diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 8df17e5..508b4c2 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -28,7 +28,7 @@ variables: git config user.email "autodeploy@mediactivegroup.com" git add --all git commit -m "Bot Auto Commit" - git push --force https://flux-token-api:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH} + git push --force https://project_access_token:${GITLAB_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git HEAD:${DEPLOY_BRANCH} tags: - flux - k8s diff --git a/flux/kustomizations/kustomization.yaml b/flux/kustomizations/kustomization.yaml index 12af385..07d7263 100644 --- a/flux/kustomizations/kustomization.yaml +++ b/flux/kustomizations/kustomization.yaml @@ -1,16 +1,17 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- cert-manager.yaml -- flux-resources.yaml -- gitlab-agent.yaml -- gitlab-runner.yaml -- hashicorp-vault.yaml -- ldc-custom.yaml -- mariadb.yaml -- meilisearch.yaml -- namespaces.yaml -- prometheus-stack.yaml -- rabbitmq.yaml -- traefik.yaml -- quickchart.yaml + - cert-manager.yaml + - flux-resources.yaml + - gitlab-agent.yaml + - gitlab-runner.yaml + - hashicorp-vault.yaml + - ldc-custom.yaml + - mariadb.yaml + - meilisearch.yaml + - namespaces.yaml + - prometheus-stack.yaml + - rabbitmq.yaml + - traefik.yaml + - quickchart.yaml + - netdata.yaml diff --git a/flux/kustomizations/netdata.yaml b/flux/kustomizations/netdata.yaml new file mode 100644 index 0000000..3dd437d --- /dev/null +++ b/flux/kustomizations/netdata.yaml @@ -0,0 +1,32 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: netdata + namespace: flux-system +spec: + interval: 1m0s + path: ./infrastructure/netdata + prune: false + healthChecks: + - apiVersion: source.toolkit.fluxcd.io/v1 + kind: HelmRepository + name: netdata + namespace: common-services + - apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + name: netdata + namespace: common-services + - apiVersion: v1 + kind: Pod + name: vault-0 + namespace: common-services + dependsOn: + - name: namespaces + namespace: flux-system + - name: external-secrets-resources + namespace: flux-system + sourceRef: + kind: GitRepository + name: flux-system + timeout: 5m diff --git a/infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml b/infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml index ab9de60..2c44d82 100644 --- a/infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml +++ b/infrastructure/hashicorp-vault/external-secrets/resources/kustomization.yaml @@ -13,3 +13,4 @@ resources: - staging.yaml - production.yaml - rabbitmq.yaml + - netdata.yaml \ No newline at end of file diff --git a/infrastructure/hashicorp-vault/external-secrets/resources/netdata.yaml b/infrastructure/hashicorp-vault/external-secrets/resources/netdata.yaml new file mode 100644 index 0000000..c5e2aea --- /dev/null +++ b/infrastructure/hashicorp-vault/external-secrets/resources/netdata.yaml @@ -0,0 +1,41 @@ +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: netdata-claim + namespace: common-services +spec: + refreshInterval: "15s" + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: netdata-claim + data: + - secretKey: NETDATA_CLAIM_TOKEN + remoteRef: + key: secret/netdata/claim + property: NETDATA_CLAIM_TOKEN + - secretKey: NETDATA_CLAIM_ROOMS + remoteRef: + key: secret/netdata/claim + property: NETDATA_CLAIM_ROOMS + +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: netdata-stream + namespace: common-services +spec: + refreshInterval: "15s" + secretStoreRef: + name: vault-secret-store + kind: ClusterSecretStore + target: + name: netdata-stream + data: + - secretKey: APIKEY + remoteRef: + key: secret/netdata/stream + property: APIKEY diff --git a/infrastructure/netdata/helm-release.yaml b/infrastructure/netdata/helm-release.yaml new file mode 100644 index 0000000..e22ef9d --- /dev/null +++ b/infrastructure/netdata/helm-release.yaml @@ -0,0 +1,117 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: netdata + namespace: common-services +spec: + interval: 1m0s + + chart: + spec: + chart: netdata + version: 3.7.158 + sourceRef: + kind: HelmRepository + name: netdata + namespace: common-services + + # Injecte APIKEY depuis un Secret (pas en clair dans Git) + valuesFrom: + - kind: Secret + name: netdata-stream + valuesKey: APIKEY + targetPath: APIKEY + + values: + image: + tag: v2.8.5 + + # Service interne uniquement + service: + type: ClusterIP + port: 19999 + + # Pas d'exposition + ingress: + enabled: false + + # Pas d'auto-update des pods en prod critique + restarter: + enabled: false + + # Parent = point de centralisation + health/alerting (par défaut chart) + parent: + enabled: true + port: 19999 + + resources: + requests: + cpu: "${NETDATA_PARENT_REQUESTS_CPU}" + memory: "${NETDATA_PARENT_REQUESTS_RAM}" + limits: + cpu: "${NETDATA_PARENT_LIMITS_CPU}" + memory: "${NETDATA_PARENT_LIMITS_RAM}" + + # PV parent recommandés (db + alarms) + database: + persistence: true + volumesize: 40Gi # /var/cache/netdata + alarms: + persistence: true + volumesize: 4Gi # /var/lib/netdata + + # Claiming via Secret envFrom + claiming: + enabled: true + token: "" + rooms: "" + url: "https://api.netdata.cloud" + envFrom: + - secretRef: + name: netdata-claim + + # Child DaemonSet + child: + enabled: true + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + + resources: + requests: + cpu: "${NETDATA_CHILD_REQUESTS_CPU}" + memory: "${NETDATA_CHILD_REQUESTS_RAM}" + limits: + cpu: "${NETDATA_CHILD_LIMITS_CPU}" + memory: "${NETDATA_CHILD_LIMITS_RAM}" + + persistence: + enabled: true + hostPath: /var/lib/netdata-k8s-child + + # Hardening UI sur les nodes: bind localhost uniquement + configs: + netdata: + enabled: true + path: /etc/netdata/netdata.conf + data: | + [db] + mode = ram + retention = "${NETDATA_CHILD_RETENTION}" + update every = "${NETDATA_CHILD_COLLECT_INTERVAL}" + [web] + bind to = localhost:19999 + [health] + enabled = no + [ml] + enabled = no + + # Claiming via Secret envFrom (token PAS en clair ici) + claiming: + enabled: true + token: "" + rooms: "" + url: "https://api.netdata.cloud" + envFrom: + - secretRef: + name: netdata-claim diff --git a/infrastructure/netdata/helm-repository.yaml b/infrastructure/netdata/helm-repository.yaml new file mode 100644 index 0000000..f218ef8 --- /dev/null +++ b/infrastructure/netdata/helm-repository.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: netdata + namespace: common-services +spec: + interval: 1h0m0s + url: https://netdata.github.io/helmchart/ diff --git a/infrastructure/netdata/kustomization.yaml b/infrastructure/netdata/kustomization.yaml new file mode 100644 index 0000000..10d11a8 --- /dev/null +++ b/infrastructure/netdata/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helm-repository.yaml + - helm-release.yaml diff --git a/infrastructure/traefik/helm-release.yaml b/infrastructure/traefik/helm-release.yaml index 4771acf..9adf3ce 100644 --- a/infrastructure/traefik/helm-release.yaml +++ b/infrastructure/traefik/helm-release.yaml @@ -281,6 +281,50 @@ spec: - 149.202.23.64/26 # LDC - 151.80.95.176/28 # LDC - 217.15.92.64/28 # LDC + - 3.77.67.4 # UptimeRobot + - 3.79.134.69 # UptimeRobot + - 18.192.166.72 # UptimeRobot + - 18.193.252.127 # UptimeRobot + - 52.28.162.93 # UptimeRobot + - 52.59.43.236 # UptimeRobot + - 63.178.84.147 # UptimeRobot + - 24.144.78.39 # UptimeRobot + - 24.144.78.185 # UptimeRobot + - 64.225.81.248 # UptimeRobot + - 64.225.82.147 # UptimeRobot + - 143.198.249.237 # UptimeRobot + - 143.198.250.89 # UptimeRobot + - 143.244.196.21 # UptimeRobot + - 143.244.196.211 # UptimeRobot + - 152.42.149.135 # UptimeRobot + - 159.223.243.219 # UptimeRobot + - 161.35.247.201 # UptimeRobot + - 167.99.18.52 # UptimeRobot + - 188.166.201.79 # UptimeRobot + - 206.189.241.133 # UptimeRobot + - 209.38.53.7 # UptimeRobot + - 49.13.24.81 # UptimeRobot + - 49.13.130.29 # UptimeRobot + - 49.13.134.145 # UptimeRobot + - 78.47.98.55 # UptimeRobot + - 88.99.80.227 # UptimeRobot + - 142.132.180.39 # UptimeRobot + - 157.90.155.240 # UptimeRobot + - 157.90.156.63 # UptimeRobot + - 168.119.53.160 # UptimeRobot + - 168.119.96.239 # UptimeRobot + - 49.13.164.148 # UptimeRobot + - 49.13.167.123 # UptimeRobot + - 78.46.190.63 # UptimeRobot + - 78.47.173.76 # UptimeRobot + - 128.140.41.193 # UptimeRobot + - 128.140.106.114 # UptimeRobot + - 159.69.158.189 # UptimeRobot + - 167.235.143.113 # UptimeRobot + - 168.119.123.75 # UptimeRobot + - 78.46.215.1 # UptimeRobot + - 91.99.101.207 # UptimeRobot + - apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP metadata: