy/templates/proxmox.yaml | 63 - master/internalproxy/templates/redlib.yaml | 68 - .../templates/registry-internal.yaml | 59 - master/internalproxy/templates/registry.yaml | 71 - master/internalproxy/templates/s3.yaml | 63 - master/internalproxy/templates/semaphore.yaml | 63 - master/internalproxy/templates/smokeping.yaml | 82 - master/internalproxy/templates/speedtest.yaml | 74 - master/internalproxy/templates/tdarr.yaml | 67 - master/internalproxy/templates/unifi.yaml | 63 - master/internalproxy/templates/unraid.yaml | 63 - master/internalproxy/templates/vault.yaml | 63 - master/internalproxy/templates/wazuh.yaml | 63 - master/krakend/Chart.yaml | 7 - master/krakend/templates/deployments.yaml | 39 - master/krakend/templates/ingress.yaml | 56 - master/krakend/templates/secrets.yaml | 15 - master/krakend/templates/service.yaml | 12 - master/kube-prometheus-stack/Chart.yaml | 12 - .../templates/grafana-secrets-sealed.yaml | 41 - .../templates/ingress.yaml | 80 - master/kube-prometheus-stack/values.yaml | 203 --- master/kubeclarity/Chart.yaml | 11 - master/kubeclarity/templates/ingress.yaml | 47 - master/kubeclarity/values.yaml | 235 --- master/littlelink/Chart.yaml | 0 master/littlelink/templates/deployment.yaml | 101 -- master/littlelink/templates/ingress.yaml | 42 - master/littlelink/templates/service.yaml | 12 - master/longhorn/Chart.yaml | 12 - master/longhorn/templates/ingress.yaml | 41 - master/longhorn/templates/secrets.yaml | 24 - master/longhorn/values.yaml | 253 --- master/metallb-system/Chart.yaml | 13 - master/metallb-system/templates/config.yaml | 17 - master/metallb-system/values.yaml | 197 --- master/nfs-client/Chart.yml | 8 - .../templates/cluster-role-binding.yml | 12 - master/nfs-client/templates/cluster-role.yml | 20 - master/nfs-client/templates/provisioner.yml | 42 - master/nfs-client/templates/role-binding.yml | 13 - master/nfs-client/templates/role.yml | 9 - .../nfs-client/templates/service-account.yml | 5 - master/nfs-client/templates/storage-class.yml | 10 - master/open-webui/Chart.yaml | 7 - master/open-webui/templates/deployment.yaml | 37 - master/open-webui/templates/ingress.yaml | 42 - master/open-webui/templates/pvc.yaml | 11 - master/open-webui/templates/secrets.yaml | 16 - master/open-webui/templates/service.yaml | 12 - master/traefik/Chart.yaml | 11 - master/traefik/templates/ingress.yaml | 39 - master/traefik/templates/middlewares.yaml | 35 - master/traefik/values.yaml | 887 ---------- master/uptimekuma/Chart.yaml | 7 - master/uptimekuma/templates/deployment.yaml | 42 - master/uptimekuma/templates/ingress.yaml | 42 - master/uptimekuma/templates/kuma-pv.yaml | 25 - master/uptimekuma/templates/kuma-pvc.yaml | 12 - master/uptimekuma/templates/service.yaml | 13 - master/vault/Chart.yaml | 12 - master/vault/templates/ingress.yaml | 37 - master/vault/templates/secret-store.yaml | 14 - master/vault/values.yaml | 65 - prd/terraform/k3s.tf | 115 -- prd/terraform/main.tf | 48 - prd/terraform/variables.tf | 14 - 163 files changed, 9597 deletions(-) delete mode 100644 dev/terraform/k3s.tf delete mode 100644 dev/terraform/main.tf delete mode 100644 dev/terraform/variables.tf delete mode 100644 dmz/terraform/k3s.tf delete mode 100644 dmz/terraform/main.tf delete mode 100644 dmz/terraform/openVPN.tf delete mode 100644 dmz/terraform/variables.tf delete mode 100644 infra/terraform/k3s.tf delete mode 100644 infra/terraform/main.tf delete mode 100644 infra/terraform/pihole.tf delete mode 100644 infra/terraform/postgres.tf delete mode 100644 infra/terraform/variables.tf delete mode 100644 master/argocd/Chart.yaml delete mode 100644 master/argocd/templates/InternalProxy.yaml delete mode 100644 master/argocd/templates/argocd.yaml delete mode 100644 master/argocd/templates/authentik.yaml delete mode 100644 master/argocd/templates/bitwarden.yaml delete mode 100644 master/argocd/templates/cert-manager.yaml delete mode 100644 master/argocd/templates/crossplane.yml delete mode 100644 master/argocd/templates/durpapi.yaml delete mode 100644 master/argocd/templates/durpot.yaml delete mode 100644 master/argocd/templates/external-dns.yaml delete mode 100644 master/argocd/templates/external-secrets.yaml delete mode 100644 master/argocd/templates/gatekeeper.yaml delete mode 100644 master/argocd/templates/gitlab-runner.yaml delete mode 100644 master/argocd/templates/heimdall.yaml delete mode 100644 master/argocd/templates/krakend.yaml delete mode 100644 master/argocd/templates/kube-prometheus-stack.yaml delete mode 100644 master/argocd/templates/kubeclarity.yaml delete mode 100644 master/argocd/templates/littlelink.yaml delete mode 100644 master/argocd/templates/longhorn.yaml delete mode 100644 master/argocd/templates/metallb-system.yaml delete mode 100644 master/argocd/templates/nfs-client.yaml delete mode 100644 master/argocd/templates/open-webui.yaml delete mode 100644 master/argocd/templates/secrets.yaml delete mode 100644 master/argocd/templates/traefik.yaml delete mode 100644 master/argocd/templates/uptimekuma.yaml delete mode 100644 master/argocd/templates/vault.yaml delete mode 100644 master/argocd/values.yaml delete mode 100644 master/authentik/Chart.yaml delete mode 100644 master/authentik/templates/authentik-pv.yaml delete mode 100644 master/authentik/templates/authentik-pvc.yaml delete mode 100644 master/authentik/templates/ingress.yaml delete mode 100644 master/authentik/templates/secrets.yaml delete mode 100644 master/authentik/values.yaml delete mode 100644 master/bitwarden/Chart.yaml delete mode 100644 master/bitwarden/templates/bitwarden-pv.yaml delete mode 100644 master/bitwarden/templates/bitwarden-pvc.yaml delete mode 100644 master/bitwarden/templates/deployment.yaml delete mode 100644 master/bitwarden/templates/ingress.yaml delete mode 100644 master/bitwarden/templates/secrets.yaml delete mode 100644 master/bitwarden/templates/service.yaml delete mode 100644 master/cert-manager/Chart.yaml delete mode 100644 master/cert-manager/templates/letsencrypt-prroduction.yaml delete mode 100644 master/cert-manager/templates/letsencrypt-staging.yaml delete mode 100644 master/cert-manager/templates/sealedsecret.yaml delete mode 100644 master/cert-manager/values.yaml delete mode 100644 master/crossplane/Chart.yaml delete mode 100644 master/crossplane/templates/gitlab.yml delete mode 100644 master/dashboards/nginx-dashboard.yaml delete mode 100644 master/durpapi/Chart.yaml delete mode 100644 master/durpapi/templates/deployment.yaml delete mode 100644 master/durpapi/templates/hpa.yaml delete mode 100644 master/durpapi/templates/ingress.yaml delete mode 100644 master/durpapi/templates/secrets.yaml delete mode 100644 master/durpapi/templates/service.yaml delete mode 100644 master/durpapi/values.yaml delete mode 100644 master/durpot/Chart.yaml delete mode 100644 master/durpot/templates/secrets.yaml delete mode 100644 master/external-dns/Chart.yaml delete mode 100644 master/external-dns/templates/secrets.yaml delete mode 100644 master/external-dns/values.yaml delete mode 100644 master/external-secrets/Chart.yaml delete mode 100644 master/external-secrets/values.yaml delete mode 100644 master/gatekeeper/Chart.yaml delete mode 100644 master/gatekeeper/values.yaml delete mode 100644 master/gitlab-runner/Chart.yaml delete mode 100644 master/gitlab-runner/templates/secrets.yaml delete mode 100644 master/gitlab-runner/values.yaml delete mode 100644 master/heimdall/Chart.yaml delete mode 100644 master/heimdall/templates/ingress.yaml delete mode 100644 master/heimdall/values.yaml delete mode 100644 master/internalproxy/Chart.yaml delete mode 100644 master/internalproxy/templates/argocd.yaml delete mode 100644 master/internalproxy/templates/blueiris.yaml delete mode 100644 master/internalproxy/templates/duplicati-ingress.yaml delete mode 100644 master/internalproxy/templates/gitea.yaml delete mode 100644 master/internalproxy/templates/infra.yaml delete mode 100644 master/internalproxy/templates/jellyfin.yaml delete mode 100644 master/internalproxy/templates/kasm.yaml delete mode 100644 master/internalproxy/templates/minio.yaml delete mode 100644 master/internalproxy/templates/nexus.yaml delete mode 100644 master/internalproxy/templates/octopus.yaml delete mode 100644 master/internalproxy/templates/ollama.yaml delete mode 100644 master/internalproxy/templates/plex.yaml delete mode 100644 master/internalproxy/templates/portainer.yaml delete mode 100644 master/internalproxy/templates/proxmox.yaml delete mode 100644 master/internalproxy/templates/redlib.yaml delete mode 100644 master/internalproxy/templates/registry-internal.yaml delete mode 100644 master/internalproxy/templates/registry.yaml delete mode 100644 master/internalproxy/templates/s3.yaml delete mode 100644 master/internalproxy/templates/semaphore.yaml delete mode 100644 master/internalproxy/templates/smokeping.yaml delete mode 100644 master/internalproxy/templates/speedtest.yaml delete mode 100644 master/internalproxy/templates/tdarr.yaml delete mode 100644 master/internalproxy/templates/unifi.yaml delete mode 100644 master/internalproxy/templates/unraid.yaml delete mode 100644 master/internalproxy/templates/vault.yaml delete mode 100644 master/internalproxy/templates/wazuh.yaml delete mode 100644 master/krakend/Chart.yaml delete mode 100644 master/krakend/templates/deployments.yaml delete mode 100644 master/krakend/templates/ingress.yaml delete mode 100644 master/krakend/templates/secrets.yaml delete mode 100644 master/krakend/templates/service.yaml delete mode 100644 master/kube-prometheus-stack/Chart.yaml delete mode 100644 master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml delete mode 100644 master/kube-prometheus-stack/templates/ingress.yaml delete mode 100644 master/kube-prometheus-stack/values.yaml delete mode 100644 master/kubeclarity/Chart.yaml delete mode 100644 master/kubeclarity/templates/ingress.yaml delete mode 100644 master/kubeclarity/values.yaml delete mode 100644 master/littlelink/Chart.yaml delete mode 100644 master/littlelink/templates/deployment.yaml delete mode 100644 master/littlelink/templates/ingress.yaml delete mode 100644 master/littlelink/templates/service.yaml delete mode 100644 master/longhorn/Chart.yaml delete mode 100644 master/longhorn/templates/ingress.yaml delete mode 100644 master/longhorn/templates/secrets.yaml delete mode 100644 master/longhorn/values.yaml delete mode 100644 master/metallb-system/Chart.yaml delete mode 100644 master/metallb-system/templates/config.yaml delete mode 100644 master/metallb-system/values.yaml delete mode 100644 master/nfs-client/Chart.yml delete mode 100644 master/nfs-client/templates/cluster-role-binding.yml delete mode 100644 master/nfs-client/templates/cluster-role.yml delete mode 100644 master/nfs-client/templates/provisioner.yml delete mode 100644 master/nfs-client/templates/role-binding.yml delete mode 100644 master/nfs-client/templates/role.yml delete mode 100644 master/nfs-client/templates/service-account.yml delete mode 100644 master/nfs-client/templates/storage-class.yml delete mode 100644 master/open-webui/Chart.yaml delete mode 100644 master/open-webui/templates/deployment.yaml delete mode 100644 master/open-webui/templates/ingress.yaml delete mode 100644 master/open-webui/templates/pvc.yaml delete mode 100644 master/open-webui/templates/secrets.yaml delete mode 100644 master/open-webui/templates/service.yaml delete mode 100644 master/traefik/Chart.yaml delete mode 100644 master/traefik/templates/ingress.yaml delete mode 100644 master/traefik/templates/middlewares.yaml delete mode 100644 master/traefik/values.yaml delete mode 100644 master/uptimekuma/Chart.yaml delete mode 100644 master/uptimekuma/templates/deployment.yaml delete mode 100644 master/uptimekuma/templates/ingress.yaml delete mode 100644 master/uptimekuma/templates/kuma-pv.yaml delete mode 100644 master/uptimekuma/templates/kuma-pvc.yaml delete mode 100644 master/uptimekuma/templates/service.yaml delete mode 100644 master/vault/Chart.yaml delete mode 100644 master/vault/templates/ingress.yaml delete mode 100644 master/vault/templates/secret-store.yaml delete mode 100644 master/vault/values.yaml delete mode 100644 prd/terraform/k3s.tf delete mode 100644 prd/terraform/main.tf delete mode 100644 prd/terraform/variables.tf diff --git a/dev/terraform/k3s.tf b/dev/terraform/k3s.tf deleted file mode 100644 index 4d02a21..0000000 --- a/dev/terraform/k3s.tf +++ /dev/null @@ -1,115 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - count = local.k3smaster.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - clone = local.template - tags = local.k3smaster.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3smaster.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.k3smaster.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - count = local.k3sserver.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - clone = local.template - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3sserver.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.k3sserver.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/dev/terraform/main.tf b/dev/terraform/main.tf deleted file mode 100644 index c75295e..0000000 --- a/dev/terraform/main.tf +++ /dev/null @@ -1,48 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.10.1" - vlan = 10 - k3smaster = { - tags = "k3s_dev" - count = 3 - name = ["master01-dev", "master02-dev", "master03-dev"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_dev" - count = 3 - name = ["node01-dev", "node02-dev", "node03-dev"] - cores = 4 - memory = "8192" - drive = 120 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } -} diff --git a/dev/terraform/variables.tf b/dev/terraform/variables.tf deleted file mode 100644 index 29a1c9d..0000000 --- a/dev/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "Username to Proxmox provider" - type = string -} diff --git a/dmz/terraform/k3s.tf b/dmz/terraform/k3s.tf deleted file mode 100644 index bca2f62..0000000 --- a/dmz/terraform/k3s.tf +++ /dev/null @@ -1,115 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - count = local.k3smaster.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - clone = local.template - tags = local.k3smaster.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - count = local.k3sserver.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - clone = local.template - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/dmz/terraform/main.tf b/dmz/terraform/main.tf deleted file mode 100644 index 4a949bd..0000000 --- a/dmz/terraform/main.tf +++ /dev/null @@ -1,58 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - storage = "cache-domains" - emulatessd = true - format = "raw" - dnsserver = "192.168.98.1" - vlan = 98 - k3smaster = { - tags = "k3s_dmz" - count = 3 - name = ["master01-dmz", "master02-dmz", "master03-dmz"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_dmz" - count = 3 - name = ["node01-dmz", "node02-dmz", "node03-dmz"] - cores = 4 - memory = "8192" - drive = 240 - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } - openVPN = { - tags = "openVPN" - count = 1 - name = ["openVPN"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership"] - ip = ["20"] - } -} diff --git a/dmz/terraform/openVPN.tf b/dmz/terraform/openVPN.tf deleted file mode 100644 index ea43924..0000000 --- a/dmz/terraform/openVPN.tf +++ /dev/null @@ -1,57 +0,0 @@ -resource "proxmox_vm_qemu" "openVPN" { - count = local.openVPN.count - ciuser = "administrator" - vmid = "${local.vlan}${local.openVPN.ip[count.index]}" - name = local.openVPN.name[count.index] - target_node = local.openVPN.node[count.index] - clone = local.template - tags = local.openVPN.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.openVPN.cores - sockets = 1 - cpu_type = "host" - memory = local.openVPN.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.openVPN.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.openVPN.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/dmz/terraform/variables.tf b/dmz/terraform/variables.tf deleted file mode 100644 index 31a92e0..0000000 --- a/dmz/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "UIsername to Proxmox provider" - type = string -} diff --git a/infra/terraform/k3s.tf b/infra/terraform/k3s.tf deleted file mode 100644 index 24e00e6..0000000 --- a/infra/terraform/k3s.tf +++ /dev/null @@ -1,116 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - lifecycle { - prevent_destroy = true - } - count = local.k3smaster.count - ciuser = "administrator" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - tags = local.k3smaster.tags - full_clone = false - qemu_os = "l26" - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3smaster.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.k3smaster.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - lifecycle { - prevent_destroy = true - } - count = local.k3sserver.count - ciuser = "administrator" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = false - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3sserver.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.k3sserver.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/infra/terraform/main.tf b/infra/terraform/main.tf deleted file mode 100644 index df2d033..0000000 --- a/infra/terraform/main.tf +++ /dev/null @@ -1,81 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.12.1" - vlan = 12 - k3smaster = { - tags = "k3s_infra" - count = 3 - name = ["master01-infra", "master02-infra", "master03-infra"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_infra" - count = 3 - name = ["node01-infra", "node02-infra", "node03-infra"] - cores = 4 - memory = "16384" - drive = 240 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } - #haproxy = { - # tags = "haproxy" - # count = 3 - # name = ["haproxy-01", "haproxy-02", "haproxy-03"] - # cores = 2 - # memory = "1024" - # drive = 20 - # storage = "cache-domains" - # node = ["mothership", "overlord", "vanguard"] - # ip = ["31", "32", "33"] - #} - #postgres = { - # tags = "postgres" - # count = 3 - # name = ["postgres-01", "postgres-02", "postgres-03"] - # cores = 4 - # memory = "4096" - # drive = 40 - # storage = "cache-domains" - # node = ["mothership", "overlord", "vanguard"] - # ip = ["34", "35", "36"] - #} - pihole = { - tags = "pihole" - count = 3 - name = ["pihole-01", "pihole-02", "pihole-03"] - cores = 2 - memory = "2048" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["41", "42", "43"] - } -} diff --git a/infra/terraform/pihole.tf b/infra/terraform/pihole.tf deleted file mode 100644 index ced2aac..0000000 --- a/infra/terraform/pihole.tf +++ /dev/null @@ -1,57 +0,0 @@ -resource "proxmox_vm_qemu" "pihole" { - count = local.pihole.count - ciuser = "administrator" - vmid = "${local.vlan}${local.pihole.ip[count.index]}" - name = local.pihole.name[count.index] - target_node = local.pihole.node[count.index] - clone = local.template - tags = local.pihole.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.pihole.cores - sockets = 1 - cpu_type = "host" - memory = local.pihole.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.pihole.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.pihole.drive - format = local.format - storage = local.pihole.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.pihole.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/infra/terraform/postgres.tf b/infra/terraform/postgres.tf deleted file mode 100644 index 47b8daa..0000000 --- a/infra/terraform/postgres.tf +++ /dev/null @@ -1,116 +0,0 @@ -#resource "proxmox_vm_qemu" "haproxy" { -# count = local.haproxy.count -# ciuser = "administrator" -# vmid = "${local.vlan}${local.haproxy.ip[count.index]}" -# name = local.haproxy.name[count.index] -# target_node = local.haproxy.node[count.index] -# clone = local.template -# tags = local.haproxy.tags -# qemu_os = "l26" -# full_clone = true -# os_type = "cloud-init" -# agent = 1 -# cores = local.haproxy.cores -# sockets = 1 -# cpu_type = "host" -# memory = local.haproxy.memory -# scsihw = "virtio-scsi-pci" -# #bootdisk = "scsi0" -# boot = "order=virtio0" -# onboot = true -# sshkeys = local.sshkeys -# vga { -# type = "serial0" -# } -# serial { -# id = 0 -# type = "socket" -# } -# disks { -# ide { -# ide2 { -# cloudinit { -# storage = local.haproxy.storage -# } -# } -# } -# virtio { -# virtio0 { -# disk { -# size = local.haproxy.drive -# format = local.format -# storage = local.haproxy.storage -# } -# } -# } -# } -# network { -# id = 0 -# model = "virtio" -# bridge = "vmbr0" -# tag = local.vlan -# } -# #Cloud Init Settings -# ipconfig0 = "ip=192.168.${local.vlan}.${local.haproxy.ip[count.index]}/24,gw=192.168.${local.vlan}.1" -# searchdomain = "durp.loc" -# nameserver = local.dnsserver -#} -# -#resource "proxmox_vm_qemu" "postgres" { -# count = local.postgres.count -# ciuser = "administrator" -# vmid = "${local.vlan}${local.postgres.ip[count.index]}" -# name = local.postgres.name[count.index] -# target_node = local.postgres.node[count.index] -# clone = local.template -# tags = local.postgres.tags -# qemu_os = "l26" -# full_clone = true -# os_type = "cloud-init" -# agent = 1 -# cores = local.postgres.cores -# sockets = 1 -# cpu_type = "host" -# memory = local.postgres.memory -# scsihw = "virtio-scsi-pci" -# #bootdisk = "scsi0" -# boot = "order=virtio0" -# onboot = true -# sshkeys = local.sshkeys -# vga { -# type = "serial0" -# } -# serial { -# id = 0 -# type = "socket" -# } -# disks { -# ide { -# ide2 { -# cloudinit { -# storage = local.postgres.storage -# } -# } -# } -# virtio { -# virtio0 { -# disk { -# size = local.postgres.drive -# format = local.format -# storage = local.postgres.storage -# } -# } -# } -# } -# network { -# id = 0 -# model = "virtio" -# bridge = "vmbr0" -# tag = local.vlan -# } -# #Cloud Init Settings -# ipconfig0 = "ip=192.168.${local.vlan}.${local.postgres.ip[count.index]}/24,gw=192.168.${local.vlan}.1" -# searchdomain = "durp.loc" -# nameserver = local.dnsserver -#} -# \ No newline at end of file diff --git a/infra/terraform/variables.tf b/infra/terraform/variables.tf deleted file mode 100644 index 31a92e0..0000000 --- a/infra/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "UIsername to Proxmox provider" - type = string -} diff --git a/master/argocd/Chart.yaml b/master/argocd/Chart.yaml deleted file mode 100644 index 647c3cf..0000000 --- a/master/argocd/Chart.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v2 -name: argocd -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: argo-cd - repository: https://argoproj.github.io/argo-helm - version: 8.1.3 - - diff --git a/master/argocd/templates/InternalProxy.yaml b/master/argocd/templates/InternalProxy.yaml deleted file mode 100644 index 76c8229..0000000 --- a/master/argocd/templates/InternalProxy.yaml +++ /dev/null @@ -1,23 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: internalproxy -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/internalproxy -# directory: -# recurse: true -# destination: -# server: https://kubernetes.default.svc -# namespace: internalproxy -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# diff --git a/master/argocd/templates/argocd.yaml b/master/argocd/templates/argocd.yaml deleted file mode 100644 index e93aa4f..0000000 --- a/master/argocd/templates/argocd.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: argocd - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/argocd - destination: - namespace: argocd - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: argocd-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`argocd.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: argocd-server - port: 443 - scheme: https - tls: - secretName: argocd-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: argocd-tls -spec: - secretName: argocd-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "argocd.internal.durp.info" - dnsNames: - - "argocd.internal.durp.info" diff --git a/master/argocd/templates/authentik.yaml b/master/argocd/templates/authentik.yaml deleted file mode 100644 index 8d003fb..0000000 --- a/master/argocd/templates/authentik.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: authentik -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/authentik -# destination: -# namespace: authentik -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# diff --git a/master/argocd/templates/bitwarden.yaml b/master/argocd/templates/bitwarden.yaml deleted file mode 100644 index ed56924..0000000 --- a/master/argocd/templates/bitwarden.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: bitwarden - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/bitwarden - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: bitwarden - syncPolicy: - automated: - prune: true - selfHeal: false - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/cert-manager.yaml b/master/argocd/templates/cert-manager.yaml deleted file mode 100644 index fc11c13..0000000 --- a/master/argocd/templates/cert-manager.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: cert-manager - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/cert-manager - destination: - namespace: cert-manager - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/crossplane.yml b/master/argocd/templates/crossplane.yml deleted file mode 100644 index 21d8835..0000000 --- a/master/argocd/templates/crossplane.yml +++ /dev/null @@ -1,20 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: crossplane -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/crossplane -# destination: -# namespace: crossplane -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true diff --git a/master/argocd/templates/durpapi.yaml b/master/argocd/templates/durpapi.yaml deleted file mode 100644 index aeefcc1..0000000 --- a/master/argocd/templates/durpapi.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: durpapi - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/durpapi - destination: - namespace: durpapi - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/durpot.yaml b/master/argocd/templates/durpot.yaml deleted file mode 100644 index 7a97eb4..0000000 --- a/master/argocd/templates/durpot.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: durpot - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/durpot - destination: - namespace: durpot - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/external-dns.yaml b/master/argocd/templates/external-dns.yaml deleted file mode 100644 index 5cf21a5..0000000 --- a/master/argocd/templates/external-dns.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-dns - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/external-dns - destination: - namespace: external-dns - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/external-secrets.yaml b/master/argocd/templates/external-secrets.yaml deleted file mode 100644 index 04f8f1d..0000000 --- a/master/argocd/templates/external-secrets.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: external-secrets - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/external-secrets - destination: - namespace: external-secrets - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/gatekeeper.yaml b/master/argocd/templates/gatekeeper.yaml deleted file mode 100644 index e50e284..0000000 --- a/master/argocd/templates/gatekeeper.yaml +++ /dev/null @@ -1,20 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: gatekeeper -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/gatekeeper -# destination: -# namespace: gatekeeper -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true diff --git a/master/argocd/templates/gitlab-runner.yaml b/master/argocd/templates/gitlab-runner.yaml deleted file mode 100644 index 8a1afec..0000000 --- a/master/argocd/templates/gitlab-runner.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: gitlab-runner -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/gitlab-runner -# destination: -# namespace: gitlab-runner -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# diff --git a/master/argocd/templates/heimdall.yaml b/master/argocd/templates/heimdall.yaml deleted file mode 100644 index 333a761..0000000 --- a/master/argocd/templates/heimdall.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: heimdall - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/heimdall - destination: - namespace: heimdall - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/krakend.yaml b/master/argocd/templates/krakend.yaml deleted file mode 100644 index e5ed113..0000000 --- a/master/argocd/templates/krakend.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: krakend - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/krakend - destination: - namespace: krakend - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/kube-prometheus-stack.yaml b/master/argocd/templates/kube-prometheus-stack.yaml deleted file mode 100644 index 2de63f1..0000000 --- a/master/argocd/templates/kube-prometheus-stack.yaml +++ /dev/null @@ -1,22 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: kube-prometheus-stack -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/kube-prometheus-stack -# destination: -# namespace: kube-prometheus-stack -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# -# \ No newline at end of file diff --git a/master/argocd/templates/kubeclarity.yaml b/master/argocd/templates/kubeclarity.yaml deleted file mode 100644 index b202df7..0000000 --- a/master/argocd/templates/kubeclarity.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: kubeclarity -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/kubeclarity -# destination: -# namespace: kubeclarity -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# \ No newline at end of file diff --git a/master/argocd/templates/littlelink.yaml b/master/argocd/templates/littlelink.yaml deleted file mode 100644 index 856ac87..0000000 --- a/master/argocd/templates/littlelink.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: littlelink - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/littlelink - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: littlelink - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/longhorn.yaml b/master/argocd/templates/longhorn.yaml deleted file mode 100644 index 1e857c5..0000000 --- a/master/argocd/templates/longhorn.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: longhorn-system - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/longhorn - destination: - namespace: longhorn-system - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/metallb-system.yaml b/master/argocd/templates/metallb-system.yaml deleted file mode 100644 index d343453..0000000 --- a/master/argocd/templates/metallb-system.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: metallb-system - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/metallb-system - destination: - namespace: metallb-system - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - - diff --git a/master/argocd/templates/nfs-client.yaml b/master/argocd/templates/nfs-client.yaml deleted file mode 100644 index a299095..0000000 --- a/master/argocd/templates/nfs-client.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: nfs-client - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/nfs-client - directory: - recurse: true - destination: - namespace: nfs-client - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/open-webui.yaml b/master/argocd/templates/open-webui.yaml deleted file mode 100644 index bae227f..0000000 --- a/master/argocd/templates/open-webui.yaml +++ /dev/null @@ -1,21 +0,0 @@ -#apiVersion: argoproj.io/v1alpha1 -#kind: Application -#metadata: -# name: open-webui -# namespace: argocd -#spec: -# project: default -# source: -# repoURL: https://gitlab.com/developerdurp/homelab.git -# targetRevision: main -# path: master/open-webui -# destination: -# namespace: open-webui -# name: in-cluster -# syncPolicy: -# automated: -# prune: true -# selfHeal: true -# syncOptions: -# - CreateNamespace=true -# \ No newline at end of file diff --git a/master/argocd/templates/secrets.yaml b/master/argocd/templates/secrets.yaml deleted file mode 100644 index ee58a80..0000000 --- a/master/argocd/templates/secrets.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: vault-argocd - labels: - app.kubernetes.io/part-of: argocd -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: client-secret - data: - - secretKey: clientSecret - remoteRef: - key: secrets/argocd/authentik - property: clientsecret diff --git a/master/argocd/templates/traefik.yaml b/master/argocd/templates/traefik.yaml deleted file mode 100644 index e336d57..0000000 --- a/master/argocd/templates/traefik.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: traefik - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/traefik - destination: - namespace: traefik - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true diff --git a/master/argocd/templates/uptimekuma.yaml b/master/argocd/templates/uptimekuma.yaml deleted file mode 100644 index 1d2c5e6..0000000 --- a/master/argocd/templates/uptimekuma.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: uptimekuma - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/uptimekuma - directory: - recurse: true - destination: - server: https://kubernetes.default.svc - namespace: uptimekuma - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - diff --git a/master/argocd/templates/vault.yaml b/master/argocd/templates/vault.yaml deleted file mode 100644 index 6f21f08..0000000 --- a/master/argocd/templates/vault.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: vault - namespace: argocd -spec: - project: default - source: - repoURL: https://gitlab.com/developerdurp/homelab.git - targetRevision: main - path: master/vault - destination: - namespace: vault - name: in-cluster - syncPolicy: - automated: - prune: true - selfHeal: true - syncOptions: - - CreateNamespace=true - ignoreDifferences: - - group: admissionregistration.k8s.io - kind: MutatingWebhookConfiguration - jqPathExpressions: - - .webhooks[]?.clientConfig.caBundle diff --git a/master/argocd/values.yaml b/master/argocd/values.yaml deleted file mode 100644 index 82b19ac..0000000 --- a/master/argocd/values.yaml +++ /dev/null @@ -1,62 +0,0 @@ -argo-cd: - - global: - revisionHistoryLimit: 1 - image: - repository: registry.durp.info/argoproj/argocd - imagePullPolicy: Always - - server: - #extraArgs: - # - --dex-server-plaintext - # - --dex-server=argocd-dex-server:5556 - # oidc.config: | - # name: AzureAD - # issuer: https://login.microsoftonline.com/TENANT_ID/v2.0 - # clientID: CLIENT_ID - # clientSecret: $oidc.azuread.clientSecret - # requestedIDTokenClaims: - # groups: - # essential: true - # requestedScopes: - # - openid - # - profile - # - email - - dex: - enabled: true - image: - repository: registry.durp.info/dexidp/dex - imagePullPolicy: Always - - configs: - cm: - create: true - annotations: {} - url: https://argocd.internal.durp.info - oidc.tls.insecure.skip.verify: "true" - dex.config: | - connectors: - - config: - issuer: https://authentik.durp.info/application/o/argocd/ - clientID: dbb8ffc06104fb6e7fac3e4ae7fafb1d90437625 - clientSecret: $client-secret:clientSecret - insecureEnableGroups: true - scopes: - - openid - - profile - - email - - groups - name: authentik - type: oidc - id: authentik - - rbac: - create: true - policy.csv: | - g, ArgoCD Admins, role:admin - scopes: "[groups]" - - server: - route: - enabled: false diff --git a/master/authentik/Chart.yaml b/master/authentik/Chart.yaml deleted file mode 100644 index e357c64..0000000 --- a/master/authentik/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: authentik -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: authentik-remote-cluster - repository: https://charts.goauthentik.io - version: 2.1.0 diff --git a/master/authentik/templates/authentik-pv.yaml b/master/authentik/templates/authentik-pv.yaml deleted file mode 100644 index 8fbc2e2..0000000 --- a/master/authentik/templates/authentik-pv.yaml +++ /dev/null @@ -1,24 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: authentik-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: authentik-pvc -# namespace: authentik -# nfs: -# path: /mnt/user/k3s/authentik -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem diff --git a/master/authentik/templates/authentik-pvc.yaml b/master/authentik/templates/authentik-pvc.yaml deleted file mode 100644 index f22640b..0000000 --- a/master/authentik/templates/authentik-pvc.yaml +++ /dev/null @@ -1,18 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolumeClaim -#metadata: -# labels: -# app.kubernetes.io/component: app -# app.kubernetes.io/instance: authentik -# app.kubernetes.io/managed-by: Helm -# app.kubernetes.io/name: authentik -# helm.sh/chart: authentik-2.14.4 -# name: authentik-pvc -# namespace: authentik -#spec: -# accessModes: -# - ReadWriteMany -# resources: -# requests: -# storage: 10Gi -# storageClassName: nfs-storage \ No newline at end of file diff --git a/master/authentik/templates/ingress.yaml b/master/authentik/templates/ingress.yaml deleted file mode 100644 index 83e1efa..0000000 --- a/master/authentik/templates/ingress.yaml +++ /dev/null @@ -1,60 +0,0 @@ -#apiVersion: traefik.containo.us/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: authentik-server -# port: 80 -# tls: -# secretName: authentik-tls -# ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - secretName: authentik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "outpost.internal.durp.info" - dnsNames: - - "outpost.internal.durp.info" - -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: authentik-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -#spec: -# type: ExternalName -# externalName: durp.info - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: outpost-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`outpost.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: ak-outpost-master-embedded-outpost - port: 9000 - tls: - secretName: authentik-tls diff --git a/master/authentik/templates/secrets.yaml b/master/authentik/templates/secrets.yaml deleted file mode 100644 index 52df8b1..0000000 --- a/master/authentik/templates/secrets.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: authentik-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: db-pass - data: - - secretKey: dbpass - remoteRef: - key: secrets/authentik/database - property: dbpass - - secretKey: secretkey - remoteRef: - key: secrets/authentik/database - property: secretkey - - secretKey: postgresql-postgres-password - remoteRef: - key: secrets/authentik/database - property: dbpass - - secretKey: postgresql-password - remoteRef: - key: secrets/authentik/database - property: dbpass - diff --git a/master/authentik/values.yaml b/master/authentik/values.yaml deleted file mode 100644 index 83be2f9..0000000 --- a/master/authentik/values.yaml +++ /dev/null @@ -1,30 +0,0 @@ -authentik-remote-cluster: - # -- Provide a name in place of `authentik`. Prefer using global.nameOverride if possible - nameOverride: "" - # -- String to fully override `"authentik.fullname"`. Prefer using global.fullnameOverride if possible - fullnameOverride: "" - # -- Override the Kubernetes version, which is used to evaluate certain manifests - kubeVersionOverride: "" - - ## Globally shared configuration for authentik components. - global: - # -- Provide a name in place of `authentik` - nameOverride: "" - # -- String to fully override `"authentik.fullname"` - fullnameOverride: "" - # -- A custom namespace to override the default namespace for the deployed resources. - namespaceOverride: "" - # -- Common labels for all resources. - additionalLabels: {} - # app: authentik - - # -- Annotations to apply to all resources - annotations: {} - - serviceAccountSecret: - # -- Create a secret with the service account credentials - enabled: true - - clusterRole: - # -- Create a clusterole in addition to a namespaced role. - enabled: true diff --git a/master/bitwarden/Chart.yaml b/master/bitwarden/Chart.yaml deleted file mode 100644 index cfdd821..0000000 --- a/master/bitwarden/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: bitwarden -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/master/bitwarden/templates/bitwarden-pv.yaml b/master/bitwarden/templates/bitwarden-pv.yaml deleted file mode 100644 index ff647d1..0000000 --- a/master/bitwarden/templates/bitwarden-pv.yaml +++ /dev/null @@ -1,25 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: bitwarden-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: bitwarden-pvc -# namespace: bitwarden -# nfs: -# path: /mnt/user/k3s/bitwarden -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem -# \ No newline at end of file diff --git a/master/bitwarden/templates/bitwarden-pvc.yaml b/master/bitwarden/templates/bitwarden-pvc.yaml deleted file mode 100644 index 333af4d..0000000 --- a/master/bitwarden/templates/bitwarden-pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: bitwarden-pvc -spec: - storageClassName: longhorn - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi diff --git a/master/bitwarden/templates/deployment.yaml b/master/bitwarden/templates/deployment.yaml deleted file mode 100644 index f787ba1..0000000 --- a/master/bitwarden/templates/deployment.yaml +++ /dev/null @@ -1,50 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: bitwarden - name: bitwarden - labels: - app: bitwarden -spec: - selector: - matchLabels: - app: bitwarden - replicas: 1 - template: - metadata: - labels: - app: bitwarden - spec: - containers: - - name: bitwarden - image: registry.durp.info/vaultwarden/server:1.32.7 - imagePullPolicy: Always - volumeMounts: - - name: bitwarden-pvc - mountPath: /data - subPath: bitwaren-data - ports: - - name: http - containerPort: 80 - env: - - name: SIGNUPS_ALLOWED - value: "FALSE" - - name: INVITATIONS_ALLOWED - value: "FALSE" - - name: WEBSOCKET_ENABLED - value: "TRUE" - - name: ROCKET_ENV - value: "staging" - - name: ROCKET_PORT - value: "80" - - name: ROCKET_WORKERS - value: "10" - - name: SECRET_USERNAME - valueFrom: - secretKeyRef: - name: bitwarden-secret - key: ADMIN_TOKEN - volumes: - - name: bitwarden-pvc - persistentVolumeClaim: - claimName: bitwarden-pvc diff --git a/master/bitwarden/templates/ingress.yaml b/master/bitwarden/templates/ingress.yaml deleted file mode 100644 index 8a9a628..0000000 --- a/master/bitwarden/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: bitwarden-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`bitwarden.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: bitwarden - port: 80 - tls: - secretName: bitwarden-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: bitwarden-tls -spec: - secretName: bitwarden-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "bitwarden.durp.info" - dnsNames: - - "bitwarden.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: bitwarden-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: bitwarden.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/master/bitwarden/templates/secrets.yaml b/master/bitwarden/templates/secrets.yaml deleted file mode 100644 index a5a9e44..0000000 --- a/master/bitwarden/templates/secrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: bitwarden-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: bitwarden-secret - data: - - secretKey: ADMIN_TOKEN - remoteRef: - key: secrets/bitwarden/admin - property: ADMIN_TOKEN - diff --git a/master/bitwarden/templates/service.yaml b/master/bitwarden/templates/service.yaml deleted file mode 100644 index df30857..0000000 --- a/master/bitwarden/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: bitwarden -spec: - ports: - - name: http - port: 80 - targetPort: 80 - protocol: TCP - selector: - app: bitwarden \ No newline at end of file diff --git a/master/cert-manager/Chart.yaml b/master/cert-manager/Chart.yaml deleted file mode 100644 index 7280af8..0000000 --- a/master/cert-manager/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: cert-manager -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: cert-manager - repository: https://charts.jetstack.io - version: v1.17.2 diff --git a/master/cert-manager/templates/letsencrypt-prroduction.yaml b/master/cert-manager/templates/letsencrypt-prroduction.yaml deleted file mode 100644 index 034ed9b..0000000 --- a/master/cert-manager/templates/letsencrypt-prroduction.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-production -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-production - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret diff --git a/master/cert-manager/templates/letsencrypt-staging.yaml b/master/cert-manager/templates/letsencrypt-staging.yaml deleted file mode 100644 index b6ae4f9..0000000 --- a/master/cert-manager/templates/letsencrypt-staging.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-staging -spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-staging - solvers: - - dns01: - cloudflare: - email: developerdurp@durp.info - apiTokenSecretRef: - name: cloudflare-api-token-secret - key: cloudflare-api-token-secret \ No newline at end of file diff --git a/master/cert-manager/templates/sealedsecret.yaml b/master/cert-manager/templates/sealedsecret.yaml deleted file mode 100644 index a85ea4e..0000000 --- a/master/cert-manager/templates/sealedsecret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: cloudflare-api-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: cloudflare-api-token-secret - data: - - secretKey: cloudflare-api-token-secret - remoteRef: - key: secrets/cert-manager - property: cloudflare-api-token-secret - diff --git a/master/cert-manager/values.yaml b/master/cert-manager/values.yaml deleted file mode 100644 index 36f403b..0000000 --- a/master/cert-manager/values.yaml +++ /dev/null @@ -1,25 +0,0 @@ -cert-manager: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-controller - pullPolicy: Always - installCRDs: true - replicaCount: 3 - extraArgs: - - --dns01-recursive-nameservers=1.1.1.1:53,1.0.0.1:53 - - --dns01-recursive-nameservers-only - podDnsPolicy: None - podDnsConfig: - nameservers: - - "1.1.1.1" - - "1.0.0.1" - webhook: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-webhook - pullPolicy: Always - cainjector: - image: - registry: registry.internal.durp.info - repository: jetstack/cert-manager-cainjector - pullPolicy: Always \ No newline at end of file diff --git a/master/crossplane/Chart.yaml b/master/crossplane/Chart.yaml deleted file mode 100644 index e725e88..0000000 --- a/master/crossplane/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: crossplane -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: crossplane - repository: https://charts.crossplane.io/stable - version: 1.20.0 diff --git a/master/crossplane/templates/gitlab.yml b/master/crossplane/templates/gitlab.yml deleted file mode 100644 index 0211b82..0000000 --- a/master/crossplane/templates/gitlab.yml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: pkg.crossplane.io/v1 -kind: Provider -metadata: - name: provider-gitlab -spec: - package: xpkg.upbound.io/crossplane-contrib/provider-gitlab:v0.5.0 ---- - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: accesstoken - remoteRef: - key: secrets/gitlab/token - property: accesstoken - ---- - -#apiVersion: gitlab.crossplane.io/v1beta1 -#kind: ProviderConfig -#metadata: -# name: gitlab-provider -#spec: -# baseURL: https://gitlab.com/ -# credentials: -# source: Secret -# secretRef: -# namespace: crossplane -# name: gitlab-secret -# key: accesstoken -# -#--- -# -#apiVersion: projects.gitlab.crossplane.io/v1alpha1 -#kind: Project -#metadata: -# name: example-project -#spec: -# deletionPolicy: Orphan -# forProvider: -# name: "Example Project" -# description: "example project description" -# providerConfigRef: -# name: gitlab-provider -# policy: -# resolution: Optional -# resolve: Always diff --git a/master/dashboards/nginx-dashboard.yaml b/master/dashboards/nginx-dashboard.yaml deleted file mode 100644 index 333a6c5..0000000 --- a/master/dashboards/nginx-dashboard.yaml +++ /dev/null @@ -1,1506 +0,0 @@ -apiVersion: v1 -data: - nginx-ingress-controller_rev1.json: |- - { - "annotations": { - "list": [ - { - "builtIn": 1, - "datasource": { - "type": "datasource", - "uid": "grafana" - }, - "enable": true, - "hide": true, - "iconColor": "rgba(0, 211, 255, 1)", - "name": "Annotations & Alerts", - "target": { - "limit": 100, - "matchAny": false, - "tags": [], - "type": "dashboard" - }, - "type": "dashboard" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "enable": true, - "expr": "sum(changes(nginx_ingress_controller_config_last_reload_successful_timestamp_seconds{instance!=\"unknown\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[30s])) by (controller_class)", - "hide": false, - "iconColor": "rgba(255, 96, 96, 1)", - "limit": 100, - "name": "Config Reloads", - "showIn": 0, - "step": "30s", - "tagKeys": "controller_class", - "tags": [], - "titleFormat": "Config Reloaded", - "type": "tags" - } - ] - }, - "description": "Ingress-nginx supports a rich collection of prometheus metrics. If you have prometheus and grafana installed on your cluster then prometheus will already be scraping this data due to the scrape annotation on the deployment.", - "editable": true, - "fiscalYearStartMonth": 0, - "gnetId": 9614, - "graphTooltip": 0, - "id": 27, - "links": [], - "liveNow": false, - "panels": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "ops" - }, - "overrides": [] - }, - "id": 20, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m])), 0.001)", - "format": "time_series", - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Request Volume", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 6, - "x": 6, - "y": 0 - }, - "id": 82, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(avg_over_time(nginx_ingress_controller_nginx_process_connections{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "instant": false, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Connections", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "rgba(245, 54, 54, 0.9)", - "value": null - }, - { - "color": "rgba(237, 129, 40, 0.89)", - "value": 95 - }, - { - "color": "rgba(50, 172, 45, 0.97)", - "value": 99 - } - ] - }, - "unit": "percentunit" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 6, - "x": 12, - "y": 0 - }, - "id": 21, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",status!~\"[4-5].*\"}[2m])) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Controller Success Rate (non-4|5xx responses)", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "decimals": 0, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 18, - "y": 0 - }, - "id": 81, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_success{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"})", - "format": "time_series", - "instant": true, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Config Reloads", - "type": "stat" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fieldConfig": { - "defaults": { - "color": { - "fixedColor": "rgb(31, 120, 193)", - "mode": "fixed" - }, - "decimals": 0, - "mappings": [ - { - "options": { - "match": "null", - "result": { - "text": "N/A" - } - }, - "type": "special" - } - ], - "thresholds": { - "mode": "absolute", - "steps": [ - { - "color": "green", - "value": null - }, - { - "color": "red", - "value": 80 - } - ] - }, - "unit": "none" - }, - "overrides": [] - }, - "gridPos": { - "h": 3, - "w": 3, - "x": 21, - "y": 0 - }, - "id": 83, - "links": [], - "maxDataPoints": 100, - "options": { - "colorMode": "none", - "graphMode": "area", - "justifyMode": "auto", - "orientation": "horizontal", - "reduceOptions": { - "calcs": [ - "mean" - ], - "fields": "", - "values": false - }, - "textMode": "auto" - }, - "pluginVersion": "9.1.6", - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "count(nginx_ingress_controller_config_last_reload_successful{controller_pod=~\"$controller\",controller_namespace=~\"$namespace\"} == 0)", - "format": "time_series", - "instant": true, - "intervalFactor": 1, - "refId": "A", - "step": 4 - } - ], - "title": "Last Config Failed", - "type": "stat" - }, - { - "aliasColors": {}, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": true, - "error": false, - "fill": 1, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 7, - "w": 12, - "x": 0, - "y": 3 - }, - "height": "200px", - "hiddenSeries": false, - "id": 86, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": false, - "hideEmpty": false, - "hideZero": true, - "max": false, - "min": false, - "rightSide": true, - "show": true, - "sideWidth": 300, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "repeatDirection": "h", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "round(sum(irate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress), 0.001)", - "format": "time_series", - "hide": false, - "instant": false, - "interval": "", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "metric": "network", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Ingress Request Volume", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "reqps", - "logBase": 1, - "show": true - }, - { - "format": "Bps", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00", - "max - prometheus": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 7, - "w": 12, - "x": 12, - "y": 3 - }, - "hiddenSeries": false, - "id": 87, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": false, - "hideEmpty": true, - "hideZero": false, - "max": false, - "min": false, - "rightSide": true, - "show": true, - "sideWidth": 300, - "sort": "avg", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\",status!~\"[4-5].*\"}[2m])) by (ingress) / sum(rate(nginx_ingress_controller_requests{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "metric": "container_memory_usage:sort_desc", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Ingress Success Rate (non-4|5xx responses)", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 1, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "percentunit", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": {}, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": true, - "error": false, - "fill": 1, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 0, - "y": 10 - }, - "height": "200px", - "hiddenSeries": false, - "id": 32, - "isNew": true, - "legend": { - "alignAsTable": false, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "sideWidth": 200, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum (irate (nginx_ingress_controller_request_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "Received", - "metric": "network", - "refId": "A", - "step": 10 - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "- sum (irate (nginx_ingress_controller_response_size_sum{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m]))", - "format": "time_series", - "hide": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "Sent", - "metric": "network", - "refId": "B", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Network I/O pressure", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 0, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "Bps", - "logBase": 1, - "show": true - }, - { - "format": "Bps", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00", - "max - prometheus": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 2, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 8, - "y": 10 - }, - "hiddenSeries": false, - "id": 77, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "sideWidth": 200, - "sort": "current", - "sortDesc": true, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_nginx_process_resident_memory_bytes{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}) ", - "format": "time_series", - "instant": false, - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "nginx", - "metric": "container_memory_usage:sort_desc", - "refId": "A", - "step": 10 - } - ], - "thresholds": [], - "timeRegions": [], - "title": "Average Memory Usage", - "tooltip": { - "msResolution": false, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "bytes", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": false - } - ], - "yaxis": { - "align": false - } - }, - { - "aliasColors": { - "max - istio-proxy": "#890f02", - "max - master": "#bf1b00" - }, - "bars": false, - "dashLength": 10, - "dashes": false, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "decimals": 3, - "editable": false, - "error": false, - "fill": 0, - "fillGradient": 0, - "grid": {}, - "gridPos": { - "h": 6, - "w": 8, - "x": 16, - "y": 10 - }, - "height": "", - "hiddenSeries": false, - "id": 79, - "isNew": true, - "legend": { - "alignAsTable": true, - "avg": true, - "current": true, - "max": false, - "min": false, - "rightSide": false, - "show": false, - "total": false, - "values": true - }, - "lines": true, - "linewidth": 2, - "links": [], - "nullPointMode": "connected", - "options": { - "alertThreshold": true - }, - "percentage": false, - "pluginVersion": "9.1.6", - "pointradius": 5, - "points": false, - "renderer": "flot", - "seriesOverrides": [], - "spaceLength": 10, - "stack": false, - "steppedLine": false, - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum (rate (nginx_ingress_controller_nginx_process_cpu_seconds_total{controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\"}[2m])) ", - "format": "time_series", - "interval": "10s", - "intervalFactor": 1, - "legendFormat": "nginx", - "metric": "container_cpu", - "refId": "A", - "step": 10 - } - ], - "thresholds": [ - { - "colorMode": "critical", - "fill": true, - "line": true, - "op": "gt" - } - ], - "timeRegions": [], - "title": "Average CPU Usage", - "tooltip": { - "msResolution": true, - "shared": true, - "sort": 2, - "value_type": "cumulative" - }, - "type": "graph", - "xaxis": { - "mode": "time", - "show": true, - "values": [] - }, - "yaxes": [ - { - "format": "none", - "label": "cores", - "logBase": 1, - "show": true - }, - { - "format": "short", - "logBase": 1, - "show": true - } - ], - "yaxis": { - "align": false - } - }, - { - "columns": [], - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fontSize": "100%", - "gridPos": { - "h": 8, - "w": 24, - "x": 0, - "y": 16 - }, - "hideTimeOverride": false, - "id": 75, - "links": [], - "pageSize": 7, - "repeatDirection": "h", - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": true - }, - "styles": [ - { - "alias": "Ingress", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "ingress", - "preserveFormat": false, - "sanitize": false, - "thresholds": [], - "type": "string", - "unit": "short" - }, - { - "alias": "Requests", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #A", - "thresholds": [ - "" - ], - "type": "number", - "unit": "ops" - }, - { - "alias": "Errors", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #B", - "thresholds": [], - "type": "number", - "unit": "ops" - }, - { - "alias": "P50 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "link": false, - "pattern": "Value #C", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "P90 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Value #D", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "P99 Latency", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Value #E", - "thresholds": [], - "type": "number", - "unit": "dtdurations" - }, - { - "alias": "IN", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Value #F", - "thresholds": [ - "" - ], - "type": "number", - "unit": "Bps" - }, - { - "alias": "", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "pattern": "Time", - "thresholds": [], - "type": "hidden", - "unit": "short" - }, - { - "alias": "OUT", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 2, - "mappingType": 1, - "pattern": "Value #G", - "thresholds": [], - "type": "number", - "unit": "Bps" - } - ], - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.50, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "C" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.90, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "D" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "histogram_quantile(0.99, sum(rate(nginx_ingress_controller_request_duration_seconds_bucket{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (le, ingress))", - "format": "table", - "hide": false, - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ destination_service }}", - "refId": "E" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(irate(nginx_ingress_controller_request_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "table", - "hide": false, - "instant": true, - "interval": "", - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "F" - }, - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "sum(irate(nginx_ingress_controller_response_size_sum{ingress!=\"\",controller_pod=~\"$controller\",controller_class=~\"$controller_class\",controller_namespace=~\"$namespace\",ingress=~\"$ingress\"}[2m])) by (ingress)", - "format": "table", - "instant": true, - "intervalFactor": 1, - "legendFormat": "{{ ingress }}", - "refId": "G" - } - ], - "title": "Ingress Percentile Response Times and Transfer Rates", - "transform": "table", - "type": "table-old" - }, - { - "columns": [ - { - "text": "Current", - "value": "current" - } - ], - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "fontSize": "100%", - "gridPos": { - "h": 8, - "w": 24, - "x": 0, - "y": 24 - }, - "height": "1024", - "id": 85, - "links": [], - "pageSize": 7, - "scroll": true, - "showHeader": true, - "sort": { - "col": 1, - "desc": false - }, - "styles": [ - { - "alias": "Time", - "align": "auto", - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "pattern": "Time", - "type": "date" - }, - { - "alias": "TTL", - "align": "auto", - "colorMode": "cell", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "dateFormat": "YYYY-MM-DD HH:mm:ss", - "decimals": 0, - "pattern": "Current", - "thresholds": [ - "0", - "691200" - ], - "type": "number", - "unit": "s" - }, - { - "alias": "", - "align": "auto", - "colors": [ - "rgba(245, 54, 54, 0.9)", - "rgba(237, 129, 40, 0.89)", - "rgba(50, 172, 45, 0.97)" - ], - "decimals": 2, - "pattern": "/.*/", - "thresholds": [], - "type": "number", - "unit": "short" - } - ], - "targets": [ - { - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "expr": "avg(nginx_ingress_controller_ssl_expire_time_seconds{kubernetes_pod_name=~\"$controller\",namespace=~\"$namespace\",ingress=~\"$ingress\"}) by (host) - time()", - "format": "time_series", - "intervalFactor": 1, - "legendFormat": "{{ host }}", - "metric": "gke_letsencrypt_cert_expiration", - "refId": "A", - "step": 1 - } - ], - "title": "Ingress Certificate Expiry", - "transform": "timeseries_aggregations", - "type": "table-old" - } - ], - "refresh": "5s", - "schemaVersion": 37, - "style": "dark", - "tags": [ - "nginx" - ], - "templating": { - "list": [ - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Namespace", - "multi": false, - "name": "namespace", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash, controller_namespace)", - "refId": "Prometheus-namespace-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Controller Class", - "multi": false, - "name": "controller_class", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\"}, controller_class) ", - "refId": "Prometheus-controller_class-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Controller", - "multi": false, - "name": "controller", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_config_hash{namespace=~\"$namespace\",controller_class=~\"$controller_class\"}, controller_pod) ", - "refId": "Prometheus-controller-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 0, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - }, - { - "allValue": ".*", - "current": { - "selected": false, - "text": "All", - "value": "$__all" - }, - "datasource": { - "type": "prometheus", - "uid": "prometheus" - }, - "definition": "", - "hide": 0, - "includeAll": true, - "label": "Ingress", - "multi": false, - "name": "ingress", - "options": [], - "query": { - "query": "label_values(nginx_ingress_controller_requests{namespace=~\"$namespace\",controller_class=~\"$controller_class\",controller=~\"$controller\"}, ingress) ", - "refId": "Prometheus-ingress-Variable-Query" - }, - "refresh": 1, - "regex": "", - "skipUrlSync": false, - "sort": 2, - "tagValuesQuery": "", - "tagsQuery": "", - "type": "query", - "useTags": false - } - ] - }, - "time": { - "from": "now-1h", - "to": "now" - }, - "timepicker": { - "refresh_intervals": [ - "5s", - "10s", - "30s", - "2m", - "5m", - "15m", - "30m", - "1h", - "2h", - "1d" - ], - "time_options": [ - "5m", - "15m", - "1h", - "6h", - "12h", - "24h", - "2d", - "7d", - "30d" - ] - }, - "timezone": "browser", - "title": "NGINX Ingress controller", - "uid": "nginx", - "version": 1, - "weekStart": "" - } -kind: ConfigMap -metadata: - labels: - grafana_dashboard: "1" - creationTimestamp: null - name: nginx-dashboard - namespace: kube-prometheus-stack \ No newline at end of file diff --git a/master/durpapi/Chart.yaml b/master/durpapi/Chart.yaml deleted file mode 100644 index da0c67e..0000000 --- a/master/durpapi/Chart.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v2 -name: durpapi -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0-dev0184 -appVersion: 0.1.0 - -dependencies: -- condition: postgresql.enabled - version: 16.7.* - repository: https://charts.bitnami.com/bitnami - name: postgresql diff --git a/master/durpapi/templates/deployment.yaml b/master/durpapi/templates/deployment.yaml deleted file mode 100644 index 0f42dfb..0000000 --- a/master/durpapi/templates/deployment.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ .Chart.Name }} - labels: - app: {{ .Chart.Name }} -spec: - revisionHistoryLimit: 1 - selector: - matchLabels: - app: {{ .Chart.Name }} - replicas: {{ .Values.deployment.hpa.minReplicas }} - template: - metadata: - labels: - app: {{ .Chart.Name }} - spec: - containers: - - name: api - image: "{{ .Values.deployment.image }}:{{ default .Chart.Version .Values.deployment.tag }}" - imagePullPolicy: {{ .Values.deployment.imagePullPolicy }} - readinessProbe: - {{- toYaml .Values.deployment.probe.readiness | nindent 12 }} - livenessProbe: - {{- toYaml .Values.deployment.probe.liveness | nindent 12 }} - startupProbe: - {{- toYaml .Values.deployment.probe.startup | nindent 12 }} - ports: - - name: http - containerPort: {{ .Values.service.targetport }} - env: - - name: host - value: {{ .Values.swagger.host }} - - name: version - value: {{ default .Chart.Version .Values.deployment.tag }} - envFrom: - - secretRef: - name: {{ .Values.deployment.secretfile }} diff --git a/master/durpapi/templates/hpa.yaml b/master/durpapi/templates/hpa.yaml deleted file mode 100644 index 68d484d..0000000 --- a/master/durpapi/templates/hpa.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: autoscaling/v2 -kind: HorizontalPodAutoscaler -metadata: - name: "{{ .Chart.Name }}-hpa" -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ .Chart.Name }} - minReplicas: {{ .Values.deployment.hpa.minReplicas }} - maxReplicas: {{ .Values.deployment.hpa.maxReplicas }} - metrics: - - type: Resource - resource: - name: memory - target: - type: Utilization - averageUtilization: 80 - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 40 diff --git a/master/durpapi/templates/ingress.yaml b/master/durpapi/templates/ingress.yaml deleted file mode 100644 index bd268dd..0000000 --- a/master/durpapi/templates/ingress.yaml +++ /dev/null @@ -1,44 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: "{{ .Chart.Name }}-ingress" -spec: - entryPoints: - - websecure - routes: - - match: Host("api.durp.info") && PathPrefix(`/api`) - kind: Rule - middlewares: - - name: jwt - services: - - name: "durpapi-service" - port: 80 - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: "{{ .Chart.Name }}-swagger" -spec: - entryPoints: - - websecure - routes: - - match: Host("api.durp.info") && PathPrefix(`/swagger`) - kind: Rule - services: - - name: "durpapi-service" - port: 80 - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: jwt -spec: - plugin: - jwt: - Required: true - Keys: - - https://authentik.durp.info/application/o/api/jwks diff --git a/master/durpapi/templates/secrets.yaml b/master/durpapi/templates/secrets.yaml deleted file mode 100644 index 36946e9..0000000 --- a/master/durpapi/templates/secrets.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: durpapi-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: durpapi-secret - data: - - secretKey: db_host - remoteRef: - key: secrets/durpapi/postgres - property: db_host - - secretKey: db_port - remoteRef: - key: secrets/durpapi/postgres - property: db_port - - secretKey: db_pass - remoteRef: - key: secrets/durpapi/postgres - property: db_pass - - secretKey: db_user - remoteRef: - key: secrets/durpapi/postgres - property: db_user - - secretKey: db_sslmode - remoteRef: - key: secrets/durpapi/postgres - property: db_sslmode - - secretKey: db_name - remoteRef: - key: secrets/durpapi/postgres - property: db_name - - secretKey: llamaurl - remoteRef: - key: secrets/durpapi/llamaurl - property: llamaurl \ No newline at end of file diff --git a/master/durpapi/templates/service.yaml b/master/durpapi/templates/service.yaml deleted file mode 100644 index 2cab669..0000000 --- a/master/durpapi/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: "{{ .Chart.Name }}-service" -spec: - ports: - - name: http - port: {{ .Values.service.port }} - targetPort: {{ .Values.service.targetport }} - protocol: TCP - selector: - app: {{ .Chart.Name }} diff --git a/master/durpapi/values.yaml b/master/durpapi/values.yaml deleted file mode 100644 index 41b152b..0000000 --- a/master/durpapi/values.yaml +++ /dev/null @@ -1,39 +0,0 @@ -ingress: - enabled: false -deployment: - image: registry.durp.info/developerdurp/durpapi - secretfile: durpapi-secret - imagePullPolicy: Always - hpa: - minReplicas: 3 - maxReplicas: 10 - probe: - readiness: - httpGet: - path: /health/gethealth - port: 8080 - liveness: - httpGet: - path: /health/gethealth - port: 8080 - startup: - httpGet: - path: /health/gethealth - port: 8080 -service: - type: ClusterIP - port: 80 - targetport: 8080 - -swagger: - host: api.durp.info -postgresql: - enabled: true - auth: - existingSecret: durpapi-secret - secretKeys: - adminPasswordKey: db_pass - userPasswordKey: db_pass - replicationPasswordKey: db_pass - database: postgres - username: postgres diff --git a/master/durpot/Chart.yaml b/master/durpot/Chart.yaml deleted file mode 100644 index c21a834..0000000 --- a/master/durpot/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: durpapi -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: durpot - repository: https://gitlab.com/api/v4/projects/45025485/packages/helm/stable - version: 0.1.0-dev0038 diff --git a/master/durpot/templates/secrets.yaml b/master/durpot/templates/secrets.yaml deleted file mode 100644 index f51273c..0000000 --- a/master/durpot/templates/secrets.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: durpot-secert -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: durpot-secret - data: - - secretKey: OPENAI_API_KEY - remoteRef: - key: secrets/durpot/openai - property: OPENAI_API_KEY - - secretKey: BOTPREFIX - remoteRef: - key: secrets/durpot/discord - property: BOTPREFIX - - secretKey: ChannelID - remoteRef: - key: secrets/durpot/discord - property: ChannelID - - secretKey: TOKEN - remoteRef: - key: secrets/durpot/discord - property: TOKEN - - secretKey: ClientID - remoteRef: - key: secrets/durpot/auth - property: ClientID - - secretKey: Password - remoteRef: - key: secrets/durpot/auth - property: Password - - secretKey: TokenURL - remoteRef: - key: secrets/durpot/auth - property: TokenURL - - secretKey: Username - remoteRef: - key: secrets/durpot/auth - property: Username diff --git a/master/external-dns/Chart.yaml b/master/external-dns/Chart.yaml deleted file mode 100644 index 937bc49..0000000 --- a/master/external-dns/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ - -apiVersion: v2 -name: external-dns -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: external-dns - repository: https://charts.bitnami.com/bitnami - version: 8.9.2 diff --git a/master/external-dns/templates/secrets.yaml b/master/external-dns/templates/secrets.yaml deleted file mode 100644 index ba603aa..0000000 --- a/master/external-dns/templates/secrets.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: external-dns-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: external-dns - data: - - secretKey: cloudflare_api_email - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_email - - secretKey: cloudflare_api_key - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_key - - secretKey: cloudflare_api_token - remoteRef: - key: secrets/external-dns/cloudflare - property: cloudflare_api_token diff --git a/master/external-dns/values.yaml b/master/external-dns/values.yaml deleted file mode 100644 index 68abe91..0000000 --- a/master/external-dns/values.yaml +++ /dev/null @@ -1,16 +0,0 @@ -external-dns: - global: - imageRegistry: "registry.internal.durp.info" - - image: - pullPolicy: Always - - sources: - - service - - provider: cloudflare - cloudflare: - secretName : "external-dns" - proxied: false - - policy: sync diff --git a/master/external-secrets/Chart.yaml b/master/external-secrets/Chart.yaml deleted file mode 100644 index 94104aa..0000000 --- a/master/external-secrets/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: external-secrets -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: external-secrets - repository: https://charts.external-secrets.io - version: 0.17.0 - diff --git a/master/external-secrets/values.yaml b/master/external-secrets/values.yaml deleted file mode 100644 index a720adb..0000000 --- a/master/external-secrets/values.yaml +++ /dev/null @@ -1,463 +0,0 @@ -external-secrets: - replicaCount: 3 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: Always - # -- The image tag to use. The default is the chart appVersion. - # There are different image flavours available, like distroless and ubi. - # Please see GitHub release notes for image tags for these flavors. - # By default the distroless image is used. - tag: "" - - # -- If set, install and upgrade CRDs through helm chart. - installCRDs: true - - crds: - # -- If true, create CRDs for Cluster External Secret. - createClusterExternalSecret: true - # -- If true, create CRDs for Cluster Secret Store. - createClusterSecretStore: true - # -- If true, create CRDs for Push Secret. - createPushSecret: true - annotations: {} - conversion: - enabled: true - - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - - # -- If true, external-secrets will perform leader election between instances to ensure no more - # than one instance of external-secrets operates at a time. - leaderElect: true - - # -- If set external secrets will filter matching - # Secret Stores with the appropriate controller values. - controllerClass: "" - - # -- If true external secrets will use recommended kubernetes - # annotations as prometheus metric labels. - extendedMetricLabels: false - - # -- If set external secrets are only reconciled in the - # provided namespace - scopedNamespace: "" - - # -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace - # and implicitly disable cluster stores and cluster external secrets - scopedRBAC: false - - # -- if true, the operator will process cluster external secret. Else, it will ignore them. - processClusterExternalSecret: true - - # -- if true, the operator will process cluster store. Else, it will ignore them. - processClusterStore: true - - # -- Specifies whether an external secret operator deployment be created. - createOperator: true - - # -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at - # a time. - concurrent: 1 - - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - ## -- Extra containers to add to the pod. - extraContainers: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead. - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- namespace where you want to install ServiceMonitors - namespace: "" - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - # -- Let prometheus add an exported_ prefix to conflicting labels - honorLabels: false - - # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) - metricRelabelings: [] - # - action: replace - # regex: (.*) - # replacement: $1 - # sourceLabels: - # - exported_namespace - # targetLabel: namespace - - # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) - relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # targetLabel: nodename - # replacement: $1 - # action: replace - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - # -- Run the controller on the host network - hostNetwork: false - - webhook: - # -- Specifies whether a webhook deployment be created. - create: true - # -- Specifices the time to check if the cert is valid - certCheckInterval: "5m" - # -- Specifices the lookaheadInterval for certificate validity - lookaheadInterval: "" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - certDir: /tmp/certs - # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore - failurePolicy: Fail - # -- Specifies if webhook pod should use hostNetwork or not. - hostNetwork: false - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: IfNotPresent - # -- The image tag to use. The default is the chart appVersion. - tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - # -- The port the webhook will listen to - port: 10250 - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - - readinessProbe: - # -- Address for readiness probe - address: "" - # -- ReadinessProbe port for kubelet - port: 8081 - - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Secret - secretAnnotations: {} - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - certController: - # -- Specifies whether a certificate controller deployment be created. - create: true - requeueInterval: "5m" - replicaCount: 1 - - # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) - revisionHistoryLimit: 10 - - image: - repository: ghcr.io/external-secrets/external-secrets - pullPolicy: Always - tag: "" - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - rbac: - # -- Specifies whether role and rolebinding resources should be created. - create: true - serviceAccount: - # -- Specifies whether a service account should be created. - create: true - # -- Automounts the service account token in all containers of the pod - automount: true - # -- Annotations to add to the service account. - annotations: {} - # -- Extra Labels to add to the service account. - extraLabels: {} - # -- The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - name: "" - nodeSelector: {} - - tolerations: [] - - topologySpreadConstraints: [] - - affinity: {} - - # -- Run the certController on the host network - hostNetwork: false - - # -- Pod priority class name. - priorityClassName: "" - - # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 - - prometheus: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - enabled: false - service: - # -- deprecated. will be removed with 0.7.0, use serviceMonitor instead - port: 8080 - - serviceMonitor: - # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics - enabled: false - - # -- Additional labels - additionalLabels: {} - - # -- Interval to scrape metrics - interval: 30s - - # -- Timeout if metrics can't be retrieved in given time interval - scrapeTimeout: 25s - - metrics: - service: - # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics - enabled: false - - # -- Metrics service port to scrape - port: 8080 - - # -- Additional service annotations - annotations: {} - - ## -- Extra environment variables to add to container. - extraEnv: [] - - ## -- Map of extra arguments to pass to container. - extraArgs: {} - - - ## -- Extra volumes to pass to pod. - extraVolumes: [] - - ## -- Extra volumes to mount to the container. - extraVolumeMounts: [] - - # -- Annotations to add to Deployment - deploymentAnnotations: {} - - # -- Annotations to add to Pod - podAnnotations: {} - - podLabels: {} - - podSecurityContext: {} - # fsGroup: 2000 - - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - runAsUser: 1000 - seccompProfile: - type: RuntimeDefault - - resources: {} - # requests: - # cpu: 10m - # memory: 32Mi - - # -- Specifies `dnsOptions` to deployment - dnsConfig: {} diff --git a/master/gatekeeper/Chart.yaml b/master/gatekeeper/Chart.yaml deleted file mode 100644 index 4269281..0000000 --- a/master/gatekeeper/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: gatekeeper -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: gatekeeper - repository: https://open-policy-agent.github.io/gatekeeper/charts - version: 3.19.2 diff --git a/master/gatekeeper/values.yaml b/master/gatekeeper/values.yaml deleted file mode 100644 index 0b0c6e7..0000000 --- a/master/gatekeeper/values.yaml +++ /dev/null @@ -1,278 +0,0 @@ -#gatekeeper: -# replicas: 3 -# revisionHistoryLimit: 10 -# auditInterval: 60 -# metricsBackends: ["prometheus"] -# auditMatchKindOnly: false -# constraintViolationsLimit: 20 -# auditFromCache: false -# disableMutation: false -# disableValidatingWebhook: false -# validatingWebhookName: gatekeeper-validating-webhook-configuration -# validatingWebhookTimeoutSeconds: 3 -# validatingWebhookFailurePolicy: Ignore -# validatingWebhookAnnotations: {} -# validatingWebhookExemptNamespacesLabels: {} -# validatingWebhookObjectSelector: {} -# validatingWebhookCheckIgnoreFailurePolicy: Fail -# validatingWebhookCustomRules: {} -# validatingWebhookURL: null -# enableDeleteOperations: false -# enableExternalData: true -# enableGeneratorResourceExpansion: true -# enableTLSHealthcheck: false -# maxServingThreads: -1 -# mutatingWebhookName: gatekeeper-mutating-webhook-configuration -# mutatingWebhookFailurePolicy: Ignore -# mutatingWebhookReinvocationPolicy: Never -# mutatingWebhookAnnotations: {} -# mutatingWebhookExemptNamespacesLabels: {} -# mutatingWebhookObjectSelector: {} -# mutatingWebhookTimeoutSeconds: 1 -# mutatingWebhookCustomRules: {} -# mutatingWebhookURL: null -# mutationAnnotations: false -# auditChunkSize: 500 -# logLevel: INFO -# logDenies: false -# logMutations: false -# emitAdmissionEvents: false -# emitAuditEvents: false -# admissionEventsInvolvedNamespace: false -# auditEventsInvolvedNamespace: false -# resourceQuota: true -# externaldataProviderResponseCacheTTL: 3m -# image: -# repository: openpolicyagent/gatekeeper -# crdRepository: openpolicyagent/gatekeeper-crds -# release: v3.15.0-beta.0 -# pullPolicy: Always -# pullSecrets: [] -# preInstall: -# crdRepository: -# image: -# repository: null -# tag: v3.15.0-beta.0 -# postUpgrade: -# labelNamespace: -# enabled: false -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# extraNamespaces: [] -# podSecurity: ["pod-security.kubernetes.io/audit=restricted", -# "pod-security.kubernetes.io/audit-version=latest", -# "pod-security.kubernetes.io/warn=restricted", -# "pod-security.kubernetes.io/warn-version=latest", -# "pod-security.kubernetes.io/enforce=restricted", -# "pod-security.kubernetes.io/enforce-version=v1.24"] -# extraAnnotations: {} -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# postInstall: -# labelNamespace: -# enabled: true -# extraRules: [] -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# extraNamespaces: [] -# podSecurity: ["pod-security.kubernetes.io/audit=restricted", -# "pod-security.kubernetes.io/audit-version=latest", -# "pod-security.kubernetes.io/warn=restricted", -# "pod-security.kubernetes.io/warn-version=latest", -# "pod-security.kubernetes.io/enforce=restricted", -# "pod-security.kubernetes.io/enforce-version=v1.24"] -# extraAnnotations: {} -# priorityClassName: "" -# probeWebhook: -# enabled: true -# image: -# repository: curlimages/curl -# tag: 7.83.1 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# waitTimeout: 60 -# httpTimeout: 2 -# insecureHTTPS: false -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# preUninstall: -# deleteWebhookConfigurations: -# extraRules: [] -# enabled: false -# image: -# repository: openpolicyagent/gatekeeper-crds -# tag: v3.15.0-beta.0 -# pullPolicy: IfNotPresent -# pullSecrets: [] -# priorityClassName: "" -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podAnnotations: {} -# auditPodAnnotations: {} -# podLabels: {} -# podCountLimit: "100" -# secretAnnotations: {} -# enableRuntimeDefaultSeccompProfile: true -# controllerManager: -# exemptNamespaces: [] -# exemptNamespacePrefixes: [] -# hostNetwork: false -# dnsPolicy: ClusterFirst -# port: 8443 -# metricsPort: 8888 -# healthPort: 9090 -# readinessTimeout: 1 -# livenessTimeout: 1 -# priorityClassName: system-cluster-critical -# disableCertRotation: false -# tlsMinVersion: 1.3 -# clientCertName: "" -# strategyType: RollingUpdate -# affinity: -# podAntiAffinity: -# preferredDuringSchedulingIgnoredDuringExecution: -# - podAffinityTerm: -# labelSelector: -# matchExpressions: -# - key: gatekeeper.sh/operation -# operator: In -# values: -# - webhook -# topologyKey: kubernetes.io/hostname -# weight: 100 -# topologySpreadConstraints: [] -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: -# limits: -# memory: 512Mi -# requests: -# cpu: 100m -# memory: 512Mi -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podSecurityContext: -# fsGroup: 999 -# supplementalGroups: -# - 999 -# extraRules: [] -# networkPolicy: -# enabled: false -# ingress: { } -# # - from: -# # - ipBlock: -# # cidr: 0.0.0.0/0 -# audit: -# enablePubsub: false -# connection: audit-connection -# channel: audit-channel -# hostNetwork: false -# dnsPolicy: ClusterFirst -# metricsPort: 8888 -# healthPort: 9090 -# readinessTimeout: 1 -# livenessTimeout: 1 -# priorityClassName: system-cluster-critical -# disableCertRotation: false -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: -# limits: -# memory: 512Mi -# requests: -# cpu: 100m -# memory: 512Mi -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 999 -# runAsNonRoot: true -# runAsUser: 1000 -# podSecurityContext: -# fsGroup: 999 -# supplementalGroups: -# - 999 -# writeToRAMDisk: false -# extraRules: [] -# crds: -# affinity: {} -# tolerations: [] -# nodeSelector: {kubernetes.io/os: linux} -# resources: {} -# securityContext: -# allowPrivilegeEscalation: false -# capabilities: -# drop: -# - ALL -# readOnlyRootFilesystem: true -# runAsGroup: 65532 -# runAsNonRoot: true -# runAsUser: 65532 -# pdb: -# controllerManager: -# minAvailable: 1 -# service: {} -# disabledBuiltins: ["{http.send}"] -# psp: -# enabled: true -# upgradeCRDs: -# enabled: true -# extraRules: [] -# priorityClassName: "" -# rbac: -# create: true -# externalCertInjection: -# enabled: false -# secretName: gatekeeper-webhook-server-cert -# \ No newline at end of file diff --git a/master/gitlab-runner/Chart.yaml b/master/gitlab-runner/Chart.yaml deleted file mode 100644 index 2915b96..0000000 --- a/master/gitlab-runner/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: gitlab-runner -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: gitlab-runner - repository: https://charts.gitlab.io/ - version: 0.77.2 diff --git a/master/gitlab-runner/templates/secrets.yaml b/master/gitlab-runner/templates/secrets.yaml deleted file mode 100644 index 3477844..0000000 --- a/master/gitlab-runner/templates/secrets.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: gitlab-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: gitlab-secret - data: - - secretKey: runner-registration-token - remoteRef: - key: secrets/gitlab/runner - property: runner-registration-token - - secretKey: runner-token - remoteRef: - key: secrets/gitlab/runner - property: runner-token diff --git a/master/gitlab-runner/values.yaml b/master/gitlab-runner/values.yaml deleted file mode 100644 index 9535eb7..0000000 --- a/master/gitlab-runner/values.yaml +++ /dev/null @@ -1,71 +0,0 @@ -gitlab-runner: - - image: - registry: registry.internal.durp.info - image: gitlab-org/gitlab-runner - - imagePullPolicy: Always - gitlabUrl: https://gitlab.com/ - unregisterRunner: false - terminationGracePeriodSeconds: 3600 - concurrent: 10 - checkInterval: 30 - - rbac: - create: true - rules: [] - clusterWideAccess: false - podSecurityPolicy: - enabled: false - resourceNames: - - gitlab-runner - - metrics: - enabled: true - serviceMonitor: - enabled: true - service: - enabled: true - annotations: {} - - runners: - config: | - [[runners]] - [runners.kubernetes] - namespace = "{{.Release.Namespace}}" - image = "ubuntu:22.04" - privileged = true - - executor: kubernetes - name: "k3s" - runUntagged: true - privileged: true - secret: gitlab-secret - #builds: - #cpuLimit: 200m - #cpuLimitOverwriteMaxAllowed: 400m - #memoryLimit: 256Mi - #memoryLimitOverwriteMaxAllowed: 512Mi - #cpuRequests: 100m - #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi - - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - privileged: false - capabilities: - drop: ["ALL"] - - podSecurityContext: - runAsUser: 100 - fsGroup: 65533 - - resources: - limits: - memory: 2Gi - requests: - memory: 128Mi - cpu: 500m diff --git a/master/heimdall/Chart.yaml b/master/heimdall/Chart.yaml deleted file mode 100644 index 39dbf54..0000000 --- a/master/heimdall/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: heimdall -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: heimdall - repository: https://djjudas21.github.io/charts/ - version: 8.5.4 diff --git a/master/heimdall/templates/ingress.yaml b/master/heimdall/templates/ingress.yaml deleted file mode 100644 index 98b6144..0000000 --- a/master/heimdall/templates/ingress.yaml +++ /dev/null @@ -1,52 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - annotations: - name: heimdall-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`heimdall.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: heimdall - port: 80 - - match: Host(`heimdall.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: heimdall-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: heimdall-tls -spec: - secretName: heimdall-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "heimdall.durp.info" - dnsNames: - - "heimdall.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: heimdall-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/heimdall/values.yaml b/master/heimdall/values.yaml deleted file mode 100644 index e93ca43..0000000 --- a/master/heimdall/values.yaml +++ /dev/null @@ -1,28 +0,0 @@ -heimdall: - - image: - registry: - repository: registry.internal.durp.info/linuxserver/heimdall - pullPolicy: Always - - env: - TZ: UTC - PUID: "1000" - PGID: "1000" - - service: - main: - annotations: - external-dns.alpha.kubernetes.io/hostname: heimdall.durp.info - external-dns.alpha.kubernetes.io/target: home.durp.info - ports: - http: - port: 80 - - ingress: - main: - enabled: false - - persistence: - config: - enabled: true diff --git a/master/internalproxy/Chart.yaml b/master/internalproxy/Chart.yaml deleted file mode 100644 index 71c9b0d..0000000 --- a/master/internalproxy/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: internalproxy -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "0.1.0" diff --git a/master/internalproxy/templates/argocd.yaml b/master/internalproxy/templates/argocd.yaml deleted file mode 100644 index 9a82e9e..0000000 --- a/master/internalproxy/templates/argocd.yaml +++ /dev/null @@ -1,46 +0,0 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: argocd-ingress -# annotations: -# cert-manager.io/cluster-issuer: letsencrypt-production -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`argocd.internal.durp.info`) -# middlewares: -# - name: whitelist -# namespace: traefik -# kind: Rule -# services: -# - name: argocd-server -# port: 443 -# scheme: https -# tls: -# secretName: argocd-tls -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: argocd-server -#spec: -# type: ExternalName -# externalName: argocd-server.argocd.svc.cluster.local -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: argocd-tls -#spec: -# secretName: argocd-tls -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# commonName: "argocd.internal.durp.info" -# dnsNames: -# - "argocd.internal.durp.info" \ No newline at end of file diff --git a/master/internalproxy/templates/blueiris.yaml b/master/internalproxy/templates/blueiris.yaml deleted file mode 100644 index 5f120c9..0000000 --- a/master/internalproxy/templates/blueiris.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: blueiris -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: blueiris -subsets: - - addresses: - - ip: 192.168.99.2 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: blueiris-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`blueiris.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: blueiris - port: 81 - scheme: http - tls: - secretName: blueiris-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: blueiris-tls -spec: - secretName: blueiris-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "blueiris.internal.durp.info" - dnsNames: - - "blueiris.internal.durp.info" diff --git a/master/internalproxy/templates/duplicati-ingress.yaml b/master/internalproxy/templates/duplicati-ingress.yaml deleted file mode 100644 index de08a38..0000000 --- a/master/internalproxy/templates/duplicati-ingress.yaml +++ /dev/null @@ -1,70 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: duplicati -spec: - ports: - - name: app - port: 8200 - protocol: TCP - targetPort: 8200 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: duplicati -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8200 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: duplicati-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: duplicati - port: 8200 - - match: Host(`duplicati.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-master-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: duplicati-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: duplicati-tls -spec: - secretName: duplicati-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "duplicati.internal.durp.info" - dnsNames: - - "duplicati.internal.durp.info" diff --git a/master/internalproxy/templates/gitea.yaml b/master/internalproxy/templates/gitea.yaml deleted file mode 100644 index 0bde4e4..0000000 --- a/master/internalproxy/templates/gitea.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: gitea -spec: - ports: - - name: app - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: gitea -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 3000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: gitea-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`gitea.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: gitea - port: 3000 - scheme: http - tls: - secretName: gitea-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: gitea-tls -spec: - secretName: gitea-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "gitea.durp.info" - dnsNames: - - "gitea.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: gitea-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: gitea.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/infra.yaml b/master/internalproxy/templates/infra.yaml deleted file mode 100644 index 51f6a91..0000000 --- a/master/internalproxy/templates/infra.yaml +++ /dev/null @@ -1,60 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: infra -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: infra -subsets: - - addresses: - - ip: 192.168.12.130 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: infra-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`*.infra.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra - port: 443 - scheme: https - tls: - secretName: infra-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: infra-tls -spec: - secretName: infra-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "infra.durp.info" - dnsNames: - - "*.infra.durp.info" diff --git a/master/internalproxy/templates/jellyfin.yaml b/master/internalproxy/templates/jellyfin.yaml deleted file mode 100644 index 709b50a..0000000 --- a/master/internalproxy/templates/jellyfin.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: jellyfin -spec: - ports: - - name: app - port: 8096 - protocol: TCP - targetPort: 8096 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: jellyfin -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8096 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: jellyfin-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`jellyfin.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: jellyfin - port: 8096 - scheme: http - tls: - secretName: jellyfin-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: jellyfin-tls -spec: - secretName: jellyfin-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "jellyfin.durp.info" - dnsNames: - - "jellyfin.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: jellyfin-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: jellyfin.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/kasm.yaml b/master/internalproxy/templates/kasm.yaml deleted file mode 100644 index 7f756e0..0000000 --- a/master/internalproxy/templates/kasm.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: kasm -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: kasm -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kasm-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kasm.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: kasm - port: 443 - scheme: https - tls: - secretName: kasm-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kasm-tls -spec: - secretName: kasm-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kasm.durp.info" - dnsNames: - - "kasm.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kasm-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kasm.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/minio.yaml b/master/internalproxy/templates/minio.yaml deleted file mode 100644 index 71dd261..0000000 --- a/master/internalproxy/templates/minio.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: minio -spec: - ports: - - name: app - port: 9769 - protocol: TCP - targetPort: 9769 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: minio -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 9769 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: minio-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`minio.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: minio - port: 9769 - scheme: http - tls: - secretName: minio-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: minio-tls -spec: - secretName: minio-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "minio.internal.durp.info" - dnsNames: - - "minio.internal.durp.info" diff --git a/master/internalproxy/templates/nexus.yaml b/master/internalproxy/templates/nexus.yaml deleted file mode 100644 index 5d3632e..0000000 --- a/master/internalproxy/templates/nexus.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: nexus -spec: - ports: - - name: app - port: 8081 - protocol: TCP - targetPort: 8081 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: nexus -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8081 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: nexus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`nexus.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: nexus - port: 8081 - tls: - secretName: nexus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: nexus-tls -spec: - secretName: nexus-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "nexus.durp.info" - dnsNames: - - "nexus.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: nexus-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: nexus.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/octopus.yaml b/master/internalproxy/templates/octopus.yaml deleted file mode 100644 index e0e5d78..0000000 --- a/master/internalproxy/templates/octopus.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: octopus -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: octopus -subsets: - - addresses: - - ip: 192.168.20.105 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: octopus-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`octopus.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: octopus - port: 443 - scheme: https - tls: - secretName: octopus-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: octopus-tls -spec: - secretName: octopus-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "octopus.internal.durp.info" - dnsNames: - - "octopus.internal.durp.info" diff --git a/master/internalproxy/templates/ollama.yaml b/master/internalproxy/templates/ollama.yaml deleted file mode 100644 index b845cac..0000000 --- a/master/internalproxy/templates/ollama.yaml +++ /dev/null @@ -1,102 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: ollama-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: ollama-secret - data: - - secretKey: users - remoteRef: - key: secrets/internalproxy/ollama - property: users - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: ollama-basic-auth -spec: - basicAuth: - headerField: x-api-key - secret: ollama-secret - ---- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: ollama-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`ollama.durp.info`) && PathPrefix(`/`) - middlewares: - - name: ollama-basic-auth - kind: Rule - services: - - name: ollama - port: 11435 - tls: - secretName: ollama-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: ollama-tls -spec: - secretName: ollama-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "ollama.durp.info" - dnsNames: - - "ollama.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: ollama-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: ollama.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/plex.yaml b/master/internalproxy/templates/plex.yaml deleted file mode 100644 index 45bba44..0000000 --- a/master/internalproxy/templates/plex.yaml +++ /dev/null @@ -1,72 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: plex -spec: - ports: - - name: app - port: 32400 - protocol: TCP - targetPort: 32400 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: plex -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 32400 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: plex-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`plex.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: plex - port: 32400 - scheme: https - tls: - secretName: plex-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: plex-tls -spec: - secretName: plex-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "plex.durp.info" - dnsNames: - - "plex.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: plex-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: plex.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/portainer.yaml b/master/internalproxy/templates/portainer.yaml deleted file mode 100644 index 5c22061..0000000 --- a/master/internalproxy/templates/portainer.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: portainer -spec: - ports: - - name: app - port: 9443 - protocol: TCP - targetPort: 9443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: portainer -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 9443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: portainer-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: portainer - port: 9443 - scheme: https - tls: - secretName: portainer-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: portainer-tls -spec: - secretName: portainer-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "portainer.internal.durp.info" - dnsNames: - - "portainer.internal.durp.info" diff --git a/master/internalproxy/templates/proxmox.yaml b/master/internalproxy/templates/proxmox.yaml deleted file mode 100644 index d61f416..0000000 --- a/master/internalproxy/templates/proxmox.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: proxmox -spec: - ports: - - name: app - port: 8006 - protocol: TCP - targetPort: 8006 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: proxmox -subsets: - - addresses: - - ip: 192.168.21.254 - ports: - - name: app - port: 8006 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: proxmox-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`proxmox.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: proxmox - port: 8006 - scheme: https - tls: - secretName: proxmox-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: proxmox-tls -spec: - secretName: proxmox-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "proxmox.internal.durp.info" - dnsNames: - - "proxmox.internal.durp.info" diff --git a/master/internalproxy/templates/redlib.yaml b/master/internalproxy/templates/redlib.yaml deleted file mode 100644 index b71e4c3..0000000 --- a/master/internalproxy/templates/redlib.yaml +++ /dev/null @@ -1,68 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: redlib -spec: - ports: - - name: app - port: 8082 - protocol: TCP - targetPort: 8082 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: redlib -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8082 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: redlib-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`redlib.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: redlib - port: 8082 - - match: Host(`redlib.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: redlib-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: redlib-tls -spec: - secretName: redlib-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "redlib.durp.info" - dnsNames: - - "redlib.durp.info" diff --git a/master/internalproxy/templates/registry-internal.yaml b/master/internalproxy/templates/registry-internal.yaml deleted file mode 100644 index c32c167..0000000 --- a/master/internalproxy/templates/registry-internal.yaml +++ /dev/null @@ -1,59 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry-internal -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry-internal -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 5000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-internal-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.internal.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry-internal - port: 5000 - tls: - secretName: registry-internal-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-internal-tls -spec: - secretName: registry-internal-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.internal.durp.info" - dnsNames: - - "registry.internal.durp.info" diff --git a/master/internalproxy/templates/registry.yaml b/master/internalproxy/templates/registry.yaml deleted file mode 100644 index 1906614..0000000 --- a/master/internalproxy/templates/registry.yaml +++ /dev/null @@ -1,71 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: registry -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 5000 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: registry-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`registry.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: registry - port: 5000 - tls: - secretName: registry-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: registry-tls -spec: - secretName: registry-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "registry.durp.info" - dnsNames: - - "registry.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: registry-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: registry.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/s3.yaml b/master/internalproxy/templates/s3.yaml deleted file mode 100644 index e48d6ce..0000000 --- a/master/internalproxy/templates/s3.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: s3 -spec: - ports: - - name: app - port: 9768 - protocol: TCP - targetPort: 9768 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: s3 -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 9768 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: s3-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`s3.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: s3 - port: 9768 - scheme: http - tls: - secretName: s3-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: s3-tls -spec: - secretName: s3-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "s3.internal.durp.info" - dnsNames: - - "s3.internal.durp.info" diff --git a/master/internalproxy/templates/semaphore.yaml b/master/internalproxy/templates/semaphore.yaml deleted file mode 100644 index e7256da..0000000 --- a/master/internalproxy/templates/semaphore.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: semaphore -spec: - ports: - - name: app - port: 3001 - protocol: TCP - targetPort: 3001 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: semaphore -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 3001 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: semaphore-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: semaphore - port: 3001 - scheme: http - tls: - secretName: semaphore-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: semaphore-tls -spec: - secretName: semaphore-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "semaphore.internal.durp.info" - dnsNames: - - "semaphore.internal.durp.info" diff --git a/master/internalproxy/templates/smokeping.yaml b/master/internalproxy/templates/smokeping.yaml deleted file mode 100644 index 9840993..0000000 --- a/master/internalproxy/templates/smokeping.yaml +++ /dev/null @@ -1,82 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: smokeping -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: smokeping -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 81 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: smokeping-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`smokeping.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: smokeping - port: 81 - - match: Host(`smokeping.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-authentik-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: smokeping-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: smokeping-tls -spec: - secretName: smokeping-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "smokeping.durp.info" - dnsNames: - - "smokeping.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: smokeping-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: smokeping.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/speedtest.yaml b/master/internalproxy/templates/speedtest.yaml deleted file mode 100644 index 275b708..0000000 --- a/master/internalproxy/templates/speedtest.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: speedtest -spec: - ports: - - name: app - port: 6580 - protocol: TCP - targetPort: 6580 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: speedtest -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 6580 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: speedtest-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`speedtest.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: speedtest - port: 6580 - tls: - secretName: speedtest-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: speedtest-tls -spec: - secretName: speedtest-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "speedtest.durp.info" - dnsNames: - - "speedtest.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: speedtest-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: speedtest.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/internalproxy/templates/tdarr.yaml b/master/internalproxy/templates/tdarr.yaml deleted file mode 100644 index 96eca07..0000000 --- a/master/internalproxy/templates/tdarr.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: tdarr -spec: - ports: - - name: app - port: 8267 - protocol: TCP - targetPort: 8267 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: tdarr -subsets: -- addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8267 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: tdarr-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`tdarr.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: tdarr - port: 8267 - scheme: http - tls: - secretName: tdarr-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: tdarr-tls -spec: - secretName: tdarr-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "tdarr.internal.durp.info" - dnsNames: - - "tdarr.internal.durp.info" diff --git a/master/internalproxy/templates/unifi.yaml b/master/internalproxy/templates/unifi.yaml deleted file mode 100644 index 76c3110..0000000 --- a/master/internalproxy/templates/unifi.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: unifi -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unifi -subsets: - - addresses: - - ip: 192.168.20.1 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: unifi-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`unifi.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: unifi - port: 443 - scheme: https - tls: - secretName: unifi-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: unifi-tls -spec: - secretName: unifi-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "unifi.internal.durp.info" - dnsNames: - - "unifi.internal.durp.info" diff --git a/master/internalproxy/templates/unraid.yaml b/master/internalproxy/templates/unraid.yaml deleted file mode 100644 index c5cde07..0000000 --- a/master/internalproxy/templates/unraid.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: unraid -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unraid -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: unraid-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`unraid.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: unraid - port: 443 - scheme: https - tls: - secretName: unraid-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: unraid-tls -spec: - secretName: unraid-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "unraid.internal.durp.info" - dnsNames: - - "unraid.internal.durp.info" diff --git a/master/internalproxy/templates/vault.yaml b/master/internalproxy/templates/vault.yaml deleted file mode 100644 index af97b25..0000000 --- a/master/internalproxy/templates/vault.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: root-vault -spec: - ports: - - name: app - port: 8201 - protocol: TCP - targetPort: 8201 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: root-vault -subsets: - - addresses: - - ip: 192.168.20.200 - ports: - - name: app - port: 8201 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: root-vault-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`root-vault.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: root-vault - port: 8201 - scheme: https - tls: - secretName: root-vault-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: root-vault-tls -spec: - secretName: root-vault-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "root-vault.internal.durp.info" - dnsNames: - - "root-vault.internal.durp.info" diff --git a/master/internalproxy/templates/wazuh.yaml b/master/internalproxy/templates/wazuh.yaml deleted file mode 100644 index 5a5d853..0000000 --- a/master/internalproxy/templates/wazuh.yaml +++ /dev/null @@ -1,63 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: wazuh -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: wazuh -subsets: - - addresses: - - ip: 192.168.20.102 - ports: - - name: app - port: 443 - protocol: TCP - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: wazuh-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`wazuh.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: wazuh - port: 443 - scheme: https - tls: - secretName: wazuh-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: wazuh-tls -spec: - secretName: wazuh-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "wazuh.internal.durp.info" - dnsNames: - - "wazuh.internal.durp.info" diff --git a/master/krakend/Chart.yaml b/master/krakend/Chart.yaml deleted file mode 100644 index d998c9f..0000000 --- a/master/krakend/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: krakend -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" \ No newline at end of file diff --git a/master/krakend/templates/deployments.yaml b/master/krakend/templates/deployments.yaml deleted file mode 100644 index ce50302..0000000 --- a/master/krakend/templates/deployments.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: krakend - name: krakend - labels: - app: krakend -spec: - selector: - matchLabels: - app: krakend - replicas: 1 - template: - metadata: - labels: - app: krakend - spec: - volumes: - - name: krakend-secret - secret: - secretName: krakend-secret - containers: - - name: krakend - image: registry.internal.durp.info/devopsfaith/krakend:2.4.3 - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /__health - port: 8080 - readinessProbe: - httpGet: - path: /__health - port: 8080 - ports: - - name: http - containerPort: 8080 - volumeMounts: - - name: krakend-secret - mountPath: /etc/krakend \ No newline at end of file diff --git a/master/krakend/templates/ingress.yaml b/master/krakend/templates/ingress.yaml deleted file mode 100644 index a8c08eb..0000000 --- a/master/krakend/templates/ingress.yaml +++ /dev/null @@ -1,56 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: api-tls -spec: - secretName: api-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "api.durp.info" - dnsNames: - - "api.durp.info" - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: krakend-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`api.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: krakend-service - port: 8080 - scheme: http - tls: - secretName: api-tls - ---- - -kind: Service -apiVersion: v1 -metadata: - name: api-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: api.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- - -kind: Service -apiVersion: v1 -metadata: - name: api-developer-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: developer.durp.info - external-dns.alpha.kubernetes.io/cloudflare-proxied: "false" -spec: - type: ExternalName - externalName: developerdurp.github.io diff --git a/master/krakend/templates/secrets.yaml b/master/krakend/templates/secrets.yaml deleted file mode 100644 index 073e590..0000000 --- a/master/krakend/templates/secrets.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: krakend-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: krakend-secret - data: - - secretKey: krakend.json - remoteRef: - key: secrets/krakend/config - property: config \ No newline at end of file diff --git a/master/krakend/templates/service.yaml b/master/krakend/templates/service.yaml deleted file mode 100644 index d5393f3..0000000 --- a/master/krakend/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: krakend-service -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - protocol: TCP - selector: - app: krakend \ No newline at end of file diff --git a/master/kube-prometheus-stack/Chart.yaml b/master/kube-prometheus-stack/Chart.yaml deleted file mode 100644 index 093c443..0000000 --- a/master/kube-prometheus-stack/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: kube-prometheus-stack -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: kube-prometheus-stack - repository: https://prometheus-community.github.io/helm-charts - version: 72.9.1 diff --git a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml b/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml deleted file mode 100644 index 7f01c1e..0000000 --- a/master/kube-prometheus-stack/templates/grafana-secrets-sealed.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: vault-grafana-oauth -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: grafana-oauth - data: - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_ID - - secretKey: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - remoteRef: - key: secrets/kube-prometheus/grafana/oauth - property: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET - ---- - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: vault-admin-credentials -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: grafana-admin-credentials - data: - - secretKey: admin-password - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-password - - secretKey: admin-user - remoteRef: - key: secrets/kube-prometheus/grafana/admin - property: admin-user diff --git a/master/kube-prometheus-stack/templates/ingress.yaml b/master/kube-prometheus-stack/templates/ingress.yaml deleted file mode 100644 index caf0ee1..0000000 --- a/master/kube-prometheus-stack/templates/ingress.yaml +++ /dev/null @@ -1,80 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: grafana-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`grafana.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: grafana - port: 80 - tls: - secretName: grafana-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: grafana-tls -spec: - secretName: grafana-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "grafana.durp.info" - dnsNames: - - "grafana.durp.info" - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: alertmanager-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`alertmanager.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: prometheus-alertmanager - port: 9093 - tls: - secretName: alertmanager-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: alertmanager-tls -spec: - secretName: alertmanager-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "alertmanager.durp.info" - dnsNames: - - "alertmanager.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: grafana-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: grafana.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/master/kube-prometheus-stack/values.yaml b/master/kube-prometheus-stack/values.yaml deleted file mode 100644 index 19436ac..0000000 --- a/master/kube-prometheus-stack/values.yaml +++ /dev/null @@ -1,203 +0,0 @@ -kube-prometheus-stack: - fullnameOverride: prometheus - - defaultRules: - create: true - rules: - alertmanager: true - etcd: true - configReloaders: true - general: true - k8s: true - kubeApiserverAvailability: true - kubeApiserverBurnrate: true - kubeApiserverHistogram: true - kubeApiserverSlos: true - kubelet: true - kubeProxy: true - kubePrometheusGeneral: true - kubePrometheusNodeRecording: true - kubernetesApps: true - kubernetesResources: true - kubernetesStorage: true - kubernetesSystem: true - kubeScheduler: true - kubeStateMetrics: true - network: true - node: true - nodeExporterAlerting: true - nodeExporterRecording: true - prometheus: true - prometheusOperator: true - - alertmanager: - fullnameOverride: alertmanager - enabled: true - ingress: - enabled: false - grafana: - enabled: true - fullnameOverride: grafana - forceDeployDatasources: false - forceDeployDashboards: false - defaultDashboardsEnabled: true - defaultDashboardsTimezone: utc - plugins: - - grafana-polystat-panel - serviceMonitor: - enabled: true - admin: - existingSecret: grafana-admin-credentials - userKey: admin-user - passwordKey: admin-password - ingress: - enabled: false - grafana.ini: - server: - root_url: https://grafana.durp.info - auth.generic_oauth: - enabled: true - scopes: openid profile email - auth_url: https://authentik.durp.info/application/o/authorize/ - token_url: https://authentik.durp.info/application/o/token/ - api_url: https://authentik.durp.info/application/o/userinfo/ - envFromSecret: "grafana-oauth" - - kubeApiServer: - enabled: true - - kubelet: - enabled: true - serviceMonitor: - metricRelabelings: - - action: replace - sourceLabels: - - node - targetLabel: instance - - kubeControllerManager: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - coreDns: - enabled: false - - kubeDns: - enabled: false - - kubeEtcd: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - service: - enabled: true - port: 2381 - targetPort: 2381 - - kubeScheduler: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - kubeProxy: - enabled: true - endpoints: # ips of servers - - 192.168.20.121 - - 192.168.20.122 - - 192.168.20.123 - - kubeStateMetrics: - enabled: true - - kube-state-metrics: - fullnameOverride: kube-state-metrics - selfMonitor: - enabled: true - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - - nodeExporter: - enabled: true - serviceMonitor: - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - - prometheus-node-exporter: - fullnameOverride: node-exporter - podLabels: - jobLabel: node-exporter - extraArgs: - - --collector.filesystem.mount-points-exclude=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/.+)($|/) - - --collector.filesystem.fs-types-exclude=^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs)$ - service: - portName: http-metrics - prometheus: - monitor: - enabled: true - relabelings: - - action: replace - regex: (.*) - replacement: $1 - sourceLabels: - - __meta_kubernetes_pod_node_name - targetLabel: kubernetes_node - resources: - requests: - memory: 512Mi - cpu: 250m - limits: - memory: 2048Mi - - prometheusOperator: - enabled: true - prometheusConfigReloader: - resources: - requests: - cpu: 200m - memory: 50Mi - limits: - memory: 100Mi - - prometheus: - enabled: true - prometheusSpec: - replicas: 1 - replicaExternalLabelName: "replica" - ruleSelectorNilUsesHelmValues: false - serviceMonitorSelectorNilUsesHelmValues: false - podMonitorSelectorNilUsesHelmValues: false - probeSelectorNilUsesHelmValues: false - retention: 6h - enableAdminAPI: true - walCompression: true - storageSpec: - volumeClaimTemplate: - spec: - storageClassName: nfs-storage - accessModes: ["ReadWriteMany"] - resources: - requests: - storage: 50Gi - - thanosRuler: - enabled: false diff --git a/master/kubeclarity/Chart.yaml b/master/kubeclarity/Chart.yaml deleted file mode 100644 index 4eef59a..0000000 --- a/master/kubeclarity/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: kubeclarity -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: kubeclarity - repository: https://openclarity.github.io/kubeclarity - version: 2.23.3 diff --git a/master/kubeclarity/templates/ingress.yaml b/master/kubeclarity/templates/ingress.yaml deleted file mode 100644 index 77b67a7..0000000 --- a/master/kubeclarity/templates/ingress.yaml +++ /dev/null @@ -1,47 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kubeclarity-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kubeclarity.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: kubeclarity-kubeclarity - port: 8080 - tls: - secretName: kubeclarity-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kubeclarity-tls -spec: - secretName: kubeclarity-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kubeclarity.durp.info" - dnsNames: - - "kubeclarity.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kubeclarity-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kubeclarity.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/kubeclarity/values.yaml b/master/kubeclarity/values.yaml deleted file mode 100644 index 0bb5078..0000000 --- a/master/kubeclarity/values.yaml +++ /dev/null @@ -1,235 +0,0 @@ -kubeclarity: - global: - databasePassword: kubeclarity - docker: - registry: "registry.internal.durp.info/openclarity" - tag: "latest" - imagePullPolicy: Always - - curl: - image: - registry: "registry.internal.durp.info" - repository: curlimages/curl - tag: 7.87.0 - - kubeclarity: - docker: - imageName: "" - - logLevel: warning - - enableDBInfoLog: false - - prometheus: - enabled: false - - podAnnotations: {} - - service: - type: ClusterIP - port: 8080 - annotations: {} - - ingress: - enabled: false - - resources: - requests: - memory: "200Mi" - cpu: "100m" - limits: - memory: "1000Mi" - cpu: "1000m" - - initContainers: - resources: - requests: - memory: "100Mi" - cpu: "100m" - limits: - memory: "200Mi" - cpu: "200m" - - kubeclarity-runtime-scan: - httpsProxy: "" - httpProxy: "" - resultServicePort: 8888 - - labels: - app: kubeclarity-scanner - sidecar.istio.io/inject: "false" - - namespace: "" - - registry: - skipVerifyTlS: "false" - useHTTP: "false" - - cis-docker-benchmark-scanner: - resources: - requests: - memory: "50Mi" - cpu: "50m" - limits: - memory: "1000Mi" - cpu: "1000m" - - vulnerability-scanner: - resources: - requests: - memory: "50Mi" - cpu: "50m" - limits: - memory: "1000Mi" - cpu: "1000m" - - analyzer: - analyzerList: "syft gomod trivy" - analyzerScope: "squashed" - - trivy: - enabled: true - timeout: "300" - - scanner: - scannerList: "grype trivy" - - grype: - enabled: true - mode: "REMOTE" - - remote-grype: - timeout: "2m" - - dependency-track: - enabled: false - insecureSkipVerify: "true" - disableTls: "true" - apiserverAddress: "dependency-track-apiserver.dependency-track" - apiKey: "" - - trivy: - enabled: true - timeout: "300" - - kubeclarity-grype-server: - enabled: true - - docker: - imageRepo: "registry.internal.durp.info/openclarity" - imageTag: "v0.6.0" - imagePullPolicy: Always - - logLevel: warning - - servicePort: 9991 - - resources: - requests: - cpu: "200m" - memory: "200Mi" - limits: - cpu: "1000m" - memory: "1G" - - kubeclarity-trivy-server: - enabled: true - - ## Docker Image values. - image: - registry: registry.internal.durp.info - repository: aquasec/trivy - tag: 0.44.1 - pullPolicy: Always - - persistence: - enabled: false - - podSecurityContext: - runAsUser: 1001 - runAsNonRoot: true - fsGroup: 1001 - - securityContext: - privileged: false - readOnlyRootFilesystem: true - - trivy: - debugMode: false - - service: - port: 9992 - - resources: - requests: - cpu: "200m" - memory: "200Mi" - limits: - cpu: "1000m" - memory: "1G" - - - kubeclarity-sbom-db: - docker: - imageName: "" - logLevel: warning - - servicePort: 8080 - - resources: - requests: - memory: "20Mi" - cpu: "10m" - limits: - memory: "1Gi" - cpu: "200m" - - kubeclarity-postgresql: - enabled: true - - image: - registry: registry.internal.durp.info - repository: bitnami/postgresql - tag: 14.6.0-debian-11-r31 - - auth: - existingSecret: kubeclarity-postgresql-secret - username: postgres - database: kubeclarity - sslMode: disable - - service: - ports: - postgresql: 5432 - - serviceAccount: - enabled: true - securityContext: - enabled: true - fsGroup: 1001 - containerSecurityContext: - enabled: true - runAsUser: 1001 - runAsNonRoot: true - volumePermissions: - enabled: false - securityContext: - runAsUser: 1001 - shmVolume: - chmod: - enabled: true - - resources: - requests: - memory: "256Mi" - cpu: "250m" - limits: - memory: "1000Mi" - cpu: "1000m" - - kubeclarity-postgresql-external: - enabled: false - - kubeclarity-postgresql-secret: - create: true - secretKey: "postgres-password" diff --git a/master/littlelink/Chart.yaml b/master/littlelink/Chart.yaml deleted file mode 100644 index e69de29..0000000 diff --git a/master/littlelink/templates/deployment.yaml b/master/littlelink/templates/deployment.yaml deleted file mode 100644 index ec9ab4d..0000000 --- a/master/littlelink/templates/deployment.yaml +++ /dev/null @@ -1,101 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: littlelink - name: littlelink - labels: - app: littlelink -spec: - selector: - matchLabels: - app: littlelink - replicas: 1 - template: - metadata: - labels: - app: littlelink - spec: - containers: - - name: littlelink - image: registry.internal.durp.info/techno-tim/littlelink-server:latest - imagePullPolicy: Always - livenessProbe: - httpGet: - path: /healthcheck - port: 3000 - readinessProbe: - httpGet: - path: /healthcheck - port: 3000 - env: - - name: META_TITLE - value: DeveloperDurp - - name: META_DESCRIPTION - value: The Durpy Developer - - name: META_AUTHOR - value: DeveloperDurp - - name: LANG - value: en - - name: META_INDEX_STATUS - value: all - - name: OG_TITLE - value: DeveloperDurp - - name: OG_DESCRIPTION - value: DeveloperDurp - - name: OG_URL - value: https://gitlab.com/developerdurp - - name: OG_IMAGE - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : OG_IMAGE_WIDTH - value: "400" - - name : OG_IMAGE_HEIGHT - value: "400" - - name : THEME - value: Dark - - name : FAVICON_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_2X_URL - value: https://gitlab.com/uploads/-/system/user/avatar/9987937/avatar.png - - name : AVATAR_ALT - value: DeveloperDurp Profile Pic - - name : NAME - value: DeveloperDurp - - name : BIO - value: Sup Nerd, - - name : BUTTON_ORDER - value: GITHUB,GITLAB,YOUTUBE,INSTAGRAM,TWITTER,BLUESKY,COFFEE,EMAIL - - name : TWITTER - value: https://twitter.com/developerdurp - - name : GITHUB - value: https://github.com/DeveloperDurp - - name: INSTAGRAM - value: https://instagram.com/developerdurp - - name : GITLAB - value: https://gitlab.com/developerdurp - - name: YOUTUBE - value: https://www.youtube.com/channel/UC1rGa6s6kER_gLpIQsxeMVQ - - name : EMAIL - value: DeveloperDurp@durp.info - - name : EMAIL_TEXT - value: DeveloperDurp@durp.info - - name : FOOTER - value: DeveloperDurp © 2022 - - name: CUSTOM_BUTTON_TEXT - value: BuyMeACoffee,BlueSky - - name: CUSTOM_BUTTON_URL - value: https://www.buymeacoffee.com/DeveloperDurp,https://bsky.app/profile/durp.info - - name: CUSTOM_BUTTON_COLOR - value: '#ffdd00,#1185fe' - - name: CUSTOM_BUTTON_TEXT_COLOR - value: '#000000,#FFFFFF' - - name: CUSTOM_BUTTON_ALT_TEXT - value: Support,BlueSky - - name: CUSTOM_BUTTON_NAME - value: COFFEE,BLUESKY - - name: CUSTOM_BUTTON_ICON - value: fa-solid fa-cup-togo - ports: - - name: http - containerPort: 3000 diff --git a/master/littlelink/templates/ingress.yaml b/master/littlelink/templates/ingress.yaml deleted file mode 100644 index 194f31e..0000000 --- a/master/littlelink/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: littlelink-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`links.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: littlelink - port: 80 - tls: - secretName: littlelink-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: littlelink-tls -spec: - secretName: littlelink-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "links.durp.info" - dnsNames: - - "links.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: links-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: links.durp.info -spec: - type: ExternalName - externalName: durp.info \ No newline at end of file diff --git a/master/littlelink/templates/service.yaml b/master/littlelink/templates/service.yaml deleted file mode 100644 index 445d527..0000000 --- a/master/littlelink/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: littlelink -spec: - ports: - - name: http - port: 80 - targetPort: 3000 - protocol: TCP - selector: - app: littlelink \ No newline at end of file diff --git a/master/longhorn/Chart.yaml b/master/longhorn/Chart.yaml deleted file mode 100644 index 2c9fea3..0000000 --- a/master/longhorn/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: longhorn-system -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: longhorn - repository: https://charts.longhorn.io - version: 1.9.0 \ No newline at end of file diff --git a/master/longhorn/templates/ingress.yaml b/master/longhorn/templates/ingress.yaml deleted file mode 100644 index 09c5ef2..0000000 --- a/master/longhorn/templates/ingress.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: longhorn-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - # - name: authentik-proxy-provider - # namespace: traefik - kind: Rule - services: - - name: longhorn-frontend - port: 80 - # - match: Host(`longhorn.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - # kind: Rule - # services: - # - name: ak-outpost-authentik-embedded-outpost - # namespace: authentik - # port: 9000 - tls: - secretName: longhorn-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: longhorn-tls -spec: - secretName: longhorn-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "longhorn.internal.durp.info" - dnsNames: - - "longhorn.internal.durp.info" diff --git a/master/longhorn/templates/secrets.yaml b/master/longhorn/templates/secrets.yaml deleted file mode 100644 index 4bbdc35..0000000 --- a/master/longhorn/templates/secrets.yaml +++ /dev/null @@ -1,24 +0,0 @@ - -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: external-longhorn-backup-token-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: longhorn-backup-token-secret - data: - - secretKey: AWS_ACCESS_KEY_ID - remoteRef: - key: secrets/longhorn/backup - property: AWS_ACCESS_KEY_ID - - secretKey: AWS_ENDPOINTS - remoteRef: - key: secrets/longhorn/backup - property: AWS_ENDPOINTS - - secretKey: AWS_SECRET_ACCESS_KEY - remoteRef: - key: secrets/longhorn/backup - property: AWS_SECRET_ACCESS_KEY diff --git a/master/longhorn/values.yaml b/master/longhorn/values.yaml deleted file mode 100644 index 647385b..0000000 --- a/master/longhorn/values.yaml +++ /dev/null @@ -1,253 +0,0 @@ -longhorn: - - # Default values for longhorn. - # This is a YAML-formatted file. - # Declare variables to be passed into your templates. - global: - cattle: - systemDefaultRegistry: "" - - image: - longhorn: - engine: - repository: longhornio/longhorn-engine - manager: - repository: longhornio/longhorn-manager - ui: - repository: longhornio/longhorn-ui - instanceManager: - repository: longhornio/longhorn-instance-manager - shareManager: - repository: longhornio/longhorn-share-manager - backingImageManager: - repository: longhornio/backing-image-manager - csi: - attacher: - repository: longhornio/csi-attacher - provisioner: - repository: longhornio/csi-provisioner - nodeDriverRegistrar: - repository: longhornio/csi-node-driver-registrar - resizer: - repository: longhornio/csi-resizer - snapshotter: - repository: longhornio/csi-snapshotter - pullPolicy: Always - - service: - ui: - type: ClusterIP - nodePort: null - manager: - type: ClusterIP - nodePort: "" - loadBalancerIP: "" - loadBalancerSourceRanges: "" - - persistence: - defaultClass: true - defaultFsType: ext4 - defaultClassReplicaCount: 3 - defaultDataLocality: disabled # best-effort otherwise - reclaimPolicy: Retain - migratable: false - recurringJobSelector: - enable: true - jobList: '[ - { - "name":"backup", - "task":"backup", - "cron":"0 0 * * ?", - "retain":24 - } - ]' - backingImage: - enable: false - name: ~ - dataSourceType: ~ - dataSourceParameters: ~ - expectedChecksum: ~ - - csi: - kubeletRootDir: ~ - attacherReplicaCount: ~ - provisionerReplicaCount: ~ - resizerReplicaCount: ~ - snapshotterReplicaCount: ~ - - defaultSettings: - backupTarget: S3://longhorn-master@us-east-1/ - backupTargetCredentialSecret: longhorn-backup-token-secret - allowRecurringJobWhileVolumeDetached: ~ - createDefaultDiskLabeledNodes: ~ - defaultDataPath: ~ - defaultDataLocality: ~ - replicaSoftAntiAffinity: ~ - replicaAutoBalance: ~ - storageOverProvisioningPercentage: ~ - storageMinimalAvailablePercentage: ~ - upgradeChecker: ~ - defaultReplicaCount: ~ - defaultLonghornStaticStorageClass: longhorn - backupstorePollInterval: ~ - taintToleration: ~ - systemManagedComponentsNodeSelector: ~ - priorityClass: ~ - autoSalvage: ~ - autoDeletePodWhenVolumeDetachedUnexpectedly: ~ - disableSchedulingOnCordonedNode: ~ - replicaZoneSoftAntiAffinity: ~ - nodeDownPodDeletionPolicy: ~ - allowNodeDrainWithLastHealthyReplica: ~ - mkfsExt4Parameters: ~ - disableReplicaRebuild: ~ - replicaReplenishmentWaitInterval: ~ - concurrentReplicaRebuildPerNodeLimit: ~ - disableRevisionCounter: ~ - systemManagedPodsImagePullPolicy: ~ - allowVolumeCreationWithDegradedAvailability: ~ - autoCleanupSystemGeneratedSnapshot: ~ - concurrentAutomaticEngineUpgradePerNodeLimit: ~ - backingImageCleanupWaitInterval: ~ - backingImageRecoveryWaitInterval: ~ - guaranteedEngineManagerCPU: ~ - guaranteedReplicaManagerCPU: ~ - kubernetesClusterAutoscalerEnabled: ~ - orphanAutoDeletion: ~ - storageNetwork: ~ - privateRegistry: - createSecret: ~ - registryUrl: ~ - registryUser: ~ - registryPasswd: ~ - registrySecret: ~ - - longhornManager: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - longhornDriver: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - longhornUI: - priorityClass: ~ - tolerations: [] - ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above - ## and uncomment this example block - # - key: "key" - # operator: "Equal" - # value: "value" - # effect: "NoSchedule" - nodeSelector: {} - ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above - ## and uncomment this example block - # label-key1: "label-value1" - # label-key2: "label-value2" - - resources: {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - # - - ingress: - ## Set to true to enable ingress record generation - enabled: false - - ## Add ingressClassName to the Ingress - ## Can replace the kubernetes.io/ingress.class annotation on v1.18+ - ingressClassName: nginx - - host: longhorn.internal.durp.info - - ## Set this to true in order to enable TLS on the ingress record - ## A side effect of this will be that the backend service will be connected at port 443 - tls: - - secretName: longhorn-tls - hosts: - - longhorn.internal.durp.info - - ## If TLS is set to true, you must declare what secret will store the key/certificate for TLS - tlsSecret: longhorn-tls - - ## If ingress is enabled you can set the default ingress path - ## then you can access the UI by using the following full path {{host}}+{{path}} - path: / - - ## Ingress annotations done as key:value pairs - ## If you're using kube-lego, you will want to add: - ## kubernetes.io/tls-acme: true - ## - ## For a full list of possible ingress annotations, please see - ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md - ## - ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production - nginx.ingress.kubernetes.io/auth-url: |- - http://ak-outpost-authentik-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/nginx - nginx.ingress.kubernetes.io/auth-signin: |- - https://longhorn.internal.durp.info/outpost.goauthentik.io/start?rd=$escaped_request_uri - nginx.ingress.kubernetes.io/auth-response-headers: |- - Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid - nginx.ingress.kubernetes.io/auth-snippet: | - proxy_set_header X-Forwarded-Host $http_host; - - secrets: - ## If you're providing your own certificates, please use this to add the certificates as secrets - ## key and certificate should start with -----BEGIN CERTIFICATE----- or - ## -----BEGIN RSA PRIVATE KEY----- - ## - ## name should line up with a tlsSecret set further up - ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set - ## - ## It is also possible to create and manage the certificates outside of this helm chart - ## Please see README.md for more information - # - name: longhorn.local-tls - # key: - # certificate: - - # Configure a pod security policy in the Longhorn namespace to allow privileged pods - enablePSP: true - - ## Specify override namespace, specifically this is useful for using longhorn as sub-chart - ## and its release namespace is not the `longhorn-system` - namespaceOverride: "" - - # Annotations to add to the Longhorn Manager DaemonSet Pods. Optional. - annotations: {} - - serviceAccount: - # Annotations to add to the service account - annotations: {} - diff --git a/master/metallb-system/Chart.yaml b/master/metallb-system/Chart.yaml deleted file mode 100644 index 7b97113..0000000 --- a/master/metallb-system/Chart.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v2 -name: metallb-system -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - -dependencies: -- name: metallb - repository: https://metallb.github.io/metallb - version: 0.15.2 - diff --git a/master/metallb-system/templates/config.yaml b/master/metallb-system/templates/config.yaml deleted file mode 100644 index e44285d..0000000 --- a/master/metallb-system/templates/config.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: metallb.io/v1beta1 -kind: IPAddressPool -metadata: - name: cheap -spec: - addresses: - - 192.168.20.130-192.168.20.140 ---- -apiVersion: metallb.io/v1beta1 -kind: L2Advertisement -metadata: - name: poop - namespace: metallb-system -spec: - ipAddressPools: - - cheap - diff --git a/master/metallb-system/values.yaml b/master/metallb-system/values.yaml deleted file mode 100644 index 0c6b1b9..0000000 --- a/master/metallb-system/values.yaml +++ /dev/null @@ -1,197 +0,0 @@ -metallb: - imagePullSecrets: [] - nameOverride: "" - fullnameOverride: "" - loadBalancerClass: "" - - rbac: - create: true - - prometheus: - scrapeAnnotations: false - metricsPort: 7472 - speakerMetricsTLSSecret: "" - controllerMetricsTLSSecret: "" - rbacPrometheus: true - serviceAccount: "" - namespace: "" - rbacProxy: - repository: gcr.io/kubebuilder/kube-rbac-proxy - tag: v0.12.0 - pullPolicy: - podMonitor: - enabled: false - additionalLabels: {} - annotations: {} - jobLabel: "app.kubernetes.io/name" - interval: - metricRelabelings: [] - relabelings: [] - serviceMonitor: - enabled: false - speaker: - additionalLabels: {} - annotations: {} - tlsConfig: - insecureSkipVerify: true - controller: - additionalLabels: {} - annotations: {} - tlsConfig: - insecureSkipVerify: true - jobLabel: "app.kubernetes.io/name" - interval: - metricRelabelings: [] - relabelings: [] - prometheusRule: - enabled: false - additionalLabels: {} - annotations: {} - staleConfig: - enabled: true - labels: - severity: warning - configNotLoaded: - enabled: true - labels: - severity: warning - addressPoolExhausted: - enabled: true - labels: - severity: alert - addressPoolUsage: - enabled: true - thresholds: - - percent: 75 - labels: - severity: warning - - percent: 85 - labels: - severity: warning - - percent: 95 - labels: - severity: alert - bgpSessionDown: - enabled: true - labels: - severity: alert - - extraAlerts: [] - - controller: - enabled: true - # -- Controller log level. Must be one of: `all`, `debug`, `info`, `warn`, `error` or `none` - logLevel: info - image: - repository: quay.io/metallb/controller - tag: - pullPolicy: - strategy: - type: RollingUpdate - serviceAccount: - create: true - name: "" - annotations: {} - securityContext: - runAsNonRoot: true - runAsUser: 65534 - fsGroup: 65534 - resources: {} - nodeSelector: {} - tolerations: [] - priorityClassName: "" - runtimeClassName: "" - affinity: {} - podAnnotations: {} - labels: {} - livenessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - tlsMinVersion: "VersionTLS12" - tlsCipherSuites: "" - - extraContainers: [] - - speaker: - enabled: true - logLevel: debug - tolerateMaster: true - memberlist: - enabled: true - mlBindPort: 7946 - mlBindAddrOverride: "" - mlSecretKeyPath: "/etc/ml_secret_key" - excludeInterfaces: - enabled: true - ignoreExcludeLB: false - - image: - repository: quay.io/metallb/speaker - tag: - pullPolicy: - updateStrategy: - type: RollingUpdate - serviceAccount: - create: true - name: "" - annotations: {} - securityContext: {} - resources: {} - nodeSelector: {} - tolerations: [] - priorityClassName: "" - affinity: {} - runtimeClassName: "" - podAnnotations: {} - labels: - pod-security.kubernetes.io/enforce: privileged - pod-security.kubernetes.io/audit: privileged - pod-security.kubernetes.io/warn: privileged - livenessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - readinessProbe: - enabled: true - failureThreshold: 3 - initialDelaySeconds: 10 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - startupProbe: - enabled: true - failureThreshold: 30 - periodSeconds: 5 - frr: - enabled: true - image: - repository: quay.io/frrouting/frr - tag: 9.1.3 - pullPolicy: - metricsPort: 7473 - resources: {} - reloader: - resources: {} - frrMetrics: - resources: {} - extraContainers: [] - crds: - enabled: true - validationFailurePolicy: Fail - frrk8s: - enabled: false - diff --git a/master/nfs-client/Chart.yml b/master/nfs-client/Chart.yml deleted file mode 100644 index 217f2c1..0000000 --- a/master/nfs-client/Chart.yml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v2 -name: nfs-client -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" - diff --git a/master/nfs-client/templates/cluster-role-binding.yml b/master/nfs-client/templates/cluster-role-binding.yml deleted file mode 100644 index 427d8c6..0000000 --- a/master/nfs-client/templates/cluster-role-binding.yml +++ /dev/null @@ -1,12 +0,0 @@ -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: run-nfs-client-provisioner -subjects: - - kind: ServiceAccount - name: nfs-client-provisioner - namespace: nfs-client -roleRef: - kind: ClusterRole - name: nfs-client-provisioner-runner - apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/cluster-role.yml b/master/nfs-client/templates/cluster-role.yml deleted file mode 100644 index fa6ed20..0000000 --- a/master/nfs-client/templates/cluster-role.yml +++ /dev/null @@ -1,20 +0,0 @@ -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: nfs-client-provisioner-runner -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "delete"] - - apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["create", "update", "patch"] - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/provisioner.yml b/master/nfs-client/templates/provisioner.yml deleted file mode 100644 index c76fe8c..0000000 --- a/master/nfs-client/templates/provisioner.yml +++ /dev/null @@ -1,42 +0,0 @@ -kind: Deployment -apiVersion: apps/v1 -metadata: - name: nfs-client-provisioner - namespace: nfs-client -spec: - selector: - matchLabels: - app: nfs-client-provisioner - replicas: 1 - strategy: - type: Recreate - template: - metadata: - labels: - app: nfs-client-provisioner - spec: - serviceAccountName: nfs-client-provisioner - containers: - - name: nfs-client-provisioner - image: gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0 - resources: - requests: - cpu: 500m - memory: 512Mi - limits: - memory: 1Gi - volumeMounts: - - name: nfs-client-ssd - mountPath: /persistentvolumes - env: - - name: PROVISIONER_NAME - value: durp.info/nfs - - name: NFS_SERVER - value: 192.168.20.253 - - name: NFS_PATH - value: /mnt/user/k3s - volumes: - - name: nfs-client-ssd - nfs: - server: 192.168.20.253 - path: /mnt/user/k3s diff --git a/master/nfs-client/templates/role-binding.yml b/master/nfs-client/templates/role-binding.yml deleted file mode 100644 index fb0f085..0000000 --- a/master/nfs-client/templates/role-binding.yml +++ /dev/null @@ -1,13 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: leader-locking-nfs-client-provisioner - namespace: nfs-client -subjects: - - kind: ServiceAccount - name: nfs-client-provisioner - namespace: nfs-client -roleRef: - kind: Role - name: leader-locking-nfs-client-provisioner - apiGroup: rbac.authorization.k8s.io diff --git a/master/nfs-client/templates/role.yml b/master/nfs-client/templates/role.yml deleted file mode 100644 index 910346d..0000000 --- a/master/nfs-client/templates/role.yml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: leader-locking-nfs-client-provisioner - namespace: nfs-client -rules: - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "list", "watch", "create", "update", "patch"] diff --git a/master/nfs-client/templates/service-account.yml b/master/nfs-client/templates/service-account.yml deleted file mode 100644 index ef9b4d7..0000000 --- a/master/nfs-client/templates/service-account.yml +++ /dev/null @@ -1,5 +0,0 @@ -kind: ServiceAccount -apiVersion: v1 -metadata: - name: nfs-client-provisioner - namespace: nfs-client diff --git a/master/nfs-client/templates/storage-class.yml b/master/nfs-client/templates/storage-class.yml deleted file mode 100644 index b615fe1..0000000 --- a/master/nfs-client/templates/storage-class.yml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: nfs-storage - annotations: - storageclass.kubernetes.io/is-default-class: "false" -provisioner: durp.info/nfs -parameters: - archiveOnDelete: "false" -reclaimPolicy: Retain diff --git a/master/open-webui/Chart.yaml b/master/open-webui/Chart.yaml deleted file mode 100644 index 1561d60..0000000 --- a/master/open-webui/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: open-webui -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/master/open-webui/templates/deployment.yaml b/master/open-webui/templates/deployment.yaml deleted file mode 100644 index c76ec24..0000000 --- a/master/open-webui/templates/deployment.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - namespace: open-webui - name: open-webui - labels: - app: open-webui -spec: - selector: - matchLabels: - app: open-webui - replicas: 1 - template: - metadata: - labels: - app: open-webui - spec: - containers: - - name: open-webui - image: registry.internal.durp.info/open-webui/open-webui:main - imagePullPolicy: Always - volumeMounts: - - name: open-webui-pvc1 - mountPath: /app/backend/data - ports: - - name: http - containerPort: 8080 - env: - - name: OLLAMA_BASE_URL - valueFrom: - secretKeyRef: - name: open-webui-secret - key: OLLAMA_BASE_URL - volumes: - - name: open-webui-pvc1 - persistentVolumeClaim: - claimName: open-webui-pvc1 diff --git a/master/open-webui/templates/ingress.yaml b/master/open-webui/templates/ingress.yaml deleted file mode 100644 index 6331e92..0000000 --- a/master/open-webui/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: open-webui-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: open-webui - port: 8080 - tls: - secretName: open-webui-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: open-webui-tls -spec: - secretName: open-webui-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "open-webui.durp.info" - dnsNames: - - "open-webui.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: open-webui-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: open-webui.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/open-webui/templates/pvc.yaml b/master/open-webui/templates/pvc.yaml deleted file mode 100644 index a7ba262..0000000 --- a/master/open-webui/templates/pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: open-webui-pvc1 -spec: - storageClassName: longhorn - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi diff --git a/master/open-webui/templates/secrets.yaml b/master/open-webui/templates/secrets.yaml deleted file mode 100644 index c8a22bc..0000000 --- a/master/open-webui/templates/secrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: open-webui-secret -spec: - secretStoreRef: - name: vault - kind: ClusterSecretStore - target: - name: open-webui-secret - data: - - secretKey: OLLAMA_BASE_URL - remoteRef: - key: secrets/open-webui - property: OLLAMA_BASE_URL - diff --git a/master/open-webui/templates/service.yaml b/master/open-webui/templates/service.yaml deleted file mode 100644 index cd93455..0000000 --- a/master/open-webui/templates/service.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: open-webui -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - protocol: TCP - selector: - app: open-webui diff --git a/master/traefik/Chart.yaml b/master/traefik/Chart.yaml deleted file mode 100644 index 5378476..0000000 --- a/master/traefik/Chart.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v2 -name: traefik -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: traefik - repository: https://traefik.github.io/charts - version: 24.0.0 diff --git a/master/traefik/templates/ingress.yaml b/master/traefik/templates/ingress.yaml deleted file mode 100644 index c3db450..0000000 --- a/master/traefik/templates/ingress.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: traefik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`traefik.internal.durp.info`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: api@internal - kind: TraefikService - - match: Host(`traefik.internal.durp.info`) && PathPrefix(`/outpost.goauthentik.io`) - kind: Rule - services: - - name: ak-outpost-master-embedded-outpost - namespace: authentik - port: 9000 - tls: - secretName: traefik-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: traefik-tls - namespace: traefik -spec: - secretName: traefik-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "traefik.internal.durp.info" - dnsNames: - - "traefik.internal.durp.info" diff --git a/master/traefik/templates/middlewares.yaml b/master/traefik/templates/middlewares.yaml deleted file mode 100644 index dfa36c4..0000000 --- a/master/traefik/templates/middlewares.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: authentik-proxy-provider - namespace: traefik -spec: - forwardAuth: - address: http://ak-outpost-master-embedded-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik?rd=$scheme://$http_host$request_uri - trustForwardHeader: true - authResponseHeaders: - - X-authentik-username - - X-authentik-groups - - X-authentik-email - - X-authentik-name - - X-authentik-uid - - X-authentik-jwt - - X-authentik-meta-jwks - - X-authentik-meta-outpost - - X-authentik-meta-provider - - X-authentik-meta-app - - X-authentik-meta-version - ---- - -apiVersion: traefik.containo.us/v1alpha1 -kind: Middleware -metadata: - name: whitelist - namespace: traefik -spec: - ipWhiteList: - sourceRange: - - 192.168.0.0/16 - - 172.16.0.0/12 - - 10.0.0.0/8 diff --git a/master/traefik/values.yaml b/master/traefik/values.yaml deleted file mode 100644 index 5bb0a04..0000000 --- a/master/traefik/values.yaml +++ /dev/null @@ -1,887 +0,0 @@ -traefik: - # Default values for Traefik - image: - registry: docker.io - repository: traefik - # defaults to appVersion - tag: "" - pullPolicy: Always - - # - # Configure integration with Traefik Hub - # - hub: - ## Enabling Hub will: - # * enable Traefik Hub integration on Traefik - # * add `traefikhub-tunl` endpoint - # * enable Prometheus metrics with addRoutersLabels - # * enable allowExternalNameServices on KubernetesIngress provider - # * enable allowCrossNamespace on KubernetesCRD provider - # * add an internal (ClusterIP) Service, dedicated for Traefik Hub - enabled: true - ## Default port can be changed - # tunnelPort: 9901 - ## TLS is optional. Insecure is mutually exclusive with any other options - # tls: - # insecure: false - # ca: "/path/to/ca.pem" - # cert: "/path/to/cert.pem" - # key: "/path/to/key.pem" - - # - # Configure the deployment - # - deployment: - enabled: true - # Can be either Deployment or DaemonSet - kind: Deployment - # Number of pods of the deployment (only applies when kind == Deployment) - replicas: 3 - # Number of old history to retain to allow rollback (If not set, default Kubernetes value is set to 10) - revisionHistoryLimit: 1 - # Amount of time (in seconds) before Kubernetes will send the SIGKILL signal if Traefik does not shut down - terminationGracePeriodSeconds: 60 - # The minimum number of seconds Traefik needs to be up and running before the DaemonSet/Deployment controller considers it available - minReadySeconds: 0 - # Additional deployment annotations (e.g. for jaeger-operator sidecar injection) - annotations: {} - # Additional deployment labels (e.g. for filtering deployment by custom labels) - labels: {} - # Additional pod annotations (e.g. for mesh injection or prometheus scraping) - podAnnotations: {} - # Additional Pod labels (e.g. for filtering Pod by custom labels) - podLabels: {} - # Additional containers (e.g. for metric offloading sidecars) - additionalContainers: [] - # https://docs.datadoghq.com/developers/dogstatsd/unix_socket/?tab=host - # - name: socat-proxy - # image: alpine/socat:1.0.5 - # args: ["-s", "-u", "udp-recv:8125", "unix-sendto:/socket/socket"] - # volumeMounts: - # - name: dsdsocket - # mountPath: /socket - # Additional volumes available for use with initContainers and additionalContainers - additionalVolumes: [] - # - name: dsdsocket - # hostPath: - # path: /var/run/statsd-exporter - # Additional initContainers (e.g. for setting file permission as shown below) - initContainers: [] - # The "volume-permissions" init container is required if you run into permission issues. - # Related issue: https://github.com/traefik/traefik-helm-chart/issues/396 - # - name: volume-permissions - # image: busybox:latest - # command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json"] - # securityContext: - # runAsNonRoot: true - # runAsGroup: 65532 - # runAsUser: 65532 - # volumeMounts: - # - name: data - # mountPath: /data - # Use process namespace sharing - shareProcessNamespace: false - # Custom pod DNS policy. Apply if `hostNetwork: true` - # dnsPolicy: ClusterFirstWithHostNet - # Additional imagePullSecrets - imagePullSecrets: [] - # - name: myRegistryKeySecretName - # Pod lifecycle actions - lifecycle: {} - # preStop: - # exec: - # command: ["/bin/sh", "-c", "sleep 40"] - # postStart: - # httpGet: - # path: /ping - # port: 9000 - # host: localhost - # scheme: HTTP - - # Pod disruption budget - podDisruptionBudget: - enabled: false - # maxUnavailable: 1 - # maxUnavailable: 33% - # minAvailable: 0 - # minAvailable: 25% - - # Create a default IngressClass for Traefik - ingressClass: - enabled: true - isDefaultClass: false - - # Enable experimental features - experimental: - v3: - enabled: false - plugins: - enabled: true - kubernetesGateway: - enabled: false - gateway: - enabled: true - # certificate: - # group: "core" - # kind: "Secret" - # name: "mysecret" - # By default, Gateway would be created to the Namespace you are deploying Traefik to. - # You may create that Gateway in another namespace, setting its name below: - # namespace: default - # Additional gateway annotations (e.g. for cert-manager.io/issuer) - # annotations: - # cert-manager.io/issuer: letsencrypt - - # Create an IngressRoute for the dashboard - ingressRoute: - dashboard: - enabled: true - # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) - annotations: {} - # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) - labels: {} - # The router match rule used for the dashboard ingressRoute - matchRule: PathPrefix(`/dashboard`) || PathPrefix(`/api`) - # Specify the allowed entrypoints to use for the dashboard ingress route, (e.g. traefik, web, websecure). - # By default, it's using traefik entrypoint, which is not exposed. - # /!\ Do not expose your dashboard without any protection over the internet /!\ - entryPoints: ["traefik"] - # Additional ingressRoute middlewares (e.g. for authentication) - middlewares: [] - # TLS options (e.g. secret containing certificate) - tls: {} - - # Customize updateStrategy of traefik pods - updateStrategy: - type: RollingUpdate - rollingUpdate: - maxUnavailable: 0 - maxSurge: 1 - - # Customize liveness and readiness probe values. - readinessProbe: - failureThreshold: 1 - initialDelaySeconds: 2 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 2 - - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 2 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 2 - - # - # Configure providers - # - providers: - kubernetesCRD: - enabled: true - allowCrossNamespace: true - allowExternalNameServices: false - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - namespaces: [] - # - "default" - - kubernetesIngress: - enabled: true - allowExternalNameServices: false - allowEmptyServices: false - # ingressClass: traefik-internal - # labelSelector: environment=production,method=traefik - namespaces: [] - # - "default" - # IP used for Kubernetes Ingress endpoints - publishedService: - enabled: false - # Published Kubernetes Service to copy status from. Format: namespace/servicename - # By default this Traefik service - # pathOverride: "" - - # - # Add volumes to the traefik pod. The volume name will be passed to tpl. - # This can be used to mount a cert pair or a configmap that holds a config.toml file. - # After the volume has been mounted, add the configs into traefik by using the `additionalArguments` list below, eg: - # additionalArguments: - # - "--providers.file.filename=/config/dynamic.toml" - # - "--ping" - # - "--ping.entrypoint=web" - volumes: [] - # - name: public-cert - # mountPath: "/certs" - # type: secret - # - name: '{{ printf "%s-configs" .Release.Name }}' - # mountPath: "/config" - # type: configMap - - # Additional volumeMounts to add to the Traefik container - additionalVolumeMounts: [] - # For instance when using a logshipper for access logs - # - name: traefik-logs - # mountPath: /var/log/traefik - - ## Logs - ## https://docs.traefik.io/observability/logs/ - logs: - ## Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). - general: - # By default, the logs use a text format (common), but you can - # also ask for the json format in the format option - # format: json - # By default, the level is set to ERROR. - # Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. - level: ERROR - access: - # To enable access logs - enabled: false - ## By default, logs are written using the Common Log Format (CLF) on stdout. - ## To write logs in JSON, use json in the format option. - ## If the given format is unsupported, the default (CLF) is used instead. - # format: json - # filePath: "/var/log/traefik/access.log - ## To write the logs in an asynchronous fashion, specify a bufferingSize option. - ## This option represents the number of log lines Traefik will keep in memory before writing - ## them to the selected output. In some cases, this option can greatly help performances. - # bufferingSize: 100 - ## Filtering https://docs.traefik.io/observability/access-logs/#filtering - filters: {} - # statuscodes: "200,300-302" - # retryattempts: true - # minduration: 10ms - ## Fields - ## https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers - fields: - general: - defaultmode: keep - names: {} - ## Examples: - # ClientUsername: drop - headers: - defaultmode: drop - names: {} - ## Examples: - # User-Agent: redact - # Authorization: drop - # Content-Type: keep - - metrics: - ## Prometheus is enabled by default. - ## It can be disabled by setting "prometheus: null" - prometheus: - ## Entry point used to expose metrics. - entryPoint: metrics - ## Enable metrics on entry points. Default=true - # addEntryPointsLabels: false - ## Enable metrics on routers. Default=false - # addRoutersLabels: true - ## Enable metrics on services. Default=true - # addServicesLabels: false - ## Buckets for latency metrics. Default="0.1,0.3,1.2,5.0" - # buckets: "0.5,1.0,2.5" - ## When manualRouting is true, it disables the default internal router in - ## order to allow creating a custom router for prometheus@internal service. - # manualRouting: true - # datadog: - # ## Address instructs exporter to send metrics to datadog-agent at this address. - # address: "127.0.0.1:8125" - # ## The interval used by the exporter to push metrics to datadog-agent. Default=10s - # # pushInterval: 30s - # ## The prefix to use for metrics collection. Default="traefik" - # # prefix: traefik - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # influxdb: - # ## Address instructs exporter to send metrics to influxdb at this address. - # address: localhost:8089 - # ## InfluxDB's address protocol (udp or http). Default="udp" - # protocol: udp - # ## InfluxDB database used when protocol is http. Default="" - # # database: "" - # ## InfluxDB retention policy used when protocol is http. Default="" - # # retentionPolicy: "" - # ## InfluxDB username (only with http). Default="" - # # username: "" - # ## InfluxDB password (only with http). Default="" - # # password: "" - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## Additional labels (influxdb tags) on all metrics. - # # additionalLabels: - # # env: production - # # foo: bar - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # influxdb2: - # ## Address instructs exporter to send metrics to influxdb v2 at this address. - # address: localhost:8086 - # ## Token with which to connect to InfluxDB v2. - # token: xxx - # ## Organisation where metrics will be stored. - # org: "" - # ## Bucket where metrics will be stored. - # bucket: "" - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## Additional labels (influxdb tags) on all metrics. - # # additionalLabels: - # # env: production - # # foo: bar - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # statsd: - # ## Address instructs exporter to send metrics to statsd at this address. - # address: localhost:8125 - # ## The interval used by the exporter to push metrics to influxdb. Default=10s - # # pushInterval: 30s - # ## The prefix to use for metrics collection. Default="traefik" - # # prefix: traefik - # ## Enable metrics on entry points. Default=true - # # addEntryPointsLabels: false - # ## Enable metrics on routers. Default=false - # # addRoutersLabels: true - # ## Enable metrics on services. Default=true - # # addServicesLabels: false - # openTelemetry: - # ## Address of the OpenTelemetry Collector to send metrics to. - # address: "localhost:4318" - # ## Enable metrics on entry points. - # addEntryPointsLabels: true - # ## Enable metrics on routers. - # addRoutersLabels: true - # ## Enable metrics on services. - # addServicesLabels: true - # ## Explicit boundaries for Histogram data points. - # explicitBoundaries: - # - "0.1" - # - "0.3" - # - "1.2" - # - "5.0" - # ## Additional headers sent with metrics by the reporter to the OpenTelemetry Collector. - # headers: - # foo: bar - # test: test - # ## Allows reporter to send metrics to the OpenTelemetry Collector without using a secured protocol. - # insecure: true - # ## Interval at which metrics are sent to the OpenTelemetry Collector. - # pushInterval: 10s - # ## Allows to override the default URL path used for sending metrics. This option has no effect when using gRPC transport. - # path: /foo/v1/traces - # ## Defines the TLS configuration used by the reporter to send metrics to the OpenTelemetry Collector. - # tls: - # ## The path to the certificate authority, it defaults to the system bundle. - # ca: path/to/ca.crt - # ## The path to the public certificate. When using this option, setting the key option is required. - # cert: path/to/foo.cert - # ## The path to the private key. When using this option, setting the cert option is required. - # key: path/to/key.key - # ## If set to true, the TLS connection accepts any certificate presented by the server regardless of the hostnames it covers. - # insecureSkipVerify: true - # ## This instructs the reporter to send metrics to the OpenTelemetry Collector using gRPC. - # grpc: true - - ## - ## enable optional CRDs for Prometheus Operator - ## - ## Create a dedicated metrics service for use with ServiceMonitor - ## When hub.enabled is set to true, it's not needed: it will use hub service. - # service: - # enabled: false - # labels: {} - # annotations: {} - ## When set to true, it won't check if Prometheus Operator CRDs are deployed - # disableAPICheck: false - # serviceMonitor: - # metricRelabelings: [] - # - sourceLabels: [__name__] - # separator: ; - # regex: ^fluentd_output_status_buffer_(oldest|newest)_.+ - # replacement: $1 - # action: drop - # relabelings: [] - # - sourceLabels: [__meta_kubernetes_pod_node_name] - # separator: ; - # regex: ^(.*)$ - # targetLabel: nodename - # replacement: $1 - # action: replace - # jobLabel: traefik - # interval: 30s - # honorLabels: true - # # (Optional) - # # scrapeTimeout: 5s - # # honorTimestamps: true - # # enableHttp2: true - # # followRedirects: true - # # additionalLabels: - # # foo: bar - # # namespace: "another-namespace" - # # namespaceSelector: {} - # prometheusRule: - # additionalLabels: {} - # namespace: "another-namespace" - # rules: - # - alert: TraefikDown - # expr: up{job="traefik"} == 0 - # for: 5m - # labels: - # context: traefik - # severity: warning - # annotations: - # summary: "Traefik Down" - # description: "{{ $labels.pod }} on {{ $labels.nodename }} is down" - - tracing: {} - # instana: - # localAgentHost: 127.0.0.1 - # localAgentPort: 42699 - # logLevel: info - # enableAutoProfile: true - # datadog: - # localAgentHostPort: 127.0.0.1:8126 - # debug: false - # globalTag: "" - # prioritySampling: false - # jaeger: - # samplingServerURL: http://localhost:5778/sampling - # samplingType: const - # samplingParam: 1.0 - # localAgentHostPort: 127.0.0.1:6831 - # gen128Bit: false - # propagation: jaeger - # traceContextHeaderName: uber-trace-id - # disableAttemptReconnecting: true - # collector: - # endpoint: "" - # user: "" - # password: "" - # zipkin: - # httpEndpoint: http://localhost:9411/api/v2/spans - # sameSpan: false - # id128Bit: true - # sampleRate: 1.0 - # haystack: - # localAgentHost: 127.0.0.1 - # localAgentPort: 35000 - # globalTag: "" - # traceIDHeaderName: "" - # parentIDHeaderName: "" - # spanIDHeaderName: "" - # baggagePrefixHeaderName: "" - # elastic: - # serverURL: http://localhost:8200 - # secretToken: "" - # serviceEnvironment: "" - - globalArguments: - - "--global.checknewversion=false" - - "--global.sendanonymoususage=false" - - # - # Configure Traefik static configuration - # Additional arguments to be passed at Traefik's binary - # All available options available on https://docs.traefik.io/reference/static-configuration/cli/ - ## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` - additionalArguments: - - "--serversTransport.insecureSkipVerify=true" - - "--log.level=DEBUG" - - --experimental.plugins.jwt.moduleName=github.com/traefik-plugins/traefik-jwt-plugin - - --experimental.plugins.jwt.version=v0.7.0 - - - # Environment variables to be passed to Traefik's binary - env: [] - # - name: SOME_VAR - # value: some-var-value - # - name: SOME_VAR_FROM_CONFIG_MAP - # valueFrom: - # configMapRef: - # name: configmap-name - # key: config-key - # - name: SOME_SECRET - # valueFrom: - # secretKeyRef: - # name: secret-name - # key: secret-key - - envFrom: [] - # - configMapRef: - # name: config-map-name - # - secretRef: - # name: secret-name - - # Configure ports - ports: - # The name of this one can't be changed as it is used for the readiness and - # liveness probes, but you can adjust its config to your liking - traefik: - port: 9000 - # Use hostPort if set. - # hostPort: 9000 - # - # Use hostIP if set. If not set, Kubernetes will default to 0.0.0.0, which - # means it's listening on all your interfaces and all your IPs. You may want - # to set this value if you need traefik to listen on specific interface - # only. - # hostIP: 192.168.100.10 - - # Override the liveness/readiness port. This is useful to integrate traefik - # with an external Load Balancer that performs healthchecks. - # Default: ports.traefik.port - # healthchecksPort: 9000 - - # Override the liveness/readiness scheme. Useful for getting ping to - # respond on websecure entryPoint. - # healthchecksScheme: HTTPS - - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # You SHOULD NOT expose the traefik port on production deployments. - # If you want to access it from outside of your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # The exposed port for this service - exposedPort: 9000 - # The port protocol (TCP/UDP) - protocol: TCP - web: - ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8000 - # hostPort: 8000 - expose: true - exposedPort: 80 - # The port protocol (TCP/UDP) - protocol: TCP - # Use nodeport if set. This is useful if you have configured Traefik in a - # LoadBalancer. - # nodePort: 32080 - # Port Redirections - # Added in 2.2, you can make permanent redirects via entrypoints. - # https://docs.traefik.io/routing/entrypoints/#redirection - redirectTo: websecure - # - # Trust forwarded headers information (X-Forwarded-*). - # forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - # Enable the Proxy Protocol header parsing for the entry point - # proxyProtocol: - # trustedIPs: [] - # insecure: false - websecure: - ## Enable this entrypoint as a default entrypoint. When a service doesn't explicity set an entrypoint it will only use this entrypoint. - # asDefault: true - port: 8443 - # hostPort: 8443 - expose: true - exposedPort: 443 - ## The port protocol (TCP/UDP) - protocol: TCP - # nodePort: 32443 - # - ## Enable HTTP/3 on the entrypoint - ## Enabling it will also enable http3 experimental feature - ## https://doc.traefik.io/traefik/routing/entrypoints/#http3 - ## There are known limitations when trying to listen on same ports for - ## TCP & UDP (Http3). There is a workaround in this chart using dual Service. - ## https://github.com/kubernetes/kubernetes/issues/47249#issuecomment-587960741 - http3: - enabled: false - # advertisedPort: 4443 - # - ## Trust forwarded headers information (X-Forwarded-*). - #forwardedHeaders: - # trustedIPs: [] - # insecure: false - # - ## Enable the Proxy Protocol header parsing for the entry point - #proxyProtocol: - # trustedIPs: [] - # insecure: false - # - ## Set TLS at the entrypoint - ## https://doc.traefik.io/traefik/routing/entrypoints/#tls - tls: - enabled: true - # this is the name of a TLSOption definition - options: "" - certResolver: "" - domains: [] - # - main: example.com - # sans: - # - foo.example.com - # - bar.example.com - # - # One can apply Middlewares on an entrypoint - # https://doc.traefik.io/traefik/middlewares/overview/ - # https://doc.traefik.io/traefik/routing/entrypoints/#middlewares - # /!\ It introduces here a link between your static configuration and your dynamic configuration /!\ - # It follows the provider naming convention: https://doc.traefik.io/traefik/providers/overview/#provider-namespace - # middlewares: - # - namespace-name1@kubernetescrd - # - namespace-name2@kubernetescrd - middlewares: [] - metrics: - # When using hostNetwork, use another port to avoid conflict with node exporter: - # https://github.com/prometheus/prometheus/wiki/Default-port-allocations - port: 9100 - # hostPort: 9100 - # Defines whether the port is exposed if service.type is LoadBalancer or - # NodePort. - # - # You may not want to expose the metrics port on production deployments. - # If you want to access it from outside of your cluster, - # use `kubectl port-forward` or create a secure ingress - expose: false - # The exposed port for this service - exposedPort: 9100 - # The port protocol (TCP/UDP) - protocol: TCP - - # TLS Options are created as TLSOption CRDs - # https://doc.traefik.io/traefik/https/tls/#tls-options - # When using `labelSelector`, you'll need to set labels on tlsOption accordingly. - # Example: - # tlsOptions: - # default: - # labels: {} - # sniStrict: true - # preferServerCipherSuites: true - # customOptions: - # labels: {} - # curvePreferences: - # - CurveP521 - # - CurveP384 - tlsOptions: {} - - # TLS Store are created as TLSStore CRDs. This is useful if you want to set a default certificate - # https://doc.traefik.io/traefik/https/tls/#default-certificate - # Example: - # tlsStore: - # default: - # defaultCertificate: - # secretName: tls-cert - tlsStore: {} - - # Options for the main traefik service, where the entrypoints traffic comes - # from. - service: - enabled: true - ## Single service is using `MixedProtocolLBService` feature gate. - ## When set to false, it will create two Service, one for TCP and one for UDP. - single: true - type: LoadBalancer - # Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config) - annotations: {} - # Additional annotations for TCP service only - annotationsTCP: {} - # Additional annotations for UDP service only - annotationsUDP: {} - # Additional service labels (e.g. for filtering Service by custom labels) - labels: {} - # Additional entries here will be added to the service spec. - # Cannot contain type, selector or ports entries. - spec: - externalTrafficPolicy: Local - # loadBalancerIP: "1.2.3.4" - # clusterIP: "2.3.4.5" - loadBalancerSourceRanges: [] - # - 192.168.0.1/32 - # - 172.16.0.0/16 - externalIPs: [] - # - 1.2.3.4 - ## One of SingleStack, PreferDualStack, or RequireDualStack. - # ipFamilyPolicy: SingleStack - ## List of IP families (e.g. IPv4 and/or IPv6). - ## ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services - # ipFamilies: - # - IPv4 - # - IPv6 - ## - ## An additionnal and optional internal Service. - ## Same parameters as external Service - # internal: - # type: ClusterIP - # # labels: {} - # # annotations: {} - # # spec: {} - # # loadBalancerSourceRanges: [] - # # externalIPs: [] - # # ipFamilies: [ "IPv4","IPv6" ] - - ## Create HorizontalPodAutoscaler object. - ## - autoscaling: - enabled: true - minReplicas: 3 - maxReplicas: 10 - metrics: - #- type: Resource - # resource: - # name: memory - # target: - # type: Utilization - # averageUtilization: 80 - - type: Resource - resource: - name: cpu - target: - type: Utilization - averageUtilization: 80 - behavior: - scaleDown: - stabilizationWindowSeconds: 300 - policies: - - type: Pods - value: 1 - periodSeconds: 60 - - # Enable persistence using Persistent Volume Claims - # ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ - # It can be used to store TLS certificates, see `storage` in certResolvers - persistence: - enabled: false - name: data - # existingClaim: "" - accessMode: ReadWriteOnce - size: 128Mi - # storageClass: "" - # volumeName: "" - path: /data - annotations: {} - # subPath: "" # only mount a subpath of the Volume into the pod - - certResolvers: {} - # letsencrypt: - # # for challenge options cf. https://doc.traefik.io/traefik/https/acme/ - # email: email@example.com - # dnsChallenge: - # # also add the provider's required configuration under env - # # or expand then from secrets/configmaps with envfrom - # # cf. https://doc.traefik.io/traefik/https/acme/#providers - # provider: digitalocean - # # add futher options for the dns challenge as needed - # # cf. https://doc.traefik.io/traefik/https/acme/#dnschallenge - # delayBeforeCheck: 30 - # resolvers: - # - 1.1.1.1 - # - 8.8.8.8 - # tlsChallenge: true - # httpChallenge: - # entryPoint: "web" - # # It has to match the path with a persistent volume - # storage: /data/acme.json - - # If hostNetwork is true, runs traefik in the host network namespace - # To prevent unschedulabel pods due to port collisions, if hostNetwork=true - # and replicas>1, a pod anti-affinity is recommended and will be set if the - # affinity is left as default. - hostNetwork: false - - # Whether Role Based Access Control objects like roles and rolebindings should be created - rbac: - enabled: true - # If set to false, installs ClusterRole and ClusterRoleBinding so Traefik can be used across namespaces. - # If set to true, installs Role and RoleBinding. Providers will only watch target namespace. - namespaced: false - # Enable user-facing roles - # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles - # aggregateTo: [ "admin" ] - - # Enable to create a PodSecurityPolicy and assign it to the Service Account via RoleBinding or ClusterRoleBinding - podSecurityPolicy: - enabled: false - - # The service account the pods will use to interact with the Kubernetes API - serviceAccount: - # If set, an existing service account is used - # If not set, a service account is created automatically using the fullname template - name: "" - - # Additional serviceAccount annotations (e.g. for oidc authentication) - serviceAccountAnnotations: {} - - resources: - requests: - cpu: "100m" - memory: "512Mi" - limits: - #cpu: "300m" - memory: "512Mi" - - # This example pod anti-affinity forces the scheduler to put traefik pods - # on nodes where no other traefik pods are scheduled. - # It should be used when hostNetwork: true to prevent port conflicts - affinity: {} - # podAntiAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # - labelSelector: - # matchLabels: - # app.kubernetes.io/name: '{{ template "traefik.name" . }}' - # app.kubernetes.io/instance: '{{ .Release.Name }}-{{ .Release.Namespace }}' - # topologyKey: kubernetes.io/hostname - - nodeSelector: {} - tolerations: [] - topologySpreadConstraints: [] - # # This example topologySpreadConstraints forces the scheduler to put traefik pods - # # on nodes where no other traefik pods are scheduled. - # - labelSelector: - # matchLabels: - # app: '{{ template "traefik.name" . }}' - # maxSkew: 1 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - - # Pods can have priority. - # Priority indicates the importance of a Pod relative to other Pods. - priorityClassName: "" - - # Set the container security context - # To run the container with ports below 1024 this will need to be adjust to run as root - securityContext: - capabilities: - drop: [ALL] - readOnlyRootFilesystem: true - - podSecurityContext: - # # /!\ When setting fsGroup, Kubernetes will recursively changes ownership and - # # permissions for the contents of each volume to match the fsGroup. This can - # # be an issue when storing sensitive content like TLS Certificates /!\ - # fsGroup: 65532 - fsGroupChangePolicy: "OnRootMismatch" - runAsGroup: 65532 - runAsNonRoot: true - runAsUser: 65532 - - # - # Extra objects to deploy (value evaluated as a template) - # - # In some cases, it can avoid the need for additional, extended or adhoc deployments. - # See #595 for more details and traefik/tests/values/extra.yaml for example. - extraObjects: [] - - # This will override the default Release Namespace for Helm. - # It will not affect optional CRDs such as `ServiceMonitor` and `PrometheusRules` - # namespaceOverride: traefik - # - ## This will override the default app.kubernetes.io/instance label for all Objects. - # instanceLabelOverride: traefik diff --git a/master/uptimekuma/Chart.yaml b/master/uptimekuma/Chart.yaml deleted file mode 100644 index 0dcf730..0000000 --- a/master/uptimekuma/Chart.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v2 -name: uptimekuma -description: A Helm chart for Kubernetes -type: application - -version: 0.1.0 -appVersion: "1.16.0" diff --git a/master/uptimekuma/templates/deployment.yaml b/master/uptimekuma/templates/deployment.yaml deleted file mode 100644 index d823327..0000000 --- a/master/uptimekuma/templates/deployment.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - component: uptime-kuma - name: deployment -spec: - selector: - matchLabels: - component: uptime-kuma - replicas: 1 - strategy: - type: Recreate - - template: - metadata: - labels: - component: uptime-kuma - spec: - containers: - - name: app - image: registry.durp.info/louislam/uptime-kuma:1 - ports: - - containerPort: 3001 - volumeMounts: - - mountPath: /app/data - name: storage - #livenessProbe: - #exec: - #command: - #- node - #- extra/healthcheck.js - readinessProbe: - httpGet: - path: / - port: 3001 - scheme: HTTP - - volumes: - - name: storage - persistentVolumeClaim: - claimName: uptimekuma-pvc diff --git a/master/uptimekuma/templates/ingress.yaml b/master/uptimekuma/templates/ingress.yaml deleted file mode 100644 index 86b65c8..0000000 --- a/master/uptimekuma/templates/ingress.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: kuma-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kuma.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: service - port: 3001 - tls: - secretName: kuma-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kuma-tls -spec: - secretName: kuma-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "kuma.durp.info" - dnsNames: - - "kuma.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: heimdall-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kuma.durp.info -spec: - type: ExternalName - externalName: durp.info diff --git a/master/uptimekuma/templates/kuma-pv.yaml b/master/uptimekuma/templates/kuma-pv.yaml deleted file mode 100644 index e17e5a7..0000000 --- a/master/uptimekuma/templates/kuma-pv.yaml +++ /dev/null @@ -1,25 +0,0 @@ -#apiVersion: v1 -#kind: PersistentVolume -#metadata: -# annotations: -# pv.kubernetes.io/provisioned-by: durp.info/nfs -# finalizers: -# - kubernetes.io/pv-protection -# name: uptimekuma-pv -#spec: -# accessModes: -# - ReadWriteMany -# capacity: -# storage: 10Gi -# claimRef: -# apiVersion: v1 -# kind: PersistentVolumeClaim -# name: uptimekuma-pvc -# namespace: uptimekuma -# nfs: -# path: /mnt/user/k3s/uptimekuma -# server: 192.168.20.253 -# persistentVolumeReclaimPolicy: Retain -# storageClassName: nfs-storage -# volumeMode: Filesystem -# \ No newline at end of file diff --git a/master/uptimekuma/templates/kuma-pvc.yaml b/master/uptimekuma/templates/kuma-pvc.yaml deleted file mode 100644 index ab76bf0..0000000 --- a/master/uptimekuma/templates/kuma-pvc.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: uptimekuma-pvc - namespace: uptimekuma -spec: - accessModes: - - ReadWriteMany - resources: - requests: - storage: 10Gi - storageClassName: longhorn \ No newline at end of file diff --git a/master/uptimekuma/templates/service.yaml b/master/uptimekuma/templates/service.yaml deleted file mode 100644 index cad08e7..0000000 --- a/master/uptimekuma/templates/service.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: service -spec: - selector: - component: uptime-kuma - type: ClusterIP - ports: - - name: http - port: 3001 - targetPort: 3001 - protocol: TCP \ No newline at end of file diff --git a/master/vault/Chart.yaml b/master/vault/Chart.yaml deleted file mode 100644 index 412c292..0000000 --- a/master/vault/Chart.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v2 -name: vault -description: A Helm chart for Kubernetes -type: application -version: 0.0.1 -appVersion: 0.0.1 - -dependencies: -- name: vault - repository: https://helm.releases.hashicorp.com - version: 0.30.0 - diff --git a/master/vault/templates/ingress.yaml b/master/vault/templates/ingress.yaml deleted file mode 100644 index 8998087..0000000 --- a/master/vault/templates/ingress.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: traefik.containo.us/v1alpha1 -kind: IngressRoute -metadata: - name: vault-ingress - annotations: - cert-manager.io/cluster-issuer: letsencrypt-production -spec: - entryPoints: - - websecure - routes: - - match: Host(`vault.internal.durp.info`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: vault - port: 8200 - scheme: http - tls: - secretName: vault-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: vault-tls -spec: - secretName: vault-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "vault.internal.durp.info" - dnsNames: - - "vault.internal.durp.info" - diff --git a/master/vault/templates/secret-store.yaml b/master/vault/templates/secret-store.yaml deleted file mode 100644 index e1feef8..0000000 --- a/master/vault/templates/secret-store.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ClusterSecretStore -metadata: - name: vault -spec: - provider: - vault: - server: "http://vault.vault.svc.cluster.local:8200" - path: "secrets" - version: "v2" - auth: - kubernetes: - mountPath: "kubernetes" - role: "external-secrets" diff --git a/master/vault/values.yaml b/master/vault/values.yaml deleted file mode 100644 index b7c6d88..0000000 --- a/master/vault/values.yaml +++ /dev/null @@ -1,65 +0,0 @@ -vault: - - global: - - image: - repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.4.2" - pullPolicy: Always - - agentImage: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - - injector: - enabled: "-" - - replicas: 3 - leaderElector: - enabled: true - - metrics: - enabled: true - - image: - repository: "registry.internal.durp.info/hashicorp/vault-k8s" - tag: "1.4.2" - pullPolicy: Always - - agentImage: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - - server: - enabled: "-" - image: - repository: "registry.internal.durp.info/hashicorp/vault" - tag: "1.17.6" - pullPolicy: Always - ha: - enabled: false - replicas: 3 - resources: - requests: - memory: 256Mi - cpu: 250m - limits: - memory: 256Mi - cpu: 250m - - dataStorage: - enabled: true - size: 10Gi - storageClass: longhorn - accessMode: ReadWriteOnce - auditStorage: - enabled: false - size: 10Gi - mountPath: "/vault/audit" - storageClass: longhorn - accessMode: ReadWriteOnce - ui: - enabled: false - externalPort: 8200 - targetPort: 8200 - diff --git a/prd/terraform/k3s.tf b/prd/terraform/k3s.tf deleted file mode 100644 index 4d02a21..0000000 --- a/prd/terraform/k3s.tf +++ /dev/null @@ -1,115 +0,0 @@ -resource "proxmox_vm_qemu" "k3smaster" { - count = local.k3smaster.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3smaster.ip[count.index]}" - name = local.k3smaster.name[count.index] - target_node = local.k3smaster.node[count.index] - clone = local.template - tags = local.k3smaster.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3smaster.cores - sockets = 1 - cpu_type = "host" - memory = local.k3smaster.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3smaster.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3smaster.drive - format = local.format - storage = local.k3smaster.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3smaster.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} - -resource "proxmox_vm_qemu" "k3sserver" { - count = local.k3sserver.count - ciuser = "administrator" - vmid = "${local.vlan}${local.k3sserver.ip[count.index]}" - name = local.k3sserver.name[count.index] - target_node = local.k3sserver.node[count.index] - clone = local.template - tags = local.k3sserver.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.k3sserver.cores - sockets = 1 - cpu_type = "host" - memory = local.k3sserver.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.k3sserver.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.k3sserver.drive - format = local.format - storage = local.k3sserver.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.k3sserver.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} diff --git a/prd/terraform/main.tf b/prd/terraform/main.tf deleted file mode 100644 index 6be6739..0000000 --- a/prd/terraform/main.tf +++ /dev/null @@ -1,48 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - format = "raw" - dnsserver = "192.168.11.1" - vlan = 11 - k3smaster = { - tags = "k3s_prd" - count = 3 - name = ["master01-prd", "master02-prd", "master03-prd"] - cores = 2 - memory = "4096" - drive = 20 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_prd" - count = 3 - name = ["node01-prd", "node02-prd", "node03-prd"] - cores = 4 - memory = "8192" - drive = 120 - storage = "cache-domains" - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } -} diff --git a/prd/terraform/variables.tf b/prd/terraform/variables.tf deleted file mode 100644 index 29a1c9d..0000000 --- a/prd/terraform/variables.tf +++ /dev/null @@ -1,14 +0,0 @@ -variable "pm_api_url" { - description = "API URL to Proxmox provider" - type = string -} - -variable "pm_password" { - description = "Passowrd to Proxmox provider" - type = string -} - -variable "pm_user" { - description = "Username to Proxmox provider" - type = string -} From 30b6c8ebc83a60e3658b24daca2426949a3be359 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 2 Feb 2026 05:24:41 -0600 Subject: [PATCH 1002/1058] remove ansible --- .gitignore | 4 +- .gitlab/.gitlab-ci.yml | 34 ---- ansible/base.yaml | 5 - ansible/newcluster.yaml | 2 - ansible/roles/base/files/01proxy | 1 - ansible/roles/base/files/10periodic | 4 - ansible/roles/base/files/authorized_keys_user | 2 - ansible/roles/base/files/issue | 4 - ansible/roles/base/files/motd | 4 - ansible/roles/base/files/sshd_config_secured | 95 ----------- ansible/roles/base/tasks/main.yaml | 155 ------------------ ansible/roles/base/vars/main.yaml | 17 -- 12 files changed, 1 insertion(+), 326 deletions(-) delete mode 100644 .gitlab/.gitlab-ci.yml delete mode 100644 ansible/base.yaml delete mode 100644 ansible/newcluster.yaml delete mode 100644 ansible/roles/base/files/01proxy delete mode 100644 ansible/roles/base/files/10periodic delete mode 100644 ansible/roles/base/files/authorized_keys_user delete mode 100644 ansible/roles/base/files/issue delete mode 100644 ansible/roles/base/files/motd delete mode 100644 ansible/roles/base/files/sshd_config_secured delete mode 100644 ansible/roles/base/tasks/main.yaml delete mode 100644 ansible/roles/base/vars/main.yaml diff --git a/.gitignore b/.gitignore index 1dee64d..723ef36 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1 @@ -.idea -infra/terraform/.terraform -infra/terraform/.terraform.lock.hcl +.idea \ No newline at end of file diff --git a/.gitlab/.gitlab-ci.yml b/.gitlab/.gitlab-ci.yml deleted file mode 100644 index b21e1bf..0000000 --- a/.gitlab/.gitlab-ci.yml +++ /dev/null @@ -1,34 +0,0 @@ -stages: - - triggers - -build_dmz: - stage: triggers - trigger: - include: dmz/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "dmz/terraform/*.tf" - -build_infra: - stage: triggers - trigger: - include: infra/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "infra/terraform/*.tf" - -build_dev: - stage: triggers - trigger: - include: dev/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "dev/terraform/*.tf" - -build_prd: - stage: triggers - trigger: - include: prd/.gitlab/.gitlab-ci.yml - rules: - - changes: - - "prd/terraform/*.tf" diff --git a/ansible/base.yaml b/ansible/base.yaml deleted file mode 100644 index 9093cdb..0000000 --- a/ansible/base.yaml +++ /dev/null @@ -1,5 +0,0 @@ -- hosts: all - gather_facts: yes - become: yes - roles: - - base diff --git a/ansible/newcluster.yaml b/ansible/newcluster.yaml deleted file mode 100644 index 4fb3572..0000000 --- a/ansible/newcluster.yaml +++ /dev/null @@ -1,2 +0,0 @@ -argocd login --insecure -argocd cluster add default --name prd --yes --kubeconfig ~/Documents/config-prd diff --git a/ansible/roles/base/files/01proxy b/ansible/roles/base/files/01proxy deleted file mode 100644 index 947368d..0000000 --- a/ansible/roles/base/files/01proxy +++ /dev/null @@ -1 +0,0 @@ -Acquire::http::Proxy "http://192.168.21.200:3142"; diff --git a/ansible/roles/base/files/10periodic b/ansible/roles/base/files/10periodic deleted file mode 100644 index 5d37e9f..0000000 --- a/ansible/roles/base/files/10periodic +++ /dev/null @@ -1,4 +0,0 @@ -APT::Periodic::Update-Package-Lists "1"; -APT::Periodic::Download-Upgradeable-Packages "1"; -APT::Periodic::AutocleanInterval "7"; -APT::Periodic::Unattended-Upgrade "1"; diff --git a/ansible/roles/base/files/authorized_keys_user b/ansible/roles/base/files/authorized_keys_user deleted file mode 100644 index 49d58bb..0000000 --- a/ansible/roles/base/files/authorized_keys_user +++ /dev/null @@ -1,2 +0,0 @@ -sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGilcndatMrXg06VxtNKuIo3scoyyXbYX8Z7cOjeA102AAAABHNzaDo= desktop-arch-09-08-2025-yubikey -sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINsbNSZ5Wr+50Ahz+IeZxt6F7gZ6wm1J8uKXQLbdbKFaAAAABHNzaDo= desktop-arch-09-08-2025-yubikeyNano \ No newline at end of file diff --git a/ansible/roles/base/files/issue b/ansible/roles/base/files/issue deleted file mode 100644 index 5acb66f..0000000 --- a/ansible/roles/base/files/issue +++ /dev/null @@ -1,4 +0,0 @@ -Use of this system is restricted to authorized users only, and all use is subjected to an acceptable use policy. - -IF YOU ARE NOT AUTHORIZED TO USE THIS SYSTEM, DISCONNECT NOW. - diff --git a/ansible/roles/base/files/motd b/ansible/roles/base/files/motd deleted file mode 100644 index fa6c8db..0000000 --- a/ansible/roles/base/files/motd +++ /dev/null @@ -1,4 +0,0 @@ -THIS SYSTEM IS FOR AUTHORIZED USE ONLY - -All activities are logged and monitored. - diff --git a/ansible/roles/base/files/sshd_config_secured b/ansible/roles/base/files/sshd_config_secured deleted file mode 100644 index 88bfedb..0000000 --- a/ansible/roles/base/files/sshd_config_secured +++ /dev/null @@ -1,95 +0,0 @@ -# Package generated configuration file -# See the sshd_config(5) manpage for details - -# What ports, IPs and protocols we listen for -Port 22 -# Use these options to restrict which interfaces/protocols sshd will bind to -#ListenAddress :: -#ListenAddress 0.0.0.0 -Protocol 2 -# HostKeys for protocol version 2 -HostKey /etc/ssh/ssh_host_rsa_key -HostKey /etc/ssh/ssh_host_dsa_key -HostKey /etc/ssh/ssh_host_ecdsa_key -HostKey /etc/ssh/ssh_host_ed25519_key -#Privilege Separation is turned on for security -UsePrivilegeSeparation yes - -# Lifetime and size of ephemeral version 1 server key -KeyRegenerationInterval 3600 -ServerKeyBits 1024 - -# Logging -SyslogFacility AUTH -LogLevel INFO - -# Authentication: -LoginGraceTime 120 -PermitRootLogin no -StrictModes yes - -RSAAuthentication yes -PubkeyAuthentication yes -#AuthorizedKeysFile %h/.ssh/authorized_keys - -# Don't read the user's ~/.rhosts and ~/.shosts files -IgnoreRhosts yes -# For this to work you will also need host keys in /etc/ssh_known_hosts -RhostsRSAAuthentication no -# similar for protocol version 2 -HostbasedAuthentication no -# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication -#IgnoreUserKnownHosts yes - -# To enable empty passwords, change to yes (NOT RECOMMENDED) -PermitEmptyPasswords no - -# Change to yes to enable challenge-response passwords (beware issues with -# some PAM modules and threads) -ChallengeResponseAuthentication no - -# Change to no to disable tunnelled clear text passwords -PasswordAuthentication no - -# Kerberos options -#KerberosAuthentication no -#KerberosGetAFSToken no -#KerberosOrLocalPasswd yes -#KerberosTicketCleanup yes - -# GSSAPI options -#GSSAPIAuthentication no -#GSSAPICleanupCredentials yes - -X11Forwarding no -X11DisplayOffset 10 -PrintMotd no -PrintLastLog yes -TCPKeepAlive yes -#UseLogin no - -#MaxStartups 10:30:60 -#Banner /etc/issue.net - -# Allow client to pass locale environment variables -AcceptEnv LANG LC_* - -Subsystem sftp /usr/lib/openssh/sftp-server - -# Set this to 'yes' to enable PAM authentication, account processing, -# and session processing. If this is enabled, PAM authentication will -# be allowed through the ChallengeResponseAuthentication and -# PasswordAuthentication. Depending on your PAM configuration, -# PAM authentication via ChallengeResponseAuthentication may bypass -# the setting of "PermitRootLogin without-password". -# If you just want the PAM account and session checks to run without -# PAM authentication, then enable this but set PasswordAuthentication -# and ChallengeResponseAuthentication to 'no'. -UsePAM yes - -ClientAliveInterval 300 - -#enable remote powershell -#Subsystem powershell /usr/bin/pwsh -sshs -NoLogo - - diff --git a/ansible/roles/base/tasks/main.yaml b/ansible/roles/base/tasks/main.yaml deleted file mode 100644 index 8cb1553..0000000 --- a/ansible/roles/base/tasks/main.yaml +++ /dev/null @@ -1,155 +0,0 @@ -- name: Copy apt proxy - copy: - src: files/01proxy - dest: /etc/apt/apt.conf.d/01proxy - owner: root - group: root - mode: "0644" - force: yes - when: - - ansible_os_family == "Debian" - - inventory_hostname not in hosts_deny - -- name: Update packages - apt: - name: '*' - state: latest - update_cache: yes - only_upgrade: yes - retries: 300 - delay: 10 - -- name: Remove packages not needed anymore - apt: - autoremove: yes - retries: 300 - delay: 10 - -- name: Install required packages Debian - apt: - state: latest - pkg: "{{ item }}" - with_items: "{{ required_packages }}" - retries: 300 - delay: 10 - -- name: Create user account - user: - name: "user" - shell: /bin/bash - state: present - createhome: yes - -- name: ensure ssh folder exists for user - file: - path: /home/user/.ssh - owner: user - group: user - mode: "0700" - state: directory - -- name: Deploy SSH Key (user) - copy: - dest: /home/user/.ssh/authorized_keys - src: files/authorized_keys_user - owner: user - group: user - force: true - -- name: Remove Root SSH Configuration - file: - path: /root/.ssh - state: absent - -- name: Copy Secured SSHD Configuration - copy: - src: files/sshd_config_secured - dest: /etc/ssh/sshd_config - owner: root - group: root - mode: "0644" - when: ansible_os_family == "Debian" - -- name: Copy Secured SSHD Configuration - copy: - src: files/sshd_config_secured_redhat - dest: /etc/ssh/sshd_config - owner: root - group: root - mode: "0644" - when: ansible_os_family == "RedHat" - -- name: Restart SSHD - systemd: - name: sshd - daemon_reload: yes - state: restarted - enabled: yes - ignore_errors: yes - - -- name: Copy unattended-upgrades file - copy: - src: files/10periodic - dest: /etc/apt/apt.conf.d/10periodic - owner: root - group: root - mode: "0644" - force: yes - when: ansible_os_family == "Debian" - -- name: Remove undesirable packages - package: - name: "{{ unnecessary_software }}" - state: absent - when: ansible_os_family == "Debian" - -- name: Stop and disable unnecessary services - service: - name: "{{ item }}" - state: stopped - enabled: no - with_items: "{{ unnecessary_services }}" - ignore_errors: yes - -- name: Set a message of the day - copy: - dest: /etc/motd - src: files/motd - owner: root - group: root - mode: 0644 - -- name: Set a login banner - copy: - dest: "{{ item }}" - src: files/issue - owner: root - group: root - mode: 0644 - with_items: - - /etc/issue - - /etc/issue.net - -- name: set timezone - shell: timedatectl set-timezone America/Chicago - -- name: Enable cockpit - systemd: - name: cockpit - daemon_reload: yes - state: restarted - enabled: yes - -- name: change password - ansible.builtin.user: - name: "user" - state: present - password: "{{ lookup('ansible.builtin.env', 'USER_PASSWORD') | password_hash('sha512') }}" - -- name: add user to sudoers - community.general.sudoers: - name: user - state: present - user: user - commands: ALL diff --git a/ansible/roles/base/vars/main.yaml b/ansible/roles/base/vars/main.yaml deleted file mode 100644 index 2670ac2..0000000 --- a/ansible/roles/base/vars/main.yaml +++ /dev/null @@ -1,17 +0,0 @@ -required_packages: - - ufw - - qemu-guest-agent - - fail2ban - - unattended-upgrades - - cockpit - - nfs-common - - open-iscsi - -unnecessary_services: - - postfix - - telnet - -unnecessary_software: - - tcpdump - - nmap-ncat - - wpa_supplicant From bbd94d3f2248bb57ebba2429337d6069da3d69da Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 4 Feb 2026 05:30:09 -0600 Subject: [PATCH 1003/1058] update --- infra/renovate/Chart.yaml | 5 +- infra/renovate/templates/secrets.yaml | 37 +++ infra/renovate/values.yaml | 330 ++++++++++++++++++++++++++ 3 files changed, 371 insertions(+), 1 deletion(-) diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml index e91e2d5..b33c633 100644 --- a/infra/renovate/Chart.yaml +++ b/infra/renovate/Chart.yaml @@ -10,4 +10,7 @@ dependencies: - name: renovate repository: https://docs.renovatebot.com/helm-charts version: 39.264.0 - + - name: renovate + repository: https://docs.renovatebot.com/helm-charts + version: 39.264.0 + alias: "renovatePersonal" diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index f4ac24c..e1e5fce 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -39,3 +39,40 @@ spec: remoteRef: key: kv/renovate property: RENOVATE_TOKEN + +--- +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: renovate-personal-config-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: renovate-personal-config-secret + data: + - secretKey: renovate.json + remoteRef: + key: kv/renoatePersonal + property: config + - secretKey: RENOVATE_AUTODISCOVER + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_AUTODISCOVER + - secretKey: RENOVATE_ENDPOINT + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_ENDPOINT + - secretKey: RENOVATE_GIT_AUTHOR + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_GIT_AUTHOR + - secretKey: RENOVATE_PLATFORM + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_PLATFORM + - secretKey: RENOVATE_TOKEN + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_TOKEN diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index b14286c..b9c7452 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -327,3 +327,333 @@ renovate: # "platform": "github", # "repositories": ["username/repo", "orgname/repo"] # } + +renovatePersonal: + global: + # -- Additional labels to be set on all renovate resources + commonLabels: {} + compatibility: + openshift: + # -- Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: `auto` (apply if the detected running cluster is Openshift), `force` (perform the adaptation always), `disabled` (do not perform adaptation) + adaptSecurityContext: "auto" + + # -- Override the name of the chart + nameOverride: "" + # -- Override the fully qualified app name + fullnameOverride: "" + # -- Annotations to add to secret + secretAnnotations: {} + + cronjob: + # -- Schedules the job to run using cron notation + schedule: "0 1 * * *" # At 01:00 every day + # -- You can specify a time zone for a CronJob by setting timeZone to the name of a valid time zone. (starting with k8s 1.27) + timeZone: "" # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names + # -- If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. + suspend: false + # -- Annotations to set on the cronjob + annotations: {} + # -- Labels to set on the cronjob + labels: {} + # -- "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run + concurrencyPolicy: "" + # -- "Number of successful completions is reached to mark the job as complete" + completions: "" + # -- "Where the jobs should be NonIndexed or Indexed" + completionMode: "" + # -- Amount of failed jobs to keep in history + failedJobsHistoryLimit: "" + # -- Amount of completed jobs to keep in history + successfulJobsHistoryLimit: "" + # -- Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails + jobRestartPolicy: Never + # -- Time to keep the job after it finished before automatically deleting it + ttlSecondsAfterFinished: "" + # -- Deadline for the job to finish + activeDeadlineSeconds: "" + # -- Number of times to retry running the pod before considering the job as being failed + jobBackoffLimit: "" + # -- Maximal number of failures per index + backoffLimitPerIndex: "" + # -- Maximal number of failed indexes before terminating the Job execution + maxFailedIndexes: "" + # -- Deadline to start the job, skips execution if job misses it's configured deadline + startingDeadlineSeconds: "" + # -- Additional initContainers that can be executed before renovate + initContainers: [] + # initContainers: + # - name: INIT_CONTAINER_NAME + # image: INIT_CONTAINER_IMAGE + # -- Number of pods to run in parallel + parallelism: "" + # -- Custom command to run in the container + commandOverride: [] + # -- Custom arguments to run in the container + argsOverride: [] + # -- Prepend shell commands before renovate runs + #preCommand: '' + #preCommand: | + # ls /config + # cat /config/renovate.json + + postCommand: "" + # postCommand: | + # echo hello + # echo world + + pod: + # -- Annotations to set on the pod + annotations: {} + # -- Labels to set on the pod + labels: {} + + image: + # -- Registry to pull image from + registry: registry.durp.info + # -- Image name to pull + repository: renovatebot/renovate + # -- Renovate image tag to pull + #tag: 39.264.0 + # -- "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images + pullPolicy: Always + # -- Set `true` to use the full image. See https://docs.renovatebot.com/getting-started/running/#the-full-image + useFull: false + + # -- Secret to use to pull the image from the repository + imagePullSecrets: {} + + renovate: + # -- Custom exiting global renovate config + #existingConfigFile: "/config/renovate.json" + # -- Inline global renovate config.json + config: | + { + "platform": "gitlab", + "endpoint": "https://gitlab.durp.info/api/v4", + "autodiscover": "true", + "dryRun": false, + "printConfig": false, + "autodiscoverFilter": ["durfy/*"], + "assignees": ["developerdurp"], + } + # See https://docs.renovatebot.com/self-hosted-configuration + # config: | + # { + # "": "gitlab", + # "endpoint": "https://gitlab.example.com/api/v4", + # "token": "your-gitlab-renovate-user-token", + # "autodiscover": "false", + # "dryRun": true, + # "printConfig": true, + # "repositories": ["username/repo", "orgname/repo"] + # } + + # -- Use the Helm tpl function on your configuration. See README for how to use this value + configEnableHelmTpl: false + + # -- Use this to create the renovate-config as a secret instead of a configmap + configIsSecret: true + + # -- Use this to create a config.js instead of a config.json + configIsJavaScript: false + + # -- Renovate Container-level security-context + securityContext: {} + + # Instead of a file system cache, it is highly recommended to use the redis subchart. + # Alternatively, SQLite is also a good choice. + # Take a look at https://github.com/renovatebot/renovate/discussions/30525 for more information. + # -- Options related to persistence + persistence: + cache: + # -- Allow the cache to persist between runs + enabled: false + # -- Storage class of the cache PVC + storageClass: "" + # -- Storage size of the cache PVC + storageSize: "512Mi" + # -- Existing volume, enables binding the pvc to an existing volume + volumeName: "" + # -- Labels to set on the cache PVC + labels: {} + + ssh_config: + # -- Whether to enable the use and creation of a secret containing .ssh files + enabled: false + + # Provide .ssh config file contents + # -- Contents of the id_rsa file + id_rsa: "" + # -- Contents of the id_rsa_pub file + id_rsa_pub: "" + # -- Contents of the config file + config: "" + + # or provide the name of an existing secret to be read instead. + # -- Name of the existing secret containing a valid .ssh configuration + existingSecret: "" + + # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set + secrets: {} + # -- k8s secret to reference environment variables from. Overrides secrets if set + existingSecret: "renovate-personal-config-secret" + + # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config + extraConfigmaps: [] + # extraConfigmaps: + # - name: netrc-config + # data: + # .netrc: |- + # machine gitlab.example.com + # login gitlab-ci-token + # password some-pass + # - name: yet-another-config + # data: + # ya-config.yaml: |- + # "key"="value" + # "key1"="value1" + + #extraVolumes: + # - name: renovate-config-secret + # secretName: + # name: renovate-config-secret + # items: + # - key: renovate.json + # path: renovate.json + + #extraVolumeMounts: + # - name: renovate-config-secret + # mountPath: /config + # subPath: renovate.json + + # -- Additional containers to the pod + extraContainers: [] + # extraContainers: + # - name: vault-agent + # image: vault:1.6.2 + # args: + # - agent + # - -config + # - /vault/config/config.hcl + # env: + # - name: VAULT_ADDR + # value: https://vault:8200 + # - name: VAULT_SKIP_VERIFY + # value: "false" + # - name: VAULT_CACERT + # value: /vault/tls/ca.crt + + serviceAccount: + # -- Specifies whether a service account should be created + create: false + # -- Annotations to add to the service account + annotations: {} + # -- The name of the service account to use + # If not set and create is true, a name is generated using the fullname template + name: "" + + # -- Specify resource limits and requests for the renovate container + resources: + {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + + # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name + envFrom: [] + # envFrom: + # - secretRef: + # name: env-secrets + # - configMapRef: + # name: env-configmap + + # -- Environment variables to set on the renovate container + env: + RENOVATE_AUTODISCOVER: true + # env: + # VARIABLE_NAME: "value" + + # -- Additional env. Helpful too if you want to use anything other than a `value` source. + envList: [] + # envList: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + + redis: + # Configuration for a Redis subchart. Additional documentation at + # https://github.com/bitnami/charts/tree/master/bitnami/redis + + # -- Enable the Redis subchart? + enabled: false + + # -- Override the prefix of the redisHost + nameOverride: "" + + # -- Disable replication by default + architecture: standalone + + auth: + # -- Don't require a password by default + enabled: false + + # -- Override Kubernetes version for redis chart + kubeVersion: "" + + # -- Override hostname resolution + hostAliases: [] + # See: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ + # hostAliases: + # - ip: "your-ip" + # hostnames: + # - "your-hostname" + + # -- Pod-level security-context + securityContext: {} + + # -- Select the node using labels to specify where the cronjob pod should run on + nodeSelector: {} + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # renovate: true + + # -- Configure the pod(Anti)Affinity and/or node(Anti)Affinity + affinity: {} + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + + # -- Configure which node taints the pod should tolerate + tolerations: [] + # See: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + + # -- Create extra manifests via values. Would be passed through `tpl` for templating + extraObjects: [] + # extraObjects: + # - apiVersion: external-secrets.io/v1 + # kind: ExternalSecret + # metadata: + # name: '{{ include "renovate.fullname" . }}-token' + # spec: + # secretStoreRef: + # name: default + # data: + # - secretKey: token + # remoteRef: + # key: github-token + # - | + # apiVersion: v1 + # kind: ConfigMap + # metadata: + # name: {{ include "renovate.fullname" . }}-config + # data: + # config.json: | + # { + # "platform": "github", + # "repositories": ["username/repo", "orgname/repo"] + # } From f35949a328e7545e5760f4b3921fa8ac02aa00b7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 4 Feb 2026 05:32:52 -0600 Subject: [PATCH 1004/1058] update --- infra/argocd/templates/renovate.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/templates/renovate.yaml b/infra/argocd/templates/renovate.yaml index 659d61f..debce7a 100644 --- a/infra/argocd/templates/renovate.yaml +++ b/infra/argocd/templates/renovate.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/renovate destination: From 3f40dcb38c6d884f89d9b47994304e8363b4b7b0 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 4 Feb 2026 05:35:30 -0600 Subject: [PATCH 1005/1058] update --- infra/renovate/Chart.yaml | 2 +- infra/renovate/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml index b33c633..05ed75f 100644 --- a/infra/renovate/Chart.yaml +++ b/infra/renovate/Chart.yaml @@ -13,4 +13,4 @@ dependencies: - name: renovate repository: https://docs.renovatebot.com/helm-charts version: 39.264.0 - alias: "renovatePersonal" + alias: "renovate-personal" diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index b9c7452..c4da8ba 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -328,7 +328,7 @@ renovate: # "repositories": ["username/repo", "orgname/repo"] # } -renovatePersonal: +renovate-personal: global: # -- Additional labels to be set on all renovate resources commonLabels: {} From 50138f25e642a471afe38fb37d0a82223c12d6fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 04:53:32 -0600 Subject: [PATCH 1006/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index c4da8ba..1f6fb60 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -434,7 +434,7 @@ renovate-personal: "dryRun": false, "printConfig": false, "autodiscoverFilter": ["durfy/*"], - "assignees": ["developerdurp"], + "assignees": ["durp"], } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From e3547898ec3dc67cac5ffb98cbae52126db631d1 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:11:50 -0600 Subject: [PATCH 1007/1058] update --- infra/renovate/templates/secrets.yaml | 20 -------------------- infra/renovate/values.yaml | 6 +++--- 2 files changed, 3 insertions(+), 23 deletions(-) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index e1e5fce..5ee1d1f 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -52,26 +52,6 @@ spec: target: name: renovate-personal-config-secret data: - - secretKey: renovate.json - remoteRef: - key: kv/renoatePersonal - property: config - - secretKey: RENOVATE_AUTODISCOVER - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_AUTODISCOVER - - secretKey: RENOVATE_ENDPOINT - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_ENDPOINT - - secretKey: RENOVATE_GIT_AUTHOR - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_GIT_AUTHOR - - secretKey: RENOVATE_PLATFORM - remoteRef: - key: kv/renoatePersonal - property: RENOVATE_PLATFORM - secretKey: RENOVATE_TOKEN remoteRef: key: kv/renoatePersonal diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 1f6fb60..f2e2ae7 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -430,11 +430,11 @@ renovate-personal: { "platform": "gitlab", "endpoint": "https://gitlab.durp.info/api/v4", - "autodiscover": "true", - "dryRun": false, + "autodiscover": true, + "dryRun": null, "printConfig": false, "autodiscoverFilter": ["durfy/*"], - "assignees": ["durp"], + "assignees": ["durp"] } # See https://docs.renovatebot.com/self-hosted-configuration # config: | From cc7ed8c81a83514d8a21ce9ac4b274802e02d7d5 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:15:16 -0600 Subject: [PATCH 1008/1058] update --- infra/renovate/values.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index f2e2ae7..574cc88 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -577,6 +577,7 @@ renovate-personal: # -- Environment variables to set on the renovate container env: RENOVATE_AUTODISCOVER: true + LOG_LEVEL: debug # env: # VARIABLE_NAME: "value" From 8173a53e53a363fff9d55dae37d5d651481ca1db Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:19:20 -0600 Subject: [PATCH 1009/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index 574cc88..bc5d1d8 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -433,7 +433,7 @@ renovate-personal: "autodiscover": true, "dryRun": null, "printConfig": false, - "autodiscoverFilter": ["durfy/*"], + "autodiscoverFilter": ["durfy/**"], "assignees": ["durp"] } # See https://docs.renovatebot.com/self-hosted-configuration From 2319a2eecd7333806cb9d2cf16da62868c7b591a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:20:20 -0600 Subject: [PATCH 1010/1058] update --- infra/renovate/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index bc5d1d8..adec42f 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -577,7 +577,7 @@ renovate-personal: # -- Environment variables to set on the renovate container env: RENOVATE_AUTODISCOVER: true - LOG_LEVEL: debug + #LOG_LEVEL: debug # env: # VARIABLE_NAME: "value" From 3907301d135019de50586e690a2b4b2876b4b713 Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Thu, 5 Feb 2026 11:21:01 +0000 Subject: [PATCH 1011/1058] Update Helm release portainer to v2.33.6 --- infra/portainer/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/Chart.yaml b/infra/portainer/Chart.yaml index 1813d7a..6bedd0a 100644 --- a/infra/portainer/Chart.yaml +++ b/infra/portainer/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: portainer repository: https://portainer.github.io/k8s/ - version: 2.33.5 + version: 2.33.6 From 38475db228782af052b1adce2ea6e17238b7bc1e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:26:47 -0600 Subject: [PATCH 1012/1058] update --- infra/renovate/templates/secrets.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infra/renovate/templates/secrets.yaml b/infra/renovate/templates/secrets.yaml index 5ee1d1f..d42ab7e 100644 --- a/infra/renovate/templates/secrets.yaml +++ b/infra/renovate/templates/secrets.yaml @@ -56,3 +56,7 @@ spec: remoteRef: key: kv/renoatePersonal property: RENOVATE_TOKEN + - secretKey: RENOVATE_GITHUB_COM_TOKEN + remoteRef: + key: kv/renoatePersonal + property: RENOVATE_GITHUB_COM_TOKEN From 1b37247b5219ec4bec4910e20f24de56d38651e7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 5 Feb 2026 05:35:41 -0600 Subject: [PATCH 1013/1058] update to personal gitlab --- infra/argocd/templates/argocd.yaml | 2 +- infra/argocd/templates/authentik.yaml | 4 ++-- infra/argocd/templates/bitwarden.yaml | 2 +- infra/argocd/templates/cert-manager.yaml | 4 ++-- infra/argocd/templates/external-dns.yaml | 2 +- infra/argocd/templates/external-secrets.yaml | 4 ++-- infra/argocd/templates/gitlab-runner.yaml | 2 +- infra/argocd/templates/internalproxy.yaml | 2 +- infra/argocd/templates/istio.yaml | 4 ++-- infra/argocd/templates/kube-prometheus-stack.yaml | 2 +- infra/argocd/templates/litellm.yaml | 2 +- infra/argocd/templates/littlelink.yaml | 2 +- infra/argocd/templates/longhorn.yaml | 4 ++-- infra/argocd/templates/metallb-system.yaml | 6 +++--- infra/argocd/templates/nebula-sync.yaml | 2 +- infra/argocd/templates/nfs.yaml | 2 +- infra/argocd/templates/openclarity.yaml | 2 +- infra/argocd/templates/openspeedtest.yaml | 2 +- infra/argocd/templates/portainer.yaml | 2 +- infra/argocd/templates/redlib.yaml | 2 +- infra/argocd/templates/searxng.yaml | 2 +- infra/argocd/templates/traefik.yaml | 6 +++--- infra/argocd/templates/vault.yaml | 4 ++-- 23 files changed, 33 insertions(+), 33 deletions(-) diff --git a/infra/argocd/templates/argocd.yaml b/infra/argocd/templates/argocd.yaml index 54e36bd..14141da 100644 --- a/infra/argocd/templates/argocd.yaml +++ b/infra/argocd/templates/argocd.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/argocd destination: diff --git a/infra/argocd/templates/authentik.yaml b/infra/argocd/templates/authentik.yaml index 42be478..ac5f8dc 100644 --- a/infra/argocd/templates/authentik.yaml +++ b/infra/argocd/templates/authentik.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/authentik destination: @@ -31,7 +31,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/authentik destination: diff --git a/infra/argocd/templates/bitwarden.yaml b/infra/argocd/templates/bitwarden.yaml index e9b4905..a42abbc 100644 --- a/infra/argocd/templates/bitwarden.yaml +++ b/infra/argocd/templates/bitwarden.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/bitwarden destination: diff --git a/infra/argocd/templates/cert-manager.yaml b/infra/argocd/templates/cert-manager.yaml index e7ac95d..31ef868 100644 --- a/infra/argocd/templates/cert-manager.yaml +++ b/infra/argocd/templates/cert-manager.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/cert-manager destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/cert-manager destination: diff --git a/infra/argocd/templates/external-dns.yaml b/infra/argocd/templates/external-dns.yaml index 6edb645..caa32d9 100644 --- a/infra/argocd/templates/external-dns.yaml +++ b/infra/argocd/templates/external-dns.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/external-dns destination: diff --git a/infra/argocd/templates/external-secrets.yaml b/infra/argocd/templates/external-secrets.yaml index 0583fea..7787a03 100644 --- a/infra/argocd/templates/external-secrets.yaml +++ b/infra/argocd/templates/external-secrets.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/external-secrets destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/external-secrets destination: diff --git a/infra/argocd/templates/gitlab-runner.yaml b/infra/argocd/templates/gitlab-runner.yaml index de73c0c..25b82bb 100644 --- a/infra/argocd/templates/gitlab-runner.yaml +++ b/infra/argocd/templates/gitlab-runner.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/gitlab-runner destination: diff --git a/infra/argocd/templates/internalproxy.yaml b/infra/argocd/templates/internalproxy.yaml index 57e2c60..9381c2d 100644 --- a/infra/argocd/templates/internalproxy.yaml +++ b/infra/argocd/templates/internalproxy.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/internalproxy destination: diff --git a/infra/argocd/templates/istio.yaml b/infra/argocd/templates/istio.yaml index 4d9d6d5..615a43f 100644 --- a/infra/argocd/templates/istio.yaml +++ b/infra/argocd/templates/istio.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/istio-system destination: @@ -36,7 +36,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/istio-system destination: diff --git a/infra/argocd/templates/kube-prometheus-stack.yaml b/infra/argocd/templates/kube-prometheus-stack.yaml index d89dad1..bc52501 100644 --- a/infra/argocd/templates/kube-prometheus-stack.yaml +++ b/infra/argocd/templates/kube-prometheus-stack.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/kube-prometheus-stack destination: diff --git a/infra/argocd/templates/litellm.yaml b/infra/argocd/templates/litellm.yaml index 7c818dc..d8e225a 100644 --- a/infra/argocd/templates/litellm.yaml +++ b/infra/argocd/templates/litellm.yaml @@ -6,7 +6,7 @@ #spec: # project: default # source: -# repoURL: https://gitlab.com/developerdurp/homelab.git +# repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git # targetRevision: main # path: infra/litellm # destination: diff --git a/infra/argocd/templates/littlelink.yaml b/infra/argocd/templates/littlelink.yaml index 5821718..2d6011f 100644 --- a/infra/argocd/templates/littlelink.yaml +++ b/infra/argocd/templates/littlelink.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/littlelink directory: diff --git a/infra/argocd/templates/longhorn.yaml b/infra/argocd/templates/longhorn.yaml index 33eda6e..f28a74c 100644 --- a/infra/argocd/templates/longhorn.yaml +++ b/infra/argocd/templates/longhorn.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/longhorn destination: @@ -33,7 +33,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/longhorn destination: diff --git a/infra/argocd/templates/metallb-system.yaml b/infra/argocd/templates/metallb-system.yaml index bac4be3..a9b33d0 100644 --- a/infra/argocd/templates/metallb-system.yaml +++ b/infra/argocd/templates/metallb-system.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/metallb-system destination: @@ -29,7 +29,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/metallb-system destination: @@ -52,7 +52,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dev/metallb-system destination: diff --git a/infra/argocd/templates/nebula-sync.yaml b/infra/argocd/templates/nebula-sync.yaml index dea50a7..d19b024 100644 --- a/infra/argocd/templates/nebula-sync.yaml +++ b/infra/argocd/templates/nebula-sync.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/nebula-sync destination: diff --git a/infra/argocd/templates/nfs.yaml b/infra/argocd/templates/nfs.yaml index f7e964f..c006f32 100644 --- a/infra/argocd/templates/nfs.yaml +++ b/infra/argocd/templates/nfs.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/nfs destination: diff --git a/infra/argocd/templates/openclarity.yaml b/infra/argocd/templates/openclarity.yaml index 64307d6..57c1995 100644 --- a/infra/argocd/templates/openclarity.yaml +++ b/infra/argocd/templates/openclarity.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/openclarity destination: diff --git a/infra/argocd/templates/openspeedtest.yaml b/infra/argocd/templates/openspeedtest.yaml index 5d79f9c..ead0679 100644 --- a/infra/argocd/templates/openspeedtest.yaml +++ b/infra/argocd/templates/openspeedtest.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/openspeedtest directory: diff --git a/infra/argocd/templates/portainer.yaml b/infra/argocd/templates/portainer.yaml index d8b5d32..22b2a9b 100644 --- a/infra/argocd/templates/portainer.yaml +++ b/infra/argocd/templates/portainer.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/portainer destination: diff --git a/infra/argocd/templates/redlib.yaml b/infra/argocd/templates/redlib.yaml index 901c316..3867fb7 100644 --- a/infra/argocd/templates/redlib.yaml +++ b/infra/argocd/templates/redlib.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/redlib directory: diff --git a/infra/argocd/templates/searxng.yaml b/infra/argocd/templates/searxng.yaml index 174c060..9e05411 100644 --- a/infra/argocd/templates/searxng.yaml +++ b/infra/argocd/templates/searxng.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/searxng directory: diff --git a/infra/argocd/templates/traefik.yaml b/infra/argocd/templates/traefik.yaml index 0136c94..0ea06aa 100644 --- a/infra/argocd/templates/traefik.yaml +++ b/infra/argocd/templates/traefik.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/traefik destination: @@ -32,7 +32,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/traefik destination: @@ -58,7 +58,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dev/traefik destination: diff --git a/infra/argocd/templates/vault.yaml b/infra/argocd/templates/vault.yaml index 351d06f..b5f6a0b 100644 --- a/infra/argocd/templates/vault.yaml +++ b/infra/argocd/templates/vault.yaml @@ -6,7 +6,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: infra/vault destination: @@ -34,7 +34,7 @@ metadata: spec: project: default source: - repoURL: https://gitlab.com/developerdurp/homelab.git + repoURL: https://gitlab.durp.info/durfy/homelab/gitops.git targetRevision: main path: dmz/vault destination: From 268e8b7af53cb1288797e069369a6aaf3e8a664f Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Fri, 6 Feb 2026 07:01:19 +0000 Subject: [PATCH 1014/1058] Update docker.io/aquasec/trivy Docker tag to v0.69.1 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index 099b435..e77ca5a 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -542,7 +542,7 @@ openclarity: # -- Trivy Server container repository repository: aquasec/trivy # -- Trivy Server container tag - tag: 0.64.1 + tag: 0.69.1 # -- Trivy Server image digest. If set will override the tag. digest: "" # -- Trivy Server image pull policy From 0af5e1f9c17b8c212aae95e6c21dfda3de3dc0fc Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Feb 2026 05:37:36 -0600 Subject: [PATCH 1015/1058] update --- dmz/gitlab-runner/values.yaml | 46 +++++++++++++++++------------------ 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml index cbf56dc..3e7ddb6 100644 --- a/dmz/gitlab-runner/values.yaml +++ b/dmz/gitlab-runner/values.yaml @@ -18,15 +18,15 @@ gitlab-runner: podSecurityPolicy: enabled: false resourceNames: - - gitlab-runner + - gitlab-runner metrics: enabled: true serviceMonitor: - enabled: true + enabled: true service: enabled: true - annotations: {} + annotations: {} runners: config: | @@ -41,15 +41,15 @@ gitlab-runner: runUntagged: true privileged: true secret: gitlab-secret - #builds: + #builds: #cpuLimit: 200m #cpuLimitOverwriteMaxAllowed: 400m #memoryLimit: 256Mi #memoryLimitOverwriteMaxAllowed: 512Mi #cpuRequests: 100m #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi + #memoryRequests: 128Mi + #memoryRequestsOverwriteMaxAllowed: 256Mi securityContext: allowPrivilegeEscalation: false @@ -63,12 +63,12 @@ gitlab-runner: runAsUser: 100 fsGroup: 65533 - resources: + resources: limits: memory: 2Gi requests: memory: 128Mi - cpu: 500m + cpu: 50m personal: @@ -77,7 +77,7 @@ personal: image: gitlab-org/gitlab-runner imagePullPolicy: Always - gitlabUrl: https://gitlab.com/ + gitlabUrl: https://gitlab.durp.info/ unregisterRunner: false terminationGracePeriodSeconds: 3600 concurrent: 10 @@ -90,15 +90,15 @@ personal: podSecurityPolicy: enabled: false resourceNames: - - gitlab-runner + - gitlab-runner metrics: enabled: true serviceMonitor: - enabled: true + enabled: true service: enabled: true - annotations: {} + annotations: {} runners: config: | @@ -113,15 +113,15 @@ personal: runUntagged: true privileged: true secret: gitlab-secret-personal - #builds: - #cpuLimit: 200m - #cpuLimitOverwriteMaxAllowed: 400m - #memoryLimit: 256Mi - #memoryLimitOverwriteMaxAllowed: 512Mi - #cpuRequests: 100m - #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi + builds: + cpuLimit: 200m + cpuLimitOverwriteMaxAllowed: 400m + memoryLimit: 256Mi + memoryLimitOverwriteMaxAllowed: 512Mi + cpuRequests: 100m + cpuRequestsOverwriteMaxAllowed: 200m + memoryRequests: 128Mi + memoryRequestsOverwriteMaxAllowed: 256Mi securityContext: allowPrivilegeEscalation: false @@ -135,9 +135,9 @@ personal: runAsUser: 100 fsGroup: 65533 - resources: + resources: limits: memory: 2Gi requests: memory: 128Mi - cpu: 500m + cpu: 50m From 0e20657811fa124d4f69d0f0943d2b0374be5521 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 14 Feb 2026 04:57:57 -0600 Subject: [PATCH 1016/1058] update --- dmz/internalproxy/templates/nexus.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nexus.yaml b/dmz/internalproxy/templates/nexus.yaml index 683fe8d..ed609d9 100644 --- a/dmz/internalproxy/templates/nexus.yaml +++ b/dmz/internalproxy/templates/nexus.yaml @@ -19,7 +19,7 @@ metadata: name: nexus subsets: - addresses: - - ip: 192.168.20.200 + - ip: 192.168.21.200 ports: - name: app port: 8081 From f7029a6329e3faf93cbd492e5f585da859280894 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 16 Feb 2026 04:46:14 -0600 Subject: [PATCH 1017/1058] add matrix server --- .gitignore | 4 ++- dmz/main.tf | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++ dmz/matrix.tf | 57 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 128 insertions(+), 1 deletion(-) create mode 100644 dmz/main.tf create mode 100644 dmz/matrix.tf diff --git a/.gitignore b/.gitignore index 723ef36..d32217b 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,3 @@ -.idea \ No newline at end of file +*/.terraform +*/.terraform.lock.hcl +.idea diff --git a/dmz/main.tf b/dmz/main.tf new file mode 100644 index 0000000..eb23c67 --- /dev/null +++ b/dmz/main.tf @@ -0,0 +1,68 @@ +terraform { + backend "http" {} + required_providers { + proxmox = { + source = "Telmate/proxmox" + version = "3.0.1-rc9" + } + } +} + +provider "proxmox" { + pm_parallel = 1 + pm_tls_insecure = true + pm_api_url = var.pm_api_url + pm_user = var.pm_user + pm_password = var.pm_password + pm_debug = false +} + +locals { + sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" + template = "Debian12-Template" + storage = "cache-domains" + emulatessd = true + format = "raw" + dnsserver = "192.168.98.1" + vlan = 98 + k3smaster = { + tags = "k3s_dmz" + count = 3 + name = ["master01-dmz", "master02-dmz", "master03-dmz"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership", "overlord", "vanguard"] + ip = ["11", "12", "13"] + } + k3sserver = { + tags = "k3s_dmz" + count = 3 + name = ["node01-dmz", "node02-dmz", "node03-dmz"] + cores = 4 + memory = "8192" + drive = 240 + node = ["mothership", "overlord", "vanguard"] + ip = ["21", "22", "23"] + } + openVPN = { + tags = "openVPN" + count = 1 + name = ["openVPN"] + cores = 2 + memory = "4096" + drive = 20 + node = ["mothership"] + ip = ["20"] + } + matrix = { + tags = "matrix" + count = 1 + name = ["matrix"] + cores = 2 + memory = "4096" + drive = 60 + node = ["vanguard"] + ip = ["21"] + } +} diff --git a/dmz/matrix.tf b/dmz/matrix.tf new file mode 100644 index 0000000..66dd4c7 --- /dev/null +++ b/dmz/matrix.tf @@ -0,0 +1,57 @@ +resource "proxmox_vm_qemu" "matrix" { + count = local.matrix.count + ciuser = "administrator" + vmid = "${local.vlan}${local.matrix.ip[count.index]}" + name = local.matrix.name[count.index] + target_node = local.matrix.node[count.index] + clone = local.template + tags = local.matrix.tags + qemu_os = "l26" + full_clone = true + os_type = "cloud-init" + agent = 1 + cores = local.matrix.cores + sockets = 1 + cpu_type = "host" + memory = local.matrix.memory + scsihw = "virtio-scsi-pci" + #bootdisk = "scsi0" + boot = "order=virtio0" + onboot = true + sshkeys = local.sshkeys + vga { + type = "serial0" + } + serial { + id = 0 + type = "socket" + } + disks { + ide { + ide2 { + cloudinit { + storage = local.storage + } + } + } + virtio { + virtio0 { + disk { + size = local.matrix.drive + format = local.format + storage = local.storage + } + } + } + } + network { + id = 0 + model = "virtio" + bridge = "vmbr0" + tag = local.vlan + } + #Cloud Init Settings + ipconfig0 = "ip=192.168.${local.vlan}.${local.matrix.ip[count.index]}/24,gw=192.168.${local.vlan}.1" + searchdomain = "durp.loc" + nameserver = local.dnsserver +} From b328e106dfbfdba499b93a479bcd03b088423b23 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 16 Feb 2026 04:51:57 -0600 Subject: [PATCH 1018/1058] update --- dmz/main.tf | 68 --------------------------------------------------- dmz/matrix.tf | 57 ------------------------------------------ 2 files changed, 125 deletions(-) delete mode 100644 dmz/main.tf delete mode 100644 dmz/matrix.tf diff --git a/dmz/main.tf b/dmz/main.tf deleted file mode 100644 index eb23c67..0000000 --- a/dmz/main.tf +++ /dev/null @@ -1,68 +0,0 @@ -terraform { - backend "http" {} - required_providers { - proxmox = { - source = "Telmate/proxmox" - version = "3.0.1-rc9" - } - } -} - -provider "proxmox" { - pm_parallel = 1 - pm_tls_insecure = true - pm_api_url = var.pm_api_url - pm_user = var.pm_user - pm_password = var.pm_password - pm_debug = false -} - -locals { - sshkeys = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEphzWgwUZnvL6E5luKLt3WO0HK7Kh63arSMoNl5gmjzXyhG1DDW0OKfoIl0T+JZw/ZjQ7iii6tmSLFRk6nuYCldqe5GVcFxvTzX4/xGEioAyG0IiUGKy6s+9xzO8QXF0EtSNPH0nfHNKcCjgwWAzM+Lt6gW0Vqs+aU5ICuDiEchmvYPz+rBaVldJVTG7m3ogKJ2aIF7HU/pCPp5l0E9gMOw7s0ABijuc3KXLEWCYgL39jIST6pFH9ceRLmu8Xy5zXHAkkEEauY/e6ld0hlzLadiUD7zYJMdDcm0oRvenYcUlaUl9gS0569IpfsJsjCejuqOxCKzTHPJDOT0f9TbIqPXkGq3s9oEJGpQW+Z8g41BqRpjBCdBk+yv39bzKxlwlumDwqgx1WP8xxKavAWYNqNRG7sBhoWwtxYEOhKXoLNjBaeDRnO5OY5AQJvONWpuByyz0R/gTh4bOFVD+Y8WWlKbT4zfhnN70XvapRsbZiaGhJBPwByAMGg6XxSbC6xtbyligVGCEjCXbTLkeKq1w0DuItY+FBGO3J2k90OiciTVSeyiVz9J/Y03UB0gHdsMCoVNrj+9QWfrTLDhM7D5YrXUt5nj2LQTcbtf49zoQXWxUhozlg42E/FJU/Yla7y55qWizAEVyP2/Ks/PHrF679k59HNd2IJ/aicA9QnmWtLQ== ansible" - template = "Debian12-Template" - storage = "cache-domains" - emulatessd = true - format = "raw" - dnsserver = "192.168.98.1" - vlan = 98 - k3smaster = { - tags = "k3s_dmz" - count = 3 - name = ["master01-dmz", "master02-dmz", "master03-dmz"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership", "overlord", "vanguard"] - ip = ["11", "12", "13"] - } - k3sserver = { - tags = "k3s_dmz" - count = 3 - name = ["node01-dmz", "node02-dmz", "node03-dmz"] - cores = 4 - memory = "8192" - drive = 240 - node = ["mothership", "overlord", "vanguard"] - ip = ["21", "22", "23"] - } - openVPN = { - tags = "openVPN" - count = 1 - name = ["openVPN"] - cores = 2 - memory = "4096" - drive = 20 - node = ["mothership"] - ip = ["20"] - } - matrix = { - tags = "matrix" - count = 1 - name = ["matrix"] - cores = 2 - memory = "4096" - drive = 60 - node = ["vanguard"] - ip = ["21"] - } -} diff --git a/dmz/matrix.tf b/dmz/matrix.tf deleted file mode 100644 index 66dd4c7..0000000 --- a/dmz/matrix.tf +++ /dev/null @@ -1,57 +0,0 @@ -resource "proxmox_vm_qemu" "matrix" { - count = local.matrix.count - ciuser = "administrator" - vmid = "${local.vlan}${local.matrix.ip[count.index]}" - name = local.matrix.name[count.index] - target_node = local.matrix.node[count.index] - clone = local.template - tags = local.matrix.tags - qemu_os = "l26" - full_clone = true - os_type = "cloud-init" - agent = 1 - cores = local.matrix.cores - sockets = 1 - cpu_type = "host" - memory = local.matrix.memory - scsihw = "virtio-scsi-pci" - #bootdisk = "scsi0" - boot = "order=virtio0" - onboot = true - sshkeys = local.sshkeys - vga { - type = "serial0" - } - serial { - id = 0 - type = "socket" - } - disks { - ide { - ide2 { - cloudinit { - storage = local.storage - } - } - } - virtio { - virtio0 { - disk { - size = local.matrix.drive - format = local.format - storage = local.storage - } - } - } - } - network { - id = 0 - model = "virtio" - bridge = "vmbr0" - tag = local.vlan - } - #Cloud Init Settings - ipconfig0 = "ip=192.168.${local.vlan}.${local.matrix.ip[count.index]}/24,gw=192.168.${local.vlan}.1" - searchdomain = "durp.loc" - nameserver = local.dnsserver -} From 53acab0ecea66c61fe3435be741a82f049f08fc9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:09:02 -0600 Subject: [PATCH 1019/1058] add nextcloud --- dmz/internalproxy/templates/nextcloud.yaml | 68 ++++++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 dmz/internalproxy/templates/nextcloud.yaml diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml new file mode 100644 index 0000000..4a645a2 --- /dev/null +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -0,0 +1,68 @@ +apiVersion: v1 +kind: Service +metadata: + name: nextcloud +spec: + ports: + - name: app + port: 7282 + protocol: TCP + targetPort: 7282 + clusterIP: None + type: ClusterIP + +--- +apiVersion: v1 +kind: Endpoints +metadata: + name: nextcloud +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 7282 + protocol: TCP + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: nextcloud-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: nextcloud + port: 7282 + scheme: http + tls: + secretName: nextcloud-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: nextcloud-tls +spec: + secretName: nextcloud-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "nextcloud.durp.info" + dnsNames: + - "nextcloud.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: nextcloud-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: nextcloud.durp.info +spec: + type: ExternalName + externalName: durp.info From 975dbd1c6d1377ebb0194bef16f72b61419654c6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:11:48 -0600 Subject: [PATCH 1020/1058] update --- dmz/internalproxy/templates/nextcloud.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 4a645a2..4bd7e96 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -38,7 +38,7 @@ spec: services: - name: nextcloud port: 7282 - scheme: http + scheme: https tls: secretName: nextcloud-tls From ed66676f2e0c03a7cc561100924a1eba32ecb3fe Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:18:52 -0600 Subject: [PATCH 1021/1058] update --- dmz/internalproxy/templates/nextcloud.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 4bd7e96..faf27a9 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -35,6 +35,8 @@ spec: routes: - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) kind: Rule + middlewares: + - nextcloud-secure-headers services: - name: nextcloud port: 7282 @@ -66,3 +68,11 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- +middlewares: + nextcloud-secure-headers: + headers: + hostsProxyHeaders: + - "X-Forwarded-Host" + referrerPolicy: "same-origin" \ No newline at end of file From f75d5d5be47e4f6d5934ea55733970549d577ea9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:21:02 -0600 Subject: [PATCH 1022/1058] update --- dmz/internalproxy/templates/nextcloud.yaml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index faf27a9..82c8e6d 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -70,9 +70,12 @@ spec: externalName: durp.info --- -middlewares: - nextcloud-secure-headers: - headers: - hostsProxyHeaders: - - "X-Forwarded-Host" - referrerPolicy: "same-origin" \ No newline at end of file +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-secure-headers +spec: + headers: + hostsProxyHeaders: + - "X-Forwarded-Host" + referrerPolicy: "same-origin" From 9d5ffd8a8a29197dec489737885f2c97aacd3038 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:22:18 -0600 Subject: [PATCH 1023/1058] update --- dmz/internalproxy/templates/nextcloud.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 82c8e6d..2050c2d 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -36,7 +36,7 @@ spec: - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - nextcloud-secure-headers + - name: nextcloud-secure-headers services: - name: nextcloud port: 7282 From 749974197e65a8f6a96f3c0abb666020c954faf6 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:25:44 -0600 Subject: [PATCH 1024/1058] update --- dmz/internalproxy/templates/nextcloud.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 2050c2d..c4fd4a3 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -5,9 +5,9 @@ metadata: spec: ports: - name: app - port: 7282 + port: 11000 protocol: TCP - targetPort: 7282 + targetPort: 11000 clusterIP: None type: ClusterIP @@ -21,7 +21,7 @@ subsets: - ip: 192.168.21.200 ports: - name: app - port: 7282 + port: 11000 protocol: TCP --- @@ -39,7 +39,7 @@ spec: - name: nextcloud-secure-headers services: - name: nextcloud - port: 7282 + port: 11000 scheme: https tls: secretName: nextcloud-tls From d6d965595cba1975ccec90bfa3d03221de521da9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 18 Feb 2026 06:30:33 -0600 Subject: [PATCH 1025/1058] update --- dmz/internalproxy/templates/nextcloud.yaml | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index c4fd4a3..4b80c8e 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -36,7 +36,7 @@ spec: - match: Host(`nextcloud.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - name: nextcloud-secure-headers + - name: nextcloud-chain services: - name: nextcloud port: 11000 @@ -79,3 +79,23 @@ spec: hostsProxyHeaders: - "X-Forwarded-Host" referrerPolicy: "same-origin" + +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: https-redirect +spec: + redirectScheme: + scheme: https + +--- +apiVersion: traefik.io/v1alpha1 +kind: Middleware +metadata: + name: nextcloud-chain +spec: + chain: + middlewares: + - name: https-redirect + - name: nextcloud-secure-headers \ No newline at end of file From 68d068300a2e83488bd91e0bbf06aa6a012e8479 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Thu, 19 Feb 2026 05:08:15 -0600 Subject: [PATCH 1026/1058] update --- dmz/internalproxy/templates/nextcloud.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index 4b80c8e..e3ea9dd 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -40,7 +40,7 @@ spec: services: - name: nextcloud port: 11000 - scheme: https + scheme: http tls: secretName: nextcloud-tls From 746e7f4d86f8df8986b506d9e925b42f001f8875 Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Sun, 1 Mar 2026 07:02:06 +0000 Subject: [PATCH 1027/1058] Update Helm release argo-cd to v8.6.4 --- infra/argocd/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/argocd/Chart.yaml b/infra/argocd/Chart.yaml index 8da230c..d9a5074 100644 --- a/infra/argocd/Chart.yaml +++ b/infra/argocd/Chart.yaml @@ -9,4 +9,4 @@ appVersion: "1.16.0" dependencies: - name: argo-cd repository: https://argoproj.github.io/argo-helm - version: 8.1.3 + version: 8.6.4 From 33efd5915fd19d8b8e4fbf4b1f955473bc8f444d Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 6 Mar 2026 05:42:12 -0600 Subject: [PATCH 1028/1058] remove public gitlab runner --- dmz/gitlab-runner/Chart.yaml | 3 -- dmz/gitlab-runner/values.yaml | 72 ----------------------------------- 2 files changed, 75 deletions(-) diff --git a/dmz/gitlab-runner/Chart.yaml b/dmz/gitlab-runner/Chart.yaml index 542b033..17e8efe 100644 --- a/dmz/gitlab-runner/Chart.yaml +++ b/dmz/gitlab-runner/Chart.yaml @@ -6,9 +6,6 @@ version: 0.0.1 appVersion: 0.0.1 dependencies: -- name: gitlab-runner - repository: https://charts.gitlab.io/ - version: 0.77.2 - name: gitlab-runner repository: https://charts.gitlab.io/ version: 0.77.2 diff --git a/dmz/gitlab-runner/values.yaml b/dmz/gitlab-runner/values.yaml index 3e7ddb6..7ba1021 100644 --- a/dmz/gitlab-runner/values.yaml +++ b/dmz/gitlab-runner/values.yaml @@ -1,75 +1,3 @@ -gitlab-runner: - - image: - registry: registry.durp.info - image: gitlab-org/gitlab-runner - - imagePullPolicy: Always - gitlabUrl: https://gitlab.com/ - unregisterRunner: false - terminationGracePeriodSeconds: 3600 - concurrent: 10 - checkInterval: 30 - - rbac: - create: true - rules: [] - clusterWideAccess: false - podSecurityPolicy: - enabled: false - resourceNames: - - gitlab-runner - - metrics: - enabled: true - serviceMonitor: - enabled: true - service: - enabled: true - annotations: {} - - runners: - config: | - [[runners]] - [runners.kubernetes] - namespace = "{{.Release.Namespace}}" - image = "ubuntu:22.04" - privileged = true - - executor: kubernetes - name: "k3s" - runUntagged: true - privileged: true - secret: gitlab-secret - #builds: - #cpuLimit: 200m - #cpuLimitOverwriteMaxAllowed: 400m - #memoryLimit: 256Mi - #memoryLimitOverwriteMaxAllowed: 512Mi - #cpuRequests: 100m - #cpuRequestsOverwriteMaxAllowed: 200m - #memoryRequests: 128Mi - #memoryRequestsOverwriteMaxAllowed: 256Mi - - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - privileged: false - capabilities: - drop: ["ALL"] - - podSecurityContext: - runAsUser: 100 - fsGroup: 65533 - - resources: - limits: - memory: 2Gi - requests: - memory: 128Mi - cpu: 50m - personal: image: From 4cb432f2ce4b80385f5f1f4d528dfcf46aa7b12f Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Sat, 7 Mar 2026 07:02:04 +0000 Subject: [PATCH 1029/1058] Update docker.io/aquasec/trivy Docker tag to v0.69.3 --- infra/openclarity/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/openclarity/values.yaml b/infra/openclarity/values.yaml index e77ca5a..c8f1629 100644 --- a/infra/openclarity/values.yaml +++ b/infra/openclarity/values.yaml @@ -542,7 +542,7 @@ openclarity: # -- Trivy Server container repository repository: aquasec/trivy # -- Trivy Server container tag - tag: 0.69.1 + tag: 0.69.3 # -- Trivy Server image digest. If set will override the tag. digest: "" # -- Trivy Server image pull policy From fe23c8a706ffd93334711f76ada59c958d828fb9 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 7 Mar 2026 06:34:28 -0600 Subject: [PATCH 1030/1058] remove public gitlab renovate bot --- infra/renovate/Chart.yaml | 3 - infra/renovate/values.yaml | 330 ------------------------------------- 2 files changed, 333 deletions(-) diff --git a/infra/renovate/Chart.yaml b/infra/renovate/Chart.yaml index 05ed75f..b20d1e8 100644 --- a/infra/renovate/Chart.yaml +++ b/infra/renovate/Chart.yaml @@ -7,9 +7,6 @@ version: 0.1.0 appVersion: "1.16.0" dependencies: - - name: renovate - repository: https://docs.renovatebot.com/helm-charts - version: 39.264.0 - name: renovate repository: https://docs.renovatebot.com/helm-charts version: 39.264.0 diff --git a/infra/renovate/values.yaml b/infra/renovate/values.yaml index adec42f..4754bc7 100644 --- a/infra/renovate/values.yaml +++ b/infra/renovate/values.yaml @@ -1,333 +1,3 @@ -renovate: - global: - # -- Additional labels to be set on all renovate resources - commonLabels: {} - compatibility: - openshift: - # -- Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: `auto` (apply if the detected running cluster is Openshift), `force` (perform the adaptation always), `disabled` (do not perform adaptation) - adaptSecurityContext: "auto" - - # -- Override the name of the chart - nameOverride: "" - # -- Override the fully qualified app name - fullnameOverride: "" - # -- Annotations to add to secret - secretAnnotations: {} - - cronjob: - # -- Schedules the job to run using cron notation - schedule: "0 1 * * *" # At 01:00 every day - # -- You can specify a time zone for a CronJob by setting timeZone to the name of a valid time zone. (starting with k8s 1.27) - timeZone: "" # see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for valid names - # -- If it is set to true, all subsequent executions are suspended. This setting does not apply to already started executions. - suspend: false - # -- Annotations to set on the cronjob - annotations: {} - # -- Labels to set on the cronjob - labels: {} - # -- "Allow" to allow concurrent runs, "Forbid" to skip new runs if a previous run is still running or "Replace" to replace the previous run - concurrencyPolicy: "" - # -- "Number of successful completions is reached to mark the job as complete" - completions: "" - # -- "Where the jobs should be NonIndexed or Indexed" - completionMode: "" - # -- Amount of failed jobs to keep in history - failedJobsHistoryLimit: "" - # -- Amount of completed jobs to keep in history - successfulJobsHistoryLimit: "" - # -- Set to Never to restart the job when the pod fails or to OnFailure to restart when a container fails - jobRestartPolicy: Never - # -- Time to keep the job after it finished before automatically deleting it - ttlSecondsAfterFinished: "" - # -- Deadline for the job to finish - activeDeadlineSeconds: "" - # -- Number of times to retry running the pod before considering the job as being failed - jobBackoffLimit: "" - # -- Maximal number of failures per index - backoffLimitPerIndex: "" - # -- Maximal number of failed indexes before terminating the Job execution - maxFailedIndexes: "" - # -- Deadline to start the job, skips execution if job misses it's configured deadline - startingDeadlineSeconds: "" - # -- Additional initContainers that can be executed before renovate - initContainers: [] - # initContainers: - # - name: INIT_CONTAINER_NAME - # image: INIT_CONTAINER_IMAGE - # -- Number of pods to run in parallel - parallelism: "" - # -- Custom command to run in the container - commandOverride: [] - # -- Custom arguments to run in the container - argsOverride: [] - # -- Prepend shell commands before renovate runs - #preCommand: '' - #preCommand: | - # ls /config - # cat /config/renovate.json - - postCommand: "" - # postCommand: | - # echo hello - # echo world - - pod: - # -- Annotations to set on the pod - annotations: {} - # -- Labels to set on the pod - labels: {} - - image: - # -- Registry to pull image from - registry: registry.durp.info - # -- Image name to pull - repository: renovatebot/renovate - # -- Renovate image tag to pull - #tag: 39.264.0 - # -- "IfNotPresent" to pull the image if no image with the specified tag exists on the node, "Always" to always pull the image or "Never" to try and use pre-pulled images - pullPolicy: Always - # -- Set `true` to use the full image. See https://docs.renovatebot.com/getting-started/running/#the-full-image - useFull: false - - # -- Secret to use to pull the image from the repository - imagePullSecrets: {} - - renovate: - # -- Custom exiting global renovate config - #existingConfigFile: "/config/renovate.json" - # -- Inline global renovate config.json - config: | - { - "platform": "gitlab", - "endpoint": "https://gitlab.com/api/v4", - "autodiscover": "true", - "dryRun": false, - "printConfig": false, - "autodiscoverFilter": ["developerdurp/*", "durfy/*"], - "assignees": ["developerdurp"], - } - # See https://docs.renovatebot.com/self-hosted-configuration - # config: | - # { - # "": "gitlab", - # "endpoint": "https://gitlab.example.com/api/v4", - # "token": "your-gitlab-renovate-user-token", - # "autodiscover": "false", - # "dryRun": true, - # "printConfig": true, - # "repositories": ["username/repo", "orgname/repo"] - # } - - # -- Use the Helm tpl function on your configuration. See README for how to use this value - configEnableHelmTpl: false - - # -- Use this to create the renovate-config as a secret instead of a configmap - configIsSecret: true - - # -- Use this to create a config.js instead of a config.json - configIsJavaScript: false - - # -- Renovate Container-level security-context - securityContext: {} - - # Instead of a file system cache, it is highly recommended to use the redis subchart. - # Alternatively, SQLite is also a good choice. - # Take a look at https://github.com/renovatebot/renovate/discussions/30525 for more information. - # -- Options related to persistence - persistence: - cache: - # -- Allow the cache to persist between runs - enabled: false - # -- Storage class of the cache PVC - storageClass: "" - # -- Storage size of the cache PVC - storageSize: "512Mi" - # -- Existing volume, enables binding the pvc to an existing volume - volumeName: "" - # -- Labels to set on the cache PVC - labels: {} - - ssh_config: - # -- Whether to enable the use and creation of a secret containing .ssh files - enabled: false - - # Provide .ssh config file contents - # -- Contents of the id_rsa file - id_rsa: "" - # -- Contents of the id_rsa_pub file - id_rsa_pub: "" - # -- Contents of the config file - config: "" - - # or provide the name of an existing secret to be read instead. - # -- Name of the existing secret containing a valid .ssh configuration - existingSecret: "" - - # -- Environment variables that should be referenced from a k8s secret, cannot be used when existingSecret is set - secrets: {} - # -- k8s secret to reference environment variables from. Overrides secrets if set - existingSecret: "renovate-config-secret" - - # -- Additional configmaps. A generated configMap name is: "renovate.fullname" + "extra" + name(below) e.g. renovate-netrc-config - extraConfigmaps: [] - # extraConfigmaps: - # - name: netrc-config - # data: - # .netrc: |- - # machine gitlab.example.com - # login gitlab-ci-token - # password some-pass - # - name: yet-another-config - # data: - # ya-config.yaml: |- - # "key"="value" - # "key1"="value1" - - #extraVolumes: - # - name: renovate-config-secret - # secretName: - # name: renovate-config-secret - # items: - # - key: renovate.json - # path: renovate.json - - #extraVolumeMounts: - # - name: renovate-config-secret - # mountPath: /config - # subPath: renovate.json - - # -- Additional containers to the pod - extraContainers: [] - # extraContainers: - # - name: vault-agent - # image: vault:1.6.2 - # args: - # - agent - # - -config - # - /vault/config/config.hcl - # env: - # - name: VAULT_ADDR - # value: https://vault:8200 - # - name: VAULT_SKIP_VERIFY - # value: "false" - # - name: VAULT_CACERT - # value: /vault/tls/ca.crt - - serviceAccount: - # -- Specifies whether a service account should be created - create: false - # -- Annotations to add to the service account - annotations: {} - # -- The name of the service account to use - # If not set and create is true, a name is generated using the fullname template - name: "" - - # -- Specify resource limits and requests for the renovate container - resources: - {} - # We usually recommend not to specify default resources and to leave this as a conscious - # choice for the user. This also increases chances charts run on environments with little - # resources, such as Minikube. If you do want to specify resources, uncomment the following - # lines, adjust them as necessary, and remove the curly braces after 'resources:'. - # limits: - # cpu: 100m - # memory: 128Mi - # requests: - # cpu: 100m - # memory: 128Mi - - # -- Environment variables to add from existing secrets/configmaps. Uses the keys as variable name - envFrom: [] - # envFrom: - # - secretRef: - # name: env-secrets - # - configMapRef: - # name: env-configmap - - # -- Environment variables to set on the renovate container - env: - RENOVATE_AUTODISCOVER: true - # env: - # VARIABLE_NAME: "value" - - # -- Additional env. Helpful too if you want to use anything other than a `value` source. - envList: [] - # envList: - # - name: POD_NAME - # valueFrom: - # fieldRef: - # fieldPath: metadata.name - - redis: - # Configuration for a Redis subchart. Additional documentation at - # https://github.com/bitnami/charts/tree/master/bitnami/redis - - # -- Enable the Redis subchart? - enabled: false - - # -- Override the prefix of the redisHost - nameOverride: "" - - # -- Disable replication by default - architecture: standalone - - auth: - # -- Don't require a password by default - enabled: false - - # -- Override Kubernetes version for redis chart - kubeVersion: "" - - # -- Override hostname resolution - hostAliases: [] - # See: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/ - # hostAliases: - # - ip: "your-ip" - # hostnames: - # - "your-hostname" - - # -- Pod-level security-context - securityContext: {} - - # -- Select the node using labels to specify where the cronjob pod should run on - nodeSelector: {} - # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - # renovate: true - - # -- Configure the pod(Anti)Affinity and/or node(Anti)Affinity - affinity: {} - # See: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ - - # -- Configure which node taints the pod should tolerate - tolerations: [] - # See: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ - - # -- Create extra manifests via values. Would be passed through `tpl` for templating - extraObjects: [] - # extraObjects: - # - apiVersion: external-secrets.io/v1 - # kind: ExternalSecret - # metadata: - # name: '{{ include "renovate.fullname" . }}-token' - # spec: - # secretStoreRef: - # name: default - # data: - # - secretKey: token - # remoteRef: - # key: github-token - # - | - # apiVersion: v1 - # kind: ConfigMap - # metadata: - # name: {{ include "renovate.fullname" . }}-config - # data: - # config.json: | - # { - # "platform": "github", - # "repositories": ["username/repo", "orgname/repo"] - # } - renovate-personal: global: # -- Additional labels to be set on all renovate resources From a1bf4cfff8b7fb0123c496c656e86ba7c6caea6f Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 7 Mar 2026 07:19:43 -0600 Subject: [PATCH 1031/1058] update vaultwarden --- infra/bitwarden/templates/deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/bitwarden/templates/deployment.yaml b/infra/bitwarden/templates/deployment.yaml index 470ac9b..b915246 100644 --- a/infra/bitwarden/templates/deployment.yaml +++ b/infra/bitwarden/templates/deployment.yaml @@ -17,7 +17,7 @@ spec: spec: containers: - name: bitwarden - image: registry.durp.info/vaultwarden/server:1.34.3 + image: registry.durp.info/vaultwarden/server:1.35.4 imagePullPolicy: Always volumeMounts: - name: bitwarden-pvc From 059d35af3e8f6ac3c331cdea8112cdaf87727719 Mon Sep 17 00:00:00 2001 From: RenovateBot Date: Sun, 8 Mar 2026 07:02:03 +0000 Subject: [PATCH 1032/1058] Update Helm release base to v1.29.0 --- dmz/istio-system/Chart.yaml | 2 +- infra/istio-system/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/istio-system/Chart.yaml b/dmz/istio-system/Chart.yaml index 50401b5..dfc92b1 100644 --- a/dmz/istio-system/Chart.yaml +++ b/dmz/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.2 + version: 1.29.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.2 diff --git a/infra/istio-system/Chart.yaml b/infra/istio-system/Chart.yaml index 0a7ea4b..7bb5fc3 100644 --- a/infra/istio-system/Chart.yaml +++ b/infra/istio-system/Chart.yaml @@ -8,7 +8,7 @@ appVersion: 0.0.1 dependencies: - name: base repository: https://istio-release.storage.googleapis.com/charts - version: 1.26.2 + version: 1.29.0 - name: istiod repository: https://istio-release.storage.googleapis.com/charts version: 1.26.2 From 5974e6450c09e03bc8399b8fe4abada1608a482c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 8 Mar 2026 08:11:47 -0500 Subject: [PATCH 1033/1058] update gitea to forgejo --- .../templates/{gitea.yaml => forgejo.yaml} | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) rename dmz/internalproxy/templates/{gitea.yaml => forgejo.yaml} (68%) diff --git a/dmz/internalproxy/templates/gitea.yaml b/dmz/internalproxy/templates/forgejo.yaml similarity index 68% rename from dmz/internalproxy/templates/gitea.yaml rename to dmz/internalproxy/templates/forgejo.yaml index 58c28d7..4a6998a 100644 --- a/dmz/internalproxy/templates/gitea.yaml +++ b/dmz/internalproxy/templates/forgejo.yaml @@ -1,7 +1,7 @@ apiVersion: v1 kind: Service metadata: - name: gitea + name: forgejo spec: ports: - name: app @@ -16,7 +16,7 @@ spec: apiVersion: v1 kind: Endpoints metadata: - name: gitea + name: forgejo subsets: - addresses: - ip: 192.168.21.200 @@ -30,43 +30,43 @@ subsets: apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: - name: gitea-ingress + name: forgejo-ingress spec: entryPoints: - websecure routes: - - match: Host(`gitea.durp.info`) && PathPrefix(`/`) + - match: Host(`forgejo.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: gitea + - name: forgejo port: 3000 scheme: http tls: - secretName: gitea-tls + secretName: forgejo-tls --- apiVersion: cert-manager.io/v1 kind: Certificate metadata: - name: gitea-tls + name: forgejo-tls spec: - secretName: gitea-tls + secretName: forgejo-tls issuerRef: name: letsencrypt-production kind: ClusterIssuer - commonName: "gitea.durp.info" + commonName: "forgejo.durp.info" dnsNames: - - "gitea.durp.info" + - "forgejo.durp.info" --- kind: Service apiVersion: v1 metadata: - name: gitea-external-dns + name: forgejo-external-dns annotations: - external-dns.alpha.kubernetes.io/hostname: gitea.durp.info + external-dns.alpha.kubernetes.io/hostname: forgejo.durp.info spec: type: ExternalName externalName: durp.info From f1b27dc3666a60bce544f919dcb15962107c6f36 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 8 Mar 2026 10:03:59 -0500 Subject: [PATCH 1034/1058] update --- dmz/searxng/templates/ingress.yaml | 31 ++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/dmz/searxng/templates/ingress.yaml b/dmz/searxng/templates/ingress.yaml index da757e7..ab8b641 100644 --- a/dmz/searxng/templates/ingress.yaml +++ b/dmz/searxng/templates/ingress.yaml @@ -43,3 +43,34 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: searxng-internal-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`searxng.internal.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: searxng-service + port: 8080 + tls: + secretName: searxng-internal-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: searxng-internal-tls +spec: + secretName: searxng-internal-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "searxng.internal.durp.info" + dnsNames: + - "searxng.internal.durp.info" From 7f8883c2bcf71b6680967a0ee916287e459401f8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 8 Mar 2026 10:06:50 -0500 Subject: [PATCH 1035/1058] update --- dmz/searxng/templates/confligmap.yaml | 11 +++++++++++ dmz/searxng/templates/deployment.yaml | 18 +++++++++++++++++- dmz/searxng/templates/secret.yaml | 23 +++++++++++++++++++++++ 3 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 dmz/searxng/templates/confligmap.yaml create mode 100644 dmz/searxng/templates/secret.yaml diff --git a/dmz/searxng/templates/confligmap.yaml b/dmz/searxng/templates/confligmap.yaml new file mode 100644 index 0000000..edc1ca6 --- /dev/null +++ b/dmz/searxng/templates/confligmap.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: searxng-config +data: + settings.yml: |- + use_default_settings: true + search: + formats: + - html + - json diff --git a/dmz/searxng/templates/deployment.yaml b/dmz/searxng/templates/deployment.yaml index 3ab2d47..e1677ed 100644 --- a/dmz/searxng/templates/deployment.yaml +++ b/dmz/searxng/templates/deployment.yaml @@ -21,4 +21,20 @@ spec: imagePullPolicy: Always ports: - name: http - containerPort: 8080 \ No newline at end of file + containerPort: 8080 + env: + - name: SEARXNG_BASE_URL + value: https://searxng.durp.info + - name: SEARXNG_SECRET + valueFrom: + secretKeyRef: + name: searxng-secret + key: SEARXNG_SECRET + volumeMounts: + - name: searxng-config-volume + mountPath: /etc/searxng/settings.yml + subPath: settings.yml + volumes: + - name: searxng-config-volume + configMap: + name: searxng-config diff --git a/dmz/searxng/templates/secret.yaml b/dmz/searxng/templates/secret.yaml new file mode 100644 index 0000000..6d4781b --- /dev/null +++ b/dmz/searxng/templates/secret.yaml @@ -0,0 +1,23 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: searxng-secret +spec: + secretStoreRef: + name: vault + kind: ClusterSecretStore + target: + name: searxng-secret + data: + - secretKey: SEARXNG_SECRET + remoteRef: + key: kv/searxng + property: searxng-secret + +--- + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vault + From 2afdded1093fe8d13934f48798a3b08b3de4e9ae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 25 Mar 2026 05:48:28 -0500 Subject: [PATCH 1036/1058] add freshrss --- dmz/internalproxy/templates/freshrss.yaml | 61 +++++++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 dmz/internalproxy/templates/freshrss.yaml diff --git a/dmz/internalproxy/templates/freshrss.yaml b/dmz/internalproxy/templates/freshrss.yaml new file mode 100644 index 0000000..3ee965a --- /dev/null +++ b/dmz/internalproxy/templates/freshrss.yaml @@ -0,0 +1,61 @@ + +apiVersion: v1 +kind: Service +metadata: + name: freshrss +spec: + ports: + - name: app + port: 8085 + protocol: TCP + targetPort: 8085 + clusterIP: None + type: ClusterIP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: freshrss +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 8085 + protocol: TCP + +--- + +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: freshrss-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`freshrss.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: freshrss + port: 8085 + scheme: https + tls: + secretName: freshrss-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: freshrss-tls +spec: + secretName: freshrss-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "freshrss.durp.info" + dnsNames: + - "freshrss.durp.info" From 6cdffc48f3bee8cbd84a6deb7eb9cec76d593e7e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Wed, 25 Mar 2026 06:07:43 -0500 Subject: [PATCH 1037/1058] update --- dmz/internalproxy/templates/freshrss.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/dmz/internalproxy/templates/freshrss.yaml b/dmz/internalproxy/templates/freshrss.yaml index 3ee965a..3fe0ff4 100644 --- a/dmz/internalproxy/templates/freshrss.yaml +++ b/dmz/internalproxy/templates/freshrss.yaml @@ -41,7 +41,6 @@ spec: services: - name: freshrss port: 8085 - scheme: https tls: secretName: freshrss-tls From e6aafbcf81b797ec296946fa436cbda6254cf63a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Fri, 27 Mar 2026 06:04:54 -0500 Subject: [PATCH 1038/1058] update --- infra/portainer/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/portainer/values.yaml b/infra/portainer/values.yaml index a63ba2e..a3779f7 100644 --- a/infra/portainer/values.yaml +++ b/infra/portainer/values.yaml @@ -2,7 +2,7 @@ portainer: replicaCount: 1 image: repository: registry.durp.info/portainer/portainer-ce - tag: 2.33.5 + tag: 2.39.1 pullPolicy: Always imagePullSecrets: [] From 1c0c8bab822e326b5dd622261ea1cb33a88053f8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 07:57:02 -0500 Subject: [PATCH 1039/1058] update --- dmz/internalproxy/templates/longhorn.yaml | 34 ++++++ dmz/internalproxy/templates/n8n.yaml | 136 +++++++++++----------- infra/longhorn/templates/ingress.yaml | 4 +- 3 files changed, 104 insertions(+), 70 deletions(-) create mode 100644 dmz/internalproxy/templates/longhorn.yaml diff --git a/dmz/internalproxy/templates/longhorn.yaml b/dmz/internalproxy/templates/longhorn.yaml new file mode 100644 index 0000000..9eeda9e --- /dev/null +++ b/dmz/internalproxy/templates/longhorn.yaml @@ -0,0 +1,34 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: longhorn-infra-ingress + annotations: + cert-manager.io/cluster-issuer: vault-issuer +spec: + entryPoints: + - websecure + routes: + - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) + kind: Rule + middlewares: + - name: authentik-proxy-provider + namespace: traefik + services: + - name: infra-cluster + port: 443 + tls: + secretName: longhorn-infra-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: longhorn-infra-tls +spec: + secretName: longhorn-infra-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "longhorn.infra.durp.info" + dnsNames: + - "longhorn.infra.durp.info" diff --git a/dmz/internalproxy/templates/n8n.yaml b/dmz/internalproxy/templates/n8n.yaml index d70038b..adfebc7 100644 --- a/dmz/internalproxy/templates/n8n.yaml +++ b/dmz/internalproxy/templates/n8n.yaml @@ -1,68 +1,68 @@ -apiVersion: v1 -kind: Service -metadata: - name: n8n -spec: - ports: - - name: app - port: 5678 - protocol: TCP - targetPort: 5678 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: n8n -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 5678 - protocol: TCP - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: n8n-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`n8n.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: n8n - port: 5678 - scheme: http - tls: - secretName: n8n-tls - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: n8n-tls -spec: - secretName: n8n-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "n8n.durp.info" - dnsNames: - - "n8n.durp.info" - ---- -kind: Service -apiVersion: v1 -metadata: - name: n8n-dns - annotations: - dns.alpha.kubernetes.io/hostname: n8n.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: n8n +#spec: +# ports: +# - name: app +# port: 5678 +# protocol: TCP +# targetPort: 5678 +# clusterIP: None +# type: ClusterIP +# +#--- +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: n8n +#subsets: +# - addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 5678 +# protocol: TCP +# +#--- +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: n8n-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`n8n.durp.info`) && PathPrefix(`/`) +# kind: Rule +# services: +# - name: n8n +# port: 5678 +# scheme: http +# tls: +# secretName: n8n-tls +# +#--- +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: n8n-tls +#spec: +# secretName: n8n-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "n8n.durp.info" +# dnsNames: +# - "n8n.durp.info" +# +#--- +#kind: Service +#apiVersion: v1 +#metadata: +# name: n8n-dns +# annotations: +# dns.alpha.kubernetes.io/hostname: n8n.durp.info +#spec: +# type: ExternalName +# externalName: durp.info diff --git a/infra/longhorn/templates/ingress.yaml b/infra/longhorn/templates/ingress.yaml index e9a3a2b..ad4ebd3 100644 --- a/infra/longhorn/templates/ingress.yaml +++ b/infra/longhorn/templates/ingress.yaml @@ -11,8 +11,8 @@ spec: - match: Host(`longhorn.infra.durp.info`) && PathPrefix(`/`) kind: Rule middlewares: - - name: authentik-proxy-provider - namespace: traefik + #- name: authentik-proxy-provider + # namespace: traefik services: - name: longhorn-frontend port: 80 From 8343867aeed08cb2974b480090365050bc3990c7 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 07:59:24 -0500 Subject: [PATCH 1040/1058] update --- dmz/internalproxy/templates/argocd.yaml | 34 +++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 dmz/internalproxy/templates/argocd.yaml diff --git a/dmz/internalproxy/templates/argocd.yaml b/dmz/internalproxy/templates/argocd.yaml new file mode 100644 index 0000000..20aba48 --- /dev/null +++ b/dmz/internalproxy/templates/argocd.yaml @@ -0,0 +1,34 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: argocd-infra-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`argocd.infra.durp.info`) + #middlewares: + # - name: whitelist + # namespace: traefik + kind: Rule + services: + - name: infra-cluster + port: 443 + scheme: https + tls: + secretName: argocd-tls + +--- + +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: argocd-infra-tls +spec: + secretName: argocd-infra-tls + issuerRef: + name: vault-issuer + kind: ClusterIssuer + commonName: "argocd.infra.durp.info" + dnsNames: + - "argocd.infra.durp.info" From ea54a2601d59fd33321d27ef8c0b9d68a6d7e51b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 08:10:07 -0500 Subject: [PATCH 1041/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 26 ++++++++++++++++++ dmz/internalproxy/templates/tdarr.yaml | 31 +--------------------- dmz/internalproxy/templates/unraid.yaml | 30 --------------------- 3 files changed, 27 insertions(+), 60 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index c5d00c4..1f1aec6 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -43,3 +43,29 @@ spec: - protocol: TCP port: 443 targetPort: 443 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: unraid +spec: + ports: + - protocol: TCP + port: 443 + targetPort: 443 + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: unraid +subsets: + - addresses: + - ip: 192.168.21.200 + ports: + - name: app + port: 443 + protocol: TCP diff --git a/dmz/internalproxy/templates/tdarr.yaml b/dmz/internalproxy/templates/tdarr.yaml index c9ace7f..35b9485 100644 --- a/dmz/internalproxy/templates/tdarr.yaml +++ b/dmz/internalproxy/templates/tdarr.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: tdarr -spec: - ports: - - name: app - port: 8267 - protocol: TCP - targetPort: 8267 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: tdarr -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8267 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -45,7 +16,7 @@ spec: namespace: traefik kind: Rule services: - - name: tdarr + - name: unraid port: 8267 scheme: http tls: diff --git a/dmz/internalproxy/templates/unraid.yaml b/dmz/internalproxy/templates/unraid.yaml index f79f4a8..10e1015 100644 --- a/dmz/internalproxy/templates/unraid.yaml +++ b/dmz/internalproxy/templates/unraid.yaml @@ -1,33 +1,3 @@ - -apiVersion: v1 -kind: Service -metadata: - name: unraid -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: unraid -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 443 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: From ab36649642ab7751c3016a3ffbcf04ceb5c9a357 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 08:11:26 -0500 Subject: [PATCH 1042/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 1f1aec6..875ed0f 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -55,6 +55,10 @@ spec: - protocol: TCP port: 443 targetPort: 443 + - name: app + port: 8267 + protocol: TCP + targetPort: 8267 --- @@ -69,3 +73,6 @@ subsets: - name: app port: 443 protocol: TCP + - name: app + port: 8267 + protocol: TCP From 57ea463e1996b9844ba2a3c3ae9b0048d61e775e Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 08:12:43 -0500 Subject: [PATCH 1043/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 875ed0f..35f2d40 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -52,10 +52,11 @@ metadata: name: unraid spec: ports: - - protocol: TCP + - name: https + protocol: TCP port: 443 targetPort: 443 - - name: app + - name: tdarr port: 8267 protocol: TCP targetPort: 8267 @@ -70,9 +71,9 @@ subsets: - addresses: - ip: 192.168.21.200 ports: - - name: app + - name: https port: 443 protocol: TCP - - name: app + - name: tdarr port: 8267 protocol: TCP From c38262a51b480f4e3e9227e9ed0c216437fbfc85 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 11:37:45 -0500 Subject: [PATCH 1044/1058] update --- dmz/authentik/templates/ingress.yaml | 62 ----------------- dmz/internalproxy/templates/argocd.yaml | 6 +- dmz/internalproxy/templates/authentik.yaml | 80 +++++++++++----------- 3 files changed, 43 insertions(+), 105 deletions(-) diff --git a/dmz/authentik/templates/ingress.yaml b/dmz/authentik/templates/ingress.yaml index f03751e..e69de29 100644 --- a/dmz/authentik/templates/ingress.yaml +++ b/dmz/authentik/templates/ingress.yaml @@ -1,62 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: authentik-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: authentik-tls - commonName: "authentik.durp.info" - dnsNames: - - "authentik.durp.info" - ---- -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: authentik-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`authentik.durp.info`) && PathPrefix(`/`) - kind: Rule - services: - - name: infra-cluster - port: 443 - tls: - secretName: authentik-tls - ---- -kind: Service -apiVersion: v1 -metadata: - name: authentik-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -spec: - type: ExternalName - externalName: durp.info - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: infra-cluster -subsets: - - addresses: - - ip: 192.168.12.130 - ports: - - port: 443 - ---- -apiVersion: v1 -kind: Service -metadata: - name: infra-cluster -spec: - ports: - - protocol: TCP - port: 443 - targetPort: 443 diff --git a/dmz/internalproxy/templates/argocd.yaml b/dmz/internalproxy/templates/argocd.yaml index 20aba48..d817e19 100644 --- a/dmz/internalproxy/templates/argocd.yaml +++ b/dmz/internalproxy/templates/argocd.yaml @@ -7,9 +7,9 @@ spec: - websecure routes: - match: Host(`argocd.infra.durp.info`) - #middlewares: - # - name: whitelist - # namespace: traefik + middlewares: + - name: whitelist + namespace: traefik kind: Rule services: - name: infra-cluster diff --git a/dmz/internalproxy/templates/authentik.yaml b/dmz/internalproxy/templates/authentik.yaml index 328d115..adf9884 100644 --- a/dmz/internalproxy/templates/authentik.yaml +++ b/dmz/internalproxy/templates/authentik.yaml @@ -1,40 +1,40 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: authentik-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`authentik.durp.info`) && PathPrefix(`/`) -# kind: Rule -# services: -# - name: infra-cluster -# port: 443 -# tls: -# secretName: authentik-tls -# -#--- -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: authentik-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: authentik-tls -# commonName: "authentik.durp.info" -# dnsNames: -# - "authentik.durp.info" -# -#--- -#kind: Service -#apiVersion: v1 -#metadata: -# name: authentik-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: authentik.durp.info -#spec: -# type: ExternalName -# externalName: durp.info +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: authentik-tls +spec: + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + secretName: authentik-tls + commonName: "authentik.durp.info" + dnsNames: + - "authentik.durp.info" + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: authentik-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`authentik.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: infra-cluster + port: 443 + tls: + secretName: authentik-tls + +--- +kind: Service +apiVersion: v1 +metadata: + name: authentik-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: authentik.durp.info +spec: + type: ExternalName + externalName: durp.info \ No newline at end of file From e47f51426a1e2e7dacc429eee8954587a9e2a7bf Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 12:09:41 -0500 Subject: [PATCH 1045/1058] update --- dmz/internalproxy/templates/duplicati.yaml | 31 +--- dmz/internalproxy/templates/endpoints.yaml | 132 +++++++++++++++++ dmz/internalproxy/templates/forgejo.yaml | 31 +--- dmz/internalproxy/templates/freshrss.yaml | 32 +---- dmz/internalproxy/templates/gitlab.yaml | 85 ++++------- dmz/internalproxy/templates/invidious.yaml | 149 ++++++++++---------- dmz/internalproxy/templates/kasm.yaml | 31 +--- dmz/internalproxy/templates/kuma.yaml | 91 ++++++------ dmz/internalproxy/templates/litellm.yaml | 31 +--- dmz/internalproxy/templates/minio.yaml | 31 +--- dmz/internalproxy/templates/nextcloud.yaml | 29 +--- dmz/internalproxy/templates/nexus.yaml | 31 +--- dmz/internalproxy/templates/ollama.yaml | 35 +---- dmz/internalproxy/templates/open-webui.yaml | 33 +---- dmz/internalproxy/templates/plex.yaml | 33 +---- dmz/internalproxy/templates/portainer.yaml | 6 +- dmz/internalproxy/templates/registry.yaml | 29 +--- dmz/internalproxy/templates/root-vault.yaml | 32 +---- dmz/internalproxy/templates/s3.yaml | 33 +---- dmz/internalproxy/templates/semaphore.yaml | 129 ++++++++--------- 20 files changed, 365 insertions(+), 669 deletions(-) diff --git a/dmz/internalproxy/templates/duplicati.yaml b/dmz/internalproxy/templates/duplicati.yaml index d2563d0..74475df 100644 --- a/dmz/internalproxy/templates/duplicati.yaml +++ b/dmz/internalproxy/templates/duplicati.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: duplicati -spec: - ports: - - name: app - port: 8200 - protocol: TCP - targetPort: 8200 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: duplicati -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8200 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -43,7 +14,7 @@ spec: namespace: traefik kind: Rule services: - - name: duplicati + - name: unraid port: 8200 tls: secretName: duplicati-tls diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 35f2d40..0b36e84 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -60,6 +60,58 @@ spec: port: 8267 protocol: TCP targetPort: 8267 + - name: duplicati + port: 8200 + protocol: TCP + targetPort: 8200 + - name: forgejo + port: 3000 + protocol: TCP + targetPort: 3000 + - name: freshrss + port: 8085 + protocol: TCP + targetPort: 8085 + - name: gitlab-ssh + port: 9022 + protocol: TCP + targetPort: 9022 + - name: gitlab + port: 9443 + protocol: TCP + targetPort: 9443 + - name: minio + port: 9769 + protocol: TCP + targetPort: 9769 + - name: nextcloud + port: 11000 + protocol: TCP + targetPort: 11000 + - name: nexus + port: 8081 + protocol: TCP + targetPort: 8081 + - name: openweb-ui + port: 8089 + protocol: TCP + targetPort: 8089 + - name: plex + port: 32400 + protocol: TCP + targetPort: 32400 + - name: registry + port: 5000 + protocol: TCP + targetPort: 5000 + - name: root-vault + port: 8201 + protocol: TCP + targetPort: 8201 + - name: s3 + port: 9768 + protocol: TCP + targetPort: 9768 --- @@ -77,3 +129,83 @@ subsets: - name: tdarr port: 8267 protocol: TCP + - name: duplicati + port: 8200 + protocol: TCP + - name: forgejo + port: 3000 + protocol: TCP + - name: freshrss + port: 8085 + protocol: TCP + - name: gitlab-ssh + port: 9022 + protocol: TCP + - name: gitlab + port: 9443 + protocol: TCP + - name: minio + port: 9769 + protocol: TCP + - name: nextcloud + port: 11000 + protocol: TCP + - name: nexus + port: 8081 + protocol: TCP + - name: openweb-ui + port: 8089 + protocol: TCP + - name: plex + port: 32400 + protocol: TCP + - name: registry + port: 5000 + protocol: TCP + - name: root-vault + port: 8201 + protocol: TCP + - name: s3 + port: 9768 + protocol: TCP + +--- + +apiVersion: v1 +kind: Endpoints +metadata: + name: ubuntu +subsets: + - addresses: + - ip: 192.168.20.104 + ports: + - name: https + port: 443 + protocol: TCP + - name: litellm + port: 4000 + protocol: TCP + - name: ollama + port: 11435 + protocol: TCP + +--- + +apiVersion: v1 +kind: Service +metadata: + name: ubuntu +spec: + ports: + - name: https + port: 443 + protocol: TCP + targetPort: 443 + - name: litellm + port: 4000 + protocol: TCP + targetPort: 4000 + - name: ollama + port: 11435 + protocol: TCP + targetPort: 11435 diff --git a/dmz/internalproxy/templates/forgejo.yaml b/dmz/internalproxy/templates/forgejo.yaml index 4a6998a..52eb710 100644 --- a/dmz/internalproxy/templates/forgejo.yaml +++ b/dmz/internalproxy/templates/forgejo.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: forgejo -spec: - ports: - - name: app - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: forgejo -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 3000 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`forgejo.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: forgejo + - name: unraid port: 3000 scheme: http tls: diff --git a/dmz/internalproxy/templates/freshrss.yaml b/dmz/internalproxy/templates/freshrss.yaml index 3fe0ff4..092854c 100644 --- a/dmz/internalproxy/templates/freshrss.yaml +++ b/dmz/internalproxy/templates/freshrss.yaml @@ -1,33 +1,3 @@ - -apiVersion: v1 -kind: Service -metadata: - name: freshrss -spec: - ports: - - name: app - port: 8085 - protocol: TCP - targetPort: 8085 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: freshrss -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8085 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -39,7 +9,7 @@ spec: - match: Host(`freshrss.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: freshrss + - name: unraid port: 8085 tls: secretName: freshrss-tls diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 0c79c8b..2f225c2 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -1,30 +1,30 @@ -apiVersion: v1 -kind: Service -metadata: - name: gitlab-ssh -spec: - ports: - - name: app - port: 9022 - protocol: TCP - targetPort: 9022 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: gitlab-ssh -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9022 - protocol: TCP - ---- +#apiVersion: v1 +#kind: Service +#metadata: +# name: gitlab-ssh +#spec: +# ports: +# - name: app +# port: 9022 +# protocol: TCP +# targetPort: 9022 +# clusterIP: None +# type: ClusterIP +# +#--- +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: gitlab-ssh +#subsets: +# - addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 9022 +# protocol: TCP +# +#--- apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP metadata: @@ -35,36 +35,9 @@ spec: routes: - match: HostSNI(`*`) services: - - name: gitlab-ssh + - name: unraid port: 9022 ---- -apiVersion: v1 -kind: Service -metadata: - name: gitlab -spec: - ports: - - name: app - port: 9443 - protocol: TCP - targetPort: 9443 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: gitlab -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9443 - protocol: TCP - --- apiVersion: traefik.io/v1alpha1 kind: IngressRoute @@ -77,7 +50,7 @@ spec: - match: Host(`gitlab.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: gitlab + - name: unraid port: 9443 scheme: https tls: diff --git a/dmz/internalproxy/templates/invidious.yaml b/dmz/internalproxy/templates/invidious.yaml index cd85414..752db88 100644 --- a/dmz/internalproxy/templates/invidious.yaml +++ b/dmz/internalproxy/templates/invidious.yaml @@ -1,74 +1,75 @@ -apiVersion: v1 -kind: Service -metadata: - name: invidious -spec: - ports: - - name: app - port: 3000 - protocol: TCP - targetPort: 3000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: invidious -subsets: -- addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 3000 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: invidious-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`invidious.durp.info`) && PathPrefix(`/`) - middlewares: - - name: authentik-proxy-provider - namespace: traefik - kind: Rule - services: - - name: invidious - port: 3000 - tls: - secretName: invidious-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: invidious-tls -spec: - secretName: invidious-tls - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - commonName: "invidious.durp.info" - dnsNames: - - "invidious.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: invidious-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: invidious.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: v1 +#kind: Service +#metadata: +# name: invidious +#spec: +# ports: +# - name: app +# port: 3000 +# protocol: TCP +# targetPort: 3000 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: invidious +#subsets: +#- addresses: +# - ip: 192.168.20.104 +# ports: +# - name: app +# port: 3000 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: invidious-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`invidious.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# kind: Rule +# services: +# - name: invidious +# port: 3000 +# tls: +# secretName: invidious-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: invidious-tls +#spec: +# secretName: invidious-tls +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# commonName: "invidious.durp.info" +# dnsNames: +# - "invidious.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: invidious-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: invidious.durp.info +#spec: +# type: ExternalName +# externalName: durp.info +# \ No newline at end of file diff --git a/dmz/internalproxy/templates/kasm.yaml b/dmz/internalproxy/templates/kasm.yaml index 3e53772..7db9d75 100644 --- a/dmz/internalproxy/templates/kasm.yaml +++ b/dmz/internalproxy/templates/kasm.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: kasm -spec: - ports: - - name: app - port: 443 - protocol: TCP - targetPort: 443 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: kasm -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 443 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`kasm.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: kasm + - name: ubuntu port: 443 scheme: https tls: diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml index 0651763..2465b67 100644 --- a/dmz/internalproxy/templates/kuma.yaml +++ b/dmz/internalproxy/templates/kuma.yaml @@ -1,45 +1,46 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: kuma-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`kuma.durp.info`) && PathPrefix(`/`) - kind: Rule - middlewares: - - name: authentik-proxy-provider - namespace: traefik - services: - - name: master-cluster - port: 443 - tls: - secretName: kuma-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: kuma-tls -spec: - issuerRef: - name: letsencrypt-production - kind: ClusterIssuer - secretName: kuma-tls - commonName: "kuma.durp.info" - dnsNames: - - "kuma.durp.info" - ---- - -kind: Service -apiVersion: v1 -metadata: - name: kuma-external-dns - annotations: - external-dns.alpha.kubernetes.io/hostname: kuma.durp.info -spec: - type: ExternalName - externalName: durp.info +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: kuma-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`kuma.durp.info`) && PathPrefix(`/`) +# kind: Rule +# middlewares: +# - name: authentik-proxy-provider +# namespace: traefik +# services: +# - name: master-cluster +# port: 443 +# tls: +# secretName: kuma-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: kuma-tls +#spec: +# issuerRef: +# name: letsencrypt-production +# kind: ClusterIssuer +# secretName: kuma-tls +# commonName: "kuma.durp.info" +# dnsNames: +# - "kuma.durp.info" +# +#--- +# +#kind: Service +#apiVersion: v1 +#metadata: +# name: kuma-external-dns +# annotations: +# external-dns.alpha.kubernetes.io/hostname: kuma.durp.info +#spec: +# type: ExternalName +# externalName: durp.info +# \ No newline at end of file diff --git a/dmz/internalproxy/templates/litellm.yaml b/dmz/internalproxy/templates/litellm.yaml index e70cbd8..11a87ac 100644 --- a/dmz/internalproxy/templates/litellm.yaml +++ b/dmz/internalproxy/templates/litellm.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: litellm -spec: - ports: - - name: app - port: 4000 - protocol: TCP - targetPort: 4000 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: litellm -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 4000 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`litellm.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: litellm + - name: ubuntu port: 4000 tls: secretName: litellm-tls diff --git a/dmz/internalproxy/templates/minio.yaml b/dmz/internalproxy/templates/minio.yaml index c30a923..8622240 100644 --- a/dmz/internalproxy/templates/minio.yaml +++ b/dmz/internalproxy/templates/minio.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: minio -spec: - ports: - - name: app - port: 9769 - protocol: TCP - targetPort: 9769 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: minio -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9769 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,7 +12,7 @@ spec: namespace: traefik kind: Rule services: - - name: minio + - name: unraid port: 9769 scheme: http tls: diff --git a/dmz/internalproxy/templates/nextcloud.yaml b/dmz/internalproxy/templates/nextcloud.yaml index e3ea9dd..77b04e5 100644 --- a/dmz/internalproxy/templates/nextcloud.yaml +++ b/dmz/internalproxy/templates/nextcloud.yaml @@ -1,30 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: nextcloud -spec: - ports: - - name: app - port: 11000 - protocol: TCP - targetPort: 11000 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: nextcloud -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 11000 - protocol: TCP - ---- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +11,7 @@ spec: middlewares: - name: nextcloud-chain services: - - name: nextcloud + - name: unraid port: 11000 scheme: http tls: diff --git a/dmz/internalproxy/templates/nexus.yaml b/dmz/internalproxy/templates/nexus.yaml index ed609d9..8e9ca70 100644 --- a/dmz/internalproxy/templates/nexus.yaml +++ b/dmz/internalproxy/templates/nexus.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: nexus -spec: - ports: - - name: app - port: 8081 - protocol: TCP - targetPort: 8081 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: nexus -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8081 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,7 +9,7 @@ spec: - match: Host(`nexus.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: nexus + - name: unraid port: 8081 tls: secretName: nexus-tls diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 9141647..9ad17e3 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -15,7 +15,6 @@ spec: property: users --- - apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: @@ -26,36 +25,6 @@ spec: secret: ollama-secret --- - -apiVersion: v1 -kind: Service -metadata: - name: ollama -spec: - ports: - - name: app - port: 11435 - protocol: TCP - targetPort: 11435 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: ollama -subsets: - - addresses: - - ip: 192.168.20.104 - ports: - - name: app - port: 11435 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -69,13 +38,12 @@ spec: - name: ollama-basic-auth kind: Rule services: - - name: ollama + - name: unraid port: 11435 tls: secretName: ollama-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -90,7 +58,6 @@ spec: - "ollama.durp.info" --- - kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/open-webui.yaml b/dmz/internalproxy/templates/open-webui.yaml index 24ae6fd..f3e7f89 100644 --- a/dmz/internalproxy/templates/open-webui.yaml +++ b/dmz/internalproxy/templates/open-webui.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: open-webui -spec: - ports: - - name: app - port: 8089 - protocol: TCP - targetPort: 8089 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: open-webui -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8089 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,14 +9,13 @@ spec: - match: Host(`open-webui.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: open-webui + - name: unraid port: 8089 scheme: http tls: secretName: open-webui-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -60,7 +30,6 @@ spec: - "open-webui.durp.info" --- - kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/plex.yaml b/dmz/internalproxy/templates/plex.yaml index abbdabf..7fbc5f8 100644 --- a/dmz/internalproxy/templates/plex.yaml +++ b/dmz/internalproxy/templates/plex.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: plex -spec: - ports: - - name: app - port: 32400 - protocol: TCP - targetPort: 32400 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: plex -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 32400 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -38,14 +9,13 @@ spec: - match: Host(`plex.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: plex + - name: unraid port: 32400 scheme: https tls: secretName: plex-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -60,7 +30,6 @@ spec: - "plex.durp.info" --- - kind: Service apiVersion: v1 metadata: diff --git a/dmz/internalproxy/templates/portainer.yaml b/dmz/internalproxy/templates/portainer.yaml index 554e052..ae89690 100644 --- a/dmz/internalproxy/templates/portainer.yaml +++ b/dmz/internalproxy/templates/portainer.yaml @@ -7,9 +7,9 @@ spec: - websecure routes: - match: Host(`portainer.internal.durp.info`) && PathPrefix(`/`) - #middlewares: - #- name: whitelist - # namespace: traefik + middlewares: + - name: whitelist + namespace: traefik kind: Rule services: - name: infra-cluster diff --git a/dmz/internalproxy/templates/registry.yaml b/dmz/internalproxy/templates/registry.yaml index ac3c25a..b9b6ed4 100644 --- a/dmz/internalproxy/templates/registry.yaml +++ b/dmz/internalproxy/templates/registry.yaml @@ -1,30 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: registry -spec: - ports: - - name: app - port: 5000 - protocol: TCP - targetPort: 5000 - clusterIP: None - type: ClusterIP - ---- -apiVersion: v1 -kind: Endpoints -metadata: - name: registry -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 5000 - protocol: TCP - ---- apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -39,7 +12,7 @@ spec: - name: whitelist namespace: traefik services: - - name: registry + - name: unraid port: 5000 tls: secretName: registry-tls diff --git a/dmz/internalproxy/templates/root-vault.yaml b/dmz/internalproxy/templates/root-vault.yaml index c32ca62..76d4b94 100644 --- a/dmz/internalproxy/templates/root-vault.yaml +++ b/dmz/internalproxy/templates/root-vault.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: root-vault -spec: - ports: - - name: app - port: 8201 - protocol: TCP - targetPort: 8201 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: root-vault -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 8201 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,14 +12,13 @@ spec: namespace: traefik kind: Rule services: - - name: root-vault + - name: unraid port: 8201 scheme: https tls: secretName: root-vault-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 29d509d..5bf203e 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: s3 -spec: - ports: - - name: app - port: 9768 - protocol: TCP - targetPort: 9768 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: s3 -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 9768 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -41,7 +12,7 @@ spec: namespace: traefik kind: Rule services: - - name: s3 + - name: unraid port: 9768 scheme: http tls: @@ -75,7 +46,7 @@ spec: - match: Host(`s3.durp.info`) && PathPrefix(`/`) kind: Rule services: - - name: s3 + - name: unraid port: 9768 scheme: http tls: diff --git a/dmz/internalproxy/templates/semaphore.yaml b/dmz/internalproxy/templates/semaphore.yaml index 3005b94..145d1ca 100644 --- a/dmz/internalproxy/templates/semaphore.yaml +++ b/dmz/internalproxy/templates/semaphore.yaml @@ -1,64 +1,65 @@ - -apiVersion: v1 -kind: Service -metadata: - name: semaphore -spec: - ports: - - name: app - port: 3001 - protocol: TCP - targetPort: 3001 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: semaphore -subsets: - - addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 3001 - protocol: TCP - ---- - -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: semaphore-ingress -spec: - entryPoints: - - websecure - routes: - - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) - middlewares: - - name: whitelist - namespace: traefik - kind: Rule - services: - - name: semaphore - port: 3001 - scheme: http - tls: - secretName: semaphore-tls - ---- - -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: semaphore-tls -spec: - secretName: semaphore-tls - issuerRef: - name: vault-issuer - kind: ClusterIssuer - commonName: "semaphore.internal.durp.info" - dnsNames: - - "semaphore.internal.durp.info" +# +#apiVersion: v1 +#kind: Service +#metadata: +# name: semaphore +#spec: +# ports: +# - name: app +# port: 3001 +# protocol: TCP +# targetPort: 3001 +# clusterIP: None +# type: ClusterIP +# +#--- +# +#apiVersion: v1 +#kind: Endpoints +#metadata: +# name: semaphore +#subsets: +# - addresses: +# - ip: 192.168.21.200 +# ports: +# - name: app +# port: 3001 +# protocol: TCP +# +#--- +# +#apiVersion: traefik.io/v1alpha1 +#kind: IngressRoute +#metadata: +# name: semaphore-ingress +#spec: +# entryPoints: +# - websecure +# routes: +# - match: Host(`semaphore.internal.durp.info`) && PathPrefix(`/`) +# middlewares: +# - name: whitelist +# namespace: traefik +# kind: Rule +# services: +# - name: semaphore +# port: 3001 +# scheme: http +# tls: +# secretName: semaphore-tls +# +#--- +# +#apiVersion: cert-manager.io/v1 +#kind: Certificate +#metadata: +# name: semaphore-tls +#spec: +# secretName: semaphore-tls +# issuerRef: +# name: vault-issuer +# kind: ClusterIssuer +# commonName: "semaphore.internal.durp.info" +# dnsNames: +# - "semaphore.internal.durp.info" +# \ No newline at end of file From 224450c70c9c848ac8cdff550bf10834b89b8a73 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 28 Mar 2026 12:13:07 -0500 Subject: [PATCH 1046/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 7 +++++ dmz/internalproxy/templates/smokeping.yaml | 33 +--------------------- 2 files changed, 8 insertions(+), 32 deletions(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 0b36e84..428120a 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -112,6 +112,10 @@ spec: port: 9768 protocol: TCP targetPort: 9768 + - name: smokeping + port: 81 + protocol: TCP + targetPort: 81 --- @@ -168,6 +172,9 @@ subsets: - name: s3 port: 9768 protocol: TCP + - name: smokeping + port: 81 + protocol: TCP --- diff --git a/dmz/internalproxy/templates/smokeping.yaml b/dmz/internalproxy/templates/smokeping.yaml index 2d78b2f..9808876 100644 --- a/dmz/internalproxy/templates/smokeping.yaml +++ b/dmz/internalproxy/templates/smokeping.yaml @@ -1,32 +1,3 @@ -apiVersion: v1 -kind: Service -metadata: - name: smokeping -spec: - ports: - - name: app - port: 81 - protocol: TCP - targetPort: 81 - clusterIP: None - type: ClusterIP - ---- - -apiVersion: v1 -kind: Endpoints -metadata: - name: smokeping -subsets: -- addresses: - - ip: 192.168.21.200 - ports: - - name: app - port: 81 - protocol: TCP - ---- - apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: @@ -43,13 +14,12 @@ spec: namespace: traefik kind: Rule services: - - name: smokeping + - name: unraid port: 81 tls: secretName: smokeping-tls --- - apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -64,7 +34,6 @@ spec: - "smokeping.durp.info" --- - kind: Service apiVersion: v1 metadata: From ecf16c071745446568bff607b54a53aa781be827 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 29 Mar 2026 07:23:32 -0500 Subject: [PATCH 1047/1058] update --- dmz/internalproxy/templates/argocd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/argocd.yaml b/dmz/internalproxy/templates/argocd.yaml index d817e19..5adf88e 100644 --- a/dmz/internalproxy/templates/argocd.yaml +++ b/dmz/internalproxy/templates/argocd.yaml @@ -16,7 +16,7 @@ spec: port: 443 scheme: https tls: - secretName: argocd-tls + secretName: argocd-infra-tls --- From f457e7f1d9bea15716b76bb902277f9415ea3fb8 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Mon, 30 Mar 2026 05:34:35 -0500 Subject: [PATCH 1048/1058] update --- dmz/internalproxy/templates/ollama.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/ollama.yaml b/dmz/internalproxy/templates/ollama.yaml index 9ad17e3..f03ca52 100644 --- a/dmz/internalproxy/templates/ollama.yaml +++ b/dmz/internalproxy/templates/ollama.yaml @@ -38,7 +38,7 @@ spec: - name: ollama-basic-auth kind: Rule services: - - name: unraid + - name: ubuntu port: 11435 tls: secretName: ollama-tls @@ -66,4 +66,4 @@ metadata: external-dns.alpha.kubernetes.io/hostname: ollama.durp.info spec: type: ExternalName - externalName: durp.info \ No newline at end of file + externalName: durp.info From 1ddfd948a5542f68a91371d421f6cde1ea545f89 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 2 May 2026 06:08:39 -0500 Subject: [PATCH 1049/1058] add gotify and kuma --- dmz/internalproxy/templates/endpoints.yaml | 13 ++-- dmz/internalproxy/templates/gotify.yaml | 41 ++++++++++ dmz/internalproxy/templates/kuma.yaml | 87 ++++++++++------------ 3 files changed, 88 insertions(+), 53 deletions(-) create mode 100644 dmz/internalproxy/templates/gotify.yaml diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index 428120a..fbabade 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -9,7 +9,6 @@ subsets: - port: 443 --- - apiVersion: v1 kind: Service metadata: @@ -21,7 +20,6 @@ spec: targetPort: 443 --- - apiVersion: v1 kind: Endpoints metadata: @@ -33,7 +31,6 @@ subsets: - port: 443 --- - apiVersion: v1 kind: Service metadata: @@ -45,7 +42,6 @@ spec: targetPort: 443 --- - apiVersion: v1 kind: Service metadata: @@ -118,7 +114,6 @@ spec: targetPort: 81 --- - apiVersion: v1 kind: Endpoints metadata: @@ -139,6 +134,9 @@ subsets: - name: forgejo port: 3000 protocol: TCP + - name: kuma + port: 3001 + protocol: TCP - name: freshrss port: 8085 protocol: TCP @@ -175,9 +173,11 @@ subsets: - name: smokeping port: 81 protocol: TCP + - name: gotify + port: 8070 + protocol: TCP --- - apiVersion: v1 kind: Endpoints metadata: @@ -197,7 +197,6 @@ subsets: protocol: TCP --- - apiVersion: v1 kind: Service metadata: diff --git a/dmz/internalproxy/templates/gotify.yaml b/dmz/internalproxy/templates/gotify.yaml new file mode 100644 index 0000000..6619aed --- /dev/null +++ b/dmz/internalproxy/templates/gotify.yaml @@ -0,0 +1,41 @@ +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gotify-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`gotify.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: unraid + port: 8070 + scheme: http + tls: + secretName: gotify-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gotify-tls +spec: + secretName: gotify-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "gotify.durp.info" + dnsNames: + - "gotify.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: gotify-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: gotify.durp.info +spec: + type: ExternalName + externalName: durp.info diff --git a/dmz/internalproxy/templates/kuma.yaml b/dmz/internalproxy/templates/kuma.yaml index 2465b67..31b040b 100644 --- a/dmz/internalproxy/templates/kuma.yaml +++ b/dmz/internalproxy/templates/kuma.yaml @@ -1,46 +1,41 @@ -#apiVersion: traefik.io/v1alpha1 -#kind: IngressRoute -#metadata: -# name: kuma-ingress -#spec: -# entryPoints: -# - websecure -# routes: -# - match: Host(`kuma.durp.info`) && PathPrefix(`/`) -# kind: Rule -# middlewares: -# - name: authentik-proxy-provider -# namespace: traefik -# services: -# - name: master-cluster -# port: 443 -# tls: -# secretName: kuma-tls -# -#--- -# -#apiVersion: cert-manager.io/v1 -#kind: Certificate -#metadata: -# name: kuma-tls -#spec: -# issuerRef: -# name: letsencrypt-production -# kind: ClusterIssuer -# secretName: kuma-tls -# commonName: "kuma.durp.info" -# dnsNames: -# - "kuma.durp.info" -# -#--- -# -#kind: Service -#apiVersion: v1 -#metadata: -# name: kuma-external-dns -# annotations: -# external-dns.alpha.kubernetes.io/hostname: kuma.durp.info -#spec: -# type: ExternalName -# externalName: durp.info -# \ No newline at end of file +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: kuma-ingress +spec: + entryPoints: + - websecure + routes: + - match: Host(`kuma.durp.info`) && PathPrefix(`/`) + kind: Rule + services: + - name: unraid + port: 3001 + scheme: http + tls: + secretName: kuma-tls + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: kuma-tls +spec: + secretName: kuma-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "kuma.durp.info" + dnsNames: + - "kuma.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: kuma-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: kuma.durp.info +spec: + type: ExternalName + externalName: durp.info From d50b776fef3f43a486a89da459d2ecebefde167c Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 2 May 2026 06:15:04 -0500 Subject: [PATCH 1050/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index fbabade..c7544c9 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -63,6 +63,9 @@ spec: - name: forgejo port: 3000 protocol: TCP + - name: kuma + port: 3001 + protocol: TCP targetPort: 3000 - name: freshrss port: 8085 @@ -112,6 +115,9 @@ spec: port: 81 protocol: TCP targetPort: 81 + - name: gotify + port: 8070 + protocol: TCP --- apiVersion: v1 From d7effa4eacbb0dca4091b6eff37caec9abab8684 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 08:23:10 -0500 Subject: [PATCH 1051/1058] update --- dmz/internalproxy/templates/s3.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 5bf203e..8d5bdca 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -13,7 +13,7 @@ spec: kind: Rule services: - name: unraid - port: 9768 + port: 9769 scheme: http tls: secretName: s3-tls @@ -47,7 +47,7 @@ spec: kind: Rule services: - name: unraid - port: 9768 + port: 9769 scheme: http tls: secretName: s3-external-tls From b968cd024f5ae8fd94e1601f15cfaf8d65da4187 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 12:14:16 -0500 Subject: [PATCH 1052/1058] update --- dmz/internalproxy/templates/s3.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dmz/internalproxy/templates/s3.yaml b/dmz/internalproxy/templates/s3.yaml index 8d5bdca..5bf203e 100644 --- a/dmz/internalproxy/templates/s3.yaml +++ b/dmz/internalproxy/templates/s3.yaml @@ -13,7 +13,7 @@ spec: kind: Rule services: - name: unraid - port: 9769 + port: 9768 scheme: http tls: secretName: s3-tls @@ -47,7 +47,7 @@ spec: kind: Rule services: - name: unraid - port: 9769 + port: 9768 scheme: http tls: secretName: s3-external-tls From 2d1916de2bf8de93e52e61f02ba0d51445f5925a Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 13:32:48 -0500 Subject: [PATCH 1053/1058] add images --- dmz/internalproxy/templates/gitlab.yaml | 44 +++++++++++++++++++++++++ 1 file changed, 44 insertions(+) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 2f225c2..5d07bea 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -80,3 +80,47 @@ metadata: spec: type: ExternalName externalName: durp.info + +--- +apiVersion: traefik.io/v1alpha1 +kind: IngressRoute +metadata: + name: gitlab-registry + namespace: gitlab +spec: + entryPoints: + - websecure + routes: + - match: Host(`images.durp.info`) + kind: Rule + services: + - name: unraid + port: 5050 + scheme: http + tls: + certResolver: letsencrypt + +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: gitlab-images-tls +spec: + secretName: gitlab-images-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: "images.durp.info" + dnsNames: + - "images.durp.info" + +--- +kind: Service +apiVersion: v1 +metadata: + name: gitlab-images-external-dns + annotations: + external-dns.alpha.kubernetes.io/hostname: images.durp.info +spec: + type: ExternalName + externalName: durp.info From e66526b1766e9b27b0d17e84ed78b47eaae6b525 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 13:37:02 -0500 Subject: [PATCH 1054/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 5d07bea..6f032fa 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -86,7 +86,6 @@ apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: gitlab-registry - namespace: gitlab spec: entryPoints: - websecure From ce51ae2f8d7439403922c185615d9668b4b2558b Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sat, 9 May 2026 13:39:43 -0500 Subject: [PATCH 1055/1058] update --- dmz/internalproxy/templates/gitlab.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 6f032fa..5331347 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -97,7 +97,7 @@ spec: port: 5050 scheme: http tls: - certResolver: letsencrypt + secretName: gitlab-images-tls --- apiVersion: cert-manager.io/v1 From dc09d0109eb3a7d65423c80cd91becb01c760887 Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Sun, 10 May 2026 08:03:18 -0500 Subject: [PATCH 1056/1058] update --- dmz/internalproxy/templates/endpoints.yaml | 7 +++++++ dmz/internalproxy/templates/gitlab.yaml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/dmz/internalproxy/templates/endpoints.yaml b/dmz/internalproxy/templates/endpoints.yaml index c7544c9..8380a2c 100644 --- a/dmz/internalproxy/templates/endpoints.yaml +++ b/dmz/internalproxy/templates/endpoints.yaml @@ -103,6 +103,10 @@ spec: port: 5000 protocol: TCP targetPort: 5000 + - name: gitlab-registry + port: 5002 + protocol: TCP + targetPort: 5002 - name: root-vault port: 8201 protocol: TCP @@ -170,6 +174,9 @@ subsets: - name: registry port: 5000 protocol: TCP + - name: gitlab-registry + port: 5002 + protocol: TCP - name: root-vault port: 8201 protocol: TCP diff --git a/dmz/internalproxy/templates/gitlab.yaml b/dmz/internalproxy/templates/gitlab.yaml index 5331347..d64a5aa 100644 --- a/dmz/internalproxy/templates/gitlab.yaml +++ b/dmz/internalproxy/templates/gitlab.yaml @@ -94,7 +94,7 @@ spec: kind: Rule services: - name: unraid - port: 5050 + port: 5002 scheme: http tls: secretName: gitlab-images-tls From fa564e4d8c27be062bff10a60ff366d972334feb Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 12 May 2026 06:24:19 -0500 Subject: [PATCH 1057/1058] update --- infra/authentik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index 1cf4c0a..c98e563 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -34,7 +34,7 @@ authentik: enabled: true image: registry: registry.durp.info - repository: bitnami/postgresql + repository: bitnamilegacy/postgresql pullPolicy: Always postgresqlUsername: "authentik" postgresqlDatabase: "authentik" From dc2c619e19c59aa770109eea70d6a8cbf52359ae Mon Sep 17 00:00:00 2001 From: DeveloperDurp Date: Tue, 12 May 2026 06:26:13 -0500 Subject: [PATCH 1058/1058] update --- infra/authentik/values.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infra/authentik/values.yaml b/infra/authentik/values.yaml index c98e563..7b75190 100644 --- a/infra/authentik/values.yaml +++ b/infra/authentik/values.yaml @@ -52,7 +52,7 @@ authentik: enabled: false image: registry: registry.durp.info - repository: bitnami/redis + repository: bitnamilegacy/redis pullPolicy: Always architecture: standalone auth: