Master
This commit is contained in:
Thibault Raquet
parent
6d79eb1f39
commit
57f12e186b
108 changed files with 7167 additions and 86429 deletions
|
|
@ -2,7 +2,7 @@ stages:
|
|||
- deploy
|
||||
|
||||
variables:
|
||||
KUBERNETES_VERSION: 1.28.3
|
||||
KUBERNETES_VERSION: 1.29.2
|
||||
|
||||
.deploy:
|
||||
stage: deploy
|
||||
|
|
@ -14,34 +14,13 @@ variables:
|
|||
- when: never
|
||||
before_script:
|
||||
- apk update && apk add gettext git
|
||||
- export $(cat ${ENV} | xargs)
|
||||
- kubectl config use-context ${KUBE_CONTEXT}
|
||||
- export $(cat ${ENV} | xargs) > /dev/null
|
||||
script:
|
||||
- |
|
||||
echo "Update namespaces"
|
||||
for namespace in $(find namespaces -name *.yaml);
|
||||
do envsubst < $namespace > $namespace.tmp;
|
||||
mv $namespace.tmp $namespace;
|
||||
done
|
||||
- |
|
||||
echo "Update pre-releases"
|
||||
for pre in $(find pre-releases -name *.yaml);
|
||||
do envsubst < $pre > $pre.tmp; mv $pre.tmp $pre;
|
||||
done
|
||||
- |
|
||||
echo "Update releases"
|
||||
for release in $(find releases -name *.yaml);
|
||||
do envsubst < $release > $release.tmp; mv $release.tmp $release;
|
||||
done
|
||||
- |
|
||||
echo "Update post-releases"
|
||||
for post in $(find post-releases -name *.yaml);
|
||||
do envsubst < $post > $post.tmp; mv $post.tmp $post;
|
||||
done
|
||||
- |
|
||||
echo "Deploy secrets"
|
||||
for secret in $(find secrets -name *.yaml);
|
||||
do envsubst < $secret | kubectl apply -f -;
|
||||
echo "Update infrastructure directory"
|
||||
for manifest in $(find infrastructure -name *.yaml);
|
||||
do envsubst < $manifest > $manifest.tmp;
|
||||
mv $manifest.tmp $manifest;
|
||||
done
|
||||
- |
|
||||
echo "Pushing updated manifests in ${DEPLOY_BRANCH} branch"
|
||||
|
|
@ -72,12 +51,12 @@ deploy:production:
|
|||
extends:
|
||||
- .deploy
|
||||
variables:
|
||||
KUBE_CONTEXT: ldc-web/cluster-k8s:k8s-ldc-web
|
||||
KUBE_CONTEXT: ldc-web/cluster-k8s:prod-k8s-ldc-web
|
||||
DEPLOY_BRANCH: deploy/production
|
||||
environment:
|
||||
name: production
|
||||
rules:
|
||||
- if: $CI_COMMIT_REF_NAME == "main"
|
||||
- if: $CI_COMMIT_REF_NAME == "master"
|
||||
when: manual
|
||||
allow_failure: true
|
||||
- when: never
|
||||
|
|
|
|||
|
|
@ -1,23 +1,23 @@
|
|||
ci_access:
|
||||
projects:
|
||||
- id: ldc-web/cluster-k8s
|
||||
access_as:
|
||||
impersonate:
|
||||
username: kubernetes-admin-DEV-TEST-K8S-LDC-WEB
|
||||
- id: ldc-web/projets/agis
|
||||
- id: ldc-web/projets/crm
|
||||
- id: ldc-web/projets/coupe-de-france-de-la-volaille
|
||||
- id: ldc-web/projets/domaine-de-lanvaux
|
||||
- id: ldc-web/projets/doux
|
||||
- id: ldc-web/projets/galina
|
||||
- id: ldc-web/projets/gen-game-web-instances/reghalal-ramadan-2024
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
|
||||
- id: ldc-web/projets/gen-game-web-instances/tregalette-chandleur-2024
|
||||
- id: ldc-web/projets/id-halal
|
||||
- id: ldc-web/projets/jeusselin
|
||||
- id: ldc-web/projets/l-hours
|
||||
- id: ldc-web/projets/la-toque-angevine
|
||||
- id: ldc-web/projets/ldc-web
|
||||
- id: ldc-web/projets/le-gaulois
|
||||
- id: ldc-web/projets/le-gaulois-pro
|
||||
- id: ldc-web/projets/lionor
|
||||
- id: ldc-web/projets/loue
|
||||
- id: ldc-web/projets/loue-magie-de-noel
|
||||
- id: ldc-web/projets/mas-d-auge
|
||||
- id: ldc-web/projets/matines
|
||||
|
|
@ -32,6 +32,8 @@ ci_access:
|
|||
- id: ldc-web/projets/regalette
|
||||
- id: ldc-web/projets/reghalal
|
||||
- id: ldc-web/projets/report
|
||||
- id: ldc-web/projets/rgpd
|
||||
- id: ldc-web/projets/sbv
|
||||
- id: ldc-web/projets/share-secure-content
|
||||
- id: ldc-web/projets/showroom/showroom-bo
|
||||
- id: ldc-web/projets/store-ldc
|
||||
|
|
|
|||
|
|
@ -33,6 +33,7 @@ ci_access:
|
|||
- id: ldc-web/projets/reghalal
|
||||
- id: ldc-web/projets/report
|
||||
- id: ldc-web/projets/rgpd
|
||||
- id: ldc-web/projets/sbv
|
||||
- id: ldc-web/projets/share-secure-content
|
||||
- id: ldc-web/projets/showroom/showroom-bo
|
||||
- id: ldc-web/projets/store-ldc
|
||||
|
|
|
|||
47
.gitlab/agents/prod-k8s-ldc-web/config.yaml
Normal file
47
.gitlab/agents/prod-k8s-ldc-web/config.yaml
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
ci_access:
|
||||
projects:
|
||||
- id: ldc-web/projets/agis
|
||||
- id: ldc-web/projets/crm
|
||||
- id: ldc-web/projets/coupe-de-france-de-la-volaille
|
||||
- id: ldc-web/projets/domaine-de-lanvaux
|
||||
- id: ldc-web/projets/doux
|
||||
- id: ldc-web/projets/galina
|
||||
- id: ldc-web/projets/gen-game-web-instances/reghalal-ramadan-2024
|
||||
- id: ldc-web/projets/gen-game-web-instances/le-gaulois-tdf-2024
|
||||
- id: ldc-web/projets/gen-game-web-instances/tregalette-chandleur-2024
|
||||
- id: ldc-web/projets/id-halal
|
||||
- id: ldc-web/projets/jeusselin
|
||||
- id: ldc-web/projets/l-hours
|
||||
- id: ldc-web/projets/la-toque-angevine
|
||||
- id: ldc-web/projets/ldc-web
|
||||
- id: ldc-web/projets/le-gaulois
|
||||
- id: ldc-web/projets/le-gaulois-pro
|
||||
- id: ldc-web/projets/lionor
|
||||
- id: ldc-web/projets/loue
|
||||
- id: ldc-web/projets/loue-magie-de-noel
|
||||
- id: ldc-web/projets/mas-d-auge
|
||||
- id: ldc-web/projets/matines
|
||||
- id: ldc-web/projets/nature-and-respect
|
||||
- id: ldc-web/projets/nature-eleveurs
|
||||
- id: ldc-web/projets/op-insta-instances/le-gaulois
|
||||
- id: ldc-web/projets/ovoteam
|
||||
- id: ldc-web/projets/poule-et-toque
|
||||
- id: ldc-web/projets/prims
|
||||
- id: ldc-web/projets/qrcollector/qrcollector-back
|
||||
- id: ldc-web/projets/qrcollector/qrcollector-front
|
||||
- id: ldc-web/projets/regalette
|
||||
- id: ldc-web/projets/reghalal
|
||||
- id: ldc-web/projets/report
|
||||
- id: ldc-web/projets/rgpd
|
||||
- id: ldc-web/projets/sbv
|
||||
- id: ldc-web/projets/share-secure-content
|
||||
- id: ldc-web/projets/showroom/showroom-bo
|
||||
- id: ldc-web/projets/store-ldc
|
||||
- id: ldc-web/projets/support-web
|
||||
- id: ldc-web/projets/tregalette
|
||||
- id: ldc-web/projets/vdme
|
||||
- id: ldc-web/projets/volena
|
||||
|
||||
observability:
|
||||
logging:
|
||||
level: debug
|
||||
16
README.md
16
README.md
|
|
@ -1,5 +1,21 @@
|
|||
# Cluster K8s
|
||||
|
||||
# Fixed version
|
||||
|
||||
| Composants | PROD_Actuel | PROD_Futur | Version_latest (app) | Version_chart_helm |
|
||||
|------------ |--------------|------------|----------------------|--------------------|
|
||||
| Cert-manager | 1.11.0 | 1.15.0 | 1.15.0 | 1.15.0 |
|
||||
| FluxCD | no flux | 2.3.0 | 2.3.0 | 2.13.0 |
|
||||
| Git-agent | 16.9.3 | 16.9.3 | 17.1.0 | 2.30 |
|
||||
| Git-runner | 16.9.1 | 16.9.1 | 17.0.1 | 0.62.1 |
|
||||
| MariaDB | 10.10 | 1.13.2 | 1.13.2 | 18.2.4 |
|
||||
| Prometheus | 0.60.1 | 0.74.0 | 0.74.0 | 60.2.0 |
|
||||
| Traefik | 2.9.6 | 3.0.2 | 3.0.2 | 28.3.0 |
|
||||
| Velero | 1.10.1 | 1.13.2 | 1.13.2 | 6.7.0 |
|
||||
| Vault | no vault | 1.16.1 | 1.16.1 | 0.28.0 |
|
||||
|
||||
|
||||
|
||||
# How does it work ?
|
||||
|
||||
```mermaid
|
||||
|
|
|
|||
|
|
@ -1,66 +0,0 @@
|
|||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: game-2048
|
||||
labels:
|
||||
app: game-2048
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: game-2048
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: game-2048
|
||||
spec:
|
||||
containers:
|
||||
- image: alexwhen/docker-2048 # 2048 image
|
||||
name: game-2048
|
||||
ports:
|
||||
- name: web
|
||||
containerPort: 80
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: game-2048
|
||||
spec:
|
||||
selector:
|
||||
app: game-2048
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: web
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: game-2048
|
||||
spec:
|
||||
entryPoints: # We listen to requests coming from ports 80 and 443
|
||||
- web
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`2048.k8s.s-web.fr`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: game-2048 # Requests will be forwarded to this service
|
||||
port: 80
|
||||
tls:
|
||||
secretName: 2048.k8s.s-web.fr
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: 2048.k8s.s-web.fr
|
||||
spec:
|
||||
dnsNames:
|
||||
- 2048.k8s.s-web.fr
|
||||
secretName: 2048.k8s.s-web.fr
|
||||
issuerRef:
|
||||
name: selfsigned # Use the issuer created previously
|
||||
kind: ClusterIssuer
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -13,7 +13,7 @@ spec:
|
|||
name: flux-system
|
||||
url: https://lab.s-web.fr/ldc-web/cluster-k8s.git
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: flux-system
|
||||
|
|
@ -22,70 +22,6 @@ spec:
|
|||
interval: 10m0s
|
||||
path: ./flux/production
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: flux-system
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: namespaces
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./namespaces
|
||||
prune: true
|
||||
dependsOn:
|
||||
- name: flux-system
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: pre-releases
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./pre-releases
|
||||
prune: true
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: releases
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./releases
|
||||
prune: true
|
||||
dependsOn:
|
||||
- name: pre-releases
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: post-releases
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./post-releases
|
||||
prune: true
|
||||
dependsOn:
|
||||
- name: releases
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
|
|
|
|||
44
flux/production/kustomizations/cert-manager.yaml
Normal file
44
flux/production/kustomizations/cert-manager.yaml
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/cert-manager
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
dependsOn:
|
||||
- name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
timeout: 5m
|
||||
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cert-manager-resources
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/cert-manager/resources
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: cert-manager
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
timeout: 5m
|
||||
17
flux/production/kustomizations/flux-resources.yaml
Normal file
17
flux/production/kustomizations/flux-resources.yaml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: flux-resources
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/flux-resources
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
namespace: flux-system
|
||||
22
flux/production/kustomizations/gitlab-agent.yaml
Normal file
22
flux/production/kustomizations/gitlab-agent.yaml
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: gitlab-agent
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/gitlab-agent
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: flux-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
22
flux/production/kustomizations/gitlab-runner.yaml
Normal file
22
flux/production/kustomizations/gitlab-runner.yaml
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/gitlab-runner
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: flux-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
73
flux/production/kustomizations/hashicorp-vault.yaml
Normal file
73
flux/production/kustomizations/hashicorp-vault.yaml
Normal file
|
|
@ -0,0 +1,73 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: hashicorp-vault
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/hashicorp-vault
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
namespace: flux-system
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: hashicorp
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: vault
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: external-secrets
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/hashicorp-vault/external-secrets
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: hashicorp-vault
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
namespace: flux-system
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: external-secrets
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: external-secrets-operator
|
||||
namespace: common-services
|
||||
timeout: 10m
|
||||
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/hashicorp-vault/external-secrets/resources
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
namespace: flux-system
|
||||
timeout: 10m
|
||||
17
flux/production/kustomizations/ldc-custom.yaml
Normal file
17
flux/production/kustomizations/ldc-custom.yaml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: ldc-custom
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/ldc-custom
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
dependsOn:
|
||||
- name: prometheus-stack
|
||||
namespace: flux-system
|
||||
timeout: 5m
|
||||
26
flux/production/kustomizations/mariadb.yaml
Normal file
26
flux/production/kustomizations/mariadb.yaml
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: mariadb
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/mariadb
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
dependsOn:
|
||||
- name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: mariadb
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
32
flux/production/kustomizations/namespaces.yaml
Normal file
32
flux/production/kustomizations/namespaces.yaml
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: namespaces
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/namespaces
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: flux-system
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: common-services
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: production
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: review
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: staging
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: velero
|
||||
26
flux/production/kustomizations/prometheus-stack.yaml
Normal file
26
flux/production/kustomizations/prometheus-stack.yaml
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: prometheus-stack
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/prometheus-stack
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
dependsOn:
|
||||
- name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: prometheus-stack
|
||||
namespace: common-services
|
||||
timeout: 10m
|
||||
26
flux/production/kustomizations/traefik.yaml
Normal file
26
flux/production/kustomizations/traefik.yaml
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/traefik
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
dependsOn:
|
||||
- name: cert-manager-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
timeout: 5m
|
||||
49
flux/staging/kustomizations/cert-manager.yaml
Normal file
49
flux/staging/kustomizations/cert-manager.yaml
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/cert-manager
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
timeout: 5m
|
||||
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cert-manager-resources
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/cert-manager/resources
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
name: common-services
|
||||
namespace: cert-manager
|
||||
dependsOn:
|
||||
- name: cert-manager
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
timeout: 5m
|
||||
14
flux/staging/kustomizations/flux-resources.yaml
Normal file
14
flux/staging/kustomizations/flux-resources.yaml
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: flux-resources
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/flux-resources
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
namespace: flux-system
|
||||
22
flux/staging/kustomizations/gitlab-agent.yaml
Normal file
22
flux/staging/kustomizations/gitlab-agent.yaml
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: gitlab-agent
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/gitlab-agent
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: flux-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
22
flux/staging/kustomizations/gitlab-runner.yaml
Normal file
22
flux/staging/kustomizations/gitlab-runner.yaml
Normal file
|
|
@ -0,0 +1,22 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/gitlab-runner
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: flux-resources
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
69
flux/staging/kustomizations/hashicorp-vault.yaml
Normal file
69
flux/staging/kustomizations/hashicorp-vault.yaml
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: hashicorp-vault
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/hashicorp-vault
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
dependsOn:
|
||||
- name: namespaces
|
||||
namespace: flux-system
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: hashicorp
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: external-secrets
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/hashicorp-vault/external-secrets
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: hashicorp-vault
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
namespace: flux-system
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: external-secrets
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
name: external-secrets-operator
|
||||
namespace: common-services
|
||||
timeout: 10m
|
||||
|
||||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: external-secrets-resources
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/hashicorp-vault/external-secrets/resources
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: external-secrets
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
namespace: flux-system
|
||||
timeout: 10m
|
||||
17
flux/staging/kustomizations/ldc-custom.yaml
Normal file
17
flux/staging/kustomizations/ldc-custom.yaml
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: ldc-custom
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/ldc-custom
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
dependsOn:
|
||||
- name: prometheus-stack
|
||||
namespace: flux-system
|
||||
timeout: 5m
|
||||
23
flux/staging/kustomizations/mariadb.yaml
Normal file
23
flux/staging/kustomizations/mariadb.yaml
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: mariadb
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/mariadb
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
name: mariadb
|
||||
namespace: common-services
|
||||
timeout: 5m
|
||||
32
flux/staging/kustomizations/namespaces.yaml
Normal file
32
flux/staging/kustomizations/namespaces.yaml
Normal file
|
|
@ -0,0 +1,32 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: namespaces
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/namespaces
|
||||
prune: false
|
||||
dependsOn:
|
||||
- name: flux-system
|
||||
namespace: flux-system
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: common-services
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: production
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: review
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: staging
|
||||
- apiVersion: v1
|
||||
kind: Namespace
|
||||
name: velero
|
||||
23
flux/staging/kustomizations/prometheus-stack.yaml
Normal file
23
flux/staging/kustomizations/prometheus-stack.yaml
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: prometheus-stack
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 30s
|
||||
path: ./infrastructure/prometheus-stack
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
name: prometheus-stack
|
||||
namespace: common-services
|
||||
timeout: 10m
|
||||
26
flux/staging/kustomizations/traefik.yaml
Normal file
26
flux/staging/kustomizations/traefik.yaml
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
---
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 1m0s
|
||||
path: ./infrastructure/traefik
|
||||
prune: false
|
||||
healthChecks:
|
||||
- apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
- apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
dependsOn:
|
||||
- name: cert-manager-resources
|
||||
namespace: common-services
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: cluster-k8s
|
||||
timeout: 5m
|
||||
18
infrastructure/cert-manager/helm-release.yaml
Normal file
18
infrastructure/cert-manager/helm-release.yaml
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: cert-manager
|
||||
version: 1.15.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
installCRDs: true
|
||||
8
infrastructure/cert-manager/helm-repository.yaml
Normal file
8
infrastructure/cert-manager/helm-repository.yaml
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://charts.jetstack.io
|
||||
5
infrastructure/cert-manager/kustomization.yaml
Normal file
5
infrastructure/cert-manager/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
41
infrastructure/cert-manager/resources/certificates.yaml
Normal file
41
infrastructure/cert-manager/resources/certificates.yaml
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: wildcard-k8s-${DOMAIN_NAME}
|
||||
namespace: review
|
||||
spec:
|
||||
dnsNames:
|
||||
- '*.review.${DOMAIN_NAME}'
|
||||
secretName: wildcard-k8s-ldc
|
||||
issuerRef:
|
||||
name: letsencrypt-production-dns01
|
||||
kind: ClusterIssuer
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: wildcard-k8s-${DOMAIN_NAME}
|
||||
namespace: staging
|
||||
spec:
|
||||
dnsNames:
|
||||
- '*.staging.${DOMAIN_NAME}'
|
||||
secretName: wildcard-k8s-ldc
|
||||
issuerRef:
|
||||
name: letsencrypt-production-dns01
|
||||
kind: ClusterIssuer
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: wildcard-k8s-${DOMAIN_NAME}
|
||||
namespace: production
|
||||
spec:
|
||||
dnsNames:
|
||||
- '*.k8s.${DOMAIN_NAME}'
|
||||
secretName: wildcard-k8s-ldc
|
||||
issuerRef:
|
||||
name: letsencrypt-production-dns01
|
||||
kind: ClusterIssuer
|
||||
5
infrastructure/cert-manager/resources/kustomization.yaml
Normal file
5
infrastructure/cert-manager/resources/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- cluster-issuers.yaml
|
||||
- certificates.yaml
|
||||
4
infrastructure/flux-resources/kustomization.yaml
Normal file
4
infrastructure/flux-resources/kustomization.yaml
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- teams-alert.yaml
|
||||
|
|
@ -1,31 +1,33 @@
|
|||
---
|
||||
apiVersion: notification.toolkit.fluxcd.io/v1beta3
|
||||
kind: Provider
|
||||
metadata:
|
||||
name: msteams
|
||||
namespace: flux-system
|
||||
spec:
|
||||
type: msteams
|
||||
channel: "Flux CD - LDC_WEB"
|
||||
secretRef:
|
||||
name: msteams-url
|
||||
|
||||
---
|
||||
apiVersion: notification.toolkit.fluxcd.io/v1beta3
|
||||
kind: Alert
|
||||
metadata:
|
||||
name: msteams
|
||||
namespace: flux-system
|
||||
spec:
|
||||
providerRef:
|
||||
name: msteams
|
||||
eventSeverity: info
|
||||
eventSources:
|
||||
- kind: GitRepository
|
||||
name: '*'
|
||||
- kind: Kustomization
|
||||
name: '*'
|
||||
- kind: HelmRepository
|
||||
name: '*'
|
||||
- kind: HelmRelease
|
||||
name: '*'
|
||||
---
|
||||
apiVersion: notification.toolkit.fluxcd.io/v1beta3
|
||||
kind: Provider
|
||||
metadata:
|
||||
name: msteams
|
||||
namespace: flux-system
|
||||
spec:
|
||||
type: msteams
|
||||
channel: "Flux CD - LDC_WEB"
|
||||
secretRef:
|
||||
name: msteams-url
|
||||
|
||||
---
|
||||
apiVersion: notification.toolkit.fluxcd.io/v1beta3
|
||||
kind: Alert
|
||||
metadata:
|
||||
name: msteams
|
||||
namespace: flux-system
|
||||
spec:
|
||||
providerRef:
|
||||
name: msteams
|
||||
eventSeverity: info
|
||||
eventSources:
|
||||
- kind: GitRepository
|
||||
name: '*'
|
||||
- kind: Kustomization
|
||||
name: '*'
|
||||
- kind: HelmRepository
|
||||
name: '*'
|
||||
- kind: HelmRelease
|
||||
name: '*'
|
||||
exclusionList:
|
||||
- "^Dependencies.*"
|
||||
|
|
@ -1,33 +1,24 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://charts.gitlab.io
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: gitlab-agent
|
||||
version: ${GITLAB_AGENT_CHART_VERSION}
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: "${GITLAB_AGENT_APP_VERSION}"
|
||||
|
||||
config:
|
||||
kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"
|
||||
secretName: gitlab-agent-token
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: gitlab-agent
|
||||
version: 1.24.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: v16.9.2
|
||||
|
||||
config:
|
||||
kasAddress: "wss://lab.s-web.fr/-/kubernetes-agent/"
|
||||
secretName: gitlab-agent-token
|
||||
9
infrastructure/gitlab-agent/helm-repository.yaml
Normal file
9
infrastructure/gitlab-agent/helm-repository.yaml
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: gitlab-agent
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://charts.gitlab.io
|
||||
5
infrastructure/gitlab-agent/kustomization.yaml
Normal file
5
infrastructure/gitlab-agent/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
|
|
@ -1,46 +1,37 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://charts.gitlab.io
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: gitlab-runner
|
||||
version: ${GITLAB_RUNNER_CHART_VERSION}
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: ${GITLAB_RUNNER_APP_VERSION}
|
||||
|
||||
gitlabUrl: https://lab.s-web.fr
|
||||
|
||||
runners:
|
||||
config: |
|
||||
[[runners]]
|
||||
executor = "kubernetes"
|
||||
[runners.kubernetes]
|
||||
namespace = "{{.Release.Namespace}}"
|
||||
image = "alpine"
|
||||
secret: gitlab-runner-token
|
||||
|
||||
metrics:
|
||||
enabled: true
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: gitlab-runner
|
||||
version: 0.62.1
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: alpine-v16.9.1
|
||||
|
||||
gitlabUrl: https://lab.s-web.fr
|
||||
|
||||
runners:
|
||||
config: |
|
||||
[[runners]]
|
||||
executor = "kubernetes"
|
||||
[runners.kubernetes]
|
||||
namespace = "{{.Release.Namespace}}"
|
||||
image = "alpine"
|
||||
secret: gitlab-runner-token
|
||||
|
||||
metrics:
|
||||
enabled: true
|
||||
|
||||
rbac:
|
||||
create: true
|
||||
9
infrastructure/gitlab-runner/helm-repository.yaml
Normal file
9
infrastructure/gitlab-runner/helm-repository.yaml
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://charts.gitlab.io
|
||||
5
infrastructure/gitlab-runner/kustomization.yaml
Normal file
5
infrastructure/gitlab-runner/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: external-secrets-operator
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: external-secrets
|
||||
version: 0.9.19
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: external-secrets
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: v0.9.19
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: external-secrets
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://charts.external-secrets.io
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: cloudflare-api-token-secret
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: cloudflare-api-token-secret
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
api-token: "{{ .api_key }}"
|
||||
data:
|
||||
- secretKey: api_key
|
||||
remoteRef:
|
||||
key: secret/certificate
|
||||
property: cloudflare_token
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: vault-secret-store
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: "http://vault.common-services.svc.cluster.local:8200"
|
||||
path: "secret"
|
||||
version: "v2"
|
||||
auth:
|
||||
# points to a secret that contains a vault token
|
||||
# https://www.vaultproject.io/docs/auth/token
|
||||
tokenSecretRef:
|
||||
name: "vault-token"
|
||||
namespace: "common-services"
|
||||
key: "token"
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: msteams-url
|
||||
namespace: flux-system
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: msteams-url
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
address: "{{ .url }}"
|
||||
data:
|
||||
- secretKey: url
|
||||
remoteRef:
|
||||
key: secret/teams
|
||||
property: flux_teams_webhook
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitlab-agent-token
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: gitlab-agent-token
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
token: "{{ .token }}"
|
||||
data:
|
||||
- secretKey: token
|
||||
remoteRef:
|
||||
key: secret/gitlab
|
||||
property: agent_token
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
---
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitlab-runner-token
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: gitlab-runner-token
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
runner-registration-token: ""
|
||||
runner-token: "{{ .token }}"
|
||||
data:
|
||||
- secretKey: token
|
||||
remoteRef:
|
||||
key: secret/gitlab
|
||||
property: runner_token
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- cert-manager.yaml
|
||||
- cluster-secret-store.yaml
|
||||
- flux-resources.yaml
|
||||
- gitlab-agent.yaml
|
||||
- gitlab-runner.yaml
|
||||
- mariadb.yaml
|
||||
- prometheus-stack.yaml
|
||||
- review.yaml
|
||||
- staging.yaml
|
||||
- production.yaml
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: mariadb-credentials
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: mariadb-credentials
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
mariadb-password: "{{ .password }}"
|
||||
mariadb-replication-password: "{{ .root_password }}"
|
||||
mariadb-root-password: "{{ .root_password }}"
|
||||
data:
|
||||
- secretKey: root_password
|
||||
remoteRef:
|
||||
key: secret/mariadb
|
||||
property: root_password
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: secret/mariadb
|
||||
property: password
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: docker-registry-credentials
|
||||
namespace: production
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: docker-registry-credentials
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
.dockerconfigjson: "{{ .config }}"
|
||||
data:
|
||||
- secretKey: config
|
||||
remoteRef:
|
||||
key: secret/docker
|
||||
property: auth_config
|
||||
decodingStrategy: Base64
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: grafana-admin
|
||||
namespace: common-services
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: grafana-admin
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: Opaque
|
||||
data:
|
||||
user: "{{ .user }}"
|
||||
password: "{{ .password }}"
|
||||
data:
|
||||
- secretKey: user
|
||||
remoteRef:
|
||||
key: secret/prometheus-stack
|
||||
property: grafana_user
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: secret/prometheus-stack
|
||||
property: grafana_admin_password
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: docker-registry-credentials
|
||||
namespace: review
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: docker-registry-credentials
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
.dockerconfigjson: "{{ .config }}"
|
||||
data:
|
||||
- secretKey: config
|
||||
remoteRef:
|
||||
key: secret/docker
|
||||
property: auth_config
|
||||
decodingStrategy: Base64
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: docker-registry-credentials
|
||||
namespace: staging
|
||||
spec:
|
||||
refreshInterval: "15s"
|
||||
secretStoreRef:
|
||||
name: vault-secret-store
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: docker-registry-credentials
|
||||
template:
|
||||
engineVersion: v2
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
.dockerconfigjson: "{{ .config }}"
|
||||
data:
|
||||
- secretKey: config
|
||||
remoteRef:
|
||||
key: secret/docker
|
||||
property: auth_config
|
||||
decodingStrategy: Base64
|
||||
31
infrastructure/hashicorp-vault/helm-release.yaml
Normal file
31
infrastructure/hashicorp-vault/helm-release.yaml
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: vault
|
||||
version: 0.28.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: hashicorp
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
injector:
|
||||
metrics:
|
||||
enabled: true
|
||||
image:
|
||||
tag: "1.4.1"
|
||||
agentImage:
|
||||
tag: "1.16.1"
|
||||
server:
|
||||
image:
|
||||
tag: "1.16.1"
|
||||
ingress:
|
||||
enabled: false
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
8
infrastructure/hashicorp-vault/helm-repository.yaml
Normal file
8
infrastructure/hashicorp-vault/helm-repository.yaml
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: hashicorp
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://helm.releases.hashicorp.com
|
||||
5
infrastructure/hashicorp-vault/kustomization.yaml
Normal file
5
infrastructure/hashicorp-vault/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
5
infrastructure/ldc-custom/kustomization.yaml
Normal file
5
infrastructure/ldc-custom/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- ldc-web-equipe-rbac.yaml
|
||||
- shinken-rbac.yaml
|
||||
|
|
@ -1,177 +1,177 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: vincent-bridier-secret
|
||||
namespace: kube-system
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: svc-vincent-bridier
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: jeremy-munsch-secret
|
||||
namespace: kube-system
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: svc-jeremy-munsch
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: crb-view-admin-web
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: view
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: cr-ldc-web-metrics
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services/portforward
|
||||
- services/proxy
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- traefik.io
|
||||
resources:
|
||||
- ingressroutes
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- middlewares
|
||||
- middlewaretcps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
- traefikservices
|
||||
- serverstransports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: crb-ldc-web-metrics
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cr-ldc-web-metrics
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: cr-admin-web-ldc-namespace
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: rb-admin-web-ldc-namespace-review
|
||||
namespace: review
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: rb-admin-web-ldc-namespace-staging
|
||||
namespace: staging
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: rb-admin-web-ldc-namespace-production
|
||||
namespace: production
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: vincent-bridier-secret
|
||||
namespace: kube-system
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: svc-vincent-bridier
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: jeremy-munsch-secret
|
||||
namespace: kube-system
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: svc-jeremy-munsch
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: crb-view-admin-web
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: view
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: cr-ldc-web-metrics
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services/portforward
|
||||
- services/proxy
|
||||
verbs:
|
||||
- create
|
||||
- delete
|
||||
- get
|
||||
- list
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- traefik.io
|
||||
resources:
|
||||
- ingressroutes
|
||||
- ingressroutetcps
|
||||
- ingressrouteudps
|
||||
- middlewares
|
||||
- middlewaretcps
|
||||
- tlsoptions
|
||||
- tlsstores
|
||||
- traefikservices
|
||||
- serverstransports
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: crb-ldc-web-metrics
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cr-ldc-web-metrics
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
name: cr-admin-web-ldc-namespace
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "*"
|
||||
verbs:
|
||||
- "*"
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: rb-admin-web-ldc-namespace-review
|
||||
namespace: review
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: rb-admin-web-ldc-namespace-staging
|
||||
namespace: staging
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: rb-admin-web-ldc-namespace-production
|
||||
namespace: production
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-vincent-bridier
|
||||
namespace: kube-system
|
||||
- kind: ServiceAccount
|
||||
name: svc-jeremy-munsch
|
||||
namespace: kube-system
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-admin-web-ldc-namespace
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -1,51 +1,51 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: shinken-monitor-token
|
||||
namespace: common-services
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: svc-shinken-monitor
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: svc-shinken-monitor
|
||||
namespace: common-services
|
||||
secrets:
|
||||
- name: shinken-monitor-token
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cr-svc-monitor
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "*"
|
||||
resources:
|
||||
- pods
|
||||
- nodes
|
||||
- deployments
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: crb-svc-monitor
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-shinken-monitor
|
||||
namespace: common-services
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-svc-monitor
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: shinken-monitor-token
|
||||
namespace: common-services
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: svc-shinken-monitor
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: svc-shinken-monitor
|
||||
namespace: common-services
|
||||
secrets:
|
||||
- name: shinken-monitor-token
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: cr-svc-monitor
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "*"
|
||||
resources:
|
||||
- pods
|
||||
- nodes
|
||||
- deployments
|
||||
- namespaces
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- list
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: crb-svc-monitor
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: svc-shinken-monitor
|
||||
namespace: common-services
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: cr-svc-monitor
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
28
infrastructure/mariadb/helm-release.yaml
Normal file
28
infrastructure/mariadb/helm-release.yaml
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: mariadb
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: mariadb
|
||||
version: 18.2.4
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: 11.3.2-debian-12-r6
|
||||
|
||||
auth:
|
||||
existingSecret: mariadb-credentials
|
||||
|
||||
primary:
|
||||
persistence:
|
||||
storageClass: "csi-cinder-high-speed"
|
||||
size: 60Gi
|
||||
10
infrastructure/mariadb/helm-repository.yaml
Normal file
10
infrastructure/mariadb/helm-repository.yaml
Normal file
|
|
@ -0,0 +1,10 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: oci://registry-1.docker.io/bitnamicharts
|
||||
type: "oci"
|
||||
5
infrastructure/mariadb/kustomization.yaml
Normal file
5
infrastructure/mariadb/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
4
infrastructure/namespaces/kustomization.yaml
Normal file
4
infrastructure/namespaces/kustomization.yaml
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespaces.yaml
|
||||
29
infrastructure/namespaces/namespaces.yaml
Normal file
29
infrastructure/namespaces/namespaces.yaml
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: common-services
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: production
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: review
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: staging
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: velero
|
||||
|
|
@ -1,48 +1,40 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: prometheus-community
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://prometheus-community.github.io/helm-charts
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: prometheus-stack
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: kube-prometheus-stack
|
||||
version: ${PROMETHEUS_STACK_CHART_VERSION}
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
prometheusOperator:
|
||||
image:
|
||||
tag: "${PROMETHEUS_STACK_APP_VERSION}"
|
||||
|
||||
kubeTargetVersionOverride: "${KUBERNETES_VERSION}"
|
||||
|
||||
grafana:
|
||||
defaultDashboardsTimezone: Europe/Paris
|
||||
admin:
|
||||
existingSecret: grafana-admin
|
||||
userKey: user
|
||||
passwordKey: password
|
||||
|
||||
prometheus:
|
||||
prometheusSpec:
|
||||
storageSpec:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: "csi-cinder-classic"
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: prometheus-stack
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: kube-prometheus-stack
|
||||
version: 60.2.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
prometheusOperator:
|
||||
image:
|
||||
tag: v0.74.0
|
||||
|
||||
grafana:
|
||||
defaultDashboardsTimezone: Europe/Paris
|
||||
admin:
|
||||
existingSecret: grafana-admin
|
||||
userKey: user
|
||||
passwordKey: password
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
prometheus:
|
||||
prometheusSpec:
|
||||
storageSpec:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: "csi-cinder-classic"
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
9
infrastructure/prometheus-stack/helm-repository.yaml
Normal file
9
infrastructure/prometheus-stack/helm-repository.yaml
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: prometheus-community
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://prometheus-community.github.io/helm-charts
|
||||
5
infrastructure/prometheus-stack/kustomization.yaml
Normal file
5
infrastructure/prometheus-stack/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
|
|
@ -1,171 +1,169 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://traefik.github.io/charts
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: traefik
|
||||
version: ${TRAEFIK_CHART_VERSION}
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: "${TRAEFIK_APP_VERSION}"
|
||||
|
||||
rbac:
|
||||
enabled: true
|
||||
|
||||
globalArguments:
|
||||
- "--global.checknewversion"
|
||||
- "--global.sendanonymoususage"
|
||||
- "--accesslog=true"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
||||
- "--providers.kubernetescrd.allowCrossNamespace=true"
|
||||
- "--entryPoints.web.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16,127.0.0.1/32"
|
||||
- "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16,127.0.0.1/32"
|
||||
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32"
|
||||
- "--entryPoints.mariadb.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP},10.124.0.0/16"
|
||||
|
||||
additionalArguments:
|
||||
- "--serversTransport.insecureSkipVerify=true"
|
||||
- "--log.level=DEBUG"
|
||||
|
||||
ports:
|
||||
traefik:
|
||||
port: 9000
|
||||
expose: false
|
||||
protocol: TCP
|
||||
web:
|
||||
redirectTo:
|
||||
port: websecure
|
||||
websecure:
|
||||
port: 8443
|
||||
expose: true
|
||||
exposedPort: 443
|
||||
protocol: TCP
|
||||
tls:
|
||||
enabled: true
|
||||
metrics:
|
||||
port: 9100
|
||||
expose: false
|
||||
protocol: TCP
|
||||
mariadb:
|
||||
port: 54322
|
||||
expose: true
|
||||
protocol: TCP
|
||||
|
||||
ingressRoute:
|
||||
dashboard:
|
||||
enable: true
|
||||
matchRule: Host(`traefik.k8s.${DOMAIN_NAME}`)
|
||||
entryPoints:
|
||||
- "web"
|
||||
- "websecure"
|
||||
middlewares:
|
||||
- name: auth
|
||||
- name: admin-ldc-whitelist
|
||||
tls:
|
||||
secretName: wildcard-${DOMAIN_NAME}
|
||||
|
||||
providers:
|
||||
kubernetesCRD:
|
||||
enabled: true
|
||||
ingresssClass: traefik
|
||||
kubernetesIngress:
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
type: LoadBalancer
|
||||
annotations:
|
||||
service.beta.kubernetes.io/ovh-loadbalancer-proxy-protocol: v2
|
||||
loadBalancerSourceRanges: [ ]
|
||||
spec:
|
||||
loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP}"
|
||||
externalTrafficPolicy: Local
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: auth
|
||||
namespace: common-services
|
||||
spec:
|
||||
basicAuth:
|
||||
secret: traefik-auth-ldc-oe
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-www-to-no-www
|
||||
namespace: common-services
|
||||
spec:
|
||||
# Redirect a request from an url to another with regex matching and replacement
|
||||
redirectRegex:
|
||||
# Apply a permanent redirection (HTTP 301)
|
||||
permanent: true
|
||||
# The regular expression to match and capture elements from the request URL
|
||||
regex: "^https?://www\\.(.+)"
|
||||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://${1}"
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-no-www-to-www
|
||||
namespace: common-services
|
||||
spec:
|
||||
# Redirect a request from an url to another with regex matching and replacement
|
||||
redirectRegex:
|
||||
# Apply a permanent redirection (HTTP 301)
|
||||
permanent: true
|
||||
# The regular expression to match and capture elements from the request URL
|
||||
regex: "^https?://(?:www\\.)?(.+)"
|
||||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://www.${1}"
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: MiddlewareTCP
|
||||
metadata:
|
||||
name: ipwhitelist-acces-mariadb
|
||||
namespace: common-services
|
||||
spec:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
- 46.18.126.208/28 # LDC
|
||||
- 62.193.56.48/32 # OPENevents - Bureau Neuville
|
||||
- 80.15.14.76/32 # LDC web - Box externe
|
||||
- 86.65.205.240/28 # LDC
|
||||
- 135.125.42.176/28 # LDC
|
||||
- 149.202.23.64/26 # LDC
|
||||
- 151.80.95.176/28 # LDC
|
||||
- 217.15.92.64/28 # LDC
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: admin-ldc-whitelist
|
||||
namespace: common-services
|
||||
spec:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
- 46.18.126.208/28 # LDC
|
||||
- 62.193.56.48/32 # OPENevents - Bureau Neuville
|
||||
- 80.15.14.76/32 # LDC web - Box externe
|
||||
- 86.65.205.240/28 # LDC
|
||||
- 135.125.42.176/28 # LDC
|
||||
- 149.202.23.64/26 # LDC
|
||||
- 151.80.95.176/28 # LDC
|
||||
- 217.15.92.64/28 # LDC
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: traefik
|
||||
version: 28.3.0
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: v3.0.2
|
||||
|
||||
rbac:
|
||||
enabled: true
|
||||
|
||||
globalArguments:
|
||||
- "--api.dashboard=true"
|
||||
- "--global.checknewversion"
|
||||
- "--global.sendanonymoususage"
|
||||
- "--accesslog=true"
|
||||
- "--entryPoints.web.http.redirections.entryPoint.to=websecure"
|
||||
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
||||
- "--providers.kubernetescrd.allowCrossNamespace=true"
|
||||
- "--entryPoints.web.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16,127.0.0.1/32"
|
||||
- "--entryPoints.websecure.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32,10.124.0.0/16,127.0.0.1/32"
|
||||
- "--entryPoints.websecure.forwardedHeaders.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP}/32"
|
||||
- "--entryPoints.mariadb.proxyProtocol.trustedIPs=${TRAEFIK_LOAD_BALANCER_IP},10.124.0.0/16"
|
||||
|
||||
additionalArguments:
|
||||
- "--log.level=DEBUG"
|
||||
|
||||
ports:
|
||||
traefik:
|
||||
port: 9000
|
||||
expose:
|
||||
default: false
|
||||
protocol: TCP
|
||||
web:
|
||||
redirectTo:
|
||||
port: websecure
|
||||
websecure:
|
||||
port: 8443
|
||||
expose:
|
||||
default: true
|
||||
exposedPort: 443
|
||||
protocol: TCP
|
||||
tls:
|
||||
enabled: true
|
||||
metrics:
|
||||
port: 9100
|
||||
expose:
|
||||
default: false
|
||||
protocol: TCP
|
||||
mariadb:
|
||||
port: 54322
|
||||
expose:
|
||||
default: true
|
||||
protocol: TCP
|
||||
|
||||
providers:
|
||||
kubernetesCRD:
|
||||
enabled: true
|
||||
ingresssClass: traefik
|
||||
kubernetesIngress:
|
||||
enabled: true
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
type: LoadBalancer
|
||||
annotations:
|
||||
service.beta.kubernetes.io/ovh-loadbalancer-proxy-protocol: v2
|
||||
spec:
|
||||
loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP}"
|
||||
externalTrafficPolicy: Local
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: auth
|
||||
namespace: common-services
|
||||
spec:
|
||||
basicAuth:
|
||||
secret: traefik-auth-ldc-oe
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect www URLs to their no-www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-www-to-no-www
|
||||
namespace: common-services
|
||||
spec:
|
||||
# Redirect a request from an url to another with regex matching and replacement
|
||||
redirectRegex:
|
||||
# Apply a permanent redirection (HTTP 301)
|
||||
permanent: true
|
||||
# The regular expression to match and capture elements from the request URL
|
||||
regex: "^https?://www\\.(.+)"
|
||||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://${1}"
|
||||
- apiVersion: traefik.io/v1alpha1 # Redirect no-www URLs to their www equivalent
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-no-www-to-www
|
||||
namespace: common-services
|
||||
spec:
|
||||
# Redirect a request from an url to another with regex matching and replacement
|
||||
redirectRegex:
|
||||
# Apply a permanent redirection (HTTP 301)
|
||||
permanent: true
|
||||
# The regular expression to match and capture elements from the request URL
|
||||
regex: "^https?://(?:www\\.)?(.+)"
|
||||
# How to modify the URL to have the new target URL
|
||||
replacement: "https://www.${1}"
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: MiddlewareTCP
|
||||
metadata:
|
||||
name: ipwhitelist-acces-mariadb
|
||||
namespace: common-services
|
||||
spec:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
- 46.18.126.208/28 # LDC
|
||||
- 62.193.56.48/32 # OPENevents - Bureau Neuville
|
||||
- 80.15.14.76/32 # LDC web - Box externe
|
||||
- 86.65.205.240/28 # LDC
|
||||
- 135.125.42.176/28 # LDC
|
||||
- 149.202.23.64/26 # LDC
|
||||
- 151.80.95.176/28 # LDC
|
||||
- 217.15.92.64/28 # LDC
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: admin-ldc-whitelist
|
||||
namespace: common-services
|
||||
spec:
|
||||
ipWhiteList:
|
||||
sourceRange:
|
||||
- 46.18.126.208/28 # LDC
|
||||
- 62.193.56.48/32 # OPENevents - Bureau Neuville
|
||||
- 80.15.14.76/32 # LDC web - Box externe
|
||||
- 86.65.205.240/28 # LDC
|
||||
- 135.125.42.176/28 # LDC
|
||||
- 149.202.23.64/26 # LDC
|
||||
- 151.80.95.176/28 # LDC
|
||||
- 217.15.92.64/28 # LDC
|
||||
- apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRouteTCP
|
||||
metadata:
|
||||
name: mariadb-ingressroutetcp
|
||||
namespace: common-services
|
||||
spec:
|
||||
entryPoints:
|
||||
- mariadb
|
||||
routes:
|
||||
- match: HostSNI(`*`) # Hostname to match
|
||||
middlewares:
|
||||
- name: ipwhitelist-acces-mariadb
|
||||
namespace: common-services
|
||||
services:
|
||||
- name: mariadb
|
||||
port: 3306
|
||||
8
infrastructure/traefik/helm-repository.yaml
Normal file
8
infrastructure/traefik/helm-repository.yaml
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: traefik
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://traefik.github.io/charts
|
||||
5
infrastructure/traefik/kustomization.yaml
Normal file
5
infrastructure/traefik/kustomization.yaml
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- helm-repository.yaml
|
||||
- helm-release.yaml
|
||||
0
infrastructure/velero/helm-repository.yaml
Normal file
0
infrastructure/velero/helm-repository.yaml
Normal file
0
infrastructure/velero/kustomization.yaml
Normal file
0
infrastructure/velero/kustomization.yaml
Normal file
|
|
@ -1,26 +1,14 @@
|
|||
---
|
||||
apiVersion: snapshot.storage.k8s.io/v1
|
||||
deletionPolicy: Delete
|
||||
driver: cinder.csi.openstack.org
|
||||
kind: VolumeSnapshotClass
|
||||
metadata:
|
||||
name: csi-cinder-snapclass-in-use-v1-velero
|
||||
labels:
|
||||
velero.io/csi-volumesnapshot-class: "true"
|
||||
parameters:
|
||||
force-create: "true"
|
||||
|
||||
---
|
||||
apiVersion: velero.io/v1
|
||||
kind: Schedule
|
||||
metadata:
|
||||
name: backup-cluster-ldc-web-test
|
||||
namespace: velero
|
||||
spec:
|
||||
schedule: '30 00 * * *'
|
||||
template:
|
||||
defaultVolumesToRestic: false
|
||||
includedNamespaces:
|
||||
- production
|
||||
ttl: 168h0m0s # Keep the backup 7 days
|
||||
---
|
||||
apiVersion: velero.io/v1
|
||||
kind: Schedule
|
||||
metadata:
|
||||
name: backup-cluster-ldc-web-test
|
||||
namespace: velero
|
||||
spec:
|
||||
schedule: '30 00 * * *'
|
||||
template:
|
||||
defaultVolumesToRestic: false
|
||||
includedNamespaces:
|
||||
- production
|
||||
ttl: 168h0m0s # Keep the backup 7 days
|
||||
storageLocation: default
|
||||
11
infrastructure/velero/resources/volume-snapshot-class.yaml
Normal file
11
infrastructure/velero/resources/volume-snapshot-class.yaml
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
---
|
||||
apiVersion: snapshot.storage.k8s.io/v1
|
||||
deletionPolicy: Delete
|
||||
driver: cinder.csi.openstack.org
|
||||
kind: VolumeSnapshotClass
|
||||
metadata:
|
||||
name: csi-cinder-snapclass-in-use-v1-velero
|
||||
labels:
|
||||
velero.io/csi-volumesnapshot-class: "true"
|
||||
parameters:
|
||||
force-create: "true"
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: common-services
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: production
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: review
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: staging
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: velero
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: wildcard-${DOMAIN_NAME}
|
||||
namespace: common-services
|
||||
spec:
|
||||
dnsNames:
|
||||
- '*.${DOMAIN_NAME}'
|
||||
- '*.k8s.${DOMAIN_NAME}'
|
||||
secretName: wildcard-${DOMAIN_NAME}
|
||||
issuerRef:
|
||||
name: letsencrypt-production-dns01
|
||||
kind: ClusterIssuer
|
||||
|
|
@ -1,20 +0,0 @@
|
|||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: grafana
|
||||
namespace: common-services
|
||||
spec:
|
||||
entryPoints: # We listen to requests coming from ports 80 and 443
|
||||
- web
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`grafana.k8s.${DOMAIN_NAME}`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: prometheus-stack-grafana
|
||||
port: 80
|
||||
middlewares:
|
||||
- name: admin-ldc-whitelist
|
||||
tls:
|
||||
secretName: wildcard-${DOMAIN_NAME}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRouteTCP
|
||||
metadata:
|
||||
name: mariadb-ingressroutetcp
|
||||
namespace: common-services
|
||||
spec:
|
||||
entryPoints:
|
||||
- mariadb
|
||||
routes:
|
||||
- match: HostSNI(`*`) # Hostname to match
|
||||
middlewares:
|
||||
- name: ipwhitelist-acces-mariadb
|
||||
namespace: common-services
|
||||
services:
|
||||
- name: mariadb
|
||||
port: 3306
|
||||
|
|
@ -1,87 +0,0 @@
|
|||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: wenndannmitrespekt.de
|
||||
namespace: common-services
|
||||
spec:
|
||||
dnsNames:
|
||||
- wenndannmitrespekt.de
|
||||
secretName: wenndannmitrespekt.de
|
||||
issuerRef:
|
||||
name: letsencrypt-production-http01
|
||||
kind: ClusterIssuer
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: www.jeu.tregalette.bzh
|
||||
namespace: common-services
|
||||
spec:
|
||||
dnsNames:
|
||||
- www.jeu.tregalette.bzh
|
||||
secretName: www.jeu.tregalette.bzh
|
||||
issuerRef:
|
||||
name: letsencrypt-production-http01
|
||||
kind: ClusterIssuer
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: redirect-wenndannmitrespekt-to-nature-and-respect
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`wenndannmitrespekt.de`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: api@internal
|
||||
kind: TraefikService
|
||||
middlewares:
|
||||
- name: redirect-wenndannmitrespekt-to-nature-and-respect
|
||||
tls:
|
||||
secretName: wenndannmitrespekt.de
|
||||
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: redirect-wwwjeutregalette-to-jeutregalette
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`www.jeu.tregalette.bzh`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: api@internal
|
||||
kind: TraefikService
|
||||
middlewares:
|
||||
- name: redirect-wwwjeutregalette-to-jeutregalette
|
||||
tls:
|
||||
secretName: www.jeu.tregalette.bzh
|
||||
---
|
||||
# Redirect with domain replacement
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-wenndannmitrespekt-to-nature-and-respect
|
||||
spec:
|
||||
redirectRegex:
|
||||
regex: ^https://wenndannmitrespekt.de/
|
||||
replacement: https://www.nature-and-respect.com/de
|
||||
permanent: true
|
||||
|
||||
---
|
||||
# Redirect with domain replacement
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: redirect-wwwjeutregalette-to-jeutregalette
|
||||
spec:
|
||||
redirectRegex:
|
||||
regex: ^https://www.jeu.tregalette.bzh/
|
||||
replacement: https://jeu.tregalette.bzh/
|
||||
permanent: true
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: datadir-mariadb-sts-0
|
||||
namespace: common-services
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
volumeMode: Filesystem
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
storageClassName: csi-cinder-high-speed
|
||||
|
|
@ -1,29 +0,0 @@
|
|||
---
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: jetstack
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: https://charts.jetstack.io
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cert-manager
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: cert-manager
|
||||
version: ${CERT_MANAGER_CHART_VERSION}
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: jetstack
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
image:
|
||||
tag: ${CERT_MANAGER_APP_VERSION}
|
||||
|
|
@ -1,38 +0,0 @@
|
|||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1h0m0s
|
||||
url: oci://registry-1.docker.io/bitnamicharts
|
||||
type: "oci"
|
||||
---
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: mariadb
|
||||
namespace: common-services
|
||||
spec:
|
||||
interval: 1m0s
|
||||
chart:
|
||||
spec:
|
||||
chart: mariadb
|
||||
version: ${MARIADB_CHART_VERSION}
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: bitnami
|
||||
namespace: common-services
|
||||
values:
|
||||
|
||||
fullnameOverride: "mariadb-service" # Only way to update the service name
|
||||
|
||||
image:
|
||||
tag: ${MARIADB_APP_VERSION}
|
||||
|
||||
auth:
|
||||
existingSecret: mariadb-credentials
|
||||
|
||||
primary:
|
||||
persistence:
|
||||
existingClaim: "datadir-mariadb-sts-0"
|
||||
|
|
@ -1,104 +0,0 @@
|
|||
---
|
||||
|
||||
### common-services ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: docker-registry-credentials
|
||||
namespace: common-services
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
# Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
|
||||
.dockerconfigjson: >-
|
||||
${DOCKER_AUTH_CONFIG}
|
||||
|
||||
---
|
||||
|
||||
### cert-manager ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cloudflare-api-token-secret
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
stringData:
|
||||
api-token: "${CERT_MANAGER_CLOUDFLARE_API_TOKEN}"
|
||||
|
||||
---
|
||||
|
||||
### gitlab-agent ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitlab-agent-token
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
stringData:
|
||||
token: "${GITLAB_AGENT_TOKEN}"
|
||||
|
||||
---
|
||||
|
||||
### gitlab-runner ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitlab-runner-token
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
stringData:
|
||||
runner-registration-token: "" # need to leave as an empty string for compatibility reasons
|
||||
runner-token: "${GITLAB_RUNNER_TOKEN}"
|
||||
|
||||
---
|
||||
|
||||
### grafana ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: grafana-admin
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
stringData:
|
||||
user: admin
|
||||
password: "${GRAFANA_ADMIN_PASSWORD}"
|
||||
|
||||
---
|
||||
|
||||
### mariadb ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mariadb-credentials
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
stringData:
|
||||
mariadb-root-password: "${MARIADB_ROOT_PASSWORD}"
|
||||
mariadb-replication-password: "${MARIADB_ROOT_PASSWORD}"
|
||||
mariadb-password: "${MARIADB_PASSWORD}"
|
||||
|
||||
### traefik ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: traefik-auth-ldc-oe
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
data:
|
||||
users: |1
|
||||
${TRAEFIK_AUTH_LDC_OE}
|
||||
|
||||
---
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: msteams-url
|
||||
namespace: flux-system
|
||||
stringData:
|
||||
address: "${FLUX_TEAMS_URL}"
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
---
|
||||
|
||||
### production ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: docker-registry-credentials
|
||||
namespace: production
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
# Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
|
||||
.dockerconfigjson: >-
|
||||
${DOCKER_AUTH_CONFIG}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
---
|
||||
|
||||
### review ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: docker-registry-credentials
|
||||
namespace: review
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
# Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
|
||||
.dockerconfigjson: >-
|
||||
${DOCKER_AUTH_CONFIG}
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
---
|
||||
|
||||
### staging ###
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: docker-registry-credentials
|
||||
namespace: staging
|
||||
type: kubernetes.io/dockerconfigjson
|
||||
data:
|
||||
# Uses a deployment token defined on the "LDC Web" group (docker-registry-credentials)
|
||||
.dockerconfigjson: >-
|
||||
${DOCKER_AUTH_CONFIG}
|
||||
File diff suppressed because it is too large
Load diff
|
|
@ -1,297 +0,0 @@
|
|||
---
|
||||
# Source: gitlab-runner/templates/service-account.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
annotations:
|
||||
name: gitlab-runner
|
||||
namespace: common-services
|
||||
labels:
|
||||
app: gitlab-runner
|
||||
chart: gitlab-runner-0.48.0
|
||||
release: "gitlab-runner"
|
||||
heritage: "Helm"
|
||||
---
|
||||
# Source: gitlab-runner/templates/secrets.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "gitlab-runner"
|
||||
namespace: "common-services"
|
||||
labels:
|
||||
app: gitlab-runner
|
||||
chart: gitlab-runner-0.48.0
|
||||
release: "gitlab-runner"
|
||||
heritage: "Helm"
|
||||
type: Opaque
|
||||
data:
|
||||
runner-registration-token: "NXNURG54MUFaREUtaG9qbXVwcXY="
|
||||
runner-token: ""
|
||||
---
|
||||
# Source: gitlab-runner/templates/configmap.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: "common-services"
|
||||
labels:
|
||||
app: gitlab-runner
|
||||
chart: gitlab-runner-0.48.0
|
||||
release: "gitlab-runner"
|
||||
heritage: "Helm"
|
||||
data:
|
||||
entrypoint: |
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
mkdir -p /home/gitlab-runner/.gitlab-runner/
|
||||
|
||||
cp /configmaps/config.toml /home/gitlab-runner/.gitlab-runner/
|
||||
|
||||
# Set up environment variables for cache
|
||||
if [[ -f /secrets/accesskey && -f /secrets/secretkey ]]; then
|
||||
export CACHE_S3_ACCESS_KEY=$(cat /secrets/accesskey)
|
||||
export CACHE_S3_SECRET_KEY=$(cat /secrets/secretkey)
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/gcs-applicaton-credentials-file ]]; then
|
||||
export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-applicaton-credentials-file"
|
||||
elif [[ -f /secrets/gcs-application-credentials-file ]]; then
|
||||
export GOOGLE_APPLICATION_CREDENTIALS="/secrets/gcs-application-credentials-file"
|
||||
else
|
||||
if [[ -f /secrets/gcs-access-id && -f /secrets/gcs-private-key ]]; then
|
||||
export CACHE_GCS_ACCESS_ID=$(cat /secrets/gcs-access-id)
|
||||
# echo -e used to make private key multiline (in google json auth key private key is oneline with \n)
|
||||
export CACHE_GCS_PRIVATE_KEY=$(echo -e $(cat /secrets/gcs-private-key))
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/azure-account-name && -f /secrets/azure-account-key ]]; then
|
||||
export CACHE_AZURE_ACCOUNT_NAME=$(cat /secrets/azure-account-name)
|
||||
export CACHE_AZURE_ACCOUNT_KEY=$(cat /secrets/azure-account-key)
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/runner-registration-token ]]; then
|
||||
export REGISTRATION_TOKEN=$(cat /secrets/runner-registration-token)
|
||||
fi
|
||||
|
||||
if [[ -f /secrets/runner-token ]]; then
|
||||
export CI_SERVER_TOKEN=$(cat /secrets/runner-token)
|
||||
fi
|
||||
|
||||
# Validate this also at runtime in case the user has set a custom secret
|
||||
if [[ ! -z "$CI_SERVER_TOKEN" && "1" -ne "1" ]]; then
|
||||
echo "Using a runner token with more than 1 replica is not supported."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Register the runner
|
||||
if ! sh /configmaps/register-the-runner; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Run pre-entrypoint-script
|
||||
if ! bash /configmaps/pre-entrypoint-script; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Start the runner
|
||||
exec /entrypoint run --user=gitlab-runner \
|
||||
--working-directory=/home/gitlab-runner
|
||||
|
||||
config.toml: |
|
||||
concurrent = 10
|
||||
check_interval = 30
|
||||
log_level = "info"
|
||||
|
||||
|
||||
config.template.toml: |
|
||||
[[runners]]
|
||||
[runners.kubernetes]
|
||||
namespace = "common-services"
|
||||
image = "ubuntu:16.04"
|
||||
|
||||
|
||||
register-the-runner: |
|
||||
#!/bin/bash
|
||||
MAX_REGISTER_ATTEMPTS=30
|
||||
|
||||
for i in $(seq 1 "${MAX_REGISTER_ATTEMPTS}"); do
|
||||
echo "Registration attempt ${i} of ${MAX_REGISTER_ATTEMPTS}"
|
||||
/entrypoint register \
|
||||
--template-config /configmaps/config.template.toml \
|
||||
--non-interactive
|
||||
|
||||
retval=$?
|
||||
|
||||
if [ ${retval} = 0 ]; then
|
||||
break
|
||||
elif [ ${i} = ${MAX_REGISTER_ATTEMPTS} ]; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
sleep 5
|
||||
done
|
||||
|
||||
exit 0
|
||||
|
||||
check-live: |
|
||||
#!/bin/bash
|
||||
if /usr/bin/pgrep -f .*register-the-runner; then
|
||||
exit 0
|
||||
elif /usr/bin/pgrep gitlab.*runner; then
|
||||
exit 0
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
pre-entrypoint-script: |
|
||||
---
|
||||
# Source: gitlab-runner/templates/role.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: "Role"
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
labels:
|
||||
app: gitlab-runner
|
||||
chart: gitlab-runner-0.48.0
|
||||
release: "gitlab-runner"
|
||||
heritage: "Helm"
|
||||
namespace: "common-services"
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["*"]
|
||||
verbs: ["*"]
|
||||
---
|
||||
# Source: gitlab-runner/templates/role-binding.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: "RoleBinding"
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
labels:
|
||||
app: gitlab-runner
|
||||
chart: gitlab-runner-0.48.0
|
||||
release: "gitlab-runner"
|
||||
heritage: "Helm"
|
||||
namespace: "common-services"
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: "Role"
|
||||
name: gitlab-runner
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gitlab-runner
|
||||
namespace: "common-services"
|
||||
---
|
||||
# Source: gitlab-runner/templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitlab-runner
|
||||
namespace: "common-services"
|
||||
labels:
|
||||
app: gitlab-runner
|
||||
chart: gitlab-runner-0.48.0
|
||||
release: "gitlab-runner"
|
||||
heritage: "Helm"
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitlab-runner
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: gitlab-runner
|
||||
chart: gitlab-runner-0.48.0
|
||||
release: "gitlab-runner"
|
||||
heritage: "Helm"
|
||||
annotations:
|
||||
checksum/configmap: d384622e4f5da536deb34e7ad12641d175943ccf1509e501650b4b81968a8722
|
||||
checksum/secrets: 160e94f48b9ea82025fca86ff7ac083c1947ca5b81cc074a93ae9c454d5f6c77
|
||||
spec:
|
||||
securityContext:
|
||||
fsGroup: 65533
|
||||
runAsUser: 100
|
||||
terminationGracePeriodSeconds: 3600
|
||||
serviceAccountName: gitlab-runner
|
||||
containers:
|
||||
- name: gitlab-runner
|
||||
image: registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v15.7.0
|
||||
imagePullPolicy: "IfNotPresent"
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
privileged: false
|
||||
readOnlyRootFilesystem: false
|
||||
runAsNonRoot: true
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command: ["/entrypoint", "unregister", "--all-runners"]
|
||||
command: ["/usr/bin/dumb-init", "--", "/bin/bash", "/configmaps/entrypoint"]
|
||||
env:
|
||||
|
||||
- name: CI_SERVER_URL
|
||||
value: "https://lab.s-web.fr/"
|
||||
- name: CLONE_URL
|
||||
value: ""
|
||||
- name: RUNNER_EXECUTOR
|
||||
value: "kubernetes"
|
||||
- name: REGISTER_LOCKED
|
||||
value: "true"
|
||||
- name: RUNNER_TAG_LIST
|
||||
value: ""
|
||||
- name: KUBERNETES_PRIVILEGED
|
||||
value: "true"
|
||||
livenessProbe:
|
||||
exec:
|
||||
command: ["/bin/bash", "/configmaps/check-live"]
|
||||
initialDelaySeconds: 60
|
||||
timeoutSeconds: 1
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
exec:
|
||||
command: ["/usr/bin/pgrep","gitlab.*runner"]
|
||||
initialDelaySeconds: 10
|
||||
timeoutSeconds: 1
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
ports:
|
||||
- name: "metrics"
|
||||
containerPort: 9252
|
||||
volumeMounts:
|
||||
- name: projected-secrets
|
||||
mountPath: /secrets
|
||||
- name: etc-gitlab-runner
|
||||
mountPath: /home/gitlab-runner/.gitlab-runner
|
||||
- name: configmaps
|
||||
mountPath: /configmaps
|
||||
resources:
|
||||
{}
|
||||
volumes:
|
||||
- name: runner-secrets
|
||||
emptyDir:
|
||||
medium: "Memory"
|
||||
- name: etc-gitlab-runner
|
||||
emptyDir:
|
||||
medium: "Memory"
|
||||
- name: projected-secrets
|
||||
projected:
|
||||
sources:
|
||||
- secret:
|
||||
name: "gitlab-runner"
|
||||
items:
|
||||
- key: runner-registration-token
|
||||
path: runner-registration-token
|
||||
- key: runner-token
|
||||
path: runner-token
|
||||
- name: configmaps
|
||||
configMap:
|
||||
name: gitlab-runner
|
||||
|
|
@ -1,327 +0,0 @@
|
|||
# Copyright 2017 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: common-services
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: common-services
|
||||
spec:
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: 8443
|
||||
selector:
|
||||
k8s-app: kubernetes-dashboard
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-certs
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-csrf
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
data:
|
||||
csrf: ""
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-key-holder
|
||||
namespace: common-services
|
||||
type: Opaque
|
||||
|
||||
---
|
||||
|
||||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard-settings
|
||||
namespace: common-services
|
||||
|
||||
---
|
||||
|
||||
kind: Role
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: common-services
|
||||
rules:
|
||||
# Allow Dashboard to get, update and delete Dashboard exclusive secrets.
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets"]
|
||||
resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
|
||||
verbs: ["get", "update", "delete"]
|
||||
# Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["kubernetes-dashboard-settings"]
|
||||
verbs: ["get", "update"]
|
||||
# Allow Dashboard to get metrics.
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
resourceNames: ["heapster", "dashboard-metrics-scraper"]
|
||||
verbs: ["proxy"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services/proxy"]
|
||||
resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
|
||||
verbs: ["get"]
|
||||
|
||||
---
|
||||
|
||||
kind: ClusterRole
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
rules:
|
||||
# Allow Metrics Scraper to get metrics from the Metrics server
|
||||
- apiGroups: ["metrics.k8s.io"]
|
||||
resources: ["pods", "nodes"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: common-services
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: kubernetes-dashboard
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-dashboard
|
||||
namespace: common-services
|
||||
|
||||
---
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: kubernetes-dashboard
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: kubernetes-dashboard
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: kubernetes-dashboard
|
||||
namespace: common-services
|
||||
|
||||
---
|
||||
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
name: kubernetes-dashboard
|
||||
namespace: common-services
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kubernetes-dashboard
|
||||
spec:
|
||||
containers:
|
||||
- name: kubernetes-dashboard
|
||||
image: kubernetesui/dashboard:v2.3.1
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 8443
|
||||
protocol: TCP
|
||||
args:
|
||||
- --auto-generate-certificates
|
||||
- --namespace=common-services
|
||||
# Uncomment the following line to manually specify Kubernetes API server Host
|
||||
# If not specified, Dashboard will attempt to auto discover the API server and connect
|
||||
# to it. Uncomment only if the default does not work.
|
||||
# - --apiserver-host=http://my-address:port
|
||||
volumeMounts:
|
||||
- name: kubernetes-dashboard-certs
|
||||
mountPath: /certs
|
||||
# Create on-disk volume to store exec logs
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
scheme: HTTPS
|
||||
path: /
|
||||
port: 8443
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 30
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1001
|
||||
runAsGroup: 2001
|
||||
volumes:
|
||||
- name: kubernetes-dashboard-certs
|
||||
secret:
|
||||
secretName: kubernetes-dashboard-certs
|
||||
- name: tmp-volume
|
||||
emptyDir: {}
|
||||
serviceAccountName: kubernetes-dashboard
|
||||
nodeSelector:
|
||||
"kubernetes.io/os": linux
|
||||
# Comment the following tolerations if Dashboard must not be deployed on master
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
|
||||
---
|
||||
|
||||
kind: Service
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
name: dashboard-metrics-scraper
|
||||
namespace: common-services
|
||||
spec:
|
||||
ports:
|
||||
- port: 8000
|
||||
targetPort: 8000
|
||||
selector:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
|
||||
---
|
||||
|
||||
kind: Deployment
|
||||
apiVersion: apps/v1
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
name: dashboard-metrics-scraper
|
||||
namespace: common-services
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: dashboard-metrics-scraper
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: 'runtime/default'
|
||||
spec:
|
||||
containers:
|
||||
- name: dashboard-metrics-scraper
|
||||
image: kubernetesui/metrics-scraper:v1.0.6
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
scheme: HTTP
|
||||
path: /
|
||||
port: 8000
|
||||
initialDelaySeconds: 30
|
||||
timeoutSeconds: 30
|
||||
volumeMounts:
|
||||
- mountPath: /tmp
|
||||
name: tmp-volume
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 1001
|
||||
runAsGroup: 2001
|
||||
serviceAccountName: kubernetes-dashboard
|
||||
nodeSelector:
|
||||
"kubernetes.io/os": linux
|
||||
# Comment the following tolerations if Dashboard must not be deployed on master
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
volumes:
|
||||
- name: tmp-volume
|
||||
emptyDir: {}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: admin-user
|
||||
namespace: common-services
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: admin-user
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: admin-user
|
||||
namespace: common-services
|
||||
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
type: kubernetes.io/service-account-token
|
||||
metadata:
|
||||
name: admin-user-token
|
||||
namespace: common-services
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: admin-user
|
||||
|
|
@ -1,65 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mariadb-secret
|
||||
type: Opaque
|
||||
data:
|
||||
# Encoded value: echo -n 'secret'|base64
|
||||
mariadb-root-password: MnI3XixYbEVkLDVSIzh4ZjZAOXdacSlsU28ldVBZYyk=
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mariadb-service
|
||||
labels:
|
||||
app: mariadb
|
||||
spec:
|
||||
ports:
|
||||
- port: 3306
|
||||
name: mariadb-port
|
||||
clusterIP: None
|
||||
selector:
|
||||
app: mariadb
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: mariadb-sts
|
||||
spec:
|
||||
serviceName: "mariadb-service"
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mariadb
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mariadb
|
||||
spec:
|
||||
containers:
|
||||
- name: mariadb
|
||||
image: mariadb:10.10
|
||||
ports:
|
||||
- containerPort: 3306
|
||||
name: mariadb-port
|
||||
env:
|
||||
# Using Secrets
|
||||
- name: MARIADB_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mariadb-secret
|
||||
key: mariadb-root-password
|
||||
volumeMounts:
|
||||
- name: datadir
|
||||
mountPath: /var/lib/mysql/
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: datadir
|
||||
spec:
|
||||
accessModes: [ "ReadWriteOnce" ]
|
||||
storageClassName: "csi-cinder-high-speed"
|
||||
resources:
|
||||
requests:
|
||||
storage: 60Gi
|
||||
|
|
@ -1,78 +0,0 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mariadb-configmap
|
||||
data:
|
||||
database_url: mariadb-service
|
||||
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: phpmyadmin-deployment
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: pma
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pma
|
||||
spec:
|
||||
containers:
|
||||
- name: phpmyadmin
|
||||
image: bitnami/phpmyadmin:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
- name: DATABASE_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: mariadb-configmap
|
||||
key: database_url
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: pma
|
||||
spec:
|
||||
selector:
|
||||
app: pma
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: pma
|
||||
spec:
|
||||
entryPoints: # We listen to requests coming from ports 80 and 443
|
||||
- web
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`pma.k8s.s-web.fr`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: pma # Requests will be forwarded to this service
|
||||
port: 8080
|
||||
middlewares:
|
||||
- name: admin-ldc-whitelist
|
||||
tls:
|
||||
secretName: pma.k8s.s-web.fr
|
||||
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: pma.k8s.s-web.fr
|
||||
spec:
|
||||
dnsNames:
|
||||
- pma.k8s.s-web.fr
|
||||
secretName: pma.k8s.s-web.fr
|
||||
issuerRef:
|
||||
name: letsencrypt-production-dns01
|
||||
kind: ClusterIssuer
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Add table
Reference in a new issue