feat(gitops): populate declarative manifests for all 10 workloads and correct destination namespaces
This commit is contained in:
@@ -17,7 +17,7 @@ spec:
|
||||
path: manifests/aerodrome/grafana
|
||||
destination:
|
||||
server: "https://140.44.4.11:6443"
|
||||
namespace: monitoring
|
||||
namespace: default
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: false
|
||||
|
||||
@@ -17,7 +17,7 @@ spec:
|
||||
path: manifests/spaceport/zabbix
|
||||
destination:
|
||||
server: "https://kubernetes.default.svc"
|
||||
namespace: zabbix
|
||||
namespace: monitoring
|
||||
syncPolicy:
|
||||
automated:
|
||||
prune: false
|
||||
|
||||
566
manifests/aerodrome/authentik/authentik.yaml
Normal file
566
manifests/aerodrome/authentik/authentik.yaml
Normal file
@@ -0,0 +1,566 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: authentik
|
||||
meta.helm.sh/release-namespace: infra
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: authentik
|
||||
app.kubernetes.io/part-of: authentik
|
||||
app.kubernetes.io/version: 2026.2.2
|
||||
helm.sh/chart: authentik-2026.2.2
|
||||
name: authentik-server
|
||||
namespace: infra
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 2
|
||||
revisionHistoryLimit: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: authentik
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/secret: dd7f348e3b2f89fc2c10dd192b2fa5e17fcda500ee513b9f5f66cd33b97e268d
|
||||
kubectl.kubernetes.io/restartedAt: 2026-10-28 22:52:19.572345
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: authentik
|
||||
app.kubernetes.io/part-of: authentik
|
||||
app.kubernetes.io/version: 2026.2.2
|
||||
helm.sh/chart: authentik-2026.2.2
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: authentik
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
env:
|
||||
- name: AUTHENTIK_LISTEN__HTTP
|
||||
value: 0.0.0.0:9000
|
||||
- name: AUTHENTIK_LISTEN__HTTPS
|
||||
value: 0.0.0.0:9443
|
||||
- name: AUTHENTIK_LISTEN__METRICS
|
||||
value: 0.0.0.0:9300
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: authentik
|
||||
image: ghcr.io/goauthentik/server:2026.2.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /-/health/live/
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
name: server
|
||||
ports:
|
||||
- containerPort: 9000
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 9443
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: 9300
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /-/health/ready/
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
resources: {}
|
||||
startupProbe:
|
||||
failureThreshold: 60
|
||||
httpGet:
|
||||
path: /-/health/live/
|
||||
port: http
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
dnsPolicy: ClusterFirst
|
||||
enableServiceLinks: true
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
terminationGracePeriodSeconds: 30
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: authentik
|
||||
meta.helm.sh/release-namespace: infra
|
||||
labels:
|
||||
app.kubernetes.io/component: worker
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: authentik
|
||||
app.kubernetes.io/part-of: authentik
|
||||
app.kubernetes.io/version: 2026.2.2
|
||||
helm.sh/chart: authentik-2026.2.2
|
||||
name: authentik-worker
|
||||
namespace: infra
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: worker
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: authentik
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/secret: dd7f348e3b2f89fc2c10dd192b2fa5e17fcda500ee513b9f5f66cd33b97e268d
|
||||
labels:
|
||||
app.kubernetes.io/component: worker
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: authentik
|
||||
app.kubernetes.io/part-of: authentik
|
||||
app.kubernetes.io/version: 2026.2.2
|
||||
helm.sh/chart: authentik-2026.2.2
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: worker
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: authentik
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 100
|
||||
containers:
|
||||
- args:
|
||||
- worker
|
||||
env:
|
||||
- name: AUTHENTIK_LISTEN__HTTP
|
||||
value: 0.0.0.0:9000
|
||||
- name: AUTHENTIK_LISTEN__METRICS
|
||||
value: 0.0.0.0:9300
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: authentik
|
||||
image: ghcr.io/goauthentik/server:2026.2.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- ak
|
||||
- healthcheck
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
name: worker
|
||||
ports:
|
||||
- containerPort: 9000
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 9300
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- ak
|
||||
- healthcheck
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
resources: {}
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- ak
|
||||
- healthcheck
|
||||
failureThreshold: 60
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 3
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
dnsPolicy: ClusterFirst
|
||||
enableServiceLinks: true
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: authentik
|
||||
serviceAccountName: authentik
|
||||
terminationGracePeriodSeconds: 30
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: authentik
|
||||
meta.helm.sh/release-namespace: infra
|
||||
labels:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: postgresql
|
||||
app.kubernetes.io/version: 17.6.0
|
||||
helm.sh/chart: postgresql-16.7.27
|
||||
name: authentik-postgresql
|
||||
namespace: infra
|
||||
spec:
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: Retain
|
||||
whenScaled: Retain
|
||||
podManagementPolicy: OrderedReady
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: postgresql
|
||||
serviceName: authentik-postgresql-hl
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/configuration: c7768a9df482d4c1de21ac88a598f24ff260dad3ff5925385ab5225b3ef8be39
|
||||
checksum/extended-configuration: f231c584ead90a4176b09eb6d6073240ab2939b8bd09b20013265962083b3208
|
||||
labels:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: postgresql
|
||||
app.kubernetes.io/version: 17.6.0
|
||||
helm.sh/chart: postgresql-16.7.27
|
||||
name: authentik-postgresql
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: postgresql
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- args:
|
||||
- -c
|
||||
- config_file=/bitnami/postgresql/conf/postgresql.conf
|
||||
- -c
|
||||
- hba_file=/bitnami/postgresql/conf/pg_hba.conf
|
||||
env:
|
||||
- name: BITNAMI_DEBUG
|
||||
value: 'false'
|
||||
- name: POSTGRESQL_PORT_NUMBER
|
||||
value: '5432'
|
||||
- name: POSTGRESQL_VOLUME_DIR
|
||||
value: /bitnami/postgresql
|
||||
- name: PGDATA
|
||||
value: /bitnami/postgresql/data
|
||||
- name: POSTGRES_USER
|
||||
value: authentik
|
||||
- name: POSTGRES_PASSWORD_FILE
|
||||
value: /opt/bitnami/postgresql/secrets/password
|
||||
- name: POSTGRES_POSTGRES_PASSWORD_FILE
|
||||
value: /opt/bitnami/postgresql/secrets/postgres-password
|
||||
- name: POSTGRES_DATABASE
|
||||
value: authentik
|
||||
- name: POSTGRESQL_ENABLE_LDAP
|
||||
value: 'no'
|
||||
- name: POSTGRESQL_ENABLE_TLS
|
||||
value: 'no'
|
||||
- name: POSTGRESQL_LOG_HOSTNAME
|
||||
value: 'false'
|
||||
- name: POSTGRESQL_LOG_CONNECTIONS
|
||||
value: 'false'
|
||||
- name: POSTGRESQL_LOG_DISCONNECTIONS
|
||||
value: 'false'
|
||||
- name: POSTGRESQL_PGAUDIT_LOG_CATALOG
|
||||
value: 'off'
|
||||
- name: POSTGRESQL_CLIENT_MIN_MESSAGES
|
||||
value: error
|
||||
- name: POSTGRESQL_SHARED_PRELOAD_LIBRARIES
|
||||
value: pgaudit
|
||||
- name: POSTGRES_DB
|
||||
value: authentik
|
||||
image: docker.io/library/postgres:17.9-bookworm
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- exec pg_isready -U "authentik" -d "dbname=authentik" -h 127.0.0.1 -p
|
||||
5432
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: postgresql
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: tcp-postgresql
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- -e
|
||||
- 'exec pg_isready -U "authentik" -d "dbname=authentik" -h 127.0.0.1 -p
|
||||
5432
|
||||
|
||||
[ -f /opt/bitnami/postgresql/tmp/.initialized ] || [ -f /bitnami/postgresql/.initialized
|
||||
]
|
||||
|
||||
'
|
||||
failureThreshold: 6
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1001
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
seLinuxOptions: {}
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: empty-dir
|
||||
subPath: tmp-dir
|
||||
- mountPath: /opt/bitnami/postgresql/conf
|
||||
name: empty-dir
|
||||
subPath: app-conf-dir
|
||||
- mountPath: /opt/bitnami/postgresql/tmp
|
||||
name: empty-dir
|
||||
subPath: app-tmp-dir
|
||||
- mountPath: /bitnami/postgresql/conf/conf.d/
|
||||
name: postgresql-extended-config
|
||||
- mountPath: /opt/bitnami/postgresql/secrets/
|
||||
name: postgresql-password
|
||||
- mountPath: /dev/shm
|
||||
name: dshm
|
||||
- mountPath: /bitnami/postgresql
|
||||
name: data
|
||||
- mountPath: /bitnami/postgresql/conf
|
||||
name: postgresql-config
|
||||
- mountPath: /var/run/postgresql
|
||||
name: postgresql-socket
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
fsGroupChangePolicy: Always
|
||||
serviceAccount: authentik-postgresql
|
||||
serviceAccountName: authentik-postgresql
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: empty-dir
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
name: authentik-postgresql-configuration
|
||||
name: postgresql-config
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
name: authentik-postgresql-extended-configuration
|
||||
name: postgresql-extended-config
|
||||
- name: postgresql-password
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: authentik-postgresql
|
||||
- emptyDir: {}
|
||||
name: postgresql-socket
|
||||
- emptyDir:
|
||||
medium: Memory
|
||||
name: dshm
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
partition: 0
|
||||
type: RollingUpdate
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 8Gi
|
||||
volumeMode: Filesystem
|
||||
status:
|
||||
phase: Pending
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: authentik
|
||||
meta.helm.sh/release-namespace: infra
|
||||
labels:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: postgresql
|
||||
app.kubernetes.io/version: 17.6.0
|
||||
helm.sh/chart: postgresql-16.7.27
|
||||
name: authentik-postgresql
|
||||
namespace: infra
|
||||
spec:
|
||||
clusterIP: 10.43.189.60
|
||||
clusterIPs:
|
||||
- 10.43.189.60
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: tcp-postgresql
|
||||
port: 5432
|
||||
protocol: TCP
|
||||
targetPort: tcp-postgresql
|
||||
selector:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: postgresql
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: authentik
|
||||
meta.helm.sh/release-namespace: infra
|
||||
labels:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: postgresql
|
||||
app.kubernetes.io/version: 17.6.0
|
||||
helm.sh/chart: postgresql-16.7.27
|
||||
name: authentik-postgresql-hl
|
||||
namespace: infra
|
||||
spec:
|
||||
clusterIP: None
|
||||
clusterIPs:
|
||||
- None
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: tcp-postgresql
|
||||
port: 5432
|
||||
protocol: TCP
|
||||
targetPort: tcp-postgresql
|
||||
publishNotReadyAddresses: true
|
||||
selector:
|
||||
app.kubernetes.io/component: primary
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: postgresql
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: authentik
|
||||
meta.helm.sh/release-namespace: infra
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: authentik
|
||||
app.kubernetes.io/part-of: authentik
|
||||
app.kubernetes.io/version: 2026.2.2
|
||||
helm.sh/chart: authentik-2026.2.2
|
||||
name: authentik-server
|
||||
namespace: infra
|
||||
spec:
|
||||
clusterIP: 10.43.250.197
|
||||
clusterIPs:
|
||||
- 10.43.250.197
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 9000
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 9443
|
||||
selector:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: authentik
|
||||
app.kubernetes.io/name: authentik
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
992
manifests/aerodrome/awx/awx.yaml
Normal file
992
manifests/aerodrome/awx/awx.yaml
Normal file
@@ -0,0 +1,992 @@
|
||||
apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: awx
|
||||
meta.helm.sh/release-namespace: awx
|
||||
restartedAt: now
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
name: awx
|
||||
namespace: awx
|
||||
spec:
|
||||
admin_user: snarf
|
||||
auto_upgrade: true
|
||||
create_preload_data: true
|
||||
extra_settings:
|
||||
- setting: CSRF_TRUSTED_ORIGINS
|
||||
value:
|
||||
- https://awx.snarfnet.net
|
||||
- setting: SECURE_PROXY_SSL_HEADER
|
||||
value:
|
||||
- HTTP_X_FORWARDED_PROTO
|
||||
- https
|
||||
- setting: SOCIAL_AUTH_REDIRECT_IS_HTTPS
|
||||
value: true
|
||||
garbage_collect_secrets: false
|
||||
image_pull_policy: IfNotPresent
|
||||
ipv6_disabled: false
|
||||
loadbalancer_ip: ''
|
||||
loadbalancer_port: 80
|
||||
loadbalancer_protocol: http
|
||||
no_log: true
|
||||
postgres_configuration_secret: awx-postgres-configuration
|
||||
postgres_keepalives: true
|
||||
postgres_keepalives_count: 5
|
||||
postgres_keepalives_idle: 5
|
||||
postgres_keepalives_interval: 5
|
||||
postgres_storage_class: longhorn
|
||||
projects_persistence: false
|
||||
projects_storage_access_mode: ReadWriteMany
|
||||
projects_storage_size: 8Gi
|
||||
replicas: 1
|
||||
route_tls_termination_mechanism: Edge
|
||||
security_context_settings:
|
||||
fsGroup: 0
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
set_self_labels: true
|
||||
task_privileged: false
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: awx
|
||||
meta.helm.sh/release-namespace: awx
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-controller-manager
|
||||
namespace: awx
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
cattle.io/timestamp: '2026-05-15T20:05:15Z'
|
||||
kubectl.kubernetes.io/default-container: awx-manager
|
||||
kubectl.kubernetes.io/restartedAt: '2026-05-15T20:01:42Z'
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --secure-listen-address=0.0.0.0:8443
|
||||
- --upstream=http://127.0.0.1:8080/
|
||||
- --logtostderr=true
|
||||
- --v=0
|
||||
image: quay.io/brancz/kube-rbac-proxy:v0.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kube-rbac-proxy
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
- args:
|
||||
- --health-probe-bind-address=:6789
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
- --leader-election-id=awx-operator
|
||||
env:
|
||||
- name: ANSIBLE_GATHERING
|
||||
value: explicit
|
||||
- name: ANSIBLE_DEBUG_LOGS
|
||||
value: 'false'
|
||||
- name: WATCH_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
image: quay.io/ansible/awx-operator:2.19.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 6789
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: awx-manager
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 6789
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 960Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /opt/ansible/roles/installer/defaults
|
||||
name: installer-defaults-override
|
||||
dnsPolicy: ClusterFirst
|
||||
imagePullSecrets:
|
||||
- name: redhat-operators-pull-secret
|
||||
initContainers:
|
||||
- command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp /opt/ansible/roles/installer/defaults/main.yml /mnt/defaults/main.yml
|
||||
|
||||
echo "" >> /mnt/defaults/main.yml
|
||||
|
||||
echo "web_manage_replicas: true" >> /mnt/defaults/main.yml
|
||||
|
||||
echo "task_manage_replicas: true" >> /mnt/defaults/main.yml
|
||||
|
||||
'
|
||||
image: quay.io/ansible/awx-operator:2.19.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: patch-defaults
|
||||
resources: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /mnt/defaults
|
||||
name: installer-defaults-override
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccount: awx-operator-controller-manager
|
||||
serviceAccountName: awx-operator-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: installer-defaults-override
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
name: awx-task
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-task
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
|
||||
checksum-configmaps-pre_stop_scripts: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
||||
checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
|
||||
checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
|
||||
checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
|
||||
checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
|
||||
checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
||||
kubectl.kubernetes.io/default-container: awx-task
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-task
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- redis-server
|
||||
- /etc/redis.conf
|
||||
image: docker.io/redis:7
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: redis
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/redis.conf
|
||||
name: awx-redis-config
|
||||
readOnly: true
|
||||
subPath: redis.conf
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /data
|
||||
name: awx-redis-data
|
||||
- args:
|
||||
- /usr/bin/launch_awx_task.sh
|
||||
env:
|
||||
- name: AWX_COMPONENT
|
||||
value: task
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_task.conf
|
||||
- name: AWX_SKIP_MIGRATIONS
|
||||
value: '1'
|
||||
- name: MY_POD_UID
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.uid
|
||||
- name: MY_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: MY_POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-task
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/execution_environments.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: execution_environments.py
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/conf.d/ldap.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: ldap.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
- mountPath: /etc/receptor/
|
||||
name: awx-receptor-config
|
||||
- mountPath: /etc/receptor/work_private_key.pem
|
||||
name: awx-receptor-work-signing
|
||||
readOnly: true
|
||||
subPath: work-private-key.pem
|
||||
- mountPath: /var/run/receptor
|
||||
name: receptor-socket
|
||||
- mountPath: /var/lib/awx/projects
|
||||
name: awx-projects
|
||||
- args:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- "if [ ! -f /etc/receptor/receptor.conf ]; then\n cp /etc/receptor/receptor-default.conf\
|
||||
\ /etc/receptor/receptor.conf\n sed -i \"s/HOSTNAME/$HOSTNAME/g\" /etc/receptor/receptor.conf\n\
|
||||
fi\nexec receptor --config /etc/receptor/receptor.conf\n"
|
||||
image: quay.io/ansible/awx-ee:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-ee
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/receptor/receptor-default.conf
|
||||
name: awx-default-receptor-config
|
||||
subPath: receptor.conf
|
||||
- mountPath: /etc/receptor/
|
||||
name: awx-receptor-config
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.crt
|
||||
- mountPath: /etc/receptor/work_private_key.pem
|
||||
name: awx-receptor-work-signing
|
||||
readOnly: true
|
||||
subPath: work-private-key.pem
|
||||
- mountPath: /etc/receptor/tls/
|
||||
name: awx-receptor-tls
|
||||
- mountPath: /var/run/receptor
|
||||
name: receptor-socket
|
||||
- mountPath: /var/lib/awx/projects
|
||||
name: awx-projects
|
||||
- args:
|
||||
- /usr/bin/launch_awx_rsyslog.sh
|
||||
env:
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_rsyslog.conf
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-rsyslog
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
dnsPolicy: ClusterFirst
|
||||
initContainers:
|
||||
- command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- wait-for-migrations
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: init-database
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- "hostname=$MY_POD_NAME\nreceptor --cert-makereq \\\n bits=2048 \\\n commonname=$hostname\
|
||||
\ \\\n dnsname=$hostname \\\n nodeid=$hostname \\\n outreq=/etc/receptor/tls/receptor.req\
|
||||
\ \\\n outkey=/etc/receptor/tls/receptor.key\nreceptor --cert-signreq \\\
|
||||
\n req=/etc/receptor/tls/receptor.req \\\n cacert=/etc/receptor/tls/ca/mesh-CA.crt\
|
||||
\ \\\n cakey=/etc/receptor/tls/ca/mesh-CA.key \\\n outcert=/etc/receptor/tls/receptor.crt\
|
||||
\ \\\n notafter=$(date --iso-8601=seconds --utc --date \"10 years\") \\\
|
||||
\n verify=yes\n"
|
||||
env:
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
image: quay.io/ansible/awx-ee:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: init-receptor
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.crt
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.key
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.key
|
||||
- mountPath: /etc/receptor/tls/
|
||||
name: awx-receptor-tls
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 0
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
serviceAccount: awx
|
||||
serviceAccountName: awx
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- name: awx-application-credentials
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: credentials.py
|
||||
path: credentials.py
|
||||
- key: ldap.py
|
||||
path: ldap.py
|
||||
- key: execution_environments.py
|
||||
path: execution_environments.py
|
||||
secretName: awx-app-credentials
|
||||
- emptyDir: {}
|
||||
name: awx-receptor-tls
|
||||
- name: awx-receptor-ca
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-ca
|
||||
- name: awx-receptor-work-signing
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-work-signing
|
||||
- name: awx-secret-key
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: secret_key
|
||||
path: SECRET_KEY
|
||||
secretName: awx-secret-key
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: settings
|
||||
path: settings.py
|
||||
name: awx-awx-configmap
|
||||
name: awx-settings
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: nginx_conf
|
||||
path: nginx.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-nginx-conf
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: redis_conf
|
||||
path: redis.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-redis-config
|
||||
- emptyDir: {}
|
||||
name: awx-redis-socket
|
||||
- emptyDir: {}
|
||||
name: awx-redis-data
|
||||
- emptyDir: {}
|
||||
name: rsyslog-socket
|
||||
- emptyDir: {}
|
||||
name: receptor-socket
|
||||
- emptyDir: {}
|
||||
name: awx-receptor-config
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: receptor_conf
|
||||
path: receptor.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-default-receptor-config
|
||||
- emptyDir: {}
|
||||
name: awx-projects
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
name: awx-web
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
|
||||
checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
|
||||
checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
|
||||
checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
|
||||
checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
|
||||
checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
||||
kubectl.kubernetes.io/default-container: awx-web
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- redis-server
|
||||
- /etc/redis.conf
|
||||
image: docker.io/redis:7
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: redis
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/redis.conf
|
||||
name: awx-redis-config
|
||||
readOnly: true
|
||||
subPath: redis.conf
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /data
|
||||
name: awx-redis-data
|
||||
- args:
|
||||
- /usr/bin/launch_awx_web.sh
|
||||
env:
|
||||
- name: AWX_COMPONENT
|
||||
value: web
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_web.conf
|
||||
- name: MY_POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: MY_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: UWSGI_MOUNT_PATH
|
||||
value: /
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-web
|
||||
ports:
|
||||
- containerPort: 8052
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/uwsgi.ini
|
||||
name: awx-uwsgi-config
|
||||
readOnly: true
|
||||
subPath: uwsgi.conf
|
||||
- mountPath: /etc/tower/conf.d/execution_environments.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: execution_environments.py
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/conf.d/ldap.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: ldap.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /etc/nginx/nginx.conf
|
||||
name: awx-nginx-conf
|
||||
readOnly: true
|
||||
subPath: nginx.conf
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.crt
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.key
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.key
|
||||
- mountPath: /etc/receptor/work_public_key.pem
|
||||
name: awx-receptor-work-signing
|
||||
readOnly: true
|
||||
subPath: work-public-key.pem
|
||||
- args:
|
||||
- /usr/bin/launch_awx_rsyslog.sh
|
||||
env:
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_rsyslog.conf
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-rsyslog
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 0
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
serviceAccount: awx
|
||||
serviceAccountName: awx
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- name: awx-receptor-ca
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-ca
|
||||
- name: awx-receptor-work-signing
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-work-signing
|
||||
- name: awx-application-credentials
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: credentials.py
|
||||
path: credentials.py
|
||||
- key: ldap.py
|
||||
path: ldap.py
|
||||
- key: execution_environments.py
|
||||
path: execution_environments.py
|
||||
secretName: awx-app-credentials
|
||||
- name: awx-secret-key
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: secret_key
|
||||
path: SECRET_KEY
|
||||
secretName: awx-secret-key
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: settings
|
||||
path: settings.py
|
||||
name: awx-awx-configmap
|
||||
name: awx-settings
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: nginx_conf
|
||||
path: nginx.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-nginx-conf
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: redis_conf
|
||||
path: redis.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-redis-config
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: uwsgi_conf
|
||||
path: uwsgi.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-uwsgi-config
|
||||
- emptyDir: {}
|
||||
name: awx-redis-socket
|
||||
- emptyDir: {}
|
||||
name: awx-redis-data
|
||||
- emptyDir: {}
|
||||
name: rsyslog-socket
|
||||
- emptyDir: {}
|
||||
name: receptor-socket
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: receptor_conf
|
||||
path: receptor.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-receptor-config
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
metallb.io/ip-allocated-from-pool: lan-pool
|
||||
metallb.universe.tf/ip-allocated-from-pool: default-pool
|
||||
metallb.universe.tf/loadBalancerIP: 140.44.4.30
|
||||
finalizers:
|
||||
- service.kubernetes.io/load-balancer-cleanup
|
||||
name: awx-lb
|
||||
namespace: awx
|
||||
spec:
|
||||
allocateLoadBalancerNodePorts: true
|
||||
clusterIP: 10.43.229.215
|
||||
clusterIPs:
|
||||
- 10.43.229.215
|
||||
externalTrafficPolicy: Cluster
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
loadBalancerIP: 140.44.4.30
|
||||
ports:
|
||||
- name: webport
|
||||
nodePort: 30015
|
||||
port: 87
|
||||
protocol: TCP
|
||||
targetPort: 80
|
||||
selector:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
sessionAffinity: None
|
||||
type: LoadBalancer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: awx
|
||||
meta.helm.sh/release-namespace: awx
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-controller-manager-metrics-service
|
||||
namespace: awx
|
||||
spec:
|
||||
clusterIP: 10.43.164.198
|
||||
clusterIPs:
|
||||
- 10.43.164.198
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/instance: postgres-15-awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: postgres-15
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
name: awx-postgres-15
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
clusterIP: None
|
||||
clusterIPs:
|
||||
- None
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- port: 5432
|
||||
protocol: TCP
|
||||
targetPort: 5432
|
||||
selector:
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/instance: postgres-15-awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: postgres-15
|
||||
app.kubernetes.io/part-of: awx
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
name: awx-service
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
clusterIP: 10.43.161.26
|
||||
clusterIPs:
|
||||
- 10.43.161.26
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8052
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8052
|
||||
selector:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/service.serversscheme: http
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/name: awx-web
|
||||
name: awx-ingress
|
||||
namespace: awx
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: awx.snarfnet.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: awx-service
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- hosts:
|
||||
- awx.snarfnet.net
|
||||
secretName: tls-awx-cert2
|
||||
252
manifests/aerodrome/grafana/grafana.yaml
Normal file
252
manifests/aerodrome/grafana/grafana.yaml
Normal file
@@ -0,0 +1,252 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: grafana
|
||||
meta.helm.sh/release-namespace: default
|
||||
labels:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: grafana
|
||||
app.kubernetes.io/version: 11.3.1
|
||||
helm.sh/chart: grafana-8.6.4
|
||||
name: grafana
|
||||
namespace: default
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/name: grafana
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
cattle.io/timestamp: '2025-10-04T04:05:51Z'
|
||||
checksum/config: f6e2070ec7fff0d4bb82d9a8fabedb9934e42e64a00d72e25402d46520734840
|
||||
checksum/sc-dashboard-provider-config: e70bf6a851099d385178a76de9757bb0bef8299da6d8443602590e44f05fdf24
|
||||
checksum/secret: 4eccb44a21c8117c1dbfbfe43f2ac844b240cd2482bc9fba8e4047442d121dc2
|
||||
kubectl.kubernetes.io/default-container: grafana
|
||||
kubectl.kubernetes.io/restartedAt: '2026-10-28T17:14:50.583825+00:00'
|
||||
labels:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/name: grafana
|
||||
app.kubernetes.io/version: 11.3.1
|
||||
helm.sh/chart: grafana-8.6.4
|
||||
spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- env:
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: GF_SECURITY_ADMIN_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: admin-user
|
||||
name: grafana
|
||||
- name: GF_SECURITY_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: admin-password
|
||||
name: grafana
|
||||
- name: GF_PATHS_DATA
|
||||
value: /var/lib/grafana/
|
||||
- name: GF_PATHS_LOGS
|
||||
value: /var/log/grafana
|
||||
- name: GF_PATHS_PLUGINS
|
||||
value: /var/lib/grafana/plugins
|
||||
- name: GF_PATHS_PROVISIONING
|
||||
value: /etc/grafana/provisioning
|
||||
image: docker.io/grafana/grafana:11.6.16
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 10
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 30
|
||||
name: grafana
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: grafana
|
||||
protocol: TCP
|
||||
- containerPort: 9094
|
||||
name: gossip-tcp
|
||||
protocol: TCP
|
||||
- containerPort: 9094
|
||||
name: gossip-udp
|
||||
protocol: UDP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /api/health
|
||||
port: 3000
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/grafana/grafana.ini
|
||||
name: config
|
||||
subPath: grafana.ini
|
||||
- mountPath: /var/lib/grafana
|
||||
name: storage
|
||||
dnsPolicy: ClusterFirst
|
||||
enableServiceLinks: true
|
||||
initContainers:
|
||||
- command:
|
||||
- chown
|
||||
- -R
|
||||
- 472:472
|
||||
- /var/lib/grafana
|
||||
image: docker.io/library/busybox:1.31.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: init-chown-data
|
||||
resources: {}
|
||||
securityContext:
|
||||
capabilities:
|
||||
add:
|
||||
- CHOWN
|
||||
runAsNonRoot: false
|
||||
runAsUser: 0
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/grafana
|
||||
name: storage
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 472
|
||||
runAsGroup: 472
|
||||
runAsNonRoot: true
|
||||
runAsUser: 472
|
||||
serviceAccount: grafana
|
||||
serviceAccountName: grafana
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
name: grafana
|
||||
name: config
|
||||
- name: storage
|
||||
persistentVolumeClaim:
|
||||
claimName: grafana
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: grafana
|
||||
meta.helm.sh/release-namespace: default
|
||||
labels:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: grafana
|
||||
app.kubernetes.io/version: 11.3.1
|
||||
helm.sh/chart: grafana-8.6.4
|
||||
name: grafana
|
||||
namespace: default
|
||||
spec:
|
||||
clusterIP: 10.43.216.183
|
||||
clusterIPs:
|
||||
- 10.43.216.183
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: service
|
||||
port: 8080
|
||||
protocol: TCP
|
||||
targetPort: 3000
|
||||
selector:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/name: grafana
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
metallb.io/ip-allocated-from-pool: lan-pool
|
||||
metallb.universe.tf/ip-allocated-from-pool: default-pool
|
||||
metallb.universe.tf/loadBalancerIP: 140.44.4.32
|
||||
finalizers:
|
||||
- service.kubernetes.io/load-balancer-cleanup
|
||||
labels:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/name: grafana
|
||||
name: grafana-lb
|
||||
namespace: default
|
||||
spec:
|
||||
allocateLoadBalancerNodePorts: true
|
||||
clusterIP: 10.43.240.82
|
||||
clusterIPs:
|
||||
- 10.43.240.82
|
||||
externalTrafficPolicy: Cluster
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
loadBalancerIP: 140.44.4.32
|
||||
ports:
|
||||
- name: grafana-lb
|
||||
nodePort: 32758
|
||||
port: 88
|
||||
protocol: TCP
|
||||
targetPort: 3000
|
||||
selector:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/name: grafana
|
||||
sessionAffinity: None
|
||||
type: LoadBalancer
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/instance: grafana
|
||||
app.kubernetes.io/name: grafana
|
||||
name: grafana
|
||||
namespace: default
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: grafana.snarfnet.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: grafana-lb
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- hosts:
|
||||
- grafana.snarfnet.net
|
||||
secretName: firefly-tls-cert
|
||||
138
manifests/aerodrome/uptime-kuma/uptime-kuma.yaml
Normal file
138
manifests/aerodrome/uptime-kuma/uptime-kuma.yaml
Normal file
@@ -0,0 +1,138 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: uptime-kuma-2-1756668961
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/instance: uptime-kuma-2-1756668961
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: uptime-kuma
|
||||
app.kubernetes.io/version: 2.3.0
|
||||
helm.sh/chart: uptime-kuma-4.1.0
|
||||
name: uptime-kuma-2-1756668961
|
||||
namespace: monitoring
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: uptime-kuma-2-1756668961
|
||||
app.kubernetes.io/name: uptime-kuma
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
cattle.io/timestamp: '2026-09-30T03:22:55Z'
|
||||
labels:
|
||||
app.kubernetes.io/instance: uptime-kuma-2-1756668961
|
||||
app.kubernetes.io/name: uptime-kuma
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
containers:
|
||||
- image: louislam/uptime-kuma:2.5.9
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- extra/healthcheck
|
||||
failureThreshold: 3
|
||||
initialDelaySeconds: 180
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 2
|
||||
name: uptime-kuma
|
||||
ports:
|
||||
- containerPort: 3001
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: 3001
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources: {}
|
||||
securityContext: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /app/data
|
||||
name: storage
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: default
|
||||
serviceAccountName: default
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- name: storage
|
||||
persistentVolumeClaim:
|
||||
claimName: uptime-kuma-2-1756668961-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: uptime-kuma-2-1756668961
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/instance: uptime-kuma-2-1756668961
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: uptime-kuma
|
||||
app.kubernetes.io/version: 2.3.0
|
||||
helm.sh/chart: uptime-kuma-4.1.0
|
||||
name: uptime-kuma-2-1756668961
|
||||
namespace: monitoring
|
||||
spec:
|
||||
clusterIP: 10.43.107.2
|
||||
clusterIPs:
|
||||
- 10.43.107.2
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
port: 3001
|
||||
protocol: TCP
|
||||
targetPort: 3001
|
||||
selector:
|
||||
app.kubernetes.io/instance: uptime-kuma-2-1756668961
|
||||
app.kubernetes.io/name: uptime-kuma
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.middlewares: monitoring-authentik-forwardauth@kubernetescrd
|
||||
labels:
|
||||
app.kubernetes.io/name: uptime-kuma
|
||||
name: uptime-ing
|
||||
namespace: monitoring
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: uptime.snarfnet.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: uptime-lb
|
||||
port:
|
||||
number: 448
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- hosts:
|
||||
- uptime.snarfnet.net
|
||||
secretName: tls-uptime-cert
|
||||
173
manifests/spaceport/coder/coder.yaml
Normal file
173
manifests/spaceport/coder/coder.yaml
Normal file
@@ -0,0 +1,173 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: coder
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/instance: coder
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 2.34.3
|
||||
helm.sh/chart: coder-2.34.3
|
||||
name: coder
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: coder
|
||||
app.kubernetes.io/name: coder
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
app.kubernetes.io/component: coderd
|
||||
kubectl.kubernetes.io/restartedAt: '2026-10-28T17:41:30.902229+00:00'
|
||||
labels:
|
||||
app.kubernetes.io/instance: coder
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 2.34.3
|
||||
helm.sh/chart: coder-2.34.3
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- coder
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- args:
|
||||
- server
|
||||
command:
|
||||
- /opt/coder
|
||||
env:
|
||||
- name: CODER_HTTP_ADDRESS
|
||||
value: 0.0.0.0:8080
|
||||
- name: CODER_PROMETHEUS_ADDRESS
|
||||
value: 0.0.0.0:2112
|
||||
- name: CODER_PPROF_ADDRESS
|
||||
value: 0.0.0.0:6060
|
||||
- name: KUBE_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: CODER_DERP_SERVER_RELAY_URL
|
||||
value: http://$(KUBE_POD_IP):8080
|
||||
- name: CODER_ACCESS_URL
|
||||
value: https://coder.snarfnet.net
|
||||
- name: CODER_OIDC_ISSUER_URL
|
||||
value: https://authentik.snarfnet.net/application/o/coder/
|
||||
- name: CODER_OIDC_CLIENT_ID
|
||||
value: coder-86c7516d
|
||||
- name: CODER_OIDC_CLIENT_SECRET
|
||||
value: GWYwV816HcUZpl_qqG9lTmI-85QihNJexaoS8tL8AoDGqQ4opwwWbw
|
||||
- name: CODER_OIDC_SCOPES
|
||||
value: openid,profile,email,groups
|
||||
- name: CODER_OIDC_SIGN_IN_TEXT
|
||||
value: Sign in with Authentik
|
||||
- name: CODER_OIDC_ALLOW_SIGNUPS
|
||||
value: 'true'
|
||||
image: ghcr.io/coder/coder:v2.38.6
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle: {}
|
||||
name: coder
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 1028Mi
|
||||
requests:
|
||||
cpu: '2'
|
||||
memory: 1028Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
runAsGroup: 1000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /home/coder
|
||||
name: coder-data
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: coder
|
||||
serviceAccountName: coder
|
||||
terminationGracePeriodSeconds: 60
|
||||
volumes:
|
||||
- name: coder-data
|
||||
persistentVolumeClaim:
|
||||
claimName: coder-data
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: coder
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
metallb.io/ip-allocated-from-pool: lan-pool
|
||||
metallb.universe.tf/loadBalancerIP: 140.44.4.58
|
||||
finalizers:
|
||||
- service.kubernetes.io/load-balancer-cleanup
|
||||
labels:
|
||||
app.kubernetes.io/instance: coder
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: coder
|
||||
app.kubernetes.io/part-of: coder
|
||||
app.kubernetes.io/version: 2.34.3
|
||||
helm.sh/chart: coder-2.34.3
|
||||
name: coder
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
allocateLoadBalancerNodePorts: true
|
||||
clusterIP: 10.43.128.151
|
||||
clusterIPs:
|
||||
- 10.43.128.151
|
||||
externalTrafficPolicy: Cluster
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
loadBalancerIP: 140.44.4.58
|
||||
ports:
|
||||
- name: http
|
||||
nodePort: 31775
|
||||
port: 96
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app.kubernetes.io/instance: coder
|
||||
app.kubernetes.io/name: coder
|
||||
sessionAffinity: None
|
||||
type: LoadBalancer
|
||||
2231
manifests/spaceport/gitea/gitea.yaml
Normal file
2231
manifests/spaceport/gitea/gitea.yaml
Normal file
File diff suppressed because it is too large
Load Diff
195
manifests/spaceport/homepage/homepage.yaml
Normal file
195
manifests/spaceport/homepage/homepage.yaml
Normal file
@@ -0,0 +1,195 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: homepage-2-1744068158
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
values-checksum: 49348e8f2cbd3272bd4954b0c4ff1480780ebd91277816507927bed3fbb0043a
|
||||
labels:
|
||||
app.kubernetes.io/instance: homepage-2-1744068158
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: homepage-2-1744068158
|
||||
app.kubernetes.io/version: v1.2.0
|
||||
helm.sh/chart: homepage-2.1.0
|
||||
name: homepage-2-1744068158
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: homepage-2-1744068158
|
||||
app.kubernetes.io/name: homepage-2-1744068158
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
cattle.io/timestamp: '2026-01-09T21:19:17Z'
|
||||
values-checksum: 49348e8f2cbd3272bd4954b0c4ff1480780ebd91277816507927bed3fbb0043a
|
||||
labels:
|
||||
app.kubernetes.io/instance: homepage-2-1744068158
|
||||
app.kubernetes.io/name: homepage-2-1744068158
|
||||
spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- env:
|
||||
- name: HOMEPAGE_ALLOWED_HOSTS
|
||||
value: homepage.snarfnet.net
|
||||
image: ghcr.io/gethomepage/homepage:v1.4.5
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: 3000
|
||||
timeoutSeconds: 1
|
||||
name: homepage-2-1744068158
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: 3000
|
||||
timeoutSeconds: 1
|
||||
resources: {}
|
||||
startupProbe:
|
||||
failureThreshold: 30
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: 3000
|
||||
timeoutSeconds: 1
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /app/config
|
||||
name: homepage-base-config
|
||||
- mountPath: /app/config/bookmarks.yaml
|
||||
name: homepage-config
|
||||
subPath: bookmarks.yaml
|
||||
- mountPath: /app/config/docker.yaml
|
||||
name: homepage-config
|
||||
subPath: docker.yaml
|
||||
- mountPath: /app/config/kubernetes.yaml
|
||||
name: homepage-config
|
||||
subPath: kubernetes.yaml
|
||||
- mountPath: /app/config/services.yaml
|
||||
name: homepage-config
|
||||
subPath: services.yaml
|
||||
- mountPath: /app/config/settings.yaml
|
||||
name: homepage-config
|
||||
subPath: settings.yaml
|
||||
- mountPath: /app/config/widgets.yaml
|
||||
name: homepage-config
|
||||
subPath: widgets.yaml
|
||||
- mountPath: /app/config/logs
|
||||
name: logs
|
||||
dnsPolicy: ClusterFirst
|
||||
enableServiceLinks: true
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: default
|
||||
serviceAccountName: default
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: homepage-base-config
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
name: homepage-2-1744068158
|
||||
name: homepage-config
|
||||
- emptyDir: {}
|
||||
name: logs
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: homepage-2-1744068158
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/instance: homepage-2-1744068158
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: homepage-2-1744068158
|
||||
app.kubernetes.io/service: homepage-2-1744068158
|
||||
app.kubernetes.io/version: v1.2.0
|
||||
helm.sh/chart: homepage-2.1.0
|
||||
name: homepage-2-1744068158
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
clusterIP: 10.43.36.247
|
||||
clusterIPs:
|
||||
- 10.43.36.247
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app.kubernetes.io/instance: homepage-2-1744068158
|
||||
app.kubernetes.io/name: homepage-2-1744068158
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
bookmarks.yaml: "- Developer:\n - Github:\n - abbr: GH\n href: https://github.com/\n"
|
||||
docker.yaml: ''
|
||||
kubernetes.yaml: 'mode: disable
|
||||
|
||||
'
|
||||
services.yaml: "- Critical Services:\n - Authentik:\n icon: authentik.png\n\
|
||||
\ href: https://authentik.snarfnet.net\n widget:\n type: authentik\n\
|
||||
\ url: https://authentik.snarfnet.net\n fields: [\"users\", \"loginsLast24H\"\
|
||||
, \"failedLoginsLast24H\"]\n key: 7HamapUhYizcNudHDIT5IFy3XEpRgeKgqr1Pw4ub9eTpAjMAzB8Aur1Z6dUU\n\
|
||||
\ - PeaNUT UPS:\n icon: peanut.png\n href: https://portal.snarfnet.net\n\
|
||||
\ widget:\n type: peanut\n url: https://peanut.snarfnet.net\n\
|
||||
\ fields: [\"battery_charge\", \"ups_load\", \"ups_status\"]\n key:\
|
||||
\ server-closet\n - Unifi Controller:\n icon: unifi.png\n href: https://unifi.ui.com\n\
|
||||
\ widget:\n type: unifi\n url: https://140.44.44.1\n username:\
|
||||
\ Snarf\n password: Katzir476!!!\n- Git Ops:\n - Gitea:\n icon: gitea.png\n\
|
||||
\ href: https://git.snarfnet.net\n widget:\n type: gitea\n \
|
||||
\ url: https://git.snarfnet.net\n fields: [\"repositories\", \"notifications\"\
|
||||
, \"issues\", \"pulls\"]\n key: 47c10c54574131c007302b246352f653facb5062\n\
|
||||
- Infrastructure:\n - NGINX proxy manager:\n icon: nginx-proxy-manager\n\
|
||||
\ href: https://nginx.snarfnet.net\n widget:\n type: npm\n \
|
||||
\ url: https://nginx.snarfnet.net\n fields: [\"enabled\", \"disabled\"\
|
||||
, \"total\"]\n username: snarf@snarfnet.net\n password: Katzir476!\n\
|
||||
\ - Uptime Kuma:\n icon: uptime-kuma\n href: https://uptime.snarfnet.net\n\
|
||||
\ widget:\n type: uptimekuma\n url: https://uptime.snarfnet.net\n\
|
||||
\ fields: [\"up\", \"down\", \"uptime\", \"incident\"]\n slug: public\n"
|
||||
settings.yaml: "title: SnarfNet Landing Zone\nheaderStyle: boxedWidgets\ncolor:\
|
||||
\ green\ntheme: dark\nlayout:\n Critical Services:\n Git Ops:\n Infrastructure:\n\
|
||||
showStats: true\nproviders:\n longhorn:\n url: https://longhorn.aerodrome.snarfnet.net\n"
|
||||
widgets.yaml: "- resources:\n backend: resources\n cpu: true\n expanded:\
|
||||
\ true\n memory: true\n- search:\n provider: duckduckgo\n target: _blank\n\
|
||||
- longhorn:\n expanded: true\n total: true\n labels: true\n nodes:\
|
||||
\ true\n"
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: homepage-2-1744068158
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/instance: homepage-2-1744068158
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: homepage-2-1744068158
|
||||
app.kubernetes.io/version: v1.2.0
|
||||
helm.sh/chart: homepage-2.1.0
|
||||
name: homepage-2-1744068158
|
||||
namespace: infrastructure
|
||||
336
manifests/spaceport/jenkins/jenkins.yaml
Normal file
336
manifests/spaceport/jenkins/jenkins.yaml
Normal file
@@ -0,0 +1,336 @@
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: jenkins
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/component: jenkins-controller
|
||||
app.kubernetes.io/instance: jenkins
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: jenkins
|
||||
helm.sh/chart: jenkins-5.9.18
|
||||
name: jenkins
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: Retain
|
||||
whenScaled: Retain
|
||||
podManagementPolicy: OrderedReady
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: jenkins-controller
|
||||
app.kubernetes.io/instance: jenkins
|
||||
serviceName: jenkins
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: ad12688985f56d830ccee6722b20739f268bf95f97d84591925bb0a0d9b871f0
|
||||
labels:
|
||||
app.kubernetes.io/component: jenkins-controller
|
||||
app.kubernetes.io/instance: jenkins
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: jenkins
|
||||
helm.sh/chart: jenkins-5.9.18
|
||||
spec:
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- args:
|
||||
- --httpPort=8080
|
||||
env:
|
||||
- name: SECRETS
|
||||
value: /run/secrets/additional
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: JAVA_OPTS
|
||||
value: '-Dcasc.reload.token=$(POD_NAME) '
|
||||
- name: JENKINS_OPTS
|
||||
value: '--webroot=/var/jenkins_cache/war '
|
||||
- name: JENKINS_SLAVE_AGENT_PORT
|
||||
value: '50000'
|
||||
- name: CASC_JENKINS_CONFIG
|
||||
value: /var/jenkins_home/casc_configs
|
||||
image: docker.io/jenkins/jenkins:2.589-jdk21
|
||||
imagePullPolicy: Always
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /login
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: jenkins
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: 50000
|
||||
name: agent-listener
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /login
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
startupProbe:
|
||||
failureThreshold: 12
|
||||
httpGet:
|
||||
path: /login
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/jenkins_home
|
||||
name: jenkins-home
|
||||
- mountPath: /var/jenkins_config
|
||||
name: jenkins-config
|
||||
readOnly: true
|
||||
- mountPath: /usr/share/jenkins/ref/plugins/
|
||||
name: plugin-dir
|
||||
- mountPath: /var/jenkins_home/casc_configs
|
||||
name: sc-config-volume
|
||||
- mountPath: /run/secrets/additional
|
||||
name: jenkins-secrets
|
||||
readOnly: true
|
||||
- mountPath: /var/jenkins_cache
|
||||
name: jenkins-cache
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
- env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: LABEL
|
||||
value: jenkins-jenkins-config
|
||||
- name: HEALTH_PORT
|
||||
value: '8060'
|
||||
- name: FOLDER
|
||||
value: /var/jenkins_home/casc_configs
|
||||
- name: NAMESPACE
|
||||
value: infrastructure
|
||||
- name: REQ_URL
|
||||
value: http://localhost:8080/reload-configuration-as-code/?casc-reload-token=$(POD_NAME)
|
||||
- name: REQ_METHOD
|
||||
value: POST
|
||||
- name: REQ_RETRY_CONNECT
|
||||
value: '10'
|
||||
image: docker.io/kiwigrid/k8s-sidecar:2.6.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: config-reload
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/jenkins_home/casc_configs
|
||||
name: sc-config-volume
|
||||
- mountPath: /var/jenkins_home
|
||||
name: jenkins-home
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
dnsPolicy: ClusterFirst
|
||||
enableServiceLinks: false
|
||||
initContainers:
|
||||
- env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: LABEL
|
||||
value: jenkins-jenkins-config
|
||||
- name: HEALTH_PORT
|
||||
value: '8060'
|
||||
- name: FOLDER
|
||||
value: /var/jenkins_home/casc_configs
|
||||
- name: NAMESPACE
|
||||
value: infrastructure
|
||||
- name: METHOD
|
||||
value: LIST
|
||||
image: docker.io/kiwigrid/k8s-sidecar:2.6.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: config-reload-init
|
||||
resources: {}
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/jenkins_home/casc_configs
|
||||
name: sc-config-volume
|
||||
- mountPath: /var/jenkins_home
|
||||
name: jenkins-home
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
- command:
|
||||
- sh
|
||||
- /var/jenkins_config/apply_config.sh
|
||||
image: docker.io/jenkins/jenkins:2.555.1-jdk21
|
||||
imagePullPolicy: Always
|
||||
name: init
|
||||
resources:
|
||||
limits:
|
||||
cpu: '2'
|
||||
memory: 4Gi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 256Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsGroup: 1000
|
||||
runAsUser: 1000
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/jenkins_home
|
||||
name: jenkins-home
|
||||
- mountPath: /var/jenkins_config
|
||||
name: jenkins-config
|
||||
- mountPath: /usr/share/jenkins/ref/plugins
|
||||
name: plugins
|
||||
- mountPath: /var/jenkins_plugins
|
||||
name: plugin-dir
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
serviceAccount: jenkins
|
||||
serviceAccountName: jenkins
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: plugins
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
name: jenkins
|
||||
name: jenkins-config
|
||||
- emptyDir: {}
|
||||
name: plugin-dir
|
||||
- name: jenkins-secrets
|
||||
projected:
|
||||
defaultMode: 420
|
||||
sources:
|
||||
- secret:
|
||||
items:
|
||||
- key: jenkins-admin-user
|
||||
path: chart-admin-username
|
||||
- key: jenkins-admin-password
|
||||
path: chart-admin-password
|
||||
name: jenkins
|
||||
- emptyDir: {}
|
||||
name: jenkins-cache
|
||||
- name: jenkins-home
|
||||
persistentVolumeClaim:
|
||||
claimName: jenkins
|
||||
- emptyDir: {}
|
||||
name: sc-config-volume
|
||||
- emptyDir: {}
|
||||
name: tmp-volume
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
partition: 0
|
||||
type: RollingUpdate
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: jenkins
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/component: jenkins-controller
|
||||
app.kubernetes.io/instance: jenkins
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: jenkins
|
||||
helm.sh/chart: jenkins-5.9.18
|
||||
name: jenkins
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
clusterIP: 10.43.106.157
|
||||
clusterIPs:
|
||||
- 10.43.106.157
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
port: 101
|
||||
protocol: TCP
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app.kubernetes.io/component: jenkins-controller
|
||||
app.kubernetes.io/instance: jenkins
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: jenkins
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/component: jenkins-controller
|
||||
app.kubernetes.io/instance: jenkins
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: jenkins
|
||||
helm.sh/chart: jenkins-5.9.18
|
||||
name: jenkins-agent
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
clusterIP: 10.43.107.50
|
||||
clusterIPs:
|
||||
- 10.43.107.50
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: agent-listener
|
||||
port: 50000
|
||||
protocol: TCP
|
||||
targetPort: 50000
|
||||
selector:
|
||||
app.kubernetes.io/component: jenkins-controller
|
||||
app.kubernetes.io/instance: jenkins
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
302
manifests/spaceport/semaphore/semaphore.yaml
Normal file
302
manifests/spaceport/semaphore/semaphore.yaml
Normal file
@@ -0,0 +1,302 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: semaphore
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/instance: semaphore
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: semaphore
|
||||
app.kubernetes.io/version: 2.17.34
|
||||
helm.sh/chart: semaphore-16.1.2
|
||||
name: semaphore
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: semaphore
|
||||
app.kubernetes.io/name: semaphore
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: 6db2d80fdda45e7be278174345179b6ece77d6ca957902f08bb3ba861921e4a8
|
||||
checksum/secret-admin: 3c0ad6cefcee43617216b7c1703bdd864766da7cee9e43f18724fe4a70c89545
|
||||
checksum/secret-general: 91136cb91b1e8cc2540294d8ecd541338bffdb2127897e8bea112160e6a3705d
|
||||
checksum/secret-runner: 8e3582b533083a64b4205c22d9b2d476f93d90b27276d88e74fe4c885f7db60a
|
||||
kubectl.kubernetes.io/restartedAt: '2026-10-28T18:13:14.547755+00:00'
|
||||
labels:
|
||||
app.kubernetes.io/instance: semaphore
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: semaphore
|
||||
app.kubernetes.io/version: 2.17.34
|
||||
helm.sh/chart: semaphore-16.1.2
|
||||
spec:
|
||||
containers:
|
||||
- env:
|
||||
- name: SEMAPHORE_PORT
|
||||
value: '3000'
|
||||
- name: SEMAPHORE_GIT_CLIENT
|
||||
value: cmd_git
|
||||
- name: SEMAPHORE_TMP_PATH
|
||||
value: /tmp/semaphore
|
||||
- name: SEMAPHORE_MAX_PARALLEL_TASKS
|
||||
value: '0'
|
||||
- name: SEMAPHORE_PASSWORD_LOGIN_DISABLED
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_USE_REMOTE_RUNNER
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_DB_DIALECT
|
||||
value: bolt
|
||||
- name: SEMAPHORE_DB_HOST
|
||||
value: /var/lib/semaphore/database.boltdb
|
||||
- name: SEMAPHORE_LDAP_ENABLE
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_EMAIL_ALERT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_TELEGRAM_ALERT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_SLACK_ALERT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: token
|
||||
name: semaphore-runner
|
||||
- name: SEMAPHORE_COOKIE_HASH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: cookieHash
|
||||
name: semaphore-general
|
||||
- name: SEMAPHORE_COOKIE_ENCRYPTION
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: cookieEncryption
|
||||
name: semaphore-general
|
||||
- name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: accesskeyEncryption
|
||||
name: semaphore-general
|
||||
- name: SEMAPHORE_OIDC_PROVIDERS
|
||||
value: '{"authentik": {"display_name": "Sign in with Authentik", "provider_url":
|
||||
"https://authentik.snarfnet.net/application/o/semaphore/", "client_id":
|
||||
"semaphore-2e50dbdf", "client_secret": "V4uazPXN9toUn5Jf2DfsRIFrygf1T0Vcltga-APrzTRjWFN0DIIqNw",
|
||||
"redirect_url": "https://semaphore.snarfnet.net/api/auth/oidc/authentik/redirect/",
|
||||
"username_claim": "preferred_username", "name_claim": "name", "email_claim":
|
||||
"email", "scopes": ["openid", "profile", "email", "groups"]}}'
|
||||
- name: SEMAPHORE_WEB_HOST
|
||||
value: https://semaphore.snarfnet.net
|
||||
image: semaphoreui/semaphore:v2.17.34
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: semaphore
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
name: http
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /
|
||||
port: http
|
||||
scheme: HTTP
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/semaphore/config.json
|
||||
name: config
|
||||
subPath: config.json
|
||||
- mountPath: /tmp/semaphore
|
||||
name: workdir
|
||||
- mountPath: /var/lib/semaphore
|
||||
name: boltdb
|
||||
dnsPolicy: ClusterFirst
|
||||
initContainers:
|
||||
- command:
|
||||
- sh
|
||||
- -c
|
||||
- "if ! semaphore user get --config=/etc/semaphore/config.json --login $(SEMAPHORE_ADMIN_USERNAME)\
|
||||
\ >/dev/null; then\n semaphore user add \\\n --config=/etc/semaphore/config.json\
|
||||
\ \\\n --admin \\\n --name=$(SEMAPHORE_ADMIN_FULLNAME) \\\n --login=$(SEMAPHORE_ADMIN_USERNAME)\
|
||||
\ \\\n --password=$(SEMAPHORE_ADMIN_PASSWORD) \\\n --email=$(SEMAPHORE_ADMIN_EMAIL)\n\
|
||||
else\n echo \"Admin already extists\"\nfi\n"
|
||||
env:
|
||||
- name: SEMAPHORE_ADMIN_FULLNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: fullname
|
||||
name: semaphore-admin
|
||||
- name: SEMAPHORE_ADMIN_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: username
|
||||
name: semaphore-admin
|
||||
- name: SEMAPHORE_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: semaphore-admin
|
||||
- name: SEMAPHORE_ADMIN_EMAIL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: email
|
||||
name: semaphore-admin
|
||||
- name: SEMAPHORE_PORT
|
||||
value: '3000'
|
||||
- name: SEMAPHORE_GIT_CLIENT
|
||||
value: cmd_git
|
||||
- name: SEMAPHORE_TMP_PATH
|
||||
value: /tmp/semaphore
|
||||
- name: SEMAPHORE_SSH_PATH
|
||||
- name: SEMAPHORE_MAX_PARALLEL_TASKS
|
||||
value: '0'
|
||||
- name: SEMAPHORE_PASSWORD_LOGIN_DISABLED
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_NON_ADMIN_CAN_CREATE_PROJECT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_USE_REMOTE_RUNNER
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_DB_DIALECT
|
||||
value: bolt
|
||||
- name: SEMAPHORE_DB_HOST
|
||||
value: /var/lib/semaphore/database.boltdb
|
||||
- name: SEMAPHORE_LDAP_ENABLE
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_EMAIL_ALERT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_TELEGRAM_ALERT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_SLACK_ALERT
|
||||
value: 'false'
|
||||
- name: SEMAPHORE_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: token
|
||||
name: semaphore-runner
|
||||
- name: SEMAPHORE_COOKIE_HASH
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: cookieHash
|
||||
name: semaphore-general
|
||||
- name: SEMAPHORE_COOKIE_ENCRYPTION
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: cookieEncryption
|
||||
name: semaphore-general
|
||||
- name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: accesskeyEncryption
|
||||
name: semaphore-general
|
||||
image: semaphoreui/semaphore:v2.17.34
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: admin
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/semaphore/config.json
|
||||
name: config
|
||||
subPath: config.json
|
||||
- mountPath: /tmp/semaphore
|
||||
name: workdir
|
||||
- mountPath: /var/lib/semaphore
|
||||
name: boltdb
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 1001
|
||||
serviceAccount: semaphore
|
||||
serviceAccountName: semaphore
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
name: semaphore-config
|
||||
name: config
|
||||
- name: workdir
|
||||
persistentVolumeClaim:
|
||||
claimName: semaphore-workdir
|
||||
- name: boltdb
|
||||
persistentVolumeClaim:
|
||||
claimName: semaphore-boltdb
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: semaphore
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/instance: semaphore
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: semaphore
|
||||
app.kubernetes.io/version: 2.17.34
|
||||
helm.sh/chart: semaphore-16.1.2
|
||||
name: semaphore
|
||||
namespace: infrastructure
|
||||
spec:
|
||||
clusterIP: 10.43.119.206
|
||||
clusterIPs:
|
||||
- 10.43.119.206
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
port: 3000
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app.kubernetes.io/instance: semaphore
|
||||
app.kubernetes.io/name: semaphore
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
data:
|
||||
config.json: '{
|
||||
|
||||
}
|
||||
|
||||
'
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: semaphore
|
||||
meta.helm.sh/release-namespace: infrastructure
|
||||
labels:
|
||||
app.kubernetes.io/instance: semaphore
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: semaphore
|
||||
app.kubernetes.io/version: 2.17.34
|
||||
helm.sh/chart: semaphore-16.1.2
|
||||
name: semaphore-config
|
||||
namespace: infrastructure
|
||||
599
manifests/spaceport/zabbix/zabbix.yaml
Normal file
599
manifests/spaceport/zabbix/zabbix.yaml
Normal file
@@ -0,0 +1,599 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-zabbix-server
|
||||
namespace: monitoring
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
strategy:
|
||||
type: Recreate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- env:
|
||||
- name: DB_SERVER_HOST
|
||||
value: zabbix-postgresql
|
||||
- name: DB_SERVER_PORT
|
||||
value: '5432'
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: user
|
||||
name: zabbix-db-access
|
||||
optional: true
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: zabbix-db-access
|
||||
- name: POSTGRES_DB
|
||||
value: zabbix
|
||||
- name: ZBX_NODEADDRESS
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: ZBX_WEBSERVICEURL
|
||||
value: http://zabbix-zabbix-webservice:10053/report
|
||||
- name: ZBX_STARTREPORTWRITERS
|
||||
value: '1'
|
||||
- name: ZBX_JAVAGATEWAY_ENABLE
|
||||
value: 'false'
|
||||
- name: ZBX_WEBDRIVERURL
|
||||
value: http://zabbix-chrome:4444
|
||||
image: zabbix/zabbix-server-pgsql:ubuntu-7.0.32
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: zabbix-server
|
||||
ports:
|
||||
- containerPort: 10051
|
||||
name: zabbix-server
|
||||
protocol: TCP
|
||||
- containerPort: 10052
|
||||
name: zabbix-jmx
|
||||
protocol: TCP
|
||||
resources: {}
|
||||
securityContext: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
- env:
|
||||
- name: ZBX_HOSTNAME
|
||||
value: Zabbix server
|
||||
- name: ZBX_SERVER_HOST
|
||||
value: 0.0.0.0/0
|
||||
- name: ZBX_SERVER_PORT
|
||||
value: '10051'
|
||||
- name: ZBX_PASSIVE_ALLOW
|
||||
value: 'true'
|
||||
- name: ZBX_PASSIVESERVERS
|
||||
- name: ZBX_ACTIVE_ALLOW
|
||||
value: 'false'
|
||||
- name: ZBX_ACTIVESERVERS
|
||||
- name: ZBX_DEBUGLEVEL
|
||||
value: '3'
|
||||
- name: ZBX_TIMEOUT
|
||||
value: '4'
|
||||
- name: ZBX_LOADMODULE
|
||||
image: zabbix/zabbix-agent2:ubuntu-7.0.32
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: zabbix-agent
|
||||
timeoutSeconds: 3
|
||||
name: zabbix-agent
|
||||
ports:
|
||||
- containerPort: 10050
|
||||
name: zabbix-agent
|
||||
protocol: TCP
|
||||
resources: {}
|
||||
securityContext: {}
|
||||
startupProbe:
|
||||
failureThreshold: 5
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
tcpSocket:
|
||||
port: zabbix-agent
|
||||
timeoutSeconds: 3
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: zabbix
|
||||
serviceAccountName: zabbix
|
||||
terminationGracePeriodSeconds: 30
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/component: web
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-zabbix-web
|
||||
namespace: monitoring
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: web
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/restartedAt: '1793197639.2173924'
|
||||
labels:
|
||||
app.kubernetes.io/component: web
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: zabbix-zabbix-web
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- env:
|
||||
- name: DB_SERVER_HOST
|
||||
value: zabbix-postgresql
|
||||
- name: DB_SERVER_PORT
|
||||
value: '5432'
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: user
|
||||
name: zabbix-db-access
|
||||
optional: true
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: zabbix-db-access
|
||||
- name: POSTGRES_DB
|
||||
value: zabbix
|
||||
image: zabbix/zabbix-web-nginx-pgsql:ubuntu-7.0.32
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: zabbix-web
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
name: zabbix-web
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: zabbix-web
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
failureThreshold: 6
|
||||
httpGet:
|
||||
path: /ping
|
||||
port: zabbix-web
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
resources: {}
|
||||
securityContext: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /usr/share/zabbix/conf/certs
|
||||
name: saml-certs
|
||||
- mountPath: /etc/zabbix/web/certs
|
||||
name: saml-certs
|
||||
- mountPath: /etc/nginx/fastcgi_params
|
||||
name: saml-certs
|
||||
subPath: fastcgi_params
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: zabbix
|
||||
serviceAccountName: zabbix
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
name: zabbix-saml-certs
|
||||
name: saml-certs
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/component: webservice
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-zabbix-webservice
|
||||
namespace: monitoring
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: webservice
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: webservice
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
spec:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: zabbix-zabbix-webservice
|
||||
topologyKey: kubernetes.io/hostname
|
||||
weight: 1
|
||||
containers:
|
||||
- env:
|
||||
- name: ZBX_ALLOWEDIP
|
||||
value: ::/0
|
||||
image: zabbix/zabbix-web-service:ubuntu-7.0.32
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: zabbix-webservice
|
||||
ports:
|
||||
- containerPort: 10053
|
||||
name: webservice
|
||||
protocol: TCP
|
||||
resources: {}
|
||||
securityContext: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: zabbix
|
||||
serviceAccountName: zabbix
|
||||
terminationGracePeriodSeconds: 30
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/component: postgresql
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-postgresql
|
||||
namespace: monitoring
|
||||
spec:
|
||||
persistentVolumeClaimRetentionPolicy:
|
||||
whenDeleted: Retain
|
||||
whenScaled: Retain
|
||||
podManagementPolicy: OrderedReady
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: postgresql
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
serviceName: zabbix
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: postgresql
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- -c
|
||||
- max_connections=100
|
||||
env:
|
||||
- name: DB_SERVER_HOST
|
||||
value: zabbix-postgresql
|
||||
- name: DB_SERVER_PORT
|
||||
value: '5432'
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: user
|
||||
name: zabbix-db-access
|
||||
optional: true
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
key: password
|
||||
name: zabbix-db-access
|
||||
- name: POSTGRES_DB
|
||||
value: zabbix
|
||||
- name: PGDATA
|
||||
value: /var/lib/postgresql/data/pgdata
|
||||
image: postgres:16
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: postgresql
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: db
|
||||
protocol: TCP
|
||||
resources: {}
|
||||
securityContext: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
name: postgresql-data
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext: {}
|
||||
serviceAccount: zabbix
|
||||
serviceAccountName: zabbix
|
||||
terminationGracePeriodSeconds: 30
|
||||
updateStrategy:
|
||||
rollingUpdate:
|
||||
partition: 0
|
||||
type: RollingUpdate
|
||||
volumeClaimTemplates:
|
||||
- apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: postgresql-data
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
volumeMode: Filesystem
|
||||
status:
|
||||
phase: Pending
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/component: postgresql
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-postgresql
|
||||
namespace: monitoring
|
||||
spec:
|
||||
clusterIP: 10.43.246.111
|
||||
clusterIPs:
|
||||
- 10.43.246.111
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: db
|
||||
port: 5432
|
||||
protocol: TCP
|
||||
targetPort: 5432
|
||||
selector:
|
||||
app.kubernetes.io/component: postgresql
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
metallb.io/ip-allocated-from-pool: lan-pool
|
||||
metallb.universe.tf/loadBalancerIP: 140.44.4.64
|
||||
finalizers:
|
||||
- service.kubernetes.io/load-balancer-cleanup
|
||||
labels:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-zabbix-server
|
||||
namespace: monitoring
|
||||
spec:
|
||||
allocateLoadBalancerNodePorts: true
|
||||
clusterIP: 10.43.14.128
|
||||
clusterIPs:
|
||||
- 10.43.14.128
|
||||
externalTrafficPolicy: Cluster
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
loadBalancerIP: 140.44.4.64
|
||||
ports:
|
||||
- name: zabbix-server
|
||||
nodePort: 32156
|
||||
port: 10051
|
||||
protocol: TCP
|
||||
targetPort: 10051
|
||||
- name: zabbix-jmx
|
||||
nodePort: 31105
|
||||
port: 10052
|
||||
protocol: TCP
|
||||
targetPort: 10052
|
||||
selector:
|
||||
app.kubernetes.io/component: server
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
sessionAffinity: None
|
||||
type: LoadBalancer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
metallb.io/ip-allocated-from-pool: lan-pool
|
||||
metallb.universe.tf/loadBalancerIP: 140.44.4.60
|
||||
finalizers:
|
||||
- service.kubernetes.io/load-balancer-cleanup
|
||||
labels:
|
||||
app.kubernetes.io/component: web
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-zabbix-web
|
||||
namespace: monitoring
|
||||
spec:
|
||||
allocateLoadBalancerNodePorts: true
|
||||
clusterIP: 10.43.156.214
|
||||
clusterIPs:
|
||||
- 10.43.156.214
|
||||
externalTrafficPolicy: Cluster
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
loadBalancerIP: 140.44.4.60
|
||||
ports:
|
||||
- name: zabbix-web
|
||||
nodePort: 31080
|
||||
port: 8888
|
||||
protocol: TCP
|
||||
targetPort: 8080
|
||||
selector:
|
||||
app.kubernetes.io/component: web
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
sessionAffinity: None
|
||||
type: LoadBalancer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: zabbix
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/component: webservice
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/name: zabbix
|
||||
app.kubernetes.io/version: 7.0.16
|
||||
helm.sh/chart: zabbix-7.0.12
|
||||
name: zabbix-zabbix-webservice
|
||||
namespace: monitoring
|
||||
spec:
|
||||
clusterIP: 10.43.76.219
|
||||
clusterIPs:
|
||||
- 10.43.76.219
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: webservice
|
||||
port: 10053
|
||||
protocol: TCP
|
||||
targetPort: 10053
|
||||
selector:
|
||||
app.kubernetes.io/component: webservice
|
||||
app.kubernetes.io/instance: zabbix
|
||||
app.kubernetes.io/name: zabbix
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
Reference in New Issue
Block a user