Merge pull request 'dev' (#16) from dev into main

Reviewed-on: #16

ansible-playbooks/common/reboot-hosts.yml

@@ -6,7 +6,7 @@
   
   tasks:
     - name: Trigger reboot with a slight delay
-      ansible.builtin.shell: "sleep 5 && reboot"
+      ansible.builtin.shell: "sleep 15 && shutdown -r now"
       async: 1
       poll: 0
       ignore_errors: true

ansible-playbooks/update-vpn.yml

@@ -6,11 +6,6 @@
   become_method: sudo
 
   tasks:
-    - name: Wait for VPN host to be ready after reboot
-      ansible.builtin.wait_for_connection:
-        delay: 5
-        timeout: 300
-
     - name: Update Pi-hole
       ansible.builtin.shell: pihole -up
       args:

kubernetes-templates/droneci.yml

@@ -1,172 +1,331 @@
 ---
+# Namespace for Drone CI
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: drone-ci
+  name: droneci
+
 ---
+# Service Account
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: drone-runner-sa
-  namespace: drone-ci
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: drone-runner-role
-  namespace: drone-ci
-rules:
-  - apiGroups: [""]
-    resources: ["pods", "pods/log", "secrets"]
-    verbs: ["get", "create", "delete", "list", "watch", "update"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: drone-runner-rb
-  namespace: drone-ci
-subjects:
-  - kind: ServiceAccount
-    name: drone-runner-sa
-    namespace: drone-ci
-roleRef:
-  kind: Role
-  name: drone-runner-role
-  apiGroup: rbac.authorization.k8s.io
+  name: droneci-sa
+  namespace: droneci
+
 ---
+# ConfigMap for Drone configuration
 apiVersion: v1
-kind: PersistentVolumeClaim
+kind: ConfigMap
 metadata:
-  name: drone-server-data-pvc
-  namespace: drone-ci
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: nfs-storage
-  resources:
-    requests:
-      storage: 5Gi
+  name: droneci-config
+  namespace: droneci
+data:
+  server.domain: "droneci.apps.mngoma.lab"
+  server.proto: "https"
+  server.runnername: "drone-runner"
+  server.runnercapacity: "2"
+  server.runnernetworks: "default"
+  database.type: "postgres"
+  database.host: "192.168.1.137:5432"
+  database.name: "dronecim"
+  gitea.server: "https://gitea.apps.mngoma.lab"
+  gitea.server.internal: "https://gitea-server.gitea.svc.cluster.local"
+
 ---
+# Secret for Drone credentials
 apiVersion: v1
 kind: Secret
 metadata:
-  name: drone-secrets
-  namespace: drone-ci
+  name: droneci-secret
+  namespace: droneci
 type: Opaque
-stringData:
-  DRONE_RPC_SECRET: "b505b2906ae213070b10d9698cc35e84"
-  DRONE_GITEA_CLIENT_ID: "a9b4a947-0b4c-4782-a5f8-3ed79a4b295d"
-  DRONE_GITEA_CLIENT_SECRET: "gto_ukxcserdy7vei36git4tbuz2tdyez4rb2eo5woownmtyct3lz3aq"
+data:
+  server.rpctoken: MDFLNlFHTkE4VEMxQjJGVzNGV0JSWDJFNE4=
+  database.username: YXBwX3VzZXI=
+  database.password: MTIzNDU=
+  database.connectstring: cG9zdGdyZXM6Ly9hcHBfdXNlcjoxMjM0NUAxOTIuMTY4LjEuMTM3OjU0MzIvZHJvbmVjaW0/c3NsbW9kZT1kaXNhYmxl
+  gitea.clientid: MGRiNTliZDAtMGI3Ni00ODgxLThhODQtNjI0N2ZlYTExOTcz
+  gitea.clientsecret: Z3RvX3l6bXB6NmJvZG52cmRnMnM1MmVmNWF1c3ozZTYzNGdyeTc0MjJqZ2hwd3ZnbGc2M2JtcnE=
+
 ---
+# Persistent Volume for Drone data
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: droneci-pv
+  labels:
+    type: local
+spec:
+  capacity:
+    storage: 5Gi
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: local-pvs
+  local:
+    path: /home/ansible/k3s/makhiwane/droneci
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values: ["lead"]
+  persistentVolumeReclaimPolicy: Retain
+
+---
+# Persistent Volume Claim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: droneci-pvc
+  namespace: droneci
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: local-pvs
+  resources:
+    requests:
+      storage: 5Gi
+
+---
+# Drone Server Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: drone-server
-  namespace: drone-ci
+  name: drone
+  namespace: droneci
+  labels:
+    app.kubernetes.io/name: drone
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: drone-server
+      app.kubernetes.io/name: drone
   template:
     metadata:
       labels:
-        app: drone-server
+        app.kubernetes.io/name: drone
     spec:
+      serviceAccountName: droneci-sa
       hostAliases:
-        - ip: "169.255.58.144"
-          hostnames: ["gitea.khongisa.co.za"]
+        - ip: "192.168.1.160"
+          hostnames:
+            - "gitea.apps.mngoma.lab"
       containers:
-        - name: drone-server
-          image: drone/drone:2
+        - name: drone
+          image: drone/drone:latest
           ports:
             - containerPort: 80
               name: http
           resources:
             requests:
-              cpu: "100m"
               memory: "256Mi"
+              cpu: "250m"
             limits:
-              cpu: "500m"
               memory: "512Mi"
+              cpu: "500m"
           env:
-            # FIX: Explicitly bind the address to bypass port validation logic
-            - name: DRONE_SERVER_ADDR
-              value: ":80"
             - name: DRONE_SERVER_HOST
-              value: "drone.khongisa.co.za"
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: server.domain
             - name: DRONE_SERVER_PROTO
-              value: "https"
-            - name: DRONE_GITEA_SERVER
-              value: "https://gitea.khongisa.co.za"
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: server.proto
+            - name: DRONE_SERVER_PORT
+              value: ":80"
+            - name: DRONE_TLS_AUTOCERT
+              value: "false"
+            - name: DRONE_LOGS_DEBUG
+              value: "true"
             - name: DRONE_RPC_SECRET
-              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_RPC_SECRET } }
-            - name: DRONE_GITEA_CLIENT_ID
-              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_GITEA_CLIENT_ID } }
-            - name: DRONE_GITEA_CLIENT_SECRET
-              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_GITEA_CLIENT_SECRET } }
+              valueFrom:
+                secretKeyRef:
+                  name: droneci-secret
+                  key: server.rpctoken
             - name: DRONE_DATABASE_DRIVER
-              value: "sqlite3"
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: database.type
             - name: DRONE_DATABASE_DATASOURCE
-              value: "/data/database.sqlite"
+              valueFrom:
+                secretKeyRef:
+                  name: droneci-secret
+                  key: database.connectstring
+            - name: DRONE_DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: droneci-secret
+                  key: database.username
+            - name: DRONE_DB_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: droneci-secret
+                  key: database.password
+            - name: DRONE_GITEA_SERVER
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: gitea.server
+            - name: DRONE_GITEA_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: droneci-secret
+                  key: gitea.clientid
+            - name: DRONE_GITEA_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: droneci-secret
+                  key: gitea.clientsecret
+            - name: DRONE_GITEA_SKIP_VERIFY
+              value: "true"
           volumeMounts:
-            - name: data
+            - name: drone-storage
               mountPath: /data
       volumes:
-        - name: data
+        - name: drone-storage
           persistentVolumeClaim:
-            claimName: drone-server-data-pvc
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone-runner
-  namespace: drone-ci
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: drone-runner
-  template:
-    metadata:
-      labels:
-        app: drone-runner
-    spec:
-      serviceAccountName: drone-runner-sa
-      hostAliases:
-        - ip: "169.255.58.144"
-          hostnames: ["gitea.khongisa.co.za"]
-      containers:
-        - name: drone-runner
-          image: drone/drone-runner-kube:latest
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "128Mi"
-            limits:
-              cpu: "300m"
-              memory: "256Mi"
-          env:
-            - name: DRONE_RPC_PROTO
-              value: "http"
-            - name: DRONE_RPC_HOST
-              value: "drone-server.drone-ci.svc.cluster.local"
-            - name: DRONE_RPC_SECRET
-              valueFrom: { secretKeyRef: { name: drone-secrets, key: DRONE_RPC_SECRET } }
-            - name: DRONE_NAMESPACE_DEFAULT
-              value: "drone-ci"
+            claimName: droneci-pvc
+
 ---
+# Drone Server Service
 apiVersion: v1
 kind: Service
 metadata:
   name: drone-server
-  namespace: drone-ci
+  namespace: droneci
 spec:
-  type: NodePort
   selector:
-    app: drone-server
+    app.kubernetes.io/name: drone
   ports:
     - name: http
       port: 80
       targetPort: 80
-      nodePort: 31001
+  type: ClusterIP
+
+---
+# Drone Runner Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drone-runner
+  namespace: droneci
+  labels:
+    app.kubernetes.io/name: drone-runner
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: drone-runner
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: drone-runner
+    spec:
+      serviceAccountName: droneci-sa
+      hostAliases:
+        - ip: "192.168.1.160"
+          hostnames:
+            - "droneci.apps.mngoma.lab"
+      containers:
+        - name: runner
+          image: drone/drone-runner-kube:latest
+          ports:
+            - containerPort: 3000
+          env:
+            # propagate SSL skip and internal Gitea to ephemeral pods
+            - name: DRONE_RUNNER_ENV_VARS
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: gitea.server.internal
+            - name: DRONE_RPC_HOST
+              value: drone-server.droneci.svc.cluster.local
+            - name: DRONE_RPC_PROTO
+              value: "http"
+            - name: DRONE_RPC_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: droneci-secret
+                  key: server.rpctoken
+            - name: DRONE_RUNNER_NAME
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: server.runnername
+            - name: DRONE_RUNNER_CAPACITY
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: server.runnercapacity
+            - name: DRONE_RUNNER_NETWORKS
+              valueFrom:
+                configMapKeyRef:
+                  name: droneci-config
+                  key: server.runnernetworks
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "200m"
+            limits:
+              memory: "256Mi"
+              cpu: "400m"
+
+---
+# Drone IngressRoute for Traefik
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: droneci-web
+  namespace: droneci
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`droneci.apps.mngoma.lab`)
+      kind: Rule
+      services:
+        - name: drone-server
+          port: 80
+          scheme: http
+  tls: {}
+---
+# ClusterRole for Drone CI Service Account
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: droneci-cluster-role
+rules:
+  - apiGroups: [""] # core API
+    resources: ["pods", "pods/exec", "pods/log", "services", "endpoints", "configmaps", "secrets", "persistentvolumeclaims", "namespaces"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "replicasets", "statefulsets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["batch"]
+    resources: ["jobs", "cronjobs"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["extensions", "networking.k8s.io"]
+    resources: ["ingresses"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["policy"]
+    resources: ["poddisruptionbudgets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+
+---
+# ClusterRoleBinding for Drone CI Service Account
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: droneci-cluster-rolebinding
+subjects:
+  - kind: ServiceAccount
+    name: droneci-sa
+    namespace: droneci
+roleRef:
+  kind: ClusterRole
+  name: droneci-cluster-role
+  apiGroup: rbac.authorization.k8s.io

kubernetes-templates/headlamp.yml

@@ -1,39 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: headlamp
-  namespace: kube-system
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: headlamp
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: headlamp
-    spec:
-      containers:
-      - name: headlamp
-        image: ghcr.io/headlamp-k8s/headlamp:latest
-        # We only use -in-cluster. No other flags allowed.
-        args:
-          - "-in-cluster"
-        ports:
-        - containerPort: 4466
-          name: http
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: headlamp
-  namespace: kube-system
-spec:
-  type: NodePort
-  selector:
-    app.kubernetes.io/name: headlamp
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 4466
-      nodePort: 30001

kubernetes-templates/nexus.yml

@@ -1,145 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nexus
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nexus-data-pvc
-  namespace: nexus
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: nfs-nexus
-  resources:
-    requests:
-      storage: 200Gi
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: nexus-secrets
-  namespace: nexus
-type: Opaque
-data:
-  nexus.secrets.json: ewogICJhY3RpdmUiOiAia2hvbmdpc2Eta2V5LTIwMjYiLAogICJrZXlzIjogWwogICAgewogICAgICAiaWQiOiAia2hvbmdpc2Eta2V5LTIwMjYiLAogICAgICAia2V5IjogIk5tTmhZMll3TkdNMUltVXdOVGt4WkROa1l6a3habVk1WVRJek5UWTVOalE9IgogICAgfQogIF0KfQo=
-  postgres-password: TWd6dUxVakZianA5ZjQ=
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: nexus-configs
-  namespace: nexus
-data:
-  POSTGRES_HOST: "192.168.1.170"
-  POSTGRES_PORT: "5432"
-  POSTGRES_USER: "nexus"
-  POSTGRES_DBNAME: "nexus"
-  JVM_PARAMS: "-Xms2g -Xmx2g -XX:MaxDirectMemorySize=2g -Dnexus.secrets.file=/nexus-data/nexus.secrets.json"
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nexus
-  namespace: nexus
-  labels:
-    app: nexus
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: nexus
-  template:
-    metadata:
-      labels:
-        app: nexus
-    spec:
-      securityContext:
-        fsGroup: 200
-      containers:
-        - name: nexus
-          image: sonatype/nexus3:latest
-          ports:
-            - containerPort: 8081
-              name: nexus-ui
-            - containerPort: 8082
-              name: docker-repo
-          env:
-            - name: INSTALL4J_ADD_VM_PARAMS
-              valueFrom:
-                configMapKeyRef:
-                  name: nexus-configs
-                  key: JVM_PARAMS
-            - name: NEXUS_DATABAS_TYPE
-              value: "postgresql"
-            - name: NEXUS_DATABASE_POSTGRES_HOST
-              valueFrom:
-                configMapKeyRef:
-                  name: nexus-configs
-                  key: POSTGRES_HOST
-            - name: NEXUS_DATABASE_POSTGRES_PORT
-              valueFrom:
-                configMapKeyRef:
-                  name: nexus-configs
-                  key: POSTGRES_PORT
-            - name: NEXUS_DATABASE_POSTGRES_USER
-              valueFrom:
-                configMapKeyRef:
-                  name: nexus-configs
-                  key: POSTGRES_USER
-            - name: NEXUS_DATABASE_POSTGRES_DBNAME
-              valueFrom:
-                configMapKeyRef:
-                  name: nexus-configs
-                  key: POSTGRES_DBNAME
-            - name: NEXUS_DATABASE_POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: nexus-secrets
-                  key: postgres-password
-          resources:
-            requests:
-              cpu: "500m"
-              memory: "2Gi"
-            limits:
-              cpu: "4"
-              memory: "4Gi"
-          volumeMounts:
-            - name: nexus-data
-              mountPath: /nexus-data
-            - name: secrets-volume
-              mountPath: /nexus-data/nexus.secrets.json
-              subPath: nexus.secrets.json
-      volumes:
-        - name: nexus-data
-          persistentVolumeClaim:
-            claimName: nexus-data-pvc
-        - name: secrets-volume
-          secret:
-            secretName: nexus-secrets
-            items:
-              - key: nexus.secrets.json
-                path: nexus.secrets.json
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: nexus-service
-  namespace: nexus
-spec:
-  type: NodePort
-  selector:
-    app: nexus
-  ports:
-    - name: ui
-      protocol: TCP
-      port: 8081
-      targetPort: 8081
-      nodePort: 31009 
-    - name: docker
-      protocol: TCP
-      port: 8082
-      targetPort: 8082
-      nodePort: 31010

kubernetes-templates/pgadmin.yml

@@ -1,46 +1,95 @@
----
 apiVersion: v1
 kind: Namespace
 metadata:
   name: pgadmin
 ---
 apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pgadmin-data-pvc
-  namespace: pgadmin
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: nfs-storage
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: pgadmin-auth
-  namespace: pgadmin
-type: Opaque
-data:
-  pgadmin-password: QmxhY2tzdGFyMkBob21l
----
-apiVersion: v1
 kind: ConfigMap
 metadata:
   name: pgadmin-config
   namespace: pgadmin
 data:
-  PGADMIN_DEFAULT_EMAIL: "khwezi@litecharms.co.za"
+  server.email: "khwezi@mngoma.lab"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: pgadmin-secret
+  namespace: pgadmin
+type: Opaque
+data:
+  server.password: M3pDQTQz
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pgadmin-sa
+  namespace: pgadmin
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pgadmin-role
+  namespace: pgadmin
+rules:
+- apiGroups: [""]
+  resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pgadmin-rolebinding
+  namespace: pgadmin
+subjects:
+- kind: ServiceAccount
+  name: pgadmin-sa
+  namespace: pgadmin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pgadmin-role
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pgadmin-pv
+spec:
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-pvs
+  local:
+    path: /home/ansible/k3s/makhiwane/pgadmin
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - lead
+  persistentVolumeReclaimPolicy: Retain
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pgadmin-pvc
+  namespace: pgadmin
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-pvs
+  resources:
+    requests:
+      storage: 2Gi
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pgadmin
   namespace: pgadmin
-  labels:
-    app: pgadmin
 spec:
   replicas: 1
   selector:
@@ -51,63 +100,60 @@ spec:
       labels:
         app: pgadmin
     spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: DoesNotExist
+      serviceAccountName: pgadmin-sa
       securityContext:
         runAsUser: 5050
+        runAsGroup: 5050
         fsGroup: 5050
       containers:
-        - name: pgadmin
-          image: dpage/pgadmin4:latest
-          ports:
-            - containerPort: 80
-              name: http
-          env:
-            - name: PGADMIN_DEFAULT_EMAIL
-              valueFrom:
-                configMapKeyRef:
-                  name: pgadmin-config
-                  key: PGADMIN_DEFAULT_EMAIL
-            - name: PGADMIN_DEFAULT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: pgadmin-auth
-                  key: pgadmin-password
-            - name: PGADMIN_CONFIG_UPGRADE_CHECK_ENABLED
-              value: "False"
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "256Mi"
-            limits:
-              cpu: "500m"
-              memory: "512Mi"
-          volumeMounts:
-            - name: pgadmin-storage
-              mountPath: /var/lib/pgadmin
+      - name: pgadmin
+        image: dpage/pgadmin4:latest        
+        ports:
+        - containerPort: 80
+        volumeMounts:
+        - name: pgadmin-data
+          mountPath: /var/lib/pgadmin
+        env:
+        - name: PGADMIN_DEFAULT_EMAIL
+          valueFrom:
+            configMapKeyRef:
+              name: pgadmin-config
+              key: server.email
+        - name: PGADMIN_DEFAULT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: pgadmin-secret
+              key: server.password
       volumes:
-        - name: pgadmin-storage
-          persistentVolumeClaim:
-            claimName: pgadmin-data-pvc
+      - name: pgadmin-data
+        persistentVolumeClaim:
+          claimName: pgadmin-pvc
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  name: pgadmin-service
+  name: pgadmin
   namespace: pgadmin
 spec:
-  type: NodePort
+  type: ClusterIP
   selector:
     app: pgadmin
   ports:
-    - name: http
-      protocol: TCP
-      port: 80
+    - port: 80
       targetPort: 80
-      nodePort: 32081
-      
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: pgadmin-ingress
+  namespace: pgadmin
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pgadmin.apps.mngoma.lab`)
+      kind: Rule
+      services:
+        - name: pgadmin
+          port: 80
+  tls: {}

kubernetes-templates/searxng.yml

@@ -38,13 +38,6 @@ spec:
               value: "0.0.0.0"
             - name: SEARXNG_SERVER_PORT
               value: "8080"
-          resources:
-            requests:
-              cpu: "100m"
-              memory: "128Mi"
-            limits:
-              cpu: "500m"
-              memory: "512Mi"
 ---
 apiVersion: v1
 kind: Service
@@ -52,7 +45,6 @@ metadata:
   name: searxng-server
   namespace: searxng
 spec:
-  type: NodePort
   selector:
     app.kubernetes.io/name: searxng-server
   ports:
@@ -60,7 +52,7 @@ spec:
       protocol: TCP
       port: 8080
       targetPort: 8080
-      nodePort: 32080
+  type: ClusterIP
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute

kubernetes-templates/semaphoreui.yml

@@ -1,199 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: semaphore
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: semaphore-sa
-  namespace: semaphore
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: semaphore-role
-  namespace: semaphore
-rules:
-  - apiGroups: [""]
-    resources: ["pods", "secrets", "configmaps"]
-    verbs: ["get", "watch", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: semaphore-rb
-  namespace: semaphore
-subjects:
-  - kind: ServiceAccount
-    name: semaphore-sa
-    namespace: semaphore
-roleRef:
-  kind: Role
-  name: semaphore-role
-  apiGroup: rbac.authorization.k8s.io
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: semaphore-data-pvc
-  namespace: semaphore
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: nfs-storage
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: semaphore-secrets
-  namespace: semaphore
-type: Opaque
-data:
-  db-password: c2VYbk42RGt1cFJaN0Y=
-  admin-password: QmxhY2tzdGFyMkBob21l
-  access-key-encryption: NHZKMm1LMnBMNW5COHhSMnpRN3dFM3RZNnVJMG9QOWE=
-  id_ed25519: LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUFNd0FBQUF0emMyZ3RaVwpReU5UVXhPUUFBQUNEbkRQMDZzbmM0Q2k3M0ZPSW1nTmszTWJsc25vNTNoajZYRDJTSzE1ZFpiQUFBQUpnZWwvMndIcGY5CnNBQUFBQXR6YzJndFpXUXlOVFV4T1FBQUFDRG5EUDA2c25jNENpNzNGT0ltZ05rM01ibHNubzUzaGo2WEQyU0sxNWRaYkEKQUFBRUJUaHFjcnNXZWVVWnpFeVdWWmJoRGlKZE9FQkZYSkg4NXNhMUNjK1dXQ0krY00vVHF5ZHpnS0x2Y1U0aWFBMlRjeAp1V3llam5lR1BwY1BaSXJYbDFsc0FBQUFEbXRvZDJWNmFVQkVRVkpMVTFWT0FRSURCQVVHQnc9PQotLS0tLUVORCBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0K
-  id_ed25519.pub: c3NoLWVkMjU1MTkgQUFBQUMzTnphQzFsWkRJMU5URTVBQUFBSU9jTS9UcXlkemdLTHZjVTRpYUEyVGN4dVd5ZWpuZUdQcGNQWklyWGwxbHMga2h3ZXppQERBUktTVU4K
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: semaphore-configs
-  namespace: semaphore
-data:
-  SEMAPHORE_DB_USER: "semaphore_user"
-  SEMAPHORE_DB_HOST: "192.168.1.170"
-  SEMAPHORE_DB_NAME: "semaphore"
-  SEMAPHORE_ADMIN_USERNAME: "khwezi"
-  SEMAPHORE_ADMIN_EMAIL: "khwezi@litecharms.co.za"
-  SEMAPHORE_SCHEDULE_TIMEZONE: "Africa/Johannesburg"
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: semaphore
-  namespace: semaphore
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: semaphore
-  template:
-    metadata:
-      labels:
-        app: semaphore
-    spec:
-      serviceAccountName: semaphore-sa
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/control-plane
-                    operator: DoesNotExist
-      hostAliases:
-        - ip: "169.255.58.144"
-          hostnames:
-            - "gitea.khongisa.co.za"
-      
-      securityContext:
-        runAsUser: 1001
-        fsGroup: 1001
-        fsGroupChangePolicy: "Always"
-
-      initContainers:
-        - name: fix-ssh-permissions
-          image: busybox:latest
-          # We ensure the directory exists and has 700. 
-          # We don't touch the files yet because they are mounted by the main container.
-          command: ["sh", "-c", "mkdir -p /home/semaphore/.ssh && chmod 700 /home/semaphore/.ssh"]
-          volumeMounts:
-            - name: semaphore-persistent-storage
-              mountPath: /home/semaphore
-
-      containers:
-        - name: semaphore
-          image: semaphoreui/semaphore:latest
-          ports:
-            - containerPort: 3000
-              name: http
-          resources:
-            requests:
-              cpu: "200m"
-              memory: "512Mi"
-            limits:
-              cpu: "1"
-              memory: "1Gi"
-          env:
-            - name: SEMAPHORE_DB_DIALECT
-              value: "postgres"
-            - name: SEMAPHORE_DB_PORT
-              value: "5432"
-            - name: SEMAPHORE_DB_USER
-              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_DB_USER } }
-            - name: SEMAPHORE_DB_HOST
-              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_DB_HOST } }
-            - name: SEMAPHORE_DB
-              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_DB_NAME } }
-            - name: SEMAPHORE_ADMIN
-              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_ADMIN_USERNAME } }
-            - name: SEMAPHORE_ADMIN_NAME
-              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_ADMIN_USERNAME } }
-            - name: SEMAPHORE_ADMIN_EMAIL
-              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_ADMIN_EMAIL } }
-            - name: SEMAPHORE_SCHEDULE_TIMEZONE
-              valueFrom: { configMapKeyRef: { name: semaphore-configs, key: SEMAPHORE_SCHEDULE_TIMEZONE } }
-            - name: SEMAPHORE_DB_PASS
-              valueFrom: { secretKeyRef: { name: semaphore-secrets, key: db-password } }
-            - name: SEMAPHORE_ADMIN_PASSWORD
-              valueFrom: { secretKeyRef: { name: semaphore-secrets, key: admin-password } }
-            - name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
-              valueFrom: { secretKeyRef: { name: semaphore-secrets, key: access-key-encryption } }
-          volumeMounts:
-            - name: semaphore-persistent-storage
-              mountPath: /home/semaphore
-            - name: semaphore-persistent-storage
-              mountPath: /tmp/semaphore
-              subPath: tmp
-            - name: ssh-keys-volume
-              mountPath: /home/semaphore/.ssh/id_ed25519
-              subPath: id_ed25519
-              readOnly: true
-            - name: ssh-keys-volume
-              mountPath: /home/semaphore/.ssh/id_ed25519.pub
-              subPath: id_ed25519.pub
-              readOnly: true
-      volumes:
-        - name: semaphore-persistent-storage
-          persistentVolumeClaim:
-            claimName: semaphore-data-pvc
-        - name: ssh-keys-volume
-          secret:
-            secretName: semaphore-secrets
-            defaultMode: 384 # 0600
-            items:
-              - key: id_ed25519
-                path: id_ed25519
-              - key: id_ed25519.pub
-                path: id_ed25519.pub
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: semaphore-service
-  namespace: semaphore
-spec:
-  type: NodePort
-  selector:
-    app: semaphore
-  ports:
-    - name: http
-      protocol: TCP
-      port: 3000
-      targetPort: 3000
-      nodePort: 31011

kubernetes-templates/traefik-dashboard.yml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: traefik-dashboard-nodeport
-  namespace: kube-system
-spec:
-  type: NodePort
-  selector:
-    app.kubernetes.io/name: traefik
-  ports:
-    - name: admin
-      protocol: TCP
-      port: 8080
-      targetPort: 8080
-      nodePort: 30000