Merge branch 'develop' into 'master'

Added gen-game-web-instances/auguste-lambert to gitlab agents

See merge request ldc-web/cluster-k8s!133

.gitlab/agents/prod-k8s-ldc-web/config.yaml

@@ -13,6 +13,7 @@ ci_access:
     - id: ldc-web/projets/doux
     - id: ldc-web/projets/espri-restauration
     - id: ldc-web/projets/galina
+    - id: ldc-web/projets/gen-game-web-instances/auguste-lambert
     - id: ldc-web/projets/gen-game-web-instances/janze
     - id: ldc-web/projets/gen-game-web-instances/l-orleanais-jeu
     - id: ldc-web/projets/gen-game-web-instances/le-gaulois-eveillez-vos-papilles

infrastructure/cert-manager/resources/certificates.yaml

@@ -6,7 +6,7 @@ metadata:
   namespace: review
 spec:
   dnsNames:
-    - '*.review.re7-s-web.fr'
+    - '*.${REVIEW_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
   revisionHistoryLimit: 1
   issuerRef:
@@ -21,7 +21,7 @@ metadata:
   namespace: staging
 spec:
   dnsNames:
-    - '*.re7-s-web.fr'
+    - '*.${STAGING_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
   revisionHistoryLimit: 1
   issuerRef:
@@ -36,7 +36,7 @@ metadata:
   namespace: production
 spec:
   dnsNames:
-    - '*.k8s.s-web.fr'
+    - '*.${PRODUCTION_DOMAIN_NAME}'
   secretName: wildcard-k8s-ldc
   revisionHistoryLimit: 1
   issuerRef:

infrastructure/crowdsec/helm-release.yaml

@@ -56,7 +56,7 @@ spec:
           server:
             auto_registration: # Activate if not using TLS for authentication
               enabled: true
-              token: "4inqydLBZ6ErkkVWLCcoVgfXRWj9FAsowvfDoP4mLDrqERje" # /!\ Do not modify this variable (Cluster K8S gitlab var)
+              token: "${CROWDSEC_REGISTRATION_TOKEN}" # /!\ Do not modify this variable (Cluster K8S gitlab var)
               allowed_ranges: # /!\ Make sure to adapt to the pod IP ranges used by your cluster
                 - "127.0.0.1/32"
                 - "192.168.0.0/16"
@@ -64,11 +64,11 @@ spec:
                 - "172.16.0.0/12"
         db_config:
           type: mysql
-          user: crowdsec
-          password: +ctk2).oRv]oW2}E$~HxM
-          db_name: crowdsec
-          host: mysql-e884938b-o403ac517.database.cloud.ovh.net
-          port: 20184
+          user: ${CROWDSEC_DB_USER}
+          password: ${CROWDSEC_DB_PWD}
+          db_name: ${CROWDSEC_DB_NAME}
+          host: ${DB_HOST}
+          port: ${DB_PORT}
           flush:
             bouncers_autodelete:
               api_key: 1h

infrastructure/flux-resources/alerts.yaml

@@ -19,9 +19,9 @@ metadata:
 spec:
   summary: "LDC-WEB K8S NOTIFICATION"
   eventMetadata:
-    env: production
-    cluster: https://dbbc0v.c1.sbg5.k8s.ovh.net
-    region: OVH-SBG5
+    env: ${CI_ENVIRONMENT_NAME}
+    cluster: ${KUBERNETES_SERVER_API}
+    region: ${KUBERNETES_REGION}
   providerRef:
     name: msteams
   eventSeverity: info

infrastructure/netdata/helm-release.yaml

@@ -47,11 +47,11 @@ spec:
 
       resources:
         requests:
-          cpu: "200m"
-          memory: "512Mi"
+          cpu: "${NETDATA_PARENT_REQUESTS_CPU}"
+          memory: "${NETDATA_PARENT_REQUESTS_RAM}"
         limits:
-          cpu: "2"
-          memory: "2Gi"
+          cpu: "${NETDATA_PARENT_LIMITS_CPU}"
+          memory: "${NETDATA_PARENT_LIMITS_RAM}"
 
       # PV parent recommandés (db + alarms)
       database:
@@ -79,11 +79,11 @@ spec:
 
       resources:
         requests:
-          cpu: "100m"
-          memory: "256Mi"
+          cpu: "${NETDATA_CHILD_REQUESTS_CPU}"
+          memory: "${NETDATA_CHILD_REQUESTS_RAM}"
         limits:
-          cpu: "500m"
-          memory: "512Mi"
+          cpu: "${NETDATA_CHILD_LIMITS_CPU}"
+          memory: "${NETDATA_CHILD_LIMITS_RAM}"
 
       persistence:
         enabled: true
@@ -97,8 +97,8 @@ spec:
           data: |
             [db]
               mode = ram
-              retention = "900"
-              update every = "5"
+              retention = "${NETDATA_CHILD_RETENTION}"
+              update every = "${NETDATA_CHILD_COLLECT_INTERVAL}"
             [web]
               bind to = localhost:19999
             [health]

infrastructure/traefik/helm-release.yaml

@@ -28,9 +28,9 @@ spec:
       - "--entryPoints.web.http.redirections.entryPoint.to=websecure"
       - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
       - "--providers.kubernetescrd.allowCrossNamespace=true"
-      - "--entryPoints.web.proxyProtocol.trustedIPs=51.83.34.192/32"
-      - "--entryPoints.websecure.proxyProtocol.trustedIPs=51.83.34.192/32"
-      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=51.83.34.192/32"
+      - "--entryPoints.web.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+      - "--entryPoints.websecure.proxyProtocol.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
+      - "--entryPoints.websecure.forwardedHeaders.trustedIPs=${OVH_LOAD_BALANCER_EGRESS_IP}/32"
 
     additionalArguments:
       #- "--log.level=DEBUG"
@@ -122,7 +122,7 @@ spec:
         spec:
           plugin:
             bouncer:
-              forwardedHeadersTrustedIps: "51.83.34.192/32"
+              forwardedHeadersTrustedIps: "${OVH_LOAD_BALANCER_EGRESS_IP}/32"
               enabled: true
               crowdsecMode: stream
               crowdsecLapiScheme: http
@@ -386,7 +386,7 @@ spec:
         spec:
           type: LoadBalancer
           externalTrafficPolicy: Local
-          loadBalancerIP: "51.91.209.204"
+          loadBalancerIP: "${TRAEFIK_LOAD_BALANCER_IP_OCTAVIA}"
           selector:
             app.kubernetes.io/name: traefik
             app.kubernetes.io/instance: traefik-common-services