forge-joniko/ldc-cluster-k8s
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'develop' into 'master'

Browse source 
Develop

See merge request ldc-web/cluster-k8s!65
This commit is contained in:
Louis Rossignol 2026-01-27 18:05:19 +00:00
commit 68ac8ffcdc
9 changed files with 264 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.gitlab-ci.yml
View file

@ -28,7 +28,7 @@ variables:
git config user.email "autodeploy@mediactivegroup.com"
git add --all
git commit -m "Bot Auto Commit"
git push --force https://flux-token-api:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
git push --force https://project_access_token:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH}
tags:
- flux
- k8s

27
flux/kustomizations/kustomization.yaml
View file

@ -1,16 +1,17 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- cert-manager.yaml
- flux-resources.yaml
- gitlab-agent.yaml
- gitlab-runner.yaml
- hashicorp-vault.yaml
- ldc-custom.yaml
- mariadb.yaml
- meilisearch.yaml
- namespaces.yaml
- prometheus-stack.yaml
- rabbitmq.yaml
- traefik.yaml
- quickchart.yaml
- cert-manager.yaml
- flux-resources.yaml
- gitlab-agent.yaml
- gitlab-runner.yaml
- hashicorp-vault.yaml
- ldc-custom.yaml
- mariadb.yaml
- meilisearch.yaml
- namespaces.yaml
- prometheus-stack.yaml
- rabbitmq.yaml
- traefik.yaml
- quickchart.yaml
- netdata.yaml

32
flux/kustomizations/netdata.yaml Normal file
View file

@ -0,0 +1,32 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: netdata
namespace: flux-system
spec:
interval: 1m0s
path: ./infrastructure/netdata
prune: false
healthChecks:
- apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
name: netdata
namespace: common-services
- apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
name: netdata
namespace: common-services
- apiVersion: v1
kind: Pod
name: vault-0
namespace: common-services
dependsOn:
- name: namespaces
namespace: flux-system
- name: external-secrets-resources
namespace: flux-system
sourceRef:
kind: GitRepository
name: flux-system
timeout: 5m

1
infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml
View file

@ -13,3 +13,4 @@ resources:
- staging.yaml
- production.yaml
- rabbitmq.yaml
- netdata.yaml

41
infrastructure/hashicorp-vault/external-secrets/resources/netdata.yaml Normal file
View file

@ -0,0 +1,41 @@
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: netdata-claim
namespace: common-services
spec:
refreshInterval: "15s"
secretStoreRef:
name: vault-secret-store
kind: ClusterSecretStore
target:
name: netdata-claim
data:
- secretKey: NETDATA_CLAIM_TOKEN
remoteRef:
key: secret/netdata/claim
property: NETDATA_CLAIM_TOKEN
- secretKey: NETDATA_CLAIM_ROOMS
remoteRef:
key: secret/netdata/claim
property: NETDATA_CLAIM_ROOMS
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: netdata-stream
namespace: common-services
spec:
refreshInterval: "15s"
secretStoreRef:
name: vault-secret-store
kind: ClusterSecretStore
target:
name: netdata-stream
data:
- secretKey: APIKEY
remoteRef:
key: secret/netdata/stream
property: APIKEY

117
infrastructure/netdata/helm-release.yaml Normal file
View file

@ -0,0 +1,117 @@
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: netdata
namespace: common-services
spec:
interval: 1m0s
chart:
spec:
chart: netdata
version: 3.7.158
sourceRef:
kind: HelmRepository
name: netdata
namespace: common-services
# Injecte APIKEY depuis un Secret (pas en clair dans Git)
valuesFrom:
- kind: Secret
name: netdata-stream
valuesKey: APIKEY
targetPath: APIKEY
values:
image:
tag: v2.8.5
# Service interne uniquement
service:
type: ClusterIP
port: 19999
# Pas d'exposition
ingress:
enabled: false
# Pas d'auto-update des pods en prod critique
restarter:
enabled: false
# Parent = point de centralisation + health/alerting (par défaut chart)
parent:
enabled: true
port: 19999
resources:
requests:
cpu: "${NETDATA_PARENT_REQUESTS_CPU}"
memory: "${NETDATA_PARENT_REQUESTS_RAM}"
limits:
cpu: "${NETDATA_PARENT_LIMITS_CPU}"
memory: "${NETDATA_PARENT_LIMITS_RAM}"
# PV parent recommandés (db + alarms)
database:
persistence: true
volumesize: 40Gi # /var/cache/netdata
alarms:
persistence: true
volumesize: 4Gi # /var/lib/netdata
# Claiming via Secret envFrom
claiming:
enabled: true
token: ""
rooms: ""
url: "https://api.netdata.cloud"
envFrom:
- secretRef:
name: netdata-claim
# Child DaemonSet
child:
enabled: true
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet
resources:
requests:
cpu: "${NETDATA_CHILD_REQUESTS_CPU}"
memory: "${NETDATA_CHILD_REQUESTS_RAM}"
limits:
cpu: "${NETDATA_CHILD_LIMITS_CPU}"
memory: "${NETDATA_CHILD_LIMITS_RAM}"
persistence:
enabled: true
hostPath: /var/lib/netdata-k8s-child
# Hardening UI sur les nodes: bind localhost uniquement
configs:
netdata:
enabled: true
path: /etc/netdata/netdata.conf
data: |
[db]
mode = ram
retention = "${NETDATA_CHILD_RETENTION}"
update every = "${NETDATA_CHILD_COLLECT_INTERVAL}"
[web]
bind to = localhost:19999
[health]
enabled = no
[ml]
enabled = no
# Claiming via Secret envFrom (token PAS en clair ici)
claiming:
enabled: true
token: ""
rooms: ""
url: "https://api.netdata.cloud"
envFrom:
- secretRef:
name: netdata-claim

9
infrastructure/netdata/helm-repository.yaml Normal file
View file

@ -0,0 +1,9 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: netdata
namespace: common-services
spec:
interval: 1h0m0s
url: https://netdata.github.io/helmchart/

5
infrastructure/netdata/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- helm-repository.yaml
- helm-release.yaml

44
infrastructure/traefik/helm-release.yaml
View file

@ -281,6 +281,50 @@ spec:
- 149.202.23.64/26 # LDC
- 151.80.95.176/28 # LDC
- 217.15.92.64/28 # LDC
- 3.77.67.4 # UptimeRobot
- 3.79.134.69 # UptimeRobot
- 18.192.166.72 # UptimeRobot
- 18.193.252.127 # UptimeRobot
- 52.28.162.93 # UptimeRobot
- 52.59.43.236 # UptimeRobot
- 63.178.84.147 # UptimeRobot
- 24.144.78.39 # UptimeRobot
- 24.144.78.185 # UptimeRobot
- 64.225.81.248 # UptimeRobot
- 64.225.82.147 # UptimeRobot
- 143.198.249.237 # UptimeRobot
- 143.198.250.89 # UptimeRobot
- 143.244.196.21 # UptimeRobot
- 143.244.196.211 # UptimeRobot
- 152.42.149.135 # UptimeRobot
- 159.223.243.219 # UptimeRobot
- 161.35.247.201 # UptimeRobot
- 167.99.18.52 # UptimeRobot
- 188.166.201.79 # UptimeRobot
- 206.189.241.133 # UptimeRobot
- 209.38.53.7 # UptimeRobot
- 49.13.24.81 # UptimeRobot
- 49.13.130.29 # UptimeRobot
- 49.13.134.145 # UptimeRobot
- 78.47.98.55 # UptimeRobot
- 88.99.80.227 # UptimeRobot
- 142.132.180.39 # UptimeRobot
- 157.90.155.240 # UptimeRobot
- 157.90.156.63 # UptimeRobot
- 168.119.53.160 # UptimeRobot
- 168.119.96.239 # UptimeRobot
- 49.13.164.148 # UptimeRobot
- 49.13.167.123 # UptimeRobot
- 78.46.190.63 # UptimeRobot
- 78.47.173.76 # UptimeRobot
- 128.140.41.193 # UptimeRobot
- 128.140.106.114 # UptimeRobot
- 159.69.158.189 # UptimeRobot
- 167.235.143.113 # UptimeRobot
- 168.119.123.75 # UptimeRobot
- 78.46.215.1 # UptimeRobot
- 91.99.101.207 # UptimeRobot
- apiVersion: traefik.io/v1alpha1
kind: IngressRouteTCP
metadata: