shdsbilling.com
This commit is contained in:
jaey
parent
9436e26f93
commit
8e849e08c7
|
|
@ -21779,7 +21779,7 @@ spec:
|
||||||
key: applicationsetcontroller.enable.scm.providers
|
key: applicationsetcontroller.enable.scm.providers
|
||||||
name: argocd-cmd-params-cm
|
name: argocd-cmd-params-cm
|
||||||
optional: true
|
optional: true
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
name: argocd-applicationset-controller
|
name: argocd-applicationset-controller
|
||||||
ports:
|
ports:
|
||||||
|
|
@ -21874,7 +21874,7 @@ spec:
|
||||||
key: dexserver.disable.tls
|
key: dexserver.disable.tls
|
||||||
name: argocd-cmd-params-cm
|
name: argocd-cmd-params-cm
|
||||||
optional: true
|
optional: true
|
||||||
image: reg.inje-private.com/nnd002/dexidp/dex:v2.38.0
|
image: ghcr.io/dexidp/dex:v2.38.0
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
name: dex
|
name: dex
|
||||||
ports:
|
ports:
|
||||||
|
|
@ -21903,7 +21903,7 @@ spec:
|
||||||
- -n
|
- -n
|
||||||
- /usr/local/bin/argocd
|
- /usr/local/bin/argocd
|
||||||
- /shared/argocd-dex
|
- /shared/argocd-dex
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
name: copyutil
|
name: copyutil
|
||||||
securityContext:
|
securityContext:
|
||||||
|
|
@ -21986,7 +21986,7 @@ spec:
|
||||||
key: notificationscontroller.selfservice.enabled
|
key: notificationscontroller.selfservice.enabled
|
||||||
name: argocd-cmd-params-cm
|
name: argocd-cmd-params-cm
|
||||||
optional: true
|
optional: true
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
tcpSocket:
|
tcpSocket:
|
||||||
|
|
@ -22071,7 +22071,7 @@ spec:
|
||||||
secretKeyRef:
|
secretKeyRef:
|
||||||
key: auth
|
key: auth
|
||||||
name: argocd-redis
|
name: argocd-redis
|
||||||
image: reg.inje-private.com/nnd002/redis:7.0.15-alpine
|
image: redis:7.0.15-alpine
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
name: redis
|
name: redis
|
||||||
ports:
|
ports:
|
||||||
|
|
@ -22087,7 +22087,7 @@ spec:
|
||||||
- argocd
|
- argocd
|
||||||
- admin
|
- admin
|
||||||
- redis-initial-password
|
- redis-initial-password
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
name: secret-init
|
name: secret-init
|
||||||
securityContext:
|
securityContext:
|
||||||
|
|
@ -22341,7 +22341,7 @@ spec:
|
||||||
value: /helm-working-dir
|
value: /helm-working-dir
|
||||||
- name: HELM_DATA_HOME
|
- name: HELM_DATA_HOME
|
||||||
value: /helm-working-dir
|
value: /helm-working-dir
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
failureThreshold: 3
|
failureThreshold: 3
|
||||||
|
|
@ -22393,7 +22393,7 @@ spec:
|
||||||
- -n
|
- -n
|
||||||
- /usr/local/bin/argocd
|
- /usr/local/bin/argocd
|
||||||
- /var/run/argocd/argocd-cmp-server
|
- /var/run/argocd/argocd-cmp-server
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
name: copyutil
|
name: copyutil
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
|
|
@ -22716,7 +22716,7 @@ spec:
|
||||||
key: server.api.content.types
|
key: server.api.content.types
|
||||||
name: argocd-cmd-params-cm
|
name: argocd-cmd-params-cm
|
||||||
optional: true
|
optional: true
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
livenessProbe:
|
livenessProbe:
|
||||||
httpGet:
|
httpGet:
|
||||||
|
|
@ -23016,7 +23016,7 @@ spec:
|
||||||
key: controller.ignore.normalizer.jq.timeout
|
key: controller.ignore.normalizer.jq.timeout
|
||||||
name: argocd-cmd-params-cm
|
name: argocd-cmd-params-cm
|
||||||
optional: true
|
optional: true
|
||||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
image: quay.io/argoproj/argocd:v2.12.3
|
||||||
imagePullPolicy: Always
|
imagePullPolicy: Always
|
||||||
name: argocd-application-controller
|
name: argocd-application-controller
|
||||||
ports:
|
ports:
|
||||||
|
|
|
||||||
|
|
@ -2,7 +2,7 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
metadata:
|
metadata:
|
||||||
name: ing-argocd
|
name: argocd-ing
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
annotations:
|
annotations:
|
||||||
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
@ -11,7 +11,7 @@ metadata:
|
||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
rules:
|
rules:
|
||||||
- host: argocd.inje-private.com # 사전 생성된 인증서의 도메인적용.
|
- host: argocd.shdsbilling.com # 사전 생성된 인증서의 도메인적용.
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- path: /
|
- path: /
|
||||||
|
|
@ -23,6 +23,6 @@ spec:
|
||||||
number: 443
|
number: 443
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- "argocd.inje-private.com"
|
- "argocd.shdsbilling.com"
|
||||||
secretName: argocd-ssl
|
secretName: ssl-shdsbilling-com
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -8,7 +8,7 @@ spec:
|
||||||
accessModes:
|
accessModes:
|
||||||
- ReadWriteOnce
|
- ReadWriteOnce
|
||||||
volumeMode: Filesystem
|
volumeMode: Filesystem
|
||||||
storageClassName: sc-monitoring
|
storageClassName: billing-portal-sc
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: 50Gi # default: 10Gi
|
storage: 8Gi # default: 10Gi
|
||||||
|
|
|
||||||
|
|
@ -49,7 +49,7 @@ spec:
|
||||||
# Auxiliary vars to populate environment variables
|
# Auxiliary vars to populate environment variables
|
||||||
containers:
|
containers:
|
||||||
- name: pgpool
|
- name: pgpool
|
||||||
image: reg.inje-private.com/nnd002/bitnami/pgpool:4.5.2-debian-12-r2
|
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
|
||||||
imagePullPolicy: "IfNotPresent"
|
imagePullPolicy: "IfNotPresent"
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
|
|
@ -207,7 +207,7 @@ spec:
|
||||||
fsGroup: 1000
|
fsGroup: 1000
|
||||||
initContainers:
|
initContainers:
|
||||||
- name: init-directories
|
- name: init-directories
|
||||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
command: ["/usr/sbin/init_directory_structure.sh"]
|
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||||
env:
|
env:
|
||||||
|
|
@ -235,7 +235,7 @@ spec:
|
||||||
cpu: 100m
|
cpu: 100m
|
||||||
memory: 128Mi
|
memory: 128Mi
|
||||||
- name: init-app-ini
|
- name: init-app-ini
|
||||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
command: ["/usr/sbin/config_environment.sh"]
|
command: ["/usr/sbin/config_environment.sh"]
|
||||||
env:
|
env:
|
||||||
|
|
@ -265,7 +265,7 @@ spec:
|
||||||
cpu: 100m
|
cpu: 100m
|
||||||
memory: 128Mi
|
memory: 128Mi
|
||||||
- name: configure-gitea
|
- name: configure-gitea
|
||||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
command: ["/usr/sbin/configure_gitea.sh"]
|
command: ["/usr/sbin/configure_gitea.sh"]
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
securityContext:
|
securityContext:
|
||||||
|
|
@ -284,7 +284,8 @@ spec:
|
||||||
- name: GITEA_ADMIN_USERNAME
|
- name: GITEA_ADMIN_USERNAME
|
||||||
value: "gitea_admin"
|
value: "gitea_admin"
|
||||||
- name: GITEA_ADMIN_PASSWORD
|
- name: GITEA_ADMIN_PASSWORD
|
||||||
value: "ijinc123!" # sdjo
|
#value: "ijinc123!" # sdjo
|
||||||
|
value: "grumatic123!"
|
||||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||||
value: keepUpdated
|
value: keepUpdated
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
|
|
@ -303,7 +304,7 @@ spec:
|
||||||
terminationGracePeriodSeconds: 60
|
terminationGracePeriodSeconds: 60
|
||||||
containers:
|
containers:
|
||||||
- name: gitea
|
- name: gitea
|
||||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
imagePullPolicy: IfNotPresent
|
imagePullPolicy: IfNotPresent
|
||||||
env:
|
env:
|
||||||
# SSH Port values have to be set here as well for openssh configuration
|
# SSH Port values have to be set here as well for openssh configuration
|
||||||
|
|
@ -432,7 +433,7 @@ spec:
|
||||||
hostIPC: false
|
hostIPC: false
|
||||||
containers:
|
containers:
|
||||||
- name: postgresql
|
- name: postgresql
|
||||||
image: reg.inje-private.com/nnd002/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
||||||
imagePullPolicy: "IfNotPresent"
|
imagePullPolicy: "IfNotPresent"
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
|
|
@ -625,6 +626,7 @@ spec:
|
||||||
spec:
|
spec:
|
||||||
accessModes:
|
accessModes:
|
||||||
- "ReadWriteOnce"
|
- "ReadWriteOnce"
|
||||||
|
storageClassName: billing-portal-sc
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: "8Gi"
|
storage: "8Gi"
|
||||||
|
|
@ -688,7 +690,7 @@ spec:
|
||||||
|
|
||||||
containers:
|
containers:
|
||||||
- name: release-name-redis-cluster
|
- name: release-name-redis-cluster
|
||||||
image: reg.inje-private.com/nnd002/bitnami/redis-cluster:7.2.5-debian-12-r2
|
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
||||||
imagePullPolicy: "IfNotPresent"
|
imagePullPolicy: "IfNotPresent"
|
||||||
securityContext:
|
securityContext:
|
||||||
allowPrivilegeEscalation: false
|
allowPrivilegeEscalation: false
|
||||||
|
|
@ -810,6 +812,7 @@ spec:
|
||||||
spec:
|
spec:
|
||||||
accessModes:
|
accessModes:
|
||||||
- "ReadWriteOnce"
|
- "ReadWriteOnce"
|
||||||
|
storageClassName: billing-portal-sc
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: "8Gi"
|
storage: "8Gi"
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
apiVersion: networking.k8s.io/v1
|
||||||
kind: Ingress
|
kind: Ingress
|
||||||
metadata:
|
metadata:
|
||||||
name: ing-gitea
|
name: gitea-ing
|
||||||
namespace: gitea
|
namespace: gitea
|
||||||
annotations:
|
annotations:
|
||||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
|
@ -9,7 +9,7 @@ metadata:
|
||||||
spec:
|
spec:
|
||||||
ingressClassName: nginx
|
ingressClassName: nginx
|
||||||
rules:
|
rules:
|
||||||
- host: gitea.inje-private.com
|
- host: gitea.shdsbilling.com
|
||||||
http:
|
http:
|
||||||
paths:
|
paths:
|
||||||
- path: /
|
- path: /
|
||||||
|
|
@ -21,6 +21,6 @@ spec:
|
||||||
number: 3000
|
number: 3000
|
||||||
tls:
|
tls:
|
||||||
- hosts:
|
- hosts:
|
||||||
- "gitea.inje-private.com"
|
- "gitea.shdsbilling.com"
|
||||||
secretName: gitea-ssl
|
secretName: ssl-shdsbilling-com
|
||||||
|
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,672 @@
|
||||||
|
apiVersion: v1 # ns 용 추가 by ljh
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: argocd
|
||||||
|
labels:
|
||||||
|
name: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: dex-server
|
||||||
|
app.kubernetes.io/name: argocd-dex-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: redis
|
||||||
|
app.kubernetes.io/name: argocd-redis
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: repo-server
|
||||||
|
app.kubernetes.io/name: argocd-repo-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-repo-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- applicationsets
|
||||||
|
- applicationsets/finalizers
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applicationsets/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
- extensions
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: dex-server
|
||||||
|
app.kubernetes.io/name: argocd-dex-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- argocd-notifications-cm
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- argocd-notifications-secret
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: redis
|
||||||
|
app.kubernetes.io/name: argocd-redis
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resourceNames:
|
||||||
|
- argocd-redis
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- patch
|
||||||
|
- delete
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- appprojects
|
||||||
|
- applicationsets
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- list
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- '*'
|
||||||
|
resources:
|
||||||
|
- '*'
|
||||||
|
verbs:
|
||||||
|
- '*'
|
||||||
|
- nonResourceURLs:
|
||||||
|
- '*'
|
||||||
|
verbs:
|
||||||
|
- '*'
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- applicationsets
|
||||||
|
- applicationsets/finalizers
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applicationsets/status
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- appprojects
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- update
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- apps
|
||||||
|
- extensions
|
||||||
|
resources:
|
||||||
|
- deployments
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- patch
|
||||||
|
- update
|
||||||
|
- watch
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- '*'
|
||||||
|
resources:
|
||||||
|
- '*'
|
||||||
|
verbs:
|
||||||
|
- delete
|
||||||
|
- get
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- pods
|
||||||
|
- pods/log
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- applications
|
||||||
|
- applicationsets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- batch
|
||||||
|
resources:
|
||||||
|
- jobs
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- argoproj.io
|
||||||
|
resources:
|
||||||
|
- workflows
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-application-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: dex-server
|
||||||
|
app.kubernetes.io/name: argocd-dex-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-dex-server
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-dex-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-notifications-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: redis
|
||||||
|
app.kubernetes.io/name: argocd-redis
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-redis
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-redis
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: argocd-server
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: application-controller
|
||||||
|
app.kubernetes.io/name: argocd-application-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-application-controller
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: argocd-application-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-application-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: applicationset-controller
|
||||||
|
app.kubernetes.io/name: argocd-applicationset-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-applicationset-controller
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: server
|
||||||
|
app.kubernetes.io/name: argocd-server
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-server
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: argocd-server
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: argocd-server
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-secret
|
||||||
|
namespace: argocd
|
||||||
|
type: Opaque
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-secret
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-secret
|
||||||
|
namespace: argocd
|
||||||
|
type: Opaque
|
||||||
|
|
@ -0,0 +1,81 @@
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-cmd-params-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-cmd-params-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-gpg-keys-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-gpg-keys-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: notifications-controller
|
||||||
|
app.kubernetes.io/name: argocd-notifications-controller
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-notifications-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-rbac-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-rbac-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
ssh_known_hosts: |
|
||||||
|
# This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT
|
||||||
|
[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||||
|
[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||||
|
[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||||
|
bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=
|
||||||
|
bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO
|
||||||
|
bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=
|
||||||
|
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||||
|
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||||
|
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||||
|
gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
|
||||||
|
gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
|
||||||
|
gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
|
||||||
|
ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||||
|
vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-ssh-known-hosts-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-ssh-known-hosts-cm
|
||||||
|
namespace: argocd
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/name: argocd-tls-certs-cm
|
||||||
|
app.kubernetes.io/part-of: argocd
|
||||||
|
name: argocd-tls-certs-cm
|
||||||
|
namespace: argocd
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,27 @@
|
||||||
|
# Offloading setting.
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: argocd-ing
|
||||||
|
namespace: argocd
|
||||||
|
annotations:
|
||||||
|
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/backend-protocol: "https"
|
||||||
|
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: argocd.shdsbilling.com # 사전 생성된 인증서의 도메인적용.
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: argocd-server
|
||||||
|
port:
|
||||||
|
number: 443
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- "argocd.shdsbilling.com"
|
||||||
|
secretName: ssl-shdsbilling-com
|
||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,28 @@
|
||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
# 원본 YAML 파일
|
||||||
|
input_file="argocd_v2.12.3_add_ns.yaml"
|
||||||
|
|
||||||
|
# CRD가 저장될 파일
|
||||||
|
crd_file="crds.yaml"
|
||||||
|
|
||||||
|
# CRD를 제외한 나머지 리소스를 저장할 파일
|
||||||
|
output_file="deployment_without_crds.yaml"
|
||||||
|
|
||||||
|
# CRD 분리
|
||||||
|
awk '
|
||||||
|
BEGIN { in_crd = 0 }
|
||||||
|
/\r$/ { sub(/\r$/, ""); } # 줄 끝에 있는 \r 제거
|
||||||
|
/^---/ {
|
||||||
|
if (in_crd) {
|
||||||
|
in_crd = 0
|
||||||
|
} else if ($0 ~ /^---/) {
|
||||||
|
if (!in_crd) print "---" > "'$output_file'"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
/^apiVersion: apiextensions.k8s.io\/v1/ { in_crd = 1; print "---" > "'$crd_file'" }
|
||||||
|
in_crd { print > "'$crd_file'" }
|
||||||
|
!in_crd && $0 !~ /^---/ { print > "'$output_file'" }
|
||||||
|
' "$input_file"
|
||||||
|
|
||||||
|
echo "CRD 부분은 $crd_file에 저장되었고, 나머지 리소스는 $output_file에 저장되었습니다."
|
||||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,5 @@
|
||||||
|
# kustomization.yaml
|
||||||
|
namespace: argocd
|
||||||
|
|
||||||
|
resources:
|
||||||
|
- argocd_v2.12.3.yaml
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
name: gitea
|
||||||
|
labels:
|
||||||
|
kubernetes.io/metadata.name: gitea
|
||||||
|
|
@ -0,0 +1,79 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
- ports:
|
||||||
|
- port: 5432
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
- ports:
|
||||||
|
- port: 5432
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/networkpolicy.yaml
|
||||||
|
kind: NetworkPolicy
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
podSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
policyTypes:
|
||||||
|
- Ingress
|
||||||
|
- Egress
|
||||||
|
egress:
|
||||||
|
- {}
|
||||||
|
ingress:
|
||||||
|
# Allow inbound connections
|
||||||
|
- ports:
|
||||||
|
- port: 6379
|
||||||
|
- port: 16379
|
||||||
|
|
@ -0,0 +1,77 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql-witness
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: witness
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: witness
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/poddisruptionbudget.yaml
|
||||||
|
apiVersion: policy/v1
|
||||||
|
kind: PodDisruptionBudget
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
maxUnavailable: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
matchExpressions:
|
||||||
|
- {key: job-name, operator: NotIn, values: [release-name-redis-cluster-cluster-update]}
|
||||||
|
|
@ -0,0 +1,23 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/redis-serviceaccount.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
|
@ -0,0 +1,384 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
admin-password: "aWppbmMxMjMh"
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
type: Opaque
|
||||||
|
data:
|
||||||
|
postgres-password: "aWppbmMxMjMh"
|
||||||
|
password: "Z2l0ZWE="
|
||||||
|
repmgr-password: "aWppbmMxMjMh"
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/config.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-inline-config
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
_generals_: ""
|
||||||
|
cache: |-
|
||||||
|
ADAPTER=redis
|
||||||
|
HOST=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
database: |-
|
||||||
|
DB_TYPE=postgres
|
||||||
|
HOST=release-name-postgresql-ha-pgpool.gitea.svc.cluster.local:5432
|
||||||
|
NAME=gitea
|
||||||
|
PASSWD=gitea
|
||||||
|
USER=gitea
|
||||||
|
indexer: ISSUE_INDEXER_TYPE=db
|
||||||
|
metrics: ENABLED=false
|
||||||
|
queue: |-
|
||||||
|
CONN_STR=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
TYPE=redis
|
||||||
|
repository: ROOT=/data/git/gitea-repositories
|
||||||
|
security: INSTALL_LOCK=true
|
||||||
|
server: |-
|
||||||
|
APP_DATA_PATH=/data
|
||||||
|
DOMAIN=gitea.inje-private.com
|
||||||
|
ENABLE_PPROF=false
|
||||||
|
HTTP_PORT=3000
|
||||||
|
PROTOCOL=http
|
||||||
|
ROOT_URL=http://gitea.inje-private.com
|
||||||
|
SSH_DOMAIN=gitea.inje-private.com
|
||||||
|
SSH_LISTEN_PORT=2222
|
||||||
|
SSH_PORT=22
|
||||||
|
START_SSH_SERVER=true
|
||||||
|
session: |-
|
||||||
|
PROVIDER=redis
|
||||||
|
PROVIDER_CONFIG=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/config.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
assertions: |
|
||||||
|
config_environment.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
function env2ini::log() {
|
||||||
|
printf "${1}\n"
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::read_config_to_env() {
|
||||||
|
local section="${1}"
|
||||||
|
local line="${2}"
|
||||||
|
|
||||||
|
if [[ -z "${line}" ]]; then
|
||||||
|
# skip empty line
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||||
|
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||||
|
|
||||||
|
if [[ -z "${setting}" ]]; then
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local value=''
|
||||||
|
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||||
|
if [[ $line =~ $regex ]]; then
|
||||||
|
value="${BASH_REMATCH[3]}"
|
||||||
|
else
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
env2ini::log " + '${setting}'"
|
||||||
|
|
||||||
|
if [[ -z "${section}" ]]; then
|
||||||
|
export "GITEA____${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||||
|
masked_section="${masked_section//-/_0X2D_}"
|
||||||
|
|
||||||
|
export "GITEA__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::reload_preset_envs() {
|
||||||
|
env2ini::log "Reloading preset envs..."
|
||||||
|
|
||||||
|
while read -r line; do
|
||||||
|
if [[ -z "${line}" ]]; then
|
||||||
|
# skip empty line
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||||
|
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||||
|
|
||||||
|
if [[ -z "${setting}" ]]; then
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local value=''
|
||||||
|
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||||
|
if [[ $line =~ $regex ]]; then
|
||||||
|
value="${BASH_REMATCH[3]}"
|
||||||
|
else
|
||||||
|
env2ini::log ' ! invalid setting'
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
env2ini::log " + '${setting}'"
|
||||||
|
|
||||||
|
export "${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||||
|
done < "/tmp/existing-envs"
|
||||||
|
|
||||||
|
rm /tmp/existing-envs
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
function env2ini::process_config_file() {
|
||||||
|
local config_file="${1}"
|
||||||
|
local section="$(basename "${config_file}")"
|
||||||
|
|
||||||
|
if [[ $section == '_generals_' ]]; then
|
||||||
|
|
||||||
|
section=''
|
||||||
|
else
|
||||||
|
env2ini::log " ${section}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
while read -r line; do
|
||||||
|
env2ini::read_config_to_env "${section}" "${line}"
|
||||||
|
done < <(awk 1 "${config_file}") # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::load_config_sources() {
|
||||||
|
local path="${1}"
|
||||||
|
|
||||||
|
if [[ -d "${path}" ]]; then
|
||||||
|
env2ini::log "Processing $(basename "${path}")..."
|
||||||
|
|
||||||
|
while read -d '' configFile; do
|
||||||
|
env2ini::process_config_file "${configFile}"
|
||||||
|
done < <(find "${path}" -type l -not -name '..data' -print0)
|
||||||
|
|
||||||
|
env2ini::log "\n"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
function env2ini::generate_initial_secrets() {
|
||||||
|
# These environment variables will either be
|
||||||
|
# - overwritten with user defined values,
|
||||||
|
# - initially used to set up Gitea
|
||||||
|
# Anyway, they won't harm existing app.ini files
|
||||||
|
|
||||||
|
export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||||
|
export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
|
||||||
|
export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
|
||||||
|
export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
|
||||||
|
|
||||||
|
env2ini::log "...Initial secrets generated\n"
|
||||||
|
}
|
||||||
|
|
||||||
|
# save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
|
||||||
|
env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > /tmp/existing-envs
|
||||||
|
|
||||||
|
# MUST BE CALLED BEFORE OTHER CONFIGURATION
|
||||||
|
env2ini::generate_initial_secrets
|
||||||
|
|
||||||
|
env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
|
||||||
|
env2ini::load_config_sources '/env-to-ini-mounts/additionals/'
|
||||||
|
|
||||||
|
# load existing envs to override auto generated envs
|
||||||
|
env2ini::reload_preset_envs
|
||||||
|
|
||||||
|
env2ini::log "=== All configuration sources loaded ===\n"
|
||||||
|
|
||||||
|
# safety to prevent rewrite of secret keys if an app.ini already exists
|
||||||
|
if [ -f ${GITEA_APP_INI} ]; then
|
||||||
|
env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
|
||||||
|
env2ini::log ' - security.INTERNAL_TOKEN'
|
||||||
|
env2ini::log ' - security.SECRET_KEY'
|
||||||
|
env2ini::log ' - oauth2.JWT_SECRET'
|
||||||
|
env2ini::log ' - server.LFS_JWT_SECRET'
|
||||||
|
|
||||||
|
unset GITEA__SECURITY__INTERNAL_TOKEN
|
||||||
|
unset GITEA__SECURITY__SECRET_KEY
|
||||||
|
unset GITEA__OAUTH2__JWT_SECRET
|
||||||
|
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||||
|
fi
|
||||||
|
|
||||||
|
environment-to-ini -o $GITEA_APP_INI
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/init.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Secret
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-init
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
type: Opaque
|
||||||
|
stringData:
|
||||||
|
configure_gpg_environment.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
gpg --batch --import /raw/private.asc
|
||||||
|
init_directory_structure.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
set -x
|
||||||
|
mkdir -p /data/git/.ssh
|
||||||
|
chmod -R 700 /data/git/.ssh
|
||||||
|
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||||
|
|
||||||
|
# prepare temp directory structure
|
||||||
|
mkdir -p "${GITEA_TEMP}"
|
||||||
|
chmod ug+rwx "${GITEA_TEMP}"
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
configure_gitea.sh: |-
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||||
|
|
||||||
|
{ # try
|
||||||
|
gitea migrate
|
||||||
|
} || { # catch
|
||||||
|
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
function test_redis_connection() {
|
||||||
|
local RETRY=0
|
||||||
|
local MAX=30
|
||||||
|
|
||||||
|
echo 'Wait for redis to become avialable...'
|
||||||
|
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||||
|
nc -vz -w2 release-name-redis-cluster-headless.gitea.svc.cluster.local 6379 && break
|
||||||
|
RETRY=$[${RETRY}+1]
|
||||||
|
echo "...not ready yet (${RETRY}/${MAX})"
|
||||||
|
done
|
||||||
|
|
||||||
|
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||||
|
echo "Redis not reachable after '${MAX}' attempts!"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
test_redis_connection
|
||||||
|
function configure_admin_user() {
|
||||||
|
local full_admin_list=$(gitea admin user list --admin)
|
||||||
|
local actual_user_table=''
|
||||||
|
|
||||||
|
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||||
|
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||||
|
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||||
|
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||||
|
else
|
||||||
|
# This code block should never be reached, as long as the output table header remains the same.
|
||||||
|
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||||
|
|
||||||
|
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||||
|
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||||
|
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-chart/issues."
|
||||||
|
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||||
|
echo "--"
|
||||||
|
echo "${full_admin_list}"
|
||||||
|
echo "--"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||||
|
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||||
|
local -a create_args
|
||||||
|
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain")
|
||||||
|
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||||
|
create_args+=(--must-change-password=true)
|
||||||
|
else
|
||||||
|
create_args+=(--must-change-password=false)
|
||||||
|
fi
|
||||||
|
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||||
|
gitea admin user create "${create_args[@]}"
|
||||||
|
echo '...created.'
|
||||||
|
else
|
||||||
|
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||||
|
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||||
|
# See https://gitea.com/gitea/helm-chart/issues/673
|
||||||
|
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||||
|
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||||
|
# should add it to prevent requiring frequent admin password resets.
|
||||||
|
local -a change_args
|
||||||
|
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||||
|
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||||
|
change_args+=(--must-change-password=false)
|
||||||
|
fi
|
||||||
|
gitea admin user change-password "${change_args[@]}"
|
||||||
|
echo '...password sync done.'
|
||||||
|
else
|
||||||
|
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_admin_user
|
||||||
|
|
||||||
|
function configure_ldap() {
|
||||||
|
echo 'no ldap configuration... skipping.'
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_ldap
|
||||||
|
|
||||||
|
function configure_oauth() {
|
||||||
|
echo 'no oauth configuration... skipping.'
|
||||||
|
}
|
||||||
|
|
||||||
|
configure_oauth
|
||||||
|
|
||||||
|
echo '==== END GITEA CONFIGURATION ===='
|
||||||
|
|
@ -0,0 +1,14 @@
|
||||||
|
# Source: gitea/templates/gitea/pvc.yaml
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
apiVersion: v1
|
||||||
|
metadata:
|
||||||
|
name: gitea-shared-storage
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
volumeMode: Filesystem
|
||||||
|
storageClassName: billing-portal-sc
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 8Gi # default: 10Gi
|
||||||
|
|
@ -0,0 +1,6 @@
|
||||||
|
# Need To Change
|
||||||
|
## Secret File
|
||||||
|
* DOMAIN
|
||||||
|
* ROOT_URL
|
||||||
|
* SSH_DOMAIN
|
||||||
|
* ###-password : aWppbmMxMjMh
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,826 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-postgresql-ha
|
||||||
|
# Auxiliary vars to populate environment variables
|
||||||
|
imagePullSecrets:
|
||||||
|
- name: ncr-billing
|
||||||
|
containers:
|
||||||
|
- name: pgpool
|
||||||
|
image: 36671e2b-kr1-registry.container.nhncloud.com/billing-base/pgpool:4.5.2-debian-12-r2
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: "false"
|
||||||
|
- name: PGPOOL_BACKEND_NODES
|
||||||
|
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
||||||
|
- name: PGPOOL_SR_CHECK_USER
|
||||||
|
value: "repmgr"
|
||||||
|
- name: PGPOOL_SR_CHECK_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: repmgr-password
|
||||||
|
- name: PGPOOL_SR_CHECK_DATABASE
|
||||||
|
value: "postgres"
|
||||||
|
- name: PGPOOL_ENABLE_LDAP
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_POSTGRES_USERNAME
|
||||||
|
value: "gitea"
|
||||||
|
- name: PGPOOL_POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: password
|
||||||
|
- name: PGPOOL_ADMIN_USERNAME
|
||||||
|
value: "admin"
|
||||||
|
- name: PGPOOL_ADMIN_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
key: admin-password
|
||||||
|
- name: PGPOOL_AUTHENTICATION_METHOD
|
||||||
|
value: "scram-sha-256"
|
||||||
|
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
||||||
|
value: "yes"
|
||||||
|
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
||||||
|
value: "transaction"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
||||||
|
value: "yes"
|
||||||
|
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_RESERVED_CONNECTIONS
|
||||||
|
value: '1'
|
||||||
|
- name: PGPOOL_CHILD_LIFE_TIME
|
||||||
|
value: ""
|
||||||
|
- name: PGPOOL_ENABLE_TLS
|
||||||
|
value: "no"
|
||||||
|
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
||||||
|
value: "6"
|
||||||
|
envFrom:
|
||||||
|
ports:
|
||||||
|
- name: postgresql
|
||||||
|
containerPort: 5432
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 375m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 384Mi
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 256Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/etc
|
||||||
|
subPath: app-etc-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/pgpool/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/deployment.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea
|
||||||
|
namespace: gitea
|
||||||
|
annotations:
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
spec:
|
||||||
|
replicas: 1
|
||||||
|
strategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 0
|
||||||
|
maxSurge: 100%
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
spec:
|
||||||
|
imagePullSecrets:
|
||||||
|
- name: ncr-billing #ljh
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1000
|
||||||
|
initContainers:
|
||||||
|
- name: init-directories
|
||||||
|
image: "36671e2b-kr1-registry.container.nhncloud.com/billing-base/gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
volumeMounts:
|
||||||
|
- name: init
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
- name: init-app-ini
|
||||||
|
image: "36671e2b-kr1-registry.container.nhncloud.com/billing-base/gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
command: ["/usr/sbin/config_environment.sh"]
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
volumeMounts:
|
||||||
|
- name: config
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
- name: inline-config-sources
|
||||||
|
mountPath: /env-to-ini-mounts/inlines/
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
- name: configure-gitea
|
||||||
|
image: "36671e2b-kr1-registry.container.nhncloud.com/billing-base/gitea/gitea:1.22.1-rootless"
|
||||||
|
command: ["/usr/sbin/configure_gitea.sh"]
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
securityContext:
|
||||||
|
runAsUser: 1000
|
||||||
|
env:
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: HOME
|
||||||
|
value: /data/gitea/git
|
||||||
|
- name: GITEA_ADMIN_USERNAME
|
||||||
|
value: "gitea_admin"
|
||||||
|
- name: GITEA_ADMIN_PASSWORD
|
||||||
|
#value: "ijinc123!" # sdjo
|
||||||
|
value: "grumatic123!"
|
||||||
|
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||||
|
value: keepUpdated
|
||||||
|
volumeMounts:
|
||||||
|
- name: init
|
||||||
|
mountPath: /usr/sbin
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
resources:
|
||||||
|
limits: {}
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 128Mi
|
||||||
|
terminationGracePeriodSeconds: 60
|
||||||
|
imagePullSecrets:
|
||||||
|
- name: ncr-billing
|
||||||
|
containers:
|
||||||
|
- name: gitea
|
||||||
|
image: "gitea/gitea:1.22.1-rootless"
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
env:
|
||||||
|
# SSH Port values have to be set here as well for openssh configuration
|
||||||
|
- name: SSH_LISTEN_PORT
|
||||||
|
value: "2222"
|
||||||
|
- name: SSH_PORT
|
||||||
|
value: "22"
|
||||||
|
- name: GITEA_APP_INI
|
||||||
|
value: /data/gitea/conf/app.ini
|
||||||
|
- name: GITEA_CUSTOM
|
||||||
|
value: /data/gitea
|
||||||
|
- name: GITEA_WORK_DIR
|
||||||
|
value: /data
|
||||||
|
- name: GITEA_TEMP
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: TMPDIR
|
||||||
|
value: /tmp/gitea
|
||||||
|
- name: HOME
|
||||||
|
value: /data/gitea/git
|
||||||
|
ports:
|
||||||
|
- name: ssh
|
||||||
|
containerPort: 2222
|
||||||
|
- name: http
|
||||||
|
containerPort: 3000
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 10
|
||||||
|
initialDelaySeconds: 200
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
timeoutSeconds: 1
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
timeoutSeconds: 1
|
||||||
|
resources:
|
||||||
|
{}
|
||||||
|
securityContext:
|
||||||
|
{}
|
||||||
|
volumeMounts:
|
||||||
|
- name: temp
|
||||||
|
mountPath: /tmp
|
||||||
|
- name: data
|
||||||
|
mountPath: /data
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: init
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea-init
|
||||||
|
defaultMode: 110
|
||||||
|
- name: config
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea
|
||||||
|
defaultMode: 110
|
||||||
|
- name: inline-config-sources
|
||||||
|
secret:
|
||||||
|
secretName: release-name-gitea-inline-config
|
||||||
|
- name: temp
|
||||||
|
emptyDir: {}
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: gitea-shared-storage
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
replicas: 3
|
||||||
|
podManagementPolicy: "Parallel"
|
||||||
|
serviceName: release-name-postgresql-ha-postgresql-headless
|
||||||
|
updateStrategy:
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
spec:
|
||||||
|
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-postgresql-ha
|
||||||
|
hostNetwork: false
|
||||||
|
hostIPC: false
|
||||||
|
imagePullSecrets:
|
||||||
|
- name: ncr-billing
|
||||||
|
containers:
|
||||||
|
- name: postgresql
|
||||||
|
image: 36671e2b-kr1-registry.container.nhncloud.com/billing-base/postgresql-repmgr:16.3.0-debian-12-r15
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /pre-stop.sh
|
||||||
|
- "25"
|
||||||
|
# Auxiliary vars to populate environment variables
|
||||||
|
env:
|
||||||
|
- name: BITNAMI_DEBUG
|
||||||
|
value: "false"
|
||||||
|
# PostgreSQL configuration
|
||||||
|
- name: POSTGRESQL_VOLUME_DIR
|
||||||
|
value: "/bitnami/postgresql"
|
||||||
|
- name: PGDATA
|
||||||
|
value: "/bitnami/postgresql/data"
|
||||||
|
- name: POSTGRES_POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: postgres-password
|
||||||
|
- name: POSTGRES_USER
|
||||||
|
value: "gitea"
|
||||||
|
- name: POSTGRES_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: password
|
||||||
|
- name: POSTGRES_DB
|
||||||
|
value: "gitea"
|
||||||
|
- name: POSTGRESQL_LOG_HOSTNAME
|
||||||
|
value: "true"
|
||||||
|
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||||
|
value: "false"
|
||||||
|
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||||
|
value: "false"
|
||||||
|
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||||
|
value: "off"
|
||||||
|
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||||
|
value: "error"
|
||||||
|
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||||
|
value: "pgaudit, repmgr"
|
||||||
|
- name: POSTGRESQL_ENABLE_TLS
|
||||||
|
value: "no"
|
||||||
|
- name: POSTGRESQL_PORT_NUMBER
|
||||||
|
value: "5432"
|
||||||
|
# Repmgr configuration
|
||||||
|
- name: REPMGR_PORT_NUMBER
|
||||||
|
value: "5432"
|
||||||
|
- name: REPMGR_PRIMARY_PORT
|
||||||
|
value: "5432"
|
||||||
|
- name: MY_POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: REPMGR_UPGRADE_EXTENSION
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_PGHBA_TRUST_ALL
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_MOUNTED_CONF_DIR
|
||||||
|
value: "/bitnami/repmgr/conf"
|
||||||
|
- name: REPMGR_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: REPMGR_PARTNER_NODES
|
||||||
|
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
||||||
|
- name: REPMGR_PRIMARY_HOST
|
||||||
|
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||||
|
- name: REPMGR_NODE_NAME
|
||||||
|
value: "$(MY_POD_NAME)"
|
||||||
|
- name: REPMGR_NODE_NETWORK_NAME
|
||||||
|
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||||
|
- name: REPMGR_NODE_TYPE
|
||||||
|
value: "data"
|
||||||
|
- name: REPMGR_LOG_LEVEL
|
||||||
|
value: "NOTICE"
|
||||||
|
- name: REPMGR_CONNECT_TIMEOUT
|
||||||
|
value: "5"
|
||||||
|
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||||
|
value: "2"
|
||||||
|
- name: REPMGR_RECONNECT_INTERVAL
|
||||||
|
value: "3"
|
||||||
|
- name: REPMGR_USERNAME
|
||||||
|
value: "repmgr"
|
||||||
|
- name: REPMGR_PASSWORD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
key: repmgr-password
|
||||||
|
- name: REPMGR_DATABASE
|
||||||
|
value: "repmgr"
|
||||||
|
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||||
|
value: "no"
|
||||||
|
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||||
|
value: "5"
|
||||||
|
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||||
|
value: "1"
|
||||||
|
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||||
|
value: "30"
|
||||||
|
envFrom:
|
||||||
|
ports:
|
||||||
|
- name: postgresql
|
||||||
|
containerPort: 5432
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 6
|
||||||
|
initialDelaySeconds: 30
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 6
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- bash
|
||||||
|
- -ec
|
||||||
|
- |
|
||||||
|
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
||||||
|
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 375m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 384Mi
|
||||||
|
requests:
|
||||||
|
cpu: 250m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 256Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/postgresql/conf
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/postgresql/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/conf
|
||||||
|
subPath: repmgr-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/tmp
|
||||||
|
subPath: repmgr-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/repmgr/logs
|
||||||
|
subPath: repmgr-logs-dir
|
||||||
|
- name: data
|
||||||
|
mountPath: /bitnami/postgresql
|
||||||
|
- name: hooks-scripts
|
||||||
|
mountPath: /pre-stop.sh
|
||||||
|
subPath: pre-stop.sh
|
||||||
|
- name: hooks-scripts
|
||||||
|
mountPath: /readiness-probe.sh
|
||||||
|
subPath: readiness-probe.sh
|
||||||
|
volumes:
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
- name: hooks-scripts
|
||||||
|
configMap:
|
||||||
|
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
||||||
|
defaultMode: 0755
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: data
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
storageClassName: billing-portal-sc
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "8Gi"
|
||||||
|
---
|
||||||
|
# Source: cdgitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: StatefulSet
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: "gitea"
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
updateStrategy:
|
||||||
|
rollingUpdate:
|
||||||
|
partition: 0
|
||||||
|
type: RollingUpdate
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
replicas: 3
|
||||||
|
serviceName: release-name-redis-cluster-headless
|
||||||
|
podManagementPolicy: Parallel
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
annotations:
|
||||||
|
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
||||||
|
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||||
|
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
||||||
|
spec:
|
||||||
|
hostNetwork: false
|
||||||
|
enableServiceLinks: false
|
||||||
|
|
||||||
|
securityContext:
|
||||||
|
fsGroup: 1001
|
||||||
|
fsGroupChangePolicy: Always
|
||||||
|
supplementalGroups: []
|
||||||
|
sysctls: []
|
||||||
|
serviceAccountName: release-name-redis-cluster
|
||||||
|
automountServiceAccountToken: false
|
||||||
|
affinity:
|
||||||
|
podAffinity:
|
||||||
|
|
||||||
|
podAntiAffinity:
|
||||||
|
preferredDuringSchedulingIgnoredDuringExecution:
|
||||||
|
- podAffinityTerm:
|
||||||
|
labelSelector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
topologyKey: kubernetes.io/hostname
|
||||||
|
weight: 1
|
||||||
|
nodeAffinity:
|
||||||
|
imagePullSecrets:
|
||||||
|
- name: ncr-billing
|
||||||
|
containers:
|
||||||
|
- name: release-name-redis-cluster
|
||||||
|
image: 36671e2b-kr1-registry.container.nhncloud.com/billing-base/redis-cluster:7.2.5-debian-12-r2
|
||||||
|
imagePullPolicy: "IfNotPresent"
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
privileged: false
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsGroup: 1001
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 1001
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
command: ['/bin/bash', '-c']
|
||||||
|
args:
|
||||||
|
- |
|
||||||
|
# Backwards compatibility change
|
||||||
|
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
||||||
|
echo COPYING FILE
|
||||||
|
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
||||||
|
fi
|
||||||
|
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
||||||
|
pod_index="${pod_index[-1]}"
|
||||||
|
if [[ "$pod_index" == "0" ]]; then
|
||||||
|
export REDIS_CLUSTER_CREATOR="yes"
|
||||||
|
export REDIS_CLUSTER_REPLICAS="0"
|
||||||
|
fi
|
||||||
|
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
||||||
|
env:
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: REDIS_NODES
|
||||||
|
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
||||||
|
- name: ALLOW_EMPTY_PASSWORD
|
||||||
|
value: "yes"
|
||||||
|
- name: REDIS_AOF_ENABLED
|
||||||
|
value: "yes"
|
||||||
|
- name: REDIS_TLS_ENABLED
|
||||||
|
value: "no"
|
||||||
|
- name: REDIS_PORT_NUMBER
|
||||||
|
value: "6379"
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
containerPort: 6379
|
||||||
|
- name: tcp-redis-bus
|
||||||
|
containerPort: 16379
|
||||||
|
livenessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
# One second longer than command timeout should prevent generation of zombie processes.
|
||||||
|
timeoutSeconds: 6
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- /scripts/ping_liveness_local.sh 5
|
||||||
|
readinessProbe:
|
||||||
|
initialDelaySeconds: 5
|
||||||
|
periodSeconds: 5
|
||||||
|
# One second longer than command timeout should prevent generation of zombie processes.
|
||||||
|
timeoutSeconds: 2
|
||||||
|
successThreshold: 1
|
||||||
|
failureThreshold: 5
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- sh
|
||||||
|
- -c
|
||||||
|
- /scripts/ping_readiness_local.sh 1
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpu: 150m
|
||||||
|
ephemeral-storage: 2Gi
|
||||||
|
memory: 192Mi
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
ephemeral-storage: 50Mi
|
||||||
|
memory: 128Mi
|
||||||
|
volumeMounts:
|
||||||
|
- name: scripts
|
||||||
|
mountPath: /scripts
|
||||||
|
- name: redis-data
|
||||||
|
mountPath: /bitnami/redis/data
|
||||||
|
subPath:
|
||||||
|
- name: default-config
|
||||||
|
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
||||||
|
subPath: redis-default.conf
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/etc/
|
||||||
|
subPath: app-conf-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/tmp
|
||||||
|
subPath: app-tmp-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /opt/bitnami/redis/logs
|
||||||
|
subPath: app-logs-dir
|
||||||
|
- name: empty-dir
|
||||||
|
mountPath: /tmp
|
||||||
|
subPath: tmp-dir
|
||||||
|
volumes:
|
||||||
|
- name: scripts
|
||||||
|
configMap:
|
||||||
|
name: release-name-redis-cluster-scripts
|
||||||
|
defaultMode: 0755
|
||||||
|
- name: default-config
|
||||||
|
configMap:
|
||||||
|
name: release-name-redis-cluster-default
|
||||||
|
- name: empty-dir
|
||||||
|
emptyDir: {}
|
||||||
|
volumeClaimTemplates:
|
||||||
|
- metadata:
|
||||||
|
name: redis-data
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- "ReadWriteOnce"
|
||||||
|
storageClassName: billing-portal-sc
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: "8Gi"
|
||||||
|
|
@ -0,0 +1,26 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
name: gitea-ing
|
||||||
|
namespace: gitea
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: gitea.shdsbilling.com
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- path: /
|
||||||
|
pathType: Prefix
|
||||||
|
backend:
|
||||||
|
service:
|
||||||
|
name: release-name-gitea-http
|
||||||
|
port:
|
||||||
|
number: 3000
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- "gitea.shdsbilling.com"
|
||||||
|
secretName: ssl-shdsbilling-com
|
||||||
|
|
||||||
|
|
@ -0,0 +1,172 @@
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/pgpool/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-pgpool
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 4.5.2
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
sessionAffinity: None
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
# nodePort: null
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: pgpool
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql-headless
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: false
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/postgresql-ha/templates/postgresql/service.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-postgresql-ha-postgresql
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/version: 16.3.0
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
ports:
|
||||||
|
- name: "postgresql"
|
||||||
|
port: 5432
|
||||||
|
targetPort: postgresql
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: postgresql-ha
|
||||||
|
app.kubernetes.io/component: postgresql
|
||||||
|
role: data
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/headless-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster-headless
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
publishNotReadyAddresses: true
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
port: 6379
|
||||||
|
targetPort: tcp-redis
|
||||||
|
- name: tcp-redis-bus
|
||||||
|
port: 16379
|
||||||
|
targetPort: tcp-redis-bus
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
---
|
||||||
|
# Source: gitea/charts/redis-cluster/templates/redis-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-redis-cluster
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
app.kubernetes.io/version: 7.2.5
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
sessionAffinity: None
|
||||||
|
ports:
|
||||||
|
- name: tcp-redis
|
||||||
|
port: 6379
|
||||||
|
targetPort: tcp-redis
|
||||||
|
protocol: TCP
|
||||||
|
nodePort: null
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/name: redis-cluster
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/http-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-http
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
# annotations:
|
||||||
|
# {}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
port: 3000
|
||||||
|
targetPort:
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
---
|
||||||
|
# Source: gitea/templates/gitea/ssh-svc.yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: release-name-gitea-ssh
|
||||||
|
namespace: gitea
|
||||||
|
labels:
|
||||||
|
app: gitea
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
|
app.kubernetes.io/version: "1.22.1"
|
||||||
|
version: "1.22.1"
|
||||||
|
# annotations:
|
||||||
|
# {}
|
||||||
|
spec:
|
||||||
|
type: ClusterIP
|
||||||
|
clusterIP: None
|
||||||
|
ports:
|
||||||
|
- name: ssh
|
||||||
|
port: 22
|
||||||
|
targetPort: 2222
|
||||||
|
protocol: TCP
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/name: gitea
|
||||||
|
app.kubernetes.io/instance: release-name
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,669 @@
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Namespace
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
name: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
automountServiceAccountToken: true
|
||||||
|
kind: ServiceAccount
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- endpoints
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resourceNames:
|
||||||
|
- ingress-nginx-leader
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: Role
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- secrets
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- create
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- configmaps
|
||||||
|
- endpoints
|
||||||
|
- nodes
|
||||||
|
- pods
|
||||||
|
- secrets
|
||||||
|
- namespaces
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- coordination.k8s.io
|
||||||
|
resources:
|
||||||
|
- leases
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- nodes
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- services
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- ""
|
||||||
|
resources:
|
||||||
|
- events
|
||||||
|
verbs:
|
||||||
|
- create
|
||||||
|
- patch
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingresses/status
|
||||||
|
verbs:
|
||||||
|
- update
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
resources:
|
||||||
|
- ingressclasses
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- apiGroups:
|
||||||
|
- discovery.k8s.io
|
||||||
|
resources:
|
||||||
|
- endpointslices
|
||||||
|
verbs:
|
||||||
|
- list
|
||||||
|
- watch
|
||||||
|
- get
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- admissionregistration.k8s.io
|
||||||
|
resources:
|
||||||
|
- validatingwebhookconfigurations
|
||||||
|
verbs:
|
||||||
|
- get
|
||||||
|
- update
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: RoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: Role
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
data:
|
||||||
|
allow-snippet-annotations: "false"
|
||||||
|
kind: ConfigMap
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
annotations: # annotaiont부분 추가
|
||||||
|
TCP-80.loadbalancer.nhncloud/listener-protocol: "HTTP"
|
||||||
|
TCP-443.loadbalancer.nhncloud/listener-protocol: "HTTPS"
|
||||||
|
loadbalancer.nhncloud/loadbalancer-name: "shdsbilling-ingress-lb"
|
||||||
|
loadbalancer.openstack.org/keep-floatingip : "true"
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
loadBalancerIP: 133.186.244.202
|
||||||
|
externalTrafficPolicy: Local
|
||||||
|
ipFamilies:
|
||||||
|
- IPv4
|
||||||
|
ipFamilyPolicy: SingleStack
|
||||||
|
ports:
|
||||||
|
- appProtocol: http
|
||||||
|
name: http
|
||||||
|
port: 80
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: http
|
||||||
|
- appProtocol: https
|
||||||
|
name: https
|
||||||
|
port: 443
|
||||||
|
protocol: TCP
|
||||||
|
targetPort: https
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: LoadBalancer
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- appProtocol: https
|
||||||
|
name: https-webhook
|
||||||
|
port: 443
|
||||||
|
targetPort: webhook
|
||||||
|
selector:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
type: ClusterIP
|
||||||
|
---
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-controller
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
minReadySeconds: 0
|
||||||
|
revisionHistoryLimit: 10
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
strategy:
|
||||||
|
rollingUpdate:
|
||||||
|
maxUnavailable: 1
|
||||||
|
type: RollingUpdate
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- /nginx-ingress-controller
|
||||||
|
- --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||||
|
- --election-id=ingress-nginx-leader
|
||||||
|
- --controller-class=k8s.io/ingress-nginx
|
||||||
|
- --ingress-class=nginx
|
||||||
|
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||||
|
- --validating-webhook=:8443
|
||||||
|
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||||
|
- --validating-webhook-key=/usr/local/certificates/key
|
||||||
|
- --enable-metrics=false
|
||||||
|
env:
|
||||||
|
- name: POD_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
- name: LD_PRELOAD
|
||||||
|
value: /usr/local/lib/libmimalloc.so
|
||||||
|
image: registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
lifecycle:
|
||||||
|
preStop:
|
||||||
|
exec:
|
||||||
|
command:
|
||||||
|
- /wait-shutdown
|
||||||
|
livenessProbe:
|
||||||
|
failureThreshold: 5
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
name: controller
|
||||||
|
ports:
|
||||||
|
- containerPort: 80
|
||||||
|
name: http
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 443
|
||||||
|
name: https
|
||||||
|
protocol: TCP
|
||||||
|
- containerPort: 8443
|
||||||
|
name: webhook
|
||||||
|
protocol: TCP
|
||||||
|
readinessProbe:
|
||||||
|
failureThreshold: 3
|
||||||
|
httpGet:
|
||||||
|
path: /healthz
|
||||||
|
port: 10254
|
||||||
|
scheme: HTTP
|
||||||
|
initialDelaySeconds: 10
|
||||||
|
periodSeconds: 10
|
||||||
|
successThreshold: 1
|
||||||
|
timeoutSeconds: 1
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
cpu: 100m
|
||||||
|
memory: 90Mi
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
add:
|
||||||
|
- NET_BIND_SERVICE
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 101
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /usr/local/certificates/
|
||||||
|
name: webhook-cert
|
||||||
|
readOnly: true
|
||||||
|
dnsPolicy: ClusterFirst
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
serviceAccountName: ingress-nginx
|
||||||
|
terminationGracePeriodSeconds: 300
|
||||||
|
volumes:
|
||||||
|
- name: webhook-cert
|
||||||
|
secret:
|
||||||
|
secretName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-create
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- create
|
||||||
|
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: create
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: batch/v1
|
||||||
|
kind: Job
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
namespace: ingress-nginx
|
||||||
|
spec:
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission-patch
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- args:
|
||||||
|
- patch
|
||||||
|
- --webhook-name=ingress-nginx-admission
|
||||||
|
- --namespace=$(POD_NAMESPACE)
|
||||||
|
- --patch-mutating=false
|
||||||
|
- --secret-name=ingress-nginx-admission
|
||||||
|
- --patch-failure-policy=Fail
|
||||||
|
env:
|
||||||
|
- name: POD_NAMESPACE
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.namespace
|
||||||
|
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3
|
||||||
|
imagePullPolicy: IfNotPresent
|
||||||
|
name: patch
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: false
|
||||||
|
capabilities:
|
||||||
|
drop:
|
||||||
|
- ALL
|
||||||
|
readOnlyRootFilesystem: true
|
||||||
|
runAsNonRoot: true
|
||||||
|
runAsUser: 65532
|
||||||
|
seccompProfile:
|
||||||
|
type: RuntimeDefault
|
||||||
|
nodeSelector:
|
||||||
|
kubernetes.io/os: linux
|
||||||
|
restartPolicy: OnFailure
|
||||||
|
serviceAccountName: ingress-nginx-admission
|
||||||
|
---
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: IngressClass
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: controller
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: nginx
|
||||||
|
spec:
|
||||||
|
controller: k8s.io/ingress-nginx
|
||||||
|
---
|
||||||
|
apiVersion: admissionregistration.k8s.io/v1
|
||||||
|
kind: ValidatingWebhookConfiguration
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app.kubernetes.io/component: admission-webhook
|
||||||
|
app.kubernetes.io/instance: ingress-nginx
|
||||||
|
app.kubernetes.io/name: ingress-nginx
|
||||||
|
app.kubernetes.io/part-of: ingress-nginx
|
||||||
|
app.kubernetes.io/version: 1.11.2
|
||||||
|
name: ingress-nginx-admission
|
||||||
|
webhooks:
|
||||||
|
- admissionReviewVersions:
|
||||||
|
- v1
|
||||||
|
clientConfig:
|
||||||
|
service:
|
||||||
|
name: ingress-nginx-controller-admission
|
||||||
|
namespace: ingress-nginx
|
||||||
|
path: /networking/v1/ingresses
|
||||||
|
failurePolicy: Fail
|
||||||
|
matchPolicy: Equivalent
|
||||||
|
name: validate.nginx.ingress.kubernetes.io
|
||||||
|
rules:
|
||||||
|
- apiGroups:
|
||||||
|
- networking.k8s.io
|
||||||
|
apiVersions:
|
||||||
|
- v1
|
||||||
|
operations:
|
||||||
|
- CREATE
|
||||||
|
- UPDATE
|
||||||
|
resources:
|
||||||
|
- ingresses
|
||||||
|
sideEffects: None
|
||||||
Loading…
Reference in New Issue