993 lines
29 KiB
YAML
993 lines
29 KiB
YAML
apiVersion: awx.ansible.com/v1beta1
|
|
kind: AWX
|
|
metadata:
|
|
annotations:
|
|
meta.helm.sh/release-name: awx
|
|
meta.helm.sh/release-namespace: awx
|
|
restartedAt: now
|
|
labels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/operator-version: 2.19.1
|
|
app.kubernetes.io/part-of: awx
|
|
name: awx
|
|
namespace: awx
|
|
spec:
|
|
admin_user: snarf
|
|
auto_upgrade: true
|
|
create_preload_data: true
|
|
extra_settings:
|
|
- setting: CSRF_TRUSTED_ORIGINS
|
|
value:
|
|
- https://awx.snarfnet.net
|
|
- setting: SECURE_PROXY_SSL_HEADER
|
|
value:
|
|
- HTTP_X_FORWARDED_PROTO
|
|
- https
|
|
- setting: SOCIAL_AUTH_REDIRECT_IS_HTTPS
|
|
value: true
|
|
garbage_collect_secrets: false
|
|
image_pull_policy: IfNotPresent
|
|
ipv6_disabled: false
|
|
loadbalancer_ip: ''
|
|
loadbalancer_port: 80
|
|
loadbalancer_protocol: http
|
|
no_log: true
|
|
postgres_configuration_secret: awx-postgres-configuration
|
|
postgres_keepalives: true
|
|
postgres_keepalives_count: 5
|
|
postgres_keepalives_idle: 5
|
|
postgres_keepalives_interval: 5
|
|
postgres_storage_class: longhorn
|
|
projects_persistence: false
|
|
projects_storage_access_mode: ReadWriteMany
|
|
projects_storage_size: 8Gi
|
|
replicas: 1
|
|
route_tls_termination_mechanism: Edge
|
|
security_context_settings:
|
|
fsGroup: 0
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
runAsGroup: 0
|
|
runAsUser: 0
|
|
set_self_labels: true
|
|
task_privileged: false
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
meta.helm.sh/release-name: awx
|
|
meta.helm.sh/release-namespace: awx
|
|
labels:
|
|
app.kubernetes.io/managed-by: Helm
|
|
control-plane: controller-manager
|
|
helm.sh/chart: awx-operator
|
|
name: awx-operator-controller-manager
|
|
namespace: awx
|
|
spec:
|
|
progressDeadlineSeconds: 600
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
control-plane: controller-manager
|
|
helm.sh/chart: awx-operator
|
|
strategy:
|
|
rollingUpdate:
|
|
maxSurge: 25%
|
|
maxUnavailable: 25%
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
cattle.io/timestamp: '2026-05-15T20:05:15Z'
|
|
kubectl.kubernetes.io/default-container: awx-manager
|
|
kubectl.kubernetes.io/restartedAt: '2026-05-15T20:01:42Z'
|
|
labels:
|
|
control-plane: controller-manager
|
|
helm.sh/chart: awx-operator
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- --secure-listen-address=0.0.0.0:8443
|
|
- --upstream=http://127.0.0.1:8080/
|
|
- --logtostderr=true
|
|
- --v=0
|
|
image: quay.io/brancz/kube-rbac-proxy:v0.15.0
|
|
imagePullPolicy: IfNotPresent
|
|
name: kube-rbac-proxy
|
|
ports:
|
|
- containerPort: 8443
|
|
name: https
|
|
protocol: TCP
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 5m
|
|
memory: 64Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
- args:
|
|
- --health-probe-bind-address=:6789
|
|
- --metrics-bind-address=127.0.0.1:8080
|
|
- --leader-elect
|
|
- --leader-election-id=awx-operator
|
|
env:
|
|
- name: ANSIBLE_GATHERING
|
|
value: explicit
|
|
- name: ANSIBLE_DEBUG_LOGS
|
|
value: 'false'
|
|
- name: WATCH_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.namespace
|
|
image: quay.io/ansible/awx-operator:2.19.1
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /healthz
|
|
port: 6789
|
|
scheme: HTTP
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
name: awx-manager
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /readyz
|
|
port: 6789
|
|
scheme: HTTP
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
resources:
|
|
limits:
|
|
cpu: 1500m
|
|
memory: 960Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /opt/ansible/roles/installer/defaults
|
|
name: installer-defaults-override
|
|
dnsPolicy: ClusterFirst
|
|
imagePullSecrets:
|
|
- name: redhat-operators-pull-secret
|
|
initContainers:
|
|
- command:
|
|
- sh
|
|
- -c
|
|
- 'cp /opt/ansible/roles/installer/defaults/main.yml /mnt/defaults/main.yml
|
|
|
|
echo "" >> /mnt/defaults/main.yml
|
|
|
|
echo "web_manage_replicas: true" >> /mnt/defaults/main.yml
|
|
|
|
echo "task_manage_replicas: true" >> /mnt/defaults/main.yml
|
|
|
|
'
|
|
image: quay.io/ansible/awx-operator:2.19.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: patch-defaults
|
|
resources: {}
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /mnt/defaults
|
|
name: installer-defaults-override
|
|
restartPolicy: Always
|
|
schedulerName: default-scheduler
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
serviceAccount: awx-operator-controller-manager
|
|
serviceAccountName: awx-operator-controller-manager
|
|
terminationGracePeriodSeconds: 10
|
|
volumes:
|
|
- emptyDir: {}
|
|
name: installer-defaults-override
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/operator-version: 2.19.1
|
|
app.kubernetes.io/part-of: awx
|
|
app.kubernetes.io/version: 24.6.1
|
|
name: awx-task
|
|
namespace: awx
|
|
ownerReferences:
|
|
- apiVersion: awx.ansible.com/v1beta1
|
|
kind: AWX
|
|
name: awx
|
|
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
|
spec:
|
|
progressDeadlineSeconds: 600
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: awx-task
|
|
strategy:
|
|
rollingUpdate:
|
|
maxSurge: 25%
|
|
maxUnavailable: 25%
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
|
|
checksum-configmaps-pre_stop_scripts: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
|
checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
|
checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
|
checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
|
|
checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
|
|
checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
|
checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
|
|
checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
|
|
checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
|
kubectl.kubernetes.io/default-container: awx-task
|
|
labels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: awx-task
|
|
app.kubernetes.io/operator-version: 2.19.1
|
|
app.kubernetes.io/part-of: awx
|
|
app.kubernetes.io/version: 24.6.1
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- redis-server
|
|
- /etc/redis.conf
|
|
image: docker.io/redis:7
|
|
imagePullPolicy: IfNotPresent
|
|
name: redis
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/redis.conf
|
|
name: awx-redis-config
|
|
readOnly: true
|
|
subPath: redis.conf
|
|
- mountPath: /var/run/redis
|
|
name: awx-redis-socket
|
|
- mountPath: /data
|
|
name: awx-redis-data
|
|
- args:
|
|
- /usr/bin/launch_awx_task.sh
|
|
env:
|
|
- name: AWX_COMPONENT
|
|
value: task
|
|
- name: SUPERVISOR_CONFIG_PATH
|
|
value: /etc/supervisord_task.conf
|
|
- name: AWX_SKIP_MIGRATIONS
|
|
value: '1'
|
|
- name: MY_POD_UID
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.uid
|
|
- name: MY_POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: status.podIP
|
|
- name: MY_POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.namespace
|
|
image: quay.io/ansible/awx:24.6.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: awx-task
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/tower/conf.d/execution_environments.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: execution_environments.py
|
|
- mountPath: /etc/tower/conf.d/credentials.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: credentials.py
|
|
- mountPath: /etc/tower/conf.d/ldap.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: ldap.py
|
|
- mountPath: /etc/tower/SECRET_KEY
|
|
name: awx-secret-key
|
|
readOnly: true
|
|
subPath: SECRET_KEY
|
|
- mountPath: /etc/tower/settings.py
|
|
name: awx-settings
|
|
readOnly: true
|
|
subPath: settings.py
|
|
- mountPath: /var/run/redis
|
|
name: awx-redis-socket
|
|
- mountPath: /var/run/awx-rsyslog
|
|
name: rsyslog-socket
|
|
- mountPath: /etc/receptor/
|
|
name: awx-receptor-config
|
|
- mountPath: /etc/receptor/work_private_key.pem
|
|
name: awx-receptor-work-signing
|
|
readOnly: true
|
|
subPath: work-private-key.pem
|
|
- mountPath: /var/run/receptor
|
|
name: receptor-socket
|
|
- mountPath: /var/lib/awx/projects
|
|
name: awx-projects
|
|
- args:
|
|
- /bin/sh
|
|
- -c
|
|
- "if [ ! -f /etc/receptor/receptor.conf ]; then\n cp /etc/receptor/receptor-default.conf\
|
|
\ /etc/receptor/receptor.conf\n sed -i \"s/HOSTNAME/$HOSTNAME/g\" /etc/receptor/receptor.conf\n\
|
|
fi\nexec receptor --config /etc/receptor/receptor.conf\n"
|
|
image: quay.io/ansible/awx-ee:24.6.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: awx-ee
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 64Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/receptor/receptor-default.conf
|
|
name: awx-default-receptor-config
|
|
subPath: receptor.conf
|
|
- mountPath: /etc/receptor/
|
|
name: awx-receptor-config
|
|
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
|
name: awx-receptor-ca
|
|
readOnly: true
|
|
subPath: tls.crt
|
|
- mountPath: /etc/receptor/work_private_key.pem
|
|
name: awx-receptor-work-signing
|
|
readOnly: true
|
|
subPath: work-private-key.pem
|
|
- mountPath: /etc/receptor/tls/
|
|
name: awx-receptor-tls
|
|
- mountPath: /var/run/receptor
|
|
name: receptor-socket
|
|
- mountPath: /var/lib/awx/projects
|
|
name: awx-projects
|
|
- args:
|
|
- /usr/bin/launch_awx_rsyslog.sh
|
|
env:
|
|
- name: SUPERVISOR_CONFIG_PATH
|
|
value: /etc/supervisord_rsyslog.conf
|
|
image: quay.io/ansible/awx:24.6.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: awx-rsyslog
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/tower/conf.d/credentials.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: credentials.py
|
|
- mountPath: /etc/tower/SECRET_KEY
|
|
name: awx-secret-key
|
|
readOnly: true
|
|
subPath: SECRET_KEY
|
|
- mountPath: /etc/tower/settings.py
|
|
name: awx-settings
|
|
readOnly: true
|
|
subPath: settings.py
|
|
- mountPath: /var/run/redis
|
|
name: awx-redis-socket
|
|
- mountPath: /var/run/awx-rsyslog
|
|
name: rsyslog-socket
|
|
dnsPolicy: ClusterFirst
|
|
initContainers:
|
|
- command:
|
|
- /bin/sh
|
|
- -c
|
|
- wait-for-migrations
|
|
image: quay.io/ansible/awx:24.6.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: init-database
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/tower/conf.d/credentials.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: credentials.py
|
|
- mountPath: /etc/tower/SECRET_KEY
|
|
name: awx-secret-key
|
|
readOnly: true
|
|
subPath: SECRET_KEY
|
|
- mountPath: /etc/tower/settings.py
|
|
name: awx-settings
|
|
readOnly: true
|
|
subPath: settings.py
|
|
- command:
|
|
- /bin/sh
|
|
- -c
|
|
- "hostname=$MY_POD_NAME\nreceptor --cert-makereq \\\n bits=2048 \\\n commonname=$hostname\
|
|
\ \\\n dnsname=$hostname \\\n nodeid=$hostname \\\n outreq=/etc/receptor/tls/receptor.req\
|
|
\ \\\n outkey=/etc/receptor/tls/receptor.key\nreceptor --cert-signreq \\\
|
|
\n req=/etc/receptor/tls/receptor.req \\\n cacert=/etc/receptor/tls/ca/mesh-CA.crt\
|
|
\ \\\n cakey=/etc/receptor/tls/ca/mesh-CA.key \\\n outcert=/etc/receptor/tls/receptor.crt\
|
|
\ \\\n notafter=$(date --iso-8601=seconds --utc --date \"10 years\") \\\
|
|
\n verify=yes\n"
|
|
env:
|
|
- name: MY_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.name
|
|
image: quay.io/ansible/awx-ee:24.6.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: init-receptor
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
|
name: awx-receptor-ca
|
|
readOnly: true
|
|
subPath: tls.crt
|
|
- mountPath: /etc/receptor/tls/ca/mesh-CA.key
|
|
name: awx-receptor-ca
|
|
readOnly: true
|
|
subPath: tls.key
|
|
- mountPath: /etc/receptor/tls/
|
|
name: awx-receptor-tls
|
|
restartPolicy: Always
|
|
schedulerName: default-scheduler
|
|
securityContext:
|
|
fsGroup: 0
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
runAsGroup: 0
|
|
runAsUser: 0
|
|
serviceAccount: awx
|
|
serviceAccountName: awx
|
|
terminationGracePeriodSeconds: 30
|
|
volumes:
|
|
- name: awx-application-credentials
|
|
secret:
|
|
defaultMode: 420
|
|
items:
|
|
- key: credentials.py
|
|
path: credentials.py
|
|
- key: ldap.py
|
|
path: ldap.py
|
|
- key: execution_environments.py
|
|
path: execution_environments.py
|
|
secretName: awx-app-credentials
|
|
- emptyDir: {}
|
|
name: awx-receptor-tls
|
|
- name: awx-receptor-ca
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: awx-receptor-ca
|
|
- name: awx-receptor-work-signing
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: awx-receptor-work-signing
|
|
- name: awx-secret-key
|
|
secret:
|
|
defaultMode: 420
|
|
items:
|
|
- key: secret_key
|
|
path: SECRET_KEY
|
|
secretName: awx-secret-key
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: settings
|
|
path: settings.py
|
|
name: awx-awx-configmap
|
|
name: awx-settings
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: nginx_conf
|
|
path: nginx.conf
|
|
name: awx-awx-configmap
|
|
name: awx-nginx-conf
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: redis_conf
|
|
path: redis.conf
|
|
name: awx-awx-configmap
|
|
name: awx-redis-config
|
|
- emptyDir: {}
|
|
name: awx-redis-socket
|
|
- emptyDir: {}
|
|
name: awx-redis-data
|
|
- emptyDir: {}
|
|
name: rsyslog-socket
|
|
- emptyDir: {}
|
|
name: receptor-socket
|
|
- emptyDir: {}
|
|
name: awx-receptor-config
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: receptor_conf
|
|
path: receptor.conf
|
|
name: awx-awx-configmap
|
|
name: awx-default-receptor-config
|
|
- emptyDir: {}
|
|
name: awx-projects
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: awx-web
|
|
app.kubernetes.io/operator-version: 2.19.1
|
|
app.kubernetes.io/part-of: awx
|
|
app.kubernetes.io/version: 24.6.1
|
|
name: awx-web
|
|
namespace: awx
|
|
ownerReferences:
|
|
- apiVersion: awx.ansible.com/v1beta1
|
|
kind: AWX
|
|
name: awx
|
|
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
|
spec:
|
|
progressDeadlineSeconds: 600
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: awx-web
|
|
strategy:
|
|
rollingUpdate:
|
|
maxSurge: 25%
|
|
maxUnavailable: 25%
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum-configmaps-config: 0568b2f90d49d75330b303e6e2f2a43af3647f2c
|
|
checksum-secret-bundle_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
|
checksum-secret-ldap_cacert: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
|
checksum-secret-receptor_ca: 3473ef9751dd3f05dc3954934ae05721a11834b1
|
|
checksum-secret-receptor_work_signing: 5c52a9cd6110ff19ddc3fa9e96e3bda62b185cc6
|
|
checksum-secret-route_tls: da39a3ee5e6b4b0d3255bfef95601890afd80709
|
|
checksum-secret-secret_key: 980cdfda514a5e1ff3b2b6505c1844f6cfa11c66
|
|
checksum-secrets-app_credentials: 1fe9a3f9c4d6dc312ac7af5ff93f1ebd1417fc17
|
|
checksum-storage-persistent: adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
|
|
kubectl.kubernetes.io/default-container: awx-web
|
|
labels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: awx-web
|
|
app.kubernetes.io/operator-version: 2.19.1
|
|
app.kubernetes.io/part-of: awx
|
|
app.kubernetes.io/version: 24.6.1
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- redis-server
|
|
- /etc/redis.conf
|
|
image: docker.io/redis:7
|
|
imagePullPolicy: IfNotPresent
|
|
name: redis
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/redis.conf
|
|
name: awx-redis-config
|
|
readOnly: true
|
|
subPath: redis.conf
|
|
- mountPath: /var/run/redis
|
|
name: awx-redis-socket
|
|
- mountPath: /data
|
|
name: awx-redis-data
|
|
- args:
|
|
- /usr/bin/launch_awx_web.sh
|
|
env:
|
|
- name: AWX_COMPONENT
|
|
value: web
|
|
- name: SUPERVISOR_CONFIG_PATH
|
|
value: /etc/supervisord_web.conf
|
|
- name: MY_POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.namespace
|
|
- name: MY_POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: status.podIP
|
|
- name: UWSGI_MOUNT_PATH
|
|
value: /
|
|
image: quay.io/ansible/awx:24.6.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: awx-web
|
|
ports:
|
|
- containerPort: 8052
|
|
protocol: TCP
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/tower/uwsgi.ini
|
|
name: awx-uwsgi-config
|
|
readOnly: true
|
|
subPath: uwsgi.conf
|
|
- mountPath: /etc/tower/conf.d/execution_environments.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: execution_environments.py
|
|
- mountPath: /etc/tower/conf.d/credentials.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: credentials.py
|
|
- mountPath: /etc/tower/conf.d/ldap.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: ldap.py
|
|
- mountPath: /etc/tower/SECRET_KEY
|
|
name: awx-secret-key
|
|
readOnly: true
|
|
subPath: SECRET_KEY
|
|
- mountPath: /etc/tower/settings.py
|
|
name: awx-settings
|
|
readOnly: true
|
|
subPath: settings.py
|
|
- mountPath: /etc/nginx/nginx.conf
|
|
name: awx-nginx-conf
|
|
readOnly: true
|
|
subPath: nginx.conf
|
|
- mountPath: /var/run/redis
|
|
name: awx-redis-socket
|
|
- mountPath: /var/run/awx-rsyslog
|
|
name: rsyslog-socket
|
|
- mountPath: /etc/receptor/tls/ca/mesh-CA.crt
|
|
name: awx-receptor-ca
|
|
readOnly: true
|
|
subPath: tls.crt
|
|
- mountPath: /etc/receptor/tls/ca/mesh-CA.key
|
|
name: awx-receptor-ca
|
|
readOnly: true
|
|
subPath: tls.key
|
|
- mountPath: /etc/receptor/work_public_key.pem
|
|
name: awx-receptor-work-signing
|
|
readOnly: true
|
|
subPath: work-public-key.pem
|
|
- args:
|
|
- /usr/bin/launch_awx_rsyslog.sh
|
|
env:
|
|
- name: SUPERVISOR_CONFIG_PATH
|
|
value: /etc/supervisord_rsyslog.conf
|
|
image: quay.io/ansible/awx:24.6.1
|
|
imagePullPolicy: IfNotPresent
|
|
name: awx-rsyslog
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /etc/tower/conf.d/credentials.py
|
|
name: awx-application-credentials
|
|
readOnly: true
|
|
subPath: credentials.py
|
|
- mountPath: /etc/tower/SECRET_KEY
|
|
name: awx-secret-key
|
|
readOnly: true
|
|
subPath: SECRET_KEY
|
|
- mountPath: /etc/tower/settings.py
|
|
name: awx-settings
|
|
readOnly: true
|
|
subPath: settings.py
|
|
- mountPath: /var/run/redis
|
|
name: awx-redis-socket
|
|
- mountPath: /var/run/awx-rsyslog
|
|
name: rsyslog-socket
|
|
dnsPolicy: ClusterFirst
|
|
restartPolicy: Always
|
|
schedulerName: default-scheduler
|
|
securityContext:
|
|
fsGroup: 0
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
runAsGroup: 0
|
|
runAsUser: 0
|
|
serviceAccount: awx
|
|
serviceAccountName: awx
|
|
terminationGracePeriodSeconds: 30
|
|
volumes:
|
|
- name: awx-receptor-ca
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: awx-receptor-ca
|
|
- name: awx-receptor-work-signing
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: awx-receptor-work-signing
|
|
- name: awx-application-credentials
|
|
secret:
|
|
defaultMode: 420
|
|
items:
|
|
- key: credentials.py
|
|
path: credentials.py
|
|
- key: ldap.py
|
|
path: ldap.py
|
|
- key: execution_environments.py
|
|
path: execution_environments.py
|
|
secretName: awx-app-credentials
|
|
- name: awx-secret-key
|
|
secret:
|
|
defaultMode: 420
|
|
items:
|
|
- key: secret_key
|
|
path: SECRET_KEY
|
|
secretName: awx-secret-key
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: settings
|
|
path: settings.py
|
|
name: awx-awx-configmap
|
|
name: awx-settings
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: nginx_conf
|
|
path: nginx.conf
|
|
name: awx-awx-configmap
|
|
name: awx-nginx-conf
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: redis_conf
|
|
path: redis.conf
|
|
name: awx-awx-configmap
|
|
name: awx-redis-config
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: uwsgi_conf
|
|
path: uwsgi.conf
|
|
name: awx-awx-configmap
|
|
name: awx-uwsgi-config
|
|
- emptyDir: {}
|
|
name: awx-redis-socket
|
|
- emptyDir: {}
|
|
name: awx-redis-data
|
|
- emptyDir: {}
|
|
name: rsyslog-socket
|
|
- emptyDir: {}
|
|
name: receptor-socket
|
|
- configMap:
|
|
defaultMode: 420
|
|
items:
|
|
- key: receptor_conf
|
|
path: receptor.conf
|
|
name: awx-awx-configmap
|
|
name: awx-receptor-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
annotations:
|
|
metallb.io/ip-allocated-from-pool: lan-pool
|
|
metallb.universe.tf/ip-allocated-from-pool: default-pool
|
|
metallb.universe.tf/loadBalancerIP: 140.44.4.30
|
|
finalizers:
|
|
- service.kubernetes.io/load-balancer-cleanup
|
|
name: awx-lb
|
|
namespace: awx
|
|
spec:
|
|
allocateLoadBalancerNodePorts: true
|
|
clusterIP: 10.43.229.215
|
|
clusterIPs:
|
|
- 10.43.229.215
|
|
externalTrafficPolicy: Cluster
|
|
internalTrafficPolicy: Cluster
|
|
ipFamilies:
|
|
- IPv4
|
|
ipFamilyPolicy: SingleStack
|
|
loadBalancerIP: 140.44.4.30
|
|
ports:
|
|
- name: webport
|
|
nodePort: 30015
|
|
port: 87
|
|
protocol: TCP
|
|
targetPort: 80
|
|
selector:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: awx-web
|
|
sessionAffinity: None
|
|
type: LoadBalancer
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
annotations:
|
|
meta.helm.sh/release-name: awx
|
|
meta.helm.sh/release-namespace: awx
|
|
labels:
|
|
app.kubernetes.io/managed-by: Helm
|
|
control-plane: controller-manager
|
|
helm.sh/chart: awx-operator
|
|
name: awx-operator-controller-manager-metrics-service
|
|
namespace: awx
|
|
spec:
|
|
clusterIP: 10.43.164.198
|
|
clusterIPs:
|
|
- 10.43.164.198
|
|
internalTrafficPolicy: Cluster
|
|
ipFamilies:
|
|
- IPv4
|
|
ipFamilyPolicy: SingleStack
|
|
ports:
|
|
- name: https
|
|
port: 8443
|
|
protocol: TCP
|
|
targetPort: https
|
|
selector:
|
|
control-plane: controller-manager
|
|
helm.sh/chart: awx-operator
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: database
|
|
app.kubernetes.io/instance: postgres-15-awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: postgres-15
|
|
app.kubernetes.io/operator-version: 2.19.1
|
|
app.kubernetes.io/part-of: awx
|
|
name: awx-postgres-15
|
|
namespace: awx
|
|
ownerReferences:
|
|
- apiVersion: awx.ansible.com/v1beta1
|
|
kind: AWX
|
|
name: awx
|
|
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
|
spec:
|
|
clusterIP: None
|
|
clusterIPs:
|
|
- None
|
|
internalTrafficPolicy: Cluster
|
|
ipFamilies:
|
|
- IPv4
|
|
ipFamilyPolicy: SingleStack
|
|
ports:
|
|
- port: 5432
|
|
protocol: TCP
|
|
targetPort: 5432
|
|
selector:
|
|
app.kubernetes.io/component: database
|
|
app.kubernetes.io/instance: postgres-15-awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: postgres-15
|
|
app.kubernetes.io/part-of: awx
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/operator-version: 2.19.1
|
|
app.kubernetes.io/part-of: awx
|
|
name: awx-service
|
|
namespace: awx
|
|
ownerReferences:
|
|
- apiVersion: awx.ansible.com/v1beta1
|
|
kind: AWX
|
|
name: awx
|
|
uid: 3b61a7c4-e398-4b54-b443-8454c80e1c06
|
|
spec:
|
|
clusterIP: 10.43.161.26
|
|
clusterIPs:
|
|
- 10.43.161.26
|
|
internalTrafficPolicy: Cluster
|
|
ipFamilies:
|
|
- IPv4
|
|
ipFamilyPolicy: SingleStack
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
protocol: TCP
|
|
targetPort: 8052
|
|
- name: https
|
|
port: 443
|
|
protocol: TCP
|
|
targetPort: 8052
|
|
selector:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/managed-by: awx-operator
|
|
app.kubernetes.io/name: awx-web
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/service.serversscheme: http
|
|
labels:
|
|
app.kubernetes.io/component: awx
|
|
app.kubernetes.io/name: awx-web
|
|
name: awx-ingress
|
|
namespace: awx
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: awx.snarfnet.net
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: awx-service
|
|
port:
|
|
number: 80
|
|
path: /
|
|
pathType: ImplementationSpecific
|
|
tls:
|
|
- hosts:
|
|
- awx.snarfnet.net
|
|
secretName: tls-awx-cert2
|