init gitea, opensearch
This commit is contained in:
root
parent
a08d78a154
commit
5bfbf1250e
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: gitea
|
||||
labels:
|
||||
kubernetes.io/metadata.name: gitea
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: pgpool
|
||||
role: data
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 5432
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 5432
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
# Allow inbound connections
|
||||
- ports:
|
||||
- port: 6379
|
||||
- port: 16379
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql-witness
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/poddisruptionbudget.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
matchExpressions:
|
||||
- {key: job-name, operator: NotIn, values: [release-name-redis-cluster-cluster-update]}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: release-name-postgresql-ha
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/redis-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
automountServiceAccountToken: false
|
||||
|
|
@ -0,0 +1,384 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
type: Opaque
|
||||
data:
|
||||
admin-password: "aWppbmMxMjMh"
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
type: Opaque
|
||||
data:
|
||||
postgres-password: "aWppbmMxMjMh"
|
||||
password: "Z2l0ZWE="
|
||||
repmgr-password: "aWppbmMxMjMh"
|
||||
---
|
||||
# Source: gitea/templates/gitea/config.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea-inline-config
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
_generals_: ""
|
||||
cache: |-
|
||||
ADAPTER=redis
|
||||
HOST=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
database: |-
|
||||
DB_TYPE=postgres
|
||||
HOST=release-name-postgresql-ha-pgpool.gitea.svc.cluster.local:5432
|
||||
NAME=gitea
|
||||
PASSWD=gitea
|
||||
USER=gitea
|
||||
indexer: ISSUE_INDEXER_TYPE=db
|
||||
metrics: ENABLED=false
|
||||
queue: |-
|
||||
CONN_STR=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
TYPE=redis
|
||||
repository: ROOT=/data/git/gitea-repositories
|
||||
security: INSTALL_LOCK=true
|
||||
server: |-
|
||||
APP_DATA_PATH=/data
|
||||
DOMAIN=gitea.nativedeck.com
|
||||
ENABLE_PPROF=false
|
||||
HTTP_PORT=3000
|
||||
PROTOCOL=http
|
||||
ROOT_URL=http://gitea.nativedeck.com
|
||||
SSH_DOMAIN=gitea.nativedeck.com
|
||||
SSH_LISTEN_PORT=2222
|
||||
SSH_PORT=22
|
||||
START_SSH_SERVER=true
|
||||
session: |-
|
||||
PROVIDER=redis
|
||||
PROVIDER_CONFIG=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
---
|
||||
# Source: gitea/templates/gitea/config.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
assertions: |
|
||||
config_environment.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
function env2ini::log() {
|
||||
printf "${1}\n"
|
||||
}
|
||||
|
||||
function env2ini::read_config_to_env() {
|
||||
local section="${1}"
|
||||
local line="${2}"
|
||||
|
||||
if [[ -z "${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '${setting}'"
|
||||
|
||||
if [[ -z "${section}" ]]; then
|
||||
export "GITEA____${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
return
|
||||
fi
|
||||
|
||||
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||
masked_section="${masked_section//-/_0X2D_}"
|
||||
|
||||
export "GITEA__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
}
|
||||
|
||||
function env2ini::reload_preset_envs() {
|
||||
env2ini::log "Reloading preset envs..."
|
||||
|
||||
while read -r line; do
|
||||
if [[ -z "${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '${setting}'"
|
||||
|
||||
export "${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
done < "/tmp/existing-envs"
|
||||
|
||||
rm /tmp/existing-envs
|
||||
}
|
||||
|
||||
|
||||
function env2ini::process_config_file() {
|
||||
local config_file="${1}"
|
||||
local section="$(basename "${config_file}")"
|
||||
|
||||
if [[ $section == '_generals_' ]]; then
|
||||
env2ini::log " [ini root]"
|
||||
section=''
|
||||
else
|
||||
env2ini::log " ${section}"
|
||||
fi
|
||||
|
||||
while read -r line; do
|
||||
env2ini::read_config_to_env "${section}" "${line}"
|
||||
done < <(awk 1 "${config_file}") # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
|
||||
}
|
||||
|
||||
function env2ini::load_config_sources() {
|
||||
local path="${1}"
|
||||
|
||||
if [[ -d "${path}" ]]; then
|
||||
env2ini::log "Processing $(basename "${path}")..."
|
||||
|
||||
while read -d '' configFile; do
|
||||
env2ini::process_config_file "${configFile}"
|
||||
done < <(find "${path}" -type l -not -name '..data' -print0)
|
||||
|
||||
env2ini::log "\n"
|
||||
fi
|
||||
}
|
||||
|
||||
function env2ini::generate_initial_secrets() {
|
||||
# These environment variables will either be
|
||||
# - overwritten with user defined values,
|
||||
# - initially used to set up Gitea
|
||||
# Anyway, they won't harm existing app.ini files
|
||||
|
||||
export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||
export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
|
||||
export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
|
||||
export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
|
||||
|
||||
env2ini::log "...Initial secrets generated\n"
|
||||
}
|
||||
|
||||
# save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
|
||||
env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > /tmp/existing-envs
|
||||
|
||||
# MUST BE CALLED BEFORE OTHER CONFIGURATION
|
||||
env2ini::generate_initial_secrets
|
||||
|
||||
env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
|
||||
env2ini::load_config_sources '/env-to-ini-mounts/additionals/'
|
||||
|
||||
# load existing envs to override auto generated envs
|
||||
env2ini::reload_preset_envs
|
||||
|
||||
env2ini::log "=== All configuration sources loaded ===\n"
|
||||
|
||||
# safety to prevent rewrite of secret keys if an app.ini already exists
|
||||
if [ -f ${GITEA_APP_INI} ]; then
|
||||
env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
|
||||
env2ini::log ' - security.INTERNAL_TOKEN'
|
||||
env2ini::log ' - security.SECRET_KEY'
|
||||
env2ini::log ' - oauth2.JWT_SECRET'
|
||||
env2ini::log ' - server.LFS_JWT_SECRET'
|
||||
|
||||
unset GITEA__SECURITY__INTERNAL_TOKEN
|
||||
unset GITEA__SECURITY__SECRET_KEY
|
||||
unset GITEA__OAUTH2__JWT_SECRET
|
||||
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||
fi
|
||||
|
||||
environment-to-ini -o $GITEA_APP_INI
|
||||
---
|
||||
# Source: gitea/templates/gitea/init.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea-init
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
configure_gpg_environment.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
set -eu
|
||||
|
||||
gpg --batch --import /raw/private.asc
|
||||
init_directory_structure.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
|
||||
|
||||
|
||||
configure_gitea.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||
|
||||
{ # try
|
||||
gitea migrate
|
||||
} || { # catch
|
||||
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||
exit 1
|
||||
}
|
||||
function test_redis_connection() {
|
||||
local RETRY=0
|
||||
local MAX=30
|
||||
|
||||
echo 'Wait for redis to become avialable...'
|
||||
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||
nc -vz -w2 release-name-redis-cluster-headless.gitea.svc.cluster.local 6379 && break
|
||||
RETRY=$[${RETRY}+1]
|
||||
echo "...not ready yet (${RETRY}/${MAX})"
|
||||
done
|
||||
|
||||
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||
echo "Redis not reachable after '${MAX}' attempts!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_redis_connection
|
||||
function configure_admin_user() {
|
||||
local full_admin_list=$(gitea admin user list --admin)
|
||||
local actual_user_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-chart/issues."
|
||||
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||
echo "--"
|
||||
echo "${full_admin_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||
local -a create_args
|
||||
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain")
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||
create_args+=(--must-change-password=true)
|
||||
else
|
||||
create_args+=(--must-change-password=false)
|
||||
fi
|
||||
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||
gitea admin user create "${create_args[@]}"
|
||||
echo '...created.'
|
||||
else
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||
# See https://gitea.com/gitea/helm-chart/issues/673
|
||||
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||
# should add it to prevent requiring frequent admin password resets.
|
||||
local -a change_args
|
||||
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||
change_args+=(--must-change-password=false)
|
||||
fi
|
||||
gitea admin user change-password "${change_args[@]}"
|
||||
echo '...password sync done.'
|
||||
else
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
configure_admin_user
|
||||
|
||||
function configure_ldap() {
|
||||
echo 'no ldap configuration... skipping.'
|
||||
}
|
||||
|
||||
configure_ldap
|
||||
|
||||
function configure_oauth() {
|
||||
echo 'no oauth configuration... skipping.'
|
||||
}
|
||||
|
||||
configure_oauth
|
||||
|
||||
echo '==== END GITEA CONFIGURATION ===='
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
# Source: gitea/templates/gitea/pvc.yaml
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: gitea-shared-storage
|
||||
namespace: gitea
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
volumeMode: Filesystem
|
||||
resources:
|
||||
requests:
|
||||
storage: 200Gi # default: 10Gi
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# Need To Change
|
||||
## Secret File
|
||||
* DOMAIN
|
||||
* ROOT_URL
|
||||
* SSH_DOMAIN
|
||||
* ###-password : aWppbmMxMjMh
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,815 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-postgresql-ha
|
||||
# Auxiliary vars to populate environment variables
|
||||
containers:
|
||||
- name: pgpool
|
||||
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: "false"
|
||||
- name: PGPOOL_BACKEND_NODES
|
||||
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
||||
- name: PGPOOL_SR_CHECK_USER
|
||||
value: "repmgr"
|
||||
- name: PGPOOL_SR_CHECK_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: repmgr-password
|
||||
- name: PGPOOL_SR_CHECK_DATABASE
|
||||
value: "postgres"
|
||||
- name: PGPOOL_ENABLE_LDAP
|
||||
value: "no"
|
||||
- name: PGPOOL_POSTGRES_USERNAME
|
||||
value: "gitea"
|
||||
- name: PGPOOL_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: password
|
||||
- name: PGPOOL_ADMIN_USERNAME
|
||||
value: "admin"
|
||||
- name: PGPOOL_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
key: admin-password
|
||||
- name: PGPOOL_AUTHENTICATION_METHOD
|
||||
value: "scram-sha-256"
|
||||
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
||||
value: "yes"
|
||||
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
||||
value: "transaction"
|
||||
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
||||
value: "no"
|
||||
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
||||
value: "yes"
|
||||
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
||||
value: "no"
|
||||
- name: PGPOOL_RESERVED_CONNECTIONS
|
||||
value: '1'
|
||||
- name: PGPOOL_CHILD_LIFE_TIME
|
||||
value: ""
|
||||
- name: PGPOOL_ENABLE_TLS
|
||||
value: "no"
|
||||
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
||||
value: "6"
|
||||
envFrom:
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: 5432
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||
readinessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
||||
resources:
|
||||
limits:
|
||||
cpu: 375m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 384Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/etc
|
||||
subPath: app-etc-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/logs
|
||||
subPath: app-logs-dir
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
---
|
||||
# Source: gitea/templates/gitea/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: release-name-gitea
|
||||
namespace: gitea
|
||||
annotations:
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 0
|
||||
maxSurge: 100%
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
spec:
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: init-directories
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
securityContext:
|
||||
{}
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: init-app-ini
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/config_environment.sh"]
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
|
||||
securityContext:
|
||||
{}
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: configure-gitea
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
command: ["/usr/sbin/configure_gitea.sh"]
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
value: "gitea_admin"
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
value: "ijinc123!" # sdjo
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: keepUpdated
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- name: gitea
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
# SSH Port values have to be set here as well for openssh configuration
|
||||
- name: SSH_LISTEN_PORT
|
||||
value: "2222"
|
||||
- name: SSH_PORT
|
||||
value: "22"
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMPDIR
|
||||
value: /tmp/gitea
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
ports:
|
||||
- name: ssh
|
||||
containerPort: 2222
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
livenessProbe:
|
||||
failureThreshold: 10
|
||||
initialDelaySeconds: 200
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: http
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: http
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
{}
|
||||
securityContext:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
volumes:
|
||||
- name: init
|
||||
secret:
|
||||
secretName: release-name-gitea-init
|
||||
defaultMode: 110
|
||||
- name: config
|
||||
secret:
|
||||
secretName: release-name-gitea
|
||||
defaultMode: 110
|
||||
- name: inline-config-sources
|
||||
secret:
|
||||
secretName: release-name-gitea-inline-config
|
||||
- name: temp
|
||||
emptyDir: {}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-shared-storage
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
replicas: 3
|
||||
podManagementPolicy: "Parallel"
|
||||
serviceName: release-name-postgresql-ha-postgresql-headless
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-postgresql-ha
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /pre-stop.sh
|
||||
- "25"
|
||||
# Auxiliary vars to populate environment variables
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: "false"
|
||||
# PostgreSQL configuration
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: "/bitnami/postgresql"
|
||||
- name: PGDATA
|
||||
value: "/bitnami/postgresql/data"
|
||||
- name: POSTGRES_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: postgres-password
|
||||
- name: POSTGRES_USER
|
||||
value: "gitea"
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: password
|
||||
- name: POSTGRES_DB
|
||||
value: "gitea"
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: "true"
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: "false"
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: "false"
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: "off"
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: "error"
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: "pgaudit, repmgr"
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: "no"
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: "5432"
|
||||
# Repmgr configuration
|
||||
- name: REPMGR_PORT_NUMBER
|
||||
value: "5432"
|
||||
- name: REPMGR_PRIMARY_PORT
|
||||
value: "5432"
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REPMGR_UPGRADE_EXTENSION
|
||||
value: "no"
|
||||
- name: REPMGR_PGHBA_TRUST_ALL
|
||||
value: "no"
|
||||
- name: REPMGR_MOUNTED_CONF_DIR
|
||||
value: "/bitnami/repmgr/conf"
|
||||
- name: REPMGR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPMGR_PARTNER_NODES
|
||||
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
||||
- name: REPMGR_PRIMARY_HOST
|
||||
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||
- name: REPMGR_NODE_NAME
|
||||
value: "$(MY_POD_NAME)"
|
||||
- name: REPMGR_NODE_NETWORK_NAME
|
||||
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||
- name: REPMGR_NODE_TYPE
|
||||
value: "data"
|
||||
- name: REPMGR_LOG_LEVEL
|
||||
value: "NOTICE"
|
||||
- name: REPMGR_CONNECT_TIMEOUT
|
||||
value: "5"
|
||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||
value: "2"
|
||||
- name: REPMGR_RECONNECT_INTERVAL
|
||||
value: "3"
|
||||
- name: REPMGR_USERNAME
|
||||
value: "repmgr"
|
||||
- name: REPMGR_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: repmgr-password
|
||||
- name: REPMGR_DATABASE
|
||||
value: "repmgr"
|
||||
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||
value: "no"
|
||||
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||
value: "5"
|
||||
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||
value: "1"
|
||||
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||
value: "30"
|
||||
envFrom:
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: 5432
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
||||
readinessProbe:
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- |
|
||||
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
||||
resources:
|
||||
limits:
|
||||
cpu: 375m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 384Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/conf
|
||||
subPath: repmgr-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/tmp
|
||||
subPath: repmgr-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/logs
|
||||
subPath: repmgr-logs-dir
|
||||
- name: data
|
||||
mountPath: /bitnami/postgresql
|
||||
- name: hooks-scripts
|
||||
mountPath: /pre-stop.sh
|
||||
subPath: pre-stop.sh
|
||||
- name: hooks-scripts
|
||||
mountPath: /readiness-probe.sh
|
||||
subPath: readiness-probe.sh
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
- name: hooks-scripts
|
||||
configMap:
|
||||
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
||||
defaultMode: 0755
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
partition: 0
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
replicas: 3
|
||||
serviceName: release-name-redis-cluster-headless
|
||||
podManagementPolicy: Parallel
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
annotations:
|
||||
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
||||
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
||||
spec:
|
||||
hostNetwork: false
|
||||
enableServiceLinks: false
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-redis-cluster
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
containers:
|
||||
- name: release-name-redis-cluster
|
||||
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
command: ['/bin/bash', '-c']
|
||||
args:
|
||||
- |
|
||||
# Backwards compatibility change
|
||||
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
||||
echo COPYING FILE
|
||||
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
||||
fi
|
||||
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
||||
pod_index="${pod_index[-1]}"
|
||||
if [[ "$pod_index" == "0" ]]; then
|
||||
export REDIS_CLUSTER_CREATOR="yes"
|
||||
export REDIS_CLUSTER_REPLICAS="0"
|
||||
fi
|
||||
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REDIS_NODES
|
||||
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
||||
- name: ALLOW_EMPTY_PASSWORD
|
||||
value: "yes"
|
||||
- name: REDIS_AOF_ENABLED
|
||||
value: "yes"
|
||||
- name: REDIS_TLS_ENABLED
|
||||
value: "no"
|
||||
- name: REDIS_PORT_NUMBER
|
||||
value: "6379"
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
containerPort: 6379
|
||||
- name: tcp-redis-bus
|
||||
containerPort: 16379
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
# One second longer than command timeout should prevent generation of zombie processes.
|
||||
timeoutSeconds: 6
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /scripts/ping_liveness_local.sh 5
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
# One second longer than command timeout should prevent generation of zombie processes.
|
||||
timeoutSeconds: 2
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /scripts/ping_readiness_local.sh 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
- name: redis-data
|
||||
mountPath: /bitnami/redis/data
|
||||
subPath:
|
||||
- name: default-config
|
||||
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
||||
subPath: redis-default.conf
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/etc/
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/logs
|
||||
subPath: app-logs-dir
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: release-name-redis-cluster-scripts
|
||||
defaultMode: 0755
|
||||
- name: default-config
|
||||
configMap:
|
||||
name: release-name-redis-cluster-default
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: redis-data
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ing-gitea
|
||||
namespace: gitea
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: gitea.nativedeck.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: release-name-gitea-http
|
||||
port:
|
||||
number: 3000
|
||||
tls:
|
||||
- hosts:
|
||||
- "gitea.nativedeck.com"
|
||||
secretName: secret-gitea-ssl
|
||||
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
type: ClusterIP
|
||||
sessionAffinity: None
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
# nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql-headless
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: false
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/headless-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-redis-cluster-headless
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp-redis
|
||||
- name: tcp-redis-bus
|
||||
port: 16379
|
||||
targetPort: tcp-redis-bus
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/redis-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
type: ClusterIP
|
||||
sessionAffinity: None
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp-redis
|
||||
protocol: TCP
|
||||
nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
---
|
||||
# Source: gitea/templates/gitea/http-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-gitea-http
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
# annotations:
|
||||
# {}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
targetPort:
|
||||
selector:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: gitea/templates/gitea/ssh-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-gitea-ssh
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
# annotations:
|
||||
# {}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: ssh
|
||||
port: 22
|
||||
targetPort: 2222
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,119 @@
|
|||
---
|
||||
- name: openSearch test
|
||||
hosts: os
|
||||
remote_user: ubuntu
|
||||
gather_facts: no
|
||||
become: yes # get root authority
|
||||
become_user: root
|
||||
# Setting Valiables
|
||||
vars:
|
||||
cluster_name: "dp3-os"
|
||||
node_roles: '["cluster_manager", "data"]'
|
||||
discovery_seed_hosts: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
|
||||
cluster_initial_cluster_manager_nodes: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
|
||||
|
||||
tasks:
|
||||
- name: Updata apt cache
|
||||
apt:
|
||||
update_cache: yes
|
||||
tags: update
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- lsb-release
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg2
|
||||
state: present
|
||||
tags: install
|
||||
# pre settings openSearch
|
||||
- name: Download OpenSearch GPG key
|
||||
get_url:
|
||||
url: https://artifacts.opensearch.org/publickeys/opensearch.pgp
|
||||
dest: /tmp/opensearch.pgp
|
||||
|
||||
- name: Add OpenSearch GPG key to the keyring
|
||||
command: gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring /tmp/opensearch.pgp
|
||||
|
||||
- name: Clean up temporary GPG key file
|
||||
file:
|
||||
path: /tmp/opensearch.pgp
|
||||
state: absent
|
||||
# Add Repo
|
||||
- name: Add OpenSearch repository
|
||||
copy:
|
||||
dest: /etc/apt/sources.list.d/opensearch-2.x.list
|
||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Add OpenSearch Dashboards repository
|
||||
copy:
|
||||
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
- name: Add OpenSearch repository
|
||||
copy:
|
||||
dest: /etc/apt/sources.list.d/opensearch-2.x.list
|
||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Add OpenSearch Dashboards repository
|
||||
copy:
|
||||
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Install required packages
|
||||
apt:
|
||||
name:
|
||||
- opensearch=2.11.1
|
||||
# - opensearch-dashboards=2.11.1
|
||||
state: present
|
||||
update_cache: yes
|
||||
tags: install
|
||||
|
||||
# set jvm
|
||||
- name: Change Xms1g to Xms#g in jvm.options
|
||||
lineinfile:
|
||||
path: /etc/opensearch/jvm.options
|
||||
regexp: '^-Xms1g'
|
||||
line: '-Xms4g'
|
||||
backup: no
|
||||
tags: config
|
||||
- name: Change Xmx1g to Xmx#g in jvm.options
|
||||
lineinfile:
|
||||
path: /etc/opensearch/jvm.options
|
||||
regexp: '^-Xmx1g'
|
||||
line: '-Xmx4g'
|
||||
backup: no
|
||||
tags: config
|
||||
|
||||
# set opensearcy.yml
|
||||
- name: Set node name based on inventory order
|
||||
set_fact:
|
||||
node_name: "os-{{ play_hosts.index(inventory_hostname) + 1 }}"
|
||||
|
||||
- name: Deploy OpenSearch configuration file from template
|
||||
template:
|
||||
src: templates/opensearch.yml.j2
|
||||
dest: /etc/opensearch/opensearch.yml
|
||||
owner: opensearch
|
||||
group: opensearch
|
||||
mode: '0644'
|
||||
|
||||
- name: Enable and start OpenSearch service
|
||||
systemd:
|
||||
name: opensearch
|
||||
enabled: yes
|
||||
state: started
|
||||
|
||||
# curl -XGET https://10.163.1.51:9200/\_cat/nodes?v -u 'admin:admin' --insecure
|
||||
|
|
@ -0,0 +1,150 @@
|
|||
# ======================== OpenSearch Configuration =========================
|
||||
#
|
||||
# NOTE: OpenSearch comes with reasonable defaults for most settings.
|
||||
# Before you set out to tweak and tune the configuration, make sure you
|
||||
# understand what are you trying to accomplish and the consequences.
|
||||
#
|
||||
# The primary way of configuring a node is via this file. This template lists
|
||||
# the most important settings you may want to configure for a production cluster.
|
||||
#
|
||||
# Please consult the documentation for further information on configuration options:
|
||||
# https://www.opensearch.org
|
||||
#
|
||||
# ---------------------------------- Cluster -----------------------------------
|
||||
#
|
||||
# Use a descriptive name for your cluster:
|
||||
#
|
||||
cluster.name: {{ cluster_name }}
|
||||
#
|
||||
# ------------------------------------ Node ------------------------------------
|
||||
#
|
||||
# Use a descriptive name for the node:
|
||||
#
|
||||
node.name: {{ node_name }}
|
||||
node.roles: {{ node_roles }}
|
||||
#
|
||||
# Add custom attributes to the node:
|
||||
#
|
||||
#node.attr.rack: r1
|
||||
#
|
||||
# ----------------------------------- Paths ------------------------------------
|
||||
#
|
||||
# Path to directory where to store the data (separate multiple locations by comma):
|
||||
#
|
||||
path.data: /var/lib/opensearch
|
||||
#
|
||||
# Path to log files:
|
||||
#
|
||||
path.logs: /var/log/opensearch
|
||||
#
|
||||
# ----------------------------------- Memory -----------------------------------
|
||||
#
|
||||
# Lock the memory on startup:
|
||||
#
|
||||
#bootstrap.memory_lock: true
|
||||
#
|
||||
# Make sure that the heap size is set to about half the memory available
|
||||
# on the system and that the owner of the process is allowed to use this
|
||||
# limit.
|
||||
#
|
||||
# OpenSearch performs poorly when the system is swapping the memory.
|
||||
#
|
||||
# ---------------------------------- Network -----------------------------------
|
||||
#
|
||||
# Set the bind address to a specific IP (IPv4 or IPv6):
|
||||
#
|
||||
network.host: 0.0.0.0
|
||||
#
|
||||
# Set a custom port for HTTP:
|
||||
#
|
||||
http.port: 9200
|
||||
transport.port: 9300
|
||||
#
|
||||
# For more information, consult the network module documentation.
|
||||
#
|
||||
# --------------------------------- Discovery ----------------------------------
|
||||
#
|
||||
# Pass an initial list of hosts to perform discovery when this node is started:
|
||||
# The default list of hosts is ["127.0.0.1", "[::1]"]
|
||||
#
|
||||
discovery.seed_hosts: {{ discovery_seed_hosts }}
|
||||
#
|
||||
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
|
||||
#
|
||||
cluster.initial_cluster_manager_nodes: {{ cluster_initial_cluster_manager_nodes }}
|
||||
#
|
||||
# For more information, consult the discovery and cluster formation module documentation.
|
||||
#
|
||||
# ---------------------------------- Gateway -----------------------------------
|
||||
#
|
||||
# Block initial recovery after a full cluster restart until N nodes are started:
|
||||
#
|
||||
#gateway.recover_after_nodes: 3
|
||||
#
|
||||
# For more information, consult the gateway module documentation.
|
||||
#
|
||||
# ---------------------------------- Various -----------------------------------
|
||||
#
|
||||
# Require explicit names when deleting indices:
|
||||
#
|
||||
#action.destructive_requires_name: true
|
||||
#
|
||||
# ---------------------------------- Remote Store -----------------------------------
|
||||
# Controls whether cluster imposes index creation only with remote store enabled
|
||||
# cluster.remote_store.enabled: true
|
||||
#
|
||||
# Repository to use for segment upload while enforcing remote store for an index
|
||||
# node.attr.remote_store.segment.repository: my-repo-1
|
||||
#
|
||||
# Repository to use for translog upload while enforcing remote store for an index
|
||||
# node.attr.remote_store.translog.repository: my-repo-1
|
||||
#
|
||||
# ---------------------------------- Experimental Features -----------------------------------
|
||||
# Gates the visibility of the experimental segment replication features until they are production ready.
|
||||
#
|
||||
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
|
||||
#
|
||||
# Gates the functionality of a new parameter to the snapshot restore API
|
||||
# that allows for creation of a new index type that searches a snapshot
|
||||
# directly in a remote repository without restoring all index data to disk
|
||||
# ahead of time.
|
||||
#
|
||||
#opensearch.experimental.feature.searchable_snapshot.enabled: false
|
||||
#
|
||||
#
|
||||
# Gates the functionality of enabling extensions to work with OpenSearch.
|
||||
# This feature enables applications to extend features of OpenSearch outside of
|
||||
# the core.
|
||||
#
|
||||
#opensearch.experimental.feature.extensions.enabled: false
|
||||
#
|
||||
#
|
||||
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
|
||||
# index searcher threadpool.
|
||||
#
|
||||
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
|
||||
|
||||
######## Start OpenSearch Security Demo Configuration ########
|
||||
# WARNING: revise all the lines below before you go into production
|
||||
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.http.pemcert_filepath: esnode.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
|
||||
plugins.security.allow_unsafe_democertificates: true
|
||||
plugins.security.allow_default_init_securityindex: true
|
||||
plugins.security.authcz.admin_dn:
|
||||
- CN=kirk,OU=client,O=client,L=test, C=de
|
||||
|
||||
plugins.security.audit.type: internal_opensearch
|
||||
plugins.security.enable_snapshot_restore_privilege: true
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
||||
node.max_local_storage_nodes: 3
|
||||
######## End OpenSearch Security Demo Configuration ########
|
||||
plugins.security.disabled: false
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ing-os-dash
|
||||
namespace: logging
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: os-dash.nativedeck.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: release-name-opensearch-dashboards
|
||||
port:
|
||||
number: 5601
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- hosts:
|
||||
- os-dash.nativedeck.com
|
||||
secretName: secret-logging-ssl
|
||||
|
|
@ -0,0 +1,140 @@
|
|||
---
|
||||
# Source: opensearch-dashboards/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: release-name-opensearch-dashboards-dashboards
|
||||
namespace: logging
|
||||
labels:
|
||||
app.kubernetes.io/name: opensearch-dashboards
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "2.11.1"
|
||||
---
|
||||
# Source: opensearch-dashboards/templates/rolebinding.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: opensearch-dashboards
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "2.11.1"
|
||||
name: release-name-opensearch-dashboards-dashboards-rolebinding
|
||||
namespace: logging
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: release-name-opensearch-dashboards-dashboards
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: release-name-opensearch-dashboards-dashboards
|
||||
namespace: logging
|
||||
---
|
||||
# Source: opensearch-dashboards/templates/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-opensearch-dashboards
|
||||
namespace: logging
|
||||
labels:
|
||||
app.kubernetes.io/name: opensearch-dashboards
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "2.11.1"
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 5601
|
||||
protocol: TCP
|
||||
name: http
|
||||
targetPort: 5601
|
||||
selector:
|
||||
app: opensearch-dashboards
|
||||
release: "release-name"
|
||||
---
|
||||
# Source: opensearch-dashboards/templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: release-name-opensearch-dashboards
|
||||
namespace: logging
|
||||
labels:
|
||||
app.kubernetes.io/name: opensearch-dashboards
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "2.11.1"
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: opensearch-dashboards
|
||||
release: "release-name"
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: opensearch-dashboards
|
||||
release: "release-name"
|
||||
annotations:
|
||||
spec:
|
||||
securityContext:
|
||||
{}
|
||||
serviceAccountName: release-name-opensearch-dashboards-dashboards
|
||||
volumes:
|
||||
containers:
|
||||
- name: dashboards
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
#image: "opensearchproject/opensearch-dashboards:2.13.0"
|
||||
image: "opensearchproject/opensearch-dashboards:2.11.1"
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
readinessProbe:
|
||||
failureThreshold: 10
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 20
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: 5601
|
||||
timeoutSeconds: 5
|
||||
livenessProbe:
|
||||
failureThreshold: 10
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 20
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: 5601
|
||||
timeoutSeconds: 5
|
||||
startupProbe:
|
||||
failureThreshold: 20
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: 5601
|
||||
timeoutSeconds: 5
|
||||
env:
|
||||
- name: OPENSEARCH_HOSTS
|
||||
value: "https://10.163.1.66:9200"
|
||||
#value: "https://opensearch-cluster-master:9200"
|
||||
- name: SERVER_HOST
|
||||
value: "0.0.0.0"
|
||||
#- name: SERVER_BASEPATH
|
||||
# value: "/os"
|
||||
- name: OPENSEARCH_USERNAME
|
||||
value: "admin"
|
||||
- name: OPENSEARCH_PASSWORD
|
||||
value: "admin"
|
||||
ports:
|
||||
- containerPort: 5601
|
||||
name: http
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 512M
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 512M
|
||||
#volumeMounts:
|
||||
|
|
@ -0,0 +1,367 @@
|
|||
# OpenSearch
|
||||
## QuicStart
|
||||
## Install OpenSearch from an APT repository
|
||||
### Install the necessary packages.
|
||||
```bash
|
||||
sudo apt-get update && sudo apt-get -y install lsb-release ca-certificates curl gnupg2
|
||||
```
|
||||
### Import the public GPG key. This key is used to verify that the APT repository is signed.
|
||||
```bash
|
||||
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring
|
||||
```
|
||||
### Create an APT repository for OpenSearch
|
||||
```bash
|
||||
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-2.x.list
|
||||
```
|
||||
|
||||
### Create an APT repository for OpenSearch-Dashboard
|
||||
```bash
|
||||
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
||||
```
|
||||
|
||||
### Verify that the repository was created successfully.
|
||||
```bash
|
||||
sudo apt-get update
|
||||
```
|
||||
설치 가능 패키지 확인
|
||||
```bash
|
||||
apt-cache madison opensearch
|
||||
```
|
||||
확인결과
|
||||
```bash
|
||||
opensearch | 2.13.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.12.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.11.1 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.11.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.10.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.9.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.8.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.7.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.6.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
opensearch | 2.5.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
||||
```
|
||||
|
||||
### Choose the version of OpenSearch you want to install:
|
||||
> Unless otherwise indicated, the latest available version of OpenSearch is installed.
|
||||
|
||||
항상 최신 버전 설치
|
||||
```bash
|
||||
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
|
||||
# Use one of the following commands to define a custom admin password:
|
||||
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch
|
||||
|
||||
# Use the following command for OpenSearch versions 2.11 and earlier:
|
||||
sudo apt-get install opensearch
|
||||
```
|
||||
|
||||
버전 지정 설치방법
|
||||
```bash
|
||||
# Specify the version manually using opensearch=<version>
|
||||
|
||||
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
|
||||
# Use one of the following commands to define a custom admin password:
|
||||
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch=2.13.0
|
||||
|
||||
# Use the following command for OpenSearch versions 2.11 and earlier:
|
||||
sudo apt-get install opensearch=2.13.0
|
||||
```
|
||||
|
||||
### MultiMaster Setting
|
||||
```bash
|
||||
/etc/opensearch/opensearch.yml
|
||||
```
|
||||
|
||||
```yaml
|
||||
cluster.name: os_cluster_name
|
||||
node.name: os1 # os2 , os3
|
||||
node.roles: ["cluster_manager", "data"]
|
||||
path.data: /var/lib/opensearch
|
||||
path.logs: /var/log/opensearch
|
||||
network.host: 0.0.0.0
|
||||
http.port: 9200
|
||||
transport.port: 9300
|
||||
discovery.seed_hosts: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
|
||||
cluster.initial_cluster_manager_nodes: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
|
||||
node.max_local_storage_nodes: 3
|
||||
plugins.security.disabled: true
|
||||
```
|
||||
### Specify initial and maximum JVM heap sizes.
|
||||
Open jvm.options
|
||||
```bash
|
||||
vi /etc/opensearch/jvm.options
|
||||
```
|
||||
Modify the values for initial and maximum heap sizes. As a starting point, you should set these values to half of the available system memory. For dedicated hosts this value can be increased based on your workflow requirements.
|
||||
As an example, if the host machine has 8 GB of memory, then you might want to set the initial and maximum heap sizes to 4 GB:
|
||||
```bash
|
||||
-Xms4g
|
||||
-Xmx4g
|
||||
```
|
||||
Save your changes and close the file.
|
||||
### Naver Cloud LB 설정
|
||||
멀티마스터 구성시 사설인증서로 Offloading 설정하여 진행.
|
||||
Network Proxy LoadBalancer에서 동작 검증완료.
|
||||
> 내부 인증서 처리 방식이 좀 까다로워 테스트 하다 오프로딩으로 전환.
|
||||
|
||||
## Reference
|
||||
[link1](https://opster.com/guides/opensearch/opensearch-data-architecture/how-to-configure-opensearch-node-roles/) 국외자료
|
||||
[link2](https://developer-jp.tistory.com/33) 국내자료
|
||||
[link3](https://opensearch.org/docs/latest/install-and-configure/install-opensearch/debian/) 공식자료
|
||||
|
||||
---
|
||||
## SingeNode 적용 예시
|
||||
아래 내용참조. SingleNode는 SSL 설정도 까다롭지 않음.
|
||||
```yaml
|
||||
vi /etc/opensearch/opensearch.yml
|
||||
```
|
||||
```yaml
|
||||
# ======================== OpenSearch Configuration =========================
|
||||
#
|
||||
# NOTE: OpenSearch comes with reasonable defaults for most settings.
|
||||
# Before you set out to tweak and tune the configuration, make sure you
|
||||
# understand what are you trying to accomplish and the consequences.
|
||||
#
|
||||
# The primary way of configuring a node is via this file. This template lists
|
||||
# the most important settings you may want to configure for a production cluster.
|
||||
#
|
||||
# Please consult the documentation for further information on configuration options:
|
||||
# https://www.opensearch.org
|
||||
#
|
||||
# ---------------------------------- Cluster -----------------------------------
|
||||
#
|
||||
# Use a descriptive name for your cluster:
|
||||
#
|
||||
#cluster.name: my-application
|
||||
#
|
||||
# ------------------------------------ Node ------------------------------------
|
||||
#
|
||||
# Use a descriptive name for the node:
|
||||
#
|
||||
#node.name: node-1
|
||||
#
|
||||
# Add custom attributes to the node:
|
||||
#
|
||||
#node.attr.rack: r1
|
||||
#
|
||||
# ----------------------------------- Paths ------------------------------------
|
||||
#
|
||||
# Path to directory where to store the data (separate multiple locations by comma):
|
||||
#
|
||||
path.data: /var/lib/opensearch
|
||||
#
|
||||
# Path to log files:
|
||||
#
|
||||
path.logs: /var/log/opensearch
|
||||
#
|
||||
# ----------------------------------- Memory -----------------------------------
|
||||
#
|
||||
# Lock the memory on startup:
|
||||
#
|
||||
#bootstrap.memory_lock: true
|
||||
#
|
||||
# Make sure that the heap size is set to about half the memory available
|
||||
# on the system and that the owner of the process is allowed to use this
|
||||
# limit.
|
||||
#
|
||||
# OpenSearch performs poorly when the system is swapping the memory.
|
||||
#
|
||||
# ---------------------------------- Network -----------------------------------
|
||||
#
|
||||
# Set the bind address to a specific IP (IPv4 or IPv6):
|
||||
#
|
||||
#network.host: 192.168.0.1
|
||||
#
|
||||
# Set a custom port for HTTP:
|
||||
#
|
||||
#http.port: 9200
|
||||
#
|
||||
# For more information, consult the network module documentation.
|
||||
#
|
||||
# --------------------------------- Discovery ----------------------------------
|
||||
#
|
||||
# Pass an initial list of hosts to perform discovery when this node is started:
|
||||
# The default list of hosts is ["127.0.0.1", "[::1]"]
|
||||
#
|
||||
#discovery.seed_hosts: ["host1", "host2"]
|
||||
#
|
||||
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
|
||||
#
|
||||
#cluster.initial_cluster_manager_nodes: ["node-1", "node-2"]
|
||||
#
|
||||
# For more information, consult the discovery and cluster formation module documentation.
|
||||
#
|
||||
# ---------------------------------- Gateway -----------------------------------
|
||||
#
|
||||
# Block initial recovery after a full cluster restart until N nodes are started:
|
||||
#
|
||||
#gateway.recover_after_nodes: 3
|
||||
#
|
||||
# For more information, consult the gateway module documentation.
|
||||
#
|
||||
# ---------------------------------- Various -----------------------------------
|
||||
#
|
||||
# Require explicit names when deleting indices:
|
||||
#
|
||||
#action.destructive_requires_name: true
|
||||
#
|
||||
# ---------------------------------- Remote Store -----------------------------------
|
||||
# Controls whether cluster imposes index creation only with remote store enabled
|
||||
# cluster.remote_store.enabled: true
|
||||
#
|
||||
# Repository to use for segment upload while enforcing remote store for an index
|
||||
# node.attr.remote_store.segment.repository: my-repo-1
|
||||
#
|
||||
# Repository to use for translog upload while enforcing remote store for an index
|
||||
# node.attr.remote_store.translog.repository: my-repo-1
|
||||
#
|
||||
# ---------------------------------- Experimental Features -----------------------------------
|
||||
# Gates the visibility of the experimental segment replication features until they are production ready.
|
||||
#
|
||||
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
|
||||
#
|
||||
# Gates the functionality of a new parameter to the snapshot restore API
|
||||
# that allows for creation of a new index type that searches a snapshot
|
||||
# directly in a remote repository without restoring all index data to disk
|
||||
# ahead of time.
|
||||
#
|
||||
#opensearch.experimental.feature.searchable_snapshot.enabled: false
|
||||
#
|
||||
#
|
||||
# Gates the functionality of enabling extensions to work with OpenSearch.
|
||||
# This feature enables applications to extend features of OpenSearch outside of
|
||||
# the core.
|
||||
#
|
||||
#opensearch.experimental.feature.extensions.enabled: false
|
||||
#
|
||||
#
|
||||
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
|
||||
# index searcher threadpool.
|
||||
#
|
||||
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
|
||||
|
||||
######## Start OpenSearch Security Demo Configuration ########
|
||||
# 키정보는 openssl로 생성해서 교체해도 됨.
|
||||
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.http.pemcert_filepath: esnode.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
|
||||
plugins.security.allow_unsafe_democertificates: true # 데모아니면 불필요
|
||||
plugins.security.allow_default_init_securityindex: true #이건 모르겠음
|
||||
plugins.security.authcz.admin_dn:
|
||||
- CN=kirk,OU=client,O=client,L=test, C=de
|
||||
|
||||
plugins.security.audit.type: internal_opensearch
|
||||
plugins.security.enable_snapshot_restore_privilege: true
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
||||
node.max_local_storage_nodes: 3
|
||||
######## End OpenSearch Security Demo Configuration ########
|
||||
# Bind OpenSearch to the correct network interface. Use 0.0.0.0
|
||||
# to include all available interfaces or specify an IP address
|
||||
# assigned to a specific interface.
|
||||
network.host: 0.0.0.0
|
||||
|
||||
# Unless you have already configured a cluster, you should set
|
||||
# discovery.type to single-node, or the bootstrap checks will
|
||||
# fail when you try to start the service.
|
||||
discovery.type: single-node
|
||||
|
||||
# If you previously disabled the Security plugin in opensearch.yml,
|
||||
# be sure to re-enable it. Otherwise you can skip this setting.
|
||||
plugins.security.disabled: false # false가 기능활성임.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Password Change
|
||||
multimaster 설정 과정에 대하여 기술함.
|
||||
|
||||
> 기존에 생성했던 인증서를 노드별로 적용하는 과정을 거쳐서 테스트를 진행하였음.
|
||||
|
||||
[참고자료](https://opensearch.org/docs/latest/security/configuration/generate-certificates/)
|
||||
|
||||
사용했던 실제 스크립트
|
||||
```sh
|
||||
#!/bin/sh
|
||||
# Root CA
|
||||
openssl genrsa -out root-ca-key.pem 2048
|
||||
openssl req -new -x509 -sha256 -key root-ca-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=root.dns.a-record" -out root-ca.pem -days 730
|
||||
# Admin cert
|
||||
openssl genrsa -out admin-key-temp.pem 2048
|
||||
openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem
|
||||
openssl req -new -key admin-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=A" -out admin.csr
|
||||
openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 730
|
||||
# Node cert 1
|
||||
openssl genrsa -out os1-key-temp.pem 2048
|
||||
openssl pkcs8 -inform PEM -outform PEM -in os1-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os1-key.pem
|
||||
openssl req -new -key os1-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os1.dns.a-record" -out os1.csr
|
||||
echo 'subjectAltName=DNS:os1.dns.a-record' > os1.ext
|
||||
openssl x509 -req -in os1.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os1.pem -days 730 -extfile os1.ext
|
||||
# Node cert 2
|
||||
openssl genrsa -out os2-key-temp.pem 2048
|
||||
openssl pkcs8 -inform PEM -outform PEM -in os2-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os2-key.pem
|
||||
openssl req -new -key os2-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os2.dns.a-record" -out os2.csr
|
||||
echo 'subjectAltName=DNS:os2.dns.a-record' > os2.ext
|
||||
openssl x509 -req -in os2.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os2.pem -days 730 -extfile os2.ext
|
||||
# Node cert 3
|
||||
openssl genrsa -out os3-key-temp.pem 2048
|
||||
openssl pkcs8 -inform PEM -outform PEM -in os3-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os3-key.pem
|
||||
openssl req -new -key os3-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os3.dns.a-record" -out os3.csr
|
||||
echo 'subjectAltName=DNS:os3.dns.a-record' > os3.ext
|
||||
openssl x509 -req -in os3.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os3.pem -days 730 -extfile os3.ext
|
||||
# Cleanup
|
||||
rm admin-key-temp.pem
|
||||
rm admin.csr
|
||||
rm os1-key-temp.pem
|
||||
rm os1.csr
|
||||
rm os1.ext
|
||||
rm os2-key-temp.pem
|
||||
rm os2.csr
|
||||
rm os2.ext
|
||||
rm os3-key-temp.pem
|
||||
rm os3.csr
|
||||
rm os3.ext
|
||||
```
|
||||
|
||||
### 설정했던 opensearch.yml
|
||||
```bash
|
||||
cluster.name: my-application
|
||||
node.name: os1
|
||||
node.roles: ["cluster_manager", "data"]
|
||||
path.data: /var/lib/opensearch
|
||||
path.logs: /var/log/opensearch
|
||||
network.host: 0.0.0.0
|
||||
http.port: 9200
|
||||
transport.port: 9300
|
||||
discovery.seed_hosts: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
|
||||
cluster.initial_cluster_manager_nodes: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
|
||||
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
|
||||
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
|
||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
|
||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
||||
plugins.security.ssl.http.enabled: true
|
||||
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
|
||||
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
|
||||
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
|
||||
plugins.security.allow_unsafe_democertificates: true
|
||||
plugins.security.allow_default_init_securityindex: true
|
||||
plugins.security.authcz.admin_dn:
|
||||
- 'CN=A,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||
plugins.security.nodes_dn:
|
||||
- 'CN=os1.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||
- 'CN=os2.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||
- 'CN=os3.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
||||
plugins.security.audit.type: internal_opensearch
|
||||
plugins.security.enable_snapshot_restore_privilege: true
|
||||
plugins.security.check_snapshot_restore_write_privileges: true
|
||||
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
||||
plugins.security.system_indices.enabled: true
|
||||
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
||||
node.max_local_storage_nodes: 3
|
||||
plugins.security.disabled: false
|
||||
```
|
||||
|
|
@ -308,4 +308,4 @@ metadata:
|
|||
release: harbor
|
||||
name: harbor-trivy
|
||||
namespace: harbor
|
||||
type: Opaque
|
||||
type: Opaque
|
||||
|
|
|
|||
Loading…
Reference in New Issue