feat(gitops): populate declarative manifests for all 10 workloads and correct destination namespaces
This commit is contained in:
992
manifests/aerodrome/awx/awx.yaml
Normal file
992
manifests/aerodrome/awx/awx.yaml
Normal file
@@ -0,0 +1,992 @@
|
||||
apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: awx
|
||||
meta.helm.sh/release-namespace: awx
|
||||
restartedAt: now
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
name: awx
|
||||
namespace: awx
|
||||
spec:
|
||||
admin_user: snarf
|
||||
auto_upgrade: true
|
||||
create_preload_data: true
|
||||
extra_settings:
|
||||
- setting: CSRF_TRUSTED_ORIGINS
|
||||
value:
|
||||
- https://awx.snarfnet.net
|
||||
- setting: SECURE_PROXY_SSL_HEADER
|
||||
value:
|
||||
- HTTP_X_FORWARDED_PROTO
|
||||
- https
|
||||
- setting: SOCIAL_AUTH_REDIRECT_IS_HTTPS
|
||||
value: true
|
||||
garbage_collect_secrets: false
|
||||
image_pull_policy: IfNotPresent
|
||||
ipv6_disabled: false
|
||||
loadbalancer_ip: ''
|
||||
loadbalancer_port: 80
|
||||
loadbalancer_protocol: http
|
||||
no_log: true
|
||||
postgres_configuration_secret: awx-postgres-configuration
|
||||
postgres_keepalives: true
|
||||
postgres_keepalives_count: 5
|
||||
postgres_keepalives_idle: 5
|
||||
postgres_keepalives_interval: 5
|
||||
postgres_storage_class: longhorn
|
||||
projects_persistence: false
|
||||
projects_storage_access_mode: ReadWriteMany
|
||||
projects_storage_size: 8Gi
|
||||
replicas: 1
|
||||
route_tls_termination_mechanism: Edge
|
||||
security_context_settings:
|
||||
fsGroup: 0
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
set_self_labels: true
|
||||
task_privileged: false
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: awx
|
||||
meta.helm.sh/release-namespace: awx
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-controller-manager
|
||||
namespace: awx
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
cattle.io/timestamp: '2026-05-15T20:05:15Z'
|
||||
kubectl.kubernetes.io/default-container: awx-manager
|
||||
kubectl.kubernetes.io/restartedAt: '2026-05-15T20:01:42Z'
|
||||
labels:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- --secure-listen-address=0.0.0.0:8443
|
||||
- --upstream=http://127.0.0.1:8080/
|
||||
- --logtostderr=true
|
||||
- --v=0
|
||||
image: quay.io/brancz/kube-rbac-proxy:v0.15.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: kube-rbac-proxy
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
name: https
|
||||
protocol: TCP
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 64Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
- args:
|
||||
- --health-probe-bind-address=:6789
|
||||
- --metrics-bind-address=127.0.0.1:8080
|
||||
- --leader-elect
|
||||
- --leader-election-id=awx-operator
|
||||
env:
|
||||
- name: ANSIBLE_GATHERING
|
||||
value: explicit
|
||||
- name: ANSIBLE_DEBUG_LOGS
|
||||
value: 'false'
|
||||
- name: WATCH_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
image: quay.io/ansible/awx-operator:2.19.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
livenessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 6789
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
name: awx-manager
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 6789
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
limits:
|
||||
cpu: 1500m
|
||||
memory: 960Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /opt/ansible/roles/installer/defaults
|
||||
name: installer-defaults-override
|
||||
dnsPolicy: ClusterFirst
|
||||
imagePullSecrets:
|
||||
- name: redhat-operators-pull-secret
|
||||
initContainers:
|
||||
- command:
|
||||
- sh
|
||||
- -c
|
||||
- 'cp /opt/ansible/roles/installer/defaults/main.yml /mnt/defaults/main.yml
|
||||
|
||||
echo "" >> /mnt/defaults/main.yml
|
||||
|
||||
echo "web_manage_replicas: true" >> /mnt/defaults/main.yml
|
||||
|
||||
echo "task_manage_replicas: true" >> /mnt/defaults/main.yml
|
||||
|
||||
'
|
||||
image: quay.io/ansible/awx-operator:2.19.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: patch-defaults
|
||||
resources: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /mnt/defaults
|
||||
name: installer-defaults-override
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
serviceAccount: awx-operator-controller-manager
|
||||
serviceAccountName: awx-operator-controller-manager
|
||||
terminationGracePeriodSeconds: 10
|
||||
volumes:
|
||||
- emptyDir: {}
|
||||
name: installer-defaults-override
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
name: awx-task
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-task
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
|
||||
checksum-configmaps-pre_stop_scripts: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
||||
checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
|
||||
checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
|
||||
checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
|
||||
checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
|
||||
checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
||||
kubectl.kubernetes.io/default-container: awx-task
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-task
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- redis-server
|
||||
- /etc/redis.conf
|
||||
image: docker.io/redis:7
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: redis
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/redis.conf
|
||||
name: awx-redis-config
|
||||
readOnly: true
|
||||
subPath: redis.conf
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /data
|
||||
name: awx-redis-data
|
||||
- args:
|
||||
- /usr/bin/launch_awx_task.sh
|
||||
env:
|
||||
- name: AWX_COMPONENT
|
||||
value: task
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_task.conf
|
||||
- name: AWX_SKIP_MIGRATIONS
|
||||
value: '1'
|
||||
- name: MY_POD_UID
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.uid
|
||||
- name: MY_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: MY_POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-task
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/execution_environments.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: execution_environments.py
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/conf.d/ldap.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: ldap.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
- mountPath: /etc/receptor/
|
||||
name: awx-receptor-config
|
||||
- mountPath: /etc/receptor/work_private_key.pem
|
||||
name: awx-receptor-work-signing
|
||||
readOnly: true
|
||||
subPath: work-private-key.pem
|
||||
- mountPath: /var/run/receptor
|
||||
name: receptor-socket
|
||||
- mountPath: /var/lib/awx/projects
|
||||
name: awx-projects
|
||||
- args:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- "if [ ! -f /etc/receptor/receptor.conf ]; then\n cp /etc/receptor/receptor-default.conf\
|
||||
\ /etc/receptor/receptor.conf\n sed -i \"s/HOSTNAME/$HOSTNAME/g\" /etc/receptor/receptor.conf\n\
|
||||
fi\nexec receptor --config /etc/receptor/receptor.conf\n"
|
||||
image: quay.io/ansible/awx-ee:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-ee
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/receptor/receptor-default.conf
|
||||
name: awx-default-receptor-config
|
||||
subPath: receptor.conf
|
||||
- mountPath: /etc/receptor/
|
||||
name: awx-receptor-config
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.crt
|
||||
- mountPath: /etc/receptor/work_private_key.pem
|
||||
name: awx-receptor-work-signing
|
||||
readOnly: true
|
||||
subPath: work-private-key.pem
|
||||
- mountPath: /etc/receptor/tls/
|
||||
name: awx-receptor-tls
|
||||
- mountPath: /var/run/receptor
|
||||
name: receptor-socket
|
||||
- mountPath: /var/lib/awx/projects
|
||||
name: awx-projects
|
||||
- args:
|
||||
- /usr/bin/launch_awx_rsyslog.sh
|
||||
env:
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_rsyslog.conf
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-rsyslog
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
dnsPolicy: ClusterFirst
|
||||
initContainers:
|
||||
- command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- wait-for-migrations
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: init-database
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- "hostname=$MY_POD_NAME\nreceptor --cert-makereq \\\n bits=2048 \\\n commonname=$hostname\
|
||||
\ \\\n dnsname=$hostname \\\n nodeid=$hostname \\\n outreq=/etc/receptor/tls/receptor.req\
|
||||
\ \\\n outkey=/etc/receptor/tls/receptor.key\nreceptor --cert-signreq \\\
|
||||
\n req=/etc/receptor/tls/receptor.req \\\n cacert=/etc/receptor/tls/ca/mesh-CA.crt\
|
||||
\ \\\n cakey=/etc/receptor/tls/ca/mesh-CA.key \\\n outcert=/etc/receptor/tls/receptor.crt\
|
||||
\ \\\n notafter=$(date --iso-8601=seconds --utc --date \"10 years\") \\\
|
||||
\n verify=yes\n"
|
||||
env:
|
||||
- name: MY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
image: quay.io/ansible/awx-ee:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: init-receptor
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.crt
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.key
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.key
|
||||
- mountPath: /etc/receptor/tls/
|
||||
name: awx-receptor-tls
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 0
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
serviceAccount: awx
|
||||
serviceAccountName: awx
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- name: awx-application-credentials
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: credentials.py
|
||||
path: credentials.py
|
||||
- key: ldap.py
|
||||
path: ldap.py
|
||||
- key: execution_environments.py
|
||||
path: execution_environments.py
|
||||
secretName: awx-app-credentials
|
||||
- emptyDir: {}
|
||||
name: awx-receptor-tls
|
||||
- name: awx-receptor-ca
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-ca
|
||||
- name: awx-receptor-work-signing
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-work-signing
|
||||
- name: awx-secret-key
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: secret_key
|
||||
path: SECRET_KEY
|
||||
secretName: awx-secret-key
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: settings
|
||||
path: settings.py
|
||||
name: awx-awx-configmap
|
||||
name: awx-settings
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: nginx_conf
|
||||
path: nginx.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-nginx-conf
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: redis_conf
|
||||
path: redis.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-redis-config
|
||||
- emptyDir: {}
|
||||
name: awx-redis-socket
|
||||
- emptyDir: {}
|
||||
name: awx-redis-data
|
||||
- emptyDir: {}
|
||||
name: rsyslog-socket
|
||||
- emptyDir: {}
|
||||
name: receptor-socket
|
||||
- emptyDir: {}
|
||||
name: awx-receptor-config
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: receptor_conf
|
||||
path: receptor.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-default-receptor-config
|
||||
- emptyDir: {}
|
||||
name: awx-projects
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
name: awx-web
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
progressDeadlineSeconds: 600
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 25%
|
||||
maxUnavailable: 25%
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
|
||||
checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
|
||||
checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
|
||||
checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
||||
checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
|
||||
checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
|
||||
checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
||||
kubectl.kubernetes.io/default-container: awx-web
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
app.kubernetes.io/version: 24.6.1
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- redis-server
|
||||
- /etc/redis.conf
|
||||
image: docker.io/redis:7
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: redis
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/redis.conf
|
||||
name: awx-redis-config
|
||||
readOnly: true
|
||||
subPath: redis.conf
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /data
|
||||
name: awx-redis-data
|
||||
- args:
|
||||
- /usr/bin/launch_awx_web.sh
|
||||
env:
|
||||
- name: AWX_COMPONENT
|
||||
value: web
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_web.conf
|
||||
- name: MY_POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: MY_POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: status.podIP
|
||||
- name: UWSGI_MOUNT_PATH
|
||||
value: /
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-web
|
||||
ports:
|
||||
- containerPort: 8052
|
||||
protocol: TCP
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/uwsgi.ini
|
||||
name: awx-uwsgi-config
|
||||
readOnly: true
|
||||
subPath: uwsgi.conf
|
||||
- mountPath: /etc/tower/conf.d/execution_environments.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: execution_environments.py
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/conf.d/ldap.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: ldap.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /etc/nginx/nginx.conf
|
||||
name: awx-nginx-conf
|
||||
readOnly: true
|
||||
subPath: nginx.conf
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.crt
|
||||
- mountPath: /etc/receptor/tls/ca/mesh-CA.key
|
||||
name: awx-receptor-ca
|
||||
readOnly: true
|
||||
subPath: tls.key
|
||||
- mountPath: /etc/receptor/work_public_key.pem
|
||||
name: awx-receptor-work-signing
|
||||
readOnly: true
|
||||
subPath: work-public-key.pem
|
||||
- args:
|
||||
- /usr/bin/launch_awx_rsyslog.sh
|
||||
env:
|
||||
- name: SUPERVISOR_CONFIG_PATH
|
||||
value: /etc/supervisord_rsyslog.conf
|
||||
image: quay.io/ansible/awx:24.6.1
|
||||
imagePullPolicy: IfNotPresent
|
||||
name: awx-rsyslog
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
terminationMessagePath: /dev/termination-log
|
||||
terminationMessagePolicy: File
|
||||
volumeMounts:
|
||||
- mountPath: /etc/tower/conf.d/credentials.py
|
||||
name: awx-application-credentials
|
||||
readOnly: true
|
||||
subPath: credentials.py
|
||||
- mountPath: /etc/tower/SECRET_KEY
|
||||
name: awx-secret-key
|
||||
readOnly: true
|
||||
subPath: SECRET_KEY
|
||||
- mountPath: /etc/tower/settings.py
|
||||
name: awx-settings
|
||||
readOnly: true
|
||||
subPath: settings.py
|
||||
- mountPath: /var/run/redis
|
||||
name: awx-redis-socket
|
||||
- mountPath: /var/run/awx-rsyslog
|
||||
name: rsyslog-socket
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
schedulerName: default-scheduler
|
||||
securityContext:
|
||||
fsGroup: 0
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
serviceAccount: awx
|
||||
serviceAccountName: awx
|
||||
terminationGracePeriodSeconds: 30
|
||||
volumes:
|
||||
- name: awx-receptor-ca
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-ca
|
||||
- name: awx-receptor-work-signing
|
||||
secret:
|
||||
defaultMode: 420
|
||||
secretName: awx-receptor-work-signing
|
||||
- name: awx-application-credentials
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: credentials.py
|
||||
path: credentials.py
|
||||
- key: ldap.py
|
||||
path: ldap.py
|
||||
- key: execution_environments.py
|
||||
path: execution_environments.py
|
||||
secretName: awx-app-credentials
|
||||
- name: awx-secret-key
|
||||
secret:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: secret_key
|
||||
path: SECRET_KEY
|
||||
secretName: awx-secret-key
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: settings
|
||||
path: settings.py
|
||||
name: awx-awx-configmap
|
||||
name: awx-settings
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: nginx_conf
|
||||
path: nginx.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-nginx-conf
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: redis_conf
|
||||
path: redis.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-redis-config
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: uwsgi_conf
|
||||
path: uwsgi.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-uwsgi-config
|
||||
- emptyDir: {}
|
||||
name: awx-redis-socket
|
||||
- emptyDir: {}
|
||||
name: awx-redis-data
|
||||
- emptyDir: {}
|
||||
name: rsyslog-socket
|
||||
- emptyDir: {}
|
||||
name: receptor-socket
|
||||
- configMap:
|
||||
defaultMode: 420
|
||||
items:
|
||||
- key: receptor_conf
|
||||
path: receptor.conf
|
||||
name: awx-awx-configmap
|
||||
name: awx-receptor-config
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
metallb.io/ip-allocated-from-pool: lan-pool
|
||||
metallb.universe.tf/ip-allocated-from-pool: default-pool
|
||||
metallb.universe.tf/loadBalancerIP: 140.44.4.30
|
||||
finalizers:
|
||||
- service.kubernetes.io/load-balancer-cleanup
|
||||
name: awx-lb
|
||||
namespace: awx
|
||||
spec:
|
||||
allocateLoadBalancerNodePorts: true
|
||||
clusterIP: 10.43.229.215
|
||||
clusterIPs:
|
||||
- 10.43.229.215
|
||||
externalTrafficPolicy: Cluster
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
loadBalancerIP: 140.44.4.30
|
||||
ports:
|
||||
- name: webport
|
||||
nodePort: 30015
|
||||
port: 87
|
||||
protocol: TCP
|
||||
targetPort: 80
|
||||
selector:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
sessionAffinity: None
|
||||
type: LoadBalancer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: awx
|
||||
meta.helm.sh/release-namespace: awx
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
name: awx-operator-controller-manager-metrics-service
|
||||
namespace: awx
|
||||
spec:
|
||||
clusterIP: 10.43.164.198
|
||||
clusterIPs:
|
||||
- 10.43.164.198
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: https
|
||||
port: 8443
|
||||
protocol: TCP
|
||||
targetPort: https
|
||||
selector:
|
||||
control-plane: controller-manager
|
||||
helm.sh/chart: awx-operator
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/instance: postgres-15-awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: postgres-15
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
name: awx-postgres-15
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
clusterIP: None
|
||||
clusterIPs:
|
||||
- None
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- port: 5432
|
||||
protocol: TCP
|
||||
targetPort: 5432
|
||||
selector:
|
||||
app.kubernetes.io/component: database
|
||||
app.kubernetes.io/instance: postgres-15-awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: postgres-15
|
||||
app.kubernetes.io/part-of: awx
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/operator-version: 2.19.1
|
||||
app.kubernetes.io/part-of: awx
|
||||
name: awx-service
|
||||
namespace: awx
|
||||
ownerReferences:
|
||||
- apiVersion: awx.ansible.com/v1beta1
|
||||
kind: AWX
|
||||
name: awx
|
||||
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
||||
spec:
|
||||
clusterIP: 10.43.161.26
|
||||
clusterIPs:
|
||||
- 10.43.161.26
|
||||
internalTrafficPolicy: Cluster
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
ipFamilyPolicy: SingleStack
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 8052
|
||||
- name: https
|
||||
port: 443
|
||||
protocol: TCP
|
||||
targetPort: 8052
|
||||
selector:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/managed-by: awx-operator
|
||||
app.kubernetes.io/name: awx-web
|
||||
sessionAffinity: None
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/service.serversscheme: http
|
||||
labels:
|
||||
app.kubernetes.io/component: awx
|
||||
app.kubernetes.io/name: awx-web
|
||||
name: awx-ingress
|
||||
namespace: awx
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: awx.snarfnet.net
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: awx-service
|
||||
port:
|
||||
number: 80
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- hosts:
|
||||
- awx.snarfnet.net
|
||||
secretName: tls-awx-cert2
|
||||
Reference in New Issue
Block a user