init gitea, opensearch
This commit is contained in:
root
parent
a08d78a154
commit
5bfbf1250e
|
|
@ -0,0 +1,6 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: gitea
|
||||||
|
labels:
|
||||||
|
kubernetes.io/metadata.name: gitea
|
||||||
|
|
@ -0,0 +1,79 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
- ports:
|
||||||
|
- port: 5432
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
- ports:
|
||||||
|
- port: 5432
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
# Allow inbound connections
|
||||||
|
- ports:
|
||||||
|
- port: 6379
|
||||||
|
- port: 16379
|
||||||
|
|
@ -0,0 +1,77 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql-witness
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: witness
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: witness
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/poddisruptionbudget.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
matchExpressions:
|
||||||
|
- {key: job-name, operator: NotIn, values: [release-name-redis-cluster-cluster-update]}
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/redis-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
|
@ -0,0 +1,384 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
admin-password: "aWppbmMxMjMh"
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
postgres-password: "aWppbmMxMjMh"
|
||||||
|
password: "Z2l0ZWE="
|
||||||
|
repmgr-password: "aWppbmMxMjMh"
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/config.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-inline-config
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
_generals_: ""
|
||||||
|
cache: |-
|
||||||
|
ADAPTER=redis
|
||||||
|
HOST=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
database: |-
|
||||||
|
DB_TYPE=postgres
|
||||||
|
HOST=release-name-postgresql-ha-pgpool.gitea.svc.cluster.local:5432
|
||||||
|
NAME=gitea
|
||||||
|
PASSWD=gitea
|
||||||
|
USER=gitea
|
||||||
|
indexer: ISSUE_INDEXER_TYPE=db
|
||||||
|
metrics: ENABLED=false
|
||||||
|
queue: |-
|
||||||
|
CONN_STR=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
TYPE=redis
|
||||||
|
repository: ROOT=/data/git/gitea-repositories
|
||||||
|
security: INSTALL_LOCK=true
|
||||||
|
server: |-
|
||||||
|
APP_DATA_PATH=/data
|
||||||
|
DOMAIN=gitea.nativedeck.com
|
||||||
|
ENABLE_PPROF=false
|
||||||
|
HTTP_PORT=3000
|
||||||
|
PROTOCOL=http
|
||||||
|
ROOT_URL=http://gitea.nativedeck.com
|
||||||
|
SSH_DOMAIN=gitea.nativedeck.com
|
||||||
|
SSH_LISTEN_PORT=2222
|
||||||
|
SSH_PORT=22
|
||||||
|
START_SSH_SERVER=true
|
||||||
|
session: |-
|
||||||
|
PROVIDER=redis
|
||||||
|
PROVIDER_CONFIG=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/config.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
assertions: |
|
||||||
|
config_environment.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
function env2ini::log() {
|
||||||
|
printf "${1}\n"
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::read_config_to_env() {
|
||||||
|
local section="${1}"
|
||||||
|
local line="${2}"
|
||||||
|
|
||||||
|
if [[ -z "${line}" ]]; then
|
||||||
|
# skip empty line
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||||
|
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||||
|
|
||||||
|
if [[ -z "${setting}" ]]; then
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local value=''
|
||||||
|
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||||
|
if [[ $line =~ $regex ]]; then
|
||||||
|
value="${BASH_REMATCH[3]}"
|
||||||
|
else
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
env2ini::log " + '${setting}'"
|
||||||
|
|
||||||
|
if [[ -z "${section}" ]]; then
|
||||||
|
export "GITEA____${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||||
|
masked_section="${masked_section//-/_0X2D_}"
|
||||||
|
|
||||||
|
export "GITEA__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::reload_preset_envs() {
|
||||||
|
env2ini::log "Reloading preset envs..."
|
||||||
|
|
||||||
|
while read -r line; do
|
||||||
|
if [[ -z "${line}" ]]; then
|
||||||
|
# skip empty line
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||||
|
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||||
|
|
||||||
|
if [[ -z "${setting}" ]]; then
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local value=''
|
||||||
|
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||||
|
if [[ $line =~ $regex ]]; then
|
||||||
|
value="${BASH_REMATCH[3]}"
|
||||||
|
else
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
env2ini::log " + '${setting}'"
|
||||||
|
|
||||||
|
export "${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
done < "/tmp/existing-envs"
|
||||||
|
|
||||||
|
rm /tmp/existing-envs
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
function env2ini::process_config_file() {
|
||||||
|
local config_file="${1}"
|
||||||
|
local section="$(basename "${config_file}")"
|
||||||
|
|
||||||
|
if [[ $section == '_generals_' ]]; then
|
||||||
|
env2ini::log " [ini root]"
|
||||||
|
section=''
|
||||||
|
else
|
||||||
|
env2ini::log " ${section}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
while read -r line; do
|
||||||
|
env2ini::read_config_to_env "${section}" "${line}"
|
||||||
|
done < <(awk 1 "${config_file}") # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::load_config_sources() {
|
||||||
|
local path="${1}"
|
||||||
|
|
||||||
|
if [[ -d "${path}" ]]; then
|
||||||
|
env2ini::log "Processing $(basename "${path}")..."
|
||||||
|
|
||||||
|
while read -d '' configFile; do
|
||||||
|
env2ini::process_config_file "${configFile}"
|
||||||
|
done < <(find "${path}" -type l -not -name '..data' -print0)
|
||||||
|
|
||||||
|
env2ini::log "\n"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::generate_initial_secrets() {
|
||||||
|
# These environment variables will either be
|
||||||
|
# - overwritten with user defined values,
|
||||||
|
# - initially used to set up Gitea
|
||||||
|
# Anyway, they won't harm existing app.ini files
|
||||||
|
|
||||||
|
export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||||
|
export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
|
||||||
|
export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
|
||||||
|
export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
|
||||||
|
|
||||||
|
env2ini::log "...Initial secrets generated\n"
|
||||||
|
}
|
||||||
|
|
||||||
|
# save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
|
||||||
|
env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > /tmp/existing-envs
|
||||||
|
|
||||||
|
# MUST BE CALLED BEFORE OTHER CONFIGURATION
|
||||||
|
env2ini::generate_initial_secrets
|
||||||
|
|
||||||
|
env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
|
||||||
|
env2ini::load_config_sources '/env-to-ini-mounts/additionals/'
|
||||||
|
|
||||||
|
# load existing envs to override auto generated envs
|
||||||
|
env2ini::reload_preset_envs
|
||||||
|
|
||||||
|
env2ini::log "=== All configuration sources loaded ===\n"
|
||||||
|
|
||||||
|
# safety to prevent rewrite of secret keys if an app.ini already exists
|
||||||
|
if [ -f ${GITEA_APP_INI} ]; then
|
||||||
|
env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
|
||||||
|
env2ini::log ' - security.INTERNAL_TOKEN'
|
||||||
|
env2ini::log ' - security.SECRET_KEY'
|
||||||
|
env2ini::log ' - oauth2.JWT_SECRET'
|
||||||
|
env2ini::log ' - server.LFS_JWT_SECRET'
|
||||||
|
|
||||||
|
unset GITEA__SECURITY__INTERNAL_TOKEN
|
||||||
|
unset GITEA__SECURITY__SECRET_KEY
|
||||||
|
unset GITEA__OAUTH2__JWT_SECRET
|
||||||
|
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||||
|
fi
|
||||||
|
|
||||||
|
environment-to-ini -o $GITEA_APP_INI
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/init.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-init
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
configure_gpg_environment.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
gpg --batch --import /raw/private.asc
|
||||||
|
init_directory_structure.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
set -x
|
||||||
|
mkdir -p /data/git/.ssh
|
||||||
|
chmod -R 700 /data/git/.ssh
|
||||||
|
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||||
|
|
||||||
|
# prepare temp directory structure
|
||||||
|
mkdir -p "${GITEA_TEMP}"
|
||||||
|
chmod ug+rwx "${GITEA_TEMP}"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
configure_gitea.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||||
|
|
||||||
|
{ # try
|
||||||
|
gitea migrate
|
||||||
|
} || { # catch
|
||||||
|
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
function test_redis_connection() {
|
||||||
|
local RETRY=0
|
||||||
|
local MAX=30
|
||||||
|
|
||||||
|
echo 'Wait for redis to become avialable...'
|
||||||
|
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||||
|
nc -vz -w2 release-name-redis-cluster-headless.gitea.svc.cluster.local 6379 && break
|
||||||
|
RETRY=$[${RETRY}+1]
|
||||||
|
echo "...not ready yet (${RETRY}/${MAX})"
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||||
|
echo "Redis not reachable after '${MAX}' attempts!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
test_redis_connection
|
||||||
|
function configure_admin_user() {
|
||||||
|
local full_admin_list=$(gitea admin user list --admin)
|
||||||
|
local actual_user_table=''
|
||||||
|
|
||||||
|
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||||
|
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||||
|
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||||
|
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||||
|
else
|
||||||
|
# This code block should never be reached, as long as the output table header remains the same.
|
||||||
|
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||||
|
|
||||||
|
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||||
|
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||||
|
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-chart/issues."
|
||||||
|
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||||
|
echo "--"
|
||||||
|
echo "${full_admin_list}"
|
||||||
|
echo "--"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||||
|
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||||
|
local -a create_args
|
||||||
|
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain")
|
||||||
|
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||||
|
create_args+=(--must-change-password=true)
|
||||||
|
else
|
||||||
|
create_args+=(--must-change-password=false)
|
||||||
|
fi
|
||||||
|
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||||
|
gitea admin user create "${create_args[@]}"
|
||||||
|
echo '...created.'
|
||||||
|
else
|
||||||
|
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||||
|
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||||
|
# See https://gitea.com/gitea/helm-chart/issues/673
|
||||||
|
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||||
|
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||||
|
# should add it to prevent requiring frequent admin password resets.
|
||||||
|
local -a change_args
|
||||||
|
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||||
|
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||||
|
change_args+=(--must-change-password=false)
|
||||||
|
fi
|
||||||
|
gitea admin user change-password "${change_args[@]}"
|
||||||
|
echo '...password sync done.'
|
||||||
|
else
|
||||||
|
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_admin_user
|
||||||
|
|
||||||
|
function configure_ldap() {
|
||||||
|
echo 'no ldap configuration... skipping.'
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_ldap
|
||||||
|
|
||||||
|
function configure_oauth() {
|
||||||
|
echo 'no oauth configuration... skipping.'
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_oauth
|
||||||
|
|
||||||
|
echo '==== END GITEA CONFIGURATION ===='
|
||||||
|
|
@ -0,0 +1,13 @@
|
||||||
|
# Source: gitea/templates/gitea/pvc.yaml
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: gitea-shared-storage
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
volumeMode: Filesystem
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 200Gi # default: 10Gi
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
# Need To Change
|
||||||
|
## Secret File
|
||||||
|
* DOMAIN
|
||||||
|
* ROOT_URL
|
||||||
|
* SSH_DOMAIN
|
||||||
|
* ###-password : aWppbmMxMjMh
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,815 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-postgresql-ha
|
||||||
|
# Auxiliary vars to populate environment variables
|
||||||
|
containers:
|
||||||
|
- name: pgpool
|
||||||
|
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: "false"
|
||||||
|
- name: PGPOOL_BACKEND_NODES
|
||||||
|
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
||||||
|
- name: PGPOOL_SR_CHECK_USER
|
||||||
|
value: "repmgr"
|
||||||
|
- name: PGPOOL_SR_CHECK_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: repmgr-password
|
||||||
|
- name: PGPOOL_SR_CHECK_DATABASE
|
||||||
|
value: "postgres"
|
||||||
|
- name: PGPOOL_ENABLE_LDAP
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_POSTGRES_USERNAME
|
||||||
|
value: "gitea"
|
||||||
|
- name: PGPOOL_POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: password
|
||||||
|
- name: PGPOOL_ADMIN_USERNAME
|
||||||
|
value: "admin"
|
||||||
|
- name: PGPOOL_ADMIN_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
key: admin-password
|
||||||
|
- name: PGPOOL_AUTHENTICATION_METHOD
|
||||||
|
value: "scram-sha-256"
|
||||||
|
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
||||||
|
value: "yes"
|
||||||
|
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
||||||
|
value: "transaction"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
||||||
|
value: "yes"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_RESERVED_CONNECTIONS
|
||||||
|
value: '1'
|
||||||
|
- name: PGPOOL_CHILD_LIFE_TIME
|
||||||
|
value: ""
|
||||||
|
- name: PGPOOL_ENABLE_TLS
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
||||||
|
value: "6"
|
||||||
|
envFrom:
|
||||||
|
ports:
|
||||||
|
- name: postgresql
|
||||||
|
containerPort: 5432
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 375m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 384Mi
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 256Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/etc
|
||||||
|
subPath: app-etc-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea
|
||||||
|
namespace: gitea
|
||||||
|
annotations:
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 0
|
||||||
|
maxSurge: 100%
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
spec:
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1000
|
||||||
|
initContainers:
|
||||||
|
- name: init-directories
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
volumeMounts:
|
||||||
|
- name: init
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
- name: init-app-ini
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ["/usr/sbin/config_environment.sh"]
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
volumeMounts:
|
||||||
|
- name: config
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
- name: inline-config-sources
|
||||||
|
mountPath: /env-to-ini-mounts/inlines/
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
- name: configure-gitea
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
command: ["/usr/sbin/configure_gitea.sh"]
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: HOME
|
||||||
|
value: /data/gitea/git
|
||||||
|
- name: GITEA_ADMIN_USERNAME
|
||||||
|
value: "gitea_admin"
|
||||||
|
- name: GITEA_ADMIN_PASSWORD
|
||||||
|
value: "ijinc123!" # sdjo
|
||||||
|
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||||
|
value: keepUpdated
|
||||||
|
volumeMounts:
|
||||||
|
- name: init
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
terminationGracePeriodSeconds: 60
|
||||||
|
containers:
|
||||||
|
- name: gitea
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
# SSH Port values have to be set here as well for openssh configuration
|
||||||
|
- name: SSH_LISTEN_PORT
|
||||||
|
value: "2222"
|
||||||
|
- name: SSH_PORT
|
||||||
|
value: "22"
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: TMPDIR
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: HOME
|
||||||
|
value: /data/gitea/git
|
||||||
|
ports:
|
||||||
|
- name: ssh
|
||||||
|
containerPort: 2222
|
||||||
|
- name: http
|
||||||
|
containerPort: 3000
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 10
|
||||||
|
initialDelaySeconds: 200
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
timeoutSeconds: 1
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
timeoutSeconds: 1
|
||||||
|
resources:
|
||||||
|
{}
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
volumeMounts:
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: init
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea-init
|
||||||
|
defaultMode: 110
|
||||||
|
- name: config
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea
|
||||||
|
defaultMode: 110
|
||||||
|
- name: inline-config-sources
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea-inline-config
|
||||||
|
- name: temp
|
||||||
|
emptyDir: {}
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: gitea-shared-storage
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
replicas: 3
|
||||||
|
podManagementPolicy: "Parallel"
|
||||||
|
serviceName: release-name-postgresql-ha-postgresql-headless
|
||||||
|
updateStrategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-postgresql-ha
|
||||||
|
hostNetwork: false
|
||||||
|
hostIPC: false
|
||||||
|
containers:
|
||||||
|
- name: postgresql
|
||||||
|
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /pre-stop.sh
|
||||||
|
- "25"
|
||||||
|
# Auxiliary vars to populate environment variables
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: "false"
|
||||||
|
# PostgreSQL configuration
|
||||||
|
- name: POSTGRESQL_VOLUME_DIR
|
||||||
|
value: "/bitnami/postgresql"
|
||||||
|
- name: PGDATA
|
||||||
|
value: "/bitnami/postgresql/data"
|
||||||
|
- name: POSTGRES_POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: postgres-password
|
||||||
|
- name: POSTGRES_USER
|
||||||
|
value: "gitea"
|
||||||
|
- name: POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: password
|
||||||
|
- name: POSTGRES_DB
|
||||||
|
value: "gitea"
|
||||||
|
- name: POSTGRESQL_LOG_HOSTNAME
|
||||||
|
value: "true"
|
||||||
|
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||||
|
value: "false"
|
||||||
|
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||||
|
value: "false"
|
||||||
|
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||||
|
value: "off"
|
||||||
|
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||||
|
value: "error"
|
||||||
|
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||||
|
value: "pgaudit, repmgr"
|
||||||
|
- name: POSTGRESQL_ENABLE_TLS
|
||||||
|
value: "no"
|
||||||
|
- name: POSTGRESQL_PORT_NUMBER
|
||||||
|
value: "5432"
|
||||||
|
# Repmgr configuration
|
||||||
|
- name: REPMGR_PORT_NUMBER
|
||||||
|
value: "5432"
|
||||||
|
- name: REPMGR_PRIMARY_PORT
|
||||||
|
value: "5432"
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: REPMGR_UPGRADE_EXTENSION
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_PGHBA_TRUST_ALL
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_MOUNTED_CONF_DIR
|
||||||
|
value: "/bitnami/repmgr/conf"
|
||||||
|
- name: REPMGR_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: REPMGR_PARTNER_NODES
|
||||||
|
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
||||||
|
- name: REPMGR_PRIMARY_HOST
|
||||||
|
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||||
|
- name: REPMGR_NODE_NAME
|
||||||
|
value: "$(MY_POD_NAME)"
|
||||||
|
- name: REPMGR_NODE_NETWORK_NAME
|
||||||
|
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||||
|
- name: REPMGR_NODE_TYPE
|
||||||
|
value: "data"
|
||||||
|
- name: REPMGR_LOG_LEVEL
|
||||||
|
value: "NOTICE"
|
||||||
|
- name: REPMGR_CONNECT_TIMEOUT
|
||||||
|
value: "5"
|
||||||
|
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||||
|
value: "2"
|
||||||
|
- name: REPMGR_RECONNECT_INTERVAL
|
||||||
|
value: "3"
|
||||||
|
- name: REPMGR_USERNAME
|
||||||
|
value: "repmgr"
|
||||||
|
- name: REPMGR_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: repmgr-password
|
||||||
|
- name: REPMGR_DATABASE
|
||||||
|
value: "repmgr"
|
||||||
|
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||||
|
value: "5"
|
||||||
|
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||||
|
value: "1"
|
||||||
|
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||||
|
value: "30"
|
||||||
|
envFrom:
|
||||||
|
ports:
|
||||||
|
- name: postgresql
|
||||||
|
containerPort: 5432
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 6
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 6
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
||||||
|
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 375m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 384Mi
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 256Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/postgresql/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/postgresql/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/conf
|
||||||
|
subPath: repmgr-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/tmp
|
||||||
|
subPath: repmgr-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/logs
|
||||||
|
subPath: repmgr-logs-dir
|
||||||
|
- name: data
|
||||||
|
mountPath: /bitnami/postgresql
|
||||||
|
- name: hooks-scripts
|
||||||
|
mountPath: /pre-stop.sh
|
||||||
|
subPath: pre-stop.sh
|
||||||
|
- name: hooks-scripts
|
||||||
|
mountPath: /readiness-probe.sh
|
||||||
|
subPath: readiness-probe.sh
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
- name: hooks-scripts
|
||||||
|
configMap:
|
||||||
|
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
||||||
|
defaultMode: 0755
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "8Gi"
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
updateStrategy:
|
||||||
|
rollingUpdate:
|
||||||
|
partition: 0
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
replicas: 3
|
||||||
|
serviceName: release-name-redis-cluster-headless
|
||||||
|
podManagementPolicy: Parallel
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
annotations:
|
||||||
|
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
||||||
|
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||||
|
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
||||||
|
spec:
|
||||||
|
hostNetwork: false
|
||||||
|
enableServiceLinks: false
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-redis-cluster
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
containers:
|
||||||
|
- name: release-name-redis-cluster
|
||||||
|
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
command: ['/bin/bash', '-c']
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
# Backwards compatibility change
|
||||||
|
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
||||||
|
echo COPYING FILE
|
||||||
|
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
||||||
|
fi
|
||||||
|
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
||||||
|
pod_index="${pod_index[-1]}"
|
||||||
|
if [[ "$pod_index" == "0" ]]; then
|
||||||
|
export REDIS_CLUSTER_CREATOR="yes"
|
||||||
|
export REDIS_CLUSTER_REPLICAS="0"
|
||||||
|
fi
|
||||||
|
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
||||||
|
env:
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: REDIS_NODES
|
||||||
|
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
||||||
|
- name: ALLOW_EMPTY_PASSWORD
|
||||||
|
value: "yes"
|
||||||
|
- name: REDIS_AOF_ENABLED
|
||||||
|
value: "yes"
|
||||||
|
- name: REDIS_TLS_ENABLED
|
||||||
|
value: "no"
|
||||||
|
- name: REDIS_PORT_NUMBER
|
||||||
|
value: "6379"
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
containerPort: 6379
|
||||||
|
- name: tcp-redis-bus
|
||||||
|
containerPort: 16379
|
||||||
|
livenessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
# One second longer than command timeout should prevent generation of zombie processes.
|
||||||
|
timeoutSeconds: 6
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- /scripts/ping_liveness_local.sh 5
|
||||||
|
readinessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
# One second longer than command timeout should prevent generation of zombie processes.
|
||||||
|
timeoutSeconds: 2
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- /scripts/ping_readiness_local.sh 1
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 150m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 192Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 128Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: scripts
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: redis-data
|
||||||
|
mountPath: /bitnami/redis/data
|
||||||
|
subPath:
|
||||||
|
- name: default-config
|
||||||
|
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
||||||
|
subPath: redis-default.conf
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/etc/
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
volumes:
|
||||||
|
- name: scripts
|
||||||
|
configMap:
|
||||||
|
name: release-name-redis-cluster-scripts
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: default-config
|
||||||
|
configMap:
|
||||||
|
name: release-name-redis-cluster-default
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
name: redis-data
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "8Gi"
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: ing-gitea
|
||||||
|
namespace: gitea
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: gitea.nativedeck.com
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: release-name-gitea-http
|
||||||
|
port:
|
||||||
|
number: 3000
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- "gitea.nativedeck.com"
|
||||||
|
secretName: secret-gitea-ssl
|
||||||
|
|
||||||
|
|
@ -0,0 +1,172 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
sessionAffinity: None
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
# nodePort: null
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql-headless
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: false
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/headless-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster-headless
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
port: 6379
|
||||||
|
targetPort: tcp-redis
|
||||||
|
- name: tcp-redis-bus
|
||||||
|
port: 16379
|
||||||
|
targetPort: tcp-redis-bus
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/redis-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
sessionAffinity: None
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
port: 6379
|
||||||
|
targetPort: tcp-redis
|
||||||
|
protocol: TCP
|
||||||
|
nodePort: null
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/http-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-http
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
# annotations:
|
||||||
|
# {}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 3000
|
||||||
|
targetPort:
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/ssh-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-ssh
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
# annotations:
|
||||||
|
# {}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: ssh
|
||||||
|
port: 22
|
||||||
|
targetPort: 2222
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,119 @@
|
||||||
|
---
|
||||||
|
- name: openSearch test
|
||||||
|
hosts: os
|
||||||
|
remote_user: ubuntu
|
||||||
|
gather_facts: no
|
||||||
|
become: yes # get root authority
|
||||||
|
become_user: root
|
||||||
|
# Setting Valiables
|
||||||
|
vars:
|
||||||
|
cluster_name: "dp3-os"
|
||||||
|
node_roles: '["cluster_manager", "data"]'
|
||||||
|
discovery_seed_hosts: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
|
||||||
|
cluster_initial_cluster_manager_nodes: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
|
||||||
|
|
||||||
|
tasks:
|
||||||
|
- name: Updata apt cache
|
||||||
|
apt:
|
||||||
|
update_cache: yes
|
||||||
|
tags: update
|
||||||
|
|
||||||
|
- name: Install required packages
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- lsb-release
|
||||||
|
- ca-certificates
|
||||||
|
- curl
|
||||||
|
- gnupg2
|
||||||
|
state: present
|
||||||
|
tags: install
|
||||||
|
# pre settings openSearch
|
||||||
|
- name: Download OpenSearch GPG key
|
||||||
|
get_url:
|
||||||
|
url: https://artifacts.opensearch.org/publickeys/opensearch.pgp
|
||||||
|
dest: /tmp/opensearch.pgp
|
||||||
|
|
||||||
|
- name: Add OpenSearch GPG key to the keyring
|
||||||
|
command: gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring /tmp/opensearch.pgp
|
||||||
|
|
||||||
|
- name: Clean up temporary GPG key file
|
||||||
|
file:
|
||||||
|
path: /tmp/opensearch.pgp
|
||||||
|
state: absent
|
||||||
|
# Add Repo
|
||||||
|
- name: Add OpenSearch repository
|
||||||
|
copy:
|
||||||
|
dest: /etc/apt/sources.list.d/opensearch-2.x.list
|
||||||
|
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0644'
|
||||||
|
|
||||||
|
- name: Add OpenSearch Dashboards repository
|
||||||
|
copy:
|
||||||
|
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
||||||
|
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0644'
|
||||||
|
- name: Add OpenSearch repository
|
||||||
|
copy:
|
||||||
|
dest: /etc/apt/sources.list.d/opensearch-2.x.list
|
||||||
|
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0644'
|
||||||
|
|
||||||
|
- name: Add OpenSearch Dashboards repository
|
||||||
|
copy:
|
||||||
|
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
||||||
|
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
mode: '0644'
|
||||||
|
|
||||||
|
- name: Install required packages
|
||||||
|
apt:
|
||||||
|
name:
|
||||||
|
- opensearch=2.11.1
|
||||||
|
# - opensearch-dashboards=2.11.1
|
||||||
|
state: present
|
||||||
|
update_cache: yes
|
||||||
|
tags: install
|
||||||
|
|
||||||
|
# set jvm
|
||||||
|
- name: Change Xms1g to Xms#g in jvm.options
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/opensearch/jvm.options
|
||||||
|
regexp: '^-Xms1g'
|
||||||
|
line: '-Xms4g'
|
||||||
|
backup: no
|
||||||
|
tags: config
|
||||||
|
- name: Change Xmx1g to Xmx#g in jvm.options
|
||||||
|
lineinfile:
|
||||||
|
path: /etc/opensearch/jvm.options
|
||||||
|
regexp: '^-Xmx1g'
|
||||||
|
line: '-Xmx4g'
|
||||||
|
backup: no
|
||||||
|
tags: config
|
||||||
|
|
||||||
|
# set opensearcy.yml
|
||||||
|
- name: Set node name based on inventory order
|
||||||
|
set_fact:
|
||||||
|
node_name: "os-{{ play_hosts.index(inventory_hostname) + 1 }}"
|
||||||
|
|
||||||
|
- name: Deploy OpenSearch configuration file from template
|
||||||
|
template:
|
||||||
|
src: templates/opensearch.yml.j2
|
||||||
|
dest: /etc/opensearch/opensearch.yml
|
||||||
|
owner: opensearch
|
||||||
|
group: opensearch
|
||||||
|
mode: '0644'
|
||||||
|
|
||||||
|
- name: Enable and start OpenSearch service
|
||||||
|
systemd:
|
||||||
|
name: opensearch
|
||||||
|
enabled: yes
|
||||||
|
state: started
|
||||||
|
|
||||||
|
# curl -XGET https://10.163.1.51:9200/\_cat/nodes?v -u 'admin:admin' --insecure
|
||||||
|
|
@ -0,0 +1,150 @@
|
||||||
|
# ======================== OpenSearch Configuration =========================
|
||||||
|
#
|
||||||
|
# NOTE: OpenSearch comes with reasonable defaults for most settings.
|
||||||
|
# Before you set out to tweak and tune the configuration, make sure you
|
||||||
|
# understand what are you trying to accomplish and the consequences.
|
||||||
|
#
|
||||||
|
# The primary way of configuring a node is via this file. This template lists
|
||||||
|
# the most important settings you may want to configure for a production cluster.
|
||||||
|
#
|
||||||
|
# Please consult the documentation for further information on configuration options:
|
||||||
|
# https://www.opensearch.org
|
||||||
|
#
|
||||||
|
# ---------------------------------- Cluster -----------------------------------
|
||||||
|
#
|
||||||
|
# Use a descriptive name for your cluster:
|
||||||
|
#
|
||||||
|
cluster.name: {{ cluster_name }}
|
||||||
|
#
|
||||||
|
# ------------------------------------ Node ------------------------------------
|
||||||
|
#
|
||||||
|
# Use a descriptive name for the node:
|
||||||
|
#
|
||||||
|
node.name: {{ node_name }}
|
||||||
|
node.roles: {{ node_roles }}
|
||||||
|
#
|
||||||
|
# Add custom attributes to the node:
|
||||||
|
#
|
||||||
|
#node.attr.rack: r1
|
||||||
|
#
|
||||||
|
# ----------------------------------- Paths ------------------------------------
|
||||||
|
#
|
||||||
|
# Path to directory where to store the data (separate multiple locations by comma):
|
||||||
|
#
|
||||||
|
path.data: /var/lib/opensearch
|
||||||
|
#
|
||||||
|
# Path to log files:
|
||||||
|
#
|
||||||
|
path.logs: /var/log/opensearch
|
||||||
|
#
|
||||||
|
# ----------------------------------- Memory -----------------------------------
|
||||||
|
#
|
||||||
|
# Lock the memory on startup:
|
||||||
|
#
|
||||||
|
#bootstrap.memory_lock: true
|
||||||
|
#
|
||||||
|
# Make sure that the heap size is set to about half the memory available
|
||||||
|
# on the system and that the owner of the process is allowed to use this
|
||||||
|
# limit.
|
||||||
|
#
|
||||||
|
# OpenSearch performs poorly when the system is swapping the memory.
|
||||||
|
#
|
||||||
|
# ---------------------------------- Network -----------------------------------
|
||||||
|
#
|
||||||
|
# Set the bind address to a specific IP (IPv4 or IPv6):
|
||||||
|
#
|
||||||
|
network.host: 0.0.0.0
|
||||||
|
#
|
||||||
|
# Set a custom port for HTTP:
|
||||||
|
#
|
||||||
|
http.port: 9200
|
||||||
|
transport.port: 9300
|
||||||
|
#
|
||||||
|
# For more information, consult the network module documentation.
|
||||||
|
#
|
||||||
|
# --------------------------------- Discovery ----------------------------------
|
||||||
|
#
|
||||||
|
# Pass an initial list of hosts to perform discovery when this node is started:
|
||||||
|
# The default list of hosts is ["127.0.0.1", "[::1]"]
|
||||||
|
#
|
||||||
|
discovery.seed_hosts: {{ discovery_seed_hosts }}
|
||||||
|
#
|
||||||
|
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
|
||||||
|
#
|
||||||
|
cluster.initial_cluster_manager_nodes: {{ cluster_initial_cluster_manager_nodes }}
|
||||||
|
#
|
||||||
|
# For more information, consult the discovery and cluster formation module documentation.
|
||||||
|
#
|
||||||
|
# ---------------------------------- Gateway -----------------------------------
|
||||||
|
#
|
||||||
|
# Block initial recovery after a full cluster restart until N nodes are started:
|
||||||
|
#
|
||||||
|
#gateway.recover_after_nodes: 3
|
||||||
|
#
|
||||||
|
# For more information, consult the gateway module documentation.
|
||||||
|
#
|
||||||
|
# ---------------------------------- Various -----------------------------------
|
||||||
|
#
|
||||||
|
# Require explicit names when deleting indices:
|
||||||
|
#
|
||||||
|
#action.destructive_requires_name: true
|
||||||
|
#
|
||||||
|
# ---------------------------------- Remote Store -----------------------------------
|
||||||
|
# Controls whether cluster imposes index creation only with remote store enabled
|
||||||
|
# cluster.remote_store.enabled: true
|
||||||
|
#
|
||||||
|
# Repository to use for segment upload while enforcing remote store for an index
|
||||||
|
# node.attr.remote_store.segment.repository: my-repo-1
|
||||||
|
#
|
||||||
|
# Repository to use for translog upload while enforcing remote store for an index
|
||||||
|
# node.attr.remote_store.translog.repository: my-repo-1
|
||||||
|
#
|
||||||
|
# ---------------------------------- Experimental Features -----------------------------------
|
||||||
|
# Gates the visibility of the experimental segment replication features until they are production ready.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
|
||||||
|
#
|
||||||
|
# Gates the functionality of a new parameter to the snapshot restore API
|
||||||
|
# that allows for creation of a new index type that searches a snapshot
|
||||||
|
# directly in a remote repository without restoring all index data to disk
|
||||||
|
# ahead of time.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.searchable_snapshot.enabled: false
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Gates the functionality of enabling extensions to work with OpenSearch.
|
||||||
|
# This feature enables applications to extend features of OpenSearch outside of
|
||||||
|
# the core.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.extensions.enabled: false
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
|
||||||
|
# index searcher threadpool.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
|
||||||
|
|
||||||
|
######## Start OpenSearch Security Demo Configuration ########
|
||||||
|
# WARNING: revise all the lines below before you go into production
|
||||||
|
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
|
||||||
|
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
|
||||||
|
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
|
||||||
|
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||||
|
plugins.security.ssl.http.enabled: true
|
||||||
|
plugins.security.ssl.http.pemcert_filepath: esnode.pem
|
||||||
|
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
|
||||||
|
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
|
||||||
|
plugins.security.allow_unsafe_democertificates: true
|
||||||
|
plugins.security.allow_default_init_securityindex: true
|
||||||
|
plugins.security.authcz.admin_dn:
|
||||||
|
- CN=kirk,OU=client,O=client,L=test, C=de
|
||||||
|
|
||||||
|
plugins.security.audit.type: internal_opensearch
|
||||||
|
plugins.security.enable_snapshot_restore_privilege: true
|
||||||
|
plugins.security.check_snapshot_restore_write_privileges: true
|
||||||
|
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
||||||
|
plugins.security.system_indices.enabled: true
|
||||||
|
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
||||||
|
node.max_local_storage_nodes: 3
|
||||||
|
######## End OpenSearch Security Demo Configuration ########
|
||||||
|
plugins.security.disabled: false
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: ing-os-dash
|
||||||
|
namespace: logging
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: os-dash.nativedeck.com
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: release-name-opensearch-dashboards
|
||||||
|
port:
|
||||||
|
number: 5601
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- os-dash.nativedeck.com
|
||||||
|
secretName: secret-logging-ssl
|
||||||
|
|
@ -0,0 +1,140 @@
|
||||||
|
---
|
||||||
|
# Source: opensearch-dashboards/templates/serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: release-name-opensearch-dashboards-dashboards
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: opensearch-dashboards
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "2.11.1"
|
||||||
|
---
|
||||||
|
# Source: opensearch-dashboards/templates/rolebinding.yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: opensearch-dashboards
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "2.11.1"
|
||||||
|
name: release-name-opensearch-dashboards-dashboards-rolebinding
|
||||||
|
namespace: logging
|
||||||
|
roleRef:
|
||||||
|
kind: Role
|
||||||
|
name: release-name-opensearch-dashboards-dashboards
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: release-name-opensearch-dashboards-dashboards
|
||||||
|
namespace: logging
|
||||||
|
---
|
||||||
|
# Source: opensearch-dashboards/templates/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-opensearch-dashboards
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: opensearch-dashboards
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "2.11.1"
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- port: 5601
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
targetPort: 5601
|
||||||
|
selector:
|
||||||
|
app: opensearch-dashboards
|
||||||
|
release: "release-name"
|
||||||
|
---
|
||||||
|
# Source: opensearch-dashboards/templates/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: release-name-opensearch-dashboards
|
||||||
|
namespace: logging
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: opensearch-dashboards
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "2.11.1"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: opensearch-dashboards
|
||||||
|
release: "release-name"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: opensearch-dashboards
|
||||||
|
release: "release-name"
|
||||||
|
annotations:
|
||||||
|
spec:
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
serviceAccountName: release-name-opensearch-dashboards-dashboards
|
||||||
|
volumes:
|
||||||
|
containers:
|
||||||
|
- name: dashboards
|
||||||
|
securityContext:
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1000
|
||||||
|
#image: "opensearchproject/opensearch-dashboards:2.13.0"
|
||||||
|
image: "opensearchproject/opensearch-dashboards:2.11.1"
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 10
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 20
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: 5601
|
||||||
|
timeoutSeconds: 5
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 10
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 20
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: 5601
|
||||||
|
timeoutSeconds: 5
|
||||||
|
startupProbe:
|
||||||
|
failureThreshold: 20
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: 5601
|
||||||
|
timeoutSeconds: 5
|
||||||
|
env:
|
||||||
|
- name: OPENSEARCH_HOSTS
|
||||||
|
value: "https://10.163.1.66:9200"
|
||||||
|
#value: "https://opensearch-cluster-master:9200"
|
||||||
|
- name: SERVER_HOST
|
||||||
|
value: "0.0.0.0"
|
||||||
|
#- name: SERVER_BASEPATH
|
||||||
|
# value: "/os"
|
||||||
|
- name: OPENSEARCH_USERNAME
|
||||||
|
value: "admin"
|
||||||
|
- name: OPENSEARCH_PASSWORD
|
||||||
|
value: "admin"
|
||||||
|
ports:
|
||||||
|
- containerPort: 5601
|
||||||
|
name: http
|
||||||
|
protocol: TCP
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 512M
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 512M
|
||||||
|
#volumeMounts:
|
||||||
|
|
@ -0,0 +1,367 @@
|
||||||
|
# OpenSearch
|
||||||
|
## QuicStart
|
||||||
|
## Install OpenSearch from an APT repository
|
||||||
|
### Install the necessary packages.
|
||||||
|
```bash
|
||||||
|
sudo apt-get update && sudo apt-get -y install lsb-release ca-certificates curl gnupg2
|
||||||
|
```
|
||||||
|
### Import the public GPG key. This key is used to verify that the APT repository is signed.
|
||||||
|
```bash
|
||||||
|
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring
|
||||||
|
```
|
||||||
|
### Create an APT repository for OpenSearch
|
||||||
|
```bash
|
||||||
|
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-2.x.list
|
||||||
|
```
|
||||||
|
|
||||||
|
### Create an APT repository for OpenSearch-Dashboard
|
||||||
|
```bash
|
||||||
|
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
||||||
|
```
|
||||||
|
|
||||||
|
### Verify that the repository was created successfully.
|
||||||
|
```bash
|
||||||
|
sudo apt-get update
|
||||||
|
```
|
||||||
|
설치 가능 패키지 확인
|
||||||
|
```bash
|
||||||
|
apt-cache madison opensearch
|
||||||
|
```
|
||||||
|
확인결과
|
||||||
|
```bash
|
||||||
|
opensearch | 2.13.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.12.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.11.1 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.11.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.10.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.9.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.8.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.7.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.6.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
opensearch | 2.5.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||||
|
```
|
||||||
|
|
||||||
|
### Choose the version of OpenSearch you want to install:
|
||||||
|
> Unless otherwise indicated, the latest available version of OpenSearch is installed.
|
||||||
|
|
||||||
|
항상 최신 버전 설치
|
||||||
|
```bash
|
||||||
|
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
|
||||||
|
# Use one of the following commands to define a custom admin password:
|
||||||
|
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch
|
||||||
|
|
||||||
|
# Use the following command for OpenSearch versions 2.11 and earlier:
|
||||||
|
sudo apt-get install opensearch
|
||||||
|
```
|
||||||
|
|
||||||
|
버전 지정 설치방법
|
||||||
|
```bash
|
||||||
|
# Specify the version manually using opensearch=<version>
|
||||||
|
|
||||||
|
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
|
||||||
|
# Use one of the following commands to define a custom admin password:
|
||||||
|
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch=2.13.0
|
||||||
|
|
||||||
|
# Use the following command for OpenSearch versions 2.11 and earlier:
|
||||||
|
sudo apt-get install opensearch=2.13.0
|
||||||
|
```
|
||||||
|
|
||||||
|
### MultiMaster Setting
|
||||||
|
```bash
|
||||||
|
/etc/opensearch/opensearch.yml
|
||||||
|
```
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
cluster.name: os_cluster_name
|
||||||
|
node.name: os1 # os2 , os3
|
||||||
|
node.roles: ["cluster_manager", "data"]
|
||||||
|
path.data: /var/lib/opensearch
|
||||||
|
path.logs: /var/log/opensearch
|
||||||
|
network.host: 0.0.0.0
|
||||||
|
http.port: 9200
|
||||||
|
transport.port: 9300
|
||||||
|
discovery.seed_hosts: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
|
||||||
|
cluster.initial_cluster_manager_nodes: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
|
||||||
|
node.max_local_storage_nodes: 3
|
||||||
|
plugins.security.disabled: true
|
||||||
|
```
|
||||||
|
### Specify initial and maximum JVM heap sizes.
|
||||||
|
Open jvm.options
|
||||||
|
```bash
|
||||||
|
vi /etc/opensearch/jvm.options
|
||||||
|
```
|
||||||
|
Modify the values for initial and maximum heap sizes. As a starting point, you should set these values to half of the available system memory. For dedicated hosts this value can be increased based on your workflow requirements.
|
||||||
|
As an example, if the host machine has 8 GB of memory, then you might want to set the initial and maximum heap sizes to 4 GB:
|
||||||
|
```bash
|
||||||
|
-Xms4g
|
||||||
|
-Xmx4g
|
||||||
|
```
|
||||||
|
Save your changes and close the file.
|
||||||
|
### Naver Cloud LB 설정
|
||||||
|
멀티마스터 구성시 사설인증서로 Offloading 설정하여 진행.
|
||||||
|
Network Proxy LoadBalancer에서 동작 검증완료.
|
||||||
|
> 내부 인증서 처리 방식이 좀 까다로워 테스트 하다 오프로딩으로 전환.
|
||||||
|
|
||||||
|
## Reference
|
||||||
|
[link1](https://opster.com/guides/opensearch/opensearch-data-architecture/how-to-configure-opensearch-node-roles/) 국외자료
|
||||||
|
[link2](https://developer-jp.tistory.com/33) 국내자료
|
||||||
|
[link3](https://opensearch.org/docs/latest/install-and-configure/install-opensearch/debian/) 공식자료
|
||||||
|
|
||||||
|
---
|
||||||
|
## SingeNode 적용 예시
|
||||||
|
아래 내용참조. SingleNode는 SSL 설정도 까다롭지 않음.
|
||||||
|
```yaml
|
||||||
|
vi /etc/opensearch/opensearch.yml
|
||||||
|
```
|
||||||
|
```yaml
|
||||||
|
# ======================== OpenSearch Configuration =========================
|
||||||
|
#
|
||||||
|
# NOTE: OpenSearch comes with reasonable defaults for most settings.
|
||||||
|
# Before you set out to tweak and tune the configuration, make sure you
|
||||||
|
# understand what are you trying to accomplish and the consequences.
|
||||||
|
#
|
||||||
|
# The primary way of configuring a node is via this file. This template lists
|
||||||
|
# the most important settings you may want to configure for a production cluster.
|
||||||
|
#
|
||||||
|
# Please consult the documentation for further information on configuration options:
|
||||||
|
# https://www.opensearch.org
|
||||||
|
#
|
||||||
|
# ---------------------------------- Cluster -----------------------------------
|
||||||
|
#
|
||||||
|
# Use a descriptive name for your cluster:
|
||||||
|
#
|
||||||
|
#cluster.name: my-application
|
||||||
|
#
|
||||||
|
# ------------------------------------ Node ------------------------------------
|
||||||
|
#
|
||||||
|
# Use a descriptive name for the node:
|
||||||
|
#
|
||||||
|
#node.name: node-1
|
||||||
|
#
|
||||||
|
# Add custom attributes to the node:
|
||||||
|
#
|
||||||
|
#node.attr.rack: r1
|
||||||
|
#
|
||||||
|
# ----------------------------------- Paths ------------------------------------
|
||||||
|
#
|
||||||
|
# Path to directory where to store the data (separate multiple locations by comma):
|
||||||
|
#
|
||||||
|
path.data: /var/lib/opensearch
|
||||||
|
#
|
||||||
|
# Path to log files:
|
||||||
|
#
|
||||||
|
path.logs: /var/log/opensearch
|
||||||
|
#
|
||||||
|
# ----------------------------------- Memory -----------------------------------
|
||||||
|
#
|
||||||
|
# Lock the memory on startup:
|
||||||
|
#
|
||||||
|
#bootstrap.memory_lock: true
|
||||||
|
#
|
||||||
|
# Make sure that the heap size is set to about half the memory available
|
||||||
|
# on the system and that the owner of the process is allowed to use this
|
||||||
|
# limit.
|
||||||
|
#
|
||||||
|
# OpenSearch performs poorly when the system is swapping the memory.
|
||||||
|
#
|
||||||
|
# ---------------------------------- Network -----------------------------------
|
||||||
|
#
|
||||||
|
# Set the bind address to a specific IP (IPv4 or IPv6):
|
||||||
|
#
|
||||||
|
#network.host: 192.168.0.1
|
||||||
|
#
|
||||||
|
# Set a custom port for HTTP:
|
||||||
|
#
|
||||||
|
#http.port: 9200
|
||||||
|
#
|
||||||
|
# For more information, consult the network module documentation.
|
||||||
|
#
|
||||||
|
# --------------------------------- Discovery ----------------------------------
|
||||||
|
#
|
||||||
|
# Pass an initial list of hosts to perform discovery when this node is started:
|
||||||
|
# The default list of hosts is ["127.0.0.1", "[::1]"]
|
||||||
|
#
|
||||||
|
#discovery.seed_hosts: ["host1", "host2"]
|
||||||
|
#
|
||||||
|
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
|
||||||
|
#
|
||||||
|
#cluster.initial_cluster_manager_nodes: ["node-1", "node-2"]
|
||||||
|
#
|
||||||
|
# For more information, consult the discovery and cluster formation module documentation.
|
||||||
|
#
|
||||||
|
# ---------------------------------- Gateway -----------------------------------
|
||||||
|
#
|
||||||
|
# Block initial recovery after a full cluster restart until N nodes are started:
|
||||||
|
#
|
||||||
|
#gateway.recover_after_nodes: 3
|
||||||
|
#
|
||||||
|
# For more information, consult the gateway module documentation.
|
||||||
|
#
|
||||||
|
# ---------------------------------- Various -----------------------------------
|
||||||
|
#
|
||||||
|
# Require explicit names when deleting indices:
|
||||||
|
#
|
||||||
|
#action.destructive_requires_name: true
|
||||||
|
#
|
||||||
|
# ---------------------------------- Remote Store -----------------------------------
|
||||||
|
# Controls whether cluster imposes index creation only with remote store enabled
|
||||||
|
# cluster.remote_store.enabled: true
|
||||||
|
#
|
||||||
|
# Repository to use for segment upload while enforcing remote store for an index
|
||||||
|
# node.attr.remote_store.segment.repository: my-repo-1
|
||||||
|
#
|
||||||
|
# Repository to use for translog upload while enforcing remote store for an index
|
||||||
|
# node.attr.remote_store.translog.repository: my-repo-1
|
||||||
|
#
|
||||||
|
# ---------------------------------- Experimental Features -----------------------------------
|
||||||
|
# Gates the visibility of the experimental segment replication features until they are production ready.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
|
||||||
|
#
|
||||||
|
# Gates the functionality of a new parameter to the snapshot restore API
|
||||||
|
# that allows for creation of a new index type that searches a snapshot
|
||||||
|
# directly in a remote repository without restoring all index data to disk
|
||||||
|
# ahead of time.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.searchable_snapshot.enabled: false
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Gates the functionality of enabling extensions to work with OpenSearch.
|
||||||
|
# This feature enables applications to extend features of OpenSearch outside of
|
||||||
|
# the core.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.extensions.enabled: false
|
||||||
|
#
|
||||||
|
#
|
||||||
|
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
|
||||||
|
# index searcher threadpool.
|
||||||
|
#
|
||||||
|
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
|
||||||
|
|
||||||
|
######## Start OpenSearch Security Demo Configuration ########
|
||||||
|
# 키정보는 openssl로 생성해서 교체해도 됨.
|
||||||
|
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
|
||||||
|
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
|
||||||
|
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
|
||||||
|
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||||
|
plugins.security.ssl.http.enabled: true
|
||||||
|
plugins.security.ssl.http.pemcert_filepath: esnode.pem
|
||||||
|
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
|
||||||
|
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
|
||||||
|
plugins.security.allow_unsafe_democertificates: true # 데모아니면 불필요
|
||||||
|
plugins.security.allow_default_init_securityindex: true #이건 모르겠음
|
||||||
|
plugins.security.authcz.admin_dn:
|
||||||
|
- CN=kirk,OU=client,O=client,L=test, C=de
|
||||||
|
|
||||||
|
plugins.security.audit.type: internal_opensearch
|
||||||
|
plugins.security.enable_snapshot_restore_privilege: true
|
||||||
|
plugins.security.check_snapshot_restore_write_privileges: true
|
||||||
|
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
||||||
|
plugins.security.system_indices.enabled: true
|
||||||
|
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
||||||
|
node.max_local_storage_nodes: 3
|
||||||
|
######## End OpenSearch Security Demo Configuration ########
|
||||||
|
# Bind OpenSearch to the correct network interface. Use 0.0.0.0
|
||||||
|
# to include all available interfaces or specify an IP address
|
||||||
|
# assigned to a specific interface.
|
||||||
|
network.host: 0.0.0.0
|
||||||
|
|
||||||
|
# Unless you have already configured a cluster, you should set
|
||||||
|
# discovery.type to single-node, or the bootstrap checks will
|
||||||
|
# fail when you try to start the service.
|
||||||
|
discovery.type: single-node
|
||||||
|
|
||||||
|
# If you previously disabled the Security plugin in opensearch.yml,
|
||||||
|
# be sure to re-enable it. Otherwise you can skip this setting.
|
||||||
|
plugins.security.disabled: false # false가 기능활성임.
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Password Change
|
||||||
|
multimaster 설정 과정에 대하여 기술함.
|
||||||
|
|
||||||
|
> 기존에 생성했던 인증서를 노드별로 적용하는 과정을 거쳐서 테스트를 진행하였음.
|
||||||
|
|
||||||
|
[참고자료](https://opensearch.org/docs/latest/security/configuration/generate-certificates/)
|
||||||
|
|
||||||
|
사용했던 실제 스크립트
|
||||||
|
```sh
|
||||||
|
#!/bin/sh
|
||||||
|
# Root CA
|
||||||
|
openssl genrsa -out root-ca-key.pem 2048
|
||||||
|
openssl req -new -x509 -sha256 -key root-ca-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=root.dns.a-record" -out root-ca.pem -days 730
|
||||||
|
# Admin cert
|
||||||
|
openssl genrsa -out admin-key-temp.pem 2048
|
||||||
|
openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem
|
||||||
|
openssl req -new -key admin-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=A" -out admin.csr
|
||||||
|
openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 730
|
||||||
|
# Node cert 1
|
||||||
|
openssl genrsa -out os1-key-temp.pem 2048
|
||||||
|
openssl pkcs8 -inform PEM -outform PEM -in os1-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os1-key.pem
|
||||||
|
openssl req -new -key os1-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os1.dns.a-record" -out os1.csr
|
||||||
|
echo 'subjectAltName=DNS:os1.dns.a-record' > os1.ext
|
||||||
|
openssl x509 -req -in os1.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os1.pem -days 730 -extfile os1.ext
|
||||||
|
# Node cert 2
|
||||||
|
openssl genrsa -out os2-key-temp.pem 2048
|
||||||
|
openssl pkcs8 -inform PEM -outform PEM -in os2-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os2-key.pem
|
||||||
|
openssl req -new -key os2-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os2.dns.a-record" -out os2.csr
|
||||||
|
echo 'subjectAltName=DNS:os2.dns.a-record' > os2.ext
|
||||||
|
openssl x509 -req -in os2.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os2.pem -days 730 -extfile os2.ext
|
||||||
|
# Node cert 3
|
||||||
|
openssl genrsa -out os3-key-temp.pem 2048
|
||||||
|
openssl pkcs8 -inform PEM -outform PEM -in os3-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os3-key.pem
|
||||||
|
openssl req -new -key os3-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os3.dns.a-record" -out os3.csr
|
||||||
|
echo 'subjectAltName=DNS:os3.dns.a-record' > os3.ext
|
||||||
|
openssl x509 -req -in os3.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os3.pem -days 730 -extfile os3.ext
|
||||||
|
# Cleanup
|
||||||
|
rm admin-key-temp.pem
|
||||||
|
rm admin.csr
|
||||||
|
rm os1-key-temp.pem
|
||||||
|
rm os1.csr
|
||||||
|
rm os1.ext
|
||||||
|
rm os2-key-temp.pem
|
||||||
|
rm os2.csr
|
||||||
|
rm os2.ext
|
||||||
|
rm os3-key-temp.pem
|
||||||
|
rm os3.csr
|
||||||
|
rm os3.ext
|
||||||
|
```
|
||||||
|
|
||||||
|
### 설정했던 opensearch.yml
|
||||||
|
```bash
|
||||||
|
cluster.name: my-application
|
||||||
|
node.name: os1
|
||||||
|
node.roles: ["cluster_manager", "data"]
|
||||||
|
path.data: /var/lib/opensearch
|
||||||
|
path.logs: /var/log/opensearch
|
||||||
|
network.host: 0.0.0.0
|
||||||
|
http.port: 9200
|
||||||
|
transport.port: 9300
|
||||||
|
discovery.seed_hosts: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
|
||||||
|
cluster.initial_cluster_manager_nodes: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
|
||||||
|
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
|
||||||
|
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
|
||||||
|
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
|
||||||
|
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||||
|
plugins.security.ssl.http.enabled: true
|
||||||
|
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
|
||||||
|
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
|
||||||
|
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
|
||||||
|
plugins.security.allow_unsafe_democertificates: true
|
||||||
|
plugins.security.allow_default_init_securityindex: true
|
||||||
|
plugins.security.authcz.admin_dn:
|
||||||
|
- 'CN=A,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||||
|
plugins.security.nodes_dn:
|
||||||
|
- 'CN=os1.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||||
|
- 'CN=os2.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||||
|
- 'CN=os3.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||||
|
plugins.security.audit.type: internal_opensearch
|
||||||
|
plugins.security.enable_snapshot_restore_privilege: true
|
||||||
|
plugins.security.check_snapshot_restore_write_privileges: true
|
||||||
|
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
||||||
|
plugins.security.system_indices.enabled: true
|
||||||
|
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
||||||
|
node.max_local_storage_nodes: 3
|
||||||
|
plugins.security.disabled: false
|
||||||
|
```
|
||||||
|
|
@ -308,4 +308,4 @@ metadata:
|
||||||
release: harbor
|
release: harbor
|
||||||
name: harbor-trivy
|
name: harbor-trivy
|
||||||
namespace: harbor
|
namespace: harbor
|
||||||
type: Opaque
|
type: Opaque
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue