shdsbilling.com
This commit is contained in:
jaey
parent
9436e26f93
commit
8e849e08c7
|
|
@ -21779,7 +21779,7 @@ spec:
|
|||
key: applicationsetcontroller.enable.scm.providers
|
||||
name: argocd-cmd-params-cm
|
||||
optional: true
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
imagePullPolicy: Always
|
||||
name: argocd-applicationset-controller
|
||||
ports:
|
||||
|
|
@ -21874,7 +21874,7 @@ spec:
|
|||
key: dexserver.disable.tls
|
||||
name: argocd-cmd-params-cm
|
||||
optional: true
|
||||
image: reg.inje-private.com/nnd002/dexidp/dex:v2.38.0
|
||||
image: ghcr.io/dexidp/dex:v2.38.0
|
||||
imagePullPolicy: Always
|
||||
name: dex
|
||||
ports:
|
||||
|
|
@ -21903,7 +21903,7 @@ spec:
|
|||
- -n
|
||||
- /usr/local/bin/argocd
|
||||
- /shared/argocd-dex
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
imagePullPolicy: Always
|
||||
name: copyutil
|
||||
securityContext:
|
||||
|
|
@ -21986,7 +21986,7 @@ spec:
|
|||
key: notificationscontroller.selfservice.enabled
|
||||
name: argocd-cmd-params-cm
|
||||
optional: true
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
imagePullPolicy: Always
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
|
|
@ -22071,7 +22071,7 @@ spec:
|
|||
secretKeyRef:
|
||||
key: auth
|
||||
name: argocd-redis
|
||||
image: reg.inje-private.com/nnd002/redis:7.0.15-alpine
|
||||
image: redis:7.0.15-alpine
|
||||
imagePullPolicy: Always
|
||||
name: redis
|
||||
ports:
|
||||
|
|
@ -22087,7 +22087,7 @@ spec:
|
|||
- argocd
|
||||
- admin
|
||||
- redis-initial-password
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: secret-init
|
||||
securityContext:
|
||||
|
|
@ -22341,7 +22341,7 @@ spec:
|
|||
value: /helm-working-dir
|
||||
- name: HELM_DATA_HOME
|
||||
value: /helm-working-dir
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
imagePullPolicy: Always
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
|
|
@ -22393,7 +22393,7 @@ spec:
|
|||
- -n
|
||||
- /usr/local/bin/argocd
|
||||
- /var/run/argocd/argocd-cmp-server
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
name: copyutil
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -22716,7 +22716,7 @@ spec:
|
|||
key: server.api.content.types
|
||||
name: argocd-cmd-params-cm
|
||||
optional: true
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
imagePullPolicy: Always
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
|
|
@ -23016,7 +23016,7 @@ spec:
|
|||
key: controller.ignore.normalizer.jq.timeout
|
||||
name: argocd-cmd-params-cm
|
||||
optional: true
|
||||
image: reg.inje-private.com/nnd002/argoproj/argocd:v2.12.3
|
||||
image: quay.io/argoproj/argocd:v2.12.3
|
||||
imagePullPolicy: Always
|
||||
name: argocd-application-controller
|
||||
ports:
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ing-argocd
|
||||
name: argocd-ing
|
||||
namespace: argocd
|
||||
annotations:
|
||||
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
|
@ -11,7 +11,7 @@ metadata:
|
|||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: argocd.inje-private.com # 사전 생성된 인증서의 도메인적용.
|
||||
- host: argocd.shdsbilling.com # 사전 생성된 인증서의 도메인적용.
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
|
|
@ -23,6 +23,6 @@ spec:
|
|||
number: 443
|
||||
tls:
|
||||
- hosts:
|
||||
- "argocd.inje-private.com"
|
||||
secretName: argocd-ssl
|
||||
- "argocd.shdsbilling.com"
|
||||
secretName: ssl-shdsbilling-com
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ spec:
|
|||
accessModes:
|
||||
- ReadWriteOnce
|
||||
volumeMode: Filesystem
|
||||
storageClassName: sc-monitoring
|
||||
storageClassName: billing-portal-sc
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi # default: 10Gi
|
||||
storage: 8Gi # default: 10Gi
|
||||
|
|
|
|||
|
|
@ -49,7 +49,7 @@ spec:
|
|||
# Auxiliary vars to populate environment variables
|
||||
containers:
|
||||
- name: pgpool
|
||||
image: reg.inje-private.com/nnd002/bitnami/pgpool:4.5.2-debian-12-r2
|
||||
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -207,7 +207,7 @@ spec:
|
|||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: init-directories
|
||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||
env:
|
||||
|
|
@ -235,7 +235,7 @@ spec:
|
|||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: init-app-ini
|
||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/config_environment.sh"]
|
||||
env:
|
||||
|
|
@ -265,7 +265,7 @@ spec:
|
|||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: configure-gitea
|
||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
command: ["/usr/sbin/configure_gitea.sh"]
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
|
|
@ -284,7 +284,8 @@ spec:
|
|||
- name: GITEA_ADMIN_USERNAME
|
||||
value: "gitea_admin"
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
value: "ijinc123!" # sdjo
|
||||
#value: "ijinc123!" # sdjo
|
||||
value: "grumatic123!"
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: keepUpdated
|
||||
volumeMounts:
|
||||
|
|
@ -303,7 +304,7 @@ spec:
|
|||
terminationGracePeriodSeconds: 60
|
||||
containers:
|
||||
- name: gitea
|
||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
# SSH Port values have to be set here as well for openssh configuration
|
||||
|
|
@ -432,7 +433,7 @@ spec:
|
|||
hostIPC: false
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: reg.inje-private.com/nnd002/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
||||
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -625,6 +626,7 @@ spec:
|
|||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
storageClassName: billing-portal-sc
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
@ -688,7 +690,7 @@ spec:
|
|||
|
||||
containers:
|
||||
- name: release-name-redis-cluster
|
||||
image: reg.inje-private.com/nnd002/bitnami/redis-cluster:7.2.5-debian-12-r2
|
||||
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -810,6 +812,7 @@ spec:
|
|||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
storageClassName: billing-portal-sc
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ing-gitea
|
||||
name: gitea-ing
|
||||
namespace: gitea
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
|
|
@ -9,7 +9,7 @@ metadata:
|
|||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: gitea.inje-private.com
|
||||
- host: gitea.shdsbilling.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
|
|
@ -21,6 +21,6 @@ spec:
|
|||
number: 3000
|
||||
tls:
|
||||
- hosts:
|
||||
- "gitea.inje-private.com"
|
||||
secretName: gitea-ssl
|
||||
- "gitea.shdsbilling.com"
|
||||
secretName: ssl-shdsbilling-com
|
||||
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,672 @@
|
|||
apiVersion: v1 # ns 용 추가 by ljh
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: argocd
|
||||
labels:
|
||||
name: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: dex-server
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: redis
|
||||
app.kubernetes.io/name: argocd-redis
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: repo-server
|
||||
app.kubernetes.io/name: argocd-repo-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-repo-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- appprojects
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- applicationsets
|
||||
- applicationsets/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- appprojects
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applicationsets/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
- extensions
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: dex-server
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- appprojects
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- secrets
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- argocd-notifications-cm
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- argocd-notifications-secret
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: redis
|
||||
app.kubernetes.io/name: argocd-redis
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- argocd-redis
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- appprojects
|
||||
- applicationsets
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- update
|
||||
- delete
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
- nonResourceURLs:
|
||||
- '*'
|
||||
verbs:
|
||||
- '*'
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
rules:
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- applicationsets
|
||||
- applicationsets/finalizers
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applicationsets/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- appprojects
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- apps
|
||||
- extensions
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- patch
|
||||
- update
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
rules:
|
||||
- apiGroups:
|
||||
- '*'
|
||||
resources:
|
||||
- '*'
|
||||
verbs:
|
||||
- delete
|
||||
- get
|
||||
- patch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- pods/log
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- applications
|
||||
- applicationsets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- batch
|
||||
resources:
|
||||
- jobs
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- argoproj.io
|
||||
resources:
|
||||
- workflows
|
||||
verbs:
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-application-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-applicationset-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: dex-server
|
||||
app.kubernetes.io/name: argocd-dex-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-dex-server
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-dex-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-notifications-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-notifications-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: redis
|
||||
app.kubernetes.io/name: argocd-redis
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-redis
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-redis
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: argocd-server
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: application-controller
|
||||
app.kubernetes.io/name: argocd-application-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-application-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: argocd-application-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-application-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: applicationset-controller
|
||||
app.kubernetes.io/name: argocd-applicationset-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-applicationset-controller
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: argocd-applicationset-controller
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-applicationset-controller
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/name: argocd-server
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-server
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: argocd-server
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: argocd-server
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-secret
|
||||
namespace: argocd
|
||||
type: Opaque
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-secret
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-secret
|
||||
namespace: argocd
|
||||
type: Opaque
|
||||
|
|
@ -0,0 +1,81 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-cmd-params-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-cmd-params-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-gpg-keys-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-gpg-keys-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: notifications-controller
|
||||
app.kubernetes.io/name: argocd-notifications-controller
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-notifications-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-rbac-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-rbac-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
ssh_known_hosts: |
|
||||
# This file was automatically generated by hack/update-ssh-known-hosts.sh. DO NOT EDIT
|
||||
[ssh.github.com]:443 ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||
[ssh.github.com]:443 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
[ssh.github.com]:443 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||
bitbucket.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPIQmuzMBuKdWeF4+a2sjSSpBK0iqitSQ+5BM9KhpexuGt20JpTVM7u5BDZngncgrqDMbWdxMWWOGtZ9UgbqgZE=
|
||||
bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO
|
||||
bitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDQeJzhupRu0u0cdegZIa8e86EG2qOCsIsD1Xw0xSeiPDlCr7kq97NLmMbpKTX6Esc30NuoqEEHCuc7yWtwp8dI76EEEB1VqY9QJq6vk+aySyboD5QF61I/1WeTwu+deCbgKMGbUijeXhtfbxSxm6JwGrXrhBdofTsbKRUsrN1WoNgUa8uqN1Vx6WAJw1JHPhglEGGHea6QICwJOAr/6mrui/oB7pkaWKHj3z7d1IC4KWLtY47elvjbaTlkN04Kc/5LFEirorGYVbt15kAUlqGM65pk6ZBxtaO3+30LVlORZkxOh+LKL/BvbZ/iRNhItLqNyieoQj/uh/7Iv4uyH/cV/0b4WDSd3DptigWq84lJubb9t/DnZlrJazxyDCulTmKdOR7vs9gMTo+uoIrPSb8ScTtvw65+odKAlBj59dhnVp9zd7QUojOpXlL62Aw56U4oO+FALuevvMjiWeavKhJqlR7i5n9srYcrNV7ttmDw7kf/97P5zauIhxcjX+xHv4M=
|
||||
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
|
||||
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
|
||||
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
|
||||
gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
|
||||
gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
|
||||
gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
|
||||
ssh.dev.azure.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||
vs-ssh.visualstudio.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7Hr1oTWqNqOlzGJOfGJ4NakVyIzf1rXYd4d7wo6jBlkLvCA4odBlL0mDUyZ0/QUfTTqeu+tm22gOsv+VrVTMk6vwRU75gY/y9ut5Mb3bR5BV58dKXyq9A9UeB5Cakehn5Zgm6x1mKoVyf+FFn26iYqXJRgzIZZcZ5V6hrE0Qg39kZm4az48o0AUbf6Sp4SLdvnuMa2sVNwHBboS7EJkm57XQPVU3/QpyNLHbWDdzwtrlS+ez30S3AdYhLKEOxAG8weOnyrtLJAUen9mTkol8oII1edf7mWWbWVf0nBmly21+nZcmCTISQBtdcyPaEno7fFQMDD26/s0lfKob4Kw8H
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-ssh-known-hosts-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-ssh-known-hosts-cm
|
||||
namespace: argocd
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: argocd-tls-certs-cm
|
||||
app.kubernetes.io/part-of: argocd
|
||||
name: argocd-tls-certs-cm
|
||||
namespace: argocd
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,27 @@
|
|||
# Offloading setting.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: argocd-ing
|
||||
namespace: argocd
|
||||
annotations:
|
||||
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "https"
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: argocd.shdsbilling.com # 사전 생성된 인증서의 도메인적용.
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: argocd-server
|
||||
port:
|
||||
number: 443
|
||||
tls:
|
||||
- hosts:
|
||||
- "argocd.shdsbilling.com"
|
||||
secretName: ssl-shdsbilling-com
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,28 @@
|
|||
#!/bin/bash
|
||||
|
||||
# 원본 YAML 파일
|
||||
input_file="argocd_v2.12.3_add_ns.yaml"
|
||||
|
||||
# CRD가 저장될 파일
|
||||
crd_file="crds.yaml"
|
||||
|
||||
# CRD를 제외한 나머지 리소스를 저장할 파일
|
||||
output_file="deployment_without_crds.yaml"
|
||||
|
||||
# CRD 분리
|
||||
awk '
|
||||
BEGIN { in_crd = 0 }
|
||||
/\r$/ { sub(/\r$/, ""); } # 줄 끝에 있는 \r 제거
|
||||
/^---/ {
|
||||
if (in_crd) {
|
||||
in_crd = 0
|
||||
} else if ($0 ~ /^---/) {
|
||||
if (!in_crd) print "---" > "'$output_file'"
|
||||
}
|
||||
}
|
||||
/^apiVersion: apiextensions.k8s.io\/v1/ { in_crd = 1; print "---" > "'$crd_file'" }
|
||||
in_crd { print > "'$crd_file'" }
|
||||
!in_crd && $0 !~ /^---/ { print > "'$output_file'" }
|
||||
' "$input_file"
|
||||
|
||||
echo "CRD 부분은 $crd_file에 저장되었고, 나머지 리소스는 $output_file에 저장되었습니다."
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,5 @@
|
|||
# kustomization.yaml
|
||||
namespace: argocd
|
||||
|
||||
resources:
|
||||
- argocd_v2.12.3.yaml
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: gitea
|
||||
labels:
|
||||
kubernetes.io/metadata.name: gitea
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: pgpool
|
||||
role: data
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 5432
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: 5432
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/networkpolicy.yaml
|
||||
kind: NetworkPolicy
|
||||
apiVersion: networking.k8s.io/v1
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
egress:
|
||||
- {}
|
||||
ingress:
|
||||
# Allow inbound connections
|
||||
- ports:
|
||||
- port: 6379
|
||||
- port: 16379
|
||||
|
|
@ -0,0 +1,77 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/witness-pdb.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql-witness
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: witness
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/poddisruptionbudget.yaml
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
maxUnavailable: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
matchExpressions:
|
||||
- {key: job-name, operator: NotIn, values: [release-name-redis-cluster-cluster-update]}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: release-name-postgresql-ha
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
automountServiceAccountToken: false
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/redis-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
automountServiceAccountToken: false
|
||||
|
|
@ -0,0 +1,384 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/secrets.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
type: Opaque
|
||||
data:
|
||||
admin-password: "aWppbmMxMjMh"
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/secrets.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
type: Opaque
|
||||
data:
|
||||
postgres-password: "aWppbmMxMjMh"
|
||||
password: "Z2l0ZWE="
|
||||
repmgr-password: "aWppbmMxMjMh"
|
||||
---
|
||||
# Source: gitea/templates/gitea/config.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea-inline-config
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
_generals_: ""
|
||||
cache: |-
|
||||
ADAPTER=redis
|
||||
HOST=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
database: |-
|
||||
DB_TYPE=postgres
|
||||
HOST=release-name-postgresql-ha-pgpool.gitea.svc.cluster.local:5432
|
||||
NAME=gitea
|
||||
PASSWD=gitea
|
||||
USER=gitea
|
||||
indexer: ISSUE_INDEXER_TYPE=db
|
||||
metrics: ENABLED=false
|
||||
queue: |-
|
||||
CONN_STR=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
TYPE=redis
|
||||
repository: ROOT=/data/git/gitea-repositories
|
||||
security: INSTALL_LOCK=true
|
||||
server: |-
|
||||
APP_DATA_PATH=/data
|
||||
DOMAIN=gitea.inje-private.com
|
||||
ENABLE_PPROF=false
|
||||
HTTP_PORT=3000
|
||||
PROTOCOL=http
|
||||
ROOT_URL=http://gitea.inje-private.com
|
||||
SSH_DOMAIN=gitea.inje-private.com
|
||||
SSH_LISTEN_PORT=2222
|
||||
SSH_PORT=22
|
||||
START_SSH_SERVER=true
|
||||
session: |-
|
||||
PROVIDER=redis
|
||||
PROVIDER_CONFIG=redis+cluster://:@release-name-redis-cluster-headless.gitea.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s&
|
||||
---
|
||||
# Source: gitea/templates/gitea/config.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
assertions: |
|
||||
config_environment.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
function env2ini::log() {
|
||||
printf "${1}\n"
|
||||
}
|
||||
|
||||
function env2ini::read_config_to_env() {
|
||||
local section="${1}"
|
||||
local line="${2}"
|
||||
|
||||
if [[ -z "${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '${setting}'"
|
||||
|
||||
if [[ -z "${section}" ]]; then
|
||||
export "GITEA____${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
return
|
||||
fi
|
||||
|
||||
local masked_section="${section//./_0X2E_}" # '//' instructs to replace all matches
|
||||
masked_section="${masked_section//-/_0X2D_}"
|
||||
|
||||
export "GITEA__${masked_section^^}__${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
}
|
||||
|
||||
function env2ini::reload_preset_envs() {
|
||||
env2ini::log "Reloading preset envs..."
|
||||
|
||||
while read -r line; do
|
||||
if [[ -z "${line}" ]]; then
|
||||
# skip empty line
|
||||
return
|
||||
fi
|
||||
|
||||
# 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
|
||||
local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
|
||||
|
||||
if [[ -z "${setting}" ]]; then
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local value=''
|
||||
local regex="^${setting}(\s*)=(\s*)(.*)"
|
||||
if [[ $line =~ $regex ]]; then
|
||||
value="${BASH_REMATCH[3]}"
|
||||
else
|
||||
env2ini::log ' ! invalid setting'
|
||||
exit 1
|
||||
fi
|
||||
|
||||
env2ini::log " + '${setting}'"
|
||||
|
||||
export "${setting^^}=${value}" # '^^' makes the variable content uppercase
|
||||
done < "/tmp/existing-envs"
|
||||
|
||||
rm /tmp/existing-envs
|
||||
}
|
||||
|
||||
|
||||
function env2ini::process_config_file() {
|
||||
local config_file="${1}"
|
||||
local section="$(basename "${config_file}")"
|
||||
|
||||
if [[ $section == '_generals_' ]]; then
|
||||
|
||||
section=''
|
||||
else
|
||||
env2ini::log " ${section}"
|
||||
fi
|
||||
|
||||
while read -r line; do
|
||||
env2ini::read_config_to_env "${section}" "${line}"
|
||||
done < <(awk 1 "${config_file}") # Helm .toYaml trims the trailing new line which breaks line processing; awk 1 ... adds it back while reading
|
||||
}
|
||||
|
||||
function env2ini::load_config_sources() {
|
||||
local path="${1}"
|
||||
|
||||
if [[ -d "${path}" ]]; then
|
||||
env2ini::log "Processing $(basename "${path}")..."
|
||||
|
||||
while read -d '' configFile; do
|
||||
env2ini::process_config_file "${configFile}"
|
||||
done < <(find "${path}" -type l -not -name '..data' -print0)
|
||||
|
||||
env2ini::log "\n"
|
||||
fi
|
||||
}
|
||||
|
||||
function env2ini::generate_initial_secrets() {
|
||||
# These environment variables will either be
|
||||
# - overwritten with user defined values,
|
||||
# - initially used to set up Gitea
|
||||
# Anyway, they won't harm existing app.ini files
|
||||
|
||||
export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
|
||||
export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
|
||||
export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
|
||||
export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
|
||||
|
||||
env2ini::log "...Initial secrets generated\n"
|
||||
}
|
||||
|
||||
# save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
|
||||
env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > /tmp/existing-envs
|
||||
|
||||
# MUST BE CALLED BEFORE OTHER CONFIGURATION
|
||||
env2ini::generate_initial_secrets
|
||||
|
||||
env2ini::load_config_sources '/env-to-ini-mounts/inlines/'
|
||||
env2ini::load_config_sources '/env-to-ini-mounts/additionals/'
|
||||
|
||||
# load existing envs to override auto generated envs
|
||||
env2ini::reload_preset_envs
|
||||
|
||||
env2ini::log "=== All configuration sources loaded ===\n"
|
||||
|
||||
# safety to prevent rewrite of secret keys if an app.ini already exists
|
||||
if [ -f ${GITEA_APP_INI} ]; then
|
||||
env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
|
||||
env2ini::log ' - security.INTERNAL_TOKEN'
|
||||
env2ini::log ' - security.SECRET_KEY'
|
||||
env2ini::log ' - oauth2.JWT_SECRET'
|
||||
env2ini::log ' - server.LFS_JWT_SECRET'
|
||||
|
||||
unset GITEA__SECURITY__INTERNAL_TOKEN
|
||||
unset GITEA__SECURITY__SECRET_KEY
|
||||
unset GITEA__OAUTH2__JWT_SECRET
|
||||
unset GITEA__SERVER__LFS_JWT_SECRET
|
||||
fi
|
||||
|
||||
environment-to-ini -o $GITEA_APP_INI
|
||||
---
|
||||
# Source: gitea/templates/gitea/init.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: release-name-gitea-init
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
type: Opaque
|
||||
stringData:
|
||||
configure_gpg_environment.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
set -eu
|
||||
|
||||
gpg --batch --import /raw/private.asc
|
||||
init_directory_structure.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
set -x
|
||||
mkdir -p /data/git/.ssh
|
||||
chmod -R 700 /data/git/.ssh
|
||||
[ ! -d /data/gitea/conf ] && mkdir -p /data/gitea/conf
|
||||
|
||||
# prepare temp directory structure
|
||||
mkdir -p "${GITEA_TEMP}"
|
||||
chmod ug+rwx "${GITEA_TEMP}"
|
||||
|
||||
|
||||
|
||||
configure_gitea.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||
|
||||
{ # try
|
||||
gitea migrate
|
||||
} || { # catch
|
||||
echo "Gitea migrate might fail due to database connection...This init-container will try again in a few seconds"
|
||||
exit 1
|
||||
}
|
||||
function test_redis_connection() {
|
||||
local RETRY=0
|
||||
local MAX=30
|
||||
|
||||
echo 'Wait for redis to become avialable...'
|
||||
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||
nc -vz -w2 release-name-redis-cluster-headless.gitea.svc.cluster.local 6379 && break
|
||||
RETRY=$[${RETRY}+1]
|
||||
echo "...not ready yet (${RETRY}/${MAX})"
|
||||
done
|
||||
|
||||
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||
echo "Redis not reachable after '${MAX}' attempts!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_redis_connection
|
||||
function configure_admin_user() {
|
||||
local full_admin_list=$(gitea admin user list --admin)
|
||||
local actual_user_table=''
|
||||
|
||||
# We might have distorted output due to warning logs, so we have to detect the actual user table by its headline and trim output above that line
|
||||
local regex="(.*)(ID\s+Username\s+Email\s+IsActive.*)"
|
||||
if [[ "${full_admin_list}" =~ $regex ]]; then
|
||||
actual_user_table=$(echo "${BASH_REMATCH[2]}" | tail -n+2) # tail'ing to drop the table headline
|
||||
else
|
||||
# This code block should never be reached, as long as the output table header remains the same.
|
||||
# If this code block is reached, the regex doesn't match anymore and we probably have to adjust this script.
|
||||
|
||||
echo "ERROR: 'configure_admin_user' was not able to determine the current list of admin users."
|
||||
echo " Please review the output of 'gitea admin user list --admin' shown below."
|
||||
echo " If you think it is an issue with the Helm Chart provisioning, file an issue at https://gitea.com/gitea/helm-chart/issues."
|
||||
echo "DEBUG: Output of 'gitea admin user list --admin'"
|
||||
echo "--"
|
||||
echo "${full_admin_list}"
|
||||
echo "--"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
local ACCOUNT_ID=$(echo "${actual_user_table}" | grep -E "\s+${GITEA_ADMIN_USERNAME}\s+" | awk -F " " "{printf \$1}")
|
||||
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||
local -a create_args
|
||||
create_args=(--admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email "gitea@local.domain")
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = initialOnlyRequireReset ]]; then
|
||||
create_args+=(--must-change-password=true)
|
||||
else
|
||||
create_args+=(--must-change-password=false)
|
||||
fi
|
||||
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||
gitea admin user create "${create_args[@]}"
|
||||
echo '...created.'
|
||||
else
|
||||
if [[ "${GITEA_ADMIN_PASSWORD_MODE}" = keepUpdated ]]; then
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||
# See https://gitea.com/gitea/helm-chart/issues/673
|
||||
# --must-change-password argument was added to change-password, defaulting to true, counter to the previous behavior
|
||||
# which acted as if it were provided with =false. If the argument is present in this version of gitea, then we
|
||||
# should add it to prevent requiring frequent admin password resets.
|
||||
local -a change_args
|
||||
change_args=(--username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}")
|
||||
if gitea admin user change-password --help | grep -qF -- '--must-change-password'; then
|
||||
change_args+=(--must-change-password=false)
|
||||
fi
|
||||
gitea admin user change-password "${change_args[@]}"
|
||||
echo '...password sync done.'
|
||||
else
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist, but update mode is set to '${GITEA_ADMIN_PASSWORD_MODE}'. Skipping."
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
configure_admin_user
|
||||
|
||||
function configure_ldap() {
|
||||
echo 'no ldap configuration... skipping.'
|
||||
}
|
||||
|
||||
configure_ldap
|
||||
|
||||
function configure_oauth() {
|
||||
echo 'no oauth configuration... skipping.'
|
||||
}
|
||||
|
||||
configure_oauth
|
||||
|
||||
echo '==== END GITEA CONFIGURATION ===='
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
# Source: gitea/templates/gitea/pvc.yaml
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: gitea-shared-storage
|
||||
namespace: gitea
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
volumeMode: Filesystem
|
||||
storageClassName: billing-portal-sc
|
||||
resources:
|
||||
requests:
|
||||
storage: 8Gi # default: 10Gi
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
# Need To Change
|
||||
## Secret File
|
||||
* DOMAIN
|
||||
* ROOT_URL
|
||||
* SSH_DOMAIN
|
||||
* ###-password : aWppbmMxMjMh
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,826 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-postgresql-ha
|
||||
# Auxiliary vars to populate environment variables
|
||||
imagePullSecrets:
|
||||
- name: ncr-billing
|
||||
containers:
|
||||
- name: pgpool
|
||||
image: 36671e2b-kr1-registry.container.nhncloud.com/billing-base/pgpool:4.5.2-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: "false"
|
||||
- name: PGPOOL_BACKEND_NODES
|
||||
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
||||
- name: PGPOOL_SR_CHECK_USER
|
||||
value: "repmgr"
|
||||
- name: PGPOOL_SR_CHECK_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: repmgr-password
|
||||
- name: PGPOOL_SR_CHECK_DATABASE
|
||||
value: "postgres"
|
||||
- name: PGPOOL_ENABLE_LDAP
|
||||
value: "no"
|
||||
- name: PGPOOL_POSTGRES_USERNAME
|
||||
value: "gitea"
|
||||
- name: PGPOOL_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: password
|
||||
- name: PGPOOL_ADMIN_USERNAME
|
||||
value: "admin"
|
||||
- name: PGPOOL_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
key: admin-password
|
||||
- name: PGPOOL_AUTHENTICATION_METHOD
|
||||
value: "scram-sha-256"
|
||||
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
||||
value: "yes"
|
||||
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
||||
value: "transaction"
|
||||
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
||||
value: "no"
|
||||
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
||||
value: "yes"
|
||||
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
||||
value: "no"
|
||||
- name: PGPOOL_RESERVED_CONNECTIONS
|
||||
value: '1'
|
||||
- name: PGPOOL_CHILD_LIFE_TIME
|
||||
value: ""
|
||||
- name: PGPOOL_ENABLE_TLS
|
||||
value: "no"
|
||||
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
||||
value: "6"
|
||||
envFrom:
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: 5432
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
||||
readinessProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
||||
resources:
|
||||
limits:
|
||||
cpu: 375m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 384Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/etc
|
||||
subPath: app-etc-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/pgpool/logs
|
||||
subPath: app-logs-dir
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
---
|
||||
# Source: gitea/templates/gitea/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: release-name-gitea
|
||||
namespace: gitea
|
||||
annotations:
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 0
|
||||
maxSurge: 100%
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
spec:
|
||||
imagePullSecrets:
|
||||
- name: ncr-billing #ljh
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
initContainers:
|
||||
- name: init-directories
|
||||
image: "36671e2b-kr1-registry.container.nhncloud.com/billing-base/gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/init_directory_structure.sh"]
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
securityContext:
|
||||
{}
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: init-app-ini
|
||||
image: "36671e2b-kr1-registry.container.nhncloud.com/billing-base/gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
command: ["/usr/sbin/config_environment.sh"]
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: inline-config-sources
|
||||
mountPath: /env-to-ini-mounts/inlines/
|
||||
|
||||
securityContext:
|
||||
{}
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
- name: configure-gitea
|
||||
image: "36671e2b-kr1-registry.container.nhncloud.com/billing-base/gitea/gitea:1.22.1-rootless"
|
||||
command: ["/usr/sbin/configure_gitea.sh"]
|
||||
imagePullPolicy: IfNotPresent
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
env:
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
- name: GITEA_ADMIN_USERNAME
|
||||
value: "gitea_admin"
|
||||
- name: GITEA_ADMIN_PASSWORD
|
||||
#value: "ijinc123!" # sdjo
|
||||
value: "grumatic123!"
|
||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
||||
value: keepUpdated
|
||||
volumeMounts:
|
||||
- name: init
|
||||
mountPath: /usr/sbin
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
resources:
|
||||
limits: {}
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationGracePeriodSeconds: 60
|
||||
imagePullSecrets:
|
||||
- name: ncr-billing
|
||||
containers:
|
||||
- name: gitea
|
||||
image: "gitea/gitea:1.22.1-rootless"
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
# SSH Port values have to be set here as well for openssh configuration
|
||||
- name: SSH_LISTEN_PORT
|
||||
value: "2222"
|
||||
- name: SSH_PORT
|
||||
value: "22"
|
||||
- name: GITEA_APP_INI
|
||||
value: /data/gitea/conf/app.ini
|
||||
- name: GITEA_CUSTOM
|
||||
value: /data/gitea
|
||||
- name: GITEA_WORK_DIR
|
||||
value: /data
|
||||
- name: GITEA_TEMP
|
||||
value: /tmp/gitea
|
||||
- name: TMPDIR
|
||||
value: /tmp/gitea
|
||||
- name: HOME
|
||||
value: /data/gitea/git
|
||||
ports:
|
||||
- name: ssh
|
||||
containerPort: 2222
|
||||
- name: http
|
||||
containerPort: 3000
|
||||
livenessProbe:
|
||||
failureThreshold: 10
|
||||
initialDelaySeconds: 200
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: http
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: http
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
{}
|
||||
securityContext:
|
||||
{}
|
||||
volumeMounts:
|
||||
- name: temp
|
||||
mountPath: /tmp
|
||||
- name: data
|
||||
mountPath: /data
|
||||
|
||||
volumes:
|
||||
- name: init
|
||||
secret:
|
||||
secretName: release-name-gitea-init
|
||||
defaultMode: 110
|
||||
- name: config
|
||||
secret:
|
||||
secretName: release-name-gitea
|
||||
defaultMode: 110
|
||||
- name: inline-config-sources
|
||||
secret:
|
||||
secretName: release-name-gitea-inline-config
|
||||
- name: temp
|
||||
emptyDir: {}
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-shared-storage
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
replicas: 3
|
||||
podManagementPolicy: "Parallel"
|
||||
serviceName: release-name-postgresql-ha-postgresql-headless
|
||||
updateStrategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
spec:
|
||||
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-postgresql-ha
|
||||
hostNetwork: false
|
||||
hostIPC: false
|
||||
imagePullSecrets:
|
||||
- name: ncr-billing
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: 36671e2b-kr1-registry.container.nhncloud.com/billing-base/postgresql-repmgr:16.3.0-debian-12-r15
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /pre-stop.sh
|
||||
- "25"
|
||||
# Auxiliary vars to populate environment variables
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: "false"
|
||||
# PostgreSQL configuration
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: "/bitnami/postgresql"
|
||||
- name: PGDATA
|
||||
value: "/bitnami/postgresql/data"
|
||||
- name: POSTGRES_POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: postgres-password
|
||||
- name: POSTGRES_USER
|
||||
value: "gitea"
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: password
|
||||
- name: POSTGRES_DB
|
||||
value: "gitea"
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: "true"
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: "false"
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: "false"
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: "off"
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: "error"
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: "pgaudit, repmgr"
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: "no"
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: "5432"
|
||||
# Repmgr configuration
|
||||
- name: REPMGR_PORT_NUMBER
|
||||
value: "5432"
|
||||
- name: REPMGR_PRIMARY_PORT
|
||||
value: "5432"
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REPMGR_UPGRADE_EXTENSION
|
||||
value: "no"
|
||||
- name: REPMGR_PGHBA_TRUST_ALL
|
||||
value: "no"
|
||||
- name: REPMGR_MOUNTED_CONF_DIR
|
||||
value: "/bitnami/repmgr/conf"
|
||||
- name: REPMGR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: REPMGR_PARTNER_NODES
|
||||
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
||||
- name: REPMGR_PRIMARY_HOST
|
||||
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||
- name: REPMGR_NODE_NAME
|
||||
value: "$(MY_POD_NAME)"
|
||||
- name: REPMGR_NODE_NETWORK_NAME
|
||||
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
||||
- name: REPMGR_NODE_TYPE
|
||||
value: "data"
|
||||
- name: REPMGR_LOG_LEVEL
|
||||
value: "NOTICE"
|
||||
- name: REPMGR_CONNECT_TIMEOUT
|
||||
value: "5"
|
||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
||||
value: "2"
|
||||
- name: REPMGR_RECONNECT_INTERVAL
|
||||
value: "3"
|
||||
- name: REPMGR_USERNAME
|
||||
value: "repmgr"
|
||||
- name: REPMGR_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
key: repmgr-password
|
||||
- name: REPMGR_DATABASE
|
||||
value: "repmgr"
|
||||
- name: REPMGR_FENCE_OLD_PRIMARY
|
||||
value: "no"
|
||||
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
||||
value: "5"
|
||||
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
||||
value: "1"
|
||||
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
||||
value: "30"
|
||||
envFrom:
|
||||
ports:
|
||||
- name: postgresql
|
||||
containerPort: 5432
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
||||
readinessProbe:
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
exec:
|
||||
command:
|
||||
- bash
|
||||
- -ec
|
||||
- |
|
||||
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
||||
resources:
|
||||
limits:
|
||||
cpu: 375m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 384Mi
|
||||
requests:
|
||||
cpu: 250m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 256Mi
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/conf
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/postgresql/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/conf
|
||||
subPath: repmgr-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/tmp
|
||||
subPath: repmgr-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/repmgr/logs
|
||||
subPath: repmgr-logs-dir
|
||||
- name: data
|
||||
mountPath: /bitnami/postgresql
|
||||
- name: hooks-scripts
|
||||
mountPath: /pre-stop.sh
|
||||
subPath: pre-stop.sh
|
||||
- name: hooks-scripts
|
||||
mountPath: /readiness-probe.sh
|
||||
subPath: readiness-probe.sh
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
- name: hooks-scripts
|
||||
configMap:
|
||||
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
||||
defaultMode: 0755
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
storageClassName: billing-portal-sc
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
---
|
||||
# Source: cdgitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: "gitea"
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
partition: 0
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
replicas: 3
|
||||
serviceName: release-name-redis-cluster-headless
|
||||
podManagementPolicy: Parallel
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
annotations:
|
||||
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
||||
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
||||
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
||||
spec:
|
||||
hostNetwork: false
|
||||
enableServiceLinks: false
|
||||
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
supplementalGroups: []
|
||||
sysctls: []
|
||||
serviceAccountName: release-name-redis-cluster
|
||||
automountServiceAccountToken: false
|
||||
affinity:
|
||||
podAffinity:
|
||||
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
nodeAffinity:
|
||||
imagePullSecrets:
|
||||
- name: ncr-billing
|
||||
containers:
|
||||
- name: release-name-redis-cluster
|
||||
image: 36671e2b-kr1-registry.container.nhncloud.com/billing-base/redis-cluster:7.2.5-debian-12-r2
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
command: ['/bin/bash', '-c']
|
||||
args:
|
||||
- |
|
||||
# Backwards compatibility change
|
||||
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
||||
echo COPYING FILE
|
||||
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
||||
fi
|
||||
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
||||
pod_index="${pod_index[-1]}"
|
||||
if [[ "$pod_index" == "0" ]]; then
|
||||
export REDIS_CLUSTER_CREATOR="yes"
|
||||
export REDIS_CLUSTER_REPLICAS="0"
|
||||
fi
|
||||
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: REDIS_NODES
|
||||
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
||||
- name: ALLOW_EMPTY_PASSWORD
|
||||
value: "yes"
|
||||
- name: REDIS_AOF_ENABLED
|
||||
value: "yes"
|
||||
- name: REDIS_TLS_ENABLED
|
||||
value: "no"
|
||||
- name: REDIS_PORT_NUMBER
|
||||
value: "6379"
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
containerPort: 6379
|
||||
- name: tcp-redis-bus
|
||||
containerPort: 16379
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
# One second longer than command timeout should prevent generation of zombie processes.
|
||||
timeoutSeconds: 6
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /scripts/ping_liveness_local.sh 5
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
# One second longer than command timeout should prevent generation of zombie processes.
|
||||
timeoutSeconds: 2
|
||||
successThreshold: 1
|
||||
failureThreshold: 5
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- /scripts/ping_readiness_local.sh 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 2Gi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
volumeMounts:
|
||||
- name: scripts
|
||||
mountPath: /scripts
|
||||
- name: redis-data
|
||||
mountPath: /bitnami/redis/data
|
||||
subPath:
|
||||
- name: default-config
|
||||
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
||||
subPath: redis-default.conf
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/etc/
|
||||
subPath: app-conf-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/tmp
|
||||
subPath: app-tmp-dir
|
||||
- name: empty-dir
|
||||
mountPath: /opt/bitnami/redis/logs
|
||||
subPath: app-logs-dir
|
||||
- name: empty-dir
|
||||
mountPath: /tmp
|
||||
subPath: tmp-dir
|
||||
volumes:
|
||||
- name: scripts
|
||||
configMap:
|
||||
name: release-name-redis-cluster-scripts
|
||||
defaultMode: 0755
|
||||
- name: default-config
|
||||
configMap:
|
||||
name: release-name-redis-cluster-default
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: redis-data
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
spec:
|
||||
accessModes:
|
||||
- "ReadWriteOnce"
|
||||
storageClassName: billing-portal-sc
|
||||
resources:
|
||||
requests:
|
||||
storage: "8Gi"
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea-ing
|
||||
namespace: gitea
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: gitea.shdsbilling.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: release-name-gitea-http
|
||||
port:
|
||||
number: 3000
|
||||
tls:
|
||||
- hosts:
|
||||
- "gitea.shdsbilling.com"
|
||||
secretName: ssl-shdsbilling-com
|
||||
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
# Source: gitea/charts/postgresql-ha/templates/pgpool/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-pgpool
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 4.5.2
|
||||
app.kubernetes.io/component: pgpool
|
||||
spec:
|
||||
type: ClusterIP
|
||||
sessionAffinity: None
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
# nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: pgpool
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/service-headless.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql-headless
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: false
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
---
|
||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-postgresql-ha-postgresql
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/version: 16.3.0
|
||||
app.kubernetes.io/component: postgresql
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- name: "postgresql"
|
||||
port: 5432
|
||||
targetPort: postgresql
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: postgresql-ha
|
||||
app.kubernetes.io/component: postgresql
|
||||
role: data
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/headless-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-redis-cluster-headless
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
publishNotReadyAddresses: true
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp-redis
|
||||
- name: tcp-redis-bus
|
||||
port: 16379
|
||||
targetPort: tcp-redis-bus
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
---
|
||||
# Source: gitea/charts/redis-cluster/templates/redis-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-redis-cluster
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
app.kubernetes.io/version: 7.2.5
|
||||
spec:
|
||||
type: ClusterIP
|
||||
sessionAffinity: None
|
||||
ports:
|
||||
- name: tcp-redis
|
||||
port: 6379
|
||||
targetPort: tcp-redis
|
||||
protocol: TCP
|
||||
nodePort: null
|
||||
selector:
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/name: redis-cluster
|
||||
---
|
||||
# Source: gitea/templates/gitea/http-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-gitea-http
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
# annotations:
|
||||
# {}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
targetPort:
|
||||
selector:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
---
|
||||
# Source: gitea/templates/gitea/ssh-svc.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: release-name-gitea-ssh
|
||||
namespace: gitea
|
||||
labels:
|
||||
app: gitea
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
app.kubernetes.io/version: "1.22.1"
|
||||
version: "1.22.1"
|
||||
# annotations:
|
||||
# {}
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
ports:
|
||||
- name: ssh
|
||||
port: 22
|
||||
targetPort: 2222
|
||||
protocol: TCP
|
||||
selector:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: release-name
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -0,0 +1,669 @@
|
|||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
name: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
automountServiceAccountToken: true
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- pods
|
||||
- secrets
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
- endpoints
|
||||
- nodes
|
||||
- pods
|
||||
- secrets
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- nodes
|
||||
verbs:
|
||||
- get
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- patch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- get
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
allow-snippet-annotations: "false"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
annotations: # annotaiont부분 추가
|
||||
TCP-80.loadbalancer.nhncloud/listener-protocol: "HTTP"
|
||||
TCP-443.loadbalancer.nhncloud/listener-protocol: "HTTPS"
|
||||
loadbalancer.nhncloud/loadbalancer-name: "shdsbilling-ingress-lb"
|
||||
loadbalancer.openstack.org/keep-floatingip : "true"
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
loadBalancerIP: 133.186.244.202
|
||||
externalTrafficPolicy: Local
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- appProtocol: http
|
||||
name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
- appProtocol: https
|
||||
name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: LoadBalancer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
ports:
|
||||
- appProtocol: https
|
||||
name: https-webhook
|
||||
port: 443
|
||||
targetPort: webhook
|
||||
selector:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
minReadySeconds: 0
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- /nginx-ingress-controller
|
||||
- --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --election-id=ingress-nginx-leader
|
||||
- --controller-class=k8s.io/ingress-nginx
|
||||
- --ingress-class=nginx
|
||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --validating-webhook=:8443
|
||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||
- --validating-webhook-key=/usr/local/certificates/key
|
||||
- --enable-metrics=false
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: controller
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 8443
|
||||
name: webhook
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
runAsUser: 101
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/certificates/
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
dnsPolicy: ClusterFirst
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
serviceAccountName: ingress-nginx
|
||||
terminationGracePeriodSeconds: 300
|
||||
volumes:
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- create
|
||||
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --secret-name=ingress-nginx-admission
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: create
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- patch
|
||||
- --webhook-name=ingress-nginx-admission
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --patch-mutating=false
|
||||
- --secret-name=ingress-nginx-admission
|
||||
- --patch-failure-policy=Fail
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: patch
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: controller
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
---
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: admission-webhook
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.11.2
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
path: /networking/v1/ingresses
|
||||
failurePolicy: Fail
|
||||
matchPolicy: Equivalent
|
||||
name: validate.nginx.ingress.kubernetes.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
sideEffects: None
|
||||
Loading…
Reference in New Issue