jhlim
/
shdsbilling
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

final

This commit is contained in:
jaey 2024-12-09 08:12:27 +00:00
parent 8e849e08c7
commit f1e63a9bc9
3943 changed files with 0 additions and 796833 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
shdsbilling/argocd_v2.12.3/1_configure/crds.yaml → on-premise/argocd_v2.12.3/1_configure/crds.yaml
View File

0
shdsbilling/argocd_v2.12.3/1_configure/init.yaml → on-premise/argocd_v2.12.3/1_configure/init.yaml
View File

0
shdsbilling/argocd_v2.12.3/2_configmap/configmap.yaml → on-premise/argocd_v2.12.3/2_configmap/configmap.yaml
View File

0
shdsbilling/argocd_v2.12.3/3_apply/deploy.yaml → on-premise/argocd_v2.12.3/3_apply/deploy.yaml
View File

0
shdsbilling/argocd_v2.12.3/3_apply/ing.yaml → on-premise/argocd_v2.12.3/3_apply/ing.yaml
View File

0
on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3.yaml → on-premise/argocd_v2.12.3/argocd_v2.12.3.yaml
View File

0
shdsbilling/argocd_v2.12.3/argocd_v2.12.3_add_ns.yaml → on-premise/argocd_v2.12.3/argocd_v2.12.3_add_ns.yaml
View File

0
shdsbilling/argocd_v2.12.3/crd.sh → on-premise/argocd_v2.12.3/crd.sh
View File

0
shdsbilling/argocd_v2.12.3/crds.yaml → on-premise/argocd_v2.12.3/crds.yaml
View File

0
shdsbilling/argocd_v2.12.3/deployment_without_crds.yaml → on-premise/argocd_v2.12.3/deployment_without_crds.yaml
View File

0
on-premise/cicd/argocd_v2.12.3/kustomization.yaml → on-premise/argocd_v2.12.3/kustomization.yaml
View File

23218
on-premise/cicd/argocd_v2.12.3/argocd_v2.12.3_add_ns.yaml
View File

File diff suppressed because it is too large Load Diff

28
on-premise/cicd/argocd_v2.12.3/ing.yaml
View File

@ -1,28 +0,0 @@
# Offloading setting.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: argocd-ing
namespace: argocd
annotations:
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/backend-protocol: "https"
nginx.ingress.kubernetes.io/ssl-passthrough: "true"
spec:
ingressClassName: nginx
rules:
- host: argocd.shdsbilling.com # 사전 생성된 인증서의 도메인적용.
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: argocd-server
port:
number: 443
tls:
- hosts:
- "argocd.shdsbilling.com"
secretName: ssl-shdsbilling-com

815
on-premise/cicd/gitea/3_apply/1
View File

@ -1,815 +0,0 @@
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: release-name-postgresql-ha-pgpool
namespace: gitea
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 4.5.2
app.kubernetes.io/component: pgpool
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: pgpool
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 4.5.2
app.kubernetes.io/component: pgpool
spec:
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: pgpool
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-postgresql-ha
# Auxiliary vars to populate environment variables
containers:
- name: pgpool
image: reg.inje-private.com/bitnami/pgpool:4.5.2-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
env:
- name: BITNAMI_DEBUG
value: "false"
- name: PGPOOL_BACKEND_NODES
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
- name: PGPOOL_SR_CHECK_USER
value: "repmgr"
- name: PGPOOL_SR_CHECK_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: repmgr-password
- name: PGPOOL_SR_CHECK_DATABASE
value: "postgres"
- name: PGPOOL_ENABLE_LDAP
value: "no"
- name: PGPOOL_POSTGRES_USERNAME
value: "gitea"
- name: PGPOOL_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: password
- name: PGPOOL_ADMIN_USERNAME
value: "admin"
- name: PGPOOL_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-pgpool
key: admin-password
- name: PGPOOL_AUTHENTICATION_METHOD
value: "scram-sha-256"
- name: PGPOOL_ENABLE_LOAD_BALANCING
value: "yes"
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
value: "transaction"
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
value: "no"
- name: PGPOOL_ENABLE_LOG_HOSTNAME
value: "yes"
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
value: "no"
- name: PGPOOL_RESERVED_CONNECTIONS
value: '1'
- name: PGPOOL_CHILD_LIFE_TIME
value: ""
- name: PGPOOL_ENABLE_TLS
value: "no"
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
value: "6"
envFrom:
ports:
- name: postgresql
containerPort: 5432
protocol: TCP
livenessProbe:
failureThreshold: 5
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- /opt/bitnami/scripts/pgpool/healthcheck.sh
readinessProbe:
failureThreshold: 5
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
resources:
limits:
cpu: 375m
ephemeral-storage: 2Gi
memory: 384Mi
requests:
cpu: 250m
ephemeral-storage: 50Mi
memory: 256Mi
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/etc
subPath: app-etc-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/logs
subPath: app-logs-dir
volumes:
- name: empty-dir
emptyDir: {}
---
# Source: gitea/templates/gitea/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: release-name-gitea
namespace: gitea
annotations:
labels:
app: gitea
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "1.22.1"
version: "1.22.1"
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 100%
selector:
matchLabels:
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
template:
metadata:
annotations:
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
labels:
app: gitea
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "1.22.1"
version: "1.22.1"
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: init-directories
image: "reg.inje-private.com/nnd002/gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/init_directory_structure.sh"]
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
volumeMounts:
- name: init
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
securityContext:
{}
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
- name: init-app-ini
image: "gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/config_environment.sh"]
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
volumeMounts:
- name: config
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
- name: inline-config-sources
mountPath: /env-to-ini-mounts/inlines/
securityContext:
{}
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
- name: configure-gitea
image: "gitea/gitea:1.22.1-rootless"
command: ["/usr/sbin/configure_gitea.sh"]
imagePullPolicy: IfNotPresent
securityContext:
runAsUser: 1000
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
- name: HOME
value: /data/gitea/git
- name: GITEA_ADMIN_USERNAME
value: "gitea_admin"
- name: GITEA_ADMIN_PASSWORD
value: "ijinc123!" # sdjo
- name: GITEA_ADMIN_PASSWORD_MODE
value: keepUpdated
volumeMounts:
- name: init
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
terminationGracePeriodSeconds: 60
containers:
- name: gitea
image: "gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
env:
# SSH Port values have to be set here as well for openssh configuration
- name: SSH_LISTEN_PORT
value: "2222"
- name: SSH_PORT
value: "22"
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
- name: TMPDIR
value: /tmp/gitea
- name: HOME
value: /data/gitea/git
ports:
- name: ssh
containerPort: 2222
- name: http
containerPort: 3000
livenessProbe:
failureThreshold: 10
initialDelaySeconds: 200
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: http
timeoutSeconds: 1
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: http
timeoutSeconds: 1
resources:
{}
securityContext:
{}
volumeMounts:
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
volumes:
- name: init
secret:
secretName: release-name-gitea-init
defaultMode: 110
- name: config
secret:
secretName: release-name-gitea
defaultMode: 110
- name: inline-config-sources
secret:
secretName: release-name-gitea-inline-config
- name: temp
emptyDir: {}
- name: data
persistentVolumeClaim:
claimName: gitea-shared-storage
---
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: release-name-postgresql-ha-postgresql
namespace: "gitea"
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 16.3.0
app.kubernetes.io/component: postgresql
role: data
spec:
replicas: 3
podManagementPolicy: "Parallel"
serviceName: release-name-postgresql-ha-postgresql-headless
updateStrategy:
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: postgresql
role: data
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 16.3.0
app.kubernetes.io/component: postgresql
role: data
spec:
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: postgresql
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-postgresql-ha
hostNetwork: false
hostIPC: false
containers:
- name: postgresql
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
lifecycle:
preStop:
exec:
command:
- /pre-stop.sh
- "25"
# Auxiliary vars to populate environment variables
env:
- name: BITNAMI_DEBUG
value: "false"
# PostgreSQL configuration
- name: POSTGRESQL_VOLUME_DIR
value: "/bitnami/postgresql"
- name: PGDATA
value: "/bitnami/postgresql/data"
- name: POSTGRES_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: postgres-password
- name: POSTGRES_USER
value: "gitea"
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: password
- name: POSTGRES_DB
value: "gitea"
- name: POSTGRESQL_LOG_HOSTNAME
value: "true"
- name: POSTGRESQL_LOG_CONNECTIONS
value: "false"
- name: POSTGRESQL_LOG_DISCONNECTIONS
value: "false"
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
value: "off"
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
value: "error"
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
value: "pgaudit, repmgr"
- name: POSTGRESQL_ENABLE_TLS
value: "no"
- name: POSTGRESQL_PORT_NUMBER
value: "5432"
# Repmgr configuration
- name: REPMGR_PORT_NUMBER
value: "5432"
- name: REPMGR_PRIMARY_PORT
value: "5432"
- name: MY_POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: REPMGR_UPGRADE_EXTENSION
value: "no"
- name: REPMGR_PGHBA_TRUST_ALL
value: "no"
- name: REPMGR_MOUNTED_CONF_DIR
value: "/bitnami/repmgr/conf"
- name: REPMGR_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: REPMGR_PARTNER_NODES
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
- name: REPMGR_PRIMARY_HOST
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
- name: REPMGR_NODE_NAME
value: "$(MY_POD_NAME)"
- name: REPMGR_NODE_NETWORK_NAME
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
- name: REPMGR_NODE_TYPE
value: "data"
- name: REPMGR_LOG_LEVEL
value: "NOTICE"
- name: REPMGR_CONNECT_TIMEOUT
value: "5"
- name: REPMGR_RECONNECT_ATTEMPTS
value: "2"
- name: REPMGR_RECONNECT_INTERVAL
value: "3"
- name: REPMGR_USERNAME
value: "repmgr"
- name: REPMGR_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: repmgr-password
- name: REPMGR_DATABASE
value: "repmgr"
- name: REPMGR_FENCE_OLD_PRIMARY
value: "no"
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
value: "5"
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
value: "1"
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
value: "30"
envFrom:
ports:
- name: postgresql
containerPort: 5432
protocol: TCP
livenessProbe:
failureThreshold: 6
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
readinessProbe:
failureThreshold: 6
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- |
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
resources:
limits:
cpu: 375m
ephemeral-storage: 2Gi
memory: 384Mi
requests:
cpu: 250m
ephemeral-storage: 50Mi
memory: 256Mi
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/postgresql/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/postgresql/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/conf
subPath: repmgr-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/tmp
subPath: repmgr-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/logs
subPath: repmgr-logs-dir
- name: data
mountPath: /bitnami/postgresql
- name: hooks-scripts
mountPath: /pre-stop.sh
subPath: pre-stop.sh
- name: hooks-scripts
mountPath: /readiness-probe.sh
subPath: readiness-probe.sh
volumes:
- name: empty-dir
emptyDir: {}
- name: hooks-scripts
configMap:
name: release-name-postgresql-ha-postgresql-hooks-scripts
defaultMode: 0755
volumeClaimTemplates:
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "8Gi"
---
# Source: gitea/charts/redis-cluster/templates/redis-statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: release-name-redis-cluster
namespace: "gitea"
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
app.kubernetes.io/version: 7.2.5
spec:
updateStrategy:
rollingUpdate:
partition: 0
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
replicas: 3
serviceName: release-name-redis-cluster-headless
podManagementPolicy: Parallel
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
app.kubernetes.io/version: 7.2.5
annotations:
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
spec:
hostNetwork: false
enableServiceLinks: false
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-redis-cluster
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
containers:
- name: release-name-redis-cluster
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
command: ['/bin/bash', '-c']
args:
- |
# Backwards compatibility change
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
echo COPYING FILE
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
fi
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
pod_index="${pod_index[-1]}"
if [[ "$pod_index" == "0" ]]; then
export REDIS_CLUSTER_CREATOR="yes"
export REDIS_CLUSTER_REPLICAS="0"
fi
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: REDIS_NODES
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
- name: ALLOW_EMPTY_PASSWORD
value: "yes"
- name: REDIS_AOF_ENABLED
value: "yes"
- name: REDIS_TLS_ENABLED
value: "no"
- name: REDIS_PORT_NUMBER
value: "6379"
ports:
- name: tcp-redis
containerPort: 6379
- name: tcp-redis-bus
containerPort: 16379
livenessProbe:
initialDelaySeconds: 5
periodSeconds: 5
# One second longer than command timeout should prevent generation of zombie processes.
timeoutSeconds: 6
successThreshold: 1
failureThreshold: 5
exec:
command:
- sh
- -c
- /scripts/ping_liveness_local.sh 5
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 5
# One second longer than command timeout should prevent generation of zombie processes.
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 5
exec:
command:
- sh
- -c
- /scripts/ping_readiness_local.sh 1
resources:
limits:
cpu: 150m
ephemeral-storage: 2Gi
memory: 192Mi
requests:
cpu: 100m
ephemeral-storage: 50Mi
memory: 128Mi
volumeMounts:
- name: scripts
mountPath: /scripts
- name: redis-data
mountPath: /bitnami/redis/data
subPath:
- name: default-config
mountPath: /opt/bitnami/redis/etc/redis-default.conf
subPath: redis-default.conf
- name: empty-dir
mountPath: /opt/bitnami/redis/etc/
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/redis/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/redis/logs
subPath: app-logs-dir
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
volumes:
- name: scripts
configMap:
name: release-name-redis-cluster-scripts
defaultMode: 0755
- name: default-config
configMap:
name: release-name-redis-cluster-default
- name: empty-dir
emptyDir: {}
volumeClaimTemplates:
- metadata:
name: redis-data
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "8Gi"

818
on-premise/cicd/gitea/3_apply/deploy.yaml
View File

@ -1,818 +0,0 @@
# Source: gitea/charts/postgresql-ha/templates/pgpool/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: release-name-postgresql-ha-pgpool
namespace: gitea
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 4.5.2
app.kubernetes.io/component: pgpool
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: pgpool
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 4.5.2
app.kubernetes.io/component: pgpool
spec:
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: pgpool
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-postgresql-ha
# Auxiliary vars to populate environment variables
containers:
- name: pgpool
image: docker.io/bitnami/pgpool:4.5.2-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
env:
- name: BITNAMI_DEBUG
value: "false"
- name: PGPOOL_BACKEND_NODES
value: 0:release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless:5432,1:release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless:5432,2:release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless:5432,
- name: PGPOOL_SR_CHECK_USER
value: "repmgr"
- name: PGPOOL_SR_CHECK_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: repmgr-password
- name: PGPOOL_SR_CHECK_DATABASE
value: "postgres"
- name: PGPOOL_ENABLE_LDAP
value: "no"
- name: PGPOOL_POSTGRES_USERNAME
value: "gitea"
- name: PGPOOL_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: password
- name: PGPOOL_ADMIN_USERNAME
value: "admin"
- name: PGPOOL_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-pgpool
key: admin-password
- name: PGPOOL_AUTHENTICATION_METHOD
value: "scram-sha-256"
- name: PGPOOL_ENABLE_LOAD_BALANCING
value: "yes"
- name: PGPOOL_DISABLE_LOAD_BALANCE_ON_WRITE
value: "transaction"
- name: PGPOOL_ENABLE_LOG_CONNECTIONS
value: "no"
- name: PGPOOL_ENABLE_LOG_HOSTNAME
value: "yes"
- name: PGPOOL_ENABLE_LOG_PER_NODE_STATEMENT
value: "no"
- name: PGPOOL_RESERVED_CONNECTIONS
value: '1'
- name: PGPOOL_CHILD_LIFE_TIME
value: ""
- name: PGPOOL_ENABLE_TLS
value: "no"
- name: PGPOOL_HEALTH_CHECK_PSQL_TIMEOUT
value: "6"
envFrom:
ports:
- name: postgresql
containerPort: 5432
protocol: TCP
livenessProbe:
failureThreshold: 5
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- /opt/bitnami/scripts/pgpool/healthcheck.sh
readinessProbe:
failureThreshold: 5
initialDelaySeconds: 5
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- PGPASSWORD=${PGPOOL_POSTGRES_PASSWORD} psql -U "gitea" -d "gitea" -h /opt/bitnami/pgpool/tmp -tA -c "SELECT 1" >/dev/null
resources:
limits:
cpu: 375m
ephemeral-storage: 2Gi
memory: 384Mi
requests:
cpu: 250m
ephemeral-storage: 50Mi
memory: 256Mi
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/etc
subPath: app-etc-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/pgpool/logs
subPath: app-logs-dir
volumes:
- name: empty-dir
emptyDir: {}
---
# Source: gitea/templates/gitea/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: release-name-gitea
namespace: gitea
annotations:
labels:
app: gitea
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "1.22.1"
version: "1.22.1"
spec:
replicas: 1
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 100%
selector:
matchLabels:
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
template:
metadata:
annotations:
checksum/config: 00fd8064076a446a896870db4974c6590fcf51561cf391547e559011465a57d8
labels:
app: gitea
app.kubernetes.io/name: gitea
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "1.22.1"
version: "1.22.1"
spec:
securityContext:
fsGroup: 1000
initContainers:
- name: init-directories
image: "gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/init_directory_structure.sh"]
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
volumeMounts:
- name: init
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
securityContext:
{}
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
- name: init-app-ini
image: "gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
command: ["/usr/sbin/config_environment.sh"]
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
volumeMounts:
- name: config
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
- name: inline-config-sources
mountPath: /env-to-ini-mounts/inlines/
securityContext:
{}
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
- name: configure-gitea
image: "gitea/gitea:1.22.1-rootless"
command: ["/usr/sbin/configure_gitea.sh"]
imagePullPolicy: IfNotPresent
securityContext:
runAsUser: 1000
env:
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
- name: HOME
value: /data/gitea/git
- name: GITEA_ADMIN_USERNAME
value: "gitea_admin"
- name: GITEA_ADMIN_PASSWORD
#value: "ijinc123!" # sdjo
value: "grumatic123!"
- name: GITEA_ADMIN_PASSWORD_MODE
value: keepUpdated
volumeMounts:
- name: init
mountPath: /usr/sbin
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
resources:
limits: {}
requests:
cpu: 100m
memory: 128Mi
terminationGracePeriodSeconds: 60
containers:
- name: gitea
image: "gitea/gitea:1.22.1-rootless"
imagePullPolicy: IfNotPresent
env:
# SSH Port values have to be set here as well for openssh configuration
- name: SSH_LISTEN_PORT
value: "2222"
- name: SSH_PORT
value: "22"
- name: GITEA_APP_INI
value: /data/gitea/conf/app.ini
- name: GITEA_CUSTOM
value: /data/gitea
- name: GITEA_WORK_DIR
value: /data
- name: GITEA_TEMP
value: /tmp/gitea
- name: TMPDIR
value: /tmp/gitea
- name: HOME
value: /data/gitea/git
ports:
- name: ssh
containerPort: 2222
- name: http
containerPort: 3000
livenessProbe:
failureThreshold: 10
initialDelaySeconds: 200
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: http
timeoutSeconds: 1
readinessProbe:
failureThreshold: 3
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: http
timeoutSeconds: 1
resources:
{}
securityContext:
{}
volumeMounts:
- name: temp
mountPath: /tmp
- name: data
mountPath: /data
volumes:
- name: init
secret:
secretName: release-name-gitea-init
defaultMode: 110
- name: config
secret:
secretName: release-name-gitea
defaultMode: 110
- name: inline-config-sources
secret:
secretName: release-name-gitea-inline-config
- name: temp
emptyDir: {}
- name: data
persistentVolumeClaim:
claimName: gitea-shared-storage
---
# Source: gitea/charts/postgresql-ha/templates/postgresql/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: release-name-postgresql-ha-postgresql
namespace: "gitea"
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 16.3.0
app.kubernetes.io/component: postgresql
role: data
spec:
replicas: 3
podManagementPolicy: "Parallel"
serviceName: release-name-postgresql-ha-postgresql-headless
updateStrategy:
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: postgresql
role: data
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/version: 16.3.0
app.kubernetes.io/component: postgresql
role: data
spec:
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: postgresql-ha
app.kubernetes.io/component: postgresql
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-postgresql-ha
hostNetwork: false
hostIPC: false
containers:
- name: postgresql
image: docker.io/bitnami/postgresql-repmgr:16.3.0-debian-12-r15
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
lifecycle:
preStop:
exec:
command:
- /pre-stop.sh
- "25"
# Auxiliary vars to populate environment variables
env:
- name: BITNAMI_DEBUG
value: "false"
# PostgreSQL configuration
- name: POSTGRESQL_VOLUME_DIR
value: "/bitnami/postgresql"
- name: PGDATA
value: "/bitnami/postgresql/data"
- name: POSTGRES_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: postgres-password
- name: POSTGRES_USER
value: "gitea"
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: password
- name: POSTGRES_DB
value: "gitea"
- name: POSTGRESQL_LOG_HOSTNAME
value: "true"
- name: POSTGRESQL_LOG_CONNECTIONS
value: "false"
- name: POSTGRESQL_LOG_DISCONNECTIONS
value: "false"
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
value: "off"
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
value: "error"
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
value: "pgaudit, repmgr"
- name: POSTGRESQL_ENABLE_TLS
value: "no"
- name: POSTGRESQL_PORT_NUMBER
value: "5432"
# Repmgr configuration
- name: REPMGR_PORT_NUMBER
value: "5432"
- name: REPMGR_PRIMARY_PORT
value: "5432"
- name: MY_POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: REPMGR_UPGRADE_EXTENSION
value: "no"
- name: REPMGR_PGHBA_TRUST_ALL
value: "no"
- name: REPMGR_MOUNTED_CONF_DIR
value: "/bitnami/repmgr/conf"
- name: REPMGR_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: REPMGR_PARTNER_NODES
value: release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-1.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,release-name-postgresql-ha-postgresql-2.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local,
- name: REPMGR_PRIMARY_HOST
value: "release-name-postgresql-ha-postgresql-0.release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
- name: REPMGR_NODE_NAME
value: "$(MY_POD_NAME)"
- name: REPMGR_NODE_NETWORK_NAME
value: "$(MY_POD_NAME).release-name-postgresql-ha-postgresql-headless.$(REPMGR_NAMESPACE).svc.cluster.local"
- name: REPMGR_NODE_TYPE
value: "data"
- name: REPMGR_LOG_LEVEL
value: "NOTICE"
- name: REPMGR_CONNECT_TIMEOUT
value: "5"
- name: REPMGR_RECONNECT_ATTEMPTS
value: "2"
- name: REPMGR_RECONNECT_INTERVAL
value: "3"
- name: REPMGR_USERNAME
value: "repmgr"
- name: REPMGR_PASSWORD
valueFrom:
secretKeyRef:
name: release-name-postgresql-ha-postgresql
key: repmgr-password
- name: REPMGR_DATABASE
value: "repmgr"
- name: REPMGR_FENCE_OLD_PRIMARY
value: "no"
- name: REPMGR_CHILD_NODES_CHECK_INTERVAL
value: "5"
- name: REPMGR_CHILD_NODES_CONNECTED_MIN_COUNT
value: "1"
- name: REPMGR_CHILD_NODES_DISCONNECT_TIMEOUT
value: "30"
envFrom:
ports:
- name: postgresql
containerPort: 5432
protocol: TCP
livenessProbe:
failureThreshold: 6
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- 'PGPASSWORD=$POSTGRES_PASSWORD psql -w -U "gitea" -d "gitea" -h 127.0.0.1 -p 5432 -c "SELECT 1"'
readinessProbe:
failureThreshold: 6
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
exec:
command:
- bash
- -ec
- |
exec pg_isready -U "postgres" -h 127.0.0.1 -p 5432
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
resources:
limits:
cpu: 375m
ephemeral-storage: 2Gi
memory: 384Mi
requests:
cpu: 250m
ephemeral-storage: 50Mi
memory: 256Mi
volumeMounts:
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/postgresql/conf
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/postgresql/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/conf
subPath: repmgr-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/tmp
subPath: repmgr-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/repmgr/logs
subPath: repmgr-logs-dir
- name: data
mountPath: /bitnami/postgresql
- name: hooks-scripts
mountPath: /pre-stop.sh
subPath: pre-stop.sh
- name: hooks-scripts
mountPath: /readiness-probe.sh
subPath: readiness-probe.sh
volumes:
- name: empty-dir
emptyDir: {}
- name: hooks-scripts
configMap:
name: release-name-postgresql-ha-postgresql-hooks-scripts
defaultMode: 0755
volumeClaimTemplates:
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
spec:
accessModes:
- "ReadWriteOnce"
storageClassName: billing-portal-sc
resources:
requests:
storage: "8Gi"
---
# Source: cdgitea/charts/redis-cluster/templates/redis-statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: release-name-redis-cluster
namespace: "gitea"
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
app.kubernetes.io/version: 7.2.5
spec:
updateStrategy:
rollingUpdate:
partition: 0
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
replicas: 3
serviceName: release-name-redis-cluster-headless
podManagementPolicy: Parallel
template:
metadata:
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
app.kubernetes.io/version: 7.2.5
annotations:
checksum/scripts: f4443ed238f1b19ab40555e6ba2aea56daba79e8270549f884b9b31cf8e0e2ee
checksum/secret: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
checksum/config: 958b865b26062946819f240fe4e5fd268b7c3203b944549981f1bd7fdc7947eb
spec:
hostNetwork: false
enableServiceLinks: false
securityContext:
fsGroup: 1001
fsGroupChangePolicy: Always
supplementalGroups: []
sysctls: []
serviceAccountName: release-name-redis-cluster
automountServiceAccountToken: false
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
containers:
- name: release-name-redis-cluster
image: docker.io/bitnami/redis-cluster:7.2.5-debian-12-r2
imagePullPolicy: "IfNotPresent"
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsGroup: 1001
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
command: ['/bin/bash', '-c']
args:
- |
# Backwards compatibility change
if ! [[ -f /opt/bitnami/redis/etc/redis.conf ]]; then
echo COPYING FILE
cp /opt/bitnami/redis/etc/redis-default.conf /opt/bitnami/redis/etc/redis.conf
fi
pod_index=($(echo "$POD_NAME" | tr "-" "\n"))
pod_index="${pod_index[-1]}"
if [[ "$pod_index" == "0" ]]; then
export REDIS_CLUSTER_CREATOR="yes"
export REDIS_CLUSTER_REPLICAS="0"
fi
/opt/bitnami/scripts/redis-cluster/entrypoint.sh /opt/bitnami/scripts/redis-cluster/run.sh
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: REDIS_NODES
value: "release-name-redis-cluster-0.release-name-redis-cluster-headless release-name-redis-cluster-1.release-name-redis-cluster-headless release-name-redis-cluster-2.release-name-redis-cluster-headless "
- name: ALLOW_EMPTY_PASSWORD
value: "yes"
- name: REDIS_AOF_ENABLED
value: "yes"
- name: REDIS_TLS_ENABLED
value: "no"
- name: REDIS_PORT_NUMBER
value: "6379"
ports:
- name: tcp-redis
containerPort: 6379
- name: tcp-redis-bus
containerPort: 16379
livenessProbe:
initialDelaySeconds: 5
periodSeconds: 5
# One second longer than command timeout should prevent generation of zombie processes.
timeoutSeconds: 6
successThreshold: 1
failureThreshold: 5
exec:
command:
- sh
- -c
- /scripts/ping_liveness_local.sh 5
readinessProbe:
initialDelaySeconds: 5
periodSeconds: 5
# One second longer than command timeout should prevent generation of zombie processes.
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 5
exec:
command:
- sh
- -c
- /scripts/ping_readiness_local.sh 1
resources:
limits:
cpu: 150m
ephemeral-storage: 2Gi
memory: 192Mi
requests:
cpu: 100m
ephemeral-storage: 50Mi
memory: 128Mi
volumeMounts:
- name: scripts
mountPath: /scripts
- name: redis-data
mountPath: /bitnami/redis/data
subPath:
- name: default-config
mountPath: /opt/bitnami/redis/etc/redis-default.conf
subPath: redis-default.conf
- name: empty-dir
mountPath: /opt/bitnami/redis/etc/
subPath: app-conf-dir
- name: empty-dir
mountPath: /opt/bitnami/redis/tmp
subPath: app-tmp-dir
- name: empty-dir
mountPath: /opt/bitnami/redis/logs
subPath: app-logs-dir
- name: empty-dir
mountPath: /tmp
subPath: tmp-dir
volumes:
- name: scripts
configMap:
name: release-name-redis-cluster-scripts
defaultMode: 0755
- name: default-config
configMap:
name: release-name-redis-cluster-default
- name: empty-dir
emptyDir: {}
volumeClaimTemplates:
- metadata:
name: redis-data
labels:
app.kubernetes.io/instance: release-name
app.kubernetes.io/name: redis-cluster
spec:
accessModes:
- "ReadWriteOnce"
storageClassName: billing-portal-sc
resources:
requests:
storage: "8Gi"

22
on-premise/cicd/nexus/1_configure/init.yaml
View File

@ -1,22 +0,0 @@
# Warning
# PersistentVolumeClaim 오브젝트에서 StorageClass 이름을 변경하고 사용.
#
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: nexus
name: nexus
spec:
finalizers:
- kubernetes
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.72.0
name: nexus-nexus-repository-manager
namespace: nexus

16
on-premise/cicd/nexus/1_configure/pvc.yaml
View File

@ -1,16 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.72.0
name: nexus-nexus-repository-manager-data
namespace: nexus
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Gi
storageClassName: sc-monitoring

96
on-premise/cicd/nexus/3_apply/deploy.yaml
View File

@ -1,96 +0,0 @@
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.62.0
name: nexus-nexus-repository-manager
namespace: nexus
spec:
ports:
- name: nexus-ui
port: 8081
protocol: TCP
selector:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
app.kubernetes.io/version: 3.62.0
name: nexus-nexus-repository-manager
namespace: nexus
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
strategy:
type: Recreate
template:
metadata:
labels:
app.kubernetes.io/instance: nexus
app.kubernetes.io/name: nexus-repository-manager
spec:
containers:
- env:
- name: INSTALL4J_ADD_VM_PARAMS
value: "-Xms2703M -Xmx2703M -XX:MaxDirectMemorySize=2703M -XX:+UnlockExperimentalVMOptions -Djava.util.prefs.userRoot=/nexus-data/javaprefs"
- name: NEXUS_SECURITY_RANDOMPASSWORD
value: "true"
envFrom: null
image: reg.inje-private.com/nnd002/sonatype/nexus3:3.72.0
imagePullPolicy: IfNotPresent
lifecycle: null
livenessProbe:
failureThreshold: 6
httpGet:
path: /
port: 8081
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 10
name: nexus-repository-manager
ports:
- containerPort: 8081
name: nexus-ui
readinessProbe:
failureThreshold: 6
httpGet:
path: /
port: 8081
initialDelaySeconds: 30
periodSeconds: 30
timeoutSeconds: 10
#resources: # by ljh
#limits:
#cpu: 4
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
volumeMounts:
- mountPath: /nexus-data
name: nexus-repository-manager-data
securityContext:
fsGroup: 200
runAsGroup: 200
runAsUser: 200
serviceAccountName: nexus-nexus-repository-manager
terminationGracePeriodSeconds: 120
volumes:
- name: nexus-repository-manager-data
persistentVolumeClaim:
claimName: nexus-nexus-repository-manager-data

24
on-premise/cicd/nexus/3_apply/ing.yaml
View File

@ -1,24 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: "0"
name: ing-nexus
namespace: nexus
spec:
ingressClassName: nginx
rules:
- host: nexus.inje-private.com
http:
paths:
- backend:
service:
name: nexus-nexus-repository-manager
port:
name: nexus-ui
path: /
pathType: Prefix
tls:
- hosts:
- "nexus.inje-private.com"
secretName: nexus-ssl

618
on-premise/cicd/sonarqube/deploy.yaml
View File

@ -1,618 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: sonarqube
name: sonarqube
spec:
finalizers:
- kubernetes
---
# Source: sonarqube/charts/postgresql/templates/secrets.yaml
apiVersion: v1
kind: Secret
metadata:
name: sonarqube-postgresql
namespace: sonarqube
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
namespace: sonarqube
type: Opaque
data:
postgresql-postgres-password: "YjlLdzZzWVlYOQ=="
postgresql-password: "c29uYXJQYXNz"
---
# Source: sonarqube/templates/secret.yaml
---
apiVersion: v1
kind: Secret
metadata:
name: sonarqube-sonarqube-monitoring-passcode
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
type: Opaque
data:
SONAR_WEB_SYSTEMPASSCODE: "ZGVmaW5lX2l0"
---
# Source: sonarqube/templates/config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-config
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
sonar.properties: |
---
# Source: sonarqube/templates/init-fs.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-init-fs
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
init_fs.sh: |-
---
# Source: sonarqube/templates/init-sysctl.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-init-sysctl
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
init_sysctl.sh: |-
if [[ "$(sysctl -n vm.max_map_count)" -lt 524288 ]]; then
sysctl -w vm.max_map_count=524288
fi
if [[ "$(sysctl -n fs.file-max)" -lt 131072 ]]; then
sysctl -w fs.file-max=131072
fi
if [[ "$(ulimit -n)" != "unlimited" ]]; then
if [[ "$(ulimit -n)" -lt 131072 ]]; then
echo "ulimit -n 131072"
ulimit -n 131072
fi
fi
if [[ "$(ulimit -u)" != "unlimited" ]]; then
if [[ "$(ulimit -u)" -lt 8192 ]]; then
echo "ulimit -u 8192"
ulimit -u 8192
fi
fi
---
# Source: sonarqube/templates/install-plugins.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-install-plugins
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
install_plugins.sh: |-
---
# Source: sonarqube/templates/jdbc-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: sonarqube-sonarqube-jdbc-config
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
data:
SONAR_JDBC_USERNAME: "sonarUser"
SONAR_JDBC_URL: "jdbc:postgresql://sonarqube-postgresql:5432/sonarDB"
---
# Source: sonarqube/charts/postgresql/templates/svc-headless.yaml
apiVersion: v1
kind: Service
metadata:
name: sonarqube-postgresql-headless
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
# Use this annotation in addition to the actual publishNotReadyAddresses
# field below because the annotation will stop being respected soon but the
# field is broken in some versions of Kubernetes:
# https://github.com/kubernetes/kubernetes/issues/58662
service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
namespace: sonarqube
spec:
type: ClusterIP
clusterIP: None
# We want all pods in the StatefulSet to have their addresses published for
# the sake of the other Postgresql pods even before they're ready, since they
# have to be able to talk to each other in order to become ready.
publishNotReadyAddresses: true
ports:
- name: tcp-postgresql
port: 5432
targetPort: tcp-postgresql
selector:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
---
# Source: sonarqube/charts/postgresql/templates/svc.yaml
apiVersion: v1
kind: Service
metadata:
name: sonarqube-postgresql
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
annotations:
namespace: sonarqube
spec:
type: ClusterIP
ports:
- name: tcp-postgresql
port: 5432
targetPort: tcp-postgresql
selector:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
role: primary
---
# Source: sonarqube/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: sonarqube-sonarqube
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
spec:
type: ClusterIP
ports:
- port: 9000
targetPort: http
protocol: TCP
name: http
selector:
app: sonarqube
release: sonarqube
---
# Source: sonarqube/charts/postgresql/templates/statefulset.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: sonarqube-postgresql
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/component: primary
annotations:
namespace: sonarqube
spec:
serviceName: sonarqube-postgresql-headless
replicas: 1
updateStrategy:
type: RollingUpdate
selector:
matchLabels:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
role: primary
template:
metadata:
name: sonarqube-postgresql
labels:
app.kubernetes.io/name: postgresql
helm.sh/chart: postgresql-10.15.0
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
role: primary
app.kubernetes.io/component: primary
spec:
affinity:
podAffinity:
podAntiAffinity:
preferredDuringSchedulingIgnoredDuringExecution:
- podAffinityTerm:
labelSelector:
matchLabels:
app.kubernetes.io/name: postgresql
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/component: primary
namespaces:
- "sonarqube"
topologyKey: kubernetes.io/hostname
weight: 1
nodeAffinity:
securityContext:
fsGroup: 1001
automountServiceAccountToken: false
containers:
- name: sonarqube-postgresql
image: reg.inje-private.com/nnd002/bitnami/postgresql:11.14.0-debian-10-r22
imagePullPolicy: "IfNotPresent"
resources:
limits:
cpu: 2
memory: 2Gi
requests:
cpu: 100m
memory: 200Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1001
seccompProfile:
type: RuntimeDefault
env:
- name: BITNAMI_DEBUG
value: "false"
- name: POSTGRESQL_PORT_NUMBER
value: "5432"
- name: POSTGRESQL_VOLUME_DIR
value: "/bitnami/postgresql"
- name: PGDATA
value: "/bitnami/postgresql/data"
- name: POSTGRES_POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: sonarqube-postgresql
key: postgresql-postgres-password
- name: POSTGRES_USER
value: "sonarUser"
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: sonarqube-postgresql
key: postgresql-password
- name: POSTGRES_DB
value: "sonarDB"
- name: POSTGRESQL_ENABLE_LDAP
value: "no"
- name: POSTGRESQL_ENABLE_TLS
value: "no"
- name: POSTGRESQL_LOG_HOSTNAME
value: "false"
- name: POSTGRESQL_LOG_CONNECTIONS
value: "false"
- name: POSTGRESQL_LOG_DISCONNECTIONS
value: "false"
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
value: "off"
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
value: "error"
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
value: "pgaudit"
ports:
- name: tcp-postgresql
containerPort: 5432
livenessProbe:
exec:
command:
- /bin/sh
- -c
- exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
initialDelaySeconds: 30
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 6
readinessProbe:
exec:
command:
- /bin/sh
- -c
- -e
- |
exec pg_isready -U "sonarUser" -d "dbname=sonarDB" -h 127.0.0.1 -p 5432
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized ]
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 5
successThreshold: 1
failureThreshold: 6
volumeMounts:
- name: dshm
mountPath: /dev/shm
- name: data
mountPath: /bitnami/postgresql
subPath:
volumes:
- name: dshm
emptyDir:
medium: Memory
volumeClaimTemplates:
- metadata:
name: data
spec:
accessModes:
- "ReadWriteOnce"
resources:
requests:
storage: "20Gi"
---
# Source: sonarqube/templates/sonarqube-sts.yaml
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: sonarqube-sonarqube
namespace: sonarqube
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
app.kubernetes.io/name: sonarqube-sonarqube-sonarqube
app.kubernetes.io/instance: sonarqube
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/part-of: sonarqube
app.kubernetes.io/component: sonarqube-sonarqube
app.kubernetes.io/version: "10.6.0-community"
spec:
replicas: 1
revisionHistoryLimit: 10
serviceName: sonarqube-sonarqube
selector:
matchLabels:
app: sonarqube
release: sonarqube
template:
metadata:
annotations:
checksum/config: 2256323f7d9ffc8a4e18606aa35e18a28b05412806a19e4e6a15359f9b710ad0
checksum/init-fs: 915551fa9592e2d81312781f423a59e6ba0837510c2e1d996e899eecd057ee91
checksum/init-sysctl: 7aa0dd9441283780322cf0596f09a398219af7dd756fcead24179a08adcebc32
checksum/plugins: 14cc0e459ae2f5de6499309b22cfdbcc1452d9e0e4f01a0ea45a43793e95e550
checksum/secret: b433376554b78de7ccf285d4ffebc8759355e6916f285189ce33ba1eba4ba28a
labels:
app: sonarqube
release: sonarqube
spec:
automountServiceAccountToken: false
securityContext:
fsGroup: 0
initContainers:
- name: "wait-for-db"
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 0
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
command: ["/bin/bash", "-c"]
args: ['set -o pipefail;for i in {1..200};do (echo > /dev/tcp/sonarqube-postgresql/5432) && exit 0; sleep 2;done; exit 1']
- name: init-sysctl
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
imagePullPolicy: IfNotPresent
securityContext:
privileged: true
runAsUser: 0
command: ["/bin/bash", "-e", "/tmp/scripts/init_sysctl.sh"]
volumeMounts:
- name: init-sysctl
mountPath: /tmp/scripts/
env:
- name: SONAR_WEB_CONTEXT
value: "/"
- name: SONAR_WEB_JAVAOPTS
value: ""
- name: SONAR_CE_JAVAOPTS
value: ""
containers:
- name: sonarqube
image: reg.inje-private.com/nnd002/sonarqube:10.6.0-community
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 9000
protocol: TCP
resources:
limits:
cpu: 800m
ephemeral-storage: 512000M
memory: 6144M
requests:
cpu: 400m
ephemeral-storage: 1536M
memory: 2048M
env:
- name: SONAR_HELM_CHART_VERSION
value: 10.6.0_3033
- name: SONAR_JDBC_PASSWORD
valueFrom:
secretKeyRef:
name: sonarqube-postgresql
key: postgresql-password
- name: SONAR_WEB_SYSTEMPASSCODE
valueFrom:
secretKeyRef:
name: sonarqube-sonarqube-monitoring-passcode
key: SONAR_WEB_SYSTEMPASSCODE
- name: SONAR_WEB_CONTEXT
value: "/"
- name: SONAR_WEB_JAVAOPTS
value: ""
- name: SONAR_CE_JAVAOPTS
value: ""
envFrom:
- configMapRef:
name: sonarqube-sonarqube-jdbc-config
livenessProbe:
exec:
command:
- sh
- -c
- |
wget --no-proxy --quiet -O /dev/null --timeout=1 --header="X-Sonar-Passcode: $SONAR_WEB_SYSTEMPASSCODE" "http://localhost:9000/api/system/liveness"
failureThreshold: 6
initialDelaySeconds: 60
periodSeconds: 30
timeoutSeconds: 1
readinessProbe:
exec:
command:
- sh
- -c
- |
#!/bin/bash
# A Sonarqube container is considered ready if the status is UP, DB_MIGRATION_NEEDED or DB_MIGRATION_RUNNING
# status about migration are added to prevent the node to be kill while sonarqube is upgrading the database.
if wget --no-proxy -qO- http://localhost:9000/api/system/status | grep -q -e '"status":"UP"' -e '"status":"DB_MIGRATION_NEEDED"' -e '"status":"DB_MIGRATION_RUNNING"'; then
exit 0
fi
exit 1
failureThreshold: 6
initialDelaySeconds: 60
periodSeconds: 30
timeoutSeconds: 1
startupProbe:
httpGet:
scheme: HTTP
path: /api/system/status
port: http
initialDelaySeconds: 30
periodSeconds: 10
failureThreshold: 24
timeoutSeconds: 1
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 0
runAsNonRoot: true
runAsUser: 1000
seccompProfile:
type: RuntimeDefault
volumeMounts:
- mountPath: /opt/sonarqube/data
name: sonarqube
subPath: data
- mountPath: /opt/sonarqube/temp
name: sonarqube
subPath: temp
- mountPath: /opt/sonarqube/logs
name: sonarqube
subPath: logs
- mountPath: /tmp
name: tmp-dir
serviceAccountName: default
volumes:
- name: init-sysctl
configMap:
name: sonarqube-sonarqube-init-sysctl
items:
- key: init_sysctl.sh
path: init_sysctl.sh
- name: init-fs
configMap:
name: sonarqube-sonarqube-init-fs
items:
- key: init_fs.sh
path: init_fs.sh
- name: sonarqube
persistentVolumeClaim:
claimName: sonarqube-sonarqube
- name : tmp-dir
emptyDir:
{}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
name: sonarqube-sonarqube
namespace: sonarqube
spec:
accessModes:
- ReadWriteMany
storageClassName: sc-monitoring
resources:
requests:
storage: 20Gi
---
# Source: sonarqube/templates/tests/sonarqube-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: "sonarqube-ui-test"
namespace: sonarqube
annotations:
"helm.sh/hook": test-success
labels:
app: sonarqube
chart: sonarqube-10.6.0_3033
release: sonarqube
heritage: Helm
spec:
automountServiceAccountToken: false
containers:
- name: sonarqube-ui-test
image: "reg.inje-private.com/nnd002/sonarqube:10.6.0-community"
imagePullPolicy: IfNotPresent
command: ['wget']
args: [
'--retry-connrefused',
'--waitretry=1',
'--timeout=5',
'-t',
'12',
'-qO-',
'sonarqube-sonarqube:9000/api/system/status'
]
resources:
limits:
cpu: 500m
ephemeral-storage: 1000M
memory: 200M
requests:
cpu: 500m
ephemeral-storage: 100M
memory: 200M
restartPolicy: Never

23
on-premise/cicd/sonarqube/ing.yaml
View File

@ -1,23 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: sonarqube-ingress
namespace: sonarqube
spec:
ingressClassName: nginx
rules:
- host: sonar.inje-private.com
http:
paths:
- backend:
service:
name: sonarqube-sonarqube
port:
name: http
path: /
pathType: Prefix
tls:
- hosts:
- "sonar.inje-private.com"
secretName: sonarqube-ssl

3366
on-premise/cicd/tekton/1_configure/init.yaml
View File

File diff suppressed because it is too large Load Diff

87
on-premise/cicd/tekton/3_apply/ValidatingWebhookConfiguration.yaml
View File

@ -1,87 +0,0 @@
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-pipelines
pipeline.tekton.dev/release: v0.57.0
name: config.webhook.pipeline.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: config.webhook.pipeline.tekton.dev
objectSelector:
matchLabels:
app.kubernetes.io/part-of: tekton-pipelines
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: v0.26.1
name: config.webhook.triggers.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-triggers-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: config.webhook.triggers.tekton.dev
namespaceSelector:
matchExpressions:
- key: triggers.tekton.dev/release
operator: Exists
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-pipelines
pipeline.tekton.dev/release: v0.57.0
name: validation.webhook.pipeline.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: validation.webhook.pipeline.tekton.dev
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: v0.26.1
name: validation.webhook.triggers.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-triggers-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: validation.webhook.triggers.tekton.dev
sideEffects: None

1054
on-premise/cicd/tekton/3_apply/deploy.yaml
View File

File diff suppressed because it is too large Load Diff

119
on-premise/cicd/tekton/3_apply/extention.yaml
View File

@ -1,119 +0,0 @@
apiVersion: dashboard.tekton.dev/v1alpha1
kind: Extension
metadata:
name: cronjobs
spec:
apiVersion: batch/v1
displayname: k8s cronjobs
name: cronjobs
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: bitbucket
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: bitbucket
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: cel
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: cel
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: github
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: github
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: gitlab
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: gitlab
port: 8443
---
apiVersion: triggers.tekton.dev/v1alpha1
kind: ClusterInterceptor
metadata:
labels:
server/type: https
name: slack
spec:
clientConfig:
service:
name: tekton-triggers-core-interceptors
namespace: tekton-pipelines
path: slack
port: 8443
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-pipelines
pipeline.tekton.dev/release: v0.57.0
name: webhook.pipeline.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-pipelines-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: webhook.pipeline.tekton.dev
sideEffects: None
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: webhook
app.kubernetes.io/instance: default
app.kubernetes.io/part-of: tekton-triggers
triggers.tekton.dev/release: v0.26.1
name: webhook.triggers.tekton.dev
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: tekton-triggers-webhook
namespace: tekton-pipelines
failurePolicy: Fail
name: webhook.triggers.tekton.dev
sideEffects: None

25
on-premise/cicd/tekton/3_apply/ing.yaml
View File

@ -1,25 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ing-tekton
namespace: tekton-pipelines
annotations:
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
ingressClassName: nginx
rules:
- host: tekton.inje-private.com # 사전 생성된 인증서의 도메인적용.
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: tekton-dashboard
port:
number: 9097
tls:
- hosts:
- "tekton.inje-private.com"
secretName: tekton-ssl

0
on-premise/cicd/gitea/1_configure/1_namespace.yaml → on-premise/gitea/1_configure/1_namespace.yaml
View File

0
on-premise/cicd/gitea/1_configure/2_networki_policy.yaml → on-premise/gitea/1_configure/2_networki_policy.yaml
View File

0
on-premise/cicd/gitea/1_configure/3_PodDisruptionBudget.yaml → on-premise/gitea/1_configure/3_PodDisruptionBudget.yaml
View File

0
on-premise/cicd/gitea/1_configure/4_sa.yaml → on-premise/gitea/1_configure/4_sa.yaml
View File

0
on-premise/cicd/gitea/1_configure/5_secret.yaml → on-premise/gitea/1_configure/5_secret.yaml
View File

0
on-premise/cicd/gitea/1_configure/6_pvc.yaml → on-premise/gitea/1_configure/6_pvc.yaml
View File

0
on-premise/cicd/gitea/1_configure/README.md → on-premise/gitea/1_configure/README.md
View File

0
on-premise/cicd/gitea/2_config/default.yaml → on-premise/gitea/2_config/default.yaml
View File

0
shdsbilling/gitea/3_apply/deploy.yaml → on-premise/gitea/3_apply/deploy.yaml
View File

0
on-premise/cicd/gitea/3_apply/ing.yaml → on-premise/gitea/3_apply/ing.yaml
View File

0
on-premise/cicd/gitea/3_apply/service.yaml → on-premise/gitea/3_apply/service.yaml
View File

0
on-premise/cicd/gitea/gitea.yaml → on-premise/gitea/gitea.yaml
View File

0
shdsbilling/ingress-nginx/deploy.yaml → on-premise/ingress-nginx/deploy.yaml
View File

60
on-premise/logging/fluentbit_v3.1.7/1_configure/init.yaml
View File

@ -1,60 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: logging
---
# Source: fluent-bit/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
---
# Source: fluent-bit/templates/clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: fluent-bit
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
rules:
- apiGroups:
- ""
resources:
- namespaces
- pods
verbs:
- get
- list
- watch
---
# Source: fluent-bit/templates/clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: fluent-bit
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: fluent-bit
subjects:
- kind: ServiceAccount
name: fluent-bit
namespace: logging

69
on-premise/logging/fluentbit_v3.1.7/2_config/custom.yaml
View File

@ -1,69 +0,0 @@
# Source: fluent-bit/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
data:
custom_parsers.conf: |
[PARSER]
Name docker_no_time
Format json
Time_Keep Off
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
fluent-bit.conf: |
[SERVICE]
Daemon Off
Flush 1
Log_Level info
Parsers_File /fluent-bit/etc/parsers.conf
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
[INPUT]
Name tail
Path /var/log/containers/*.log
multiline.parser docker, cri
# DB /var/fluent-bit/state/flb_log.db
Tag kube.*
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[FILTER]
Name kubernetes
Match kube.*
Merge_Log On
Keep_Log Off
K8S-Logging.Parser On
K8S-Logging.Exclude On
# [FILTER]
# Name record_modifier
# Match kube.*
# Record namespace ${_score}
[OUTPUT]
Name es
Match kube.*
Host 172.17.128.246
HTTP_User admin
HTTP_Passwd admin
Index fluent-bit10--%Y.%m.%d
Logstash_Format On
Logstash_Prefix_Key $kubernetes['namespace_name']
Suppress_Type_Name On
tls On
tls.Verify Off
Retry_Limit False

69
on-premise/logging/fluentbit_v3.1.7/2_config/default.yaml
View File

@ -1,69 +0,0 @@
# Source: fluent-bit/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
data:
custom_parsers.conf: |
[PARSER]
Name docker_no_time
Format json
Time_Keep Off
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L
fluent-bit.conf: |
[SERVICE]
Daemon Off
Flush 1
Log_Level info
Parsers_File /fluent-bit/etc/parsers.conf
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
[INPUT]
Name tail
Path /var/log/containers/*.log
multiline.parser docker, cri
Tag kube.*
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[INPUT]
Name systemd
Tag host.*
Systemd_Filter _SYSTEMD_UNIT=kubelet.service
Read_From_Tail On
[FILTER]
Name kubernetes
Match kube.*
Merge_Log On
Keep_Log Off
K8S-Logging.Parser On
K8S-Logging.Exclude On
[OUTPUT]
Name es
Match kube.*
Host elasticsearch-master
Logstash_Format On
Retry_Limit False
[OUTPUT]
Name es
Match host.*
Host elasticsearch-master
Logstash_Format On
Logstash_Prefix node
Retry_Limit False

73
on-premise/logging/fluentbit_v3.1.7/2_config/fileSave.yaml
View File

@ -1,73 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: fluent-bit
namespace: logging
labels:
app.kubernetes.io/name: fluentbit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
data:
custom_parsers.conf: |
[PARSER]
Name cri
Format regex
Regex ^(?<time>[^ ]+) (?<stream>stdout|stderr) (?<logtag>[^ ]*) (?<message>.*)$
Time_Key time
Time_Format %Y-%m-%dT%H:%M:%S.%L%z
Decode_Field_As json message
[PARSER]
Name svcname
Format regex
Regex /sample-(?<servicename>.+)-dp-[^-]+-[^-]+_(?<namespace>.+)_.+-con-[^-]+.log$
fluent-bit.conf: |
[SERVICE]
Flush 5
Log_Level info
Daemon off
Parsers_File /fluent-bit/etc/parsers.conf
Parsers_File /fluent-bit/etc/conf/custom_parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
storage.path /var/fluent-bit/state/flb-storage/
storage.sync normal
storage.checksum off
storage.backlog.mem_limit 5M
@INCLUDE input-kubernetes.conf
# @INCLUDE filter-kubernetes.conf
@INCLUDE output-file.conf
input-kubernetes.conf: |
[INPUT]
Name tail
Parser cri
Path /var/log/containers/blog-*-dp-*-*_blog_*-con-*.log
DB /var/fluent-bit/state/flb_log.db
Tag blog.<service_name>
Tag_Regex /blog-(?<service_name>.+)-dp-[^-]+-[^-]+_blog_.+-con-[^-]+.log$
Mem_Buf_Limit 5MB
Skip_Long_Lines On
Refresh_Interval 10
Path_key svc_name
filter-kubernetes.conf: |
[FILTER]
Name parser
Match blog.*
Key_name svc_name
reserve_data On
Parser svcname
output-file.conf: |
[OUTPUT]
Name file
Match blog.*
Path /home/ubuntu
file fluentbit-scrape.txt

66
on-premise/logging/fluentbit_v3.1.7/2_config/multiline.yaml
View File

@ -1,66 +0,0 @@
# Source: fluent-bit/templates/configmap.yaml
apiVersion: v1
kind: ConfigMap
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.10
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
data:
fluent-bit.conf: |
[SERVICE]
Daemon Off
Flush 1
Log_Level warn
Parsers_File /fluent-bit/etc/parsers.conf
HTTP_Server On
HTTP_Listen 0.0.0.0
HTTP_Port 2020
Health_Check On
storage.path /var/fluent-bit/state/flb-storage/
storage.sync normal
storage.checksum off
storage.backlog.mem_limit 5M
[INPUT]
Name tail
Path /var/log/containers/sample-*-dp-*-con-*.log
Parser cri
Tag normal.<service_name>.<namespace_name>
Tag_Regex /sample-(?<service_name>.+)-dp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[INPUT]
Name tail
Path /var/log/containers/sample-*-mdp-*-con-*.log
Parser cri
Tag multi.<service_name>.<namespace_name>
Tag_Regex /sample-(?<service_name>.+)-mdp-(.+)_(?<namespace_name>.+)_(.+)-con-(.+).log$
Mem_Buf_Limit 5MB
Skip_Long_Lines On
[FILTER]
name multiline
match multi.*
multiline.key_content message
multiline.parser java
[OUTPUT]
Name es
Match *
Host soo-os.maintndjs.shop
Port 9200
Index test5
Type _doc
Include_Tag_Key true
Tag_key @svc_name
Suppress_Type_Name On
HTTP_User admin
HTTP_Passwd admin
tls On
tls.verify Off

137
on-premise/logging/fluentbit_v3.1.7/3_apply/debug.yaml
View File

@ -1,137 +0,0 @@
# Source: fluent-bit/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:
- port: 2020
targetPort: http
protocol: TCP
name: http
selector:
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
---
# Source: fluent-bit/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
spec:
selector:
matchLabels:
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
template:
metadata:
labels:
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
annotations:
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
spec:
serviceAccountName: fluent-bit
hostNetwork: false
dnsPolicy: ClusterFirst
containers:
- name: fluent-bit
image: "cr.fluentbit.io/fluent/fluent-bit:3.1.7-debug"
imagePullPolicy: IfNotPresent
command:
- /fluent-bit/bin/fluent-bit
args:
- --workdir=/fluent-bit/etc
- --config=/fluent-bit/etc/conf/fluent-bit.conf
ports:
- name: http
containerPort: 2020
protocol: TCP
livenessProbe:
httpGet:
path: /
port: http
readinessProbe:
httpGet:
path: /api/v1/health
port: http
volumeMounts:
- name: config
mountPath: /fluent-bit/etc/conf
- mountPath: /var/log
name: varlog
- mountPath: /var/lib/docker/containers
name: varlibdockercontainers
readOnly: true
- mountPath: /etc/machine-id
name: etcmachineid
readOnly: true
# Custom Add
- name: runlogjournal
mountPath: /run/log/journal
readOnly: true
# - name: dmesg
# mountPath: /var/log/dmesg
# readOnly: true
- name: mnt
mountPath: /mnt
readOnly: true
- name: fluentbitstate
mountPath: /var/fluent-bit/state
- name: file-save
mountPath: /home/ubuntu
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
resources:
limits:
cpu: 500m
memory: 500Mi
requests:
cpu: 500m
memory: 500Mi
volumes:
- name: config
configMap:
name: fluent-bit
- name: varlog
hostPath:
path: /var/log
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers
- name: etcmachineid
hostPath:
path: /etc/machine-id
type: File
# Custom Add
## for cash
- name: fluentbitstate
hostPath:
path: /var/fluent-bit/state
- name: runlogjournal # 있음
hostPath:
path: /run/log/journal
# - name: dmesg # 있음
# hostPath:
# path: /var/log/dmesg
- name: mnt # 있음
hostPath:
path: /mnt
- name: file-save # 있음
hostPath:
path: /home/ubuntu

132
on-premise/logging/fluentbit_v3.1.7/3_apply/default.yaml
View File

@ -1,132 +0,0 @@
# Source: fluent-bit/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
spec:
type: ClusterIP
ports:
- port: 2020
targetPort: http
protocol: TCP
name: http
selector:
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
---
# Source: fluent-bit/templates/daemonset.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: fluent-bit
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
spec:
selector:
matchLabels:
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
template:
metadata:
labels:
app.kubernetes.io/name: fluent-bit
app.kubernetes.io/instance: fluent-bit
annotations:
checksum/config: 19631ad1090fbeaf145be8a25d43bf24621413639593494df4b243914c27e763
spec:
serviceAccountName: fluent-bit
hostNetwork: false
dnsPolicy: ClusterFirst
containers:
- name: fluent-bit
image: "reg.inje-private.com/nnd002/fluent/fluent-bit:3.1.7"
imagePullPolicy: IfNotPresent
command:
- /fluent-bit/bin/fluent-bit
args:
- --workdir=/fluent-bit/etc
- --config=/fluent-bit/etc/conf/fluent-bit.conf
ports:
- name: http
containerPort: 2020
protocol: TCP
livenessProbe:
httpGet:
path: /
port: http
readinessProbe:
httpGet:
path: /api/v1/health
port: http
volumeMounts:
- name: config
mountPath: /fluent-bit/etc/conf
- mountPath: /var/log
name: varlog
- mountPath: /var/lib/docker/containers
name: varlibdockercontainers
readOnly: true
- mountPath: /etc/machine-id
name: etcmachineid
readOnly: true
# Custom Add
- name: runlogjournal
mountPath: /run/log/journal
readOnly: true
# - name: dmesg
# mountPath: /var/log/dmesg
# readOnly: true
- name: mnt
mountPath: /mnt
readOnly: true
- name: fluentbitstate
mountPath: /var/fluent-bit/state
# https://docs.fluentbit.io/manual/pipeline/filters/kubernetes
resources:
limits:
cpu: 500m
memory: 500Mi
requests:
cpu: 500m
memory: 500Mi
volumes:
- name: config
configMap:
name: fluent-bit
- name: varlog
hostPath:
path: /var/log
- name: varlibdockercontainers
hostPath:
path: /var/lib/docker/containers
- name: etcmachineid
hostPath:
path: /etc/machine-id
type: File
# Custom Add
## for cash
- name: fluentbitstate
hostPath:
path: /var/fluent-bit/state
- name: runlogjournal # 있음
hostPath:
path: /run/log/journal
# - name: dmesg # 있음
# hostPath:
# path: /var/log/dmesg
- name: mnt # 있음
hostPath:
path: /mnt

21
on-premise/logging/fluentbit_v3.1.7/3_apply/test.yaml
View File

@ -1,21 +0,0 @@
# Source: fluent-bit/templates/tests/test-connection.yaml
apiVersion: v1
kind: Pod
metadata:
name: "fluent-bit-test-connection"
namespace: logging
labels:
helm.sh/chart: fluent-bit-0.47.9
app.kubernetes.io/version: "3.1.7"
app.kubernetes.io/managed-by: Helm
annotations:
helm.sh/hook: test
helm.sh/hook-delete-policy: hook-succeeded
spec:
containers:
- name: wget
image: "reg.inje-private.com/nnd002/busybox:latest"
imagePullPolicy: Always
command: ["sh"]
args: ["-c", "wget -O- fluent-bit:2020"]
restartPolicy: Never

119
on-premise/logging/openSearch/ansible-play/openSearch-install.yaml
View File

@ -1,119 +0,0 @@
---
- name: openSearch test
hosts: os
remote_user: ubuntu
gather_facts: no
become: yes # get root authority
become_user: root
# Setting Valiables
vars:
cluster_name: "dp3-os"
node_roles: '["cluster_manager", "data"]'
discovery_seed_hosts: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
cluster_initial_cluster_manager_nodes: '["10.163.1.96", "10.163.1.51", "10.163.1.46"]'
tasks:
- name: Updata apt cache
apt:
update_cache: yes
tags: update
- name: Install required packages
apt:
name:
- lsb-release
- ca-certificates
- curl
- gnupg2
state: present
tags: install
# pre settings openSearch
- name: Download OpenSearch GPG key
get_url:
url: https://artifacts.opensearch.org/publickeys/opensearch.pgp
dest: /tmp/opensearch.pgp
- name: Add OpenSearch GPG key to the keyring
command: gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring /tmp/opensearch.pgp
- name: Clean up temporary GPG key file
file:
path: /tmp/opensearch.pgp
state: absent
# Add Repo
- name: Add OpenSearch repository
copy:
dest: /etc/apt/sources.list.d/opensearch-2.x.list
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
owner: root
group: root
mode: '0644'
- name: Add OpenSearch Dashboards repository
copy:
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
owner: root
group: root
mode: '0644'
- name: Add OpenSearch repository
copy:
dest: /etc/apt/sources.list.d/opensearch-2.x.list
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main"
owner: root
group: root
mode: '0644'
- name: Add OpenSearch Dashboards repository
copy:
dest: /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
content: "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main"
owner: root
group: root
mode: '0644'
- name: Install required packages
apt:
name:
- opensearch=2.11.1
# - opensearch-dashboards=2.11.1
state: present
update_cache: yes
tags: install
# set jvm
- name: Change Xms1g to Xms#g in jvm.options
lineinfile:
path: /etc/opensearch/jvm.options
regexp: '^-Xms1g'
line: '-Xms4g'
backup: no
tags: config
- name: Change Xmx1g to Xmx#g in jvm.options
lineinfile:
path: /etc/opensearch/jvm.options
regexp: '^-Xmx1g'
line: '-Xmx4g'
backup: no
tags: config
# set opensearcy.yml
- name: Set node name based on inventory order
set_fact:
node_name: "os-{{ play_hosts.index(inventory_hostname) + 1 }}"
- name: Deploy OpenSearch configuration file from template
template:
src: templates/opensearch.yml.j2
dest: /etc/opensearch/opensearch.yml
owner: opensearch
group: opensearch
mode: '0644'
- name: Enable and start OpenSearch service
systemd:
name: opensearch
enabled: yes
state: started
# curl -XGET https://10.163.1.51:9200/\_cat/nodes?v -u 'admin:admin' --insecure

150
on-premise/logging/openSearch/ansible-play/templates/opensearch.yml.j2
View File

@ -1,150 +0,0 @@
# ======================== OpenSearch Configuration =========================
#
# NOTE: OpenSearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.opensearch.org
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
cluster.name: {{ cluster_name }}
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
node.name: {{ node_name }}
node.roles: {{ node_roles }}
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/opensearch
#
# Path to log files:
#
path.logs: /var/log/opensearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# OpenSearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
network.host: 0.0.0.0
#
# Set a custom port for HTTP:
#
http.port: 9200
transport.port: 9300
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
discovery.seed_hosts: {{ discovery_seed_hosts }}
#
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
#
cluster.initial_cluster_manager_nodes: {{ cluster_initial_cluster_manager_nodes }}
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#
# ---------------------------------- Remote Store -----------------------------------
# Controls whether cluster imposes index creation only with remote store enabled
# cluster.remote_store.enabled: true
#
# Repository to use for segment upload while enforcing remote store for an index
# node.attr.remote_store.segment.repository: my-repo-1
#
# Repository to use for translog upload while enforcing remote store for an index
# node.attr.remote_store.translog.repository: my-repo-1
#
# ---------------------------------- Experimental Features -----------------------------------
# Gates the visibility of the experimental segment replication features until they are production ready.
#
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
#
# Gates the functionality of a new parameter to the snapshot restore API
# that allows for creation of a new index type that searches a snapshot
# directly in a remote repository without restoring all index data to disk
# ahead of time.
#
#opensearch.experimental.feature.searchable_snapshot.enabled: false
#
#
# Gates the functionality of enabling extensions to work with OpenSearch.
# This feature enables applications to extend features of OpenSearch outside of
# the core.
#
#opensearch.experimental.feature.extensions.enabled: false
#
#
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
# index searcher threadpool.
#
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
######## Start OpenSearch Security Demo Configuration ########
# WARNING: revise all the lines below before you go into production
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: esnode.pem
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
- CN=kirk,OU=client,O=client,L=test, C=de
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
node.max_local_storage_nodes: 3
######## End OpenSearch Security Demo Configuration ########
plugins.security.disabled: false

22
on-premise/logging/openSearch/ing-opensearch-dashboard.yaml
View File

@ -1,22 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ing-os-dash
namespace: logging
spec:
ingressClassName: nginx
rules:
- host: os-dash.inje-private.com
http:
paths:
- backend:
service:
name: release-name-opensearch-dashboards
port:
number: 5601
path: /
pathType: Prefix
tls:
- hosts:
- os-dash.inje-private.com
secretName: logging-ssl

141
on-premise/logging/openSearch/openSearch-dashboard_2.11.1.yaml
View File

@ -1,141 +0,0 @@
---
# Source: opensearch-dashboards/templates/serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: release-name-opensearch-dashboards-dashboards
namespace: logging
labels:
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "2.11.1"
---
# Source: opensearch-dashboards/templates/rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "2.11.1"
name: release-name-opensearch-dashboards-dashboards-rolebinding
namespace: logging
roleRef:
kind: Role
name: release-name-opensearch-dashboards-dashboards
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
name: release-name-opensearch-dashboards-dashboards
namespace: logging
---
# Source: opensearch-dashboards/templates/service.yaml
apiVersion: v1
kind: Service
metadata:
name: release-name-opensearch-dashboards
namespace: logging
labels:
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "2.11.1"
spec:
type: ClusterIP
ports:
- port: 5601
protocol: TCP
name: http
targetPort: 5601
selector:
app: opensearch-dashboards
release: "release-name"
---
# Source: opensearch-dashboards/templates/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: release-name-opensearch-dashboards
namespace: logging
labels:
app.kubernetes.io/name: opensearch-dashboards
app.kubernetes.io/instance: release-name
app.kubernetes.io/version: "2.11.1"
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: opensearch-dashboards
release: "release-name"
template:
metadata:
labels:
app: opensearch-dashboards
release: "release-name"
annotations:
spec:
securityContext:
{}
serviceAccountName: release-name-opensearch-dashboards-dashboards
volumes:
containers:
- name: dashboards
securityContext:
capabilities:
drop:
- ALL
runAsNonRoot: true
runAsUser: 1000
#image: "opensearchproject/opensearch-dashboards:2.13.0"
image: "reg.inje-private.com/nnd002/opensearchproject/opensearch-dashboards:2.11.1"
imagePullPolicy: "IfNotPresent"
readinessProbe:
failureThreshold: 10
initialDelaySeconds: 30
periodSeconds: 20
successThreshold: 1
tcpSocket:
port: 5601
timeoutSeconds: 5
livenessProbe:
failureThreshold: 10
initialDelaySeconds: 30
periodSeconds: 20
successThreshold: 1
tcpSocket:
port: 5601
timeoutSeconds: 5
startupProbe:
failureThreshold: 20
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
tcpSocket:
port: 5601
timeoutSeconds: 5
env:
- name: OPENSEARCH_HOSTS
value: "https://172.17.128.246:9200"
#value: "https://opensearch-cluster-master:9200"
- name: SERVER_HOST
value: "0.0.0.0"
#- name: SERVER_BASEPATH
# value: "/os"
- name: OPENSEARCH_USERNAME
value: "admin"
- name: OPENSEARCH_PASSWORD
value: "admin"
ports:
- containerPort: 5601
name: http
protocol: TCP
resources:
limits:
cpu: 100m
memory: 512M
requests:
cpu: 100m
memory: 512M
#volumeMounts:

367
on-premise/logging/openSearch/openSearch-multiMaster.md
View File

@ -1,367 +0,0 @@
# OpenSearch
## QuicStart
## Install OpenSearch from an APT repository
### Install the necessary packages.
```bash
sudo apt-get update && sudo apt-get -y install lsb-release ca-certificates curl gnupg2
```
### Import the public GPG key. This key is used to verify that the APT repository is signed.
```bash
curl -o- https://artifacts.opensearch.org/publickeys/opensearch.pgp | sudo gpg --dearmor --batch --yes -o /usr/share/keyrings/opensearch-keyring
```
### Create an APT repository for OpenSearch
```bash
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-2.x.list
```
### Create an APT repository for OpenSearch-Dashboard
```bash
echo "deb [signed-by=/usr/share/keyrings/opensearch-keyring] https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/2.x/apt stable main" | sudo tee /etc/apt/sources.list.d/opensearch-dashboards-2.x.list
```
### Verify that the repository was created successfully.
```bash
sudo apt-get update
```
설치 가능 패키지 확인
```bash
apt-cache madison opensearch
```
확인결과
```bash
opensearch | 2.13.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.12.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.11.1 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.11.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.10.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.9.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.8.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.7.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.6.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
opensearch | 2.5.0 | https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable/main amd64 Packages
```
### Choose the version of OpenSearch you want to install:
> Unless otherwise indicated, the latest available version of OpenSearch is installed.
항상 최신 버전 설치
```bash
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
# Use one of the following commands to define a custom admin password:
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch
# Use the following command for OpenSearch versions 2.11 and earlier:
sudo apt-get install opensearch
```
버전 지정 설치방법
```bash
# Specify the version manually using opensearch=<version>
# For new installations of OpenSearch 2.12 and later, you must define a custom admin password in order to set up a demo security configuration.
# Use one of the following commands to define a custom admin password:
sudo env OPENSEARCH_INITIAL_ADMIN_PASSWORD=<custom-admin-password> apt-get install opensearch=2.13.0
# Use the following command for OpenSearch versions 2.11 and earlier:
sudo apt-get install opensearch=2.13.0
```
### MultiMaster Setting
```bash
/etc/opensearch/opensearch.yml
```
```yaml
cluster.name: os_cluster_name
node.name: os1 # os2 , os3
node.roles: ["cluster_manager", "data"]
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
network.host: 0.0.0.0
http.port: 9200
transport.port: 9300
discovery.seed_hosts: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
cluster.initial_cluster_manager_nodes: ["10.10.2.30", "10.10.2.89", "10.10.2.97"]
node.max_local_storage_nodes: 3
plugins.security.disabled: true
```
### Specify initial and maximum JVM heap sizes.
Open jvm.options
```bash
vi /etc/opensearch/jvm.options
```
Modify the values for initial and maximum heap sizes. As a starting point, you should set these values to half of the available system memory. For dedicated hosts this value can be increased based on your workflow requirements.
As an example, if the host machine has 8 GB of memory, then you might want to set the initial and maximum heap sizes to 4 GB:
```bash
-Xms4g
-Xmx4g
```
Save your changes and close the file.
### Naver Cloud LB 설정
멀티마스터 구성시 사설인증서로 Offloading 설정하여 진행.
Network Proxy LoadBalancer에서 동작 검증완료.
> 내부 인증서 처리 방식이 좀 까다로워 테스트 하다 오프로딩으로 전환.
## Reference
[link1](https://opster.com/guides/opensearch/opensearch-data-architecture/how-to-configure-opensearch-node-roles/) 국외자료
[link2](https://developer-jp.tistory.com/33) 국내자료
[link3](https://opensearch.org/docs/latest/install-and-configure/install-opensearch/debian/) 공식자료
---
## SingeNode 적용 예시
아래 내용참조. SingleNode는 SSL 설정도 까다롭지 않음.
```yaml
vi /etc/opensearch/opensearch.yml
```
```yaml
# ======================== OpenSearch Configuration =========================
#
# NOTE: OpenSearch comes with reasonable defaults for most settings.
# Before you set out to tweak and tune the configuration, make sure you
# understand what are you trying to accomplish and the consequences.
#
# The primary way of configuring a node is via this file. This template lists
# the most important settings you may want to configure for a production cluster.
#
# Please consult the documentation for further information on configuration options:
# https://www.opensearch.org
#
# ---------------------------------- Cluster -----------------------------------
#
# Use a descriptive name for your cluster:
#
#cluster.name: my-application
#
# ------------------------------------ Node ------------------------------------
#
# Use a descriptive name for the node:
#
#node.name: node-1
#
# Add custom attributes to the node:
#
#node.attr.rack: r1
#
# ----------------------------------- Paths ------------------------------------
#
# Path to directory where to store the data (separate multiple locations by comma):
#
path.data: /var/lib/opensearch
#
# Path to log files:
#
path.logs: /var/log/opensearch
#
# ----------------------------------- Memory -----------------------------------
#
# Lock the memory on startup:
#
#bootstrap.memory_lock: true
#
# Make sure that the heap size is set to about half the memory available
# on the system and that the owner of the process is allowed to use this
# limit.
#
# OpenSearch performs poorly when the system is swapping the memory.
#
# ---------------------------------- Network -----------------------------------
#
# Set the bind address to a specific IP (IPv4 or IPv6):
#
#network.host: 192.168.0.1
#
# Set a custom port for HTTP:
#
#http.port: 9200
#
# For more information, consult the network module documentation.
#
# --------------------------------- Discovery ----------------------------------
#
# Pass an initial list of hosts to perform discovery when this node is started:
# The default list of hosts is ["127.0.0.1", "[::1]"]
#
#discovery.seed_hosts: ["host1", "host2"]
#
# Bootstrap the cluster using an initial set of cluster-manager-eligible nodes:
#
#cluster.initial_cluster_manager_nodes: ["node-1", "node-2"]
#
# For more information, consult the discovery and cluster formation module documentation.
#
# ---------------------------------- Gateway -----------------------------------
#
# Block initial recovery after a full cluster restart until N nodes are started:
#
#gateway.recover_after_nodes: 3
#
# For more information, consult the gateway module documentation.
#
# ---------------------------------- Various -----------------------------------
#
# Require explicit names when deleting indices:
#
#action.destructive_requires_name: true
#
# ---------------------------------- Remote Store -----------------------------------
# Controls whether cluster imposes index creation only with remote store enabled
# cluster.remote_store.enabled: true
#
# Repository to use for segment upload while enforcing remote store for an index
# node.attr.remote_store.segment.repository: my-repo-1
#
# Repository to use for translog upload while enforcing remote store for an index
# node.attr.remote_store.translog.repository: my-repo-1
#
# ---------------------------------- Experimental Features -----------------------------------
# Gates the visibility of the experimental segment replication features until they are production ready.
#
#opensearch.experimental.feature.segment_replication_experimental.enabled: false
#
# Gates the functionality of a new parameter to the snapshot restore API
# that allows for creation of a new index type that searches a snapshot
# directly in a remote repository without restoring all index data to disk
# ahead of time.
#
#opensearch.experimental.feature.searchable_snapshot.enabled: false
#
#
# Gates the functionality of enabling extensions to work with OpenSearch.
# This feature enables applications to extend features of OpenSearch outside of
# the core.
#
#opensearch.experimental.feature.extensions.enabled: false
#
#
# Gates the concurrent segment search feature. This feature enables concurrent segment search in a separate
# index searcher threadpool.
#
#opensearch.experimental.feature.concurrent_segment_search.enabled: false
######## Start OpenSearch Security Demo Configuration ########
# 키정보는 openssl로 생성해서 교체해도 됨.
plugins.security.ssl.transport.pemcert_filepath: esnode.pem
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: esnode.pem
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.allow_unsafe_democertificates: true # 데모아니면 불필요
plugins.security.allow_default_init_securityindex: true #이건 모르겠음
plugins.security.authcz.admin_dn:
- CN=kirk,OU=client,O=client,L=test, C=de
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
node.max_local_storage_nodes: 3
######## End OpenSearch Security Demo Configuration ########
# Bind OpenSearch to the correct network interface. Use 0.0.0.0
# to include all available interfaces or specify an IP address
# assigned to a specific interface.
network.host: 0.0.0.0
# Unless you have already configured a cluster, you should set
# discovery.type to single-node, or the bootstrap checks will
# fail when you try to start the service.
discovery.type: single-node
# If you previously disabled the Security plugin in opensearch.yml,
# be sure to re-enable it. Otherwise you can skip this setting.
plugins.security.disabled: false # false가 기능활성임.
```
---
## Password Change
multimaster 설정 과정에 대하여 기술함.
> 기존에 생성했던 인증서를 노드별로 적용하는 과정을 거쳐서 테스트를 진행하였음.
[참고자료](https://opensearch.org/docs/latest/security/configuration/generate-certificates/)
사용했던 실제 스크립트
```sh
#!/bin/sh
# Root CA
openssl genrsa -out root-ca-key.pem 2048
openssl req -new -x509 -sha256 -key root-ca-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=root.dns.a-record" -out root-ca.pem -days 730
# Admin cert
openssl genrsa -out admin-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in admin-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out admin-key.pem
openssl req -new -key admin-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=A" -out admin.csr
openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out admin.pem -days 730
# Node cert 1
openssl genrsa -out os1-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in os1-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os1-key.pem
openssl req -new -key os1-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os1.dns.a-record" -out os1.csr
echo 'subjectAltName=DNS:os1.dns.a-record' > os1.ext
openssl x509 -req -in os1.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os1.pem -days 730 -extfile os1.ext
# Node cert 2
openssl genrsa -out os2-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in os2-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os2-key.pem
openssl req -new -key os2-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os2.dns.a-record" -out os2.csr
echo 'subjectAltName=DNS:os2.dns.a-record' > os2.ext
openssl x509 -req -in os2.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os2.pem -days 730 -extfile os2.ext
# Node cert 3
openssl genrsa -out os3-key-temp.pem 2048
openssl pkcs8 -inform PEM -outform PEM -in os3-key-temp.pem -topk8 -nocrypt -v1 PBE-SHA1-3DES -out os3-key.pem
openssl req -new -key os3-key.pem -subj "/C=CA/ST=ONTARIO/L=TORONTO/O=ORG/OU=UNIT/CN=os3.dns.a-record" -out os3.csr
echo 'subjectAltName=DNS:os3.dns.a-record' > os3.ext
openssl x509 -req -in os3.csr -CA root-ca.pem -CAkey root-ca-key.pem -CAcreateserial -sha256 -out os3.pem -days 730 -extfile os3.ext
# Cleanup
rm admin-key-temp.pem
rm admin.csr
rm os1-key-temp.pem
rm os1.csr
rm os1.ext
rm os2-key-temp.pem
rm os2.csr
rm os2.ext
rm os3-key-temp.pem
rm os3.csr
rm os3.ext
```
### 설정했던 opensearch.yml
```bash
cluster.name: my-application
node.name: os1
node.roles: ["cluster_manager", "data"]
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
network.host: 0.0.0.0
http.port: 9200
transport.port: 9300
discovery.seed_hosts: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
cluster.initial_cluster_manager_nodes: ["10.151.2.82", "10.151.2.69", "10.151.2.8"]
plugins.security.ssl.transport.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
plugins.security.ssl.transport.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /etc/opensearch/ssh-files/os1.pem
plugins.security.ssl.http.pemkey_filepath: /etc/opensearch/ssh-files/os1-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /etc/opensearch/ssh-files/root-ca.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
- 'CN=A,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
plugins.security.nodes_dn:
- 'CN=os1.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
- 'CN=os2.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
- 'CN=os3.dns.a-record,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
node.max_local_storage_nodes: 3
plugins.security.disabled: false
```

28
on-premise/main/calico_v3.28.2/custom-resources.yaml
View File

@ -1,28 +0,0 @@
# This section includes base Calico installation configuration.
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.Installation
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
name: default
spec:
# Configures Calico networking.
calicoNetwork:
ipPools:
- name: default-ipv4-ippool
blockSize: 24
cidr: 10.10.0.0/16
encapsulation: VXLANCrossSubnet # openstack 에서는 VXLAN을 사용해야해안다 byljh
natOutgoing: Enabled
nodeSelector: all()
registry: reg.inje-private.com
---
# This section configures the Calico API server.
# For more information, see: https://docs.tigera.io/calico/latest/reference/installation/api#operator.tigera.io/v1.APIServer
apiVersion: operator.tigera.io/v1
kind: APIServer
metadata:
name: default
spec: {}

25476
on-premise/main/calico_v3.28.2/tigera-operator.yaml
View File

File diff suppressed because it is too large Load Diff

311
on-premise/main/harbor_2.9.1/1.init.yaml
View File

@ -1,311 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: harbor
name: harbor
spec:
finalizers:
- kubernetes
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-core
namespace: harbor
data:
_REDIS_URL_CORE: redis://harbor-redis:6379/0?idle_timeout_seconds=30
_REDIS_URL_REG: redis://harbor-redis:6379/2?idle_timeout_seconds=30
CHART_CACHE_DRIVER: redis
CONFIG_PATH: /etc/core/app.conf
CORE_LOCAL_URL: http://127.0.0.1:8080
CORE_URL: http://harbor-core:80
DATABASE_TYPE: postgresql
EXT_ENDPOINT: https://harbor.inje-private.com
HTTP_PROXY: ""
HTTPS_PROXY: ""
JOBSERVICE_URL: http://harbor-jobservice
LOG_LEVEL: info
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
PERMITTED_REGISTRY_TYPES_FOR_PROXY_CACHE: docker-hub,harbor,azure-acr,aws-ecr,google-gcr,quay,docker-registry,github-ghcr,jfrog-artifactory
PORT: "8080"
PORTAL_URL: http://harbor-portal
POSTGRESQL_DATABASE: registry
POSTGRESQL_HOST: harbor-database
POSTGRESQL_MAX_IDLE_CONNS: "100"
POSTGRESQL_MAX_OPEN_CONNS: "900"
POSTGRESQL_PORT: "5432"
POSTGRESQL_SSLMODE: disable
POSTGRESQL_USERNAME: postgres
QUOTA_UPDATE_PROVIDER: db
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
REGISTRY_STORAGE_PROVIDER_NAME: filesystem
REGISTRY_URL: http://harbor-registry:5000
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
TRIVY_ADAPTER_URL: http://harbor-trivy:8080
WITH_TRIVY: "true"
app.conf: |
appname = Harbor
runmode = prod
enablegzip = true
[prod]
httpport = 8080
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice
namespace: harbor
data:
config.yml: |
#Server listening port
protocol: "http"
port: 8080
worker_pool:
workers: 10
backend: "redis"
redis_pool:
redis_url: "redis://harbor-redis:6379/1"
namespace: "harbor_job_service_namespace"
idle_timeout_second: 3600
job_loggers:
- name: "FILE"
level: INFO
settings: # Customized settings of logger
base_dir: "/var/log/jobs"
sweeper:
duration: 14 #days
settings: # Customized settings of sweeper
work_dir: "/var/log/jobs"
metric:
enabled: false
path: /metrics
port: 8001
#Loggers for the job service
loggers:
- name: "STD_OUTPUT"
level: INFO
reaper:
# the max time to wait for a task to finish, if unfinished after max_update_hours, the task will be mark as error, but the task will continue to run, default value is 24
max_update_hours: 24
# the max time for execution in running state without new task created
max_dangling_hours: 168
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice-env
namespace: harbor
data:
CORE_URL: http://harbor-core:80
HTTP_PROXY: ""
HTTPS_PROXY: ""
JOBSERVICE_WEBHOOK_JOB_HTTP_CLIENT_TIMEOUT: "3"
JOBSERVICE_WEBHOOK_JOB_MAX_RETRY: "3"
NO_PROXY: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
REGISTRY_CONTROLLER_URL: http://harbor-registry:8080
REGISTRY_CREDENTIAL_USERNAME: harbor_registry_user
REGISTRY_URL: http://harbor-registry:5000
TOKEN_SERVICE_URL: http://harbor-core:80/service/token
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-portal
namespace: harbor
data:
nginx.conf: |
worker_processes auto;
pid /tmp/nginx.pid;
events {
worker_connections 1024;
}
http {
client_body_temp_path /tmp/client_body_temp;
proxy_temp_path /tmp/proxy_temp;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
listen 8080;
listen [::]:8080;
server_name localhost;
root /usr/share/nginx/html;
index index.html index.htm;
include /etc/nginx/mime.types;
gzip on;
gzip_min_length 1000;
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;
location /devcenter-api-2.0 {
try_files $uri $uri/ /swagger-ui-index.html;
}
location / {
try_files $uri $uri/ /index.html;
}
location = /index.html {
add_header Cache-Control "no-store, no-cache, must-revalidate";
}
}
}
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry
namespace: harbor
data:
config.yml: |
version: 0.1
log:
level: info
fields:
service: registry
storage:
filesystem:
rootdirectory: /storage
cache:
layerinfo: redis
maintenance:
uploadpurging:
enabled: true
age: 168h
interval: 24h
dryrun: false
delete:
enabled: true
redirect:
disable: false
redis:
addr: harbor-redis:6379
db: 2
readtimeout: 10s
writetimeout: 10s
dialtimeout: 10s
pool:
maxidle: 100
maxactive: 500
idletimeout: 60s
http:
addr: :5000
#relativeurls: false
relativeurls: true
# set via environment variable
# secret: placeholder
debug:
addr: localhost:5001
auth:
htpasswd:
realm: harbor-registry-basic-realm
path: /etc/registry/passwd
validation:
disabled: true
compatibility:
schema1:
enabled: true
ctl-config.yml: |
---
protocol: "http"
port: 8080
log_level: info
registry_config: "/etc/registry/config.yml"
---
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: harbor
release: harbor
name: harbor-registryctl
namespace: harbor
---
apiVersion: v1
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-database
namespace: harbor
type: Opaque
data:
POSTGRES_PASSWORD: UmxheG9kbXM5MCFA
---
apiVersion: v1
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice
namespace: harbor
type: Opaque
data:
JOBSERVICE_SECRET: akVWbzlyNFJaU2R1clJqUA==
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
---
apiVersion: v1
data:
REGISTRY_HTTP_SECRET: dHlCdm41MXpIakxLRm5mRw==
REGISTRY_REDIS_PASSWORD: ""
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry
namespace: harbor
type: Opaque
---
apiVersion: v1
data:
REGISTRY_HTPASSWD: aGFyYm9yX3JlZ2lzdHJ5X3VzZXI6JDJhJDEwJG1uRkVSQkVyRmROYnNuZDVHWUxTQXVUOTRaUWxZNGkxU3BtNTk4dWlmV2pLbEJrQnJhbHEu
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry-htpasswd
namespace: harbor
type: Opaque
---
apiVersion: v1
data: null
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-registryctl
namespace: harbor
type: Opaque
---
apiVersion: v1
data:
gitHubToken: ""
redisURL: cmVkaXM6Ly9oYXJib3ItcmVkaXM6NjM3OS81P2lkbGVfdGltZW91dF9zZWNvbmRzPTMw
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-trivy
namespace: harbor
type: Opaque

27
on-premise/main/harbor_2.9.1/2.cert.yaml
View File

@ -1,27 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: harbor-cacerts
namespace: harbor
data:
cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuVENDQW9XZ0F3SUJBZ0lVZG82RjNaejRhT2JjazdreDJwbHdHQVJreHBZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJIUVZOTwpNUXd3Q2dZRFZRUUtEQU5FUlZZeEVEQU9CZ05WQkFzTUIwcEJXUzVEVDFJeEVEQU9CZ05WQkFNTUIxSlBUMVF0ClEwRXdIaGNOTWpReE1ERXdNRFEwTWpJMldoY05Nall4TURFd01EUTBNakkyV2pCZU1Rc3dDUVlEVlFRR0V3SkwKVWpFT01Bd0dBMVVFQ0F3RlUyVnZkV3d4RFRBTEJnTlZCQWNNQkVkQlUwNHhEREFLQmdOVkJBb01BMFJGVmpFUQpNQTRHQTFVRUN3d0hTa0ZaTGtOUFVqRVFNQTRHQTFVRUF3d0hVazlQVkMxRFFUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMYkZPU2dMOEUveDk3VGVBdENqWDllTnlleXZkcS9GSWV0V2l2bk0KSWtaSWhqakZleG4rQXB0azZodFU2U1JabFdvNncvcExJRmJDUlZKbWdNY0s5WVRQenJHQ1FmUjRtOGhvdnN4dQo0aWNLU2tCR0o3YWd0RWI5MU1tSzk3SjFrelNHbm5EVXhQQVRRVnFtWVhZekdiWWhXRGpROURuQ3IwV3Rrb0xECkxwZU4yVERYcW5FcFY3K0dhaEpxWmhnc1VHUkJtcDR4VWttUFpDRWFSZkNrMHg4bVkvVFUyR1NRaTl1Y0dDQm4KN2RQQ1dXeEtNemFQNFkwMm5TSlgvY3FRTmxVS0FDOGlHZ2xwdllaRno3U29hNmxaak8yZXlVbEtXQnc3RGh0eQpiUHFrdjlicEc5aWRCdTU3Y2NuZ1dML0c5SnBFMTBSMEkxUXJJK0h5aUFTRThhOENBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRkprZ3VDTVBFT1c3YzN4NnBVa3Vwb0F2RkovcU1COEdBMVVkSXdRWU1CYUFGSmtndUNNUEVPVzcKYzN4NnBVa3Vwb0F2RkovcU1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRUUzd3hoak5xZzhxUFQ1UC9MNTFKSWlaaWxGbk95cTJjOGg5L0dYVHl2Rmp1ZXB5MkFOeUtMaEJwcjlCNXhYCkVqY3JqWCtyT044OWJIRkFRamlnWTJadGVvRGNyNjhVb1d3cExETC8zU1BPTEcvTnN2TnNUTFJTQkxSK01CdE0KQUJVNzUwM0o4WSszZWY3K0N0MElmVzdWTWNnRnpheWNIaXRkZDZON0x5YTJsVW9vUnNFZmNXSjZqWXlUNEVaTgoxVjc4STEwWHE4aW56ZVFVT3JjaEhQY3Y3VHF6ay9wVG9aMWI0K3hLZFJJTExsYUo1SmQ1R1MrWVU2R3FRb2VmClNlcWlRRmlzODJxdzFFS2xCOFVxNGVFejZENXdjNnF5U0pLd25tY2FOMVNxcld4YnlHSk53TGtyWkZmQXdPNWwKc2N6WjVvdE54TTJUOFgyV2Z4MUtPZW89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
---
apiVersion: v1
kind: Secret
metadata:
labels:
app: harbor
release: harbor
name: harbor-core
namespace: harbor
type: Opaque
data:
CSRF_KEY: Tk9ORjNTYjZoZ2tIdlZmcXNlcTVEdjNhUlBjWDZ6Rjg=
HARBOR_ADMIN_PASSWORD: UmxheG9kbXM5MCFA
POSTGRESQL_PASSWORD: UmxheG9kbXM5MCFA
REGISTRY_CREDENTIAL_PASSWORD: aGFyYm9yX3JlZ2lzdHJ5X3Bhc3N3b3Jk
secret: RTRQY0FxZ3RPVmdKWTBRRw==
secretKey: bm90LWEtc2VjdXJlLWtleQ==
tls.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURuVENDQW9XZ0F3SUJBZ0lVZG82RjNaejRhT2JjazdreDJwbHdHQVJreHBZd0RRWUpLb1pJaHZjTkFRRUwKQlFBd1hqRUxNQWtHQTFVRUJoTUNTMUl4RGpBTUJnTlZCQWdNQlZObGIzVnNNUTB3Q3dZRFZRUUhEQVJIUVZOTwpNUXd3Q2dZRFZRUUtEQU5FUlZZeEVEQU9CZ05WQkFzTUIwcEJXUzVEVDFJeEVEQU9CZ05WQkFNTUIxSlBUMVF0ClEwRXdIaGNOTWpReE1ERXdNRFEwTWpJMldoY05Nall4TURFd01EUTBNakkyV2pCZU1Rc3dDUVlEVlFRR0V3SkwKVWpFT01Bd0dBMVVFQ0F3RlUyVnZkV3d4RFRBTEJnTlZCQWNNQkVkQlUwNHhEREFLQmdOVkJBb01BMFJGVmpFUQpNQTRHQTFVRUN3d0hTa0ZaTGtOUFVqRVFNQTRHQTFVRUF3d0hVazlQVkMxRFFUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMYkZPU2dMOEUveDk3VGVBdENqWDllTnlleXZkcS9GSWV0V2l2bk0KSWtaSWhqakZleG4rQXB0azZodFU2U1JabFdvNncvcExJRmJDUlZKbWdNY0s5WVRQenJHQ1FmUjRtOGhvdnN4dQo0aWNLU2tCR0o3YWd0RWI5MU1tSzk3SjFrelNHbm5EVXhQQVRRVnFtWVhZekdiWWhXRGpROURuQ3IwV3Rrb0xECkxwZU4yVERYcW5FcFY3K0dhaEpxWmhnc1VHUkJtcDR4VWttUFpDRWFSZkNrMHg4bVkvVFUyR1NRaTl1Y0dDQm4KN2RQQ1dXeEtNemFQNFkwMm5TSlgvY3FRTmxVS0FDOGlHZ2xwdllaRno3U29hNmxaak8yZXlVbEtXQnc3RGh0eQpiUHFrdjlicEc5aWRCdTU3Y2NuZ1dML0c5SnBFMTBSMEkxUXJJK0h5aUFTRThhOENBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRkprZ3VDTVBFT1c3YzN4NnBVa3Vwb0F2RkovcU1COEdBMVVkSXdRWU1CYUFGSmtndUNNUEVPVzcKYzN4NnBVa3Vwb0F2RkovcU1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRUUzd3hoak5xZzhxUFQ1UC9MNTFKSWlaaWxGbk95cTJjOGg5L0dYVHl2Rmp1ZXB5MkFOeUtMaEJwcjlCNXhYCkVqY3JqWCtyT044OWJIRkFRamlnWTJadGVvRGNyNjhVb1d3cExETC8zU1BPTEcvTnN2TnNUTFJTQkxSK01CdE0KQUJVNzUwM0o4WSszZWY3K0N0MElmVzdWTWNnRnpheWNIaXRkZDZON0x5YTJsVW9vUnNFZmNXSjZqWXlUNEVaTgoxVjc4STEwWHE4aW56ZVFVT3JjaEhQY3Y3VHF6ay9wVG9aMWI0K3hLZFJJTExsYUo1SmQ1R1MrWVU2R3FRb2VmClNlcWlRRmlzODJxdzFFS2xCOFVxNGVFejZENXdjNnF5U0pLd25tY2FOMVNxcld4YnlHSk53TGtyWkZmQXdPNWwKc2N6WjVvdE54TTJUOFgyV2Z4MUtPZW89Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBNENCZnhHTW8xb3pNWld0cXVKNmJUdndPNHhSRy9MTWFVcEF3WUlRNElJUXZtazloCmJkL24vMW85TmpWdDB2QzRqUmU0TFkxbzNUcWk0YWdCbWFWOW1CWTBjZmlRakluSTdybFFJOVpDN25zNXIyZ0gKdngrRGhzVExPQ0I1Mit1b05UdkdJdDYrRzUzbm53c3YxNmx6Qy9GU2M0ZEwzaURacjlQazJOWk55NUhFRC8yawpVQU43ejZ3bmNDRE4vNlVQdlR3aFdncmNtQmpTMjZhQjBMVzU2bk1FZzhTSHErREd2OVlhYXlySDgrYkV0RlVBCllJU2JPcCs3RTRIZVI5c011dmw3VVg5WW1RbG9DN0oxQnljaExuTGdXWlhBU0p0ODd0eW45RkpiaTI1bGVjeVIKTU9oYmxvQSt0SjgyZWlORTRuZXBxOTdXWTZpY3Jqei9aZTd5OVFJREFRQUJBb0lCQUFPNjdqVWJ6R0p6d2ZRZgpLMDNLei8xcXl3bWkvUUo0TGFRNW82QjdtdDZKckt3bURaSlJVM0JuelZTQlk2UkszdHQwVFZ1dXVwUFNCY041Ck14dWVTajZWZ2daeWsxOVBiTUZ5WXAvU0VWZWNRK3ZFTUxyUTJMVE53aThiTlVRQWdsSnVmZi8zRXBWdGxaMEwKUjk3UVFtcXN0OGxWODJDTlRlb3ovZDlSQThielRHV2o5c3FlOS9wY28rb09FV0xPWXNMeE9lWXBFSjdXejhIWQoxalhtRnpid1Jlcnp3Q3RuMVFLeDRKYU4wVWpSTkY3dEpKV2c1VEo0YTVLSkdNaHhZdE5NQ3UvaVBObjNIMnpDCnBJK2x0SmNMMkIwcXBRdzZCMHZ2d1ZHblNNS05weWlHK0dRQk5XRFZLYVR4TXZZT1g0YXpWWmkzS29nU0lETkcKaVZpaTZYa0NnWUVBNzYwN3pFQmIzSmJMakVlNGR2cUErdkJKMGpQNDNBQlNSWElSM3AyaW45VjRJMlpEbHN6NAowem9aelVpS3NYSVAvRlI0bGJHQXJMYzFwMDdSYmpJWUdRaXFzU2N6UCtqMGhDYVJpOWZoaXRVOUJBSk1lT24rCnRZbmxmZ3VZU2ZRa0t4Qk03ck90WnJNdkV2OW5aUXNDYmFGOTV4cDFNKzV2aFoxRHg5OXZ2VDBDZ1lFQTcyUUYKb1QwUko4eVlCTWs5bEYyQUwzcSsxRjQ3SUZ2VFVpd0NIS2tkL1NYd3BSaW5IQ0xwQnZBRjBFcGU0UVcrVkdiSQpEY3UyV0dVY1E0cFRpZk9TcUc2Um4rQ3RjUzViVTRYUytUR09aLzZobkFmSGYyQTh4OTg3aE9DTCtHWVU5Y2RLClFuR1czcFRxMkxkdEFDTnEzcUV0VXhMSjNOZkNyYlZ4ZVBkaTJCa0NnWUVBbTJGTVRncy9Rby9FSUFwekRUY3oKblB0Z2NGVGZOZ2xEVE9BNXMzK3dhVHhrS1ZibjVJQzNvNENjTDVpaXlZenZ6aDhaR2JxOGQ3eENuVmVjc0hycgpZbmRhNllSSFZseDVBSjljWmpPcmRXenVwSVcwL0FKKzdVUWJzbzVqeVRYc3FMcGxsYTZJY1BjalFvYXZpak1MCi9QVGdBWTRHZzRkRlozTGYrVmppUU9VQ2dZRUFnNlJHTUVlTGtvNUFub2tua3RuajdyZ2FEbUNQTlJrcDJRc1kKVWpoeHBFN2p5WFlJRjBIZlVSQldzaGJqbSt4em9LZ3dwTjE4TlpuTWRCdXlHcTlWMjhlSnp4aFhhR0RzbWI2QwpxTVFtb210MDVYK2xwaGIrOVk1OWhYR1JweFJEdkhCT0ZzR3VERkpwM3FqbmlPYnhFdUloTVlpb2R3Z3pKeUVhCitFRmFHcWtDZ1lCSnhuWU1CNzlTa1M1Z1NvTnJnNjJRV3JBcElvZ2dTTkFCNnA3Q1NJbTFldXcvYlBvYVB1aEcKL0V4c0ZGenZ2ayt2TWFycVU0VFNJYkRHcjRkRXZHRm8yM3NQYVNvcVFVZDVRbmg3RGd6RVh5RjhmUGxBV2RxTQpuTTU0aUFnZ2Fyc1paSk9CSnpvQzQveDdwVEJta3RDYkNPVnNVakpDdWZCa0luOXU0UWJjMmc9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQ==
---

824
on-premise/main/harbor_2.9.1/3.harbor.yaml
View File

@ -1,824 +0,0 @@
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-core
namespace: harbor
spec:
ports:
- name: http-web
port: 80
targetPort: 8080
selector:
app: harbor
component: core
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-database
namespace: harbor
spec:
ports:
- port: 5432
selector:
app: harbor
component: database
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-jobservice
namespace: harbor
spec:
ports:
- name: http-jobservice
port: 80
targetPort: 8080
selector:
app: harbor
component: jobservice
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-portal
namespace: harbor
spec:
ports:
- port: 80
targetPort: 8080
selector:
app: harbor
component: portal
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-redis
namespace: harbor
spec:
ports:
- port: 6379
selector:
app: harbor
component: redis
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-registry
namespace: harbor
spec:
ports:
- name: http-registry
port: 5000
- name: http-controller
port: 8080
selector:
app: harbor
component: registry
release: harbor
---
apiVersion: v1
kind: Service
metadata:
labels:
app: harbor
release: harbor
name: harbor-trivy
namespace: harbor
spec:
ports:
- name: http-trivy
port: 8080
protocol: TCP
selector:
app: harbor
component: trivy
release: harbor
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: harbor
component: jobservice
release: harbor
name: harbor-jobservice
namespace: harbor
spec:
accessModes:
- ReadWriteMany
storageClassName: sc-monitoring
resources:
requests:
storage: 10Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
labels:
app: harbor
component: registry
release: harbor
name: harbor-registry
namespace: harbor
spec:
storageClassName: sc-monitoring
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: core
release: harbor
name: harbor-core
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: core
release: harbor
template:
metadata:
labels:
app: harbor
component: core
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: CORE_SECRET
valueFrom:
secretKeyRef:
key: secret
name: harbor-core
- name: JOBSERVICE_SECRET
valueFrom:
secretKeyRef:
key: JOBSERVICE_SECRET
name: harbor-jobservice
envFrom:
- configMapRef:
name: harbor-core
- secretRef:
name: harbor-core
image: reg.inje-private.com/nnd002/goharbor/harbor-core:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 2
httpGet:
path: /api/v2.0/ping
port: 8080
scheme: HTTP
periodSeconds: 10
name: core
ports:
- containerPort: 8080
readinessProbe:
failureThreshold: 2
httpGet:
path: /api/v2.0/ping
port: 8080
scheme: HTTP
periodSeconds: 10
startupProbe:
failureThreshold: 360
httpGet:
path: /api/v2.0/ping
port: 8080
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
volumeMounts:
- mountPath: /etc/core/app.conf
name: config
subPath: app.conf
- mountPath: /etc/core/key
name: secret-key
subPath: key
- mountPath: /etc/core/private_key.pem
name: token-service-private-key
subPath: tls.key
- mountPath: /etc/core/ca
name: ca-download
- mountPath: /etc/core/token
name: psc
securityContext:
fsGroup: 10000
runAsUser: 10000
terminationGracePeriodSeconds: 120
volumes:
- configMap:
items:
- key: app.conf
path: app.conf
name: harbor-core
name: config
- name: secret-key
secret:
items:
- key: secretKey
path: key
secretName: harbor-core
- name: token-service-private-key
secret:
secretName: harbor-core
- name: ca-download
secret:
secretName: harbor-cacerts
- emptyDir: {}
name: psc
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: jobservice
release: harbor
name: harbor-jobservice
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: jobservice
release: harbor
strategy:
type: RollingUpdate
template:
metadata:
labels:
app: harbor
component: jobservice
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: CORE_SECRET
valueFrom:
secretKeyRef:
key: secret
name: harbor-core
envFrom:
- configMapRef:
name: harbor-jobservice-env
- secretRef:
name: harbor-jobservice
image: reg.inje-private.com/nnd002/goharbor/harbor-jobservice:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /api/v1/stats
port: 8080
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: jobservice
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /api/v1/stats
port: 8080
scheme: HTTP
initialDelaySeconds: 20
periodSeconds: 10
volumeMounts:
- mountPath: /etc/jobservice/config.yml
name: jobservice-config
subPath: config.yml
- mountPath: /var/log/jobs
name: job-logs
subPath: null
securityContext:
fsGroup: 10000
runAsUser: 10000
terminationGracePeriodSeconds: 120
volumes:
- configMap:
name: harbor-jobservice
name: jobservice-config
- name: job-logs
persistentVolumeClaim:
claimName: harbor-jobservice
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: portal
release: harbor
name: harbor-portal
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: portal
release: harbor
template:
metadata:
labels:
app: harbor
component: portal
release: harbor
spec:
automountServiceAccountToken: false
containers:
- image: reg.inje-private.com/nnd002/goharbor/harbor-portal:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /
port: 8080
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: portal
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /
port: 8080
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
volumeMounts:
- mountPath: /etc/nginx/nginx.conf
name: portal-config
subPath: nginx.conf
securityContext:
fsGroup: 10000
runAsUser: 10000
volumes:
- configMap:
name: harbor-portal
name: portal-config
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: harbor
component: registry
release: harbor
name: harbor-registry
namespace: harbor
spec:
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: harbor
component: registry
release: harbor
strategy:
type: RollingUpdate
template:
metadata:
labels:
app: harbor
component: registry
release: harbor
spec:
automountServiceAccountToken: false
containers:
- args:
- serve
- /etc/registry/config.yml
env: null
envFrom:
- secretRef:
name: harbor-registry
image: reg.inje-private.com/nnd002/goharbor/registry-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /
port: 5000
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: registry
ports:
- containerPort: 5000
- containerPort: 5001
readinessProbe:
httpGet:
path: /
port: 5000
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
volumeMounts:
- mountPath: /storage
name: registry-data
subPath: null
- mountPath: /etc/registry/passwd
name: registry-htpasswd
subPath: passwd
- mountPath: /etc/registry/config.yml
name: registry-config
subPath: config.yml
- env:
- name: CORE_SECRET
valueFrom:
secretKeyRef:
key: secret
name: harbor-core
- name: JOBSERVICE_SECRET
valueFrom:
secretKeyRef:
key: JOBSERVICE_SECRET
name: harbor-jobservice
envFrom:
- configMapRef:
name: harbor-registryctl
- secretRef:
name: harbor-registry
- secretRef:
name: harbor-registryctl
image: reg.inje-private.com/nnd002/goharbor/harbor-registryctl:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
httpGet:
path: /api/health
port: 8080
scheme: HTTP
initialDelaySeconds: 300
periodSeconds: 10
name: registryctl
ports:
- containerPort: 8080
readinessProbe:
httpGet:
path: /api/health
port: 8080
scheme: HTTP
initialDelaySeconds: 1
periodSeconds: 10
volumeMounts:
- mountPath: /storage
name: registry-data
subPath: null
- mountPath: /etc/registry/config.yml
name: registry-config
subPath: config.yml
- mountPath: /etc/registryctl/config.yml
name: registry-config
subPath: ctl-config.yml
securityContext:
fsGroup: 10000
fsGroupChangePolicy: OnRootMismatch
runAsUser: 10000
terminationGracePeriodSeconds: 120
volumes:
- name: registry-htpasswd
secret:
items:
- key: REGISTRY_HTPASSWD
path: passwd
secretName: harbor-registry-htpasswd
- configMap:
name: harbor-registry
name: registry-config
- name: registry-data
persistentVolumeClaim:
claimName: harbor-registry
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app: harbor
component: database
release: harbor
name: harbor-database
namespace: harbor
spec:
replicas: 1
selector:
matchLabels:
app: harbor
component: database
release: harbor
serviceName: harbor-database
template:
metadata:
labels:
app: harbor
component: database
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: PGDATA
value: /var/lib/postgresql/data/pgdata
envFrom:
- secretRef:
name: harbor-database
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
exec:
command:
- /docker-healthcheck.sh
initialDelaySeconds: 300
periodSeconds: 10
timeoutSeconds: 1
name: database
readinessProbe:
exec:
command:
- /docker-healthcheck.sh
initialDelaySeconds: 1
periodSeconds: 10
timeoutSeconds: 1
volumeMounts:
- mountPath: /var/lib/postgresql/data
name: database-data
- mountPath: /dev/shm
name: shm-volume
initContainers:
- args:
- -c
- '[ -e /var/lib/postgresql/data/postgresql.conf ] && [ ! -d /var/lib/postgresql/data/pgdata
] && mkdir -m 0700 /var/lib/postgresql/data/pgdata && mv /var/lib/postgresql/data/*
/var/lib/postgresql/data/pgdata/ || true'
command:
- /bin/sh
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
name: data-migrator
volumeMounts:
- mountPath: /var/lib/postgresql/data
name: database-data
- args:
- -c
- chmod -R 700 /var/lib/postgresql/data/pgdata || true
command:
- /bin/sh
image: reg.inje-private.com/nnd002/goharbor/harbor-db:v2.9.1
imagePullPolicy: IfNotPresent
name: data-permissions-ensurer
volumeMounts:
- mountPath: /var/lib/postgresql/data
name: database-data
securityContext:
fsGroup: 999
runAsUser: 999
terminationGracePeriodSeconds: 120
volumes:
- emptyDir:
medium: Memory
sizeLimit: 512Mi
name: shm-volume
volumeClaimTemplates:
- metadata:
annotations: null
labels:
app: harbor
release: harbor
name: database-data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app: harbor
component: redis
release: harbor
name: harbor-redis
namespace: harbor
spec:
replicas: 1
selector:
matchLabels:
app: harbor
component: redis
release: harbor
serviceName: harbor-redis
template:
metadata:
labels:
app: harbor
component: redis
release: harbor
spec:
automountServiceAccountToken: false
containers:
- image: reg.inje-private.com/nnd002/goharbor/redis-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
initialDelaySeconds: 300
periodSeconds: 10
tcpSocket:
port: 6379
name: redis
readinessProbe:
initialDelaySeconds: 1
periodSeconds: 10
tcpSocket:
port: 6379
volumeMounts:
- mountPath: /var/lib/redis
name: data
securityContext:
fsGroup: 999
runAsUser: 999
terminationGracePeriodSeconds: 120
volumeClaimTemplates:
- metadata:
annotations: null
labels:
app: harbor
release: harbor
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
labels:
app: harbor
component: trivy
release: harbor
name: harbor-trivy
namespace: harbor
spec:
replicas: 1
selector:
matchLabels:
app: harbor
component: trivy
release: harbor
serviceName: harbor-trivy
template:
metadata:
labels:
app: harbor
component: trivy
release: harbor
spec:
automountServiceAccountToken: false
containers:
- env:
- name: HTTP_PROXY
value: ""
- name: HTTPS_PROXY
value: ""
- name: NO_PROXY
value: harbor-core,harbor-jobservice,harbor-database,harbor-registry,harbor-portal,harbor-trivy,harbor-exporter,127.0.0.1,localhost,.local,.internal
- name: SCANNER_LOG_LEVEL
value: info
- name: SCANNER_TRIVY_CACHE_DIR
value: /home/scanner/.cache/trivy
- name: SCANNER_TRIVY_REPORTS_DIR
value: /home/scanner/.cache/reports
- name: SCANNER_TRIVY_DEBUG_MODE
value: "false"
- name: SCANNER_TRIVY_VULN_TYPE
value: os,library
- name: SCANNER_TRIVY_TIMEOUT
value: 5m0s
- name: SCANNER_TRIVY_GITHUB_TOKEN
valueFrom:
secretKeyRef:
key: gitHubToken
name: harbor-trivy
- name: SCANNER_TRIVY_SEVERITY
value: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
- name: SCANNER_TRIVY_IGNORE_UNFIXED
value: "false"
- name: SCANNER_TRIVY_SKIP_UPDATE
value: "false"
- name: SCANNER_TRIVY_OFFLINE_SCAN
value: "false"
- name: SCANNER_TRIVY_SECURITY_CHECKS
value: vuln
- name: SCANNER_TRIVY_INSECURE
value: "false"
- name: SCANNER_API_SERVER_ADDR
value: :8080
- name: SCANNER_REDIS_URL
valueFrom:
secretKeyRef:
key: redisURL
name: harbor-trivy
- name: SCANNER_STORE_REDIS_URL
valueFrom:
secretKeyRef:
key: redisURL
name: harbor-trivy
- name: SCANNER_JOB_QUEUE_REDIS_URL
valueFrom:
secretKeyRef:
key: redisURL
name: harbor-trivy
image: reg.inje-private.com/nnd002/goharbor/trivy-adapter-photon:v2.9.1
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 10
httpGet:
path: /probe/healthy
port: api-server
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
name: trivy
ports:
- containerPort: 8080
name: api-server
readinessProbe:
failureThreshold: 3
httpGet:
path: /probe/ready
port: api-server
scheme: HTTP
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
resources:
limits:
cpu: 1
memory: 1Gi
requests:
cpu: 200m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
privileged: false
volumeMounts:
- mountPath: /home/scanner/.cache
name: data
readOnly: false
securityContext:
fsGroup: 10000
runAsUser: 10000
volumeClaimTemplates:
- metadata:
labels:
app: harbor
release: harbor
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 50Gi

64
on-premise/main/harbor_2.9.1/4.ing-harbor.yaml
View File

@ -1,64 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/proxy-body-size: "0"
#nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
labels:
app: harbor
release: harbor
name: harbor-ingress
namespace: harbor
spec:
ingressClassName: nginx
tls:
- hosts:
- "harbor.icurfer.com"
secretName: harbor-ssl
rules:
- host: harbor.inje-private.com
http:
paths:
- backend:
service:
name: harbor-core
port:
number: 80
path: /api/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /service/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /v2/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /chartrepo/
pathType: Prefix
- backend:
service:
name: harbor-core
port:
number: 80
path: /c/
pathType: Prefix
- backend:
service:
name: harbor-portal
port:
number: 80
path: /
pathType: Prefix

12
on-premise/main/harbor_2.9.1/pv-delete.py
View File

@ -1,12 +0,0 @@
#!/usr/bin/python3
import os
import subprocess
pv_str = os.popen("kubectl get -n default pv | grep harbor | awk '$1 > 0 {print $1}'").read()
print(pv_str)
pv_list = pv_str.split('\n')
i = 0
for pv in pv_list:
print(pv)
# os.system(f"kubectl delete -n {ns} pv {pv}")
os.system(f"kubectl delete pv {pv}")

BIN
on-premise/main/helm/helm-v3.9.0-linux-amd64.tar.gz
View File

Binary file not shown.

663
on-premise/main/ingress-nginx/deploy_v1.11.2.yaml
View File

@ -1,663 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
labels:
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
name: ingress-nginx
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx
namespace: ingress-nginx
---
apiVersion: v1
automountServiceAccountToken: true
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx
namespace: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- endpoints
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- coordination.k8s.io
resourceNames:
- ingress-nginx-leader
resources:
- leases
verbs:
- get
- update
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- create
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission
namespace: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx
rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
- secrets
- namespaces
verbs:
- list
- watch
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- list
- watch
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- watch
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- networking.k8s.io
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- networking.k8s.io
resources:
- ingressclasses
verbs:
- get
- list
- watch
- apiGroups:
- discovery.k8s.io
resources:
- endpointslices
verbs:
- list
- watch
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- validatingwebhookconfigurations
verbs:
- get
- update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx
namespace: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ingress-nginx
subjects:
- kind: ServiceAccount
name: ingress-nginx
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission
namespace: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
name: ingress-nginx-admission
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: ingress-nginx
subjects:
- kind: ServiceAccount
name: ingress-nginx
namespace: ingress-nginx
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: ingress-nginx-admission
subjects:
- kind: ServiceAccount
name: ingress-nginx-admission
namespace: ingress-nginx
---
apiVersion: v1
data:
allow-snippet-annotations: "false"
kind: ConfigMap
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-controller
namespace: ingress-nginx
---
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-controller
namespace: ingress-nginx
spec:
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
ports:
- appProtocol: http
name: http
port: 80
protocol: TCP
targetPort: http
nodePort: 30100 # by.sdjo
- appProtocol: https
name: https
port: 443
protocol: TCP
targetPort: https
nodePort: 30101 # by.sdjo
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
type: NodePort
---
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-controller-admission
namespace: ingress-nginx
spec:
ports:
- appProtocol: https
name: https-webhook
port: 443
targetPort: webhook
selector:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-controller
namespace: ingress-nginx
spec:
minReadySeconds: 0
revisionHistoryLimit: 10
selector:
matchLabels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
strategy:
rollingUpdate:
maxUnavailable: 1
type: RollingUpdate
template:
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
spec:
containers:
- args:
- /nginx-ingress-controller
- --election-id=ingress-nginx-leader
- --controller-class=k8s.io/ingress-nginx
- --ingress-class=nginx
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
- --validating-webhook=:8443
- --validating-webhook-certificate=/usr/local/certificates/cert
- --validating-webhook-key=/usr/local/certificates/key
- --enable-metrics=false
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
- name: LD_PRELOAD
value: /usr/local/lib/libmimalloc.so
image: reg.inje-private.com/nnd002/ingress-nginx/controller:v1.11.2 # by.ljh
imagePullPolicy: IfNotPresent
lifecycle:
preStop:
exec:
command:
- /wait-shutdown
livenessProbe:
failureThreshold: 5
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
name: controller
ports:
- containerPort: 80
name: http
protocol: TCP
- containerPort: 443
name: https
protocol: TCP
- containerPort: 8443
name: webhook
protocol: TCP
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthz
port: 10254
scheme: HTTP
initialDelaySeconds: 10
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 1
resources:
requests:
cpu: 100m
memory: 90Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
readOnlyRootFilesystem: false
runAsNonRoot: true
runAsUser: 101
seccompProfile:
type: RuntimeDefault
volumeMounts:
- mountPath: /usr/local/certificates/
name: webhook-cert
readOnly: true
dnsPolicy: ClusterFirst
nodeSelector:
kubernetes.io/os: linux
serviceAccountName: ingress-nginx
terminationGracePeriodSeconds: 300
volumes:
- name: webhook-cert
secret:
secretName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission-create
namespace: ingress-nginx
spec:
template:
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission-create
spec:
containers:
- args:
- create
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
- --namespace=$(POD_NAMESPACE)
- --secret-name=ingress-nginx-admission
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
imagePullPolicy: IfNotPresent
name: create
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65532
seccompProfile:
type: RuntimeDefault
nodeSelector:
kubernetes.io/os: linux
restartPolicy: OnFailure
serviceAccountName: ingress-nginx-admission
---
apiVersion: batch/v1
kind: Job
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission-patch
namespace: ingress-nginx
spec:
template:
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission-patch
spec:
containers:
- args:
- patch
- --webhook-name=ingress-nginx-admission
- --namespace=$(POD_NAMESPACE)
- --patch-mutating=false
- --secret-name=ingress-nginx-admission
- --patch-failure-policy=Fail
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
image: reg.inje-private.com/nnd002/ingress-nginx/kube-webhook-certgen:v1.4.3 #by.ljh
imagePullPolicy: IfNotPresent
name: patch
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 65532
seccompProfile:
type: RuntimeDefault
nodeSelector:
kubernetes.io/os: linux
restartPolicy: OnFailure
serviceAccountName: ingress-nginx-admission
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
labels:
app.kubernetes.io/component: controller
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: nginx
spec:
controller: k8s.io/ingress-nginx
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app.kubernetes.io/component: admission-webhook
app.kubernetes.io/instance: ingress-nginx
app.kubernetes.io/name: ingress-nginx
app.kubernetes.io/part-of: ingress-nginx
app.kubernetes.io/version: 1.11.2
name: ingress-nginx-admission
webhooks:
- admissionReviewVersions:
- v1
clientConfig:
service:
name: ingress-nginx-controller-admission
namespace: ingress-nginx
path: /networking/v1/ingresses
failurePolicy: Fail
matchPolicy: Equivalent
name: validate.nginx.ingress.kubernetes.io
rules:
- apiGroups:
- networking.k8s.io
apiVersions:
- v1
operations:
- CREATE
- UPDATE
resources:
- ingresses
sideEffects: None

32
on-premise/main/ingress-nginx/ingress_img_pull.py
View File

@ -1,32 +0,0 @@
#!/usr/bin/python3
import os
import time
img_list = [
"registry.k8s.io/ingress-nginx/controller:v1.11.2@sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce",
"registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.3@sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3"
]
public_registry_list = [
"registry.k8s.io",
]
registry_path = "reg.inje-private.com"
harbor_project_name = "nnd002"
for var in img_list:
os.system(f"docker pull {var}")
for foo in public_registry_list:
if var.startswith(foo):
private_img_path = var.replace(foo, f"{registry_path}/{harbor_project_name}")
break
private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
# else: ljh 수정
# private_img_path = f"{registry_path}/{harbor_project_name}/{var}"
time.sleep(1)
# os.system(f"echo {private_img_path}")
os.system(f"docker tag {var} {private_img_path}")
os.system(f"docker push {private_img_path}")

197
on-premise/main/metrics-server/metric-server_v0.6.4.yaml
View File

@ -1,197 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
k8s-app: metrics-server
name: metrics-server
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
k8s-app: metrics-server
rbac.authorization.k8s.io/aggregate-to-admin: "true"
rbac.authorization.k8s.io/aggregate-to-edit: "true"
rbac.authorization.k8s.io/aggregate-to-view: "true"
name: system:aggregated-metrics-reader
rules:
- apiGroups:
- metrics.k8s.io
resources:
- pods
- nodes
verbs:
- get
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
k8s-app: metrics-server
name: system:metrics-server
rules:
- apiGroups:
- ""
resources:
- nodes/metrics
verbs:
- get
- apiGroups:
- ""
resources:
- pods
- nodes
verbs:
- get
- list
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
k8s-app: metrics-server
name: metrics-server-auth-reader
namespace: kube-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: extension-apiserver-authentication-reader
subjects:
- kind: ServiceAccount
name: metrics-server
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
k8s-app: metrics-server
name: metrics-server:system:auth-delegator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:auth-delegator
subjects:
- kind: ServiceAccount
name: metrics-server
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
k8s-app: metrics-server
name: system:metrics-server
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: system:metrics-server
subjects:
- kind: ServiceAccount
name: metrics-server
namespace: kube-system
---
apiVersion: v1
kind: Service
metadata:
labels:
k8s-app: metrics-server
name: metrics-server
namespace: kube-system
spec:
ports:
- name: https
port: 443
protocol: TCP
targetPort: https
selector:
k8s-app: metrics-server
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
k8s-app: metrics-server
name: metrics-server
namespace: kube-system
spec:
selector:
matchLabels:
k8s-app: metrics-server
strategy:
rollingUpdate:
maxUnavailable: 0
template:
metadata:
labels:
k8s-app: metrics-server
spec:
containers:
- args:
- --cert-dir=/tmp
- --secure-port=4443
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
- --kubelet-use-node-status-port
- --metric-resolution=15s
- --kubelet-insecure-tls
image: reg.inje-private.com/nnd002/metrics-server/metrics-server:v0.6.4
imagePullPolicy: IfNotPresent
livenessProbe:
failureThreshold: 3
httpGet:
path: /livez
port: https
scheme: HTTPS
periodSeconds: 10
name: metrics-server
ports:
- containerPort: 4443
name: https
protocol: TCP
readinessProbe:
failureThreshold: 3
httpGet:
path: /readyz
port: https
scheme: HTTPS
initialDelaySeconds: 20
periodSeconds: 10
resources:
requests:
cpu: 100m
memory: 200Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
volumeMounts:
- mountPath: /tmp
name: tmp-dir
nodeSelector:
kubernetes.io/os: linux
priorityClassName: system-cluster-critical
serviceAccountName: metrics-server
volumes:
- emptyDir: {}
name: tmp-dir
---
apiVersion: apiregistration.k8s.io/v1
kind: APIService
metadata:
labels:
k8s-app: metrics-server
name: v1beta1.metrics.k8s.io
spec:
group: metrics.k8s.io
groupPriorityMinimum: 100
insecureSkipTLSVerify: true
service:
name: metrics-server
namespace: kube-system
version: v1beta1
versionPriority: 100

101
on-premise/main/nfs-provisioner/1.configuration/init_add_ns.yaml
View File

@ -1,101 +0,0 @@
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
name: provision
name: nfs-pod-provisioner-sa
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
name: provision
name: nfs-pod-provisioner-otherRoles
namespace: kube-system
rules:
- apiGroups:
- ""
resources:
- endpoints
verbs:
- get
- list
- watch
- create
- update
- patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
name: provision
name: nfs-provisioner-clusterRole
rules:
- apiGroups:
- ""
resources:
- persistentvolumes
verbs:
- get
- list
- watch
- create
- delete
- apiGroups:
- ""
resources:
- persistentvolumeclaims
verbs:
- get
- list
- watch
- update
- apiGroups:
- storage.k8s.io
resources:
- storageclasses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- update
- patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
name: provision
name: nfs-pod-provisioner-otherRoles
namespace: kube-system
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: nfs-pod-provisioner-otherRoles
subjects:
- kind: ServiceAccount
name: nfs-pod-provisioner-sa
namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
name: provision
name: nfs-provisioner-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: nfs-provisioner-clusterRole
subjects:
- kind: ServiceAccount
name: nfs-pod-provisioner-sa
namespace: kube-system

38
on-premise/main/nfs-provisioner/3.deploy/\
View File

@ -1,38 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: vm-nfs
namespace: kube-system
labels:
name: provision
spec:
replicas: 1
selector:
matchLabels:
app: vm-nfs
strategy:
type: Recreate
template:
metadata:
labels:
app: vm-nfs
spec:
serviceAccountName: nfs-pod-provisioner-sa
containers:
- name: nfs-client-provisioner
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
volumeMounts:
- name: nfs-provisioner
mountPath: persistentvolumes
env:
- name: PROVISIONER_NAME
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
- name: NFS_SERVER
value: 172.17.128.249 # 주소변경
- name: NFS_PATH
value: /nfs/monitoring # nfs 연결 주소
volumes:
- name: nfs-provisioner
nfs:
server: 172.17.128.249
path: /nfs/monitoring

38
on-premise/main/nfs-provisioner/3.deploy/sample-deploy.yaml
View File

@ -1,38 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: vm-nfs
namespace: kube-system
labels:
name: provision
spec:
replicas: 1
selector:
matchLabels:
app: vm-nfs
strategy:
type: Recreate
template:
metadata:
labels:
app: vm-nfs
spec:
serviceAccountName: nfs-pod-provisioner-sa
containers:
- name: nfs-client-provisioner
image: reg.inje-private.com/nnd002/nfs-subdir-external-provisioner:v4.0.2 # provisioner를 구성하는 image
volumeMounts:
- name: nfs-provisioner
mountPath: /persistentvolumes
env:
- name: PROVISIONER_NAME
value: k8s-sigs.io/nfs-subdir-external-provisioner # SC에서 provisioner의 이름으로 사용
- name: NFS_SERVER
value: 172.17.128.249 # 주소변경
- name: NFS_PATH
value: /nfs/monitoring # nfs 연결 주소
volumes:
- name: nfs-provisioner
nfs:
server: 172.17.128.249
path: /nfs/monitoring

13
on-premise/main/nfs-provisioner/4.postSettings/sc-hm.yaml
View File

@ -1,13 +0,0 @@
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: hm-nas
annotations:
storageclass.kubernetes.io/is-default-class: "true"
labels:
name: provision
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner
parameters:
pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
onDelete: delete
archiveOnDelete: "false"

15
on-premise/main/nfs-provisioner/4.postSettings/sc-vm.yaml
View File

@ -1,15 +0,0 @@
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: vm-nfs # pvc에서 사용할 SC Name
annotations:
storageclass.kubernetes.io/is-default-class: "true"
labels:
name: provision
provisioner: vm-nfs # provisioner에서 생성한 PROVISIONER_NAME
parameters:
#pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
onDelete: Retain
#onDelete: delete
archiveOnDelete: "false"
reclaimPolicy: Retain

1
on-premise/main/rancher_v2.9.1/rancher-cleanup

@ -1 +0,0 @@
Subproject commit 1fe0b33ebd4339aeaef721c75388809bb461a4d3

1
on-premise/main/rancher_v2.9.1/rancher/.helmignore
View File

@ -1 +0,0 @@
tests

16
on-premise/main/rancher_v2.9.1/rancher/Chart.yaml
View File

@ -1,16 +0,0 @@
apiVersion: v2
appVersion: v2.9.1
description: Install Rancher Server to manage Kubernetes clusters across providers.
home: https://rancher.com
icon: https://github.com/rancher/ui/blob/master/public/assets/images/logos/welcome-cow.svg
keywords:
- rancher
kubeVersion: < 1.32.0-0
maintainers:
- email: charts@rancher.com
name: Rancher Labs
name: rancher
sources:
- https://github.com/rancher/rancher
- https://github.com/rancher/server-chart
version: 2.9.1

208
on-premise/main/rancher_v2.9.1/rancher/README.md
View File

@ -1,208 +0,0 @@
By installing this application, you accept the [End User License Agreement & Terms & Conditions](https://www.suse.com/licensing/eula/).
# Rancher
***Rancher*** is open source software that combines everything an organization needs to adopt and run containers in production. Built on Kubernetes, Rancher makes it easy for DevOps teams to test, deploy and manage their applications.
### Introduction
This chart bootstraps a [Rancher Server](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster) on a Kubernetes cluster using the [Helm](https://helm.sh/) package manager. For a Rancher Supported Deployment please follow our [HA install instructions](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs).
### Prerequisites Details
*For installations covered under [Rancher Support SLA](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions) the target cluster must be **[RKE1](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke1-for-rancher)**, **[RKE2](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/rke2-for-rancher)**, **[K3s](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/k3s-for-rancher)**, **[AKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks)**, **[EKS](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks)**, or **[GKE](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke)**.*
Make sure the node(s) for the Rancher server fulfill the following requirements:
[Operating Systems and Container Runtime Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#operating-systems-and-container-runtime-requirements)
[Hardware Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#hardware-requirements)
- [CPU and Memory](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#cpu-and-memory)
- [Ingress](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#ingress)
- [Disks](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#disks)
[Networking Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#networking-requirements)
- [Node IP Addresses](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#node-ip-addresses)
- [Port Requirements](https://ranchermanager.docs.rancher.com/pages-for-subheaders/installation-requirements#port-requirements)
[Install the Required CLI Tools](https://ranchermanager.docs.rancher.com/pages-for-subheaders/cli-with-rancher)
- [kubectl](https://ranchermanager.docs.rancher.com/reference-guides/cli-with-rancher/kubectl-utility) - Kubernetes command-line tool.
- [helm](https://docs.helm.sh/using_helm/#installing-helm) - Package management for Kubernetes. Refer to the [Helm version requirements](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/resources/helm-version-requirements) to choose a version of Helm to install Rancher.
For a list of best practices that we recommend for running the Rancher server in production, refer to the [best practices section](https://ranchermanager.docs.rancher.com/pages-for-subheaders/best-practices).
## Installing Rancher
For production environments, we recommend installing Rancher in a [high-availability Kubernetes installation](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-cluster-setup/high-availability-installs) so that your user base can always access Rancher Server. When installed in a Kubernetes cluster, Rancher will integrate with the cluster’s etcd database and take advantage of Kubernetes scheduling for high-availability.
Optional: Installing Rancher on a [Single-node](https://ranchermanager.docs.rancher.com/pages-for-subheaders/rancher-on-a-single-node-with-docker) Kubernetes Cluster
#### Add the Helm Chart Repository
Use [helm repo add](https://helm.sh/docs/helm/helm_repo_add/) command to add the Helm chart repository that contains charts to install Rancher. For more information about the repository choices and which is best for your use case, see Choosing a Version of Rancher.
```bash
helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
```
#### Create a Namespace for Rancher
We’ll need to define a Kubernetes namespace where the resources created by the Chart should be installed. This should always be cattle-system:
```bash
kubectl create namespace cattle-system
```
#### Choose your SSL Configuration
The Rancher management server is designed to be secure by default and requires SSL/TLS configuration.
There are three recommended options for the source of the certificate used for TLS termination at the Rancher server:
- [Rancher-generated TLS certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
- [Bring your own certificate](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#3-choose-your-ssl-configuration)
#### Install cert-manager
This step is only required to use certificates issued by Rancher’s generated CA **`(ingress.tls.source=rancher)`** or to request Let’s Encrypt issued certificates **`(ingress.tls.source=letsEncrypt)`**.
[These instructions are adapted from the official cert-manager documentation.](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#4-install-cert-manager)
#### Install Rancher with Helm and Your Chosen Certificate Option
- [Rancher to generated certificates](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org
```
- [Let’s Encrypt](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=letsEncrypt \
--set letsEncrypt.email=me@example.org
```
- [Certificates from Files](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#5-install-rancher-with-helm-and-your-chosen-certificate-option)
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=secret
```
*If you are using a Private CA signed certificate , add **--set privateCA=true** to the command:`*
```bash
helm install rancher rancher-latest/rancher \
--namespace cattle-system \
--set hostname=rancher.my.org \
--set ingress.tls.source=secret \
--set privateCA=true
```
#### Verify that the Rancher Server is Successfully Deployed
After adding the secrets, check if Rancher was rolled out successfully:
```bash
kubectl -n cattle-system rollout status deploy/rancher
Waiting for deployment "rancher" rollout to finish: 0 of 3 updated replicas are available...
deployment "rancher" successfully rolled out
```
If you see the following **`error: error: deployment "rancher" exceeded its progress deadline`**, you can check the status of the deployment by running the following command:
```bash
kubectl -n cattle-system get deploy rancher
NAME DESIRED CURRENT UP-TO-DATE AVAILABLE AGE
rancher 3 3 3 3 3m
```
It should show the same count for **`DESIRED`** and **`AVAILABLE`**.
#### Save Your Options
Make sure you save the **`--set`** options you used. You will need to use the same options when you upgrade Rancher to new versions with Helm.
#### Finishing Up
That’s it. You should have a functional Rancher server.
In a web browser, go to the DNS name that forwards traffic to your load balancer. Then you should be greeted by the colorful login page.
Doesn’t work? Take a look at the [Troubleshooting Page](https://ranchermanager.docs.rancher.com/troubleshooting/general-troubleshooting)
***All of these instructions are defined in detailed in the [Rancher Documentation](https://ranchermanager.docs.rancher.com/pages-for-subheaders/install-upgrade-on-a-kubernetes-cluster#install-the-rancher-helm-chart).***
### Helm Chart Options for Kubernetes Installations
The full [Helm Chart Options](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options) can be found here.
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`.
#### Common Options
| Parameter | Default Value | Description |
| ------------------------- | ------------- | -------------------------------------------------------------------------------------------- |
| `hostname` | " " | ***string*** - the Fully Qualified Domain Name for your Rancher Server |
| `ingress.tls.source` | "rancher" | ***string*** - Where to get the cert for the ingress. - "***rancher, letsEncrypt, secret***" |
| `letsEncrypt.email` | " " | ***string*** - Your email address |
| `letsEncrypt.environment` | "production" | ***string*** - Valid options: "***staging, production***" |
| `privateCA` | false | ***bool*** - Set to true if your cert is signed by a private CA |
#### Advanced Options
| Parameter | Default Value | Description |
| ---------------------------------------- | ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `additionalTrustedCAs` | false | ***bool*** - [See Additional Trusted CAs Server](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/helm-chart-options#additional-trusted-cas) |
| `addLocal` | "true" | ***string*** - As of Rancher v2.5.0 this flag is deprecated and must be set to "true" |
| `antiAffinity` | "preferred" | ***string*** - AntiAffinity rule for Rancher pods - *"preferred, required"* |
| `replicas` | 3 | ***int*** - Number of replicas of Rancher pods |
| `auditLog.destination` | "sidecar" | ***string*** - Stream to sidecar container console or hostPath volume - *"sidecar, hostPath"* |
| `auditLog.hostPath` | "/var/log/rancher/audit" | ***string*** - log file destination on host (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.level` | 0 | ***int*** - set the [API Audit Log level](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#audit-log-levels). 0 is off. [0-3] |
| `auditLog.maxAge` | 1 | ***int*** - maximum number of days to retain old audit log files (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.maxBackup` | 1 | int - maximum number of audit log files to retain (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.maxSize` | 100 | ***int*** - maximum size in megabytes of the audit log file before it gets rotated (only applies when **auditLog.destination** is set to **hostPath**) |
| `auditLog.image.repository` | "rancher/mirrored-bci-micro" | ***string*** - Location for the image used to collect audit logs *Note: Available as of v2.7.0* |
| `auditLog.image.tag` | "15.4.14.3" | ***string*** - Tag for the image used to collect audit logs *Note: Available as of v2.7.0* |
| `auditLog.image.pullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for auditLog images - *"Always", "Never", "IfNotPresent"* *Note: Available as of v2.7.0* |
| `busyboxImage` | "" | ***string*** - *Deprecated `auditlog.image.repository` should be used to control auditing sidecar image.* Image location for busybox image used to collect audit logs *Note: Available as of v2.2.0, and Deprecated as of v2.7.0* |
| `busyboxImagePullPolicy` | "IfNotPresent" | ***string*** - - *Deprecated `auditlog.image.pullPolicy` should be used to control auditing sidecar image.* Override imagePullPolicy for busybox images - *"Always", "Never", "IfNotPresent"* *Deprecated as of v2.7.0* |
| `debug` | false | ***bool*** - set debug flag on rancher server |
| `certmanager.version` | " " | ***string*** - set cert-manager compatibility |
| `extraEnv` | [] | ***list*** - set additional environment variables for Rancher Note: *Available as of v2.2.0* |
| `imagePullSecrets` | [] | ***list*** - list of names of Secret resource containing private registry credentials |
| `ingress.enabled` | true | ***bool*** - install ingress resource |
| `ingress.ingressClassName` | " " | ***string*** - class name of ingress if not set manually or by the ingress controller's defaults |
| `ingress.includeDefaultExtraAnnotations` | true | ***bool*** - Add default nginx annotations |
| `ingress.extraAnnotations` | {} | ***map*** - additional annotations to customize the ingress |
| `ingress.configurationSnippet` | " " | ***string*** - Add additional Nginx configuration. Can be used for proxy configuration. Note: *Available as of v2.0.15, v2.1.10 and v2.2.4* |
| `service.annotations` | {} | ***map*** - annotations to customize the service |
| `service.type` | " " | ***string*** - Override the type used for the service - *"NodePort", "LoadBalancer", "ClusterIP"* |
| `letsEncrypt.ingress.class` | " " | ***string*** - optional ingress class for the cert-manager acmesolver ingress that responds to the Let’s *Encrypt ACME challenges* |
| `proxy` | " " | ***string** - HTTP[S] proxy server for Rancher |
| `noProxy` | "127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local" | ***string*** - comma separated list of hostnames or ip address not to use the proxy |
| `resources` | {} | ***map*** - rancher pod resource requests & limits |
| `rancherImage` | "rancher/rancher" | ***string*** - rancher image source |
| `rancherImageTag` | same as chart version | ***string*** - rancher/rancher image tag |
| `rancherImagePullPolicy` | "IfNotPresent" | ***string*** - Override imagePullPolicy for rancher server images - *"Always", "Never", "IfNotPresent"* |
| `tls` | "ingress" | ***string*** - See External TLS Termination for details. - *"ingress, external"* |
| `systemDefaultRegistry` | "" | ***string*** - private registry to be used for all system Docker images, e.g., [http://registry.example.com/] *Available as of v2.3.0* |
| `useBundledSystemChart` | false | ***bool*** - select to use the system-charts packaged with Rancher server. This option is used for air gapped installations. *Available as of v2.3.0* |
| `customLogos.enabled` | false | ***bool*** - Enabled [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) and [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence volume |
| `customLogos.volumeSubpaths.emberUi` | "ember" | ***string*** - Volume subpath for [Ember Rancher UI (cluster manager) custom logos](https://github.com/rancher/ui/tree/master/public/assets/images/logos) persistence |
| `customLogos.volumeSubpaths.vueUi` | "vue" | ***string*** - Volume subpath for [Vue Rancher UI (cluster explorer) custom logos](https://github.com/rancher/dashboard/tree/master/shell/assets/images/pl) persistence |
| `customLogos.volumeName` | "" | ***string*** - Use an existing volume. Custom logos should be copied to the proper `volume/subpath` folder by the user. Optional for persistentVolumeClaim, required for configMap |
| `customLogos.storageClass` | "" | ***string*** - Set custom logos persistentVolumeClaim storage class. Required for dynamic pv |
| `customLogos.accessMode` | "ReadWriteOnce" | ***string*** - Set custom persistentVolumeClaim access mode |
| `customLogos.size` | "1Gi" | ***string*** - Set custom persistentVolumeClaim size |

64
on-premise/main/rancher_v2.9.1/rancher/cattle-system.json
View File

@ -1,64 +0,0 @@
{
"apiVersion": "v1",
"kind": "Namespace",
"metadata": {
"annotations": {
"cattle.io/status": "{\"Conditions\":[{\"Type\":\"ResourceQuotaInit\",\"Status\":\"True\",\"Message\":\"\",\"LastUpdateTime\":\"2024-10-14T01:51:04Z\"},{\"Type\":\"InitialRolesPopulated\",\"Status\":\"True\",\"Message\":\"\",\"LastUpdateTime\":\"2024-10-14T01:51:09Z\"}]}",
"field.cattle.io/projectId": "local:p-2mvh7",
"lifecycle.cattle.io/create.namespace-auth": "true",
"management.cattle.io/no-default-sa-token": "true"
},
"creationTimestamp": "2024-10-14T01:46:51Z",
"deletionTimestamp": "2024-10-14T01:54:44Z",
"finalizers": [
],
"labels": {
"field.cattle.io/projectId": "p-2mvh7",
"kubernetes.io/metadata.name": "cattle-system"
},
"name": "cattle-system",
"resourceVersion": "4398991",
"uid": "bc99e08c-67a1-40ed-8106-9cc109e2f6a1"
},
"spec": {},
"status": {
"conditions": [
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All resources successfully discovered",
"reason": "ResourcesDiscovered",
"status": "False",
"type": "NamespaceDeletionDiscoveryFailure"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All legacy kube types successfully parsed",
"reason": "ParsedGroupVersions",
"status": "False",
"type": "NamespaceDeletionGroupVersionParsingFailure"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All content successfully deleted, may be waiting on finalization",
"reason": "ContentDeleted",
"status": "False",
"type": "NamespaceDeletionContentFailure"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All content successfully removed",
"reason": "ContentRemoved",
"status": "False",
"type": "NamespaceContentRemaining"
},
{
"lastTransitionTime": "2024-10-14T01:54:50Z",
"message": "All content-preserving finalizers finished",
"reason": "ContentHasNoFinalizers",
"status": "False",
"type": "NamespaceFinalizersRemaining"
}
],
"phase": "Terminating"
}
}

31
on-premise/main/rancher_v2.9.1/rancher/ing.yaml
View File

@ -1,31 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ing-rancher
namespace: cattle-system
labels:
app: release-name-rancher
release: release-name
annotations:
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
spec:
ingressClassName: nginx
rules:
- host: rancher.inje-private.com # hostname to access rancher server
http:
paths:
- backend:
service:
name: rancher
port:
number: 80
pathType: ImplementationSpecific
path: /
tls:
- hosts:
- rancher.inje-private.com
secretName: cattle-ssl

BIN
on-premise/main/rancher_v2.9.1/rancher/rancher-2.9.1.tgz
View File

Binary file not shown.

94
on-premise/main/rancher_v2.9.1/rancher/scripts/post-delete-hook.sh
View File

@ -1,94 +0,0 @@
#!/bin/bash
set -e
namespaces="${NAMESPACES}"
rancher_namespace="${RANCHER_NAMESPACE}"
timeout="${TIMEOUT}"
ignoreTimeoutError="${IGNORETIMEOUTERROR}"
if [[ -z ${namespaces} ]]; then
echo "No namespace is provided."
exit 1
fi
if [[ -z ${rancher_namespace} ]]; then
echo "No rancher namespace is provided."
exit 1
fi
if [[ -z ${timeout} ]]; then
echo "No timeout value is provided."
exit 1
fi
if [[ -z ${ignoreTimeoutError} ]]; then
echo "No ignoreTimeoutError value is provided."
exit 1
fi
succeeded=()
failed=()
get_pod_count() {
kubectl get pods --selector app="${1}" -n "${2}" -o json | jq '.items | length'
}
echo "Uninstalling Rancher resources in the following namespaces: ${namespaces}"
for namespace in ${namespaces}; do
for app in $(helm list -n "${namespace}" -q); do
if [[ ${app} =~ .crd$ ]]; then
echo "--- Skip the app [${app}] in the namespace [${namespace}]"
continue
fi
echo "--- Deleting the app [${app}] in the namespace [${namespace}]"
if [[ ! $(helm uninstall "${app}" -n "${namespace}") ]]; then
failed=("${failed[@]}" "${app}")
continue
fi
t=0
while true; do
if [[ $(get_pod_count "${app}" "${namespace}") -eq 0 ]]; then
echo "successfully uninstalled [${app}] in the namespace [${namespace}]"
succeeded=("${succeeded[@]}" "${app}")
break
fi
if [[ ${t} -ge ${timeout} ]]; then
echo "timeout uninstalling [${app}] in the namespace [${namespace}]"
failed=("${failed[@]}" "${app}")
break
fi
# by default, wait 120 seconds in total for an app to be uninstalled
echo "waiting 5 seconds for pods of [${app}] to be terminated ..."
sleep 5
t=$((t + 5))
done
done
# delete the helm operator pods
for pod in $(kubectl get pods -n "${namespace}" -o name); do
if [[ ${pod} =~ ^pod\/helm-operation-* ]]; then
echo "--- Deleting the pod [${pod}] in the namespace [${namespace}]"
kubectl delete "${pod}" -n "${namespace}"
fi
done
done
echo "Removing Rancher bootstrap secret in the following namespace: ${rancher_namespace}"
kubectl --ignore-not-found=true delete secret bootstrap-secret -n "${rancher_namespace}"
echo "------ Summary ------"
if [[ ${#succeeded[@]} -ne 0 ]]; then
echo "Succeeded to uninstall the following apps:" "${succeeded[@]}"
fi
if [[ ${#failed[@]} -ne 0 ]]; then
echo "Failed to uninstall the following apps:" "${failed[@]}"
if [[ "${ignoreTimeoutError}" == "false" ]]; then
exit 2
fi
else
echo "Cleanup finished successfully."
fi

22
on-premise/main/rancher_v2.9.1/rancher/templates/NOTES.txt
View File

@ -1,22 +0,0 @@
Rancher Server has been installed.
NOTE: Rancher may take several minutes to fully initialize. Please standby while Certificates are being issued, Containers are started and the Ingress rule comes up.
Check out our docs at https://rancher.com/docs/
If you provided your own bootstrap password during installation, browse to https://{{ .Values.hostname }} to get started.
If this is the first time you installed Rancher, get started by running this command and clicking the URL it generates:
```
echo https://{{ .Values.hostname }}/dashboard/?setup=$(kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}')
```
To get just the bootstrap password on its own, run:
```
kubectl get secret --namespace cattle-system bootstrap-secret -o go-template='{{ "{{" }}.data.bootstrapPassword|base64decode{{ "}}" }}{{ "{{" }} "\n" {{ "}}" }}'
```
Happy Containering!

76
on-premise/main/rancher_v2.9.1/rancher/templates/_helpers.tpl
View File

@ -1,76 +0,0 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "rancher.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "rancher.fullname" -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{/*
Create a default fully qualified chart name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "rancher.chartname" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | trunc 63 | trimSuffix "-" -}}
{{- end -}}
# Render Values in configurationSnippet
{{- define "configurationSnippet" -}}
{{- tpl (.Values.ingress.configurationSnippet) . | nindent 6 -}}
{{- end -}}
{{/*
Generate the labels.
*/}}
{{- define "rancher.labels" -}}
app: {{ template "rancher.fullname" . }}
chart: {{ template "rancher.chartname" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
{{- end }}
# Windows Support
{{/*
Windows cluster will add default taint for linux nodes,
add below linux tolerations to workloads could be scheduled to those linux nodes
*/}}
{{- define "linux-node-tolerations" -}}
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
{{- end -}}
{{- define "linux-node-selector-terms" -}}
{{- $key := "kubernetes.io/os" -}}
- matchExpressions:
- key: {{ $key }}
operator: NotIn
values:
- windows
{{- end -}}
{{- define "system_default_registry" -}}
{{- if .Values.systemDefaultRegistry -}}
{{- if hasSuffix "/" .Values.systemDefaultRegistry -}}
{{- printf "%s" .Values.systemDefaultRegistry -}}
{{- else -}}
{{- printf "%s/" .Values.systemDefaultRegistry -}}
{{- end -}}
{{- end -}}
{{- end -}}

14
on-premise/main/rancher_v2.9.1/rancher/templates/clusterRoleBinding.yaml
View File

@ -1,14 +0,0 @@
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
subjects:
- kind: ServiceAccount
name: {{ template "rancher.fullname" . }}
namespace: {{ .Release.Namespace }}
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io

18
on-premise/main/rancher_v2.9.1/rancher/templates/configMap.yaml
View File

@ -1,18 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: rancher-config
labels: {{ include "rancher.labels" . | nindent 4 }}
app.kubernetes.io/part-of: "rancher"
data:
priorityClassName: {{ .Values.priorityClassName }}
{{- if and .Values.webhook (kindIs "string" .Values.webhook) }}
rancher-webhook: {{ .Values.webhook | quote }}
{{- else if .Values.webhook }}
rancher-webhook: {{ toYaml .Values.webhook | quote }}
{{- end }}
{{- if and .Values.fleet (kindIs "string" .Values.fleet) }}
fleet: {{ .Values.fleet | quote }}
{{- else if .Values.fleet }}
fleet: {{ toYaml .Values.fleet | quote }}
{{- end }}

264
on-premise/main/rancher_v2.9.1/rancher/templates/deployment.yaml
View File

@ -1,264 +0,0 @@
kind: Deployment
apiVersion: apps/v1
metadata:
name: {{ template "rancher.fullname" . }}
annotations:
{{- if (lt (int .Values.replicas) 0) }}
management.cattle.io/scale-available: "{{ sub 0 (int .Values.replicas)}}"
{{- end }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
{{- if (gt (int .Values.replicas) 0) }}
replicas: {{ .Values.replicas }}
{{- end }}
selector:
matchLabels:
app: {{ template "rancher.fullname" . }}
strategy:
rollingUpdate:
maxSurge: 1
{{- if (eq (int .Values.replicas) 1) }}
maxUnavailable: 0
{{- else }}
maxUnavailable: 1
{{- end }}
type: RollingUpdate
template:
metadata:
labels:
app: {{ template "rancher.fullname" . }}
release: {{ .Release.Name }}
spec:
priorityClassName: {{ .Values.priorityClassName }}
serviceAccountName: {{ template "rancher.fullname" . }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 6 }}
{{- end }}
affinity:
podAntiAffinity:
{{- if eq .Values.antiAffinity "required" }}
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchExpressions:
- key: app
operator: In
values:
- {{ template "rancher.fullname" . }}
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
{{- else }}
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 100
podAffinityTerm:
labelSelector:
matchExpressions:
- key: app
operator: In
values:
- {{ template "rancher.fullname" . }}
topologyKey: {{ .Values.topologyKey | default "kubernetes.io/hostname" }}
{{- end }}
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms: {{ include "linux-node-selector-terms" . | nindent 14 }}
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
containers:
- image: {{ .Values.rancherImage }}:{{ default .Chart.AppVersion .Values.rancherImageTag }}
imagePullPolicy: {{ default "IfNotPresent" .Values.rancherImagePullPolicy }}
name: {{ template "rancher.name" . }}
ports:
- containerPort: 80
protocol: TCP
{{- if (and .Values.hostPort (gt (int .Values.hostPort) 0)) }}
- containerPort: 444
hostPort: {{ int .Values.hostPort }}
protocol: TCP
{{- end}}
args:
{{- if .Values.debug }}
- "--debug"
{{- end }}
{{- if .Values.privateCA }}
# Private CA - don't clear ca certs
{{- else if and (eq .Values.tls "ingress") (eq .Values.ingress.tls.source "rancher") }}
# Rancher self-signed - don't clear ca certs
{{- else }}
# Public trusted CA - clear ca certs
- "--no-cacerts"
{{- end }}
- "--http-listen-port=80"
- "--https-listen-port=443"
- "--add-local={{ .Values.addLocal }}"
env:
- name: CATTLE_NAMESPACE
value: {{ .Release.Namespace }}
- name: CATTLE_PEER_SERVICE
value: {{ template "rancher.fullname" . }}
{{- if .Values.features }}
- name: CATTLE_FEATURES
value: "{{ .Values.features }}"
{{- end}}
{{- if .Values.noDefaultAdmin }}
- name: CATTLE_NO_DEFAULT_ADMIN
value: "{{ .Values.noDefaultAdmin }}"
{{- end}}
{{- if gt (int .Values.auditLog.level) 0 }}
- name: AUDIT_LEVEL
value: {{ .Values.auditLog.level | quote }}
- name: AUDIT_LOG_MAXAGE
value: {{ .Values.auditLog.maxAge | quote }}
- name: AUDIT_LOG_MAXBACKUP
value: {{ .Values.auditLog.maxBackup | quote }}
- name: AUDIT_LOG_MAXSIZE
value: {{ .Values.auditLog.maxSize | quote }}
{{- end }}
{{- if .Values.proxy }}
- name: HTTP_PROXY
value: {{ .Values.proxy }}
- name: HTTPS_PROXY
value: {{ .Values.proxy }}
- name: NO_PROXY
value: {{ .Values.noProxy }}
{{- end }}
{{- if .Values.systemDefaultRegistry }}
- name: CATTLE_SYSTEM_DEFAULT_REGISTRY
value: {{ .Values.systemDefaultRegistry }}
{{- end }}
{{- if .Values.useBundledSystemChart }}
- name: CATTLE_SYSTEM_CATALOG
value: bundled
{{- end }}
{{- if .Values.restrictedAdmin }}
- name: CATTLE_RESTRICTED_DEFAULT_ADMIN
value: "true"
{{- end}}
{{- if .Values.bootstrapPassword }}
- name: CATTLE_BOOTSTRAP_PASSWORD
valueFrom:
secretKeyRef:
name: "bootstrap-secret"
key: "bootstrapPassword"
{{- end }}
{{- if .Values.agentTLSMode }}
- name: CATTLE_AGENT_TLS_MODE
value: "{{ .Values.agentTLSMode }}"
{{- end }}
{{- if .Values.extraEnv }}
{{ toYaml .Values.extraEnv | indent 8}}
{{- end }}
startupProbe:
httpGet:
path: /healthz
port: 80
timeoutSeconds: {{ .Values.startupProbe.timeoutSeconds }}
failureThreshold: {{ .Values.startupProbe.failureThreshold }}
periodSeconds: {{ .Values.startupProbe.periodSeconds }}
livenessProbe:
httpGet:
path: /healthz
port: 80
{{- with .Values.livenessProbe.initialDelaySeconds}}
initialDelaySeconds: {{ . }}
{{- end }}
timeoutSeconds: {{.Values.livenessProbe.timeoutSeconds }}
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
failureThreshold: {{.Values.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: /healthz
port: 80
{{- with .Values.readinessProbe.initialDelaySeconds}}
initialDelaySeconds: {{ . }}
{{- end }}
timeoutSeconds: {{.Values.readinessProbe.timeoutSeconds }}
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
failureThreshold: {{.Values.readinessProbe.failureThreshold }}
resources:
{{ toYaml .Values.resources | indent 10 }}
volumeMounts:
{{- if .Values.additionalTrustedCAs }}
- mountPath: /etc/pki/trust/anchors/ca-additional.pem
name: tls-ca-additional-volume
subPath: ca-additional.pem
readOnly: true
- mountPath: /etc/rancher/ssl/ca-additional.pem
name: tls-ca-additional-volume
subPath: ca-additional.pem
readOnly: true
{{- end }}
{{- if .Values.privateCA }}
# Pass CA cert into rancher for private CA
- mountPath: /etc/rancher/ssl/cacerts.pem
name: tls-ca-volume
subPath: cacerts.pem
readOnly: true
{{- end }}
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
# Mount rancher custom-logos volume
- mountPath: /usr/share/rancher/ui/assets/images/logos
name: custom-logos
subPath: {{ .Values.customLogos.volumeSubpaths.emberUi | default "ember" | quote }}
- mountPath: /usr/share/rancher/ui-dashboard/dashboard/_nuxt/assets/images/pl
name: custom-logos
subPath: {{ .Values.customLogos.volumeSubpaths.vueUi | default "vue" | quote }}
{{- end }}
{{- if gt (int .Values.auditLog.level) 0 }}
- mountPath: /var/log/auditlog
name: audit-log
{{- end }}
{{- if eq .Values.auditLog.destination "sidecar" }}
{{- if gt (int .Values.auditLog.level) 0 }}
# Make audit logs available for Rancher log collector tools.
{{- if .Values.busyboxImage }}
- image: {{ .Values.busyboxImage}}
{{- else }}
- image: {{ .Values.auditLog.image.repository }}:{{.Values.auditLog.image.tag}}
{{- end }}
{{- if .Values.busyboxImagePullPolicy }}
imagePullPolicy: {{ .Values.busyboxImagePullPolicy }}
{{- else }}
imagePullPolicy: {{ .Values.auditLog.image.pullPolicy }}
{{- end }}
name: {{ template "rancher.name" . }}-audit-log
command: ["tail"]
args: ["-F", "/var/log/auditlog/rancher-api-audit.log"]
volumeMounts:
- mountPath: /var/log/auditlog
name: audit-log
{{- end }}
{{- end }}
volumes:
{{- if .Values.additionalTrustedCAs }}
- name: tls-ca-additional-volume
secret:
defaultMode: 0400
secretName: tls-ca-additional
{{- end }}
{{- if .Values.privateCA }}
- name: tls-ca-volume
secret:
defaultMode: 0400
secretName: tls-ca
{{- end }}
{{- if gt (int .Values.auditLog.level) 0 }}
{{- if eq .Values.auditLog.destination "hostPath" }}
- name: audit-log
hostPath:
path: {{ .Values.auditLog.hostPath }}
type: DirectoryOrCreate
{{- else }}
- name: audit-log
emptyDir: {}
{{- end }}
{{- end }}
{{- if and .Values.customLogos.enabled (or (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (and (eq .Values.customLogos.volumeKind "configMap") (.Values.customLogos.volumeName))) }}
- name: custom-logos
{{- if (eq .Values.customLogos.volumeKind "persistentVolumeClaim") }}
persistentVolumeClaim:
claimName: {{ .Values.customLogos.volumeName | default (printf "%s-custom-logos" (include "rancher.fullname" .)) }}
{{- else if (eq .Values.customLogos.volumeKind "configMap") }}
configMap:
name: {{ .Values.customLogos.volumeName }}
{{- end }}
{{- end }}

66
on-premise/main/rancher_v2.9.1/rancher/templates/ingress.yaml
View File

@ -1,66 +0,0 @@
{{- if .Values.ingress.enabled }}
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
apiVersion: networking.k8s.io/v1
{{- else }}
apiVersion: networking.k8s.io/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
annotations:
{{- if .Values.ingress.configurationSnippet }}
nginx.ingress.kubernetes.io/configuration-snippet: |
{{- template "configurationSnippet" . }}
{{- end }}
{{- if eq .Values.tls "external" }}
nginx.ingress.kubernetes.io/ssl-redirect: "false" # turn off ssl redirect for external.
{{- else }}
{{- if ne .Values.ingress.tls.source "secret" }}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
certmanager.k8s.io/issuer: {{ template "rancher.fullname" . }}
{{- else }}
cert-manager.io/issuer: {{ template "rancher.fullname" . }}
cert-manager.io/issuer-kind: Issuer
{{- end }}
{{- end }}
{{- end }}
{{- if .Values.ingress.includeDefaultExtraAnnotations }}
nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"
nginx.ingress.kubernetes.io/proxy-read-timeout: "1800"
nginx.ingress.kubernetes.io/proxy-send-timeout: "1800"
{{- end }}
{{- if .Values.ingress.extraAnnotations }}
{{ toYaml .Values.ingress.extraAnnotations | indent 4 }}
{{- end }}
spec:
{{- if .Values.ingress.ingressClassName }}
ingressClassName: {{ .Values.ingress.ingressClassName }}
{{- end }}
rules:
- host: {{ .Values.hostname }} # hostname to access rancher server
http:
paths:
- backend:
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
service:
name: {{ template "rancher.fullname" . }}
port:
number: {{ .Values.ingress.servicePort }}
{{- else }}
serviceName: {{ template "rancher.fullname" . }}
servicePort: {{ .Values.ingress.servicePort }}
{{- end }}
{{- if or (.Capabilities.APIVersions.Has "networking.k8s.io/v1/Ingress") (not (.Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/Ingress")) }}
pathType: {{ .Values.ingress.pathType }}
path: {{ .Values.ingress.path }}
{{- end }}
{{- if eq .Values.tls "ingress" }}
tls:
- hosts:
- {{ .Values.hostname }}
secretName: {{ .Values.ingress.tls.secretName }}
{{- end }}
{{- end }}

37
on-premise/main/rancher_v2.9.1/rancher/templates/issuer-letsEncrypt.yaml
View File

@ -1,37 +0,0 @@
{{- if eq .Values.tls "ingress" -}}
{{- if eq .Values.ingress.tls.source "letsEncrypt" -}}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
apiVersion: cert-manager.io/v1
{{- end }}
kind: Issuer
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
acme:
{{- if eq .Values.letsEncrypt.environment "production" }}
server: https://acme-v02.api.letsencrypt.org/directory
{{- else }}
server: https://acme-staging-v02.api.letsencrypt.org/directory
{{- end }}
email: {{ .Values.letsEncrypt.email }}
privateKeySecretRef:
name: letsencrypt-{{ .Values.letsEncrypt.environment }}
{{- if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
http01: {}
{{- else }}
solvers:
- http01:
ingress:
class: {{ .Values.letsEncrypt.ingress.class }}
{{- end }}
{{- end -}}
{{- end -}}

22
on-premise/main/rancher_v2.9.1/rancher/templates/issuer-rancher.yaml
View File

@ -1,22 +0,0 @@
{{- if eq .Values.tls "ingress" -}}
{{- if eq .Values.ingress.tls.source "rancher" -}}
{{- $certmanagerVer := split "." .Values.certmanager.version -}}
{{- if or (.Capabilities.APIVersions.Has "cert-manager.io/v1beta1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 16)) }}
apiVersion: cert-manager.io/v1beta1
{{- else if or (.Capabilities.APIVersions.Has "cert-manager.io/v1alpha2") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (ge (int $certmanagerVer._1) 11)) }}
apiVersion: cert-manager.io/v1alpha2
{{- else if or (.Capabilities.APIVersions.Has "certmanager.k8s.io/v1alpha1") (and (gt (len $certmanagerVer._0) 0) (eq (int $certmanagerVer._0) 0) (lt (int $certmanagerVer._1) 11)) }}
apiVersion: certmanager.k8s.io/v1alpha1
{{- else }}
apiVersion: cert-manager.io/v1
{{- end }}
kind: Issuer
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
ca:
secretName: tls-rancher
{{- end -}}
{{- end -}}

19
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-cluster-role-binding.yaml
View File

@ -1,19 +0,0 @@
{{- if .Values.postDelete.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "2"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "rancher.fullname" . }}-post-delete
subjects:
- kind: ServiceAccount
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
{{- end }}

39
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-cluster-role.yaml
View File

@ -1,39 +0,0 @@
{{- if .Values.postDelete.enabled }}
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
rules:
- apiGroups: [ "extensions","apps" ]
resources: [ "deployments" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "batch" ]
resources: [ "jobs" ]
verbs: [ "get", "list", "watch", "delete", "create" ]
- apiGroups: [ "rbac.authorization.k8s.io" ]
resources: [ "clusterroles", "clusterrolebindings", "roles", "rolebindings" ]
verbs: [ "get", "list", "delete", "create" ]
- apiGroups: [ "" ]
resources: [ "pods", "secrets", "services", "configmaps" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "" ]
resources: [ "serviceaccounts" ]
verbs: [ "get", "list", "delete", "create" ]
- apiGroups: [ "networking.k8s.io" ]
resources: [ "networkpolicies" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "admissionregistration.k8s.io" ]
resources: [ "validatingwebhookconfigurations", "mutatingwebhookconfigurations" ]
verbs: [ "get", "list", "delete" ]
- apiGroups: [ "networking.k8s.io" ]
resources: [ "ingresses" ]
verbs: [ "delete" ]
- apiGroups: [ "cert-manager.io" ]
resources: [ "issuers" ]
verbs: [ "delete" ]
{{- end }}

15
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-config-map.yaml
View File

@ -1,15 +0,0 @@
{{- if .Values.postDelete.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
data:
post-delete-hook.sh: |-
{{ $.Files.Get "scripts/post-delete-hook.sh" | indent 4 }}
{{- end }}

46
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-job.yaml
View File

@ -1,46 +0,0 @@
{{- if .Values.postDelete.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "3"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
spec:
backoffLimit: 3
template:
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
labels: {{ include "rancher.labels" . | nindent 8 }}
spec:
serviceAccountName: {{ template "rancher.fullname" . }}-post-delete
restartPolicy: OnFailure
containers:
- name: {{ template "rancher.name" . }}-post-delete
image: "{{ include "system_default_registry" . }}{{ .Values.postDelete.image.repository }}:{{ .Values.postDelete.image.tag }}"
imagePullPolicy: IfNotPresent
securityContext:
runAsUser: 0
command:
- /scripts/post-delete-hook.sh
volumeMounts:
- mountPath: /scripts
name: config-volume
env:
- name: NAMESPACES
value: {{ .Values.postDelete.namespaceList | join " " | quote }}
- name: RANCHER_NAMESPACE
value: {{ .Release.Namespace }}
- name: TIMEOUT
value: {{ .Values.postDelete.timeout | quote }}
- name: IGNORETIMEOUTERROR
value: {{ .Values.postDelete.ignoreTimeoutError | quote }}
volumes:
- name: config-volume
configMap:
name: {{ template "rancher.fullname" . }}-post-delete
defaultMode: 0777
{{- end }}

12
on-premise/main/rancher_v2.9.1/rancher/templates/post-delete-hook-service-account.yaml
View File

@ -1,12 +0,0 @@
{{- if .Values.postDelete.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "rancher.fullname" . }}-post-delete
namespace: {{ .Release.Namespace }}
labels: {{ include "rancher.labels" . | nindent 4 }}
annotations:
"helm.sh/hook": post-delete
"helm.sh/hook-weight": "1"
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-failed
{{- end }}

8
on-premise/main/rancher_v2.9.1/rancher/templates/priorityClass.yaml
View File

@ -1,8 +0,0 @@
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
name: rancher-critical
labels: {{ include "rancher.labels" . | nindent 4 }}
value: 1000000000
globalDefault: false
description: "Priority class used by pods critical to rancher's functionality."

19
on-premise/main/rancher_v2.9.1/rancher/templates/pvc.yaml
View File

@ -1,19 +0,0 @@
{{- if and (.Values.customLogos.enabled) (eq .Values.customLogos.volumeKind "persistentVolumeClaim") (not .Values.customLogos.volumeName) }}
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: {{ template "rancher.fullname" . }}-custom-logos
spec:
accessModes:
- {{ .Values.customLogos.accessMode | quote }}
resources:
requests:
storage: {{ .Values.customLogos.size | quote }}
storageClassName: {{ if .Values.customLogos.storageClass }}
{{- if (eq "-" .Values.customLogos.storageClass) -}}
""
{{- else }}
{{- .Values.customLogos.storageClass }}
{{- end -}}
{{- end }}
{{- end }}

25
on-premise/main/rancher_v2.9.1/rancher/templates/secret.yaml
View File

@ -1,25 +0,0 @@
{{/* Use the bootstrap password from values.yaml if an existing secret is not found */}}
{{- $bootstrapPassword := .Values.bootstrapPassword -}}
{{- $existingSecret := lookup "v1" "Secret" .Release.Namespace "bootstrap-secret" -}}
{{- if $existingSecret -}}
{{- if $existingSecret.data -}}
{{- if $existingSecret.data.bootstrapPassword -}}
{{- $bootstrapPassword = $existingSecret.data.bootstrapPassword | b64dec -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/* If a bootstrap password was found in the values or an existing password was found create the secret */}}
{{- if $bootstrapPassword }}
apiVersion: v1
kind: Secret
metadata:
name: "bootstrap-secret"
namespace: {{ .Release.Namespace }}
annotations:
"helm.sh/hook": pre-install,pre-upgrade
"helm.sh/hook-weight": "-5"
"helm.sh/resource-policy": keep
type: Opaque
data:
bootstrapPassword: {{ $bootstrapPassword | b64enc | quote }}
{{- end }}

28
on-premise/main/rancher_v2.9.1/rancher/templates/service.yaml
View File

@ -1,28 +0,0 @@
apiVersion: v1
kind: Service
metadata:
{{- if .Values.service.annotations }}
annotations:
{{ toYaml .Values.service.annotations | indent 4 }}
{{- end }}
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}
spec:
{{- /*
If service.type is not provided this attribute is ommitted and k8s default of ClusterIP is used.
*/}}
{{- if .Values.service.type }}
type: {{ .Values.service.type }}
{{- end }}
ports:
- port: 80
targetPort: 80
protocol: TCP
name: http
- port: 443
targetPort: 444
protocol: TCP
name: https-internal
selector:
app: {{ template "rancher.fullname" . }}

6
on-premise/main/rancher_v2.9.1/rancher/templates/serviceAccount.yaml
View File

@ -1,6 +0,0 @@
kind: ServiceAccount
apiVersion: v1
metadata:
name: {{ template "rancher.fullname" . }}
labels:
{{ include "rancher.labels" . | indent 4 }}

13
on-premise/main/rancher_v2.9.1/rancher/values.schema.json
View File

@ -1,13 +0,0 @@
{
"$schema": "https://json-schema.org/draft-07/schema#",
"properties": {
"agentTLSMode": {
"type": ["string", "null"],
"enum": ["strict", "system-store", "", null],
"description": "agentTLSMode must be 'strict' or 'system-store' or null (defaults to system-store)"
}
},
"required": [],
"title": "Rancher Chart Values",
"type": "object"
}

199
on-premise/main/rancher_v2.9.1/rancher/values.yaml
View File

@ -1,199 +0,0 @@
# Additional Trusted CAs.
# Enable this flag and add your CA certs as a secret named tls-ca-additional in the namespace.
# See README.md for details.
additionalTrustedCAs: false
antiAffinity: preferred
topologyKey: kubernetes.io/hostname
# Audit Logs https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
# The audit log is piped to the console of the rancher-audit-log container in the rancher pod.
# https://rancher.com/docs/rancher/v2.x/en/installation/api-auditing/
# destination stream to sidecar container console or hostPath volume
# level: Verbosity of logs, 0 to 3. 0 is off 3 is a lot.
auditLog:
destination: sidecar
hostPath: /var/log/rancher/audit/
level: 0
maxAge: 1
maxBackup: 1
maxSize: 100
# Image for collecting rancher audit logs.
# Important: update pkg/image/export/resolve.go when this default image is changed, so that it's reflected accordingly in rancher-images.txt generated for air-gapped setups.
image:
repository: "rancher/mirrored-bci-micro"
tag: 15.4.14.3
# Override imagePullPolicy image
# options: Always, Never, IfNotPresent
pullPolicy: "IfNotPresent"
# As of Rancher v2.5.0 this flag is deprecated and must be set to 'true' in order for Rancher to start
addLocal: "true"
# Add debug flag to Rancher server
debug: false
# When starting Rancher for the first time, bootstrap the admin as restricted-admin
restrictedAdmin: false
# Control how the Rancher agents validate TLS connections
# Valid options: strict, or system-store
# Note, for new installations empty will default to strict on 2.9+, or system-store on 2.8 or older
agentTLSMode: "system-store"
# Extra environment variables passed to the rancher pods.
# extraEnv:
# - name: CATTLE_TLS_MIN_VERSION
# value: "1.0"
# Fully qualified name to reach your Rancher server
hostname: rancher.inje-private.com
## Optional array of imagePullSecrets containing private registry credentials
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
imagePullSecrets: []
# - name: secretName
### ingress ###
# Readme for details and instruction on adding tls secrets.
ingress:
# If set to false, ingress will not be created
# Defaults to true
# options: true, false
enabled: false # by ljh true -> false
includeDefaultExtraAnnotations: true
extraAnnotations: {}
ingressClassName: ""
# Certain ingress controllers will require the pathType or path to be set to a different value.
pathType: ImplementationSpecific
path: "/"
# backend port number
servicePort: 80
# configurationSnippet - Add additional Nginx configuration. This example statically sets a header on the ingress.
# configurationSnippet: |
# more_set_input_headers "X-Forwarded-Host: {{ .Values.hostname }}";
tls:
# options: rancher, letsEncrypt, secret
source: rancher
secretName: tls-rancher-ingress
### service ###
# Override to use NodePort or LoadBalancer service type - default is ClusterIP
service:
type: ""
annotations: {}
### LetsEncrypt config ###
# ProTip: The production environment only allows you to register a name 5 times a week.
# Use staging until you have your config right.
letsEncrypt:
# email: none@example.com
environment: production
ingress:
# options: traefik, nginx
class: ""
# If you are using certs signed by a private CA set to 'true' and set the 'tls-ca'
# in the 'rancher-system' namespace. See the README.md for details
privateCA: true
# http[s] proxy server passed into rancher server.
# proxy: http://<username>@<password>:<url>:<port>
# comma separated list of domains or ip addresses that will not use the proxy
noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local
# Override rancher image location for Air Gap installs
rancherImage: reg.inje-private.com/nnd002/rancher/rancher #by ljh
# rancher/rancher image tag. https://hub.docker.com/r/rancher/rancher/tags/
# Defaults to .Chart.appVersion
# rancherImageTag: v2.0.7
# Override imagePullPolicy for rancher server images
# options: Always, Never, IfNotPresent
# Defaults to IfNotPresent
# rancherImagePullPolicy: <pullPolicy>
# Number of Rancher server replicas. Setting to negative number will dynamically between 0 and the abs(replicas) based on available nodes.
# of available nodes in the cluster
replicas: 3
# Set priorityClassName to avoid eviction
priorityClassName: rancher-critical
# Set pod resource requests/limits for Rancher.
resources: {}
#
# tls
# Where to offload the TLS/SSL encryption
# - ingress (default)
# - external
tls: external # by ljh
systemDefaultRegistry: "reg.inje-private.com/nnd002"
# Set to use the packaged system charts
#useBundledSystemChart: false
useBundledSystemChart: true
# Certmanager version compatibility
certmanager:
version: ""
# Rancher custom logos persistence
customLogos:
enabled: true # by ljh
volumeSubpaths:
emberUi: "ember"
vueUi: "vue"
## Volume kind to use for persistence: persistentVolumeClaim, configMap
volumeKind: persistentVolumeClaim
## Use an existing volume. Custom logos should be copied to the volume by the user
# volumeName: custom-logos
## Just for volumeKind: persistentVolumeClaim
## To disables dynamic provisioning, set storageClass: "" or storageClass: "-"
storageClass: "sc-monitoring" # by ljh
accessMode: ReadWriteOnce
size: 10Gi
# Rancher post-delete hook
postDelete:
enabled: true #by ljh
image:
repository: rancher/shell # by ljh add registry
tag: v0.2.1
namespaceList:
- cattle-fleet-system
- cattle-system
- rancher-operator-system
# Number of seconds to wait for an app to be uninstalled
timeout: 120
# by default, the job will fail if it fail to uninstall any of the apps
ignoreTimeoutError: false
# Set a bootstrap password. If leave empty, a random password will be generated.
bootstrapPassword: "coneijinc123!"
startupProbe:
## should be ready within 2 minutes
timeoutSeconds: 5
periodSeconds: 10
failureThreshold: 12
livenessProbe:
timeoutSeconds: 5
periodSeconds: 30
failureThreshold: 5
readinessProbe:
timeoutSeconds: 5
periodSeconds: 30
failureThreshold: 5
# helm values to use when installing the rancher-webhook chart.
# helm values set here will override all other global values used when installing the webhook such as priorityClassName and systemRegistry settings.
webhook: ""
# helm values to use when installing the fleet chart.
# helm values set here will override all other global values used when installing the fleet chart.
fleet: ""

16
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.dockerignore
View File

@ -1,16 +0,0 @@
./bin
./.dapper
./build
./dist
./.idea
./default.etcd
./package/rancher
./package/agent
./tests/MANIFEST
./tests/.idea
./tests/.cache
./tests/.tox
./tests/.venv
**/*.pyc
**/__pycache__
./management-state/

6
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.gitattributes vendored
View File

@ -1,6 +0,0 @@
# Treat all Go files in this repo as binary, with no git magic updating
# line endings. Windows users contributing to Go will need to use a
# modern version of git and editors capable of LF line endings.
*.go -text diff=golang
* text eol=lf

48
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/ISSUE_TEMPLATE/bug_report.md vendored
View File

@ -1,48 +0,0 @@
---
name: Bug report
about: Create a report to help us improve
title: "[BUG]"
labels: kind/bug
assignees: ''
---
**Rancher Server Setup**
- Rancher version:
- Installation option (Docker install/Helm Chart):
- If Helm Chart, Kubernetes Cluster and version (RKE1, RKE2, k3s, EKS, etc):
- Proxy/Cert Details:
**Information about the Cluster**
- Kubernetes version:
- Cluster Type (Local/Downstream):
- If downstream, what type of cluster? (Custom/Imported or specify provider for Hosted/Infrastructure Provider):
<!--
* Custom = Running a docker command on a node
* Imported = Running kubectl apply onto an existing k8s cluster
* Hosted = EKS, GKE, AKS, etc
* Infrastructure Provider = Rancher provisioning the nodes using different node drivers (e.g. AWS, Digital Ocean, etc)
-->
**User Information**
- What is the role of the user logged in? (Admin/Cluster Owner/Cluster Member/Project Owner/Project Member/Custom)
- If custom, define the set of permissions:
**Describe the bug**
<!--A clear and concise description of what the bug is.-->
**To Reproduce**
<!--Steps to reproduce the behavior-->
**Result**
**Expected Result**
<!--A clear and concise description of what you expected to happen.-->
**Screenshots**
<!-- If applicable, add screenshots to help explain your problem.-->
**Additional context**
<!--Add any other context about the problem here.-->

20
on-premise/main/rancher_v2.9.1/source/rancher-2.9.1/.github/ISSUE_TEMPLATE/feature_request.md vendored
View File

@ -1,20 +0,0 @@
---
name: Feature request
about: Suggest an idea for this project
title: "[RFE] "
labels: kind/enhancement
assignees: ''
---
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.

Some files were not shown because too many files have changed in this diff Show More