final
This commit is contained in:
jaey
parent
8e849e08c7
commit
f1e63a9bc9
File diff suppressed because it is too large
Load Diff
|
|
@ -1,28 +0,0 @@
|
||||||
# Offloading setting.
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: argocd-ing
|
|
||||||
namespace: argocd
|
|
||||||
annotations:
|
|
||||||
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
||||||
nginx.ingress.kubernetes.io/backend-protocol: "https"
|
|
||||||
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
rules:
|
|
||||||
- host: argocd.shdsbilling.com # 사전 생성된 인증서의 도메인적용.
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: argocd-server
|
|
||||||
port:
|
|
||||||
number: 443
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- "argocd.shdsbilling.com"
|
|
||||||
secretName: ssl-shdsbilling-com
|
|
||||||
|
|
||||||
|
|
@ -1,815 +0,0 @@
|
||||||
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: release-name-postgresql-ha-pgpool
|
|
||||||
namespace: gitea
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 4.5.2
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 4.5.2
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
spec:
|
|
||||||
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
affinity:
|
|
||||||
podAffinity:
|
|
||||||
podAntiAffinity:
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
weight: 1
|
|
||||||
nodeAffinity:
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1001
|
|
||||||
fsGroupChangePolicy: Always
|
|
||||||
supplementalGroups: []
|
|
||||||
sysctls: []
|
|
||||||
serviceAccountName: release-name-postgresql-ha
|
|
||||||
# Auxiliary vars to populate environment variables
|
|
||||||
containers:
|
|
||||||
- name: pgpool
|
|
||||||
image: reg.inje-private.com/bitnami/pgpool:4.5.2-debian-12-r2
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
privileged: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1001
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
env:
|
|
||||||
- name: BITNAMI_DEBUG
|
|
||||||
value: "false"
|
|
||||||
- name: PGPOOL_BACKEND_NODES
|
|
||||||
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
|
||||||
- name: PGPOOL_SR_CHECK_USER
|
|
||||||
value: "repmgr"
|
|
||||||
- name: PGPOOL_SR_CHECK_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: repmgr-password
|
|
||||||
- name: PGPOOL_SR_CHECK_DATABASE
|
|
||||||
value: "postgres"
|
|
||||||
- name: PGPOOL_ENABLE_LDAP
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_POSTGRES_USERNAME
|
|
||||||
value: "gitea"
|
|
||||||
- name: PGPOOL_POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: password
|
|
||||||
- name: PGPOOL_ADMIN_USERNAME
|
|
||||||
value: "admin"
|
|
||||||
- name: PGPOOL_ADMIN_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-pgpool
|
|
||||||
key: admin-password
|
|
||||||
- name: PGPOOL_AUTHENTICATION_METHOD
|
|
||||||
value: "scram-sha-256"
|
|
||||||
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
|
||||||
value: "yes"
|
|
||||||
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
|
||||||
value: "transaction"
|
|
||||||
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
|
||||||
value: "yes"
|
|
||||||
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_RESERVED_CONNECTIONS
|
|
||||||
value: '1'
|
|
||||||
- name: PGPOOL_CHILD_LIFE_TIME
|
|
||||||
value: ""
|
|
||||||
- name: PGPOOL_ENABLE_TLS
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
|
||||||
value: "6"
|
|
||||||
envFrom:
|
|
||||||
ports:
|
|
||||||
- name: postgresql
|
|
||||||
containerPort: 5432
|
|
||||||
protocol: TCP
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 5
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 5
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- bash
|
|
||||||
- -ec
|
|
||||||
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 375m
|
|
||||||
ephemeral-storage: 2Gi
|
|
||||||
memory: 384Mi
|
|
||||||
requests:
|
|
||||||
cpu: 250m
|
|
||||||
ephemeral-storage: 50Mi
|
|
||||||
memory: 256Mi
|
|
||||||
volumeMounts:
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /tmp
|
|
||||||
subPath: tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/etc
|
|
||||||
subPath: app-etc-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/conf
|
|
||||||
subPath: app-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/tmp
|
|
||||||
subPath: app-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/logs
|
|
||||||
subPath: app-logs-dir
|
|
||||||
volumes:
|
|
||||||
- name: empty-dir
|
|
||||||
emptyDir: {}
|
|
||||||
---
|
|
||||||
# Source: gitea/templates/gitea/deployment.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: release-name-gitea
|
|
||||||
namespace: gitea
|
|
||||||
annotations:
|
|
||||||
labels:
|
|
||||||
app: gitea
|
|
||||||
app.kubernetes.io/name: gitea
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "1.22.1"
|
|
||||||
version: "1.22.1"
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
strategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
rollingUpdate:
|
|
||||||
maxUnavailable: 0
|
|
||||||
maxSurge: 100%
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: gitea
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
|
||||||
labels:
|
|
||||||
app: gitea
|
|
||||||
app.kubernetes.io/name: gitea
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "1.22.1"
|
|
||||||
version: "1.22.1"
|
|
||||||
spec:
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1000
|
|
||||||
initContainers:
|
|
||||||
- name: init-directories
|
|
||||||
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command: ["/usr/sbin/init_directory_structure.sh"]
|
|
||||||
env:
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
volumeMounts:
|
|
||||||
- name: init
|
|
||||||
mountPath: /usr/sbin
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
- name: init-app-ini
|
|
||||||
image: "gitea/gitea:1.22.1-rootless"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command: ["/usr/sbin/config_environment.sh"]
|
|
||||||
env:
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
volumeMounts:
|
|
||||||
- name: config
|
|
||||||
mountPath: /usr/sbin
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
- name: inline-config-sources
|
|
||||||
mountPath: /env-to-ini-mounts/inlines/
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
- name: configure-gitea
|
|
||||||
image: "gitea/gitea:1.22.1-rootless"
|
|
||||||
command: ["/usr/sbin/configure_gitea.sh"]
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 1000
|
|
||||||
env:
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
- name: HOME
|
|
||||||
value: /data/gitea/git
|
|
||||||
- name: GITEA_ADMIN_USERNAME
|
|
||||||
value: "gitea_admin"
|
|
||||||
- name: GITEA_ADMIN_PASSWORD
|
|
||||||
value: "ijinc123!" # sdjo
|
|
||||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
|
||||||
value: keepUpdated
|
|
||||||
volumeMounts:
|
|
||||||
- name: init
|
|
||||||
mountPath: /usr/sbin
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
terminationGracePeriodSeconds: 60
|
|
||||||
containers:
|
|
||||||
- name: gitea
|
|
||||||
image: "gitea/gitea:1.22.1-rootless"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
# SSH Port values have to be set here as well for openssh configuration
|
|
||||||
- name: SSH_LISTEN_PORT
|
|
||||||
value: "2222"
|
|
||||||
- name: SSH_PORT
|
|
||||||
value: "22"
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
- name: TMPDIR
|
|
||||||
value: /tmp/gitea
|
|
||||||
- name: HOME
|
|
||||||
value: /data/gitea/git
|
|
||||||
ports:
|
|
||||||
- name: ssh
|
|
||||||
containerPort: 2222
|
|
||||||
- name: http
|
|
||||||
containerPort: 3000
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 10
|
|
||||||
initialDelaySeconds: 200
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
tcpSocket:
|
|
||||||
port: http
|
|
||||||
timeoutSeconds: 1
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 3
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
tcpSocket:
|
|
||||||
port: http
|
|
||||||
timeoutSeconds: 1
|
|
||||||
resources:
|
|
||||||
{}
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
volumeMounts:
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- name: init
|
|
||||||
secret:
|
|
||||||
secretName: release-name-gitea-init
|
|
||||||
defaultMode: 110
|
|
||||||
- name: config
|
|
||||||
secret:
|
|
||||||
secretName: release-name-gitea
|
|
||||||
defaultMode: 110
|
|
||||||
- name: inline-config-sources
|
|
||||||
secret:
|
|
||||||
secretName: release-name-gitea-inline-config
|
|
||||||
- name: temp
|
|
||||||
emptyDir: {}
|
|
||||||
- name: data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: gitea-shared-storage
|
|
||||||
---
|
|
||||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
namespace: "gitea"
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 16.3.0
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
role: data
|
|
||||||
spec:
|
|
||||||
replicas: 3
|
|
||||||
podManagementPolicy: "Parallel"
|
|
||||||
serviceName: release-name-postgresql-ha-postgresql-headless
|
|
||||||
updateStrategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
role: data
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 16.3.0
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
role: data
|
|
||||||
spec:
|
|
||||||
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
affinity:
|
|
||||||
podAffinity:
|
|
||||||
|
|
||||||
podAntiAffinity:
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
weight: 1
|
|
||||||
nodeAffinity:
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1001
|
|
||||||
fsGroupChangePolicy: Always
|
|
||||||
supplementalGroups: []
|
|
||||||
sysctls: []
|
|
||||||
serviceAccountName: release-name-postgresql-ha
|
|
||||||
hostNetwork: false
|
|
||||||
hostIPC: false
|
|
||||||
containers:
|
|
||||||
- name: postgresql
|
|
||||||
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
privileged: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1001
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
lifecycle:
|
|
||||||
preStop:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /pre-stop.sh
|
|
||||||
- "25"
|
|
||||||
# Auxiliary vars to populate environment variables
|
|
||||||
env:
|
|
||||||
- name: BITNAMI_DEBUG
|
|
||||||
value: "false"
|
|
||||||
# PostgreSQL configuration
|
|
||||||
- name: POSTGRESQL_VOLUME_DIR
|
|
||||||
value: "/bitnami/postgresql"
|
|
||||||
- name: PGDATA
|
|
||||||
value: "/bitnami/postgresql/data"
|
|
||||||
- name: POSTGRES_POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: postgres-password
|
|
||||||
- name: POSTGRES_USER
|
|
||||||
value: "gitea"
|
|
||||||
- name: POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: password
|
|
||||||
- name: POSTGRES_DB
|
|
||||||
value: "gitea"
|
|
||||||
- name: POSTGRESQL_LOG_HOSTNAME
|
|
||||||
value: "true"
|
|
||||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
|
||||||
value: "off"
|
|
||||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
|
||||||
value: "error"
|
|
||||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
|
||||||
value: "pgaudit, repmgr"
|
|
||||||
- name: POSTGRESQL_ENABLE_TLS
|
|
||||||
value: "no"
|
|
||||||
- name: POSTGRESQL_PORT_NUMBER
|
|
||||||
value: "5432"
|
|
||||||
# Repmgr configuration
|
|
||||||
- name: REPMGR_PORT_NUMBER
|
|
||||||
value: "5432"
|
|
||||||
- name: REPMGR_PRIMARY_PORT
|
|
||||||
value: "5432"
|
|
||||||
- name: MY_POD_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.name
|
|
||||||
- name: REPMGR_UPGRADE_EXTENSION
|
|
||||||
value: "no"
|
|
||||||
- name: REPMGR_PGHBA_TRUST_ALL
|
|
||||||
value: "no"
|
|
||||||
- name: REPMGR_MOUNTED_CONF_DIR
|
|
||||||
value: "/bitnami/repmgr/conf"
|
|
||||||
- name: REPMGR_NAMESPACE
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.namespace
|
|
||||||
- name: REPMGR_PARTNER_NODES
|
|
||||||
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
|
||||||
- name: REPMGR_PRIMARY_HOST
|
|
||||||
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
|
||||||
- name: REPMGR_NODE_NAME
|
|
||||||
value: "$(MY_POD_NAME)"
|
|
||||||
- name: REPMGR_NODE_NETWORK_NAME
|
|
||||||
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
|
||||||
- name: REPMGR_NODE_TYPE
|
|
||||||
value: "data"
|
|
||||||
- name: REPMGR_LOG_LEVEL
|
|
||||||
value: "NOTICE"
|
|
||||||
- name: REPMGR_CONNECT_TIMEOUT
|
|
||||||
value: "5"
|
|
||||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
|
||||||
value: "2"
|
|
||||||
- name: REPMGR_RECONNECT_INTERVAL
|
|
||||||
value: "3"
|
|
||||||
- name: REPMGR_USERNAME
|
|
||||||
value: "repmgr"
|
|
||||||
- name: REPMGR_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: repmgr-password
|
|
||||||
- name: REPMGR_DATABASE
|
|
||||||
value: "repmgr"
|
|
||||||
- name: REPMGR_FENCE_OLD_PRIMARY
|
|
||||||
value: "no"
|
|
||||||
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
|
||||||
value: "5"
|
|
||||||
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
|
||||||
value: "1"
|
|
||||||
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
|
||||||
value: "30"
|
|
||||||
envFrom:
|
|
||||||
ports:
|
|
||||||
- name: postgresql
|
|
||||||
containerPort: 5432
|
|
||||||
protocol: TCP
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 6
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- bash
|
|
||||||
- -ec
|
|
||||||
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 6
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- bash
|
|
||||||
- -ec
|
|
||||||
- |
|
|
||||||
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
|
||||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 375m
|
|
||||||
ephemeral-storage: 2Gi
|
|
||||||
memory: 384Mi
|
|
||||||
requests:
|
|
||||||
cpu: 250m
|
|
||||||
ephemeral-storage: 50Mi
|
|
||||||
memory: 256Mi
|
|
||||||
volumeMounts:
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /tmp
|
|
||||||
subPath: tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/postgresql/conf
|
|
||||||
subPath: app-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/postgresql/tmp
|
|
||||||
subPath: app-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/repmgr/conf
|
|
||||||
subPath: repmgr-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/repmgr/tmp
|
|
||||||
subPath: repmgr-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/repmgr/logs
|
|
||||||
subPath: repmgr-logs-dir
|
|
||||||
- name: data
|
|
||||||
mountPath: /bitnami/postgresql
|
|
||||||
- name: hooks-scripts
|
|
||||||
mountPath: /pre-stop.sh
|
|
||||||
subPath: pre-stop.sh
|
|
||||||
- name: hooks-scripts
|
|
||||||
mountPath: /readiness-probe.sh
|
|
||||||
subPath: readiness-probe.sh
|
|
||||||
volumes:
|
|
||||||
- name: empty-dir
|
|
||||||
emptyDir: {}
|
|
||||||
- name: hooks-scripts
|
|
||||||
configMap:
|
|
||||||
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
|
||||||
defaultMode: 0755
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: data
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- "ReadWriteOnce"
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: "8Gi"
|
|
||||||
---
|
|
||||||
# Source: gitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: release-name-redis-cluster
|
|
||||||
namespace: "gitea"
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
app.kubernetes.io/version: 7.2.5
|
|
||||||
spec:
|
|
||||||
updateStrategy:
|
|
||||||
rollingUpdate:
|
|
||||||
partition: 0
|
|
||||||
type: RollingUpdate
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
replicas: 3
|
|
||||||
serviceName: release-name-redis-cluster-headless
|
|
||||||
podManagementPolicy: Parallel
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
app.kubernetes.io/version: 7.2.5
|
|
||||||
annotations:
|
|
||||||
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
|
||||||
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
|
||||||
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
|
||||||
spec:
|
|
||||||
hostNetwork: false
|
|
||||||
enableServiceLinks: false
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1001
|
|
||||||
fsGroupChangePolicy: Always
|
|
||||||
supplementalGroups: []
|
|
||||||
sysctls: []
|
|
||||||
serviceAccountName: release-name-redis-cluster
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
affinity:
|
|
||||||
podAffinity:
|
|
||||||
|
|
||||||
podAntiAffinity:
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
weight: 1
|
|
||||||
nodeAffinity:
|
|
||||||
|
|
||||||
containers:
|
|
||||||
- name: release-name-redis-cluster
|
|
||||||
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
privileged: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1001
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
command: ['/bin/bash', '-c']
|
|
||||||
args:
|
|
||||||
- |
|
|
||||||
# Backwards compatibility change
|
|
||||||
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
|
||||||
echo COPYING FILE
|
|
||||||
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
|
||||||
fi
|
|
||||||
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
|
||||||
pod_index="${pod_index[-1]}"
|
|
||||||
if [[ "$pod_index" == "0" ]]; then
|
|
||||||
export REDIS_CLUSTER_CREATOR="yes"
|
|
||||||
export REDIS_CLUSTER_REPLICAS="0"
|
|
||||||
fi
|
|
||||||
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
|
||||||
env:
|
|
||||||
- name: POD_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.name
|
|
||||||
- name: REDIS_NODES
|
|
||||||
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
|
||||||
- name: ALLOW_EMPTY_PASSWORD
|
|
||||||
value: "yes"
|
|
||||||
- name: REDIS_AOF_ENABLED
|
|
||||||
value: "yes"
|
|
||||||
- name: REDIS_TLS_ENABLED
|
|
||||||
value: "no"
|
|
||||||
- name: REDIS_PORT_NUMBER
|
|
||||||
value: "6379"
|
|
||||||
ports:
|
|
||||||
- name: tcp-redis
|
|
||||||
containerPort: 6379
|
|
||||||
- name: tcp-redis-bus
|
|
||||||
containerPort: 16379
|
|
||||||
livenessProbe:
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
# One second longer than command timeout should prevent generation of zombie processes.
|
|
||||||
timeoutSeconds: 6
|
|
||||||
successThreshold: 1
|
|
||||||
failureThreshold: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- /scripts/ping_liveness_local.sh 5
|
|
||||||
readinessProbe:
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
# One second longer than command timeout should prevent generation of zombie processes.
|
|
||||||
timeoutSeconds: 2
|
|
||||||
successThreshold: 1
|
|
||||||
failureThreshold: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- /scripts/ping_readiness_local.sh 1
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 150m
|
|
||||||
ephemeral-storage: 2Gi
|
|
||||||
memory: 192Mi
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
ephemeral-storage: 50Mi
|
|
||||||
memory: 128Mi
|
|
||||||
volumeMounts:
|
|
||||||
- name: scripts
|
|
||||||
mountPath: /scripts
|
|
||||||
- name: redis-data
|
|
||||||
mountPath: /bitnami/redis/data
|
|
||||||
subPath:
|
|
||||||
- name: default-config
|
|
||||||
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
|
||||||
subPath: redis-default.conf
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/redis/etc/
|
|
||||||
subPath: app-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/redis/tmp
|
|
||||||
subPath: app-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/redis/logs
|
|
||||||
subPath: app-logs-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /tmp
|
|
||||||
subPath: tmp-dir
|
|
||||||
volumes:
|
|
||||||
- name: scripts
|
|
||||||
configMap:
|
|
||||||
name: release-name-redis-cluster-scripts
|
|
||||||
defaultMode: 0755
|
|
||||||
- name: default-config
|
|
||||||
configMap:
|
|
||||||
name: release-name-redis-cluster-default
|
|
||||||
- name: empty-dir
|
|
||||||
emptyDir: {}
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
name: redis-data
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- "ReadWriteOnce"
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: "8Gi"
|
|
||||||
|
|
@ -1,818 +0,0 @@
|
||||||
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: release-name-postgresql-ha-pgpool
|
|
||||||
namespace: gitea
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 4.5.2
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 4.5.2
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
spec:
|
|
||||||
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
affinity:
|
|
||||||
podAffinity:
|
|
||||||
podAntiAffinity:
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: pgpool
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
weight: 1
|
|
||||||
nodeAffinity:
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1001
|
|
||||||
fsGroupChangePolicy: Always
|
|
||||||
supplementalGroups: []
|
|
||||||
sysctls: []
|
|
||||||
serviceAccountName: release-name-postgresql-ha
|
|
||||||
# Auxiliary vars to populate environment variables
|
|
||||||
containers:
|
|
||||||
- name: pgpool
|
|
||||||
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
privileged: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1001
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
env:
|
|
||||||
- name: BITNAMI_DEBUG
|
|
||||||
value: "false"
|
|
||||||
- name: PGPOOL_BACKEND_NODES
|
|
||||||
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
|
|
||||||
- name: PGPOOL_SR_CHECK_USER
|
|
||||||
value: "repmgr"
|
|
||||||
- name: PGPOOL_SR_CHECK_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: repmgr-password
|
|
||||||
- name: PGPOOL_SR_CHECK_DATABASE
|
|
||||||
value: "postgres"
|
|
||||||
- name: PGPOOL_ENABLE_LDAP
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_POSTGRES_USERNAME
|
|
||||||
value: "gitea"
|
|
||||||
- name: PGPOOL_POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: password
|
|
||||||
- name: PGPOOL_ADMIN_USERNAME
|
|
||||||
value: "admin"
|
|
||||||
- name: PGPOOL_ADMIN_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-pgpool
|
|
||||||
key: admin-password
|
|
||||||
- name: PGPOOL_AUTHENTICATION_METHOD
|
|
||||||
value: "scram-sha-256"
|
|
||||||
- name: PGPOOL_ENABLE_LOAD_BALANCING
|
|
||||||
value: "yes"
|
|
||||||
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
|
|
||||||
value: "transaction"
|
|
||||||
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_ENABLE_LOG_HOSTNAME
|
|
||||||
value: "yes"
|
|
||||||
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_RESERVED_CONNECTIONS
|
|
||||||
value: '1'
|
|
||||||
- name: PGPOOL_CHILD_LIFE_TIME
|
|
||||||
value: ""
|
|
||||||
- name: PGPOOL_ENABLE_TLS
|
|
||||||
value: "no"
|
|
||||||
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
|
|
||||||
value: "6"
|
|
||||||
envFrom:
|
|
||||||
ports:
|
|
||||||
- name: postgresql
|
|
||||||
containerPort: 5432
|
|
||||||
protocol: TCP
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 5
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /opt/bitnami/scripts/pgpool/healthcheck.sh
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 5
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- bash
|
|
||||||
- -ec
|
|
||||||
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 375m
|
|
||||||
ephemeral-storage: 2Gi
|
|
||||||
memory: 384Mi
|
|
||||||
requests:
|
|
||||||
cpu: 250m
|
|
||||||
ephemeral-storage: 50Mi
|
|
||||||
memory: 256Mi
|
|
||||||
volumeMounts:
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /tmp
|
|
||||||
subPath: tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/etc
|
|
||||||
subPath: app-etc-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/conf
|
|
||||||
subPath: app-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/tmp
|
|
||||||
subPath: app-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/pgpool/logs
|
|
||||||
subPath: app-logs-dir
|
|
||||||
volumes:
|
|
||||||
- name: empty-dir
|
|
||||||
emptyDir: {}
|
|
||||||
---
|
|
||||||
# Source: gitea/templates/gitea/deployment.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: release-name-gitea
|
|
||||||
namespace: gitea
|
|
||||||
annotations:
|
|
||||||
labels:
|
|
||||||
app: gitea
|
|
||||||
app.kubernetes.io/name: gitea
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "1.22.1"
|
|
||||||
version: "1.22.1"
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
strategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
rollingUpdate:
|
|
||||||
maxUnavailable: 0
|
|
||||||
maxSurge: 100%
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: gitea
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
|
|
||||||
labels:
|
|
||||||
app: gitea
|
|
||||||
app.kubernetes.io/name: gitea
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "1.22.1"
|
|
||||||
version: "1.22.1"
|
|
||||||
spec:
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1000
|
|
||||||
initContainers:
|
|
||||||
- name: init-directories
|
|
||||||
image: "gitea/gitea:1.22.1-rootless"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command: ["/usr/sbin/init_directory_structure.sh"]
|
|
||||||
env:
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
volumeMounts:
|
|
||||||
- name: init
|
|
||||||
mountPath: /usr/sbin
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
- name: init-app-ini
|
|
||||||
image: "gitea/gitea:1.22.1-rootless"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command: ["/usr/sbin/config_environment.sh"]
|
|
||||||
env:
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
volumeMounts:
|
|
||||||
- name: config
|
|
||||||
mountPath: /usr/sbin
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
- name: inline-config-sources
|
|
||||||
mountPath: /env-to-ini-mounts/inlines/
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
- name: configure-gitea
|
|
||||||
image: "gitea/gitea:1.22.1-rootless"
|
|
||||||
command: ["/usr/sbin/configure_gitea.sh"]
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 1000
|
|
||||||
env:
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
- name: HOME
|
|
||||||
value: /data/gitea/git
|
|
||||||
- name: GITEA_ADMIN_USERNAME
|
|
||||||
value: "gitea_admin"
|
|
||||||
- name: GITEA_ADMIN_PASSWORD
|
|
||||||
#value: "ijinc123!" # sdjo
|
|
||||||
value: "grumatic123!"
|
|
||||||
- name: GITEA_ADMIN_PASSWORD_MODE
|
|
||||||
value: keepUpdated
|
|
||||||
volumeMounts:
|
|
||||||
- name: init
|
|
||||||
mountPath: /usr/sbin
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
|
|
||||||
resources:
|
|
||||||
limits: {}
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 128Mi
|
|
||||||
terminationGracePeriodSeconds: 60
|
|
||||||
containers:
|
|
||||||
- name: gitea
|
|
||||||
image: "gitea/gitea:1.22.1-rootless"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
env:
|
|
||||||
# SSH Port values have to be set here as well for openssh configuration
|
|
||||||
- name: SSH_LISTEN_PORT
|
|
||||||
value: "2222"
|
|
||||||
- name: SSH_PORT
|
|
||||||
value: "22"
|
|
||||||
- name: GITEA_APP_INI
|
|
||||||
value: /data/gitea/conf/app.ini
|
|
||||||
- name: GITEA_CUSTOM
|
|
||||||
value: /data/gitea
|
|
||||||
- name: GITEA_WORK_DIR
|
|
||||||
value: /data
|
|
||||||
- name: GITEA_TEMP
|
|
||||||
value: /tmp/gitea
|
|
||||||
- name: TMPDIR
|
|
||||||
value: /tmp/gitea
|
|
||||||
- name: HOME
|
|
||||||
value: /data/gitea/git
|
|
||||||
ports:
|
|
||||||
- name: ssh
|
|
||||||
containerPort: 2222
|
|
||||||
- name: http
|
|
||||||
containerPort: 3000
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 10
|
|
||||||
initialDelaySeconds: 200
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
tcpSocket:
|
|
||||||
port: http
|
|
||||||
timeoutSeconds: 1
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 3
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
tcpSocket:
|
|
||||||
port: http
|
|
||||||
timeoutSeconds: 1
|
|
||||||
resources:
|
|
||||||
{}
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
volumeMounts:
|
|
||||||
- name: temp
|
|
||||||
mountPath: /tmp
|
|
||||||
- name: data
|
|
||||||
mountPath: /data
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
- name: init
|
|
||||||
secret:
|
|
||||||
secretName: release-name-gitea-init
|
|
||||||
defaultMode: 110
|
|
||||||
- name: config
|
|
||||||
secret:
|
|
||||||
secretName: release-name-gitea
|
|
||||||
defaultMode: 110
|
|
||||||
- name: inline-config-sources
|
|
||||||
secret:
|
|
||||||
secretName: release-name-gitea-inline-config
|
|
||||||
- name: temp
|
|
||||||
emptyDir: {}
|
|
||||||
- name: data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: gitea-shared-storage
|
|
||||||
---
|
|
||||||
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
namespace: "gitea"
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 16.3.0
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
role: data
|
|
||||||
spec:
|
|
||||||
replicas: 3
|
|
||||||
podManagementPolicy: "Parallel"
|
|
||||||
serviceName: release-name-postgresql-ha-postgresql-headless
|
|
||||||
updateStrategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
role: data
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/version: 16.3.0
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
role: data
|
|
||||||
spec:
|
|
||||||
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
affinity:
|
|
||||||
podAffinity:
|
|
||||||
|
|
||||||
podAntiAffinity:
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: postgresql-ha
|
|
||||||
app.kubernetes.io/component: postgresql
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
weight: 1
|
|
||||||
nodeAffinity:
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1001
|
|
||||||
fsGroupChangePolicy: Always
|
|
||||||
supplementalGroups: []
|
|
||||||
sysctls: []
|
|
||||||
serviceAccountName: release-name-postgresql-ha
|
|
||||||
hostNetwork: false
|
|
||||||
hostIPC: false
|
|
||||||
containers:
|
|
||||||
- name: postgresql
|
|
||||||
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
privileged: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1001
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
lifecycle:
|
|
||||||
preStop:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /pre-stop.sh
|
|
||||||
- "25"
|
|
||||||
# Auxiliary vars to populate environment variables
|
|
||||||
env:
|
|
||||||
- name: BITNAMI_DEBUG
|
|
||||||
value: "false"
|
|
||||||
# PostgreSQL configuration
|
|
||||||
- name: POSTGRESQL_VOLUME_DIR
|
|
||||||
value: "/bitnami/postgresql"
|
|
||||||
- name: PGDATA
|
|
||||||
value: "/bitnami/postgresql/data"
|
|
||||||
- name: POSTGRES_POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: postgres-password
|
|
||||||
- name: POSTGRES_USER
|
|
||||||
value: "gitea"
|
|
||||||
- name: POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: password
|
|
||||||
- name: POSTGRES_DB
|
|
||||||
value: "gitea"
|
|
||||||
- name: POSTGRESQL_LOG_HOSTNAME
|
|
||||||
value: "true"
|
|
||||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
|
||||||
value: "off"
|
|
||||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
|
||||||
value: "error"
|
|
||||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
|
||||||
value: "pgaudit, repmgr"
|
|
||||||
- name: POSTGRESQL_ENABLE_TLS
|
|
||||||
value: "no"
|
|
||||||
- name: POSTGRESQL_PORT_NUMBER
|
|
||||||
value: "5432"
|
|
||||||
# Repmgr configuration
|
|
||||||
- name: REPMGR_PORT_NUMBER
|
|
||||||
value: "5432"
|
|
||||||
- name: REPMGR_PRIMARY_PORT
|
|
||||||
value: "5432"
|
|
||||||
- name: MY_POD_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.name
|
|
||||||
- name: REPMGR_UPGRADE_EXTENSION
|
|
||||||
value: "no"
|
|
||||||
- name: REPMGR_PGHBA_TRUST_ALL
|
|
||||||
value: "no"
|
|
||||||
- name: REPMGR_MOUNTED_CONF_DIR
|
|
||||||
value: "/bitnami/repmgr/conf"
|
|
||||||
- name: REPMGR_NAMESPACE
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.namespace
|
|
||||||
- name: REPMGR_PARTNER_NODES
|
|
||||||
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
|
|
||||||
- name: REPMGR_PRIMARY_HOST
|
|
||||||
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
|
||||||
- name: REPMGR_NODE_NAME
|
|
||||||
value: "$(MY_POD_NAME)"
|
|
||||||
- name: REPMGR_NODE_NETWORK_NAME
|
|
||||||
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
|
|
||||||
- name: REPMGR_NODE_TYPE
|
|
||||||
value: "data"
|
|
||||||
- name: REPMGR_LOG_LEVEL
|
|
||||||
value: "NOTICE"
|
|
||||||
- name: REPMGR_CONNECT_TIMEOUT
|
|
||||||
value: "5"
|
|
||||||
- name: REPMGR_RECONNECT_ATTEMPTS
|
|
||||||
value: "2"
|
|
||||||
- name: REPMGR_RECONNECT_INTERVAL
|
|
||||||
value: "3"
|
|
||||||
- name: REPMGR_USERNAME
|
|
||||||
value: "repmgr"
|
|
||||||
- name: REPMGR_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: release-name-postgresql-ha-postgresql
|
|
||||||
key: repmgr-password
|
|
||||||
- name: REPMGR_DATABASE
|
|
||||||
value: "repmgr"
|
|
||||||
- name: REPMGR_FENCE_OLD_PRIMARY
|
|
||||||
value: "no"
|
|
||||||
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
|
|
||||||
value: "5"
|
|
||||||
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
|
|
||||||
value: "1"
|
|
||||||
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
|
|
||||||
value: "30"
|
|
||||||
envFrom:
|
|
||||||
ports:
|
|
||||||
- name: postgresql
|
|
||||||
containerPort: 5432
|
|
||||||
protocol: TCP
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 6
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- bash
|
|
||||||
- -ec
|
|
||||||
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 6
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- bash
|
|
||||||
- -ec
|
|
||||||
- |
|
|
||||||
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
|
|
||||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 375m
|
|
||||||
ephemeral-storage: 2Gi
|
|
||||||
memory: 384Mi
|
|
||||||
requests:
|
|
||||||
cpu: 250m
|
|
||||||
ephemeral-storage: 50Mi
|
|
||||||
memory: 256Mi
|
|
||||||
volumeMounts:
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /tmp
|
|
||||||
subPath: tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/postgresql/conf
|
|
||||||
subPath: app-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/postgresql/tmp
|
|
||||||
subPath: app-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/repmgr/conf
|
|
||||||
subPath: repmgr-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/repmgr/tmp
|
|
||||||
subPath: repmgr-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/repmgr/logs
|
|
||||||
subPath: repmgr-logs-dir
|
|
||||||
- name: data
|
|
||||||
mountPath: /bitnami/postgresql
|
|
||||||
- name: hooks-scripts
|
|
||||||
mountPath: /pre-stop.sh
|
|
||||||
subPath: pre-stop.sh
|
|
||||||
- name: hooks-scripts
|
|
||||||
mountPath: /readiness-probe.sh
|
|
||||||
subPath: readiness-probe.sh
|
|
||||||
volumes:
|
|
||||||
- name: empty-dir
|
|
||||||
emptyDir: {}
|
|
||||||
- name: hooks-scripts
|
|
||||||
configMap:
|
|
||||||
name: release-name-postgresql-ha-postgresql-hooks-scripts
|
|
||||||
defaultMode: 0755
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: data
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- "ReadWriteOnce"
|
|
||||||
storageClassName: billing-portal-sc
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: "8Gi"
|
|
||||||
---
|
|
||||||
# Source: cdgitea/charts/redis-cluster/templates/redis-statefulset.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: release-name-redis-cluster
|
|
||||||
namespace: "gitea"
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
app.kubernetes.io/version: 7.2.5
|
|
||||||
spec:
|
|
||||||
updateStrategy:
|
|
||||||
rollingUpdate:
|
|
||||||
partition: 0
|
|
||||||
type: RollingUpdate
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
replicas: 3
|
|
||||||
serviceName: release-name-redis-cluster-headless
|
|
||||||
podManagementPolicy: Parallel
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
app.kubernetes.io/version: 7.2.5
|
|
||||||
annotations:
|
|
||||||
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
|
|
||||||
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
|
|
||||||
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
|
|
||||||
spec:
|
|
||||||
hostNetwork: false
|
|
||||||
enableServiceLinks: false
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1001
|
|
||||||
fsGroupChangePolicy: Always
|
|
||||||
supplementalGroups: []
|
|
||||||
sysctls: []
|
|
||||||
serviceAccountName: release-name-redis-cluster
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
affinity:
|
|
||||||
podAffinity:
|
|
||||||
|
|
||||||
podAntiAffinity:
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
weight: 1
|
|
||||||
nodeAffinity:
|
|
||||||
|
|
||||||
containers:
|
|
||||||
- name: release-name-redis-cluster
|
|
||||||
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
privileged: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsGroup: 1001
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
command: ['/bin/bash', '-c']
|
|
||||||
args:
|
|
||||||
- |
|
|
||||||
# Backwards compatibility change
|
|
||||||
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
|
|
||||||
echo COPYING FILE
|
|
||||||
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
|
|
||||||
fi
|
|
||||||
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
|
|
||||||
pod_index="${pod_index[-1]}"
|
|
||||||
if [[ "$pod_index" == "0" ]]; then
|
|
||||||
export REDIS_CLUSTER_CREATOR="yes"
|
|
||||||
export REDIS_CLUSTER_REPLICAS="0"
|
|
||||||
fi
|
|
||||||
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
|
|
||||||
env:
|
|
||||||
- name: POD_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.name
|
|
||||||
- name: REDIS_NODES
|
|
||||||
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
|
|
||||||
- name: ALLOW_EMPTY_PASSWORD
|
|
||||||
value: "yes"
|
|
||||||
- name: REDIS_AOF_ENABLED
|
|
||||||
value: "yes"
|
|
||||||
- name: REDIS_TLS_ENABLED
|
|
||||||
value: "no"
|
|
||||||
- name: REDIS_PORT_NUMBER
|
|
||||||
value: "6379"
|
|
||||||
ports:
|
|
||||||
- name: tcp-redis
|
|
||||||
containerPort: 6379
|
|
||||||
- name: tcp-redis-bus
|
|
||||||
containerPort: 16379
|
|
||||||
livenessProbe:
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
# One second longer than command timeout should prevent generation of zombie processes.
|
|
||||||
timeoutSeconds: 6
|
|
||||||
successThreshold: 1
|
|
||||||
failureThreshold: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- /scripts/ping_liveness_local.sh 5
|
|
||||||
readinessProbe:
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 5
|
|
||||||
# One second longer than command timeout should prevent generation of zombie processes.
|
|
||||||
timeoutSeconds: 2
|
|
||||||
successThreshold: 1
|
|
||||||
failureThreshold: 5
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- /scripts/ping_readiness_local.sh 1
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 150m
|
|
||||||
ephemeral-storage: 2Gi
|
|
||||||
memory: 192Mi
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
ephemeral-storage: 50Mi
|
|
||||||
memory: 128Mi
|
|
||||||
volumeMounts:
|
|
||||||
- name: scripts
|
|
||||||
mountPath: /scripts
|
|
||||||
- name: redis-data
|
|
||||||
mountPath: /bitnami/redis/data
|
|
||||||
subPath:
|
|
||||||
- name: default-config
|
|
||||||
mountPath: /opt/bitnami/redis/etc/redis-default.conf
|
|
||||||
subPath: redis-default.conf
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/redis/etc/
|
|
||||||
subPath: app-conf-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/redis/tmp
|
|
||||||
subPath: app-tmp-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /opt/bitnami/redis/logs
|
|
||||||
subPath: app-logs-dir
|
|
||||||
- name: empty-dir
|
|
||||||
mountPath: /tmp
|
|
||||||
subPath: tmp-dir
|
|
||||||
volumes:
|
|
||||||
- name: scripts
|
|
||||||
configMap:
|
|
||||||
name: release-name-redis-cluster-scripts
|
|
||||||
defaultMode: 0755
|
|
||||||
- name: default-config
|
|
||||||
configMap:
|
|
||||||
name: release-name-redis-cluster-default
|
|
||||||
- name: empty-dir
|
|
||||||
emptyDir: {}
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
name: redis-data
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/name: redis-cluster
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- "ReadWriteOnce"
|
|
||||||
storageClassName: billing-portal-sc
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: "8Gi"
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
# Warning
|
|
||||||
# PersistentVolumeClaim 오브젝트에서 StorageClass 이름을 변경하고 사용.
|
|
||||||
#
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
kubernetes.io/metadata.name: nexus
|
|
||||||
name: nexus
|
|
||||||
spec:
|
|
||||||
finalizers:
|
|
||||||
- kubernetes
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: nexus
|
|
||||||
app.kubernetes.io/name: nexus-repository-manager
|
|
||||||
app.kubernetes.io/version: 3.72.0
|
|
||||||
name: nexus-nexus-repository-manager
|
|
||||||
namespace: nexus
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: nexus
|
|
||||||
app.kubernetes.io/name: nexus-repository-manager
|
|
||||||
app.kubernetes.io/version: 3.72.0
|
|
||||||
name: nexus-nexus-repository-manager-data
|
|
||||||
namespace: nexus
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 50Gi
|
|
||||||
storageClassName: sc-monitoring
|
|
||||||
|
|
@ -1,96 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: nexus
|
|
||||||
app.kubernetes.io/name: nexus-repository-manager
|
|
||||||
app.kubernetes.io/version: 3.62.0
|
|
||||||
name: nexus-nexus-repository-manager
|
|
||||||
namespace: nexus
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: nexus-ui
|
|
||||||
port: 8081
|
|
||||||
protocol: TCP
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/instance: nexus
|
|
||||||
app.kubernetes.io/name: nexus-repository-manager
|
|
||||||
type: ClusterIP
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: nexus
|
|
||||||
app.kubernetes.io/name: nexus-repository-manager
|
|
||||||
app.kubernetes.io/version: 3.62.0
|
|
||||||
name: nexus-nexus-repository-manager
|
|
||||||
namespace: nexus
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/instance: nexus
|
|
||||||
app.kubernetes.io/name: nexus-repository-manager
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: nexus
|
|
||||||
app.kubernetes.io/name: nexus-repository-manager
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: INSTALL4J_ADD_VM_PARAMS
|
|
||||||
value: "-Xms2703M -Xmx2703M -XX:MaxDirectMemorySize=2703M -XX:+UnlockExperimentalVMOptions -Djava.util.prefs.userRoot=/nexus-data/javaprefs"
|
|
||||||
- name: NEXUS_SECURITY_RANDOMPASSWORD
|
|
||||||
value: "true"
|
|
||||||
envFrom: null
|
|
||||||
image: reg.inje-private.com/nnd002/sonatype/nexus3:3.72.0
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
lifecycle: null
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 6
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: 8081
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 10
|
|
||||||
name: nexus-repository-manager
|
|
||||||
ports:
|
|
||||||
- containerPort: 8081
|
|
||||||
name: nexus-ui
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 6
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: 8081
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 10
|
|
||||||
#resources: # by ljh
|
|
||||||
#limits:
|
|
||||||
#cpu: 4
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
runAsNonRoot: true
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /nexus-data
|
|
||||||
name: nexus-repository-manager-data
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 200
|
|
||||||
runAsGroup: 200
|
|
||||||
runAsUser: 200
|
|
||||||
serviceAccountName: nexus-nexus-repository-manager
|
|
||||||
terminationGracePeriodSeconds: 120
|
|
||||||
volumes:
|
|
||||||
- name: nexus-repository-manager-data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nexus-nexus-repository-manager-data
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
||||||
name: ing-nexus
|
|
||||||
namespace: nexus
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
rules:
|
|
||||||
- host: nexus.inje-private.com
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: nexus-nexus-repository-manager
|
|
||||||
port:
|
|
||||||
name: nexus-ui
|
|
||||||
path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- "nexus.inje-private.com"
|
|
||||||
secretName: nexus-ssl
|
|
||||||
|
|
@ -1,618 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
kubernetes.io/metadata.name: sonarqube
|
|
||||||
name: sonarqube
|
|
||||||
spec:
|
|
||||||
finalizers:
|
|
||||||
- kubernetes
|
|
||||||
---
|
|
||||||
# Source: sonarqube/charts/postgresql/templates/secrets.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-postgresql
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
helm.sh/chart: postgresql-10.15.0
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
namespace: sonarqube
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
postgresql-postgres-password: "YjlLdzZzWVlYOQ=="
|
|
||||||
postgresql-password: "c29uYXJQYXNz"
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/secret.yaml
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube-monitoring-passcode
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
SONAR_WEB_SYSTEMPASSCODE: "ZGVmaW5lX2l0"
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/config.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube-config
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
data:
|
|
||||||
sonar.properties: |
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/init-fs.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube-init-fs
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
data:
|
|
||||||
init_fs.sh: |-
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/init-sysctl.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube-init-sysctl
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
data:
|
|
||||||
init_sysctl.sh: |-
|
|
||||||
if [[ "$(sysctl -n vm.max_map_count)" -lt 524288 ]]; then
|
|
||||||
sysctl -w vm.max_map_count=524288
|
|
||||||
fi
|
|
||||||
if [[ "$(sysctl -n fs.file-max)" -lt 131072 ]]; then
|
|
||||||
sysctl -w fs.file-max=131072
|
|
||||||
fi
|
|
||||||
if [[ "$(ulimit -n)" != "unlimited" ]]; then
|
|
||||||
if [[ "$(ulimit -n)" -lt 131072 ]]; then
|
|
||||||
echo "ulimit -n 131072"
|
|
||||||
ulimit -n 131072
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
if [[ "$(ulimit -u)" != "unlimited" ]]; then
|
|
||||||
if [[ "$(ulimit -u)" -lt 8192 ]]; then
|
|
||||||
echo "ulimit -u 8192"
|
|
||||||
ulimit -u 8192
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/install-plugins.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube-install-plugins
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
data:
|
|
||||||
install_plugins.sh: |-
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/jdbc-config.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube-jdbc-config
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
data:
|
|
||||||
SONAR_JDBC_USERNAME: "sonarUser"
|
|
||||||
SONAR_JDBC_URL: "jdbc:postgresql://sonarqube-postgresql:5432/sonarDB"
|
|
||||||
---
|
|
||||||
# Source: sonarqube/charts/postgresql/templates/svc-headless.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-postgresql-headless
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
helm.sh/chart: postgresql-10.15.0
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
# Use this annotation in addition to the actual publishNotReadyAddresses
|
|
||||||
# field below because the annotation will stop being respected soon but the
|
|
||||||
# field is broken in some versions of Kubernetes:
|
|
||||||
# https://github.com/kubernetes/kubernetes/issues/58662
|
|
||||||
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
|
|
||||||
namespace: sonarqube
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
clusterIP: None
|
|
||||||
# We want all pods in the StatefulSet to have their addresses published for
|
|
||||||
# the sake of the other Postgresql pods even before they're ready, since they
|
|
||||||
# have to be able to talk to each other in order to become ready.
|
|
||||||
publishNotReadyAddresses: true
|
|
||||||
ports:
|
|
||||||
- name: tcp-postgresql
|
|
||||||
port: 5432
|
|
||||||
targetPort: tcp-postgresql
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
---
|
|
||||||
# Source: sonarqube/charts/postgresql/templates/svc.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-postgresql
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
helm.sh/chart: postgresql-10.15.0
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
annotations:
|
|
||||||
namespace: sonarqube
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
ports:
|
|
||||||
- name: tcp-postgresql
|
|
||||||
port: 5432
|
|
||||||
targetPort: tcp-postgresql
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
role: primary
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/service.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
ports:
|
|
||||||
- port: 9000
|
|
||||||
targetPort: http
|
|
||||||
protocol: TCP
|
|
||||||
name: http
|
|
||||||
selector:
|
|
||||||
app: sonarqube
|
|
||||||
release: sonarqube
|
|
||||||
---
|
|
||||||
# Source: sonarqube/charts/postgresql/templates/statefulset.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-postgresql
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
helm.sh/chart: postgresql-10.15.0
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
app.kubernetes.io/component: primary
|
|
||||||
annotations:
|
|
||||||
namespace: sonarqube
|
|
||||||
spec:
|
|
||||||
serviceName: sonarqube-postgresql-headless
|
|
||||||
replicas: 1
|
|
||||||
updateStrategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
role: primary
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-postgresql
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
helm.sh/chart: postgresql-10.15.0
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
role: primary
|
|
||||||
app.kubernetes.io/component: primary
|
|
||||||
spec:
|
|
||||||
affinity:
|
|
||||||
podAffinity:
|
|
||||||
|
|
||||||
podAntiAffinity:
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: postgresql
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
app.kubernetes.io/component: primary
|
|
||||||
namespaces:
|
|
||||||
- "sonarqube"
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
weight: 1
|
|
||||||
nodeAffinity:
|
|
||||||
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 1001
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- name: sonarqube-postgresql
|
|
||||||
image: reg.inje-private.com/nnd002/bitnami/postgresql:11.14.0-debian-10-r22
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 2
|
|
||||||
memory: 2Gi
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 200Mi
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1001
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
env:
|
|
||||||
- name: BITNAMI_DEBUG
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_PORT_NUMBER
|
|
||||||
value: "5432"
|
|
||||||
- name: POSTGRESQL_VOLUME_DIR
|
|
||||||
value: "/bitnami/postgresql"
|
|
||||||
- name: PGDATA
|
|
||||||
value: "/bitnami/postgresql/data"
|
|
||||||
- name: POSTGRES_POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: sonarqube-postgresql
|
|
||||||
key: postgresql-postgres-password
|
|
||||||
- name: POSTGRES_USER
|
|
||||||
value: "sonarUser"
|
|
||||||
- name: POSTGRES_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: sonarqube-postgresql
|
|
||||||
key: postgresql-password
|
|
||||||
- name: POSTGRES_DB
|
|
||||||
value: "sonarDB"
|
|
||||||
- name: POSTGRESQL_ENABLE_LDAP
|
|
||||||
value: "no"
|
|
||||||
- name: POSTGRESQL_ENABLE_TLS
|
|
||||||
value: "no"
|
|
||||||
- name: POSTGRESQL_LOG_HOSTNAME
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
|
||||||
value: "false"
|
|
||||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
|
||||||
value: "off"
|
|
||||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
|
||||||
value: "error"
|
|
||||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
|
||||||
value: "pgaudit"
|
|
||||||
ports:
|
|
||||||
- name: tcp-postgresql
|
|
||||||
containerPort: 5432
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
- -c
|
|
||||||
- exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 5
|
|
||||||
successThreshold: 1
|
|
||||||
failureThreshold: 6
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
- -c
|
|
||||||
- -e
|
|
||||||
- |
|
|
||||||
exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
|
|
||||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 5
|
|
||||||
successThreshold: 1
|
|
||||||
failureThreshold: 6
|
|
||||||
volumeMounts:
|
|
||||||
- name: dshm
|
|
||||||
mountPath: /dev/shm
|
|
||||||
- name: data
|
|
||||||
mountPath: /bitnami/postgresql
|
|
||||||
subPath:
|
|
||||||
volumes:
|
|
||||||
- name: dshm
|
|
||||||
emptyDir:
|
|
||||||
medium: Memory
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
name: data
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- "ReadWriteOnce"
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: "20Gi"
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/sonarqube-sts.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-sonarqube
|
|
||||||
namespace: sonarqube
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
app.kubernetes.io/name: sonarqube-sonarqube-sonarqube
|
|
||||||
app.kubernetes.io/instance: sonarqube
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
app.kubernetes.io/part-of: sonarqube
|
|
||||||
app.kubernetes.io/component: sonarqube-sonarqube
|
|
||||||
app.kubernetes.io/version: "10.6.0-community"
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
revisionHistoryLimit: 10
|
|
||||||
serviceName: sonarqube-sonarqube
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: sonarqube
|
|
||||||
release: sonarqube
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
checksum/config: 2256323f7d9ffc8a4e18606aa35e18a28b05412806a19e4e6a15359f9b710ad0
|
|
||||||
checksum/init-fs: 915551fa9592e2d81312781f423a59e6ba0837510c2e1d996e899eecd057ee91
|
|
||||||
checksum/init-sysctl: 7aa0dd9441283780322cf0596f09a398219af7dd756fcead24179a08adcebc32
|
|
||||||
checksum/plugins: 14cc0e459ae2f5de6499309b22cfdbcc1452d9e0e4f01a0ea45a43793e95e550
|
|
||||||
checksum/secret: b433376554b78de7ccf285d4ffebc8759355e6916f285189ce33ba1eba4ba28a
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
release: sonarqube
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 0
|
|
||||||
initContainers:
|
|
||||||
- name: "wait-for-db"
|
|
||||||
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
runAsGroup: 0
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
command: ["/bin/bash", "-c"]
|
|
||||||
args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/sonarqube-postgresql/5432) && exit 0; sleep 2;done; exit 1']
|
|
||||||
- name: init-sysctl
|
|
||||||
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
securityContext:
|
|
||||||
privileged: true
|
|
||||||
runAsUser: 0
|
|
||||||
command: ["/bin/bash", "-e", "/tmp/scripts/init_sysctl.sh"]
|
|
||||||
volumeMounts:
|
|
||||||
- name: init-sysctl
|
|
||||||
mountPath: /tmp/scripts/
|
|
||||||
env:
|
|
||||||
- name: SONAR_WEB_CONTEXT
|
|
||||||
value: "/"
|
|
||||||
- name: SONAR_WEB_JAVAOPTS
|
|
||||||
value: ""
|
|
||||||
- name: SONAR_CE_JAVAOPTS
|
|
||||||
value: ""
|
|
||||||
containers:
|
|
||||||
- name: sonarqube
|
|
||||||
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
containerPort: 9000
|
|
||||||
protocol: TCP
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 800m
|
|
||||||
ephemeral-storage: 512000M
|
|
||||||
memory: 6144M
|
|
||||||
requests:
|
|
||||||
cpu: 400m
|
|
||||||
ephemeral-storage: 1536M
|
|
||||||
memory: 2048M
|
|
||||||
env:
|
|
||||||
- name: SONAR_HELM_CHART_VERSION
|
|
||||||
value: 10.6.0_3033
|
|
||||||
- name: SONAR_JDBC_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: sonarqube-postgresql
|
|
||||||
key: postgresql-password
|
|
||||||
- name: SONAR_WEB_SYSTEMPASSCODE
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: sonarqube-sonarqube-monitoring-passcode
|
|
||||||
key: SONAR_WEB_SYSTEMPASSCODE
|
|
||||||
- name: SONAR_WEB_CONTEXT
|
|
||||||
value: "/"
|
|
||||||
- name: SONAR_WEB_JAVAOPTS
|
|
||||||
value: ""
|
|
||||||
- name: SONAR_CE_JAVAOPTS
|
|
||||||
value: ""
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: sonarqube-sonarqube-jdbc-config
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
wget --no-proxy --quiet -O /dev/null --timeout=1 --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://localhost:9000/api/system/liveness"
|
|
||||||
failureThreshold: 6
|
|
||||||
initialDelaySeconds: 60
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 1
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- |
|
|
||||||
#!/bin/bash
|
|
||||||
# A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
|
|
||||||
# status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
|
|
||||||
if wget --no-proxy -qO- http://localhost:9000/api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
|
|
||||||
exit 0
|
|
||||||
fi
|
|
||||||
exit 1
|
|
||||||
failureThreshold: 6
|
|
||||||
initialDelaySeconds: 60
|
|
||||||
periodSeconds: 30
|
|
||||||
timeoutSeconds: 1
|
|
||||||
startupProbe:
|
|
||||||
httpGet:
|
|
||||||
scheme: HTTP
|
|
||||||
path: /api/system/status
|
|
||||||
port: http
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
failureThreshold: 24
|
|
||||||
timeoutSeconds: 1
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
runAsGroup: 0
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /opt/sonarqube/data
|
|
||||||
name: sonarqube
|
|
||||||
subPath: data
|
|
||||||
- mountPath: /opt/sonarqube/temp
|
|
||||||
name: sonarqube
|
|
||||||
subPath: temp
|
|
||||||
- mountPath: /opt/sonarqube/logs
|
|
||||||
name: sonarqube
|
|
||||||
subPath: logs
|
|
||||||
- mountPath: /tmp
|
|
||||||
name: tmp-dir
|
|
||||||
serviceAccountName: default
|
|
||||||
volumes:
|
|
||||||
- name: init-sysctl
|
|
||||||
configMap:
|
|
||||||
name: sonarqube-sonarqube-init-sysctl
|
|
||||||
items:
|
|
||||||
- key: init_sysctl.sh
|
|
||||||
path: init_sysctl.sh
|
|
||||||
- name: init-fs
|
|
||||||
configMap:
|
|
||||||
name: sonarqube-sonarqube-init-fs
|
|
||||||
items:
|
|
||||||
- key: init_fs.sh
|
|
||||||
path: init_fs.sh
|
|
||||||
- name: sonarqube
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: sonarqube-sonarqube
|
|
||||||
- name : tmp-dir
|
|
||||||
emptyDir:
|
|
||||||
{}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
name: sonarqube-sonarqube
|
|
||||||
namespace: sonarqube
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
storageClassName: sc-monitoring
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 20Gi
|
|
||||||
|
|
||||||
---
|
|
||||||
# Source: sonarqube/templates/tests/sonarqube-test.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Pod
|
|
||||||
metadata:
|
|
||||||
name: "sonarqube-ui-test"
|
|
||||||
namespace: sonarqube
|
|
||||||
annotations:
|
|
||||||
"helm.sh/hook": test-success
|
|
||||||
labels:
|
|
||||||
app: sonarqube
|
|
||||||
chart: sonarqube-10.6.0_3033
|
|
||||||
release: sonarqube
|
|
||||||
heritage: Helm
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- name: sonarqube-ui-test
|
|
||||||
image: "reg.inje-private.com/nnd002/sonarqube:10.6.0-community"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command: ['wget']
|
|
||||||
args: [
|
|
||||||
'--retry-connrefused',
|
|
||||||
'--waitretry=1',
|
|
||||||
'--timeout=5',
|
|
||||||
'-t',
|
|
||||||
'12',
|
|
||||||
'-qO-',
|
|
||||||
'sonarqube-sonarqube:9000/api/system/status'
|
|
||||||
]
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 500m
|
|
||||||
ephemeral-storage: 1000M
|
|
||||||
memory: 200M
|
|
||||||
requests:
|
|
||||||
cpu: 500m
|
|
||||||
ephemeral-storage: 100M
|
|
||||||
memory: 200M
|
|
||||||
restartPolicy: Never
|
|
||||||
|
|
@ -1,23 +0,0 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: sonarqube-ingress
|
|
||||||
namespace: sonarqube
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
rules:
|
|
||||||
- host: sonar.inje-private.com
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: sonarqube-sonarqube
|
|
||||||
port:
|
|
||||||
name: http
|
|
||||||
path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- "sonar.inje-private.com"
|
|
||||||
secretName: sonarqube-ssl
|
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,87 +0,0 @@
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: ValidatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: webhook
|
|
||||||
app.kubernetes.io/instance: default
|
|
||||||
app.kubernetes.io/part-of: tekton-pipelines
|
|
||||||
pipeline.tekton.dev/release: v0.57.0
|
|
||||||
name: config.webhook.pipeline.tekton.dev
|
|
||||||
webhooks:
|
|
||||||
- admissionReviewVersions:
|
|
||||||
- v1
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-pipelines-webhook
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
failurePolicy: Fail
|
|
||||||
name: config.webhook.pipeline.tekton.dev
|
|
||||||
objectSelector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/part-of: tekton-pipelines
|
|
||||||
sideEffects: None
|
|
||||||
---
|
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: ValidatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: webhook
|
|
||||||
app.kubernetes.io/instance: default
|
|
||||||
app.kubernetes.io/part-of: tekton-triggers
|
|
||||||
triggers.tekton.dev/release: v0.26.1
|
|
||||||
name: config.webhook.triggers.tekton.dev
|
|
||||||
webhooks:
|
|
||||||
- admissionReviewVersions:
|
|
||||||
- v1
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-webhook
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
failurePolicy: Fail
|
|
||||||
name: config.webhook.triggers.tekton.dev
|
|
||||||
namespaceSelector:
|
|
||||||
matchExpressions:
|
|
||||||
- key: triggers.tekton.dev/release
|
|
||||||
operator: Exists
|
|
||||||
sideEffects: None
|
|
||||||
---
|
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: ValidatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: webhook
|
|
||||||
app.kubernetes.io/instance: default
|
|
||||||
app.kubernetes.io/part-of: tekton-pipelines
|
|
||||||
pipeline.tekton.dev/release: v0.57.0
|
|
||||||
name: validation.webhook.pipeline.tekton.dev
|
|
||||||
webhooks:
|
|
||||||
- admissionReviewVersions:
|
|
||||||
- v1
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-pipelines-webhook
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
failurePolicy: Fail
|
|
||||||
name: validation.webhook.pipeline.tekton.dev
|
|
||||||
sideEffects: None
|
|
||||||
---
|
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: ValidatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: webhook
|
|
||||||
app.kubernetes.io/instance: default
|
|
||||||
app.kubernetes.io/part-of: tekton-triggers
|
|
||||||
triggers.tekton.dev/release: v0.26.1
|
|
||||||
name: validation.webhook.triggers.tekton.dev
|
|
||||||
webhooks:
|
|
||||||
- admissionReviewVersions:
|
|
||||||
- v1
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-webhook
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
failurePolicy: Fail
|
|
||||||
name: validation.webhook.triggers.tekton.dev
|
|
||||||
sideEffects: None
|
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,119 +0,0 @@
|
||||||
apiVersion: dashboard.tekton.dev/v1alpha1
|
|
||||||
kind: Extension
|
|
||||||
metadata:
|
|
||||||
name: cronjobs
|
|
||||||
spec:
|
|
||||||
apiVersion: batch/v1
|
|
||||||
displayname: k8s cronjobs
|
|
||||||
name: cronjobs
|
|
||||||
---
|
|
||||||
apiVersion: triggers.tekton.dev/v1alpha1
|
|
||||||
kind: ClusterInterceptor
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
server/type: https
|
|
||||||
name: bitbucket
|
|
||||||
spec:
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-core-interceptors
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
path: bitbucket
|
|
||||||
port: 8443
|
|
||||||
---
|
|
||||||
apiVersion: triggers.tekton.dev/v1alpha1
|
|
||||||
kind: ClusterInterceptor
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
server/type: https
|
|
||||||
name: cel
|
|
||||||
spec:
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-core-interceptors
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
path: cel
|
|
||||||
port: 8443
|
|
||||||
---
|
|
||||||
apiVersion: triggers.tekton.dev/v1alpha1
|
|
||||||
kind: ClusterInterceptor
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
server/type: https
|
|
||||||
name: github
|
|
||||||
spec:
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-core-interceptors
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
path: github
|
|
||||||
port: 8443
|
|
||||||
---
|
|
||||||
apiVersion: triggers.tekton.dev/v1alpha1
|
|
||||||
kind: ClusterInterceptor
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
server/type: https
|
|
||||||
name: gitlab
|
|
||||||
spec:
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-core-interceptors
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
path: gitlab
|
|
||||||
port: 8443
|
|
||||||
---
|
|
||||||
apiVersion: triggers.tekton.dev/v1alpha1
|
|
||||||
kind: ClusterInterceptor
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
server/type: https
|
|
||||||
name: slack
|
|
||||||
spec:
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-core-interceptors
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
path: slack
|
|
||||||
port: 8443
|
|
||||||
---
|
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: MutatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: webhook
|
|
||||||
app.kubernetes.io/instance: default
|
|
||||||
app.kubernetes.io/part-of: tekton-pipelines
|
|
||||||
pipeline.tekton.dev/release: v0.57.0
|
|
||||||
name: webhook.pipeline.tekton.dev
|
|
||||||
webhooks:
|
|
||||||
- admissionReviewVersions:
|
|
||||||
- v1
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-pipelines-webhook
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
failurePolicy: Fail
|
|
||||||
name: webhook.pipeline.tekton.dev
|
|
||||||
sideEffects: None
|
|
||||||
---
|
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: MutatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: webhook
|
|
||||||
app.kubernetes.io/instance: default
|
|
||||||
app.kubernetes.io/part-of: tekton-triggers
|
|
||||||
triggers.tekton.dev/release: v0.26.1
|
|
||||||
name: webhook.triggers.tekton.dev
|
|
||||||
webhooks:
|
|
||||||
- admissionReviewVersions:
|
|
||||||
- v1
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: tekton-triggers-webhook
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
failurePolicy: Fail
|
|
||||||
name: webhook.triggers.tekton.dev
|
|
||||||
sideEffects: None
|
|
||||||
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: ing-tekton
|
|
||||||
namespace: tekton-pipelines
|
|
||||||
annotations:
|
|
||||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
rules:
|
|
||||||
- host: tekton.inje-private.com # 사전 생성된 인증서의 도메인적용.
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- path: /
|
|
||||||
pathType: Prefix
|
|
||||||
backend:
|
|
||||||
service:
|
|
||||||
name: tekton-dashboard
|
|
||||||
port:
|
|
||||||
number: 9097
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- "tekton.inje-private.com"
|
|
||||||
secretName: tekton-ssl
|
|
||||||
|
|
||||||
|
|
@ -1,60 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: logging
|
|
||||||
|
|
||||||
---
|
|
||||||
# Source: fluent-bit/templates/serviceaccount.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
---
|
|
||||||
# Source: fluent-bit/templates/clusterrole.yaml
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- namespaces
|
|
||||||
- pods
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
---
|
|
||||||
# Source: fluent-bit/templates/clusterrolebinding.yaml
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: fluent-bit
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
|
|
@ -1,69 +0,0 @@
|
||||||
# Source: fluent-bit/templates/configmap.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
data:
|
|
||||||
custom_parsers.conf: |
|
|
||||||
[PARSER]
|
|
||||||
Name docker_no_time
|
|
||||||
Format json
|
|
||||||
Time_Keep Off
|
|
||||||
Time_Key time
|
|
||||||
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
|
||||||
fluent-bit.conf: |
|
|
||||||
[SERVICE]
|
|
||||||
Daemon Off
|
|
||||||
Flush 1
|
|
||||||
Log_Level info
|
|
||||||
Parsers_File /fluent-bit/etc/parsers.conf
|
|
||||||
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
|
||||||
HTTP_Server On
|
|
||||||
HTTP_Listen 0.0.0.0
|
|
||||||
HTTP_Port 2020
|
|
||||||
Health_Check On
|
|
||||||
|
|
||||||
[INPUT]
|
|
||||||
Name tail
|
|
||||||
Path /var/log/containers/*.log
|
|
||||||
multiline.parser docker, cri
|
|
||||||
# DB /var/fluent-bit/state/flb_log.db
|
|
||||||
Tag kube.*
|
|
||||||
Mem_Buf_Limit 5MB
|
|
||||||
Skip_Long_Lines On
|
|
||||||
|
|
||||||
|
|
||||||
[FILTER]
|
|
||||||
Name kubernetes
|
|
||||||
Match kube.*
|
|
||||||
Merge_Log On
|
|
||||||
Keep_Log Off
|
|
||||||
K8S-Logging.Parser On
|
|
||||||
K8S-Logging.Exclude On
|
|
||||||
|
|
||||||
# [FILTER]
|
|
||||||
# Name record_modifier
|
|
||||||
# Match kube.*
|
|
||||||
# Record namespace ${_score}
|
|
||||||
|
|
||||||
[OUTPUT]
|
|
||||||
Name es
|
|
||||||
Match kube.*
|
|
||||||
Host 172.17.128.246
|
|
||||||
HTTP_User admin
|
|
||||||
HTTP_Passwd admin
|
|
||||||
Index fluent-bit10--%Y.%m.%d
|
|
||||||
Logstash_Format On
|
|
||||||
Logstash_Prefix_Key $kubernetes['namespace_name']
|
|
||||||
Suppress_Type_Name On
|
|
||||||
tls On
|
|
||||||
tls.Verify Off
|
|
||||||
Retry_Limit False
|
|
||||||
|
|
||||||
|
|
@ -1,69 +0,0 @@
|
||||||
# Source: fluent-bit/templates/configmap.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
data:
|
|
||||||
custom_parsers.conf: |
|
|
||||||
[PARSER]
|
|
||||||
Name docker_no_time
|
|
||||||
Format json
|
|
||||||
Time_Keep Off
|
|
||||||
Time_Key time
|
|
||||||
Time_Format %Y-%m-%dT%H:%M:%S.%L
|
|
||||||
|
|
||||||
fluent-bit.conf: |
|
|
||||||
[SERVICE]
|
|
||||||
Daemon Off
|
|
||||||
Flush 1
|
|
||||||
Log_Level info
|
|
||||||
Parsers_File /fluent-bit/etc/parsers.conf
|
|
||||||
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
|
||||||
HTTP_Server On
|
|
||||||
HTTP_Listen 0.0.0.0
|
|
||||||
HTTP_Port 2020
|
|
||||||
Health_Check On
|
|
||||||
|
|
||||||
[INPUT]
|
|
||||||
Name tail
|
|
||||||
Path /var/log/containers/*.log
|
|
||||||
multiline.parser docker, cri
|
|
||||||
Tag kube.*
|
|
||||||
Mem_Buf_Limit 5MB
|
|
||||||
Skip_Long_Lines On
|
|
||||||
|
|
||||||
[INPUT]
|
|
||||||
Name systemd
|
|
||||||
Tag host.*
|
|
||||||
Systemd_Filter _SYSTEMD_UNIT=kubelet.service
|
|
||||||
Read_From_Tail On
|
|
||||||
|
|
||||||
[FILTER]
|
|
||||||
Name kubernetes
|
|
||||||
Match kube.*
|
|
||||||
Merge_Log On
|
|
||||||
Keep_Log Off
|
|
||||||
K8S-Logging.Parser On
|
|
||||||
K8S-Logging.Exclude On
|
|
||||||
|
|
||||||
[OUTPUT]
|
|
||||||
Name es
|
|
||||||
Match kube.*
|
|
||||||
Host elasticsearch-master
|
|
||||||
Logstash_Format On
|
|
||||||
Retry_Limit False
|
|
||||||
|
|
||||||
[OUTPUT]
|
|
||||||
Name es
|
|
||||||
Match host.*
|
|
||||||
Host elasticsearch-master
|
|
||||||
Logstash_Format On
|
|
||||||
Logstash_Prefix node
|
|
||||||
Retry_Limit False
|
|
||||||
|
|
@ -1,73 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fluentbit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
data:
|
|
||||||
custom_parsers.conf: |
|
|
||||||
[PARSER]
|
|
||||||
Name cri
|
|
||||||
Format regex
|
|
||||||
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
|
|
||||||
Time_Key time
|
|
||||||
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
|
|
||||||
Decode_Field_As json message
|
|
||||||
|
|
||||||
[PARSER]
|
|
||||||
Name svcname
|
|
||||||
Format regex
|
|
||||||
Regex /sample-(?<servicename>.+)-dp-[^-]+-[^-]+_(?<namespace>.+)_.+-con-[^-]+.log$
|
|
||||||
|
|
||||||
fluent-bit.conf: |
|
|
||||||
[SERVICE]
|
|
||||||
Flush 5
|
|
||||||
Log_Level info
|
|
||||||
Daemon off
|
|
||||||
Parsers_File /fluent-bit/etc/parsers.conf
|
|
||||||
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
|
|
||||||
HTTP_Server On
|
|
||||||
HTTP_Listen 0.0.0.0
|
|
||||||
HTTP_Port 2020
|
|
||||||
Health_Check On
|
|
||||||
storage.path /var/fluent-bit/state/flb-storage/
|
|
||||||
storage.sync normal
|
|
||||||
storage.checksum off
|
|
||||||
storage.backlog.mem_limit 5M
|
|
||||||
|
|
||||||
@INCLUDE input-kubernetes.conf
|
|
||||||
# @INCLUDE filter-kubernetes.conf
|
|
||||||
@INCLUDE output-file.conf
|
|
||||||
|
|
||||||
input-kubernetes.conf: |
|
|
||||||
[INPUT]
|
|
||||||
Name tail
|
|
||||||
Parser cri
|
|
||||||
Path /var/log/containers/blog-*-dp-*-*_blog_*-con-*.log
|
|
||||||
DB /var/fluent-bit/state/flb_log.db
|
|
||||||
Tag blog.<service_name>
|
|
||||||
Tag_Regex /blog-(?<service_name>.+)-dp-[^-]+-[^-]+_blog_.+-con-[^-]+.log$
|
|
||||||
Mem_Buf_Limit 5MB
|
|
||||||
Skip_Long_Lines On
|
|
||||||
Refresh_Interval 10
|
|
||||||
Path_key svc_name
|
|
||||||
|
|
||||||
filter-kubernetes.conf: |
|
|
||||||
[FILTER]
|
|
||||||
Name parser
|
|
||||||
Match blog.*
|
|
||||||
Key_name svc_name
|
|
||||||
reserve_data On
|
|
||||||
Parser svcname
|
|
||||||
|
|
||||||
output-file.conf: |
|
|
||||||
[OUTPUT]
|
|
||||||
Name file
|
|
||||||
Match blog.*
|
|
||||||
Path /home/ubuntu
|
|
||||||
file fluentbit-scrape.txt
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,66 +0,0 @@
|
||||||
# Source: fluent-bit/templates/configmap.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.10
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
data:
|
|
||||||
fluent-bit.conf: |
|
|
||||||
[SERVICE]
|
|
||||||
Daemon Off
|
|
||||||
Flush 1
|
|
||||||
Log_Level warn
|
|
||||||
Parsers_File /fluent-bit/etc/parsers.conf
|
|
||||||
HTTP_Server On
|
|
||||||
HTTP_Listen 0.0.0.0
|
|
||||||
HTTP_Port 2020
|
|
||||||
Health_Check On
|
|
||||||
storage.path /var/fluent-bit/state/flb-storage/
|
|
||||||
storage.sync normal
|
|
||||||
storage.checksum off
|
|
||||||
storage.backlog.mem_limit 5M
|
|
||||||
|
|
||||||
[INPUT]
|
|
||||||
Name tail
|
|
||||||
Path /var/log/containers/sample-*-dp-*-con-*.log
|
|
||||||
Parser cri
|
|
||||||
Tag normal.<service_name>.<namespace_name>
|
|
||||||
Tag_Regex /sample-(?<service_name>.+)-dp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
|
|
||||||
Mem_Buf_Limit 5MB
|
|
||||||
Skip_Long_Lines On
|
|
||||||
|
|
||||||
[INPUT]
|
|
||||||
Name tail
|
|
||||||
Path /var/log/containers/sample-*-mdp-*-con-*.log
|
|
||||||
Parser cri
|
|
||||||
Tag multi.<service_name>.<namespace_name>
|
|
||||||
Tag_Regex /sample-(?<service_name>.+)-mdp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
|
|
||||||
Mem_Buf_Limit 5MB
|
|
||||||
Skip_Long_Lines On
|
|
||||||
|
|
||||||
[FILTER]
|
|
||||||
name multiline
|
|
||||||
match multi.*
|
|
||||||
multiline.key_content message
|
|
||||||
multiline.parser java
|
|
||||||
|
|
||||||
[OUTPUT]
|
|
||||||
Name es
|
|
||||||
Match *
|
|
||||||
Host soo-os.maintndjs.shop
|
|
||||||
Port 9200
|
|
||||||
Index test5
|
|
||||||
Type _doc
|
|
||||||
Include_Tag_Key true
|
|
||||||
Tag_key @svc_name
|
|
||||||
Suppress_Type_Name On
|
|
||||||
HTTP_User admin
|
|
||||||
HTTP_Passwd admin
|
|
||||||
tls On
|
|
||||||
tls.verify Off
|
|
||||||
|
|
@ -1,137 +0,0 @@
|
||||||
# Source: fluent-bit/templates/service.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
ports:
|
|
||||||
- port: 2020
|
|
||||||
targetPort: http
|
|
||||||
protocol: TCP
|
|
||||||
name: http
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
---
|
|
||||||
# Source: fluent-bit/templates/daemonset.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: DaemonSet
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
annotations:
|
|
||||||
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
|
|
||||||
spec:
|
|
||||||
serviceAccountName: fluent-bit
|
|
||||||
hostNetwork: false
|
|
||||||
dnsPolicy: ClusterFirst
|
|
||||||
containers:
|
|
||||||
- name: fluent-bit
|
|
||||||
image: "cr.fluentbit.io/fluent/fluent-bit:3.1.7-debug"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- /fluent-bit/bin/fluent-bit
|
|
||||||
args:
|
|
||||||
- --workdir=/fluent-bit/etc
|
|
||||||
- --config=/fluent-bit/etc/conf/fluent-bit.conf
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
containerPort: 2020
|
|
||||||
protocol: TCP
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: http
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/v1/health
|
|
||||||
port: http
|
|
||||||
volumeMounts:
|
|
||||||
- name: config
|
|
||||||
mountPath: /fluent-bit/etc/conf
|
|
||||||
- mountPath: /var/log
|
|
||||||
name: varlog
|
|
||||||
- mountPath: /var/lib/docker/containers
|
|
||||||
name: varlibdockercontainers
|
|
||||||
readOnly: true
|
|
||||||
- mountPath: /etc/machine-id
|
|
||||||
name: etcmachineid
|
|
||||||
readOnly: true
|
|
||||||
# Custom Add
|
|
||||||
- name: runlogjournal
|
|
||||||
mountPath: /run/log/journal
|
|
||||||
readOnly: true
|
|
||||||
# - name: dmesg
|
|
||||||
# mountPath: /var/log/dmesg
|
|
||||||
# readOnly: true
|
|
||||||
- name: mnt
|
|
||||||
mountPath: /mnt
|
|
||||||
readOnly: true
|
|
||||||
- name: fluentbitstate
|
|
||||||
mountPath: /var/fluent-bit/state
|
|
||||||
- name: file-save
|
|
||||||
mountPath: /home/ubuntu
|
|
||||||
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 500Mi
|
|
||||||
requests:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 500Mi
|
|
||||||
volumes:
|
|
||||||
- name: config
|
|
||||||
configMap:
|
|
||||||
name: fluent-bit
|
|
||||||
- name: varlog
|
|
||||||
hostPath:
|
|
||||||
path: /var/log
|
|
||||||
- name: varlibdockercontainers
|
|
||||||
hostPath:
|
|
||||||
path: /var/lib/docker/containers
|
|
||||||
- name: etcmachineid
|
|
||||||
hostPath:
|
|
||||||
path: /etc/machine-id
|
|
||||||
type: File
|
|
||||||
# Custom Add
|
|
||||||
## for cash
|
|
||||||
- name: fluentbitstate
|
|
||||||
hostPath:
|
|
||||||
path: /var/fluent-bit/state
|
|
||||||
- name: runlogjournal # 있음
|
|
||||||
hostPath:
|
|
||||||
path: /run/log/journal
|
|
||||||
# - name: dmesg # 있음
|
|
||||||
# hostPath:
|
|
||||||
# path: /var/log/dmesg
|
|
||||||
- name: mnt # 있음
|
|
||||||
hostPath:
|
|
||||||
path: /mnt
|
|
||||||
- name: file-save # 있음
|
|
||||||
hostPath:
|
|
||||||
path: /home/ubuntu
|
|
||||||
|
|
||||||
|
|
@ -1,132 +0,0 @@
|
||||||
# Source: fluent-bit/templates/service.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
ports:
|
|
||||||
- port: 2020
|
|
||||||
targetPort: http
|
|
||||||
protocol: TCP
|
|
||||||
name: http
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
---
|
|
||||||
# Source: fluent-bit/templates/daemonset.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: DaemonSet
|
|
||||||
metadata:
|
|
||||||
name: fluent-bit
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: fluent-bit
|
|
||||||
app.kubernetes.io/instance: fluent-bit
|
|
||||||
annotations:
|
|
||||||
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
|
|
||||||
spec:
|
|
||||||
serviceAccountName: fluent-bit
|
|
||||||
hostNetwork: false
|
|
||||||
dnsPolicy: ClusterFirst
|
|
||||||
containers:
|
|
||||||
- name: fluent-bit
|
|
||||||
image: "reg.inje-private.com/nnd002/fluent/fluent-bit:3.1.7"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
command:
|
|
||||||
- /fluent-bit/bin/fluent-bit
|
|
||||||
args:
|
|
||||||
- --workdir=/fluent-bit/etc
|
|
||||||
- --config=/fluent-bit/etc/conf/fluent-bit.conf
|
|
||||||
ports:
|
|
||||||
- name: http
|
|
||||||
containerPort: 2020
|
|
||||||
protocol: TCP
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: http
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/v1/health
|
|
||||||
port: http
|
|
||||||
volumeMounts:
|
|
||||||
- name: config
|
|
||||||
mountPath: /fluent-bit/etc/conf
|
|
||||||
- mountPath: /var/log
|
|
||||||
name: varlog
|
|
||||||
- mountPath: /var/lib/docker/containers
|
|
||||||
name: varlibdockercontainers
|
|
||||||
readOnly: true
|
|
||||||
- mountPath: /etc/machine-id
|
|
||||||
name: etcmachineid
|
|
||||||
readOnly: true
|
|
||||||
# Custom Add
|
|
||||||
- name: runlogjournal
|
|
||||||
mountPath: /run/log/journal
|
|
||||||
readOnly: true
|
|
||||||
# - name: dmesg
|
|
||||||
# mountPath: /var/log/dmesg
|
|
||||||
# readOnly: true
|
|
||||||
- name: mnt
|
|
||||||
mountPath: /mnt
|
|
||||||
readOnly: true
|
|
||||||
- name: fluentbitstate
|
|
||||||
mountPath: /var/fluent-bit/state
|
|
||||||
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 500Mi
|
|
||||||
requests:
|
|
||||||
cpu: 500m
|
|
||||||
memory: 500Mi
|
|
||||||
volumes:
|
|
||||||
- name: config
|
|
||||||
configMap:
|
|
||||||
name: fluent-bit
|
|
||||||
- name: varlog
|
|
||||||
hostPath:
|
|
||||||
path: /var/log
|
|
||||||
- name: varlibdockercontainers
|
|
||||||
hostPath:
|
|
||||||
path: /var/lib/docker/containers
|
|
||||||
- name: etcmachineid
|
|
||||||
hostPath:
|
|
||||||
path: /etc/machine-id
|
|
||||||
type: File
|
|
||||||
# Custom Add
|
|
||||||
## for cash
|
|
||||||
- name: fluentbitstate
|
|
||||||
hostPath:
|
|
||||||
path: /var/fluent-bit/state
|
|
||||||
- name: runlogjournal # 있음
|
|
||||||
hostPath:
|
|
||||||
path: /run/log/journal
|
|
||||||
# - name: dmesg # 있음
|
|
||||||
# hostPath:
|
|
||||||
# path: /var/log/dmesg
|
|
||||||
- name: mnt # 있음
|
|
||||||
hostPath:
|
|
||||||
path: /mnt
|
|
||||||
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
# Source: fluent-bit/templates/tests/test-connection.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Pod
|
|
||||||
metadata:
|
|
||||||
name: "fluent-bit-test-connection"
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
helm.sh/chart: fluent-bit-0.47.9
|
|
||||||
app.kubernetes.io/version: "3.1.7"
|
|
||||||
app.kubernetes.io/managed-by: Helm
|
|
||||||
annotations:
|
|
||||||
helm.sh/hook: test
|
|
||||||
helm.sh/hook-delete-policy: hook-succeeded
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: wget
|
|
||||||
image: "reg.inje-private.com/nnd002/busybox:latest"
|
|
||||||
imagePullPolicy: Always
|
|
||||||
command: ["sh"]
|
|
||||||
args: ["-c", "wget -O- fluent-bit:2020"]
|
|
||||||
restartPolicy: Never
|
|
||||||
|
|
@ -1,119 +0,0 @@
|
||||||
---
|
|
||||||
- name: openSearch test
|
|
||||||
hosts: os
|
|
||||||
remote_user: ubuntu
|
|
||||||
gather_facts: no
|
|
||||||
become: yes # get root authority
|
|
||||||
become_user: root
|
|
||||||
# Setting Valiables
|
|
||||||
vars:
|
|
||||||
cluster_name: "dp3-os"
|
|
||||||
node_roles: '["cluster_manager", "data"]'
|
|
||||||
discovery_seed_hosts: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
|
|
||||||
cluster_initial_cluster_manager_nodes: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
|
|
||||||
|
|
||||||
tasks:
|
|
||||||
- name: Updata apt cache
|
|
||||||
apt:
|
|
||||||
update_cache: yes
|
|
||||||
tags: update
|
|
||||||
|
|
||||||
- name: Install required packages
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- lsb-release
|
|
||||||
- ca-certificates
|
|
||||||
- curl
|
|
||||||
- gnupg2
|
|
||||||
state: present
|
|
||||||
tags: install
|
|
||||||
# pre settings openSearch
|
|
||||||
- name: Download OpenSearch GPG key
|
|
||||||
get_url:
|
|
||||||
url: https://artifacts.opensearch.org/publickeys/opensearch.pgp
|
|
||||||
dest: /tmp/opensearch.pgp
|
|
||||||
|
|
||||||
- name: Add OpenSearch GPG key to the keyring
|
|
||||||
command: gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring /tmp/opensearch.pgp
|
|
||||||
|
|
||||||
- name: Clean up temporary GPG key file
|
|
||||||
file:
|
|
||||||
path: /tmp/opensearch.pgp
|
|
||||||
state: absent
|
|
||||||
# Add Repo
|
|
||||||
- name: Add OpenSearch repository
|
|
||||||
copy:
|
|
||||||
dest: /etc/apt/sources.list.d/opensearch-2.x.list
|
|
||||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Add OpenSearch Dashboards repository
|
|
||||||
copy:
|
|
||||||
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
|
||||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '0644'
|
|
||||||
- name: Add OpenSearch repository
|
|
||||||
copy:
|
|
||||||
dest: /etc/apt/sources.list.d/opensearch-2.x.list
|
|
||||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Add OpenSearch Dashboards repository
|
|
||||||
copy:
|
|
||||||
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
|
||||||
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
|
|
||||||
owner: root
|
|
||||||
group: root
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Install required packages
|
|
||||||
apt:
|
|
||||||
name:
|
|
||||||
- opensearch=2.11.1
|
|
||||||
# - opensearch-dashboards=2.11.1
|
|
||||||
state: present
|
|
||||||
update_cache: yes
|
|
||||||
tags: install
|
|
||||||
|
|
||||||
# set jvm
|
|
||||||
- name: Change Xms1g to Xms#g in jvm.options
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/opensearch/jvm.options
|
|
||||||
regexp: '^-Xms1g'
|
|
||||||
line: '-Xms4g'
|
|
||||||
backup: no
|
|
||||||
tags: config
|
|
||||||
- name: Change Xmx1g to Xmx#g in jvm.options
|
|
||||||
lineinfile:
|
|
||||||
path: /etc/opensearch/jvm.options
|
|
||||||
regexp: '^-Xmx1g'
|
|
||||||
line: '-Xmx4g'
|
|
||||||
backup: no
|
|
||||||
tags: config
|
|
||||||
|
|
||||||
# set opensearcy.yml
|
|
||||||
- name: Set node name based on inventory order
|
|
||||||
set_fact:
|
|
||||||
node_name: "os-{{ play_hosts.index(inventory_hostname) + 1 }}"
|
|
||||||
|
|
||||||
- name: Deploy OpenSearch configuration file from template
|
|
||||||
template:
|
|
||||||
src: templates/opensearch.yml.j2
|
|
||||||
dest: /etc/opensearch/opensearch.yml
|
|
||||||
owner: opensearch
|
|
||||||
group: opensearch
|
|
||||||
mode: '0644'
|
|
||||||
|
|
||||||
- name: Enable and start OpenSearch service
|
|
||||||
systemd:
|
|
||||||
name: opensearch
|
|
||||||
enabled: yes
|
|
||||||
state: started
|
|
||||||
|
|
||||||
# curl -XGET https://10.163.1.51:9200/\_cat/nodes?v -u 'admin:admin' --insecure
|
|
||||||
|
|
@ -1,150 +0,0 @@
|
||||||
# ======================== OpenSearch Configuration =========================
|
|
||||||
#
|
|
||||||
# NOTE: OpenSearch comes with reasonable defaults for most settings.
|
|
||||||
# Before you set out to tweak and tune the configuration, make sure you
|
|
||||||
# understand what are you trying to accomplish and the consequences.
|
|
||||||
#
|
|
||||||
# The primary way of configuring a node is via this file. This template lists
|
|
||||||
# the most important settings you may want to configure for a production cluster.
|
|
||||||
#
|
|
||||||
# Please consult the documentation for further information on configuration options:
|
|
||||||
# https://www.opensearch.org
|
|
||||||
#
|
|
||||||
# ---------------------------------- Cluster -----------------------------------
|
|
||||||
#
|
|
||||||
# Use a descriptive name for your cluster:
|
|
||||||
#
|
|
||||||
cluster.name: {{ cluster_name }}
|
|
||||||
#
|
|
||||||
# ------------------------------------ Node ------------------------------------
|
|
||||||
#
|
|
||||||
# Use a descriptive name for the node:
|
|
||||||
#
|
|
||||||
node.name: {{ node_name }}
|
|
||||||
node.roles: {{ node_roles }}
|
|
||||||
#
|
|
||||||
# Add custom attributes to the node:
|
|
||||||
#
|
|
||||||
#node.attr.rack: r1
|
|
||||||
#
|
|
||||||
# ----------------------------------- Paths ------------------------------------
|
|
||||||
#
|
|
||||||
# Path to directory where to store the data (separate multiple locations by comma):
|
|
||||||
#
|
|
||||||
path.data: /var/lib/opensearch
|
|
||||||
#
|
|
||||||
# Path to log files:
|
|
||||||
#
|
|
||||||
path.logs: /var/log/opensearch
|
|
||||||
#
|
|
||||||
# ----------------------------------- Memory -----------------------------------
|
|
||||||
#
|
|
||||||
# Lock the memory on startup:
|
|
||||||
#
|
|
||||||
#bootstrap.memory_lock: true
|
|
||||||
#
|
|
||||||
# Make sure that the heap size is set to about half the memory available
|
|
||||||
# on the system and that the owner of the process is allowed to use this
|
|
||||||
# limit.
|
|
||||||
#
|
|
||||||
# OpenSearch performs poorly when the system is swapping the memory.
|
|
||||||
#
|
|
||||||
# ---------------------------------- Network -----------------------------------
|
|
||||||
#
|
|
||||||
# Set the bind address to a specific IP (IPv4 or IPv6):
|
|
||||||
#
|
|
||||||
network.host: 0.0.0.0
|
|
||||||
#
|
|
||||||
# Set a custom port for HTTP:
|
|
||||||
#
|
|
||||||
http.port: 9200
|
|
||||||
transport.port: 9300
|
|
||||||
#
|
|
||||||
# For more information, consult the network module documentation.
|
|
||||||
#
|
|
||||||
# --------------------------------- Discovery ----------------------------------
|
|
||||||
#
|
|
||||||
# Pass an initial list of hosts to perform discovery when this node is started:
|
|
||||||
# The default list of hosts is ["127.0.0.1", "[::1]"]
|
|
||||||
#
|
|
||||||
discovery.seed_hosts: {{ discovery_seed_hosts }}
|
|
||||||
#
|
|
||||||
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
|
|
||||||
#
|
|
||||||
cluster.initial_cluster_manager_nodes: {{ cluster_initial_cluster_manager_nodes }}
|
|
||||||
#
|
|
||||||
# For more information, consult the discovery and cluster formation module documentation.
|
|
||||||
#
|
|
||||||
# ---------------------------------- Gateway -----------------------------------
|
|
||||||
#
|
|
||||||
# Block initial recovery after a full cluster restart until N nodes are started:
|
|
||||||
#
|
|
||||||
#gateway.recover_after_nodes: 3
|
|
||||||
#
|
|
||||||
# For more information, consult the gateway module documentation.
|
|
||||||
#
|
|
||||||
# ---------------------------------- Various -----------------------------------
|
|
||||||
#
|
|
||||||
# Require explicit names when deleting indices:
|
|
||||||
#
|
|
||||||
#action.destructive_requires_name: true
|
|
||||||
#
|
|
||||||
# ---------------------------------- Remote Store -----------------------------------
|
|
||||||
# Controls whether cluster imposes index creation only with remote store enabled
|
|
||||||
# cluster.remote_store.enabled: true
|
|
||||||
#
|
|
||||||
# Repository to use for segment upload while enforcing remote store for an index
|
|
||||||
# node.attr.remote_store.segment.repository: my-repo-1
|
|
||||||
#
|
|
||||||
# Repository to use for translog upload while enforcing remote store for an index
|
|
||||||
# node.attr.remote_store.translog.repository: my-repo-1
|
|
||||||
#
|
|
||||||
# ---------------------------------- Experimental Features -----------------------------------
|
|
||||||
# Gates the visibility of the experimental segment replication features until they are production ready.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
|
|
||||||
#
|
|
||||||
# Gates the functionality of a new parameter to the snapshot restore API
|
|
||||||
# that allows for creation of a new index type that searches a snapshot
|
|
||||||
# directly in a remote repository without restoring all index data to disk
|
|
||||||
# ahead of time.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.searchable_snapshot.enabled: false
|
|
||||||
#
|
|
||||||
#
|
|
||||||
# Gates the functionality of enabling extensions to work with OpenSearch.
|
|
||||||
# This feature enables applications to extend features of OpenSearch outside of
|
|
||||||
# the core.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.extensions.enabled: false
|
|
||||||
#
|
|
||||||
#
|
|
||||||
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
|
|
||||||
# index searcher threadpool.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
|
|
||||||
|
|
||||||
######## Start OpenSearch Security Demo Configuration ########
|
|
||||||
# WARNING: revise all the lines below before you go into production
|
|
||||||
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
|
|
||||||
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
|
|
||||||
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
|
|
||||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
|
||||||
plugins.security.ssl.http.enabled: true
|
|
||||||
plugins.security.ssl.http.pemcert_filepath: esnode.pem
|
|
||||||
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
|
|
||||||
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
|
|
||||||
plugins.security.allow_unsafe_democertificates: true
|
|
||||||
plugins.security.allow_default_init_securityindex: true
|
|
||||||
plugins.security.authcz.admin_dn:
|
|
||||||
- CN=kirk,OU=client,O=client,L=test, C=de
|
|
||||||
|
|
||||||
plugins.security.audit.type: internal_opensearch
|
|
||||||
plugins.security.enable_snapshot_restore_privilege: true
|
|
||||||
plugins.security.check_snapshot_restore_write_privileges: true
|
|
||||||
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
|
||||||
plugins.security.system_indices.enabled: true
|
|
||||||
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
|
||||||
node.max_local_storage_nodes: 3
|
|
||||||
######## End OpenSearch Security Demo Configuration ########
|
|
||||||
plugins.security.disabled: false
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: ing-os-dash
|
|
||||||
namespace: logging
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
rules:
|
|
||||||
- host: os-dash.inje-private.com
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: release-name-opensearch-dashboards
|
|
||||||
port:
|
|
||||||
number: 5601
|
|
||||||
path: /
|
|
||||||
pathType: Prefix
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- os-dash.inje-private.com
|
|
||||||
secretName: logging-ssl
|
|
||||||
|
|
@ -1,141 +0,0 @@
|
||||||
---
|
|
||||||
# Source: opensearch-dashboards/templates/serviceaccount.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: release-name-opensearch-dashboards-dashboards
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: opensearch-dashboards
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "2.11.1"
|
|
||||||
---
|
|
||||||
# Source: opensearch-dashboards/templates/rolebinding.yaml
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: opensearch-dashboards
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "2.11.1"
|
|
||||||
name: release-name-opensearch-dashboards-dashboards-rolebinding
|
|
||||||
namespace: logging
|
|
||||||
roleRef:
|
|
||||||
kind: Role
|
|
||||||
name: release-name-opensearch-dashboards-dashboards
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: release-name-opensearch-dashboards-dashboards
|
|
||||||
namespace: logging
|
|
||||||
---
|
|
||||||
# Source: opensearch-dashboards/templates/service.yaml
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: release-name-opensearch-dashboards
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: opensearch-dashboards
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "2.11.1"
|
|
||||||
spec:
|
|
||||||
type: ClusterIP
|
|
||||||
ports:
|
|
||||||
- port: 5601
|
|
||||||
protocol: TCP
|
|
||||||
name: http
|
|
||||||
targetPort: 5601
|
|
||||||
selector:
|
|
||||||
app: opensearch-dashboards
|
|
||||||
release: "release-name"
|
|
||||||
---
|
|
||||||
# Source: opensearch-dashboards/templates/deployment.yaml
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: release-name-opensearch-dashboards
|
|
||||||
namespace: logging
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/name: opensearch-dashboards
|
|
||||||
app.kubernetes.io/instance: release-name
|
|
||||||
app.kubernetes.io/version: "2.11.1"
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: opensearch-dashboards
|
|
||||||
release: "release-name"
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: opensearch-dashboards
|
|
||||||
release: "release-name"
|
|
||||||
annotations:
|
|
||||||
spec:
|
|
||||||
securityContext:
|
|
||||||
{}
|
|
||||||
serviceAccountName: release-name-opensearch-dashboards-dashboards
|
|
||||||
volumes:
|
|
||||||
containers:
|
|
||||||
- name: dashboards
|
|
||||||
securityContext:
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
#image: "opensearchproject/opensearch-dashboards:2.13.0"
|
|
||||||
image: "reg.inje-private.com/nnd002/opensearchproject/opensearch-dashboards:2.11.1"
|
|
||||||
imagePullPolicy: "IfNotPresent"
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 10
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 20
|
|
||||||
successThreshold: 1
|
|
||||||
tcpSocket:
|
|
||||||
port: 5601
|
|
||||||
timeoutSeconds: 5
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 10
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 20
|
|
||||||
successThreshold: 1
|
|
||||||
tcpSocket:
|
|
||||||
port: 5601
|
|
||||||
timeoutSeconds: 5
|
|
||||||
startupProbe:
|
|
||||||
failureThreshold: 20
|
|
||||||
initialDelaySeconds: 30
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
tcpSocket:
|
|
||||||
port: 5601
|
|
||||||
timeoutSeconds: 5
|
|
||||||
env:
|
|
||||||
- name: OPENSEARCH_HOSTS
|
|
||||||
value: "https://172.17.128.246:9200"
|
|
||||||
#value: "https://opensearch-cluster-master:9200"
|
|
||||||
- name: SERVER_HOST
|
|
||||||
value: "0.0.0.0"
|
|
||||||
#- name: SERVER_BASEPATH
|
|
||||||
# value: "/os"
|
|
||||||
- name: OPENSEARCH_USERNAME
|
|
||||||
value: "admin"
|
|
||||||
- name: OPENSEARCH_PASSWORD
|
|
||||||
value: "admin"
|
|
||||||
ports:
|
|
||||||
- containerPort: 5601
|
|
||||||
name: http
|
|
||||||
protocol: TCP
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 512M
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 512M
|
|
||||||
#volumeMounts:
|
|
||||||
|
|
||||||
|
|
@ -1,367 +0,0 @@
|
||||||
# OpenSearch
|
|
||||||
## QuicStart
|
|
||||||
## Install OpenSearch from an APT repository
|
|
||||||
### Install the necessary packages.
|
|
||||||
```bash
|
|
||||||
sudo apt-get update && sudo apt-get -y install lsb-release ca-certificates curl gnupg2
|
|
||||||
```
|
|
||||||
### Import the public GPG key. This key is used to verify that the APT repository is signed.
|
|
||||||
```bash
|
|
||||||
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring
|
|
||||||
```
|
|
||||||
### Create an APT repository for OpenSearch
|
|
||||||
```bash
|
|
||||||
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-2.x.list
|
|
||||||
```
|
|
||||||
|
|
||||||
### Create an APT repository for OpenSearch-Dashboard
|
|
||||||
```bash
|
|
||||||
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
|
|
||||||
```
|
|
||||||
|
|
||||||
### Verify that the repository was created successfully.
|
|
||||||
```bash
|
|
||||||
sudo apt-get update
|
|
||||||
```
|
|
||||||
설치 가능 패키지 확인
|
|
||||||
```bash
|
|
||||||
apt-cache madison opensearch
|
|
||||||
```
|
|
||||||
확인결과
|
|
||||||
```bash
|
|
||||||
opensearch | 2.13.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.12.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.11.1 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.11.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.10.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.9.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.8.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.7.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.6.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
opensearch | 2.5.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
|
|
||||||
```
|
|
||||||
|
|
||||||
### Choose the version of OpenSearch you want to install:
|
|
||||||
> Unless otherwise indicated, the latest available version of OpenSearch is installed.
|
|
||||||
|
|
||||||
항상 최신 버전 설치
|
|
||||||
```bash
|
|
||||||
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
|
|
||||||
# Use one of the following commands to define a custom admin password:
|
|
||||||
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch
|
|
||||||
|
|
||||||
# Use the following command for OpenSearch versions 2.11 and earlier:
|
|
||||||
sudo apt-get install opensearch
|
|
||||||
```
|
|
||||||
|
|
||||||
버전 지정 설치방법
|
|
||||||
```bash
|
|
||||||
# Specify the version manually using opensearch=<version>
|
|
||||||
|
|
||||||
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
|
|
||||||
# Use one of the following commands to define a custom admin password:
|
|
||||||
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch=2.13.0
|
|
||||||
|
|
||||||
# Use the following command for OpenSearch versions 2.11 and earlier:
|
|
||||||
sudo apt-get install opensearch=2.13.0
|
|
||||||
```
|
|
||||||
|
|
||||||
### MultiMaster Setting
|
|
||||||
```bash
|
|
||||||
/etc/opensearch/opensearch.yml
|
|
||||||
```
|
|
||||||
|
|
||||||
```yaml
|
|
||||||
cluster.name: os_cluster_name
|
|
||||||
node.name: os1 # os2 , os3
|
|
||||||
node.roles: ["cluster_manager", "data"]
|
|
||||||
path.data: /var/lib/opensearch
|
|
||||||
path.logs: /var/log/opensearch
|
|
||||||
network.host: 0.0.0.0
|
|
||||||
http.port: 9200
|
|
||||||
transport.port: 9300
|
|
||||||
discovery.seed_hosts: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
|
|
||||||
cluster.initial_cluster_manager_nodes: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
|
|
||||||
node.max_local_storage_nodes: 3
|
|
||||||
plugins.security.disabled: true
|
|
||||||
```
|
|
||||||
### Specify initial and maximum JVM heap sizes.
|
|
||||||
Open jvm.options
|
|
||||||
```bash
|
|
||||||
vi /etc/opensearch/jvm.options
|
|
||||||
```
|
|
||||||
Modify the values for initial and maximum heap sizes. As a starting point, you should set these values to half of the available system memory. For dedicated hosts this value can be increased based on your workflow requirements.
|
|
||||||
As an example, if the host machine has 8 GB of memory, then you might want to set the initial and maximum heap sizes to 4 GB:
|
|
||||||
```bash
|
|
||||||
-Xms4g
|
|
||||||
-Xmx4g
|
|
||||||
```
|
|
||||||
Save your changes and close the file.
|
|
||||||
### Naver Cloud LB 설정
|
|
||||||
멀티마스터 구성시 사설인증서로 Offloading 설정하여 진행.
|
|
||||||
Network Proxy LoadBalancer에서 동작 검증완료.
|
|
||||||
> 내부 인증서 처리 방식이 좀 까다로워 테스트 하다 오프로딩으로 전환.
|
|
||||||
|
|
||||||
## Reference
|
|
||||||
[link1](https://opster.com/guides/opensearch/opensearch-data-architecture/how-to-configure-opensearch-node-roles/) 국외자료
|
|
||||||
[link2](https://developer-jp.tistory.com/33) 국내자료
|
|
||||||
[link3](https://opensearch.org/docs/latest/install-and-configure/install-opensearch/debian/) 공식자료
|
|
||||||
|
|
||||||
---
|
|
||||||
## SingeNode 적용 예시
|
|
||||||
아래 내용참조. SingleNode는 SSL 설정도 까다롭지 않음.
|
|
||||||
```yaml
|
|
||||||
vi /etc/opensearch/opensearch.yml
|
|
||||||
```
|
|
||||||
```yaml
|
|
||||||
# ======================== OpenSearch Configuration =========================
|
|
||||||
#
|
|
||||||
# NOTE: OpenSearch comes with reasonable defaults for most settings.
|
|
||||||
# Before you set out to tweak and tune the configuration, make sure you
|
|
||||||
# understand what are you trying to accomplish and the consequences.
|
|
||||||
#
|
|
||||||
# The primary way of configuring a node is via this file. This template lists
|
|
||||||
# the most important settings you may want to configure for a production cluster.
|
|
||||||
#
|
|
||||||
# Please consult the documentation for further information on configuration options:
|
|
||||||
# https://www.opensearch.org
|
|
||||||
#
|
|
||||||
# ---------------------------------- Cluster -----------------------------------
|
|
||||||
#
|
|
||||||
# Use a descriptive name for your cluster:
|
|
||||||
#
|
|
||||||
#cluster.name: my-application
|
|
||||||
#
|
|
||||||
# ------------------------------------ Node ------------------------------------
|
|
||||||
#
|
|
||||||
# Use a descriptive name for the node:
|
|
||||||
#
|
|
||||||
#node.name: node-1
|
|
||||||
#
|
|
||||||
# Add custom attributes to the node:
|
|
||||||
#
|
|
||||||
#node.attr.rack: r1
|
|
||||||
#
|
|
||||||
# ----------------------------------- Paths ------------------------------------
|
|
||||||
#
|
|
||||||
# Path to directory where to store the data (separate multiple locations by comma):
|
|
||||||
#
|
|
||||||
path.data: /var/lib/opensearch
|
|
||||||
#
|
|
||||||
# Path to log files:
|
|
||||||
#
|
|
||||||
path.logs: /var/log/opensearch
|
|
||||||
#
|
|
||||||
# ----------------------------------- Memory -----------------------------------
|
|
||||||
#
|
|
||||||
# Lock the memory on startup:
|
|
||||||
#
|
|
||||||
#bootstrap.memory_lock: true
|
|
||||||
#
|
|
||||||
# Make sure that the heap size is set to about half the memory available
|
|
||||||
# on the system and that the owner of the process is allowed to use this
|
|
||||||
# limit.
|
|
||||||
#
|
|
||||||
# OpenSearch performs poorly when the system is swapping the memory.
|
|
||||||
#
|
|
||||||
# ---------------------------------- Network -----------------------------------
|
|
||||||
#
|
|
||||||
# Set the bind address to a specific IP (IPv4 or IPv6):
|
|
||||||
#
|
|
||||||
#network.host: 192.168.0.1
|
|
||||||
#
|
|
||||||
# Set a custom port for HTTP:
|
|
||||||
#
|
|
||||||
#http.port: 9200
|
|
||||||
#
|
|
||||||
# For more information, consult the network module documentation.
|
|
||||||
#
|
|
||||||
# --------------------------------- Discovery ----------------------------------
|
|
||||||
#
|
|
||||||
# Pass an initial list of hosts to perform discovery when this node is started:
|
|
||||||
# The default list of hosts is ["127.0.0.1", "[::1]"]
|
|
||||||
#
|
|
||||||
#discovery.seed_hosts: ["host1", "host2"]
|
|
||||||
#
|
|
||||||
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
|
|
||||||
#
|
|
||||||
#cluster.initial_cluster_manager_nodes: ["node-1", "node-2"]
|
|
||||||
#
|
|
||||||
# For more information, consult the discovery and cluster formation module documentation.
|
|
||||||
#
|
|
||||||
# ---------------------------------- Gateway -----------------------------------
|
|
||||||
#
|
|
||||||
# Block initial recovery after a full cluster restart until N nodes are started:
|
|
||||||
#
|
|
||||||
#gateway.recover_after_nodes: 3
|
|
||||||
#
|
|
||||||
# For more information, consult the gateway module documentation.
|
|
||||||
#
|
|
||||||
# ---------------------------------- Various -----------------------------------
|
|
||||||
#
|
|
||||||
# Require explicit names when deleting indices:
|
|
||||||
#
|
|
||||||
#action.destructive_requires_name: true
|
|
||||||
#
|
|
||||||
# ---------------------------------- Remote Store -----------------------------------
|
|
||||||
# Controls whether cluster imposes index creation only with remote store enabled
|
|
||||||
# cluster.remote_store.enabled: true
|
|
||||||
#
|
|
||||||
# Repository to use for segment upload while enforcing remote store for an index
|
|
||||||
# node.attr.remote_store.segment.repository: my-repo-1
|
|
||||||
#
|
|
||||||
# Repository to use for translog upload while enforcing remote store for an index
|
|
||||||
# node.attr.remote_store.translog.repository: my-repo-1
|
|
||||||
#
|
|
||||||
# ---------------------------------- Experimental Features -----------------------------------
|
|
||||||
# Gates the visibility of the experimental segment replication features until they are production ready.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
|
|
||||||
#
|
|
||||||
# Gates the functionality of a new parameter to the snapshot restore API
|
|
||||||
# that allows for creation of a new index type that searches a snapshot
|
|
||||||
# directly in a remote repository without restoring all index data to disk
|
|
||||||
# ahead of time.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.searchable_snapshot.enabled: false
|
|
||||||
#
|
|
||||||
#
|
|
||||||
# Gates the functionality of enabling extensions to work with OpenSearch.
|
|
||||||
# This feature enables applications to extend features of OpenSearch outside of
|
|
||||||
# the core.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.extensions.enabled: false
|
|
||||||
#
|
|
||||||
#
|
|
||||||
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
|
|
||||||
# index searcher threadpool.
|
|
||||||
#
|
|
||||||
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
|
|
||||||
|
|
||||||
######## Start OpenSearch Security Demo Configuration ########
|
|
||||||
# 키정보는 openssl로 생성해서 교체해도 됨.
|
|
||||||
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
|
|
||||||
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
|
|
||||||
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
|
|
||||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
|
||||||
plugins.security.ssl.http.enabled: true
|
|
||||||
plugins.security.ssl.http.pemcert_filepath: esnode.pem
|
|
||||||
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
|
|
||||||
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
|
|
||||||
plugins.security.allow_unsafe_democertificates: true # 데모아니면 불필요
|
|
||||||
plugins.security.allow_default_init_securityindex: true #이건 모르겠음
|
|
||||||
plugins.security.authcz.admin_dn:
|
|
||||||
- CN=kirk,OU=client,O=client,L=test, C=de
|
|
||||||
|
|
||||||
plugins.security.audit.type: internal_opensearch
|
|
||||||
plugins.security.enable_snapshot_restore_privilege: true
|
|
||||||
plugins.security.check_snapshot_restore_write_privileges: true
|
|
||||||
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
|
||||||
plugins.security.system_indices.enabled: true
|
|
||||||
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
|
||||||
node.max_local_storage_nodes: 3
|
|
||||||
######## End OpenSearch Security Demo Configuration ########
|
|
||||||
# Bind OpenSearch to the correct network interface. Use 0.0.0.0
|
|
||||||
# to include all available interfaces or specify an IP address
|
|
||||||
# assigned to a specific interface.
|
|
||||||
network.host: 0.0.0.0
|
|
||||||
|
|
||||||
# Unless you have already configured a cluster, you should set
|
|
||||||
# discovery.type to single-node, or the bootstrap checks will
|
|
||||||
# fail when you try to start the service.
|
|
||||||
discovery.type: single-node
|
|
||||||
|
|
||||||
# If you previously disabled the Security plugin in opensearch.yml,
|
|
||||||
# be sure to re-enable it. Otherwise you can skip this setting.
|
|
||||||
plugins.security.disabled: false # false가 기능활성임.
|
|
||||||
```
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
## Password Change
|
|
||||||
multimaster 설정 과정에 대하여 기술함.
|
|
||||||
|
|
||||||
> 기존에 생성했던 인증서를 노드별로 적용하는 과정을 거쳐서 테스트를 진행하였음.
|
|
||||||
|
|
||||||
[참고자료](https://opensearch.org/docs/latest/security/configuration/generate-certificates/)
|
|
||||||
|
|
||||||
사용했던 실제 스크립트
|
|
||||||
```sh
|
|
||||||
#!/bin/sh
|
|
||||||
# Root CA
|
|
||||||
openssl genrsa -out root-ca-key.pem 2048
|
|
||||||
openssl req -new -x509 -sha256 -key root-ca-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=root.dns.a-record" -out root-ca.pem -days 730
|
|
||||||
# Admin cert
|
|
||||||
openssl genrsa -out admin-key-temp.pem 2048
|
|
||||||
openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem
|
|
||||||
openssl req -new -key admin-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=A" -out admin.csr
|
|
||||||
openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 730
|
|
||||||
# Node cert 1
|
|
||||||
openssl genrsa -out os1-key-temp.pem 2048
|
|
||||||
openssl pkcs8 -inform PEM -outform PEM -in os1-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os1-key.pem
|
|
||||||
openssl req -new -key os1-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os1.dns.a-record" -out os1.csr
|
|
||||||
echo 'subjectAltName=DNS:os1.dns.a-record' > os1.ext
|
|
||||||
openssl x509 -req -in os1.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os1.pem -days 730 -extfile os1.ext
|
|
||||||
# Node cert 2
|
|
||||||
openssl genrsa -out os2-key-temp.pem 2048
|
|
||||||
openssl pkcs8 -inform PEM -outform PEM -in os2-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os2-key.pem
|
|
||||||
openssl req -new -key os2-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os2.dns.a-record" -out os2.csr
|
|
||||||
echo 'subjectAltName=DNS:os2.dns.a-record' > os2.ext
|
|
||||||
openssl x509 -req -in os2.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os2.pem -days 730 -extfile os2.ext
|
|
||||||
# Node cert 3
|
|
||||||
openssl genrsa -out os3-key-temp.pem 2048
|
|
||||||
openssl pkcs8 -inform PEM -outform PEM -in os3-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os3-key.pem
|
|
||||||
openssl req -new -key os3-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os3.dns.a-record" -out os3.csr
|
|
||||||
echo 'subjectAltName=DNS:os3.dns.a-record' > os3.ext
|
|
||||||
openssl x509 -req -in os3.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os3.pem -days 730 -extfile os3.ext
|
|
||||||
# Cleanup
|
|
||||||
rm admin-key-temp.pem
|
|
||||||
rm admin.csr
|
|
||||||
rm os1-key-temp.pem
|
|
||||||
rm os1.csr
|
|
||||||
rm os1.ext
|
|
||||||
rm os2-key-temp.pem
|
|
||||||
rm os2.csr
|
|
||||||
rm os2.ext
|
|
||||||
rm os3-key-temp.pem
|
|
||||||
rm os3.csr
|
|
||||||
rm os3.ext
|
|
||||||
```
|
|
||||||
|
|
||||||
### 설정했던 opensearch.yml
|
|
||||||
```bash
|
|
||||||
cluster.name: my-application
|
|
||||||
node.name: os1
|
|
||||||
node.roles: ["cluster_manager", "data"]
|
|
||||||
path.data: /var/lib/opensearch
|
|
||||||
path.logs: /var/log/opensearch
|
|
||||||
network.host: 0.0.0.0
|
|
||||||
http.port: 9200
|
|
||||||
transport.port: 9300
|
|
||||||
discovery.seed_hosts: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
|
|
||||||
cluster.initial_cluster_manager_nodes: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
|
|
||||||
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
|
|
||||||
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
|
|
||||||
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
|
|
||||||
plugins.security.ssl.transport.enforce_hostname_verification: false
|
|
||||||
plugins.security.ssl.http.enabled: true
|
|
||||||
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
|
|
||||||
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
|
|
||||||
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
|
|
||||||
plugins.security.allow_unsafe_democertificates: true
|
|
||||||
plugins.security.allow_default_init_securityindex: true
|
|
||||||
plugins.security.authcz.admin_dn:
|
|
||||||
- 'CN=A,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
|
||||||
plugins.security.nodes_dn:
|
|
||||||
- 'CN=os1.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
|
||||||
- 'CN=os2.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
|
||||||
- 'CN=os3.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
|
|
||||||
plugins.security.audit.type: internal_opensearch
|
|
||||||
plugins.security.enable_snapshot_restore_privilege: true
|
|
||||||
plugins.security.check_snapshot_restore_write_privileges: true
|
|
||||||
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
|
|
||||||
plugins.security.system_indices.enabled: true
|
|
||||||
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
|
|
||||||
node.max_local_storage_nodes: 3
|
|
||||||
plugins.security.disabled: false
|
|
||||||
```
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
# This section includes base Calico installation configuration.
|
|
||||||
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
|
|
||||||
apiVersion: operator.tigera.io/v1
|
|
||||||
kind: Installation
|
|
||||||
metadata:
|
|
||||||
name: default
|
|
||||||
spec:
|
|
||||||
# Configures Calico networking.
|
|
||||||
calicoNetwork:
|
|
||||||
ipPools:
|
|
||||||
- name: default-ipv4-ippool
|
|
||||||
blockSize: 24
|
|
||||||
cidr: 10.10.0.0/16
|
|
||||||
encapsulation: VXLANCrossSubnet # openstack 에서는 VXLAN을 사용해야해안다 byljh
|
|
||||||
natOutgoing: Enabled
|
|
||||||
nodeSelector: all()
|
|
||||||
registry: reg.inje-private.com
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
# This section configures the Calico API server.
|
|
||||||
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
|
|
||||||
apiVersion: operator.tigera.io/v1
|
|
||||||
kind: APIServer
|
|
||||||
metadata:
|
|
||||||
name: default
|
|
||||||
spec: {}
|
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
|
|
@ -1,311 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
kubernetes.io/metadata.name: harbor
|
|
||||||
name: harbor
|
|
||||||
spec:
|
|
||||||
finalizers:
|
|
||||||
- kubernetes
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-core
|
|
||||||
namespace: harbor
|
|
||||||
data:
|
|
||||||
_REDIS_URL_CORE: redis://harbor-redis:6379/0?idle_timeout_seconds=30
|
|
||||||
_REDIS_URL_REG: redis://harbor-redis:6379/2?idle_timeout_seconds=30
|
|
||||||
CHART_CACHE_DRIVER: redis
|
|
||||||
CONFIG_PATH: /etc/core/app.conf
|
|
||||||
CORE_LOCAL_URL: http://127.0.0.1:8080
|
|
||||||
CORE_URL: http://harbor-core:80
|
|
||||||
DATABASE_TYPE: postgresql
|
|
||||||
EXT_ENDPOINT: https://harbor.inje-private.com
|
|
||||||
HTTP_PROXY: ""
|
|
||||||
HTTPS_PROXY: ""
|
|
||||||
JOBSERVICE_URL: http://harbor-jobservice
|
|
||||||
LOG_LEVEL: info
|
|
||||||
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
|
||||||
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory
|
|
||||||
PORT: "8080"
|
|
||||||
PORTAL_URL: http://harbor-portal
|
|
||||||
POSTGRESQL_DATABASE: registry
|
|
||||||
POSTGRESQL_HOST: harbor-database
|
|
||||||
POSTGRESQL_MAX_IDLE_CONNS: "100"
|
|
||||||
POSTGRESQL_MAX_OPEN_CONNS: "900"
|
|
||||||
POSTGRESQL_PORT: "5432"
|
|
||||||
POSTGRESQL_SSLMODE: disable
|
|
||||||
POSTGRESQL_USERNAME: postgres
|
|
||||||
QUOTA_UPDATE_PROVIDER: db
|
|
||||||
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
|
|
||||||
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
|
|
||||||
REGISTRY_STORAGE_PROVIDER_NAME: filesystem
|
|
||||||
REGISTRY_URL: http://harbor-registry:5000
|
|
||||||
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
|
|
||||||
TRIVY_ADAPTER_URL: http://harbor-trivy:8080
|
|
||||||
WITH_TRIVY: "true"
|
|
||||||
app.conf: |
|
|
||||||
appname = Harbor
|
|
||||||
runmode = prod
|
|
||||||
enablegzip = true
|
|
||||||
|
|
||||||
[prod]
|
|
||||||
httpport = 8080
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-jobservice
|
|
||||||
namespace: harbor
|
|
||||||
data:
|
|
||||||
config.yml: |
|
|
||||||
#Server listening port
|
|
||||||
protocol: "http"
|
|
||||||
port: 8080
|
|
||||||
worker_pool:
|
|
||||||
workers: 10
|
|
||||||
backend: "redis"
|
|
||||||
redis_pool:
|
|
||||||
redis_url: "redis://harbor-redis:6379/1"
|
|
||||||
namespace: "harbor_job_service_namespace"
|
|
||||||
idle_timeout_second: 3600
|
|
||||||
job_loggers:
|
|
||||||
- name: "FILE"
|
|
||||||
level: INFO
|
|
||||||
settings: # Customized settings of logger
|
|
||||||
base_dir: "/var/log/jobs"
|
|
||||||
sweeper:
|
|
||||||
duration: 14 #days
|
|
||||||
settings: # Customized settings of sweeper
|
|
||||||
work_dir: "/var/log/jobs"
|
|
||||||
metric:
|
|
||||||
enabled: false
|
|
||||||
path: /metrics
|
|
||||||
port: 8001
|
|
||||||
#Loggers for the job service
|
|
||||||
loggers:
|
|
||||||
- name: "STD_OUTPUT"
|
|
||||||
level: INFO
|
|
||||||
reaper:
|
|
||||||
# the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
|
|
||||||
max_update_hours: 24
|
|
||||||
# the max time for execution in running state without new task created
|
|
||||||
max_dangling_hours: 168
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-jobservice-env
|
|
||||||
namespace: harbor
|
|
||||||
data:
|
|
||||||
CORE_URL: http://harbor-core:80
|
|
||||||
HTTP_PROXY: ""
|
|
||||||
HTTPS_PROXY: ""
|
|
||||||
JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "3"
|
|
||||||
JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "3"
|
|
||||||
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
|
||||||
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
|
|
||||||
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
|
|
||||||
REGISTRY_URL: http://harbor-registry:5000
|
|
||||||
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-portal
|
|
||||||
namespace: harbor
|
|
||||||
data:
|
|
||||||
nginx.conf: |
|
|
||||||
worker_processes auto;
|
|
||||||
pid /tmp/nginx.pid;
|
|
||||||
events {
|
|
||||||
worker_connections 1024;
|
|
||||||
}
|
|
||||||
http {
|
|
||||||
client_body_temp_path /tmp/client_body_temp;
|
|
||||||
proxy_temp_path /tmp/proxy_temp;
|
|
||||||
fastcgi_temp_path /tmp/fastcgi_temp;
|
|
||||||
uwsgi_temp_path /tmp/uwsgi_temp;
|
|
||||||
scgi_temp_path /tmp/scgi_temp;
|
|
||||||
server {
|
|
||||||
listen 8080;
|
|
||||||
listen [::]:8080;
|
|
||||||
server_name localhost;
|
|
||||||
root /usr/share/nginx/html;
|
|
||||||
index index.html index.htm;
|
|
||||||
include /etc/nginx/mime.types;
|
|
||||||
gzip on;
|
|
||||||
gzip_min_length 1000;
|
|
||||||
gzip_proxied expired no-cache no-store private auth;
|
|
||||||
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
|
|
||||||
location /devcenter-api-2.0 {
|
|
||||||
try_files $uri $uri/ /swagger-ui-index.html;
|
|
||||||
}
|
|
||||||
location / {
|
|
||||||
try_files $uri $uri/ /index.html;
|
|
||||||
}
|
|
||||||
location = /index.html {
|
|
||||||
add_header Cache-Control "no-store, no-cache, must-revalidate";
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registry
|
|
||||||
namespace: harbor
|
|
||||||
data:
|
|
||||||
config.yml: |
|
|
||||||
version: 0.1
|
|
||||||
log:
|
|
||||||
level: info
|
|
||||||
fields:
|
|
||||||
service: registry
|
|
||||||
storage:
|
|
||||||
filesystem:
|
|
||||||
rootdirectory: /storage
|
|
||||||
cache:
|
|
||||||
layerinfo: redis
|
|
||||||
maintenance:
|
|
||||||
uploadpurging:
|
|
||||||
enabled: true
|
|
||||||
age: 168h
|
|
||||||
interval: 24h
|
|
||||||
dryrun: false
|
|
||||||
delete:
|
|
||||||
enabled: true
|
|
||||||
redirect:
|
|
||||||
disable: false
|
|
||||||
redis:
|
|
||||||
addr: harbor-redis:6379
|
|
||||||
db: 2
|
|
||||||
readtimeout: 10s
|
|
||||||
writetimeout: 10s
|
|
||||||
dialtimeout: 10s
|
|
||||||
pool:
|
|
||||||
maxidle: 100
|
|
||||||
maxactive: 500
|
|
||||||
idletimeout: 60s
|
|
||||||
http:
|
|
||||||
addr: :5000
|
|
||||||
#relativeurls: false
|
|
||||||
relativeurls: true
|
|
||||||
# set via environment variable
|
|
||||||
# secret: placeholder
|
|
||||||
debug:
|
|
||||||
addr: localhost:5001
|
|
||||||
auth:
|
|
||||||
htpasswd:
|
|
||||||
realm: harbor-registry-basic-realm
|
|
||||||
path: /etc/registry/passwd
|
|
||||||
validation:
|
|
||||||
disabled: true
|
|
||||||
compatibility:
|
|
||||||
schema1:
|
|
||||||
enabled: true
|
|
||||||
ctl-config.yml: |
|
|
||||||
---
|
|
||||||
protocol: "http"
|
|
||||||
port: 8080
|
|
||||||
log_level: info
|
|
||||||
registry_config: "/etc/registry/config.yml"
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registryctl
|
|
||||||
namespace: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-database
|
|
||||||
namespace: harbor
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
POSTGRES_PASSWORD: UmxheG9kbXM5MCFA
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-jobservice
|
|
||||||
namespace: harbor
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
JOBSERVICE_SECRET: akVWbzlyNFJaU2R1clJqUA==
|
|
||||||
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
REGISTRY_HTTP_SECRET: dHlCdm41MXpIakxLRm5mRw==
|
|
||||||
REGISTRY_REDIS_PASSWORD: ""
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registry
|
|
||||||
namespace: harbor
|
|
||||||
type: Opaque
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
REGISTRY_HTPASSWD: aGFyYm9yX3JlZ2lzdHJ5X3VzZXI6JDJhJDEwJG1uRkVSQkVyRmROYnNuZDVHWUxTQXVUOTRaUWxZNGkxU3BtNTk4dWlmV2pLbEJrQnJhbHEu
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registry-htpasswd
|
|
||||||
namespace: harbor
|
|
||||||
type: Opaque
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
data: null
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registryctl
|
|
||||||
namespace: harbor
|
|
||||||
type: Opaque
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
gitHubToken: ""
|
|
||||||
redisURL: cmVkaXM6Ly9oYXJib3ItcmVkaXM6NjM3OS81P2lkbGVfdGltZW91dF9zZWNvbmRzPTMw
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-trivy
|
|
||||||
namespace: harbor
|
|
||||||
type: Opaque
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: harbor-cacerts
|
|
||||||
namespace: harbor
|
|
||||||
data:
|
|
||||||
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuVENDQW9XZ0F3SUJBZ0lVZG82RjNaejRhT2JjazdreDJwbHdHQVJreHBZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJIUVZOTwpNUXd3Q2dZRFZRUUtEQU5FUlZZeEVEQU9CZ05WQkFzTUIwcEJXUzVEVDFJeEVEQU9CZ05WQkFNTUIxSlBUMVF0ClEwRXdIaGNOTWpReE1ERXdNRFEwTWpJMldoY05Nall4TURFd01EUTBNakkyV2pCZU1Rc3dDUVlEVlFRR0V3SkwKVWpFT01Bd0dBMVVFQ0F3RlUyVnZkV3d4RFRBTEJnTlZCQWNNQkVkQlUwNHhEREFLQmdOVkJBb01BMFJGVmpFUQpNQTRHQTFVRUN3d0hTa0ZaTGtOUFVqRVFNQTRHQTFVRUF3d0hVazlQVkMxRFFUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMYkZPU2dMOEUveDk3VGVBdENqWDllTnlleXZkcS9GSWV0V2l2bk0KSWtaSWhqakZleG4rQXB0azZodFU2U1JabFdvNncvcExJRmJDUlZKbWdNY0s5WVRQenJHQ1FmUjRtOGhvdnN4dQo0aWNLU2tCR0o3YWd0RWI5MU1tSzk3SjFrelNHbm5EVXhQQVRRVnFtWVhZekdiWWhXRGpROURuQ3IwV3Rrb0xECkxwZU4yVERYcW5FcFY3K0dhaEpxWmhnc1VHUkJtcDR4VWttUFpDRWFSZkNrMHg4bVkvVFUyR1NRaTl1Y0dDQm4KN2RQQ1dXeEtNemFQNFkwMm5TSlgvY3FRTmxVS0FDOGlHZ2xwdllaRno3U29hNmxaak8yZXlVbEtXQnc3RGh0eQpiUHFrdjlicEc5aWRCdTU3Y2NuZ1dML0c5SnBFMTBSMEkxUXJJK0h5aUFTRThhOENBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRkprZ3VDTVBFT1c3YzN4NnBVa3Vwb0F2RkovcU1COEdBMVVkSXdRWU1CYUFGSmtndUNNUEVPVzcKYzN4NnBVa3Vwb0F2RkovcU1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRUUzd3hoak5xZzhxUFQ1UC9MNTFKSWlaaWxGbk95cTJjOGg5L0dYVHl2Rmp1ZXB5MkFOeUtMaEJwcjlCNXhYCkVqY3JqWCtyT044OWJIRkFRamlnWTJadGVvRGNyNjhVb1d3cExETC8zU1BPTEcvTnN2TnNUTFJTQkxSK01CdE0KQUJVNzUwM0o4WSszZWY3K0N0MElmVzdWTWNnRnpheWNIaXRkZDZON0x5YTJsVW9vUnNFZmNXSjZqWXlUNEVaTgoxVjc4STEwWHE4aW56ZVFVT3JjaEhQY3Y3VHF6ay9wVG9aMWI0K3hLZFJJTExsYUo1SmQ1R1MrWVU2R3FRb2VmClNlcWlRRmlzODJxdzFFS2xCOFVxNGVFejZENXdjNnF5U0pLd25tY2FOMVNxcld4YnlHSk53TGtyWkZmQXdPNWwKc2N6WjVvdE54TTJUOFgyV2Z4MUtPZW89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-core
|
|
||||||
namespace: harbor
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
CSRF_KEY: Tk9ORjNTYjZoZ2tIdlZmcXNlcTVEdjNhUlBjWDZ6Rjg=
|
|
||||||
HARBOR_ADMIN_PASSWORD: UmxheG9kbXM5MCFA
|
|
||||||
POSTGRESQL_PASSWORD: UmxheG9kbXM5MCFA
|
|
||||||
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
|
|
||||||
secret: RTRQY0FxZ3RPVmdKWTBRRw==
|
|
||||||
secretKey: bm90LWEtc2VjdXJlLWtleQ==
|
|
||||||
tls.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuVENDQW9XZ0F3SUJBZ0lVZG82RjNaejRhT2JjazdreDJwbHdHQVJreHBZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJIUVZOTwpNUXd3Q2dZRFZRUUtEQU5FUlZZeEVEQU9CZ05WQkFzTUIwcEJXUzVEVDFJeEVEQU9CZ05WQkFNTUIxSlBUMVF0ClEwRXdIaGNOTWpReE1ERXdNRFEwTWpJMldoY05Nall4TURFd01EUTBNakkyV2pCZU1Rc3dDUVlEVlFRR0V3SkwKVWpFT01Bd0dBMVVFQ0F3RlUyVnZkV3d4RFRBTEJnTlZCQWNNQkVkQlUwNHhEREFLQmdOVkJBb01BMFJGVmpFUQpNQTRHQTFVRUN3d0hTa0ZaTGtOUFVqRVFNQTRHQTFVRUF3d0hVazlQVkMxRFFUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMYkZPU2dMOEUveDk3VGVBdENqWDllTnlleXZkcS9GSWV0V2l2bk0KSWtaSWhqakZleG4rQXB0azZodFU2U1JabFdvNncvcExJRmJDUlZKbWdNY0s5WVRQenJHQ1FmUjRtOGhvdnN4dQo0aWNLU2tCR0o3YWd0RWI5MU1tSzk3SjFrelNHbm5EVXhQQVRRVnFtWVhZekdiWWhXRGpROURuQ3IwV3Rrb0xECkxwZU4yVERYcW5FcFY3K0dhaEpxWmhnc1VHUkJtcDR4VWttUFpDRWFSZkNrMHg4bVkvVFUyR1NRaTl1Y0dDQm4KN2RQQ1dXeEtNemFQNFkwMm5TSlgvY3FRTmxVS0FDOGlHZ2xwdllaRno3U29hNmxaak8yZXlVbEtXQnc3RGh0eQpiUHFrdjlicEc5aWRCdTU3Y2NuZ1dML0c5SnBFMTBSMEkxUXJJK0h5aUFTRThhOENBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRkprZ3VDTVBFT1c3YzN4NnBVa3Vwb0F2RkovcU1COEdBMVVkSXdRWU1CYUFGSmtndUNNUEVPVzcKYzN4NnBVa3Vwb0F2RkovcU1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRUUzd3hoak5xZzhxUFQ1UC9MNTFKSWlaaWxGbk95cTJjOGg5L0dYVHl2Rmp1ZXB5MkFOeUtMaEJwcjlCNXhYCkVqY3JqWCtyT044OWJIRkFRamlnWTJadGVvRGNyNjhVb1d3cExETC8zU1BPTEcvTnN2TnNUTFJTQkxSK01CdE0KQUJVNzUwM0o4WSszZWY3K0N0MElmVzdWTWNnRnpheWNIaXRkZDZON0x5YTJsVW9vUnNFZmNXSjZqWXlUNEVaTgoxVjc4STEwWHE4aW56ZVFVT3JjaEhQY3Y3VHF6ay9wVG9aMWI0K3hLZFJJTExsYUo1SmQ1R1MrWVU2R3FRb2VmClNlcWlRRmlzODJxdzFFS2xCOFVxNGVFejZENXdjNnF5U0pLd25tY2FOMVNxcld4YnlHSk53TGtyWkZmQXdPNWwKc2N6WjVvdE54TTJUOFgyV2Z4MUtPZW89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
|
|
||||||
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBNENCZnhHTW8xb3pNWld0cXVKNmJUdndPNHhSRy9MTWFVcEF3WUlRNElJUXZtazloCmJkL24vMW85TmpWdDB2QzRqUmU0TFkxbzNUcWk0YWdCbWFWOW1CWTBjZmlRakluSTdybFFJOVpDN25zNXIyZ0gKdngrRGhzVExPQ0I1Mit1b05UdkdJdDYrRzUzbm53c3YxNmx6Qy9GU2M0ZEwzaURacjlQazJOWk55NUhFRC8yawpVQU43ejZ3bmNDRE4vNlVQdlR3aFdncmNtQmpTMjZhQjBMVzU2bk1FZzhTSHErREd2OVlhYXlySDgrYkV0RlVBCllJU2JPcCs3RTRIZVI5c011dmw3VVg5WW1RbG9DN0oxQnljaExuTGdXWlhBU0p0ODd0eW45RkpiaTI1bGVjeVIKTU9oYmxvQSt0SjgyZWlORTRuZXBxOTdXWTZpY3Jqei9aZTd5OVFJREFRQUJBb0lCQUFPNjdqVWJ6R0p6d2ZRZgpLMDNLei8xcXl3bWkvUUo0TGFRNW82QjdtdDZKckt3bURaSlJVM0JuelZTQlk2UkszdHQwVFZ1dXVwUFNCY041Ck14dWVTajZWZ2daeWsxOVBiTUZ5WXAvU0VWZWNRK3ZFTUxyUTJMVE53aThiTlVRQWdsSnVmZi8zRXBWdGxaMEwKUjk3UVFtcXN0OGxWODJDTlRlb3ovZDlSQThielRHV2o5c3FlOS9wY28rb09FV0xPWXNMeE9lWXBFSjdXejhIWQoxalhtRnpid1Jlcnp3Q3RuMVFLeDRKYU4wVWpSTkY3dEpKV2c1VEo0YTVLSkdNaHhZdE5NQ3UvaVBObjNIMnpDCnBJK2x0SmNMMkIwcXBRdzZCMHZ2d1ZHblNNS05weWlHK0dRQk5XRFZLYVR4TXZZT1g0YXpWWmkzS29nU0lETkcKaVZpaTZYa0NnWUVBNzYwN3pFQmIzSmJMakVlNGR2cUErdkJKMGpQNDNBQlNSWElSM3AyaW45VjRJMlpEbHN6NAowem9aelVpS3NYSVAvRlI0bGJHQXJMYzFwMDdSYmpJWUdRaXFzU2N6UCtqMGhDYVJpOWZoaXRVOUJBSk1lT24rCnRZbmxmZ3VZU2ZRa0t4Qk03ck90WnJNdkV2OW5aUXNDYmFGOTV4cDFNKzV2aFoxRHg5OXZ2VDBDZ1lFQTcyUUYKb1QwUko4eVlCTWs5bEYyQUwzcSsxRjQ3SUZ2VFVpd0NIS2tkL1NYd3BSaW5IQ0xwQnZBRjBFcGU0UVcrVkdiSQpEY3UyV0dVY1E0cFRpZk9TcUc2Um4rQ3RjUzViVTRYUytUR09aLzZobkFmSGYyQTh4OTg3aE9DTCtHWVU5Y2RLClFuR1czcFRxMkxkdEFDTnEzcUV0VXhMSjNOZkNyYlZ4ZVBkaTJCa0NnWUVBbTJGTVRncy9Rby9FSUFwekRUY3oKblB0Z2NGVGZOZ2xEVE9BNXMzK3dhVHhrS1ZibjVJQzNvNENjTDVpaXlZenZ6aDhaR2JxOGQ3eENuVmVjc0hycgpZbmRhNllSSFZseDVBSjljWmpPcmRXenVwSVcwL0FKKzdVUWJzbzVqeVRYc3FMcGxsYTZJY1BjalFvYXZpak1MCi9QVGdBWTRHZzRkRlozTGYrVmppUU9VQ2dZRUFnNlJHTUVlTGtvNUFub2tua3RuajdyZ2FEbUNQTlJrcDJRc1kKVWpoeHBFN2p5WFlJRjBIZlVSQldzaGJqbSt4em9LZ3dwTjE4TlpuTWRCdXlHcTlWMjhlSnp4aFhhR0RzbWI2QwpxTVFtb210MDVYK2xwaGIrOVk1OWhYR1JweFJEdkhCT0ZzR3VERkpwM3FqbmlPYnhFdUloTVlpb2R3Z3pKeUVhCitFRmFHcWtDZ1lCSnhuWU1CNzlTa1M1Z1NvTnJnNjJRV3JBcElvZ2dTTkFCNnA3Q1NJbTFldXcvYlBvYVB1aEcKL0V4c0ZGenZ2ayt2TWFycVU0VFNJYkRHcjRkRXZHRm8yM3NQYVNvcVFVZDVRbmg3RGd6RVh5RjhmUGxBV2RxTQpuTTU0aUFnZ2Fyc1paSk9CSnpvQzQveDdwVEJta3RDYkNPVnNVakpDdWZCa0luOXU0UWJjMmc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQ==
|
|
||||||
---
|
|
||||||
|
|
@ -1,824 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-core
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http-web
|
|
||||||
port: 80
|
|
||||||
targetPort: 8080
|
|
||||||
selector:
|
|
||||||
app: harbor
|
|
||||||
component: core
|
|
||||||
release: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-database
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- port: 5432
|
|
||||||
selector:
|
|
||||||
app: harbor
|
|
||||||
component: database
|
|
||||||
release: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-jobservice
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http-jobservice
|
|
||||||
port: 80
|
|
||||||
targetPort: 8080
|
|
||||||
selector:
|
|
||||||
app: harbor
|
|
||||||
component: jobservice
|
|
||||||
release: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-portal
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
targetPort: 8080
|
|
||||||
selector:
|
|
||||||
app: harbor
|
|
||||||
component: portal
|
|
||||||
release: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-redis
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- port: 6379
|
|
||||||
selector:
|
|
||||||
app: harbor
|
|
||||||
component: redis
|
|
||||||
release: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registry
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http-registry
|
|
||||||
port: 5000
|
|
||||||
- name: http-controller
|
|
||||||
port: 8080
|
|
||||||
selector:
|
|
||||||
app: harbor
|
|
||||||
component: registry
|
|
||||||
release: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-trivy
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: http-trivy
|
|
||||||
port: 8080
|
|
||||||
protocol: TCP
|
|
||||||
selector:
|
|
||||||
app: harbor
|
|
||||||
component: trivy
|
|
||||||
release: harbor
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: jobservice
|
|
||||||
release: harbor
|
|
||||||
name: harbor-jobservice
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
storageClassName: sc-monitoring
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 10Gi
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: registry
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registry
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
storageClassName: sc-monitoring
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 50Gi
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: core
|
|
||||||
release: harbor
|
|
||||||
name: harbor-core
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
revisionHistoryLimit: 10
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: harbor
|
|
||||||
component: core
|
|
||||||
release: harbor
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: core
|
|
||||||
release: harbor
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: CORE_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: secret
|
|
||||||
name: harbor-core
|
|
||||||
- name: JOBSERVICE_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: JOBSERVICE_SECRET
|
|
||||||
name: harbor-jobservice
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: harbor-core
|
|
||||||
- secretRef:
|
|
||||||
name: harbor-core
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/harbor-core:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 2
|
|
||||||
httpGet:
|
|
||||||
path: /api/v2.0/ping
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
periodSeconds: 10
|
|
||||||
name: core
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 2
|
|
||||||
httpGet:
|
|
||||||
path: /api/v2.0/ping
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
periodSeconds: 10
|
|
||||||
startupProbe:
|
|
||||||
failureThreshold: 360
|
|
||||||
httpGet:
|
|
||||||
path: /api/v2.0/ping
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /etc/core/app.conf
|
|
||||||
name: config
|
|
||||||
subPath: app.conf
|
|
||||||
- mountPath: /etc/core/key
|
|
||||||
name: secret-key
|
|
||||||
subPath: key
|
|
||||||
- mountPath: /etc/core/private_key.pem
|
|
||||||
name: token-service-private-key
|
|
||||||
subPath: tls.key
|
|
||||||
- mountPath: /etc/core/ca
|
|
||||||
name: ca-download
|
|
||||||
- mountPath: /etc/core/token
|
|
||||||
name: psc
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 10000
|
|
||||||
runAsUser: 10000
|
|
||||||
terminationGracePeriodSeconds: 120
|
|
||||||
volumes:
|
|
||||||
- configMap:
|
|
||||||
items:
|
|
||||||
- key: app.conf
|
|
||||||
path: app.conf
|
|
||||||
name: harbor-core
|
|
||||||
name: config
|
|
||||||
- name: secret-key
|
|
||||||
secret:
|
|
||||||
items:
|
|
||||||
- key: secretKey
|
|
||||||
path: key
|
|
||||||
secretName: harbor-core
|
|
||||||
- name: token-service-private-key
|
|
||||||
secret:
|
|
||||||
secretName: harbor-core
|
|
||||||
- name: ca-download
|
|
||||||
secret:
|
|
||||||
secretName: harbor-cacerts
|
|
||||||
- emptyDir: {}
|
|
||||||
name: psc
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: jobservice
|
|
||||||
release: harbor
|
|
||||||
name: harbor-jobservice
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
revisionHistoryLimit: 10
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: harbor
|
|
||||||
component: jobservice
|
|
||||||
release: harbor
|
|
||||||
strategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: jobservice
|
|
||||||
release: harbor
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: CORE_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: secret
|
|
||||||
name: harbor-core
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: harbor-jobservice-env
|
|
||||||
- secretRef:
|
|
||||||
name: harbor-jobservice
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/harbor-jobservice:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/v1/stats
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 300
|
|
||||||
periodSeconds: 10
|
|
||||||
name: jobservice
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/v1/stats
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 20
|
|
||||||
periodSeconds: 10
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /etc/jobservice/config.yml
|
|
||||||
name: jobservice-config
|
|
||||||
subPath: config.yml
|
|
||||||
- mountPath: /var/log/jobs
|
|
||||||
name: job-logs
|
|
||||||
subPath: null
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 10000
|
|
||||||
runAsUser: 10000
|
|
||||||
terminationGracePeriodSeconds: 120
|
|
||||||
volumes:
|
|
||||||
- configMap:
|
|
||||||
name: harbor-jobservice
|
|
||||||
name: jobservice-config
|
|
||||||
- name: job-logs
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: harbor-jobservice
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: portal
|
|
||||||
release: harbor
|
|
||||||
name: harbor-portal
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
revisionHistoryLimit: 10
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: harbor
|
|
||||||
component: portal
|
|
||||||
release: harbor
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: portal
|
|
||||||
release: harbor
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- image: reg.inje-private.com/nnd002/goharbor/harbor-portal:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 300
|
|
||||||
periodSeconds: 10
|
|
||||||
name: portal
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 1
|
|
||||||
periodSeconds: 10
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /etc/nginx/nginx.conf
|
|
||||||
name: portal-config
|
|
||||||
subPath: nginx.conf
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 10000
|
|
||||||
runAsUser: 10000
|
|
||||||
volumes:
|
|
||||||
- configMap:
|
|
||||||
name: harbor-portal
|
|
||||||
name: portal-config
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: registry
|
|
||||||
release: harbor
|
|
||||||
name: harbor-registry
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
revisionHistoryLimit: 10
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: harbor
|
|
||||||
component: registry
|
|
||||||
release: harbor
|
|
||||||
strategy:
|
|
||||||
type: RollingUpdate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: registry
|
|
||||||
release: harbor
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- args:
|
|
||||||
- serve
|
|
||||||
- /etc/registry/config.yml
|
|
||||||
env: null
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: harbor-registry
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/registry-photon:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: 5000
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 300
|
|
||||||
periodSeconds: 10
|
|
||||||
name: registry
|
|
||||||
ports:
|
|
||||||
- containerPort: 5000
|
|
||||||
- containerPort: 5001
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /
|
|
||||||
port: 5000
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 1
|
|
||||||
periodSeconds: 10
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /storage
|
|
||||||
name: registry-data
|
|
||||||
subPath: null
|
|
||||||
- mountPath: /etc/registry/passwd
|
|
||||||
name: registry-htpasswd
|
|
||||||
subPath: passwd
|
|
||||||
- mountPath: /etc/registry/config.yml
|
|
||||||
name: registry-config
|
|
||||||
subPath: config.yml
|
|
||||||
- env:
|
|
||||||
- name: CORE_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: secret
|
|
||||||
name: harbor-core
|
|
||||||
- name: JOBSERVICE_SECRET
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: JOBSERVICE_SECRET
|
|
||||||
name: harbor-jobservice
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: harbor-registryctl
|
|
||||||
- secretRef:
|
|
||||||
name: harbor-registry
|
|
||||||
- secretRef:
|
|
||||||
name: harbor-registryctl
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/harbor-registryctl:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/health
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 300
|
|
||||||
periodSeconds: 10
|
|
||||||
name: registryctl
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /api/health
|
|
||||||
port: 8080
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 1
|
|
||||||
periodSeconds: 10
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /storage
|
|
||||||
name: registry-data
|
|
||||||
subPath: null
|
|
||||||
- mountPath: /etc/registry/config.yml
|
|
||||||
name: registry-config
|
|
||||||
subPath: config.yml
|
|
||||||
- mountPath: /etc/registryctl/config.yml
|
|
||||||
name: registry-config
|
|
||||||
subPath: ctl-config.yml
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 10000
|
|
||||||
fsGroupChangePolicy: OnRootMismatch
|
|
||||||
runAsUser: 10000
|
|
||||||
terminationGracePeriodSeconds: 120
|
|
||||||
volumes:
|
|
||||||
- name: registry-htpasswd
|
|
||||||
secret:
|
|
||||||
items:
|
|
||||||
- key: REGISTRY_HTPASSWD
|
|
||||||
path: passwd
|
|
||||||
secretName: harbor-registry-htpasswd
|
|
||||||
- configMap:
|
|
||||||
name: harbor-registry
|
|
||||||
name: registry-config
|
|
||||||
- name: registry-data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: harbor-registry
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: database
|
|
||||||
release: harbor
|
|
||||||
name: harbor-database
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: harbor
|
|
||||||
component: database
|
|
||||||
release: harbor
|
|
||||||
serviceName: harbor-database
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: database
|
|
||||||
release: harbor
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: PGDATA
|
|
||||||
value: /var/lib/postgresql/data/pgdata
|
|
||||||
envFrom:
|
|
||||||
- secretRef:
|
|
||||||
name: harbor-database
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /docker-healthcheck.sh
|
|
||||||
initialDelaySeconds: 300
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 1
|
|
||||||
name: database
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /docker-healthcheck.sh
|
|
||||||
initialDelaySeconds: 1
|
|
||||||
periodSeconds: 10
|
|
||||||
timeoutSeconds: 1
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/lib/postgresql/data
|
|
||||||
name: database-data
|
|
||||||
- mountPath: /dev/shm
|
|
||||||
name: shm-volume
|
|
||||||
initContainers:
|
|
||||||
- args:
|
|
||||||
- -c
|
|
||||||
- '[ -e /var/lib/postgresql/data/postgresql.conf ] && [ ! -d /var/lib/postgresql/data/pgdata
|
|
||||||
] && mkdir -m 0700 /var/lib/postgresql/data/pgdata && mv /var/lib/postgresql/data/*
|
|
||||||
/var/lib/postgresql/data/pgdata/ || true'
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
name: data-migrator
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/lib/postgresql/data
|
|
||||||
name: database-data
|
|
||||||
- args:
|
|
||||||
- -c
|
|
||||||
- chmod -R 700 /var/lib/postgresql/data/pgdata || true
|
|
||||||
command:
|
|
||||||
- /bin/sh
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
name: data-permissions-ensurer
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/lib/postgresql/data
|
|
||||||
name: database-data
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 999
|
|
||||||
runAsUser: 999
|
|
||||||
terminationGracePeriodSeconds: 120
|
|
||||||
volumes:
|
|
||||||
- emptyDir:
|
|
||||||
medium: Memory
|
|
||||||
sizeLimit: 512Mi
|
|
||||||
name: shm-volume
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
annotations: null
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: database-data
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 10Gi
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: redis
|
|
||||||
release: harbor
|
|
||||||
name: harbor-redis
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: harbor
|
|
||||||
component: redis
|
|
||||||
release: harbor
|
|
||||||
serviceName: harbor-redis
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: redis
|
|
||||||
release: harbor
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- image: reg.inje-private.com/nnd002/goharbor/redis-photon:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
initialDelaySeconds: 300
|
|
||||||
periodSeconds: 10
|
|
||||||
tcpSocket:
|
|
||||||
port: 6379
|
|
||||||
name: redis
|
|
||||||
readinessProbe:
|
|
||||||
initialDelaySeconds: 1
|
|
||||||
periodSeconds: 10
|
|
||||||
tcpSocket:
|
|
||||||
port: 6379
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/lib/redis
|
|
||||||
name: data
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 999
|
|
||||||
runAsUser: 999
|
|
||||||
terminationGracePeriodSeconds: 120
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
annotations: null
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: data
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 10Gi
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: trivy
|
|
||||||
release: harbor
|
|
||||||
name: harbor-trivy
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: harbor
|
|
||||||
component: trivy
|
|
||||||
release: harbor
|
|
||||||
serviceName: harbor-trivy
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
component: trivy
|
|
||||||
release: harbor
|
|
||||||
spec:
|
|
||||||
automountServiceAccountToken: false
|
|
||||||
containers:
|
|
||||||
- env:
|
|
||||||
- name: HTTP_PROXY
|
|
||||||
value: ""
|
|
||||||
- name: HTTPS_PROXY
|
|
||||||
value: ""
|
|
||||||
- name: NO_PROXY
|
|
||||||
value: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
|
|
||||||
- name: SCANNER_LOG_LEVEL
|
|
||||||
value: info
|
|
||||||
- name: SCANNER_TRIVY_CACHE_DIR
|
|
||||||
value: /home/scanner/.cache/trivy
|
|
||||||
- name: SCANNER_TRIVY_REPORTS_DIR
|
|
||||||
value: /home/scanner/.cache/reports
|
|
||||||
- name: SCANNER_TRIVY_DEBUG_MODE
|
|
||||||
value: "false"
|
|
||||||
- name: SCANNER_TRIVY_VULN_TYPE
|
|
||||||
value: os,library
|
|
||||||
- name: SCANNER_TRIVY_TIMEOUT
|
|
||||||
value: 5m0s
|
|
||||||
- name: SCANNER_TRIVY_GITHUB_TOKEN
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: gitHubToken
|
|
||||||
name: harbor-trivy
|
|
||||||
- name: SCANNER_TRIVY_SEVERITY
|
|
||||||
value: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
|
||||||
- name: SCANNER_TRIVY_IGNORE_UNFIXED
|
|
||||||
value: "false"
|
|
||||||
- name: SCANNER_TRIVY_SKIP_UPDATE
|
|
||||||
value: "false"
|
|
||||||
- name: SCANNER_TRIVY_OFFLINE_SCAN
|
|
||||||
value: "false"
|
|
||||||
- name: SCANNER_TRIVY_SECURITY_CHECKS
|
|
||||||
value: vuln
|
|
||||||
- name: SCANNER_TRIVY_INSECURE
|
|
||||||
value: "false"
|
|
||||||
- name: SCANNER_API_SERVER_ADDR
|
|
||||||
value: :8080
|
|
||||||
- name: SCANNER_REDIS_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: redisURL
|
|
||||||
name: harbor-trivy
|
|
||||||
- name: SCANNER_STORE_REDIS_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: redisURL
|
|
||||||
name: harbor-trivy
|
|
||||||
- name: SCANNER_JOB_QUEUE_REDIS_URL
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
key: redisURL
|
|
||||||
name: harbor-trivy
|
|
||||||
image: reg.inje-private.com/nnd002/goharbor/trivy-adapter-photon:v2.9.1
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 10
|
|
||||||
httpGet:
|
|
||||||
path: /probe/healthy
|
|
||||||
port: api-server
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
name: trivy
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
name: api-server
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 3
|
|
||||||
httpGet:
|
|
||||||
path: /probe/ready
|
|
||||||
port: api-server
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpu: 1
|
|
||||||
memory: 1Gi
|
|
||||||
requests:
|
|
||||||
cpu: 200m
|
|
||||||
memory: 512Mi
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
privileged: false
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /home/scanner/.cache
|
|
||||||
name: data
|
|
||||||
readOnly: false
|
|
||||||
securityContext:
|
|
||||||
fsGroup: 10000
|
|
||||||
runAsUser: 10000
|
|
||||||
volumeClaimTemplates:
|
|
||||||
- metadata:
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: data
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 50Gi
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
annotations:
|
|
||||||
ingress.kubernetes.io/proxy-body-size: "0"
|
|
||||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
|
||||||
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
|
||||||
labels:
|
|
||||||
app: harbor
|
|
||||||
release: harbor
|
|
||||||
name: harbor-ingress
|
|
||||||
namespace: harbor
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- "harbor.icurfer.com"
|
|
||||||
secretName: harbor-ssl
|
|
||||||
rules:
|
|
||||||
- host: harbor.inje-private.com
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: harbor-core
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
path: /api/
|
|
||||||
pathType: Prefix
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: harbor-core
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
path: /service/
|
|
||||||
pathType: Prefix
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: harbor-core
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
path: /v2/
|
|
||||||
pathType: Prefix
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: harbor-core
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
path: /chartrepo/
|
|
||||||
pathType: Prefix
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: harbor-core
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
path: /c/
|
|
||||||
pathType: Prefix
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: harbor-portal
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
path: /
|
|
||||||
pathType: Prefix
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
#!/usr/bin/python3
|
|
||||||
import os
|
|
||||||
import subprocess
|
|
||||||
|
|
||||||
pv_str = os.popen("kubectl get -n default pv | grep harbor | awk '$1 > 0 {print $1}'").read()
|
|
||||||
print(pv_str)
|
|
||||||
pv_list = pv_str.split('\n')
|
|
||||||
i = 0
|
|
||||||
for pv in pv_list:
|
|
||||||
print(pv)
|
|
||||||
# os.system(f"kubectl delete -n {ns} pv {pv}")
|
|
||||||
os.system(f"kubectl delete pv {pv}")
|
|
||||||
Binary file not shown.
|
|
@ -1,663 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
name: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
automountServiceAccountToken: true
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx
|
|
||||||
namespace: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
automountServiceAccountToken: true
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
namespace: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx
|
|
||||||
namespace: ingress-nginx
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- namespaces
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- configmaps
|
|
||||||
- pods
|
|
||||||
- secrets
|
|
||||||
- endpoints
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- services
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
resources:
|
|
||||||
- ingresses
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
resources:
|
|
||||||
- ingresses/status
|
|
||||||
verbs:
|
|
||||||
- update
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
resources:
|
|
||||||
- ingressclasses
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- coordination.k8s.io
|
|
||||||
resourceNames:
|
|
||||||
- ingress-nginx-leader
|
|
||||||
resources:
|
|
||||||
- leases
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- update
|
|
||||||
- apiGroups:
|
|
||||||
- coordination.k8s.io
|
|
||||||
resources:
|
|
||||||
- leases
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- events
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- discovery.k8s.io
|
|
||||||
resources:
|
|
||||||
- endpointslices
|
|
||||||
verbs:
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- get
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
namespace: ingress-nginx
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- secrets
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- create
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- configmaps
|
|
||||||
- endpoints
|
|
||||||
- nodes
|
|
||||||
- pods
|
|
||||||
- secrets
|
|
||||||
- namespaces
|
|
||||||
verbs:
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- coordination.k8s.io
|
|
||||||
resources:
|
|
||||||
- leases
|
|
||||||
verbs:
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- nodes
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- services
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
resources:
|
|
||||||
- ingresses
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- events
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- patch
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
resources:
|
|
||||||
- ingresses/status
|
|
||||||
verbs:
|
|
||||||
- update
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
resources:
|
|
||||||
- ingressclasses
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- discovery.k8s.io
|
|
||||||
resources:
|
|
||||||
- endpointslices
|
|
||||||
verbs:
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- get
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- admissionregistration.k8s.io
|
|
||||||
resources:
|
|
||||||
- validatingwebhookconfigurations
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- update
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx
|
|
||||||
namespace: ingress-nginx
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: ingress-nginx
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: ingress-nginx
|
|
||||||
namespace: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
namespace: ingress-nginx
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
namespace: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: ingress-nginx
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: ingress-nginx
|
|
||||||
namespace: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
namespace: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
data:
|
|
||||||
allow-snippet-annotations: "false"
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-controller
|
|
||||||
namespace: ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-controller
|
|
||||||
namespace: ingress-nginx
|
|
||||||
spec:
|
|
||||||
ipFamilies:
|
|
||||||
- IPv4
|
|
||||||
ipFamilyPolicy: SingleStack
|
|
||||||
ports:
|
|
||||||
- appProtocol: http
|
|
||||||
name: http
|
|
||||||
port: 80
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: http
|
|
||||||
nodePort: 30100 # by.sdjo
|
|
||||||
- appProtocol: https
|
|
||||||
name: https
|
|
||||||
port: 443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: https
|
|
||||||
nodePort: 30101 # by.sdjo
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
type: NodePort
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-controller-admission
|
|
||||||
namespace: ingress-nginx
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- appProtocol: https
|
|
||||||
name: https-webhook
|
|
||||||
port: 443
|
|
||||||
targetPort: webhook
|
|
||||||
selector:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
type: ClusterIP
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-controller
|
|
||||||
namespace: ingress-nginx
|
|
||||||
spec:
|
|
||||||
minReadySeconds: 0
|
|
||||||
revisionHistoryLimit: 10
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
strategy:
|
|
||||||
rollingUpdate:
|
|
||||||
maxUnavailable: 1
|
|
||||||
type: RollingUpdate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- args:
|
|
||||||
- /nginx-ingress-controller
|
|
||||||
- --election-id=ingress-nginx-leader
|
|
||||||
- --controller-class=k8s.io/ingress-nginx
|
|
||||||
- --ingress-class=nginx
|
|
||||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
|
||||||
- --validating-webhook=:8443
|
|
||||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
|
||||||
- --validating-webhook-key=/usr/local/certificates/key
|
|
||||||
- --enable-metrics=false
|
|
||||||
env:
|
|
||||||
- name: POD_NAME
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.name
|
|
||||||
- name: POD_NAMESPACE
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.namespace
|
|
||||||
- name: LD_PRELOAD
|
|
||||||
value: /usr/local/lib/libmimalloc.so
|
|
||||||
image: reg.inje-private.com/nnd002/ingress-nginx/controller:v1.11.2 # by.ljh
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
lifecycle:
|
|
||||||
preStop:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- /wait-shutdown
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 5
|
|
||||||
httpGet:
|
|
||||||
path: /healthz
|
|
||||||
port: 10254
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 1
|
|
||||||
name: controller
|
|
||||||
ports:
|
|
||||||
- containerPort: 80
|
|
||||||
name: http
|
|
||||||
protocol: TCP
|
|
||||||
- containerPort: 443
|
|
||||||
name: https
|
|
||||||
protocol: TCP
|
|
||||||
- containerPort: 8443
|
|
||||||
name: webhook
|
|
||||||
protocol: TCP
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 3
|
|
||||||
httpGet:
|
|
||||||
path: /healthz
|
|
||||||
port: 10254
|
|
||||||
scheme: HTTP
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 10
|
|
||||||
successThreshold: 1
|
|
||||||
timeoutSeconds: 1
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 90Mi
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
add:
|
|
||||||
- NET_BIND_SERVICE
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
readOnlyRootFilesystem: false
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 101
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /usr/local/certificates/
|
|
||||||
name: webhook-cert
|
|
||||||
readOnly: true
|
|
||||||
dnsPolicy: ClusterFirst
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/os: linux
|
|
||||||
serviceAccountName: ingress-nginx
|
|
||||||
terminationGracePeriodSeconds: 300
|
|
||||||
volumes:
|
|
||||||
- name: webhook-cert
|
|
||||||
secret:
|
|
||||||
secretName: ingress-nginx-admission
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: Job
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission-create
|
|
||||||
namespace: ingress-nginx
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission-create
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- args:
|
|
||||||
- create
|
|
||||||
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
|
||||||
- --namespace=$(POD_NAMESPACE)
|
|
||||||
- --secret-name=ingress-nginx-admission
|
|
||||||
env:
|
|
||||||
- name: POD_NAMESPACE
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.namespace
|
|
||||||
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
name: create
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 65532
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/os: linux
|
|
||||||
restartPolicy: OnFailure
|
|
||||||
serviceAccountName: ingress-nginx-admission
|
|
||||||
---
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: Job
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission-patch
|
|
||||||
namespace: ingress-nginx
|
|
||||||
spec:
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission-patch
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- args:
|
|
||||||
- patch
|
|
||||||
- --webhook-name=ingress-nginx-admission
|
|
||||||
- --namespace=$(POD_NAMESPACE)
|
|
||||||
- --patch-mutating=false
|
|
||||||
- --secret-name=ingress-nginx-admission
|
|
||||||
- --patch-failure-policy=Fail
|
|
||||||
env:
|
|
||||||
- name: POD_NAMESPACE
|
|
||||||
valueFrom:
|
|
||||||
fieldRef:
|
|
||||||
fieldPath: metadata.namespace
|
|
||||||
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
name: patch
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- ALL
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 65532
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/os: linux
|
|
||||||
restartPolicy: OnFailure
|
|
||||||
serviceAccountName: ingress-nginx-admission
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: IngressClass
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: controller
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: nginx
|
|
||||||
spec:
|
|
||||||
controller: k8s.io/ingress-nginx
|
|
||||||
---
|
|
||||||
apiVersion: admissionregistration.k8s.io/v1
|
|
||||||
kind: ValidatingWebhookConfiguration
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/component: admission-webhook
|
|
||||||
app.kubernetes.io/instance: ingress-nginx
|
|
||||||
app.kubernetes.io/name: ingress-nginx
|
|
||||||
app.kubernetes.io/part-of: ingress-nginx
|
|
||||||
app.kubernetes.io/version: 1.11.2
|
|
||||||
name: ingress-nginx-admission
|
|
||||||
webhooks:
|
|
||||||
- admissionReviewVersions:
|
|
||||||
- v1
|
|
||||||
clientConfig:
|
|
||||||
service:
|
|
||||||
name: ingress-nginx-controller-admission
|
|
||||||
namespace: ingress-nginx
|
|
||||||
path: /networking/v1/ingresses
|
|
||||||
failurePolicy: Fail
|
|
||||||
matchPolicy: Equivalent
|
|
||||||
name: validate.nginx.ingress.kubernetes.io
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- networking.k8s.io
|
|
||||||
apiVersions:
|
|
||||||
- v1
|
|
||||||
operations:
|
|
||||||
- CREATE
|
|
||||||
- UPDATE
|
|
||||||
resources:
|
|
||||||
- ingresses
|
|
||||||
sideEffects: None
|
|
||||||
|
|
@ -1,32 +0,0 @@
|
||||||
#!/usr/bin/python3
|
|
||||||
|
|
||||||
import os
|
|
||||||
import time
|
|
||||||
|
|
||||||
img_list = [
|
|
||||||
"registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce",
|
|
||||||
"registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3"
|
|
||||||
]
|
|
||||||
|
|
||||||
public_registry_list = [
|
|
||||||
"registry.k8s.io",
|
|
||||||
|
|
||||||
]
|
|
||||||
|
|
||||||
registry_path = "reg.inje-private.com"
|
|
||||||
|
|
||||||
harbor_project_name = "nnd002"
|
|
||||||
|
|
||||||
for var in img_list:
|
|
||||||
os.system(f"docker pull {var}")
|
|
||||||
for foo in public_registry_list:
|
|
||||||
if var.startswith(foo):
|
|
||||||
private_img_path = var.replace(foo, f"{registry_path}/{harbor_project_name}")
|
|
||||||
break
|
|
||||||
private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
|
||||||
# else: ljh 수정
|
|
||||||
# private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
|
|
||||||
time.sleep(1)
|
|
||||||
# os.system(f"echo {private_img_path}")
|
|
||||||
os.system(f"docker tag {var} {private_img_path}")
|
|
||||||
os.system(f"docker push {private_img_path}")
|
|
||||||
|
|
@ -1,197 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: metrics-server
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
|
||||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
|
||||||
name: system:aggregated-metrics-reader
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- metrics.k8s.io
|
|
||||||
resources:
|
|
||||||
- pods
|
|
||||||
- nodes
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: system:metrics-server
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- nodes/metrics
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- pods
|
|
||||||
- nodes
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: metrics-server-auth-reader
|
|
||||||
namespace: kube-system
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: extension-apiserver-authentication-reader
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: metrics-server
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: metrics-server:system:auth-delegator
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: system:auth-delegator
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: metrics-server
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: system:metrics-server
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: system:metrics-server
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: metrics-server
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: metrics-server
|
|
||||||
namespace: kube-system
|
|
||||||
spec:
|
|
||||||
ports:
|
|
||||||
- name: https
|
|
||||||
port: 443
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: https
|
|
||||||
selector:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: metrics-server
|
|
||||||
namespace: kube-system
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
strategy:
|
|
||||||
rollingUpdate:
|
|
||||||
maxUnavailable: 0
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- args:
|
|
||||||
- --cert-dir=/tmp
|
|
||||||
- --secure-port=4443
|
|
||||||
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
|
|
||||||
- --kubelet-use-node-status-port
|
|
||||||
- --metric-resolution=15s
|
|
||||||
- --kubelet-insecure-tls
|
|
||||||
image: reg.inje-private.com/nnd002/metrics-server/metrics-server:v0.6.4
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
livenessProbe:
|
|
||||||
failureThreshold: 3
|
|
||||||
httpGet:
|
|
||||||
path: /livez
|
|
||||||
port: https
|
|
||||||
scheme: HTTPS
|
|
||||||
periodSeconds: 10
|
|
||||||
name: metrics-server
|
|
||||||
ports:
|
|
||||||
- containerPort: 4443
|
|
||||||
name: https
|
|
||||||
protocol: TCP
|
|
||||||
readinessProbe:
|
|
||||||
failureThreshold: 3
|
|
||||||
httpGet:
|
|
||||||
path: /readyz
|
|
||||||
port: https
|
|
||||||
scheme: HTTPS
|
|
||||||
initialDelaySeconds: 20
|
|
||||||
periodSeconds: 10
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
cpu: 100m
|
|
||||||
memory: 200Mi
|
|
||||||
securityContext:
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
runAsNonRoot: true
|
|
||||||
runAsUser: 1000
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /tmp
|
|
||||||
name: tmp-dir
|
|
||||||
nodeSelector:
|
|
||||||
kubernetes.io/os: linux
|
|
||||||
priorityClassName: system-cluster-critical
|
|
||||||
serviceAccountName: metrics-server
|
|
||||||
volumes:
|
|
||||||
- emptyDir: {}
|
|
||||||
name: tmp-dir
|
|
||||||
---
|
|
||||||
apiVersion: apiregistration.k8s.io/v1
|
|
||||||
kind: APIService
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
k8s-app: metrics-server
|
|
||||||
name: v1beta1.metrics.k8s.io
|
|
||||||
spec:
|
|
||||||
group: metrics.k8s.io
|
|
||||||
groupPriorityMinimum: 100
|
|
||||||
insecureSkipTLSVerify: true
|
|
||||||
service:
|
|
||||||
name: metrics-server
|
|
||||||
namespace: kube-system
|
|
||||||
version: v1beta1
|
|
||||||
versionPriority: 100
|
|
||||||
|
|
@ -1,101 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
name: nfs-pod-provisioner-sa
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
name: nfs-pod-provisioner-otherRoles
|
|
||||||
namespace: kube-system
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- endpoints
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRole
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
name: nfs-provisioner-clusterRole
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- persistentvolumes
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- create
|
|
||||||
- delete
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- persistentvolumeclaims
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- update
|
|
||||||
- apiGroups:
|
|
||||||
- storage.k8s.io
|
|
||||||
resources:
|
|
||||||
- storageclasses
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- list
|
|
||||||
- watch
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- events
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- update
|
|
||||||
- patch
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
name: nfs-pod-provisioner-otherRoles
|
|
||||||
namespace: kube-system
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: Role
|
|
||||||
name: nfs-pod-provisioner-otherRoles
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: nfs-pod-provisioner-sa
|
|
||||||
namespace: kube-system
|
|
||||||
---
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
name: nfs-provisioner-rolebinding
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: nfs-provisioner-clusterRole
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: nfs-pod-provisioner-sa
|
|
||||||
namespace: kube-system
|
|
||||||
|
|
@ -1,38 +0,0 @@
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: vm-nfs
|
|
||||||
namespace: kube-system
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: vm-nfs
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: vm-nfs
|
|
||||||
spec:
|
|
||||||
serviceAccountName: nfs-pod-provisioner-sa
|
|
||||||
containers:
|
|
||||||
- name: nfs-client-provisioner
|
|
||||||
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
|
||||||
volumeMounts:
|
|
||||||
- name: nfs-provisioner
|
|
||||||
mountPath: persistentvolumes
|
|
||||||
env:
|
|
||||||
- name: PROVISIONER_NAME
|
|
||||||
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
|
|
||||||
- name: NFS_SERVER
|
|
||||||
value: 172.17.128.249 # 주소변경
|
|
||||||
- name: NFS_PATH
|
|
||||||
value: /nfs/monitoring # nfs 연결 주소
|
|
||||||
volumes:
|
|
||||||
- name: nfs-provisioner
|
|
||||||
nfs:
|
|
||||||
server: 172.17.128.249
|
|
||||||
path: /nfs/monitoring
|
|
||||||
|
|
@ -1,38 +0,0 @@
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: Deployment
|
|
||||||
metadata:
|
|
||||||
name: vm-nfs
|
|
||||||
namespace: kube-system
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: vm-nfs
|
|
||||||
strategy:
|
|
||||||
type: Recreate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: vm-nfs
|
|
||||||
spec:
|
|
||||||
serviceAccountName: nfs-pod-provisioner-sa
|
|
||||||
containers:
|
|
||||||
- name: nfs-client-provisioner
|
|
||||||
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
|
|
||||||
volumeMounts:
|
|
||||||
- name: nfs-provisioner
|
|
||||||
mountPath: /persistentvolumes
|
|
||||||
env:
|
|
||||||
- name: PROVISIONER_NAME
|
|
||||||
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
|
|
||||||
- name: NFS_SERVER
|
|
||||||
value: 172.17.128.249 # 주소변경
|
|
||||||
- name: NFS_PATH
|
|
||||||
value: /nfs/monitoring # nfs 연결 주소
|
|
||||||
volumes:
|
|
||||||
- name: nfs-provisioner
|
|
||||||
nfs:
|
|
||||||
server: 172.17.128.249
|
|
||||||
path: /nfs/monitoring
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
apiVersion: storage.k8s.io/v1
|
|
||||||
kind: StorageClass
|
|
||||||
metadata:
|
|
||||||
name: hm-nas
|
|
||||||
annotations:
|
|
||||||
storageclass.kubernetes.io/is-default-class: "true"
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner
|
|
||||||
parameters:
|
|
||||||
pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
|
|
||||||
onDelete: delete
|
|
||||||
archiveOnDelete: "false"
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
apiVersion: storage.k8s.io/v1
|
|
||||||
kind: StorageClass
|
|
||||||
metadata:
|
|
||||||
name: vm-nfs # pvc에서 사용할 SC Name
|
|
||||||
annotations:
|
|
||||||
storageclass.kubernetes.io/is-default-class: "true"
|
|
||||||
labels:
|
|
||||||
name: provision
|
|
||||||
provisioner: vm-nfs # provisioner에서 생성한 PROVISIONER_NAME
|
|
||||||
parameters:
|
|
||||||
#pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
|
|
||||||
onDelete: Retain
|
|
||||||
#onDelete: delete
|
|
||||||
archiveOnDelete: "false"
|
|
||||||
reclaimPolicy: Retain
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
Subproject commit 1fe0b33ebd4339aeaef721c75388809bb461a4d3
|
|
||||||
|
|
@ -1 +0,0 @@
|
||||||
tests
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
apiVersion: v2
|
|
||||||
appVersion: v2.9.1
|
|
||||||
description: Install Rancher Server to manage Kubernetes clusters across providers.
|
|
||||||
home: https://rancher.com
|
|
||||||
icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg
|
|
||||||
keywords:
|
|
||||||
- rancher
|
|
||||||
kubeVersion: < 1.32.0-0
|
|
||||||
maintainers:
|
|
||||||
- email: charts@rancher.com
|
|
||||||
name: Rancher Labs
|
|
||||||
name: rancher
|
|
||||||
sources:
|
|
||||||
- https://github.com/rancher/rancher
|
|
||||||
- https://github.com/rancher/server-chart
|
|
||||||
version: 2.9.1
|
|
||||||
|
|
@ -1,208 +0,0 @@
|
||||||
By installing this application, you accept the [End User License Agreement & Terms & Conditions](https://www.suse.com/licensing/eula/).
|
|
||||||
|
|
||||||
# Rancher
|
|
||||||
|
|
||||||
***Rancher*** is open source software that combines everything an organization needs to adopt and run containers in production. Built on Kubernetes, Rancher makes it easy for DevOps teams to test, deploy and manage their applications.
|
|
||||||
|
|
||||||
### Introduction
|
|
||||||
|
|
||||||
This chart bootstraps a [Rancher Server](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster) on a Kubernetes cluster using the [Helm](https://helm.sh/) package manager. For a Rancher Supported Deployment please follow our [HA install instructions](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs).
|
|
||||||
|
|
||||||
|
|
||||||
### Prerequisites Details
|
|
||||||
|
|
||||||
*For installations covered under [Rancher Support SLA](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) the target cluster must be **[RKE1](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher)**, **[RKE2](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke2-for-rancher)**, **[K3s](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/k3s-for-rancher)**, **[AKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks)**, **[EKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks)**, or **[GKE](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke)**.*
|
|
||||||
|
|
||||||
Make sure the node(s) for the Rancher server fulfill the following requirements:
|
|
||||||
|
|
||||||
[Operating Systems and Container Runtime Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#operating-systems-and-container-runtime-requirements)
|
|
||||||
[Hardware Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#hardware-requirements)
|
|
||||||
|
|
||||||
- [CPU and Memory](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#cpu-and-memory)
|
|
||||||
- [Ingress](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#ingress)
|
|
||||||
- [Disks](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#disks)
|
|
||||||
|
|
||||||
[Networking Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#networking-requirements)
|
|
||||||
- [Node IP Addresses](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#node-ip-addresses)
|
|
||||||
- [Port Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#port-requirements)
|
|
||||||
|
|
||||||
[Install the Required CLI Tools](https://ranchermanager.docs.rancher.com/pages-for-subheaders/cli-with-rancher)
|
|
||||||
|
|
||||||
- [kubectl](https://ranchermanager.docs.rancher.com/reference-guides/cli-with-rancher/kubectl-utility) - Kubernetes command-line tool.
|
|
||||||
- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/helm-version-requirements) to choose a version of Helm to install Rancher.
|
|
||||||
|
|
||||||
For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section](https://ranchermanager.docs.rancher.com/pages-for-subheaders/best-practices).
|
|
||||||
|
|
||||||
## Installing Rancher
|
|
||||||
|
|
||||||
For production environments, we recommend installing Rancher in a [high-availability Kubernetes installation](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs) so that your user base can always access Rancher Server. When installed in a Kubernetes cluster, Rancher will integrate with the cluster’s etcd database and take advantage of Kubernetes scheduling for high-availability.
|
|
||||||
|
|
||||||
Optional: Installing Rancher on a [Single-node](https://ranchermanager.docs.rancher.com/pages-for-subheaders/rancher-on-a-single-node-with-docker) Kubernetes Cluster
|
|
||||||
|
|
||||||
#### Add the Helm Chart Repository
|
|
||||||
|
|
||||||
Use [helm repo add](https://helm.sh/docs/helm/helm_repo_add/) command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see Choosing a Version of Rancher.
|
|
||||||
|
|
||||||
```bash
|
|
||||||
helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Create a Namespace for Rancher
|
|
||||||
|
|
||||||
We’ll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be cattle-system:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl create namespace cattle-system
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Choose your SSL Configuration
|
|
||||||
|
|
||||||
The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
|
|
||||||
|
|
||||||
There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
|
|
||||||
|
|
||||||
- [Rancher-generated TLS certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
|
|
||||||
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
|
|
||||||
- [Bring your own certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
|
|
||||||
|
|
||||||
#### Install cert-manager
|
|
||||||
|
|
||||||
This step is only required to use certificates issued by Rancher’s generated CA **`(ingress.tls.source=rancher)`** or to request Let’s Encrypt issued certificates **`(ingress.tls.source=letsEncrypt)`**.
|
|
||||||
|
|
||||||
[These instructions are adapted from the official cert-manager documentation.](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#4-install-cert-manager)
|
|
||||||
|
|
||||||
#### Install Rancher with Helm and Your Chosen Certificate Option
|
|
||||||
|
|
||||||
- [Rancher to generated certificates](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
|
|
||||||
```bash
|
|
||||||
helm install rancher rancher-latest/rancher \
|
|
||||||
--namespace cattle-system \
|
|
||||||
--set hostname=rancher.my.org
|
|
||||||
```
|
|
||||||
|
|
||||||
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
|
|
||||||
|
|
||||||
```bash
|
|
||||||
helm install rancher rancher-latest/rancher \
|
|
||||||
--namespace cattle-system \
|
|
||||||
--set hostname=rancher.my.org \
|
|
||||||
--set ingress.tls.source=letsEncrypt \
|
|
||||||
--set letsEncrypt.email=me@example.org
|
|
||||||
```
|
|
||||||
|
|
||||||
- [Certificates from Files](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
|
|
||||||
|
|
||||||
```bash
|
|
||||||
helm install rancher rancher-latest/rancher \
|
|
||||||
--namespace cattle-system \
|
|
||||||
--set hostname=rancher.my.org \
|
|
||||||
--set ingress.tls.source=secret
|
|
||||||
```
|
|
||||||
|
|
||||||
*If you are using a Private CA signed certificate , add **--set privateCA=true** to the command:`*
|
|
||||||
|
|
||||||
```bash
|
|
||||||
helm install rancher rancher-latest/rancher \
|
|
||||||
--namespace cattle-system \
|
|
||||||
--set hostname=rancher.my.org \
|
|
||||||
--set ingress.tls.source=secret \
|
|
||||||
--set privateCA=true
|
|
||||||
```
|
|
||||||
|
|
||||||
#### Verify that the Rancher Server is Successfully Deployed
|
|
||||||
|
|
||||||
After adding the secrets, check if Rancher was rolled out successfully:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl -n cattle-system rollout status deploy/rancher
|
|
||||||
Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
|
|
||||||
deployment "rancher" successfully rolled out
|
|
||||||
```
|
|
||||||
|
|
||||||
If you see the following **`error: error: deployment "rancher" exceeded its progress deadline`**, you can check the status of the deployment by running the following command:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
kubectl -n cattle-system get deploy rancher
|
|
||||||
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
|
|
||||||
rancher 3 3 3 3 3m
|
|
||||||
```
|
|
||||||
|
|
||||||
It should show the same count for **`DESIRED`** and **`AVAILABLE`**.
|
|
||||||
|
|
||||||
#### Save Your Options
|
|
||||||
|
|
||||||
Make sure you save the **`--set`** options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
|
|
||||||
|
|
||||||
#### Finishing Up
|
|
||||||
|
|
||||||
That’s it. You should have a functional Rancher server.
|
|
||||||
|
|
||||||
In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
|
|
||||||
|
|
||||||
Doesn’t work? Take a look at the [Troubleshooting Page](https://ranchermanager.docs.rancher.com/troubleshooting/general-troubleshooting)
|
|
||||||
|
|
||||||
***All of these instructions are defined in detailed in the [Rancher Documentation](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#install-the-rancher-helm-chart).***
|
|
||||||
|
|
||||||
### Helm Chart Options for Kubernetes Installations
|
|
||||||
|
|
||||||
The full [Helm Chart Options](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options) can be found here.
|
|
||||||
|
|
||||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
|
|
||||||
|
|
||||||
#### Common Options
|
|
||||||
|
|
||||||
| Parameter | Default Value | Description |
|
|
||||||
| ------------------------- | ------------- | -------------------------------------------------------------------------------------------- |
|
|
||||||
| `hostname` | " " | ***string*** - the Fully Qualified Domain Name for your Rancher Server |
|
|
||||||
| `ingress.tls.source` | "rancher" | ***string*** - Where to get the cert for the ingress. - "***rancher, letsEncrypt, secret***" |
|
|
||||||
| `letsEncrypt.email` | " " | ***string*** - Your email address |
|
|
||||||
| `letsEncrypt.environment` | "production" | ***string*** - Valid options: "***staging, production***" |
|
|
||||||
| `privateCA` | false | ***bool*** - Set to true if your cert is signed by a private CA |
|
|
||||||
|
|
||||||
#### Advanced Options
|
|
||||||
|
|
||||||
| Parameter | Default Value | Description |
|
|
||||||
| ---------------------------------------- | ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
||||||
| `additionalTrustedCAs` | false | ***bool*** - [See Additional Trusted CAs Server](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#additional-trusted-cas) |
|
|
||||||
| `addLocal` | "true" | ***string*** - As of Rancher v2.5.0 this flag is deprecated and must be set to "true" |
|
|
||||||
| `antiAffinity` | "preferred" | ***string*** - AntiAffinity rule for Rancher pods - *"preferred, required"* |
|
|
||||||
| `replicas` | 3 | ***int*** - Number of replicas of Rancher pods |
|
|
||||||
| `auditLog.destination` | "sidecar" | ***string*** - Stream to sidecar container console or hostPath volume - *"sidecar, hostPath"* |
|
|
||||||
| `auditLog.hostPath` | "/var/log/rancher/audit" | ***string*** - log file destination on host (only applies when **auditLog.destination** is set to **hostPath**) |
|
|
||||||
| `auditLog.level` | 0 | ***int*** - set the [API Audit Log level](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels). 0 is off. [0-3] |
|
|
||||||
| `auditLog.maxAge` | 1 | ***int*** - maximum number of days to retain old audit log files (only applies when **auditLog.destination** is set to **hostPath**) |
|
|
||||||
| `auditLog.maxBackup` | 1 | int - maximum number of audit log files to retain (only applies when **auditLog.destination** is set to **hostPath**) |
|
|
||||||
| `auditLog.maxSize` | 100 | ***int*** - maximum size in megabytes of the audit log file before it gets rotated (only applies when **auditLog.destination** is set to **hostPath**) |
|
|
||||||
| `auditLog.image.repository` | "rancher/mirrored-bci-micro" | ***string*** - Location for the image used to collect audit logs *Note: Available as of v2.7.0* |
|
|
||||||
| `auditLog.image.tag` | "15.4.14.3" | ***string*** - Tag for the image used to collect audit logs *Note: Available as of v2.7.0* |
|
|
||||||
| `auditLog.image.pullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for auditLog images - *"Always", "Never", "IfNotPresent"* *Note: Available as of v2.7.0* |
|
|
||||||
| `busyboxImage` | "" | ***string*** - *Deprecated `auditlog.image.repository` should be used to control auditing sidecar image.* Image location for busybox image used to collect audit logs *Note: Available as of v2.2.0, and Deprecated as of v2.7.0* |
|
|
||||||
| `busyboxImagePullPolicy` | "IfNotPresent" | ***string*** - - *Deprecated `auditlog.image.pullPolicy` should be used to control auditing sidecar image.* Override imagePullPolicy for busybox images - *"Always", "Never", "IfNotPresent"* *Deprecated as of v2.7.0* |
|
|
||||||
| `debug` | false | ***bool*** - set debug flag on rancher server |
|
|
||||||
| `certmanager.version` | " " | ***string*** - set cert-manager compatibility |
|
|
||||||
| `extraEnv` | [] | ***list*** - set additional environment variables for Rancher Note: *Available as of v2.2.0* |
|
|
||||||
| `imagePullSecrets` | [] | ***list*** - list of names of Secret resource containing private registry credentials |
|
|
||||||
| `ingress.enabled` | true | ***bool*** - install ingress resource |
|
|
||||||
| `ingress.ingressClassName` | " " | ***string*** - class name of ingress if not set manually or by the ingress controller's defaults |
|
|
||||||
| `ingress.includeDefaultExtraAnnotations` | true | ***bool*** - Add default nginx annotations |
|
|
||||||
| `ingress.extraAnnotations` | {} | ***map*** - additional annotations to customize the ingress |
|
|
||||||
| `ingress.configurationSnippet` | " " | ***string*** - Add additional Nginx configuration. Can be used for proxy configuration. Note: *Available as of v2.0.15, v2.1.10 and v2.2.4* |
|
|
||||||
| `service.annotations` | {} | ***map*** - annotations to customize the service |
|
|
||||||
| `service.type` | " " | ***string*** - Override the type used for the service - *"NodePort", "LoadBalancer", "ClusterIP"* |
|
|
||||||
| `letsEncrypt.ingress.class` | " " | ***string*** - optional ingress class for the cert-manager acmesolver ingress that responds to the Let’s *Encrypt ACME challenges* |
|
|
||||||
| `proxy` | " " | ***string** - HTTP[S] proxy server for Rancher |
|
|
||||||
| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local" | ***string*** - comma separated list of hostnames or ip address not to use the proxy |
|
|
||||||
| `resources` | {} | ***map*** - rancher pod resource requests & limits |
|
|
||||||
| `rancherImage` | "rancher/rancher" | ***string*** - rancher image source |
|
|
||||||
| `rancherImageTag` | same as chart version | ***string*** - rancher/rancher image tag |
|
|
||||||
| `rancherImagePullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for rancher server images - *"Always", "Never", "IfNotPresent"* |
|
|
||||||
| `tls` | "ingress" | ***string*** - See External TLS Termination for details. - *"ingress, external"* |
|
|
||||||
| `systemDefaultRegistry` | "" | ***string*** - private registry to be used for all system Docker images, e.g., [http://registry.example.com/] *Available as of v2.3.0* |
|
|
||||||
| `useBundledSystemChart` | false | ***bool*** - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. *Available as of v2.3.0* |
|
|
||||||
| `customLogos.enabled` | false | ***bool*** - Enabled [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) and [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence volume |
|
|
||||||
| `customLogos.volumeSubpaths.emberUi` | "ember" | ***string*** - Volume subpath for [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) persistence |
|
|
||||||
| `customLogos.volumeSubpaths.vueUi` | "vue" | ***string*** - Volume subpath for [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence |
|
|
||||||
| `customLogos.volumeName` | "" | ***string*** - Use an existing volume. Custom logos should be copied to the proper `volume/subpath` folder by the user. Optional for persistentVolumeClaim, required for configMap |
|
|
||||||
| `customLogos.storageClass` | "" | ***string*** - Set custom logos persistentVolumeClaim storage class. Required for dynamic pv |
|
|
||||||
| `customLogos.accessMode` | "ReadWriteOnce" | ***string*** - Set custom persistentVolumeClaim access mode |
|
|
||||||
| `customLogos.size` | "1Gi" | ***string*** - Set custom persistentVolumeClaim size |
|
|
||||||
|
|
@ -1,64 +0,0 @@
|
||||||
{
|
|
||||||
"apiVersion": "v1",
|
|
||||||
"kind": "Namespace",
|
|
||||||
"metadata": {
|
|
||||||
"annotations": {
|
|
||||||
"cattle.io/status": "{\"Conditions\":[{\"Type\":\"ResourceQuotaInit\",\"Status\":\"True\",\"Message\":\"\",\"LastUpdateTime\":\"2024-10-14T01:51:04Z\"},{\"Type\":\"InitialRolesPopulated\",\"Status\":\"True\",\"Message\":\"\",\"LastUpdateTime\":\"2024-10-14T01:51:09Z\"}]}",
|
|
||||||
"field.cattle.io/projectId": "local:p-2mvh7",
|
|
||||||
"lifecycle.cattle.io/create.namespace-auth": "true",
|
|
||||||
"management.cattle.io/no-default-sa-token": "true"
|
|
||||||
},
|
|
||||||
"creationTimestamp": "2024-10-14T01:46:51Z",
|
|
||||||
"deletionTimestamp": "2024-10-14T01:54:44Z",
|
|
||||||
"finalizers": [
|
|
||||||
],
|
|
||||||
"labels": {
|
|
||||||
"field.cattle.io/projectId": "p-2mvh7",
|
|
||||||
"kubernetes.io/metadata.name": "cattle-system"
|
|
||||||
},
|
|
||||||
"name": "cattle-system",
|
|
||||||
"resourceVersion": "4398991",
|
|
||||||
"uid": "bc99e08c-67a1-40ed-8106-9cc109e2f6a1"
|
|
||||||
},
|
|
||||||
"spec": {},
|
|
||||||
"status": {
|
|
||||||
"conditions": [
|
|
||||||
{
|
|
||||||
"lastTransitionTime": "2024-10-14T01:54:50Z",
|
|
||||||
"message": "All resources successfully discovered",
|
|
||||||
"reason": "ResourcesDiscovered",
|
|
||||||
"status": "False",
|
|
||||||
"type": "NamespaceDeletionDiscoveryFailure"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"lastTransitionTime": "2024-10-14T01:54:50Z",
|
|
||||||
"message": "All legacy kube types successfully parsed",
|
|
||||||
"reason": "ParsedGroupVersions",
|
|
||||||
"status": "False",
|
|
||||||
"type": "NamespaceDeletionGroupVersionParsingFailure"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"lastTransitionTime": "2024-10-14T01:54:50Z",
|
|
||||||
"message": "All content successfully deleted, may be waiting on finalization",
|
|
||||||
"reason": "ContentDeleted",
|
|
||||||
"status": "False",
|
|
||||||
"type": "NamespaceDeletionContentFailure"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"lastTransitionTime": "2024-10-14T01:54:50Z",
|
|
||||||
"message": "All content successfully removed",
|
|
||||||
"reason": "ContentRemoved",
|
|
||||||
"status": "False",
|
|
||||||
"type": "NamespaceContentRemaining"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"lastTransitionTime": "2024-10-14T01:54:50Z",
|
|
||||||
"message": "All content-preserving finalizers finished",
|
|
||||||
"reason": "ContentHasNoFinalizers",
|
|
||||||
"status": "False",
|
|
||||||
"type": "NamespaceFinalizersRemaining"
|
|
||||||
}
|
|
||||||
],
|
|
||||||
"phase": "Terminating"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,31 +0,0 @@
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: ing-rancher
|
|
||||||
namespace: cattle-system
|
|
||||||
labels:
|
|
||||||
app: release-name-rancher
|
|
||||||
release: release-name
|
|
||||||
annotations:
|
|
||||||
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
|
|
||||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
|
|
||||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
|
|
||||||
spec:
|
|
||||||
ingressClassName: nginx
|
|
||||||
rules:
|
|
||||||
- host: rancher.inje-private.com # hostname to access rancher server
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- backend:
|
|
||||||
service:
|
|
||||||
name: rancher
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
pathType: ImplementationSpecific
|
|
||||||
path: /
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- rancher.inje-private.com
|
|
||||||
secretName: cattle-ssl
|
|
||||||
|
|
||||||
|
|
||||||
Binary file not shown.
|
|
@ -1,94 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
set -e
|
|
||||||
|
|
||||||
namespaces="${NAMESPACES}"
|
|
||||||
rancher_namespace="${RANCHER_NAMESPACE}"
|
|
||||||
timeout="${TIMEOUT}"
|
|
||||||
ignoreTimeoutError="${IGNORETIMEOUTERROR}"
|
|
||||||
|
|
||||||
if [[ -z ${namespaces} ]]; then
|
|
||||||
echo "No namespace is provided."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z ${rancher_namespace} ]]; then
|
|
||||||
echo "No rancher namespace is provided."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z ${timeout} ]]; then
|
|
||||||
echo "No timeout value is provided."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ -z ${ignoreTimeoutError} ]]; then
|
|
||||||
echo "No ignoreTimeoutError value is provided."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
succeeded=()
|
|
||||||
failed=()
|
|
||||||
|
|
||||||
get_pod_count() {
|
|
||||||
kubectl get pods --selector app="${1}" -n "${2}" -o json | jq '.items | length'
|
|
||||||
}
|
|
||||||
|
|
||||||
echo "Uninstalling Rancher resources in the following namespaces: ${namespaces}"
|
|
||||||
|
|
||||||
for namespace in ${namespaces}; do
|
|
||||||
for app in $(helm list -n "${namespace}" -q); do
|
|
||||||
if [[ ${app} =~ .crd$ ]]; then
|
|
||||||
echo "--- Skip the app [${app}] in the namespace [${namespace}]"
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
echo "--- Deleting the app [${app}] in the namespace [${namespace}]"
|
|
||||||
if [[ ! $(helm uninstall "${app}" -n "${namespace}") ]]; then
|
|
||||||
failed=("${failed[@]}" "${app}")
|
|
||||||
continue
|
|
||||||
fi
|
|
||||||
|
|
||||||
t=0
|
|
||||||
while true; do
|
|
||||||
if [[ $(get_pod_count "${app}" "${namespace}") -eq 0 ]]; then
|
|
||||||
echo "successfully uninstalled [${app}] in the namespace [${namespace}]"
|
|
||||||
succeeded=("${succeeded[@]}" "${app}")
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
if [[ ${t} -ge ${timeout} ]]; then
|
|
||||||
echo "timeout uninstalling [${app}] in the namespace [${namespace}]"
|
|
||||||
failed=("${failed[@]}" "${app}")
|
|
||||||
break
|
|
||||||
fi
|
|
||||||
# by default, wait 120 seconds in total for an app to be uninstalled
|
|
||||||
echo "waiting 5 seconds for pods of [${app}] to be terminated ..."
|
|
||||||
sleep 5
|
|
||||||
t=$((t + 5))
|
|
||||||
done
|
|
||||||
done
|
|
||||||
|
|
||||||
# delete the helm operator pods
|
|
||||||
for pod in $(kubectl get pods -n "${namespace}" -o name); do
|
|
||||||
if [[ ${pod} =~ ^pod\/helm-operation-* ]]; then
|
|
||||||
echo "--- Deleting the pod [${pod}] in the namespace [${namespace}]"
|
|
||||||
kubectl delete "${pod}" -n "${namespace}"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
done
|
|
||||||
|
|
||||||
echo "Removing Rancher bootstrap secret in the following namespace: ${rancher_namespace}"
|
|
||||||
kubectl --ignore-not-found=true delete secret bootstrap-secret -n "${rancher_namespace}"
|
|
||||||
|
|
||||||
echo "------ Summary ------"
|
|
||||||
if [[ ${#succeeded[@]} -ne 0 ]]; then
|
|
||||||
echo "Succeeded to uninstall the following apps:" "${succeeded[@]}"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ ${#failed[@]} -ne 0 ]]; then
|
|
||||||
echo "Failed to uninstall the following apps:" "${failed[@]}"
|
|
||||||
if [[ "${ignoreTimeoutError}" == "false" ]]; then
|
|
||||||
exit 2
|
|
||||||
fi
|
|
||||||
else
|
|
||||||
echo "Cleanup finished successfully."
|
|
||||||
fi
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
Rancher Server has been installed.
|
|
||||||
|
|
||||||
NOTE: Rancher may take several minutes to fully initialize. Please standby while Certificates are being issued, Containers are started and the Ingress rule comes up.
|
|
||||||
|
|
||||||
Check out our docs at https://rancher.com/docs/
|
|
||||||
|
|
||||||
If you provided your own bootstrap password during installation, browse to https://{{ .Values.hostname }} to get started.
|
|
||||||
|
|
||||||
If this is the first time you installed Rancher, get started by running this command and clicking the URL it generates:
|
|
||||||
|
|
||||||
```
|
|
||||||
echo https://{{ .Values.hostname }}/dashboard/?setup=$(kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}')
|
|
||||||
```
|
|
||||||
|
|
||||||
To get just the bootstrap password on its own, run:
|
|
||||||
|
|
||||||
```
|
|
||||||
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}{{ "{{" }} "\n" {{ "}}" }}'
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|
||||||
Happy Containering!
|
|
||||||
|
|
@ -1,76 +0,0 @@
|
||||||
{{/* vim: set filetype=mustache: */}}
|
|
||||||
{{/*
|
|
||||||
Expand the name of the chart.
|
|
||||||
*/}}
|
|
||||||
{{- define "rancher.name" -}}
|
|
||||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create a default fully qualified app name.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
*/}}
|
|
||||||
{{- define "rancher.fullname" -}}
|
|
||||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
|
||||||
{{- if contains $name .Release.Name -}}
|
|
||||||
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Create a default fully qualified chart name.
|
|
||||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
|
||||||
*/}}
|
|
||||||
{{- define "rancher.chartname" -}}
|
|
||||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | trunc 63 | trimSuffix "-" -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
# Render Values in configurationSnippet
|
|
||||||
{{- define "configurationSnippet" -}}
|
|
||||||
{{- tpl (.Values.ingress.configurationSnippet) . | nindent 6 -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Generate the labels.
|
|
||||||
*/}}
|
|
||||||
{{- define "rancher.labels" -}}
|
|
||||||
app: {{ template "rancher.fullname" . }}
|
|
||||||
chart: {{ template "rancher.chartname" . }}
|
|
||||||
heritage: {{ .Release.Service }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
||||||
# Windows Support
|
|
||||||
|
|
||||||
{{/*
|
|
||||||
Windows cluster will add default taint for linux nodes,
|
|
||||||
add below linux tolerations to workloads could be scheduled to those linux nodes
|
|
||||||
*/}}
|
|
||||||
|
|
||||||
{{- define "linux-node-tolerations" -}}
|
|
||||||
- key: "cattle.io/os"
|
|
||||||
value: "linux"
|
|
||||||
effect: "NoSchedule"
|
|
||||||
operator: "Equal"
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "linux-node-selector-terms" -}}
|
|
||||||
{{- $key := "kubernetes.io/os" -}}
|
|
||||||
- matchExpressions:
|
|
||||||
- key: {{ $key }}
|
|
||||||
operator: NotIn
|
|
||||||
values:
|
|
||||||
- windows
|
|
||||||
{{- end -}}
|
|
||||||
|
|
||||||
{{- define "system_default_registry" -}}
|
|
||||||
{{- if .Values.systemDefaultRegistry -}}
|
|
||||||
{{- if hasSuffix "/" .Values.systemDefaultRegistry -}}
|
|
||||||
{{- printf "%s" .Values.systemDefaultRegistry -}}
|
|
||||||
{{- else -}}
|
|
||||||
{{- printf "%s/" .Values.systemDefaultRegistry -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
kind: ClusterRoleBinding
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{ include "rancher.labels" . | indent 4 }}
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
roleRef:
|
|
||||||
kind: ClusterRole
|
|
||||||
name: cluster-admin
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: rancher-config
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
||||||
app.kubernetes.io/part-of: "rancher"
|
|
||||||
data:
|
|
||||||
priorityClassName: {{ .Values.priorityClassName }}
|
|
||||||
{{- if and .Values.webhook (kindIs "string" .Values.webhook) }}
|
|
||||||
rancher-webhook: {{ .Values.webhook | quote }}
|
|
||||||
{{- else if .Values.webhook }}
|
|
||||||
rancher-webhook: {{ toYaml .Values.webhook | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if and .Values.fleet (kindIs "string" .Values.fleet) }}
|
|
||||||
fleet: {{ .Values.fleet | quote }}
|
|
||||||
{{- else if .Values.fleet }}
|
|
||||||
fleet: {{ toYaml .Values.fleet | quote }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,264 +0,0 @@
|
||||||
kind: Deployment
|
|
||||||
apiVersion: apps/v1
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
annotations:
|
|
||||||
{{- if (lt (int .Values.replicas) 0) }}
|
|
||||||
management.cattle.io/scale-available: "{{ sub 0 (int .Values.replicas)}}"
|
|
||||||
{{- end }}
|
|
||||||
labels:
|
|
||||||
{{ include "rancher.labels" . | indent 4 }}
|
|
||||||
spec:
|
|
||||||
{{- if (gt (int .Values.replicas) 0) }}
|
|
||||||
replicas: {{ .Values.replicas }}
|
|
||||||
{{- end }}
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: {{ template "rancher.fullname" . }}
|
|
||||||
strategy:
|
|
||||||
rollingUpdate:
|
|
||||||
maxSurge: 1
|
|
||||||
{{- if (eq (int .Values.replicas) 1) }}
|
|
||||||
maxUnavailable: 0
|
|
||||||
{{- else }}
|
|
||||||
maxUnavailable: 1
|
|
||||||
{{- end }}
|
|
||||||
type: RollingUpdate
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: {{ template "rancher.fullname" . }}
|
|
||||||
release: {{ .Release.Name }}
|
|
||||||
spec:
|
|
||||||
priorityClassName: {{ .Values.priorityClassName }}
|
|
||||||
serviceAccountName: {{ template "rancher.fullname" . }}
|
|
||||||
{{- if .Values.imagePullSecrets }}
|
|
||||||
imagePullSecrets:
|
|
||||||
{{ toYaml .Values.imagePullSecrets | indent 6 }}
|
|
||||||
{{- end }}
|
|
||||||
affinity:
|
|
||||||
podAntiAffinity:
|
|
||||||
{{- if eq .Values.antiAffinity "required" }}
|
|
||||||
requiredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- labelSelector:
|
|
||||||
matchExpressions:
|
|
||||||
- key: app
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
- {{ template "rancher.fullname" . }}
|
|
||||||
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
|
|
||||||
{{- else }}
|
|
||||||
preferredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
- weight: 100
|
|
||||||
podAffinityTerm:
|
|
||||||
labelSelector:
|
|
||||||
matchExpressions:
|
|
||||||
- key: app
|
|
||||||
operator: In
|
|
||||||
values:
|
|
||||||
- {{ template "rancher.fullname" . }}
|
|
||||||
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
|
|
||||||
{{- end }}
|
|
||||||
nodeAffinity:
|
|
||||||
requiredDuringSchedulingIgnoredDuringExecution:
|
|
||||||
nodeSelectorTerms: {{ include "linux-node-selector-terms" . | nindent 14 }}
|
|
||||||
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
|
|
||||||
containers:
|
|
||||||
- image: {{ .Values.rancherImage }}:{{ default .Chart.AppVersion .Values.rancherImageTag }}
|
|
||||||
imagePullPolicy: {{ default "IfNotPresent" .Values.rancherImagePullPolicy }}
|
|
||||||
name: {{ template "rancher.name" . }}
|
|
||||||
ports:
|
|
||||||
- containerPort: 80
|
|
||||||
protocol: TCP
|
|
||||||
{{- if (and .Values.hostPort (gt (int .Values.hostPort) 0)) }}
|
|
||||||
- containerPort: 444
|
|
||||||
hostPort: {{ int .Values.hostPort }}
|
|
||||||
protocol: TCP
|
|
||||||
{{- end}}
|
|
||||||
args:
|
|
||||||
{{- if .Values.debug }}
|
|
||||||
- "--debug"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.privateCA }}
|
|
||||||
# Private CA - don't clear ca certs
|
|
||||||
{{- else if and (eq .Values.tls "ingress") (eq .Values.ingress.tls.source "rancher") }}
|
|
||||||
# Rancher self-signed - don't clear ca certs
|
|
||||||
{{- else }}
|
|
||||||
# Public trusted CA - clear ca certs
|
|
||||||
- "--no-cacerts"
|
|
||||||
{{- end }}
|
|
||||||
- "--http-listen-port=80"
|
|
||||||
- "--https-listen-port=443"
|
|
||||||
- "--add-local={{ .Values.addLocal }}"
|
|
||||||
env:
|
|
||||||
- name: CATTLE_NAMESPACE
|
|
||||||
value: {{ .Release.Namespace }}
|
|
||||||
- name: CATTLE_PEER_SERVICE
|
|
||||||
value: {{ template "rancher.fullname" . }}
|
|
||||||
{{- if .Values.features }}
|
|
||||||
- name: CATTLE_FEATURES
|
|
||||||
value: "{{ .Values.features }}"
|
|
||||||
{{- end}}
|
|
||||||
{{- if .Values.noDefaultAdmin }}
|
|
||||||
- name: CATTLE_NO_DEFAULT_ADMIN
|
|
||||||
value: "{{ .Values.noDefaultAdmin }}"
|
|
||||||
{{- end}}
|
|
||||||
{{- if gt (int .Values.auditLog.level) 0 }}
|
|
||||||
- name: AUDIT_LEVEL
|
|
||||||
value: {{ .Values.auditLog.level | quote }}
|
|
||||||
- name: AUDIT_LOG_MAXAGE
|
|
||||||
value: {{ .Values.auditLog.maxAge | quote }}
|
|
||||||
- name: AUDIT_LOG_MAXBACKUP
|
|
||||||
value: {{ .Values.auditLog.maxBackup | quote }}
|
|
||||||
- name: AUDIT_LOG_MAXSIZE
|
|
||||||
value: {{ .Values.auditLog.maxSize | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.proxy }}
|
|
||||||
- name: HTTP_PROXY
|
|
||||||
value: {{ .Values.proxy }}
|
|
||||||
- name: HTTPS_PROXY
|
|
||||||
value: {{ .Values.proxy }}
|
|
||||||
- name: NO_PROXY
|
|
||||||
value: {{ .Values.noProxy }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.systemDefaultRegistry }}
|
|
||||||
- name: CATTLE_SYSTEM_DEFAULT_REGISTRY
|
|
||||||
value: {{ .Values.systemDefaultRegistry }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.useBundledSystemChart }}
|
|
||||||
- name: CATTLE_SYSTEM_CATALOG
|
|
||||||
value: bundled
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.restrictedAdmin }}
|
|
||||||
- name: CATTLE_RESTRICTED_DEFAULT_ADMIN
|
|
||||||
value: "true"
|
|
||||||
{{- end}}
|
|
||||||
{{- if .Values.bootstrapPassword }}
|
|
||||||
- name: CATTLE_BOOTSTRAP_PASSWORD
|
|
||||||
valueFrom:
|
|
||||||
secretKeyRef:
|
|
||||||
name: "bootstrap-secret"
|
|
||||||
key: "bootstrapPassword"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.agentTLSMode }}
|
|
||||||
- name: CATTLE_AGENT_TLS_MODE
|
|
||||||
value: "{{ .Values.agentTLSMode }}"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.extraEnv }}
|
|
||||||
{{ toYaml .Values.extraEnv | indent 8}}
|
|
||||||
{{- end }}
|
|
||||||
startupProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /healthz
|
|
||||||
port: 80
|
|
||||||
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
|
|
||||||
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
|
|
||||||
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
|
|
||||||
livenessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /healthz
|
|
||||||
port: 80
|
|
||||||
{{- with .Values.livenessProbe.initialDelaySeconds}}
|
|
||||||
initialDelaySeconds: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
timeoutSeconds: {{.Values.livenessProbe.timeoutSeconds }}
|
|
||||||
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
|
||||||
failureThreshold: {{.Values.livenessProbe.failureThreshold }}
|
|
||||||
readinessProbe:
|
|
||||||
httpGet:
|
|
||||||
path: /healthz
|
|
||||||
port: 80
|
|
||||||
{{- with .Values.readinessProbe.initialDelaySeconds}}
|
|
||||||
initialDelaySeconds: {{ . }}
|
|
||||||
{{- end }}
|
|
||||||
timeoutSeconds: {{.Values.readinessProbe.timeoutSeconds }}
|
|
||||||
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
|
||||||
failureThreshold: {{.Values.readinessProbe.failureThreshold }}
|
|
||||||
resources:
|
|
||||||
{{ toYaml .Values.resources | indent 10 }}
|
|
||||||
volumeMounts:
|
|
||||||
{{- if .Values.additionalTrustedCAs }}
|
|
||||||
- mountPath: /etc/pki/trust/anchors/ca-additional.pem
|
|
||||||
name: tls-ca-additional-volume
|
|
||||||
subPath: ca-additional.pem
|
|
||||||
readOnly: true
|
|
||||||
- mountPath: /etc/rancher/ssl/ca-additional.pem
|
|
||||||
name: tls-ca-additional-volume
|
|
||||||
subPath: ca-additional.pem
|
|
||||||
readOnly: true
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.privateCA }}
|
|
||||||
# Pass CA cert into rancher for private CA
|
|
||||||
- mountPath: /etc/rancher/ssl/cacerts.pem
|
|
||||||
name: tls-ca-volume
|
|
||||||
subPath: cacerts.pem
|
|
||||||
readOnly: true
|
|
||||||
{{- end }}
|
|
||||||
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
|
|
||||||
# Mount rancher custom-logos volume
|
|
||||||
- mountPath: /usr/share/rancher/ui/assets/images/logos
|
|
||||||
name: custom-logos
|
|
||||||
subPath: {{ .Values.customLogos.volumeSubpaths.emberUi | default "ember" | quote }}
|
|
||||||
- mountPath: /usr/share/rancher/ui-dashboard/dashboard/_nuxt/assets/images/pl
|
|
||||||
name: custom-logos
|
|
||||||
subPath: {{ .Values.customLogos.volumeSubpaths.vueUi | default "vue" | quote }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if gt (int .Values.auditLog.level) 0 }}
|
|
||||||
- mountPath: /var/log/auditlog
|
|
||||||
name: audit-log
|
|
||||||
{{- end }}
|
|
||||||
{{- if eq .Values.auditLog.destination "sidecar" }}
|
|
||||||
{{- if gt (int .Values.auditLog.level) 0 }}
|
|
||||||
# Make audit logs available for Rancher log collector tools.
|
|
||||||
{{- if .Values.busyboxImage }}
|
|
||||||
- image: {{ .Values.busyboxImage}}
|
|
||||||
{{- else }}
|
|
||||||
- image: {{ .Values.auditLog.image.repository }}:{{.Values.auditLog.image.tag}}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.busyboxImagePullPolicy }}
|
|
||||||
imagePullPolicy: {{ .Values.busyboxImagePullPolicy }}
|
|
||||||
{{- else }}
|
|
||||||
imagePullPolicy: {{ .Values.auditLog.image.pullPolicy }}
|
|
||||||
{{- end }}
|
|
||||||
name: {{ template "rancher.name" . }}-audit-log
|
|
||||||
command: ["tail"]
|
|
||||||
args: ["-F", "/var/log/auditlog/rancher-api-audit.log"]
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/log/auditlog
|
|
||||||
name: audit-log
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
volumes:
|
|
||||||
{{- if .Values.additionalTrustedCAs }}
|
|
||||||
- name: tls-ca-additional-volume
|
|
||||||
secret:
|
|
||||||
defaultMode: 0400
|
|
||||||
secretName: tls-ca-additional
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.privateCA }}
|
|
||||||
- name: tls-ca-volume
|
|
||||||
secret:
|
|
||||||
defaultMode: 0400
|
|
||||||
secretName: tls-ca
|
|
||||||
{{- end }}
|
|
||||||
{{- if gt (int .Values.auditLog.level) 0 }}
|
|
||||||
{{- if eq .Values.auditLog.destination "hostPath" }}
|
|
||||||
- name: audit-log
|
|
||||||
hostPath:
|
|
||||||
path: {{ .Values.auditLog.hostPath }}
|
|
||||||
type: DirectoryOrCreate
|
|
||||||
{{- else }}
|
|
||||||
- name: audit-log
|
|
||||||
emptyDir: {}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
|
|
||||||
- name: custom-logos
|
|
||||||
{{- if (eq .Values.customLogos.volumeKind "persistentVolumeClaim") }}
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: {{ .Values.customLogos.volumeName | default (printf "%s-custom-logos" (include "rancher.fullname" .)) }}
|
|
||||||
{{- else if (eq .Values.customLogos.volumeKind "configMap") }}
|
|
||||||
configMap:
|
|
||||||
name: {{ .Values.customLogos.volumeName }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,66 +0,0 @@
|
||||||
{{- if .Values.ingress.enabled }}
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
{{- else }}
|
|
||||||
apiVersion: networking.k8s.io/v1beta1
|
|
||||||
{{- end }}
|
|
||||||
kind: Ingress
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{ include "rancher.labels" . | indent 4 }}
|
|
||||||
annotations:
|
|
||||||
{{- if .Values.ingress.configurationSnippet }}
|
|
||||||
nginx.ingress.kubernetes.io/configuration-snippet: |
|
|
||||||
{{- template "configurationSnippet" . }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if eq .Values.tls "external" }}
|
|
||||||
nginx.ingress.kubernetes.io/ssl-redirect: "false" # turn off ssl redirect for external.
|
|
||||||
{{- else }}
|
|
||||||
{{- if ne .Values.ingress.tls.source "secret" }}
|
|
||||||
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
|
|
||||||
certmanager.k8s.io/issuer: {{ template "rancher.fullname" . }}
|
|
||||||
{{- else }}
|
|
||||||
cert-manager.io/issuer: {{ template "rancher.fullname" . }}
|
|
||||||
cert-manager.io/issuer-kind: Issuer
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.ingress.includeDefaultExtraAnnotations }}
|
|
||||||
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
|
|
||||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
|
|
||||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
|
|
||||||
{{- end }}
|
|
||||||
{{- if .Values.ingress.extraAnnotations }}
|
|
||||||
{{ toYaml .Values.ingress.extraAnnotations | indent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
spec:
|
|
||||||
{{- if .Values.ingress.ingressClassName }}
|
|
||||||
ingressClassName: {{ .Values.ingress.ingressClassName }}
|
|
||||||
{{- end }}
|
|
||||||
rules:
|
|
||||||
- host: {{ .Values.hostname }} # hostname to access rancher server
|
|
||||||
http:
|
|
||||||
paths:
|
|
||||||
- backend:
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
|
|
||||||
service:
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
port:
|
|
||||||
number: {{ .Values.ingress.servicePort }}
|
|
||||||
{{- else }}
|
|
||||||
serviceName: {{ template "rancher.fullname" . }}
|
|
||||||
servicePort: {{ .Values.ingress.servicePort }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
|
|
||||||
pathType: {{ .Values.ingress.pathType }}
|
|
||||||
path: {{ .Values.ingress.path }}
|
|
||||||
{{- end }}
|
|
||||||
{{- if eq .Values.tls "ingress" }}
|
|
||||||
tls:
|
|
||||||
- hosts:
|
|
||||||
- {{ .Values.hostname }}
|
|
||||||
secretName: {{ .Values.ingress.tls.secretName }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
{{- if eq .Values.tls "ingress" -}}
|
|
||||||
{{- if eq .Values.ingress.tls.source "letsEncrypt" -}}
|
|
||||||
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
|
|
||||||
apiVersion: cert-manager.io/v1beta1
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: cert-manager.io/v1alpha2
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: certmanager.k8s.io/v1alpha1
|
|
||||||
{{- else }}
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
{{- end }}
|
|
||||||
kind: Issuer
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{ include "rancher.labels" . | indent 4 }}
|
|
||||||
spec:
|
|
||||||
acme:
|
|
||||||
{{- if eq .Values.letsEncrypt.environment "production" }}
|
|
||||||
server: https://acme-v02.api.letsencrypt.org/directory
|
|
||||||
{{- else }}
|
|
||||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
|
||||||
{{- end }}
|
|
||||||
email: {{ .Values.letsEncrypt.email }}
|
|
||||||
privateKeySecretRef:
|
|
||||||
name: letsencrypt-{{ .Values.letsEncrypt.environment }}
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
|
|
||||||
http01: {}
|
|
||||||
{{- else }}
|
|
||||||
solvers:
|
|
||||||
- http01:
|
|
||||||
ingress:
|
|
||||||
class: {{ .Values.letsEncrypt.ingress.class }}
|
|
||||||
{{- end }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
{{- if eq .Values.tls "ingress" -}}
|
|
||||||
{{- if eq .Values.ingress.tls.source "rancher" -}}
|
|
||||||
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
|
|
||||||
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
|
|
||||||
apiVersion: cert-manager.io/v1beta1
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: cert-manager.io/v1alpha2
|
|
||||||
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
|
|
||||||
apiVersion: certmanager.k8s.io/v1alpha1
|
|
||||||
{{- else }}
|
|
||||||
apiVersion: cert-manager.io/v1
|
|
||||||
{{- end }}
|
|
||||||
kind: Issuer
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{ include "rancher.labels" . | indent 4 }}
|
|
||||||
spec:
|
|
||||||
ca:
|
|
||||||
secretName: tls-rancher
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
{{- if .Values.postDelete.enabled }}
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
"helm.sh/hook": post-delete
|
|
||||||
"helm.sh/hook-weight": "2"
|
|
||||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
|
|
||||||
roleRef:
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
kind: ClusterRole
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,39 +0,0 @@
|
||||||
{{- if .Values.postDelete.enabled }}
|
|
||||||
kind: ClusterRole
|
|
||||||
apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
"helm.sh/hook": post-delete
|
|
||||||
"helm.sh/hook-weight": "1"
|
|
||||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
|
|
||||||
rules:
|
|
||||||
- apiGroups: [ "extensions","apps" ]
|
|
||||||
resources: [ "deployments" ]
|
|
||||||
verbs: [ "get", "list", "delete" ]
|
|
||||||
- apiGroups: [ "batch" ]
|
|
||||||
resources: [ "jobs" ]
|
|
||||||
verbs: [ "get", "list", "watch", "delete", "create" ]
|
|
||||||
- apiGroups: [ "rbac.authorization.k8s.io" ]
|
|
||||||
resources: [ "clusterroles", "clusterrolebindings", "roles", "rolebindings" ]
|
|
||||||
verbs: [ "get", "list", "delete", "create" ]
|
|
||||||
- apiGroups: [ "" ]
|
|
||||||
resources: [ "pods", "secrets", "services", "configmaps" ]
|
|
||||||
verbs: [ "get", "list", "delete" ]
|
|
||||||
- apiGroups: [ "" ]
|
|
||||||
resources: [ "serviceaccounts" ]
|
|
||||||
verbs: [ "get", "list", "delete", "create" ]
|
|
||||||
- apiGroups: [ "networking.k8s.io" ]
|
|
||||||
resources: [ "networkpolicies" ]
|
|
||||||
verbs: [ "get", "list", "delete" ]
|
|
||||||
- apiGroups: [ "admissionregistration.k8s.io" ]
|
|
||||||
resources: [ "validatingwebhookconfigurations", "mutatingwebhookconfigurations" ]
|
|
||||||
verbs: [ "get", "list", "delete" ]
|
|
||||||
- apiGroups: [ "networking.k8s.io" ]
|
|
||||||
resources: [ "ingresses" ]
|
|
||||||
verbs: [ "delete" ]
|
|
||||||
- apiGroups: [ "cert-manager.io" ]
|
|
||||||
resources: [ "issuers" ]
|
|
||||||
verbs: [ "delete" ]
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
{{- if .Values.postDelete.enabled }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
"helm.sh/hook": post-delete
|
|
||||||
"helm.sh/hook-weight": "1"
|
|
||||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
|
|
||||||
data:
|
|
||||||
post-delete-hook.sh: |-
|
|
||||||
{{ $.Files.Get "scripts/post-delete-hook.sh" | indent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,46 +0,0 @@
|
||||||
{{- if .Values.postDelete.enabled }}
|
|
||||||
apiVersion: batch/v1
|
|
||||||
kind: Job
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
"helm.sh/hook": post-delete
|
|
||||||
"helm.sh/hook-weight": "3"
|
|
||||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
||||||
spec:
|
|
||||||
backoffLimit: 3
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 8 }}
|
|
||||||
spec:
|
|
||||||
serviceAccountName: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
restartPolicy: OnFailure
|
|
||||||
containers:
|
|
||||||
- name: {{ template "rancher.name" . }}-post-delete
|
|
||||||
image: "{{ include "system_default_registry" . }}{{ .Values.postDelete.image.repository }}:{{ .Values.postDelete.image.tag }}"
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
securityContext:
|
|
||||||
runAsUser: 0
|
|
||||||
command:
|
|
||||||
- /scripts/post-delete-hook.sh
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /scripts
|
|
||||||
name: config-volume
|
|
||||||
env:
|
|
||||||
- name: NAMESPACES
|
|
||||||
value: {{ .Values.postDelete.namespaceList | join " " | quote }}
|
|
||||||
- name: RANCHER_NAMESPACE
|
|
||||||
value: {{ .Release.Namespace }}
|
|
||||||
- name: TIMEOUT
|
|
||||||
value: {{ .Values.postDelete.timeout | quote }}
|
|
||||||
- name: IGNORETIMEOUTERROR
|
|
||||||
value: {{ .Values.postDelete.ignoreTimeoutError | quote }}
|
|
||||||
volumes:
|
|
||||||
- name: config-volume
|
|
||||||
configMap:
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
defaultMode: 0777
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
{{- if .Values.postDelete.enabled }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}-post-delete
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
||||||
annotations:
|
|
||||||
"helm.sh/hook": post-delete
|
|
||||||
"helm.sh/hook-weight": "1"
|
|
||||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,8 +0,0 @@
|
||||||
apiVersion: scheduling.k8s.io/v1
|
|
||||||
kind: PriorityClass
|
|
||||||
metadata:
|
|
||||||
name: rancher-critical
|
|
||||||
labels: {{ include "rancher.labels" . | nindent 4 }}
|
|
||||||
value: 1000000000
|
|
||||||
globalDefault: false
|
|
||||||
description: "Priority class used by pods critical to rancher's functionality."
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
{{- if and (.Values.customLogos.enabled) (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (not .Values.customLogos.volumeName) }}
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
apiVersion: v1
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}-custom-logos
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- {{ .Values.customLogos.accessMode | quote }}
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: {{ .Values.customLogos.size | quote }}
|
|
||||||
storageClassName: {{ if .Values.customLogos.storageClass }}
|
|
||||||
{{- if (eq "-" .Values.customLogos.storageClass) -}}
|
|
||||||
""
|
|
||||||
{{- else }}
|
|
||||||
{{- .Values.customLogos.storageClass }}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,25 +0,0 @@
|
||||||
{{/* Use the bootstrap password from values.yaml if an existing secret is not found */}}
|
|
||||||
{{- $bootstrapPassword := .Values.bootstrapPassword -}}
|
|
||||||
{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace "bootstrap-secret" -}}
|
|
||||||
{{- if $existingSecret -}}
|
|
||||||
{{- if $existingSecret.data -}}
|
|
||||||
{{- if $existingSecret.data.bootstrapPassword -}}
|
|
||||||
{{- $bootstrapPassword = $existingSecret.data.bootstrapPassword | b64dec -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{- end -}}
|
|
||||||
{{/* If a bootstrap password was found in the values or an existing password was found create the secret */}}
|
|
||||||
{{- if $bootstrapPassword }}
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Secret
|
|
||||||
metadata:
|
|
||||||
name: "bootstrap-secret"
|
|
||||||
namespace: {{ .Release.Namespace }}
|
|
||||||
annotations:
|
|
||||||
"helm.sh/hook": pre-install,pre-upgrade
|
|
||||||
"helm.sh/hook-weight": "-5"
|
|
||||||
"helm.sh/resource-policy": keep
|
|
||||||
type: Opaque
|
|
||||||
data:
|
|
||||||
bootstrapPassword: {{ $bootstrapPassword | b64enc | quote }}
|
|
||||||
{{- end }}
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
{{- if .Values.service.annotations }}
|
|
||||||
annotations:
|
|
||||||
{{ toYaml .Values.service.annotations | indent 4 }}
|
|
||||||
{{- end }}
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{ include "rancher.labels" . | indent 4 }}
|
|
||||||
spec:
|
|
||||||
{{- /*
|
|
||||||
If service.type is not provided this attribute is ommitted and k8s default of ClusterIP is used.
|
|
||||||
*/}}
|
|
||||||
{{- if .Values.service.type }}
|
|
||||||
type: {{ .Values.service.type }}
|
|
||||||
{{- end }}
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
targetPort: 80
|
|
||||||
protocol: TCP
|
|
||||||
name: http
|
|
||||||
- port: 443
|
|
||||||
targetPort: 444
|
|
||||||
protocol: TCP
|
|
||||||
name: https-internal
|
|
||||||
selector:
|
|
||||||
app: {{ template "rancher.fullname" . }}
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
kind: ServiceAccount
|
|
||||||
apiVersion: v1
|
|
||||||
metadata:
|
|
||||||
name: {{ template "rancher.fullname" . }}
|
|
||||||
labels:
|
|
||||||
{{ include "rancher.labels" . | indent 4 }}
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
{
|
|
||||||
"$schema": "https://json-schema.org/draft-07/schema#",
|
|
||||||
"properties": {
|
|
||||||
"agentTLSMode": {
|
|
||||||
"type": ["string", "null"],
|
|
||||||
"enum": ["strict", "system-store", "", null],
|
|
||||||
"description": "agentTLSMode must be 'strict' or 'system-store' or null (defaults to system-store)"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"required": [],
|
|
||||||
"title": "Rancher Chart Values",
|
|
||||||
"type": "object"
|
|
||||||
}
|
|
||||||
|
|
@ -1,199 +0,0 @@
|
||||||
# Additional Trusted CAs.
|
|
||||||
# Enable this flag and add your CA certs as a secret named tls-ca-additional in the namespace.
|
|
||||||
# See README.md for details.
|
|
||||||
additionalTrustedCAs: false
|
|
||||||
|
|
||||||
antiAffinity: preferred
|
|
||||||
topologyKey: kubernetes.io/hostname
|
|
||||||
|
|
||||||
# Audit Logs https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
|
|
||||||
# The audit log is piped to the console of the rancher-audit-log container in the rancher pod.
|
|
||||||
# https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
|
|
||||||
# destination stream to sidecar container console or hostPath volume
|
|
||||||
# level: Verbosity of logs, 0 to 3. 0 is off 3 is a lot.
|
|
||||||
auditLog:
|
|
||||||
destination: sidecar
|
|
||||||
hostPath: /var/log/rancher/audit/
|
|
||||||
level: 0
|
|
||||||
maxAge: 1
|
|
||||||
maxBackup: 1
|
|
||||||
maxSize: 100
|
|
||||||
|
|
||||||
# Image for collecting rancher audit logs.
|
|
||||||
# Important: update pkg/image/export/resolve.go when this default image is changed, so that it's reflected accordingly in rancher-images.txt generated for air-gapped setups.
|
|
||||||
image:
|
|
||||||
repository: "rancher/mirrored-bci-micro"
|
|
||||||
tag: 15.4.14.3
|
|
||||||
# Override imagePullPolicy image
|
|
||||||
# options: Always, Never, IfNotPresent
|
|
||||||
pullPolicy: "IfNotPresent"
|
|
||||||
|
|
||||||
# As of Rancher v2.5.0 this flag is deprecated and must be set to 'true' in order for Rancher to start
|
|
||||||
addLocal: "true"
|
|
||||||
|
|
||||||
# Add debug flag to Rancher server
|
|
||||||
debug: false
|
|
||||||
|
|
||||||
# When starting Rancher for the first time, bootstrap the admin as restricted-admin
|
|
||||||
restrictedAdmin: false
|
|
||||||
|
|
||||||
# Control how the Rancher agents validate TLS connections
|
|
||||||
# Valid options: strict, or system-store
|
|
||||||
# Note, for new installations empty will default to strict on 2.9+, or system-store on 2.8 or older
|
|
||||||
agentTLSMode: "system-store"
|
|
||||||
|
|
||||||
# Extra environment variables passed to the rancher pods.
|
|
||||||
# extraEnv:
|
|
||||||
# - name: CATTLE_TLS_MIN_VERSION
|
|
||||||
# value: "1.0"
|
|
||||||
|
|
||||||
# Fully qualified name to reach your Rancher server
|
|
||||||
hostname: rancher.inje-private.com
|
|
||||||
|
|
||||||
## Optional array of imagePullSecrets containing private registry credentials
|
|
||||||
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
|
||||||
imagePullSecrets: []
|
|
||||||
# - name: secretName
|
|
||||||
|
|
||||||
### ingress ###
|
|
||||||
# Readme for details and instruction on adding tls secrets.
|
|
||||||
ingress:
|
|
||||||
# If set to false, ingress will not be created
|
|
||||||
# Defaults to true
|
|
||||||
# options: true, false
|
|
||||||
enabled: false # by ljh true -> false
|
|
||||||
includeDefaultExtraAnnotations: true
|
|
||||||
extraAnnotations: {}
|
|
||||||
ingressClassName: ""
|
|
||||||
# Certain ingress controllers will require the pathType or path to be set to a different value.
|
|
||||||
pathType: ImplementationSpecific
|
|
||||||
path: "/"
|
|
||||||
# backend port number
|
|
||||||
servicePort: 80
|
|
||||||
|
|
||||||
# configurationSnippet - Add additional Nginx configuration. This example statically sets a header on the ingress.
|
|
||||||
# configurationSnippet: |
|
|
||||||
# more_set_input_headers "X-Forwarded-Host: {{ .Values.hostname }}";
|
|
||||||
|
|
||||||
tls:
|
|
||||||
# options: rancher, letsEncrypt, secret
|
|
||||||
source: rancher
|
|
||||||
secretName: tls-rancher-ingress
|
|
||||||
|
|
||||||
### service ###
|
|
||||||
# Override to use NodePort or LoadBalancer service type - default is ClusterIP
|
|
||||||
service:
|
|
||||||
type: ""
|
|
||||||
annotations: {}
|
|
||||||
|
|
||||||
### LetsEncrypt config ###
|
|
||||||
# ProTip: The production environment only allows you to register a name 5 times a week.
|
|
||||||
# Use staging until you have your config right.
|
|
||||||
letsEncrypt:
|
|
||||||
# email: none@example.com
|
|
||||||
environment: production
|
|
||||||
ingress:
|
|
||||||
# options: traefik, nginx
|
|
||||||
class: ""
|
|
||||||
# If you are using certs signed by a private CA set to 'true' and set the 'tls-ca'
|
|
||||||
# in the 'rancher-system' namespace. See the README.md for details
|
|
||||||
privateCA: true
|
|
||||||
|
|
||||||
# http[s] proxy server passed into rancher server.
|
|
||||||
# proxy: http://<username>@<password>:<url>:<port>
|
|
||||||
|
|
||||||
# comma separated list of domains or ip addresses that will not use the proxy
|
|
||||||
noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local
|
|
||||||
|
|
||||||
# Override rancher image location for Air Gap installs
|
|
||||||
rancherImage: reg.inje-private.com/nnd002/rancher/rancher #by ljh
|
|
||||||
# rancher/rancher image tag. https://hub.docker.com/r/rancher/rancher/tags/
|
|
||||||
# Defaults to .Chart.appVersion
|
|
||||||
# rancherImageTag: v2.0.7
|
|
||||||
|
|
||||||
# Override imagePullPolicy for rancher server images
|
|
||||||
# options: Always, Never, IfNotPresent
|
|
||||||
# Defaults to IfNotPresent
|
|
||||||
# rancherImagePullPolicy: <pullPolicy>
|
|
||||||
|
|
||||||
# Number of Rancher server replicas. Setting to negative number will dynamically between 0 and the abs(replicas) based on available nodes.
|
|
||||||
# of available nodes in the cluster
|
|
||||||
replicas: 3
|
|
||||||
|
|
||||||
# Set priorityClassName to avoid eviction
|
|
||||||
priorityClassName: rancher-critical
|
|
||||||
|
|
||||||
# Set pod resource requests/limits for Rancher.
|
|
||||||
resources: {}
|
|
||||||
|
|
||||||
#
|
|
||||||
# tls
|
|
||||||
# Where to offload the TLS/SSL encryption
|
|
||||||
# - ingress (default)
|
|
||||||
# - external
|
|
||||||
tls: external # by ljh
|
|
||||||
|
|
||||||
systemDefaultRegistry: "reg.inje-private.com/nnd002"
|
|
||||||
# Set to use the packaged system charts
|
|
||||||
#useBundledSystemChart: false
|
|
||||||
useBundledSystemChart: true
|
|
||||||
|
|
||||||
# Certmanager version compatibility
|
|
||||||
certmanager:
|
|
||||||
version: ""
|
|
||||||
|
|
||||||
# Rancher custom logos persistence
|
|
||||||
customLogos:
|
|
||||||
enabled: true # by ljh
|
|
||||||
volumeSubpaths:
|
|
||||||
emberUi: "ember"
|
|
||||||
vueUi: "vue"
|
|
||||||
## Volume kind to use for persistence: persistentVolumeClaim, configMap
|
|
||||||
volumeKind: persistentVolumeClaim
|
|
||||||
## Use an existing volume. Custom logos should be copied to the volume by the user
|
|
||||||
# volumeName: custom-logos
|
|
||||||
## Just for volumeKind: persistentVolumeClaim
|
|
||||||
## To disables dynamic provisioning, set storageClass: "" or storageClass: "-"
|
|
||||||
storageClass: "sc-monitoring" # by ljh
|
|
||||||
accessMode: ReadWriteOnce
|
|
||||||
size: 10Gi
|
|
||||||
|
|
||||||
# Rancher post-delete hook
|
|
||||||
postDelete:
|
|
||||||
enabled: true #by ljh
|
|
||||||
image:
|
|
||||||
repository: rancher/shell # by ljh add registry
|
|
||||||
tag: v0.2.1
|
|
||||||
namespaceList:
|
|
||||||
- cattle-fleet-system
|
|
||||||
- cattle-system
|
|
||||||
- rancher-operator-system
|
|
||||||
# Number of seconds to wait for an app to be uninstalled
|
|
||||||
timeout: 120
|
|
||||||
# by default, the job will fail if it fail to uninstall any of the apps
|
|
||||||
ignoreTimeoutError: false
|
|
||||||
|
|
||||||
# Set a bootstrap password. If leave empty, a random password will be generated.
|
|
||||||
bootstrapPassword: "coneijinc123!"
|
|
||||||
|
|
||||||
startupProbe:
|
|
||||||
## should be ready within 2 minutes
|
|
||||||
timeoutSeconds: 5
|
|
||||||
periodSeconds: 10
|
|
||||||
failureThreshold: 12
|
|
||||||
livenessProbe:
|
|
||||||
timeoutSeconds: 5
|
|
||||||
periodSeconds: 30
|
|
||||||
failureThreshold: 5
|
|
||||||
readinessProbe:
|
|
||||||
timeoutSeconds: 5
|
|
||||||
periodSeconds: 30
|
|
||||||
failureThreshold: 5
|
|
||||||
|
|
||||||
# helm values to use when installing the rancher-webhook chart.
|
|
||||||
# helm values set here will override all other global values used when installing the webhook such as priorityClassName and systemRegistry settings.
|
|
||||||
webhook: ""
|
|
||||||
|
|
||||||
# helm values to use when installing the fleet chart.
|
|
||||||
# helm values set here will override all other global values used when installing the fleet chart.
|
|
||||||
fleet: ""
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
./bin
|
|
||||||
./.dapper
|
|
||||||
./build
|
|
||||||
./dist
|
|
||||||
./.idea
|
|
||||||
./default.etcd
|
|
||||||
./package/rancher
|
|
||||||
./package/agent
|
|
||||||
./tests/MANIFEST
|
|
||||||
./tests/.idea
|
|
||||||
./tests/.cache
|
|
||||||
./tests/.tox
|
|
||||||
./tests/.venv
|
|
||||||
**/*.pyc
|
|
||||||
**/__pycache__
|
|
||||||
./management-state/
|
|
||||||
|
|
@ -1,6 +0,0 @@
|
||||||
# Treat all Go files in this repo as binary, with no git magic updating
|
|
||||||
# line endings. Windows users contributing to Go will need to use a
|
|
||||||
# modern version of git and editors capable of LF line endings.
|
|
||||||
|
|
||||||
*.go -text diff=golang
|
|
||||||
* text eol=lf
|
|
||||||
|
|
@ -1,48 +0,0 @@
|
||||||
---
|
|
||||||
name: Bug report
|
|
||||||
about: Create a report to help us improve
|
|
||||||
title: "[BUG]"
|
|
||||||
labels: kind/bug
|
|
||||||
assignees: ''
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Rancher Server Setup**
|
|
||||||
- Rancher version:
|
|
||||||
- Installation option (Docker install/Helm Chart):
|
|
||||||
- If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
|
|
||||||
- Proxy/Cert Details:
|
|
||||||
|
|
||||||
**Information about the Cluster**
|
|
||||||
- Kubernetes version:
|
|
||||||
- Cluster Type (Local/Downstream):
|
|
||||||
- If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider):
|
|
||||||
<!--
|
|
||||||
* Custom = Running a docker command on a node
|
|
||||||
* Imported = Running kubectl apply onto an existing k8s cluster
|
|
||||||
* Hosted = EKS, GKE, AKS, etc
|
|
||||||
* Infrastructure Provider = Rancher provisioning the nodes using different node drivers (e.g. AWS, Digital Ocean, etc)
|
|
||||||
-->
|
|
||||||
|
|
||||||
**User Information**
|
|
||||||
- What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom)
|
|
||||||
- If custom, define the set of permissions:
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
**Describe the bug**
|
|
||||||
<!--A clear and concise description of what the bug is.-->
|
|
||||||
|
|
||||||
**To Reproduce**
|
|
||||||
<!--Steps to reproduce the behavior-->
|
|
||||||
|
|
||||||
**Result**
|
|
||||||
|
|
||||||
**Expected Result**
|
|
||||||
<!--A clear and concise description of what you expected to happen.-->
|
|
||||||
|
|
||||||
**Screenshots**
|
|
||||||
<!-- If applicable, add screenshots to help explain your problem.-->
|
|
||||||
|
|
||||||
**Additional context**
|
|
||||||
<!--Add any other context about the problem here.-->
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
---
|
|
||||||
name: Feature request
|
|
||||||
about: Suggest an idea for this project
|
|
||||||
title: "[RFE] "
|
|
||||||
labels: kind/enhancement
|
|
||||||
assignees: ''
|
|
||||||
|
|
||||||
---
|
|
||||||
|
|
||||||
**Is your feature request related to a problem? Please describe.**
|
|
||||||
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
|
|
||||||
|
|
||||||
**Describe the solution you'd like**
|
|
||||||
A clear and concise description of what you want to happen.
|
|
||||||
|
|
||||||
**Describe alternatives you've considered**
|
|
||||||
A clear and concise description of any alternative solutions or features you've considered.
|
|
||||||
|
|
||||||
**Additional context**
|
|
||||||
Add any other context or screenshots about the feature request here.
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue