first commit
This commit is contained in:
Khwezi Mngoma
191
k3s/ansible/add-cluster-tooling.yml
Normal file
191
k3s/ansible/add-cluster-tooling.yml
Normal file
@@ -0,0 +1,191 @@
|
||||
---
|
||||
- name: Install dependencies, mount NFS at /home/{{ ansible_user }}/k3s, setup K3s, DNS, Traefik, venv for k8s module
|
||||
hosts: all
|
||||
become: yes
|
||||
vars:
|
||||
nfs_server: storage.mngoma.lab
|
||||
nfs_export_path: /export/k3s
|
||||
dns_server_ip: 192.168.1.151
|
||||
dns_fallback_ip: 192.168.1.1
|
||||
ansible_user_home: "/home/{{ ansible_user }}"
|
||||
nfs_mount_path: "{{ ansible_user_home }}/k3s"
|
||||
kube_config_path: "{{ ansible_user_home }}/.kube/config"
|
||||
kube_venv_path: "/opt/kube-venv"
|
||||
tasks:
|
||||
- name: Configure systemd-resolved permanent DNS
|
||||
copy:
|
||||
dest: /etc/systemd/resolved.conf
|
||||
content: |
|
||||
[Resolve]
|
||||
DNS={{ dns_server_ip }}
|
||||
FallbackDNS={{ dns_fallback_ip }}
|
||||
Domains=mngoma.lab
|
||||
DNSStubListener=yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Ensure /etc/resolv.conf points to systemd-resolved stub
|
||||
file:
|
||||
src: /run/systemd/resolve/stub-resolv.conf
|
||||
dest: /etc/resolv.conf
|
||||
state: link
|
||||
force: yes
|
||||
|
||||
- name: Restart systemd-resolved to apply DNS changes
|
||||
systemd:
|
||||
name: systemd-resolved
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Ensure NFS mount point exists
|
||||
file:
|
||||
path: "{{ nfs_mount_path }}"
|
||||
state: directory
|
||||
owner: "{{ ansible_user | default('root') }}"
|
||||
group: "{{ ansible_user | default('root') }}"
|
||||
mode: '0755'
|
||||
|
||||
- name: Mount NFS share immediately (direct, idempotent)
|
||||
mount:
|
||||
src: "{{ nfs_server }}:{{ nfs_export_path }}"
|
||||
path: "{{ nfs_mount_path }}"
|
||||
fstype: nfs
|
||||
opts: defaults
|
||||
state: mounted
|
||||
|
||||
- name: Ensure NFS mount persists across reboots (fstab entry)
|
||||
mount:
|
||||
src: "{{ nfs_server }}:{{ nfs_export_path }}"
|
||||
path: "{{ nfs_mount_path }}"
|
||||
fstype: nfs
|
||||
opts: defaults
|
||||
state: present
|
||||
|
||||
- name: Ensure .kube directory exists
|
||||
file:
|
||||
path: "{{ ansible_user_home }}/.kube"
|
||||
state: directory
|
||||
owner: "{{ ansible_user }}"
|
||||
group: "{{ ansible_user }}"
|
||||
mode: '0700'
|
||||
|
||||
- name: Download latest kubectl
|
||||
shell: |
|
||||
arch=$(uname -m)
|
||||
if [ "$arch" = "x86_64" ]; then arch="amd64";
|
||||
elif [ "$arch" = "aarch64" ]; then arch="arm64";
|
||||
fi
|
||||
curl -Lo /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${arch}/kubectl"
|
||||
chmod +x /usr/local/bin/kubectl
|
||||
args:
|
||||
creates: /usr/local/bin/kubectl
|
||||
environment:
|
||||
KUBECONFIG: "{{ kube_config_path }}"
|
||||
|
||||
- name: Install Helm
|
||||
shell: |
|
||||
curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
|
||||
args:
|
||||
creates: /usr/local/bin/helm
|
||||
environment:
|
||||
KUBECONFIG: "{{ kube_config_path }}"
|
||||
|
||||
- name: Download and install kustomize
|
||||
shell: |
|
||||
kustomize_ver=$(curl -s https://api.github.com/repos/kubernetes-sigs/kustomize/releases/latest | jq -r '.tag_name')
|
||||
arch=$(uname -m)
|
||||
if [ "$arch" = "x86_64" ]; then arch="amd64";
|
||||
elif [ "$arch" = "aarch64" ]; then arch="arm64";
|
||||
fi
|
||||
url="https://github.com/kubernetes-sigs/kustomize/releases/download/${kustomize_ver}/kustomize_${kustomize_ver#kustomize/}_linux_${arch}.tar.gz"
|
||||
tmpfile=$(mktemp)
|
||||
curl -L -o "$tmpfile" "$url"
|
||||
tar -xz -C /usr/local/bin -f "$tmpfile"
|
||||
chmod +x /usr/local/bin/kustomize
|
||||
rm -f "$tmpfile"
|
||||
args:
|
||||
creates: /usr/local/bin/kustomize
|
||||
ignore_errors: true
|
||||
environment:
|
||||
KUBECONFIG: "{{ kube_config_path }}"
|
||||
|
||||
- name: Install kubectx and kubens
|
||||
shell: |
|
||||
git clone https://github.com/ahmetb/kubectx /opt/kubectx || true
|
||||
ln -sf /opt/kubectx/kubectx /usr/local/bin/kubectx
|
||||
ln -sf /opt/kubectx/kubens /usr/local/bin/kubens
|
||||
environment:
|
||||
KUBECONFIG: "{{ kube_config_path }}"
|
||||
|
||||
- name: Ensure systemd override directory for k3s exists
|
||||
file:
|
||||
path: /etc/systemd/system/k3s.service.d
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Enable Traefik ping via CLI arguments
|
||||
copy:
|
||||
dest: /etc/systemd/system/k3s.service.d/10-traefik-ping.conf
|
||||
content: |
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/local/bin/k3s server --no-deploy=servicelb --kubelet-arg="cloud-provider=external" \
|
||||
--traefik-arg="--ping.entryPoint=web" \
|
||||
--traefik-arg="--ping.manualRouting=false" \
|
||||
--traefik-arg="--ping.responseMessage=Healthy"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Reload systemd to pick up k3s override
|
||||
systemd:
|
||||
daemon_reload: yes
|
||||
|
||||
# --- VENV FOR KUBERNETES MODULE ---
|
||||
- name: Create venv for k8s ansible modules
|
||||
command: python3 -m venv {{ kube_venv_path }}
|
||||
args:
|
||||
creates: "{{ kube_venv_path }}/bin/activate"
|
||||
|
||||
- name: Install kubernetes python library in venv
|
||||
pip:
|
||||
name: kubernetes
|
||||
virtualenv: "{{ kube_venv_path }}"
|
||||
virtualenv_python: python3
|
||||
|
||||
# The following play block will ONLY target the manager group
|
||||
- name: Expose Traefik dashboard via IngressRoute (manager only)
|
||||
hosts: manager # Change to your actual manager inventory group name
|
||||
become: yes
|
||||
vars:
|
||||
ansible_user_home: "/home/{{ ansible_user }}"
|
||||
kube_config_path: "{{ ansible_user_home }}/.kube/config"
|
||||
kube_venv_path: "/opt/kube-venv"
|
||||
tasks:
|
||||
- name: Expose Traefik dashboard via IngressRoute (inline)
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
definition:
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: traefik-dashboard
|
||||
namespace: kube-system
|
||||
spec:
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`dashboard.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: traefik
|
||||
port: 8080
|
||||
tls: {}
|
||||
environment:
|
||||
KUBECONFIG: "{{ kube_config_path }}"
|
||||
vars:
|
||||
ansible_python_interpreter: "{{ kube_venv_path }}/bin/python"
|
||||
37
k3s/ansible/apply-cluster-snat.bat
Normal file
37
k3s/ansible/apply-cluster-snat.bat
Normal file
@@ -0,0 +1,37 @@
|
||||
@echo off
|
||||
REM =========================================
|
||||
REM apply-cluster-snat.bat
|
||||
REM Enables hairpin NAT for Kubernetes pods -> HAProxy host
|
||||
REM =========================================
|
||||
|
||||
REM ---- Step 1: Enable IP forwarding ----
|
||||
echo Enabling IPv4 forwarding...
|
||||
powershell -Command "Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name 'IPEnableRouter' -Value 1"
|
||||
echo IP forwarding enabled. Please reboot for permanent effect.
|
||||
|
||||
REM ---- Step 2: Add UFW NAT rules ----
|
||||
echo Applying NAT rules for pod -> HAProxy hairpin...
|
||||
REM Ensure before.rules file exists
|
||||
set ufw_rules_file=/etc/ufw/before.rules
|
||||
|
||||
REM Backup original rules
|
||||
if exist "%ufw_rules_file%.bak" (
|
||||
echo Backup already exists.
|
||||
) else (
|
||||
copy "%ufw_rules_file%" "%ufw_rules_file%.bak"
|
||||
echo Backup created at %ufw_rules_file%.bak
|
||||
)
|
||||
|
||||
REM Append NAT rules
|
||||
echo *nat >> "%ufw_rules_file%"
|
||||
echo :POSTROUTING ACCEPT [0:0] >> "%ufw_rules_file%"
|
||||
echo -A POSTROUTING -s 10.42.0.0/16 -d 192.168.1.160 -j MASQUERADE >> "%ufw_rules_file%"
|
||||
echo COMMIT >> "%ufw_rules_file%"
|
||||
|
||||
REM ---- Step 3: Reload UFW ----
|
||||
echo Reloading UFW...
|
||||
ufw disable
|
||||
ufw enable
|
||||
|
||||
echo Hairpin NAT applied successfully.
|
||||
pause
|
||||
81
k3s/ansible/common/create-ansible-user.yml
Normal file
81
k3s/ansible/common/create-ansible-user.yml
Normal file
@@ -0,0 +1,81 @@
|
||||
# command: ansible-playbook -i config/<target manifest>.ini common/create-ansible-user.yml --ask-become-pass
|
||||
# Note: this playbook requires an interactive mode or passed secret for privilege escalation
|
||||
---
|
||||
- name: Create ansible user and configure passwordless sudo
|
||||
hosts: all
|
||||
become: true
|
||||
become_method: sudo
|
||||
vars:
|
||||
ansible_user: khwezi
|
||||
tasks:
|
||||
- name: Ensure 'ansible' user exists
|
||||
ansible.builtin.user:
|
||||
name: ansible
|
||||
groups: sudo
|
||||
append: yes
|
||||
shell: /bin/bash
|
||||
state: present
|
||||
- name: Check if passwordless sudo is already configured for 'ansible'
|
||||
ansible.builtin.shell: |
|
||||
grep -Fxq "ansible ALL=(ALL) NOPASSWD: ALL" /etc/sudoers.d/ansible
|
||||
register: sudoers_check
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
- name: Allow 'ansible' user passwordless sudo
|
||||
ansible.builtin.copy:
|
||||
dest: /etc/sudoers.d/ansible
|
||||
content: "ansible ALL=(ALL) NOPASSWD: ALL\n"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0440'
|
||||
when: sudoers_check.rc != 0
|
||||
- name: Ensure /home/ansible/.ssh directory exists
|
||||
ansible.builtin.file:
|
||||
path: /home/ansible/.ssh
|
||||
state: directory
|
||||
owner: ansible
|
||||
group: ansible
|
||||
mode: '0700'
|
||||
- name: Copy id_ed25519 private key to ansible user
|
||||
ansible.builtin.copy:
|
||||
src: ~/.ssh/id_ed25519
|
||||
dest: /home/ansible/.ssh/id_ed25519
|
||||
owner: ansible
|
||||
group: ansible
|
||||
mode: '0600'
|
||||
- name: Copy id_ed25519 public key to ansible user
|
||||
ansible.builtin.copy:
|
||||
src: ~/.ssh/id_ed25519.pub
|
||||
dest: /home/ansible/.ssh/id_ed25519.pub
|
||||
owner: ansible
|
||||
group: ansible
|
||||
mode: '0644'
|
||||
- name: Ensure authorized_keys exists
|
||||
ansible.builtin.file:
|
||||
path: /home/ansible/.ssh/authorized_keys
|
||||
state: touch
|
||||
owner: ansible
|
||||
group: ansible
|
||||
mode: '0600'
|
||||
- name: Read public key content
|
||||
ansible.builtin.slurp:
|
||||
src: /home/ansible/.ssh/id_ed25519.pub
|
||||
register: pubkey_content
|
||||
- name: Ensure public key is present in authorized_keys
|
||||
ansible.builtin.lineinfile:
|
||||
path: /home/ansible/.ssh/authorized_keys
|
||||
line: "{{ pubkey_content['content'] | b64decode | trim }}"
|
||||
owner: ansible
|
||||
group: ansible
|
||||
mode: '0600'
|
||||
create: yes
|
||||
state: present
|
||||
|
||||
- name: Allow 'ansible' user to write to /etc/systemd/resolved.conf
|
||||
ansible.builtin.file:
|
||||
path: /etc/systemd/resolved.conf
|
||||
owner: ansible
|
||||
group: ansible
|
||||
mode: '0664'
|
||||
state: file
|
||||
become: true
|
||||
86
k3s/ansible/common/install-docker.yml
Normal file
86
k3s/ansible/common/install-docker.yml
Normal file
@@ -0,0 +1,86 @@
|
||||
# command: ansible-playbook -i config/<target manifest>.ini common/install-docker.yml
|
||||
---
|
||||
- name: Install Docker and Test
|
||||
hosts: all
|
||||
become: true
|
||||
become_method: sudo
|
||||
|
||||
tasks:
|
||||
- name: Ensure required apt packages are installed
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- apt-transport-https
|
||||
- ca-certificates
|
||||
- curl
|
||||
- gnupg
|
||||
- lsb-release
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Ensure gpg is installed
|
||||
ansible.builtin.apt:
|
||||
name: gpg
|
||||
state: present
|
||||
|
||||
- name: Remove old Docker keyring files if present
|
||||
ansible.builtin.file:
|
||||
path: "{{ item }}"
|
||||
state: absent
|
||||
loop:
|
||||
- /usr/share/keyrings/docker-archive-keyring.gpg
|
||||
- /usr/share/keyrings/docker-archive-keyring.gpg.asc
|
||||
|
||||
- name: Download Docker's official GPG key (ASCII)
|
||||
ansible.builtin.get_url:
|
||||
url: https://download.docker.com/linux/ubuntu/gpg
|
||||
dest: /usr/share/keyrings/docker-archive-keyring.gpg.asc
|
||||
mode: '0644'
|
||||
force: yes
|
||||
|
||||
- name: Convert Docker GPG key to binary format
|
||||
ansible.builtin.command: >
|
||||
gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg /usr/share/keyrings/docker-archive-keyring.gpg.asc
|
||||
|
||||
- name: Add Docker repository if not present (modern method)
|
||||
ansible.builtin.apt_repository:
|
||||
repo: "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu {{ ansible_distribution_release }} stable"
|
||||
state: present
|
||||
filename: docker
|
||||
|
||||
- name: Update apt cache after adding Docker repo
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Check if Docker is already installed
|
||||
ansible.builtin.command: docker --version
|
||||
register: docker_check
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Install Docker Engine
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
state: present
|
||||
when: docker_check.rc != 0
|
||||
|
||||
- name: Check Docker version (post-install)
|
||||
ansible.builtin.command: docker --version
|
||||
register: docker_version
|
||||
changed_when: false
|
||||
|
||||
- name: Show Docker version
|
||||
ansible.builtin.debug:
|
||||
var: docker_version.stdout
|
||||
|
||||
- name: Run hello-world container to test Docker
|
||||
ansible.builtin.command: docker run --name hello-test --rm hello-world
|
||||
register: hello_world_output
|
||||
changed_when: false
|
||||
|
||||
- name: Show hello-world output
|
||||
ansible.builtin.debug:
|
||||
var: hello_world_output.stdout
|
||||
|
||||
28
k3s/ansible/common/update-docker.yml
Normal file
28
k3s/ansible/common/update-docker.yml
Normal file
@@ -0,0 +1,28 @@
|
||||
# command: ansible-playbook -i config/<target manifest>.ini common/update-docker.yml
|
||||
---
|
||||
- name: Update Docker only on hosts where it is installed
|
||||
hosts: all
|
||||
become: true
|
||||
become_method: sudo
|
||||
|
||||
tasks:
|
||||
- name: Check if Docker is installed
|
||||
ansible.builtin.command: docker --version
|
||||
register: docker_check
|
||||
ignore_errors: true
|
||||
changed_when: false
|
||||
|
||||
- name: Update Docker packages if installed
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- docker-ce
|
||||
- docker-ce-cli
|
||||
- containerd.io
|
||||
state: latest
|
||||
update_cache: yes
|
||||
when: docker_check.rc == 0
|
||||
|
||||
- name: Debug message if Docker is not installed
|
||||
ansible.builtin.debug:
|
||||
msg: "Docker is not installed on this host. Skipping update."
|
||||
when: docker_check.rc != 0
|
||||
19
k3s/ansible/common/update-hosts.yml
Normal file
19
k3s/ansible/common/update-hosts.yml
Normal file
@@ -0,0 +1,19 @@
|
||||
# command: ansible-playbook -i config/<target manifest>.ini common/update-hosts.yml
|
||||
---
|
||||
- name: Update and upgrade all apt packages
|
||||
hosts: all
|
||||
become: true
|
||||
become_method: sudo
|
||||
|
||||
tasks:
|
||||
- name: Update apt cache
|
||||
ansible.builtin.apt:
|
||||
update_cache: yes
|
||||
|
||||
- name: Upgrade all packages
|
||||
ansible.builtin.apt:
|
||||
upgrade: dist
|
||||
|
||||
- name: Autoremove unused packages
|
||||
ansible.builtin.apt:
|
||||
autoremove: yes
|
||||
31
k3s/ansible/config/appliances.ini
Normal file
31
k3s/ansible/config/appliances.ini
Normal file
@@ -0,0 +1,31 @@
|
||||
[all:vars]
|
||||
ansible_python_interpreter=/usr/bin/python3
|
||||
ansible_user=ansible
|
||||
ansible_ssh_private_key_file=~/.ssh/id_ed25519
|
||||
|
||||
[shared]
|
||||
sentry ansible_host=sentry.mngoma.lab
|
||||
alpha ansible_host=alpha.lb.mngoma.lab
|
||||
database ansible_host=database.mngoma.lab
|
||||
vpn ansible_host=vpn.mngoma.lab
|
||||
minecraft ansible_host=minecraft.mngoma.lab
|
||||
#khongisa ansible_host=khongisa.mngoma.lab
|
||||
#beta ansible_host=beta.lb.mngoma.lab
|
||||
#dns ansible_host=dns.mngoma.lab
|
||||
#storage ansible_host=storage.mngoma.lab
|
||||
manager ansible_host=lead.mngoma.lab
|
||||
worker ansible_host=worker1.mngoma.lab
|
||||
#manager2 ansible_host=follow.mngoma.lab
|
||||
#worker2 ansible_host=worker2.mngoma.lab
|
||||
|
||||
[makhiwanecluster]
|
||||
manager ansible_host=lead.mngoma.lab
|
||||
worker ansible_host=worker1.mngoma.lab
|
||||
|
||||
[mbubecluster]
|
||||
#manager2 ansible_host=follow.mngoma.lab
|
||||
#worker2 ansible_host=worker2.mngoma.lab
|
||||
|
||||
[loadbalancers]
|
||||
alpha ansible_host=alpha.lb.mngoma.lab
|
||||
#beta ansible_host=beta.lb.mngoma.lab
|
||||
11
k3s/ansible/config/makhiwane.ini
Normal file
11
k3s/ansible/config/makhiwane.ini
Normal file
@@ -0,0 +1,11 @@
|
||||
[all:vars]
|
||||
ansible_python_interpreter=/usr/bin/python3
|
||||
ansible_user=ansible
|
||||
ansible_ssh_private_key_file=~/.ssh/id_ed25519
|
||||
|
||||
[cluster]
|
||||
manager ansible_host=lead.mngoma.lab
|
||||
worker ansible_host=worker1.mngoma.lab
|
||||
|
||||
[workers]
|
||||
worker ansible_host=worker1.mngoma.lab
|
||||
11
k3s/ansible/config/mbube.ini
Normal file
11
k3s/ansible/config/mbube.ini
Normal file
@@ -0,0 +1,11 @@
|
||||
[all:vars]
|
||||
ansible_python_interpreter=/usr/bin/python3
|
||||
ansible_user=ansible
|
||||
ansible_ssh_private_key_file=~/.ssh/id_ed25519
|
||||
|
||||
[cluster]
|
||||
manager ansible_host=follow.mngoma.lab
|
||||
worker ansible_host=worker2.mngoma.lab
|
||||
|
||||
[workers]
|
||||
worker ansible_host=worker2.mngoma.lab
|
||||
20
k3s/ansible/config/safe-cluster-startup.yml
Normal file
20
k3s/ansible/config/safe-cluster-startup.yml
Normal file
@@ -0,0 +1,20 @@
|
||||
---
|
||||
- name: Ensure manager node is running k3s / start if needed
|
||||
hosts: manager
|
||||
become: true
|
||||
tasks:
|
||||
- name: Start k3s service on manager
|
||||
systemd:
|
||||
name: k3s
|
||||
state: started
|
||||
enabled: true
|
||||
|
||||
- name: Ensure worker nodes are running k3s-agent / start if needed
|
||||
hosts: workers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Start k3s-agent service on worker nodes
|
||||
systemd:
|
||||
name: k3s-agent
|
||||
state: started
|
||||
enabled: true
|
||||
256
k3s/ansible/create-cluster.yml
Normal file
256
k3s/ansible/create-cluster.yml
Normal file
@@ -0,0 +1,256 @@
|
||||
---
|
||||
- name: Gather IPv4 address facts for all hosts
|
||||
hosts: all
|
||||
gather_facts: yes
|
||||
vars:
|
||||
dns_server: "192.168.1.151"
|
||||
tasks:
|
||||
- name: Configure systemd-resolved to use custom DNS
|
||||
become: true
|
||||
copy:
|
||||
dest: /etc/systemd/resolved.conf
|
||||
content: |
|
||||
[Resolve]
|
||||
DNS={{ dns_server }}
|
||||
FallbackDNS=192.168.1.1
|
||||
Domains=mngoma.lab
|
||||
DNSStubListener=yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Ensure systemd-resolved service is enabled and restarted
|
||||
become: true
|
||||
systemd:
|
||||
name: systemd-resolved
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Ensure host IPv4 address is available and stored as fact
|
||||
set_fact:
|
||||
node_ipv4: "{{ ansible_default_ipv4.address }}"
|
||||
when: ansible_default_ipv4 is defined and ansible_default_ipv4.address is defined
|
||||
|
||||
- name: Fail if IPv4 address could not be determined
|
||||
fail:
|
||||
msg: "Could not determine IPv4 address for {{ inventory_hostname }}. Please check network configuration."
|
||||
when: node_ipv4 is not defined
|
||||
|
||||
- name: Ensure /home/{{ ansible_user }}/k3s directory exists
|
||||
become: yes
|
||||
file:
|
||||
path: /home/{{ ansible_user }}/k3s
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0777'
|
||||
|
||||
- name: Initialise the K3s control plane (manager)
|
||||
hosts: manager
|
||||
become: yes
|
||||
vars:
|
||||
k3s_version: v1.29.4+k3s1
|
||||
kubeconfig_dir: "/home/{{ ansible_user }}/.kube"
|
||||
kubeconfig_file: "{{ kubeconfig_dir }}/config"
|
||||
tasks:
|
||||
- name: Install required apt dependencies
|
||||
apt:
|
||||
name:
|
||||
- curl
|
||||
- python3-pip
|
||||
- python3-venv
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Create a Python virtual environment for Ansible k8s modules
|
||||
command: python3 -m venv /opt/ansible-venv
|
||||
args:
|
||||
creates: /opt/ansible-venv
|
||||
|
||||
- name: Install Kubernetes and OpenShift libraries in the venv
|
||||
command: /opt/ansible-venv/bin/pip install kubernetes openshift
|
||||
|
||||
- name: Install k3s on manager (control plane)
|
||||
shell: |
|
||||
curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION={{ k3s_version }} sh -
|
||||
args:
|
||||
creates: /usr/local/bin/k3s
|
||||
|
||||
- name: Gather architecture for kubectl
|
||||
set_fact:
|
||||
kubectl_arch: |
|
||||
{% if ansible_architecture == "x86_64" %}
|
||||
amd64
|
||||
{% elif "armv7l" in ansible_architecture %}
|
||||
arm
|
||||
{% elif "aarch64" in ansible_architecture %}
|
||||
arm64
|
||||
{% else %}
|
||||
{{ ansible_architecture }}
|
||||
{% endif %}
|
||||
|
||||
- name: Download latest kubectl binary
|
||||
shell: |
|
||||
curl -Lo /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/{{ kubectl_arch }}/kubectl"
|
||||
args:
|
||||
creates: /usr/local/bin/kubectl
|
||||
|
||||
- name: Make kubectl executable
|
||||
file:
|
||||
path: /usr/local/bin/kubectl
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Validate kubectl version
|
||||
shell: kubectl version --client --output=yaml
|
||||
register: kubectl_version
|
||||
changed_when: false
|
||||
|
||||
- name: Show kubectl version
|
||||
debug:
|
||||
var: kubectl_version.stdout
|
||||
|
||||
- name: Ensure .kube directory exists for ansible user
|
||||
become_user: "{{ ansible_user }}"
|
||||
file:
|
||||
path: "{{ kubeconfig_dir }}"
|
||||
state: directory
|
||||
owner: "{{ ansible_user }}"
|
||||
group: "{{ ansible_user }}"
|
||||
mode: '0700'
|
||||
|
||||
- name: Copy kubeconfig file to ansible user home
|
||||
become: true
|
||||
copy:
|
||||
src: /etc/rancher/k3s/k3s.yaml
|
||||
dest: "{{ kubeconfig_file }}"
|
||||
owner: "{{ ansible_user }}"
|
||||
group: "{{ ansible_user }}"
|
||||
mode: '0600'
|
||||
remote_src: yes
|
||||
|
||||
- name: Replace server IP in kubeconfig with manager's IP address
|
||||
become_user: "{{ ansible_user }}"
|
||||
lineinfile:
|
||||
path: "{{ kubeconfig_file }}"
|
||||
regexp: 'server: https://127\\.0\\.0\\.1:6443'
|
||||
line: " server: https://{{ node_ipv4 }}:6443"
|
||||
|
||||
- name: Get the cluster join token
|
||||
shell: cat /var/lib/rancher/k3s/server/node-token
|
||||
register: k3s_token
|
||||
changed_when: false
|
||||
|
||||
- name: Set fact for join token and manager IP
|
||||
set_fact:
|
||||
k3s_node_token: "{{ k3s_token.stdout }}"
|
||||
manager_ip: "{{ node_ipv4 }}"
|
||||
|
||||
- name: Add the join token and manager IP to hostvars for workers
|
||||
add_host:
|
||||
name: "cluster_primary"
|
||||
groups: join_info
|
||||
k3s_node_token: "{{ k3s_node_token }}"
|
||||
k3s_manager_ip: "{{ manager_ip }}"
|
||||
|
||||
- name: Install and join worker nodes to the control plane
|
||||
hosts: workers
|
||||
become: yes
|
||||
vars:
|
||||
k3s_version: v1.29.4+k3s1
|
||||
tasks:
|
||||
- name: Install required dependencies
|
||||
apt:
|
||||
name: [curl]
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Ensure /home/{{ ansible_user }}/k3s directory exists
|
||||
file:
|
||||
path: /home/{{ ansible_user }}/k3s
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0777'
|
||||
|
||||
- name: Set manager join information
|
||||
set_fact:
|
||||
k3s_node_token: "{{ hostvars[groups['join_info'][0]]['k3s_node_token'] }}"
|
||||
k3s_manager_ip: "{{ hostvars[groups['join_info'][0]]['k3s_manager_ip'] }}"
|
||||
|
||||
- name: Fail if manager's IP is not available
|
||||
fail:
|
||||
msg: "Could not determine manager's IP for joining cluster!"
|
||||
when: k3s_manager_ip is not defined
|
||||
|
||||
- name: Install k3s agent (worker)
|
||||
shell: |
|
||||
curl -sfL https://get.k3s.io | K3S_URL=https://{{ k3s_manager_ip }}:6443 K3S_TOKEN={{ k3s_node_token }} INSTALL_K3S_VERSION={{ k3s_version }} sh -
|
||||
args:
|
||||
creates: /usr/local/bin/k3s-agent
|
||||
|
||||
- name: Gather architecture for kubectl
|
||||
set_fact:
|
||||
kubectl_arch: |
|
||||
{% if ansible_architecture == "x86_64" %}
|
||||
amd64
|
||||
{% elif "armv7l" in ansible_architecture %}
|
||||
arm
|
||||
{% elif "aarch64" in ansible_architecture %}
|
||||
arm64
|
||||
{% else %}
|
||||
{{ ansible_architecture }}
|
||||
{% endif %}
|
||||
|
||||
- name: Download latest kubectl binary (worker)
|
||||
shell: |
|
||||
curl -Lo /usr/local/bin/kubectl "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/{{ kubectl_arch }}/kubectl"
|
||||
args:
|
||||
creates: /usr/local/bin/kubectl
|
||||
|
||||
- name: Make kubectl executable (worker)
|
||||
file:
|
||||
path: /usr/local/bin/kubectl
|
||||
mode: '0755'
|
||||
owner: root
|
||||
group: root
|
||||
|
||||
- name: Verify cluster nodes from manager node and configure storage
|
||||
hosts: manager
|
||||
become: yes
|
||||
vars:
|
||||
kubeconfig_file: "/home/{{ ansible_user }}/.kube/config"
|
||||
tasks:
|
||||
- name: Wait for all worker nodes to join the cluster
|
||||
become_user: "{{ ansible_user }}"
|
||||
shell: |
|
||||
for i in {1..10}; do
|
||||
[ $(kubectl --kubeconfig={{ kubeconfig_file }} get nodes | grep -c worker) -ge 1 ] && exit 0
|
||||
sleep 15
|
||||
done
|
||||
exit 1
|
||||
register: wait_worker
|
||||
failed_when: wait_worker.rc != 0
|
||||
|
||||
- name: List all k3s nodes
|
||||
become_user: "{{ ansible_user }}"
|
||||
shell: kubectl --kubeconfig={{ kubeconfig_file }} get nodes -o wide
|
||||
register: all_nodes
|
||||
|
||||
- name: Show current k3s cluster nodes
|
||||
debug:
|
||||
var: all_nodes.stdout
|
||||
|
||||
- name: Create StorageClass for /home/ansible/k3s INLINE
|
||||
vars:
|
||||
ansible_python_interpreter: /opt/ansible-venv/bin/python
|
||||
kubernetes.core.k8s:
|
||||
kubeconfig: "{{ kubeconfig_file }}"
|
||||
definition:
|
||||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: local-pvs
|
||||
provisioner: kubernetes.io/no-provisioner
|
||||
volumeBindingMode: WaitForFirstConsumer
|
||||
131
k3s/ansible/create-loadbalancer.yml
Normal file
131
k3s/ansible/create-loadbalancer.yml
Normal file
@@ -0,0 +1,131 @@
|
||||
# create-loadbalancer.yml
|
||||
- name: Install and configure HAProxy with SSL termination and managed DNS
|
||||
hosts: alpha
|
||||
become: yes
|
||||
vars:
|
||||
ssl_cert_path: "/etc/ssl/certs/haproxy.pem"
|
||||
dns_server: "192.168.1.151"
|
||||
|
||||
tasks:
|
||||
- name: Install HAProxy and dependencies
|
||||
apt:
|
||||
name:
|
||||
- haproxy
|
||||
- openssl
|
||||
state: present
|
||||
update_cache: yes
|
||||
|
||||
- name: Ensure cert directory exists
|
||||
file:
|
||||
path: /etc/ssl/certs
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
|
||||
- name: Generate private key for HAProxy
|
||||
community.crypto.openssl_privatekey:
|
||||
path: /etc/ssl/certs/haproxy.key
|
||||
size: 2048
|
||||
type: RSA
|
||||
mode: '0600'
|
||||
|
||||
- name: Generate a Certificate Signing Request (CSR) for HAProxy
|
||||
community.crypto.openssl_csr:
|
||||
path: /etc/ssl/certs/haproxy.csr
|
||||
privatekey_path: /etc/ssl/certs/haproxy.key
|
||||
common_name: "{{ inventory_hostname }}"
|
||||
subject_alt_name:
|
||||
- "DNS:{{ inventory_hostname }}"
|
||||
mode: "0644"
|
||||
|
||||
- name: Generate self-signed certificate for HAProxy
|
||||
community.crypto.x509_certificate:
|
||||
path: /etc/ssl/certs/haproxy.crt
|
||||
privatekey_path: /etc/ssl/certs/haproxy.key
|
||||
csr_path: /etc/ssl/certs/haproxy.csr
|
||||
provider: selfsigned
|
||||
selfsigned_not_before: "{{ '%Y%m%d%H%M%SZ' | strftime(ansible_date_time.epoch | int) }}"
|
||||
selfsigned_not_after: "{{ '%Y%m%d%H%M%SZ' | strftime((ansible_date_time.epoch | int) + (365*24*60*60)) }}"
|
||||
mode: "0644"
|
||||
|
||||
- name: Combine key and cert into .pem file for HAProxy
|
||||
shell: cat /etc/ssl/certs/haproxy.key /etc/ssl/certs/haproxy.crt > {{ ssl_cert_path }}
|
||||
args:
|
||||
creates: "{{ ssl_cert_path }}"
|
||||
|
||||
- name: Configure systemd-resolved to use custom DNS
|
||||
become: true
|
||||
copy:
|
||||
dest: /etc/systemd/resolved.conf
|
||||
content: |
|
||||
[Resolve]
|
||||
DNS={{ dns_server }}
|
||||
FallbackDNS=192.168.1.1
|
||||
Domains=mngoma.lab
|
||||
DNSStubListener=yes
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Ensure systemd-resolved service is enabled and restarted
|
||||
become: true
|
||||
systemd:
|
||||
name: systemd-resolved
|
||||
state: restarted
|
||||
enabled: yes
|
||||
|
||||
- name: Upload custom haproxy.cfg with SSL termination and HTTPS-only backend
|
||||
copy:
|
||||
dest: /etc/haproxy/haproxy.cfg
|
||||
content: |
|
||||
global
|
||||
log /dev/log local0
|
||||
log /dev/log local1 notice
|
||||
chroot /var/lib/haproxy
|
||||
stats socket /run/haproxy/admin.sock mode 660 level admin
|
||||
user haproxy
|
||||
group haproxy
|
||||
daemon
|
||||
tune.ssl.default-dh-param 2048
|
||||
|
||||
defaults
|
||||
log global
|
||||
mode http
|
||||
option httplog
|
||||
option dontlognull
|
||||
timeout connect 5000
|
||||
timeout client 50000
|
||||
timeout server 50000
|
||||
option forwardfor
|
||||
|
||||
resolvers dns
|
||||
nameserver dns1 {{ dns_server }}:53
|
||||
resolve_retries 3
|
||||
timeout resolve 2s
|
||||
timeout retry 1s
|
||||
hold valid 10s
|
||||
|
||||
frontend https_front
|
||||
bind *:443 ssl crt {{ ssl_cert_path }}
|
||||
mode http
|
||||
option forwardfor
|
||||
http-request set-header X-Forwarded-Proto https
|
||||
http-request set-header Host %[req.hdr(host)]
|
||||
default_backend app_clusters
|
||||
|
||||
backend app_clusters
|
||||
mode http
|
||||
balance roundrobin
|
||||
option httpchk GET /
|
||||
http-check expect status 100,101,102,103,200,201,202,203,204,205,206,207,208,226,300,301,302,303,304,305,306,307,308,400,401,402,403,404,405,406,407,408,409,410,411,412,413,414,415,416,417,418,421,422,423,424,425,426,428,429,431,451
|
||||
server lead_https lead.mngoma.lab:443 resolvers dns resolve-prefer ipv4 check ssl verify none
|
||||
owner: root
|
||||
group: root
|
||||
mode: "0644"
|
||||
|
||||
- name: Enable and start haproxy
|
||||
systemd:
|
||||
name: haproxy
|
||||
state: restarted
|
||||
enabled: yes
|
||||
35
k3s/ansible/safe-cluster-shutdown.yml
Normal file
35
k3s/ansible/safe-cluster-shutdown.yml
Normal file
@@ -0,0 +1,35 @@
|
||||
---
|
||||
- name: Drain and stop worker nodes first
|
||||
hosts: workers
|
||||
become: true
|
||||
tasks:
|
||||
- name: Drain worker node (optional - requires kubectl access)
|
||||
shell: kubectl drain {{ inventory_hostname }} --ignore-daemonsets --delete-emptydir-data || true
|
||||
delegate_to: manager
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Stop k3s-agent service on worker
|
||||
systemd:
|
||||
name: k3s-agent
|
||||
state: stopped
|
||||
enabled: false
|
||||
|
||||
- name: Poweroff worker node
|
||||
shell: shutdown -h now
|
||||
async: 0
|
||||
poll: 0
|
||||
|
||||
- name: Stop and poweroff the manager node
|
||||
hosts: manager
|
||||
become: true
|
||||
tasks:
|
||||
- name: Stop k3s (server) service
|
||||
systemd:
|
||||
name: k3s
|
||||
state: stopped
|
||||
enabled: false
|
||||
|
||||
- name: Poweroff manager node
|
||||
shell: shutdown -h now
|
||||
async: 0
|
||||
poll: 0
|
||||
168
k3s/stacks/dashy.yaml
Normal file
168
k3s/stacks/dashy.yaml
Normal file
@@ -0,0 +1,168 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: dashy
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: dashy-sa
|
||||
namespace: dashy
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: dashy-role
|
||||
namespace: dashy
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: dashy-rolebinding
|
||||
namespace: dashy
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: dashy-sa
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: dashy-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: dashy-config-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/dashy
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: dashy-config-pvc
|
||||
namespace: dashy
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: dashy-pvc
|
||||
namespace: dashy
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: dashy
|
||||
namespace: dashy
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: dashy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: dashy
|
||||
spec:
|
||||
serviceAccountName: dashy-sa
|
||||
containers:
|
||||
- name: dashy
|
||||
image: lissy93/dashy:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "128Mi"
|
||||
limits:
|
||||
cpu: "250m"
|
||||
memory: "256Mi"
|
||||
volumeMounts:
|
||||
- name: dashy-config
|
||||
mountPath: /app/data
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
failureThreshold: 18
|
||||
timeoutSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
initialDelaySeconds: 300
|
||||
periodSeconds: 10
|
||||
failureThreshold: 18
|
||||
timeoutSeconds: 10
|
||||
volumes:
|
||||
- name: dashy-config
|
||||
persistentVolumeClaim:
|
||||
claimName: dashy-config-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: dashy
|
||||
namespace: dashy
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: dashy
|
||||
ports:
|
||||
- name: web
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 8080
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: dashy-web
|
||||
namespace: dashy
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`dashboard.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: dashy
|
||||
port: 80
|
||||
scheme: http
|
||||
tls: {}
|
||||
331
k3s/stacks/droneci.yml
Normal file
331
k3s/stacks/droneci.yml
Normal file
@@ -0,0 +1,331 @@
|
||||
---
|
||||
# Namespace for Drone CI
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: droneci
|
||||
|
||||
---
|
||||
# Service Account
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: droneci-sa
|
||||
namespace: droneci
|
||||
|
||||
---
|
||||
# ConfigMap for Drone configuration
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: droneci-config
|
||||
namespace: droneci
|
||||
data:
|
||||
server.domain: "droneci.apps.mngoma.lab"
|
||||
server.proto: "https"
|
||||
server.runnername: "drone-runner"
|
||||
server.runnercapacity: "2"
|
||||
server.runnernetworks: "default"
|
||||
database.type: "postgres"
|
||||
database.host: "192.168.1.137:5432"
|
||||
database.name: "dronecim"
|
||||
gitea.server: "https://gitea.apps.mngoma.lab"
|
||||
gitea.server.internal: "https://gitea-server.gitea.svc.cluster.local"
|
||||
|
||||
---
|
||||
# Secret for Drone credentials
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: droneci-secret
|
||||
namespace: droneci
|
||||
type: Opaque
|
||||
data:
|
||||
server.rpctoken: MDFLNlFHTkE4VEMxQjJGVzNGV0JSWDJFNE4=
|
||||
database.username: YXBwX3VzZXI=
|
||||
database.password: MTIzNDU=
|
||||
database.connectstring: cG9zdGdyZXM6Ly9hcHBfdXNlcjoxMjM0NUAxOTIuMTY4LjEuMTM3OjU0MzIvZHJvbmVjaW0/c3NsbW9kZT1kaXNhYmxl
|
||||
gitea.clientid: MGRiNTliZDAtMGI3Ni00ODgxLThhODQtNjI0N2ZlYTExOTcz
|
||||
gitea.clientsecret: Z3RvX3l6bXB6NmJvZG52cmRnMnM1MmVmNWF1c3ozZTYzNGdyeTc0MjJqZ2hwd3ZnbGc2M2JtcnE=
|
||||
|
||||
---
|
||||
# Persistent Volume for Drone data
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: droneci-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 5Gi
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/droneci
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values: ["lead"]
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
|
||||
---
|
||||
# Persistent Volume Claim
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: droneci-pvc
|
||||
namespace: droneci
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
|
||||
---
|
||||
# Drone Server Deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: drone
|
||||
namespace: droneci
|
||||
labels:
|
||||
app.kubernetes.io/name: drone
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: drone
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: drone
|
||||
spec:
|
||||
serviceAccountName: droneci-sa
|
||||
hostAliases:
|
||||
- ip: "192.168.1.160"
|
||||
hostnames:
|
||||
- "gitea.apps.mngoma.lab"
|
||||
containers:
|
||||
- name: drone
|
||||
image: drone/drone:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
env:
|
||||
- name: DRONE_SERVER_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: server.domain
|
||||
- name: DRONE_SERVER_PROTO
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: server.proto
|
||||
- name: DRONE_SERVER_PORT
|
||||
value: ":80"
|
||||
- name: DRONE_TLS_AUTOCERT
|
||||
value: "false"
|
||||
- name: DRONE_LOGS_DEBUG
|
||||
value: "true"
|
||||
- name: DRONE_RPC_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: droneci-secret
|
||||
key: server.rpctoken
|
||||
- name: DRONE_DATABASE_DRIVER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: database.type
|
||||
- name: DRONE_DATABASE_DATASOURCE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: droneci-secret
|
||||
key: database.connectstring
|
||||
- name: DRONE_DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: droneci-secret
|
||||
key: database.username
|
||||
- name: DRONE_DB_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: droneci-secret
|
||||
key: database.password
|
||||
- name: DRONE_GITEA_SERVER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: gitea.server
|
||||
- name: DRONE_GITEA_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: droneci-secret
|
||||
key: gitea.clientid
|
||||
- name: DRONE_GITEA_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: droneci-secret
|
||||
key: gitea.clientsecret
|
||||
- name: DRONE_GITEA_SKIP_VERIFY
|
||||
value: "true"
|
||||
volumeMounts:
|
||||
- name: drone-storage
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: drone-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: droneci-pvc
|
||||
|
||||
---
|
||||
# Drone Server Service
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: drone-server
|
||||
namespace: droneci
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: drone
|
||||
ports:
|
||||
- name: http
|
||||
port: 80
|
||||
targetPort: 80
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
# Drone Runner Deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: drone-runner
|
||||
namespace: droneci
|
||||
labels:
|
||||
app.kubernetes.io/name: drone-runner
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: drone-runner
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: drone-runner
|
||||
spec:
|
||||
serviceAccountName: droneci-sa
|
||||
hostAliases:
|
||||
- ip: "192.168.1.160"
|
||||
hostnames:
|
||||
- "droneci.apps.mngoma.lab"
|
||||
containers:
|
||||
- name: runner
|
||||
image: drone/drone-runner-kube:latest
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
env:
|
||||
# propagate SSL skip and internal Gitea to ephemeral pods
|
||||
- name: DRONE_RUNNER_ENV_VARS
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: gitea.server.internal
|
||||
- name: DRONE_RPC_HOST
|
||||
value: drone-server.droneci.svc.cluster.local
|
||||
- name: DRONE_RPC_PROTO
|
||||
value: "http"
|
||||
- name: DRONE_RPC_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: droneci-secret
|
||||
key: server.rpctoken
|
||||
- name: DRONE_RUNNER_NAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: server.runnername
|
||||
- name: DRONE_RUNNER_CAPACITY
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: server.runnercapacity
|
||||
- name: DRONE_RUNNER_NETWORKS
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: droneci-config
|
||||
key: server.runnernetworks
|
||||
resources:
|
||||
requests:
|
||||
memory: "128Mi"
|
||||
cpu: "200m"
|
||||
limits:
|
||||
memory: "256Mi"
|
||||
cpu: "400m"
|
||||
|
||||
---
|
||||
# Drone IngressRoute for Traefik
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: droneci-web
|
||||
namespace: droneci
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`droneci.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: drone-server
|
||||
port: 80
|
||||
scheme: http
|
||||
tls: {}
|
||||
---
|
||||
# ClusterRole for Drone CI Service Account
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: droneci-cluster-role
|
||||
rules:
|
||||
- apiGroups: [""] # core API
|
||||
resources: ["pods", "pods/exec", "pods/log", "services", "endpoints", "configmaps", "secrets", "persistentvolumeclaims", "namespaces"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "replicasets", "statefulsets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["jobs", "cronjobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["poddisruptionbudgets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
|
||||
---
|
||||
# ClusterRoleBinding for Drone CI Service Account
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: droneci-cluster-rolebinding
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: droneci-sa
|
||||
namespace: droneci
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: droneci-cluster-role
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
170
k3s/stacks/flame.yml
Normal file
170
k3s/stacks/flame.yml
Normal file
@@ -0,0 +1,170 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: flame
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: flame-sa
|
||||
namespace: flame
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: flame-secret
|
||||
namespace: flame
|
||||
type: Opaque
|
||||
data:
|
||||
app.password: MTIzNDU=
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: flame-role
|
||||
namespace: flame
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: flame-rolebinding
|
||||
namespace: flame
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: flame-sa
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: flame-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: flame-config-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/flame
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: flame-config-pvc
|
||||
namespace: flame
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: flame
|
||||
namespace: flame
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: flame
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: flame
|
||||
spec:
|
||||
serviceAccountName: flame-sa
|
||||
containers:
|
||||
- name: flame
|
||||
image: pawelmalak/flame
|
||||
env:
|
||||
- name: PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: flame-secret
|
||||
key: app.password
|
||||
ports:
|
||||
- containerPort: 5005
|
||||
resources:
|
||||
requests:
|
||||
cpu: "100m"
|
||||
memory: "128Mi"
|
||||
limits:
|
||||
cpu: "250m"
|
||||
memory: "256Mi"
|
||||
volumeMounts:
|
||||
- name: flame-config
|
||||
mountPath: /app/data
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 5005
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
failureThreshold: 10
|
||||
timeoutSeconds: 5
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 5005
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
failureThreshold: 10
|
||||
timeoutSeconds: 5
|
||||
volumes:
|
||||
- name: flame-config
|
||||
persistentVolumeClaim:
|
||||
claimName: flame-config-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: flame
|
||||
namespace: flame
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: flame
|
||||
ports:
|
||||
- name: web
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 5005
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: flame-web
|
||||
namespace: flame
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`dashboard.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: flame
|
||||
port: 80
|
||||
scheme: http
|
||||
tls: {}
|
||||
208
k3s/stacks/gitea.yml
Normal file
208
k3s/stacks/gitea.yml
Normal file
@@ -0,0 +1,208 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: gitea
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: gitea-sa
|
||||
namespace: gitea
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: gitea-config
|
||||
namespace: gitea
|
||||
data:
|
||||
server.domain: "gitea.apps.mngoma.lab"
|
||||
server.rooturl: "https://gitea.apps.mngoma.lab"
|
||||
database.type: "postgres"
|
||||
database.host: "192.168.1.137:5432"
|
||||
database.name: "giteam"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: gitea-secret
|
||||
namespace: gitea
|
||||
type: Opaque
|
||||
data:
|
||||
database.username: YXBwX3VzZXI=
|
||||
database.password: MTIzNDU=
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: gitea-role
|
||||
namespace: gitea
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "endpoints", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: gitea-rolebinding
|
||||
namespace: gitea
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gitea-sa
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: gitea-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: gitea-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 5Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/gitea
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-pvc
|
||||
namespace: gitea
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: gitea
|
||||
namespace: gitea
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-server
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: gitea-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-server
|
||||
spec:
|
||||
serviceAccountName: gitea-sa
|
||||
containers:
|
||||
- name: gitea
|
||||
image: gitea/gitea:latest
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
- containerPort: 22
|
||||
volumeMounts:
|
||||
- name: gitea-data
|
||||
mountPath: /data
|
||||
env:
|
||||
- name: USER_UID
|
||||
value: "1000"
|
||||
- name: USER_GID
|
||||
value: "1000"
|
||||
- name: GITEA_SERVER_ROOT_URL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: gitea-config
|
||||
key: server.rooturl
|
||||
- name: GITEA_SERVER_DOMAIN
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: gitea-config
|
||||
key: server.domain
|
||||
- name: GITEA__database__TYPE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: gitea-config
|
||||
key: database.type
|
||||
- name: GITEA__database__HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: gitea-config
|
||||
key: database.host
|
||||
- name: GITEA__database__USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-secret
|
||||
key: database.username
|
||||
- name: GITEA__database__PASSWD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-secret
|
||||
key: database.password
|
||||
- name: GITEA__database__NAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: gitea-config
|
||||
key: database.name
|
||||
resources:
|
||||
requests:
|
||||
memory: "512Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "2Gi"
|
||||
cpu: "500m"
|
||||
volumes:
|
||||
- name: gitea-data
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: gitea-server
|
||||
namespace: gitea
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: gitea-server
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 3000
|
||||
targetPort: 3000
|
||||
- name: ssh
|
||||
protocol: TCP
|
||||
port: 22
|
||||
targetPort: 22
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: gitea-web
|
||||
namespace: gitea
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`gitea.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: gitea-server
|
||||
port: 3000
|
||||
scheme: http
|
||||
tls: {}
|
||||
156
k3s/stacks/mariadb.yml
Normal file
156
k3s/stacks/mariadb.yml
Normal file
@@ -0,0 +1,156 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: mariadb
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mariadb-secret
|
||||
namespace: mariadb
|
||||
type: Opaque
|
||||
data:
|
||||
root.password: UDRvMzBB
|
||||
database.username: cm9vdA==
|
||||
database.password: NXBFMjZa
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: mariadb-sa
|
||||
namespace: mariadb
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: mariadb-role
|
||||
namespace: mariadb
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: mariadb-rolebinding
|
||||
namespace: mariadb
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mariadb-sa
|
||||
namespace: mariadb
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: mariadb-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: mariadb-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 10Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/mariadb
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mariadb-pvc
|
||||
namespace: mariadb
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mariadb
|
||||
namespace: mariadb
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mariadb
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mariadb
|
||||
spec:
|
||||
serviceAccountName: mariadb-sa
|
||||
containers:
|
||||
- name: mariadb
|
||||
image: mariadb:11
|
||||
restartPolicy: Always
|
||||
env:
|
||||
- name: MYSQL_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mariadb-secret
|
||||
key: root.password
|
||||
- name: MYSQL_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mariadb-secret
|
||||
key: database.username
|
||||
- name: MYSQL_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mariadb-secret
|
||||
key: database.password
|
||||
ports:
|
||||
- containerPort: 3306
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/mysql
|
||||
name: mariadb-data
|
||||
volumes:
|
||||
- name: mariadb-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mariadb-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mariadb
|
||||
namespace: mariadb
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mariadb
|
||||
ports:
|
||||
- port: 3306
|
||||
targetPort: 3306
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: mariadb-ingress
|
||||
namespace: mariadb
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`mariadb.database.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: mariadb
|
||||
port: 3306
|
||||
tls: {}
|
||||
166
k3s/stacks/mongodb.yml
Normal file
166
k3s/stacks/mongodb.yml
Normal file
@@ -0,0 +1,166 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: mongodb
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mongodb-secret
|
||||
namespace: mongodb
|
||||
type: Opaque
|
||||
data:
|
||||
root.username: YWRtaW4=
|
||||
root.password: bGpUMTkx
|
||||
username: YXBwdXNlcg==
|
||||
password: VTNlNzRy
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mongodb-config
|
||||
namespace: mongodb
|
||||
data:
|
||||
database.name: "appdb"
|
||||
database.replicaset: "primary"
|
||||
database.port: "27017"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: mongodb-sa
|
||||
namespace: mongodb
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: mongodb-role
|
||||
namespace: mongodb
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: mongodb-rolebinding
|
||||
namespace: mongodb
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: mongodb-sa
|
||||
namespace: mongodb
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: mongodb-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: mongodb-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 10Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/mongodb
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mongodb-pvc
|
||||
namespace: mongodb
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mongodb
|
||||
namespace: mongodb
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mongodb
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mongodb
|
||||
spec:
|
||||
serviceAccountName: mongodb-sa
|
||||
containers:
|
||||
- name: mongodb
|
||||
image: mongo:6
|
||||
env:
|
||||
- name: MONGO_INITDB_ROOT_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mongodb-secret
|
||||
key: root.username
|
||||
- name: MONGO_INITDB_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mongodb-secret
|
||||
key: root.password
|
||||
- name: MONGO_INITDB_DATABASE
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: mongodb-config
|
||||
key: database.name
|
||||
ports:
|
||||
- containerPort: 27017
|
||||
volumeMounts:
|
||||
- mountPath: /data/db
|
||||
name: mongodb-data
|
||||
volumes:
|
||||
- name: mongodb-data
|
||||
persistentVolumeClaim:
|
||||
claimName: mongodb-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mongodb
|
||||
namespace: mongodb
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: mongodb
|
||||
ports:
|
||||
- port: 27017
|
||||
targetPort: 27017
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: mongodb-ingress
|
||||
namespace: mongodb
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`mongodb.database.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: mongodb
|
||||
port: 27017
|
||||
tls: {}
|
||||
196
k3s/stacks/nextcloud.yml
Normal file
196
k3s/stacks/nextcloud.yml
Normal file
@@ -0,0 +1,196 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: nextcloud
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nextcloud-config
|
||||
namespace: nextcloud
|
||||
data:
|
||||
server.trusteddomains: "nextcloud.apps.mngoma.lab"
|
||||
database.createdbuser: "false"
|
||||
database.host: "192.168.1.137"
|
||||
database.name: "nextcloudm"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: nextcloud-secret
|
||||
namespace: nextcloud
|
||||
type: Opaque
|
||||
data:
|
||||
root.username: a2h3ZXpp
|
||||
root.password: QmxhY2tzdGFyMkBob21l
|
||||
database.username: YXBwX3VzZXI=
|
||||
database.password: MTIzNDU=
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: nextcloud-sa
|
||||
namespace: nextcloud
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: nextcloud-role
|
||||
namespace: nextcloud
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "endpoints", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: nextcloud-rolebinding
|
||||
namespace: nextcloud
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: nextcloud-sa
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: nextcloud-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: nextcloud-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 5Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/nextcloud
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: nextcloud-pvc
|
||||
namespace: nextcloud
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nextcloud
|
||||
namespace: nextcloud
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nextcloud
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nextcloud
|
||||
spec:
|
||||
serviceAccountName: nextcloud-sa
|
||||
containers:
|
||||
- name: nextcloud
|
||||
image: nextcloud:27.1.7
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- name: nextcloud-data
|
||||
mountPath: /var/www/html
|
||||
env:
|
||||
- name: NEXTCLOUD_ADMIN_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-secret
|
||||
key: root.username
|
||||
- name: NEXTCLOUD_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-secret
|
||||
key: root.password
|
||||
- name: NEXTCLOUD_TRUSTED_DOMAINS
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: nextcloud-config
|
||||
key: server.trusteddomains
|
||||
- name: POSTGRES_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: nextcloud-config
|
||||
key: database.host
|
||||
- name: POSTGRES_DB
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: nextcloud-config
|
||||
key: database.name
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-secret
|
||||
key: database.username
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nextcloud-secret
|
||||
key: database.password
|
||||
- name: NC_SETUP_CREATE_DB_USER
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: nextcloud-config
|
||||
key: database.createdbuser
|
||||
volumes:
|
||||
- name: nextcloud-data
|
||||
persistentVolumeClaim:
|
||||
claimName: nextcloud-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nextcloud
|
||||
namespace: nextcloud
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: nextcloud
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: nextcloud-web
|
||||
namespace: nextcloud
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`nextcloud.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: nextcloud
|
||||
port: 80
|
||||
scheme: http
|
||||
tls: {}
|
||||
101
k3s/stacks/nosqlclient.yml
Normal file
101
k3s/stacks/nosqlclient.yml
Normal file
@@ -0,0 +1,101 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: nosqlclient
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: nosqlclient-secret
|
||||
namespace: nosqlclient
|
||||
type: Opaque
|
||||
data:
|
||||
mongodb-uri: bW9uZ29kYjovL2FkbWluOkJsYWNrc3RhcjIlNDBob21lQGRhdGFiYXNlLm1uZ29tYS5sYWI6MjcwMTcvYWRtaW4=
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: nosqlclient-sa
|
||||
namespace: nosqlclient
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: nosqlclient-role
|
||||
namespace: nosqlclient
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: nosqlclient-rolebinding
|
||||
namespace: nosqlclient
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: nosqlclient-sa
|
||||
namespace: nosqlclient
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: nosqlclient-role
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nosqlclient
|
||||
namespace: nosqlclient
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nosqlclient
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nosqlclient
|
||||
spec:
|
||||
serviceAccountName: nosqlclient-sa
|
||||
containers:
|
||||
- name: nosqlclient
|
||||
image: mongoclient/mongoclient:latest
|
||||
env:
|
||||
- name: MONGO_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nosqlclient-secret
|
||||
key: mongodb-uri
|
||||
ports:
|
||||
- containerPort: 3000
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nosqlclient
|
||||
namespace: nosqlclient
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: nosqlclient
|
||||
ports:
|
||||
- port: 3000
|
||||
targetPort: 3000
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: nosqlclient-ingress
|
||||
namespace: nosqlclient
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`mongodb.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: nosqlclient
|
||||
port: 3000
|
||||
tls: {}
|
||||
159
k3s/stacks/pgadmin.yml
Normal file
159
k3s/stacks/pgadmin.yml
Normal file
@@ -0,0 +1,159 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: pgadmin
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: pgadmin-config
|
||||
namespace: pgadmin
|
||||
data:
|
||||
server.email: "khwezi@mngoma.lab"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: pgadmin-secret
|
||||
namespace: pgadmin
|
||||
type: Opaque
|
||||
data:
|
||||
server.password: M3pDQTQz
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: pgadmin-sa
|
||||
namespace: pgadmin
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: pgadmin-role
|
||||
namespace: pgadmin
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: pgadmin-rolebinding
|
||||
namespace: pgadmin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: pgadmin-sa
|
||||
namespace: pgadmin
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: pgadmin-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: pgadmin-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 2Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/pgadmin
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: pgadmin-pvc
|
||||
namespace: pgadmin
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: pgadmin
|
||||
namespace: pgadmin
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: pgadmin
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pgadmin
|
||||
spec:
|
||||
serviceAccountName: pgadmin-sa
|
||||
securityContext:
|
||||
runAsUser: 5050
|
||||
runAsGroup: 5050
|
||||
fsGroup: 5050
|
||||
containers:
|
||||
- name: pgadmin
|
||||
image: dpage/pgadmin4:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- name: pgadmin-data
|
||||
mountPath: /var/lib/pgadmin
|
||||
env:
|
||||
- name: PGADMIN_DEFAULT_EMAIL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: pgadmin-config
|
||||
key: server.email
|
||||
- name: PGADMIN_DEFAULT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: pgadmin-secret
|
||||
key: server.password
|
||||
volumes:
|
||||
- name: pgadmin-data
|
||||
persistentVolumeClaim:
|
||||
claimName: pgadmin-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: pgadmin
|
||||
namespace: pgadmin
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: pgadmin
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: pgadmin-ingress
|
||||
namespace: pgadmin
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`pgadmin.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: pgadmin
|
||||
port: 80
|
||||
tls: {}
|
||||
126
k3s/stacks/phpmyadmin.yml
Normal file
126
k3s/stacks/phpmyadmin.yml
Normal file
@@ -0,0 +1,126 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: phpmyadmin
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: phpmyadmin-config
|
||||
namespace: phpmyadmin
|
||||
data:
|
||||
database.address: "192.168.1.137"
|
||||
database.port: "3306"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: mysql-secret
|
||||
namespace: phpmyadmin
|
||||
type: Opaque
|
||||
data:
|
||||
username: cm9vdA==
|
||||
password: QmxhY2tzdGFyMkBob21l
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: phpmyadmin-sa
|
||||
namespace: phpmyadmin
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: phpmyadmin-role
|
||||
namespace: phpmyadmin
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: phpmyadmin-rolebinding
|
||||
namespace: phpmyadmin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: phpmyadmin-sa
|
||||
namespace: phpmyadmin
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: phpmyadmin-role
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: phpmyadmin
|
||||
namespace: phpmyadmin
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: phpmyadmin
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: phpmyadmin
|
||||
spec:
|
||||
serviceAccountName: phpmyadmin-sa
|
||||
containers:
|
||||
- name: phpmyadmin
|
||||
image: phpmyadmin/phpmyadmin:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
env:
|
||||
- name: PMA_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: phpmyadmin-config
|
||||
key: database.address
|
||||
- name: PMA_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: phpmyadmin-config
|
||||
key: database.port
|
||||
- name: PMA_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mysql-secret
|
||||
key: username
|
||||
- name: PMA_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: mysql-secret
|
||||
key: password
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: phpmyadmin
|
||||
namespace: phpmyadmin
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: phpmyadmin
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: phpmyadmin-ingress
|
||||
namespace: phpmyadmin
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`phpmyadmin.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: phpmyadmin
|
||||
port: 80
|
||||
tls: {}
|
||||
127
k3s/stacks/portainer.yml
Normal file
127
k3s/stacks/portainer.yml
Normal file
@@ -0,0 +1,127 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: portainer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: portainer-sa
|
||||
namespace: portainer
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: portainer-admin-binding
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: cluster-admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: portainer-sa
|
||||
namespace: portainer
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: portainer-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 10Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/portainer
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: portainer-pvc
|
||||
namespace: portainer
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: portainer
|
||||
namespace: portainer
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: portainer
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: portainer
|
||||
spec:
|
||||
serviceAccountName: portainer-sa
|
||||
containers:
|
||||
- name: portainer
|
||||
image: portainer/portainer-ce:2.33.2
|
||||
ports:
|
||||
- containerPort: 9000
|
||||
- containerPort: 9443
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
volumes:
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: portainer-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: portainer
|
||||
namespace: portainer
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: portainer
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 9000
|
||||
targetPort: 9000
|
||||
- name: https
|
||||
protocol: TCP
|
||||
port: 9443
|
||||
targetPort: 9443
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: portainer-dashboard
|
||||
namespace: portainer
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`portainer.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: portainer
|
||||
port: 9000
|
||||
scheme: http
|
||||
tls: {}
|
||||
149
k3s/stacks/postgresql.yml
Normal file
149
k3s/stacks/postgresql.yml
Normal file
@@ -0,0 +1,149 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: postgresql
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: postgresql-secret
|
||||
namespace: postgresql
|
||||
type: Opaque
|
||||
data:
|
||||
username: cm9vdA==
|
||||
password: Mmh2MTdL
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: postgresql-sa
|
||||
namespace: postgresql
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: postgresql-role
|
||||
namespace: postgresql
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: postgresql-rolebinding
|
||||
namespace: postgresql
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: postgresql-sa
|
||||
namespace: postgresql
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: postgresql-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: postgresql-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 10Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/postgresql
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: postgresql-pvc
|
||||
namespace: postgresql
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: postgresql
|
||||
namespace: postgresql
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: postgresql
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: postgresql
|
||||
spec:
|
||||
serviceAccountName: postgresql-sa
|
||||
containers:
|
||||
- name: postgresql
|
||||
image: postgres:16
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgresql-secret
|
||||
key: username
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: postgresql-secret
|
||||
key: password
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
volumeMounts:
|
||||
- mountPath: /var/lib/postgresql/data
|
||||
name: postgresql-data
|
||||
volumes:
|
||||
- name: postgresql-data
|
||||
persistentVolumeClaim:
|
||||
claimName: postgresql-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: postgresql
|
||||
namespace: postgresql
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: postgresql
|
||||
ports:
|
||||
- port: 5432
|
||||
targetPort: 5432
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: postgresql-ingress
|
||||
namespace: postgresql
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`postgresql.database.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: postgresql
|
||||
port: 5432
|
||||
tls: {}
|
||||
107
k3s/stacks/redis.yml
Normal file
107
k3s/stacks/redis.yml
Normal file
@@ -0,0 +1,107 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: redis
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: redis-secret
|
||||
namespace: redis
|
||||
type: Opaque
|
||||
data:
|
||||
username: YWRtaW4=
|
||||
password: NjI4akZL
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: redis-sa
|
||||
namespace: redis
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: redis-role
|
||||
namespace: redis
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: redis-rolebinding
|
||||
namespace: redis
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: redis-sa
|
||||
namespace: redis
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: redis-role
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: redis
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redis
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redis
|
||||
spec:
|
||||
serviceAccountName: redis-sa
|
||||
containers:
|
||||
- name: redis
|
||||
image: redis:7
|
||||
ports:
|
||||
- containerPort: 6379
|
||||
env:
|
||||
- name: REDIS_USERNAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: redis-secret
|
||||
key: username
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: redis-secret
|
||||
key: password
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redis
|
||||
namespace: redis
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: redis
|
||||
ports:
|
||||
- port: 6379
|
||||
targetPort: 6379
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: redis-ingress
|
||||
namespace: redis
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`redis.database.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: redis
|
||||
port: 6379
|
||||
tls: {}
|
||||
189
k3s/stacks/redisinsight.yml
Normal file
189
k3s/stacks/redisinsight.yml
Normal file
@@ -0,0 +1,189 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: redisinsight
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: redisinsight-config
|
||||
namespace: redisinsight
|
||||
data:
|
||||
database.host: "192.168.1.137"
|
||||
database.port: "6379"
|
||||
database.instance: "redis"
|
||||
RI_LOG_LEVEL: "info"
|
||||
RI_ALLOW_PRIVILEGED: "true"
|
||||
RI_TELEMETRY: "false"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: redis-secret
|
||||
namespace: redisinsight
|
||||
type: Opaque
|
||||
data:
|
||||
password: NjI4akZL
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: redisinsight-sa
|
||||
namespace: redisinsight
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: redisinsight-role
|
||||
namespace: redisinsight
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: redisinsight-rolebinding
|
||||
namespace: redisinsight
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: redisinsight-sa
|
||||
namespace: redisinsight
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: redisinsight-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: redisinsight-pv
|
||||
spec:
|
||||
capacity:
|
||||
storage: 2Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/redisinsight
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: redisinsight-pvc
|
||||
namespace: redisinsight
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: redisinsight
|
||||
namespace: redisinsight
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: redisinsight
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: redisinsight
|
||||
spec:
|
||||
serviceAccountName: redisinsight-sa
|
||||
containers:
|
||||
- name: redisinsight
|
||||
image: redislabs/redisinsight:latest
|
||||
ports:
|
||||
- containerPort: 8001
|
||||
volumeMounts:
|
||||
- name: redisinsight-data
|
||||
mountPath: /db
|
||||
env:
|
||||
- name: RI_APP_HOST
|
||||
value: "0.0.0.0"
|
||||
- name: RI_APP_PORT
|
||||
value: "8001"
|
||||
- name: RI_LOG_LEVEL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: redisinsight-config
|
||||
key: RI_LOG_LEVEL
|
||||
- name: RI_ALLOW_PRIVILEGED
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: redisinsight-config
|
||||
key: RI_ALLOW_PRIVILEGED
|
||||
- name: RI_TELEMETRY
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: redisinsight-config
|
||||
key: RI_TELEMETRY
|
||||
- name: RI_DATABASE_0_NAME
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: redisinsight-config
|
||||
key: database.instance
|
||||
- name: RI_DATABASE_0_HOST
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: redisinsight-config
|
||||
key: database.host
|
||||
- name: RI_DATABASE_0_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: redisinsight-config
|
||||
key: database.port
|
||||
- name: RI_DATABASE_0_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: redis-secret
|
||||
key: password
|
||||
volumes:
|
||||
- name: redisinsight-data
|
||||
persistentVolumeClaim:
|
||||
claimName: redisinsight-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: redisinsight
|
||||
namespace: redisinsight
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: redisinsight
|
||||
ports:
|
||||
- port: 8001
|
||||
targetPort: 8001 # maybe 5540
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: redisinsight-ingress
|
||||
namespace: redisinsight
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`redisinsight.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: redisinsight
|
||||
port: 8001
|
||||
tls: {}
|
||||
163
k3s/stacks/registry-ui.yml
Normal file
163
k3s/stacks/registry-ui.yml
Normal file
@@ -0,0 +1,163 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: registry-ui
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: registry-credentials
|
||||
namespace: registry-ui
|
||||
type: Opaque
|
||||
data:
|
||||
username: YXBwX3VzZXI=
|
||||
password: MTIzNDU=
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: registry-ui-pv
|
||||
namespace: registry-ui
|
||||
spec:
|
||||
capacity:
|
||||
storage: 2Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/registry-ui
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: registry-ui-pvc
|
||||
namespace: registry-ui
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: registry-ui
|
||||
namespace: registry-ui
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: registry-ui
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: registry-ui
|
||||
spec:
|
||||
containers:
|
||||
- name: registry-ui
|
||||
image: joxit/docker-registry-ui:main
|
||||
ports:
|
||||
- containerPort: 80
|
||||
env:
|
||||
- name: SINGLE_REGISTRY
|
||||
value: "true"
|
||||
- name: REGISTRY_TITLE
|
||||
value: "Docker Registry UI"
|
||||
- name: DELETE_IMAGES
|
||||
value: "true"
|
||||
- name: SHOW_CONTENT_DIGEST
|
||||
value: "true"
|
||||
- name: SHOW_CATALOG_NB_TAGS
|
||||
value: "true"
|
||||
- name: CATALOG_MIN_BRANCHES
|
||||
value: "1"
|
||||
- name: CATALOG_MAX_BRANCHES
|
||||
value: "1"
|
||||
- name: TAGLIST_PAGE_SIZE
|
||||
value: "100"
|
||||
- name: REGISTRY_SECURED
|
||||
value: "false"
|
||||
- name: CATALOG_ELEMENTS_LIMIT
|
||||
value: "1000"
|
||||
- name: NGINX_PROXY_PASS_URL
|
||||
value: "http://registry-server.registry.svc.cluster.local:5000"
|
||||
- name: REGISTRY_AUTH_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: registry-credentials
|
||||
key: username
|
||||
- name: REGISTRY_AUTH_PASS
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: registry-credentials
|
||||
key: password
|
||||
volumeMounts:
|
||||
- name: registry-ui-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
volumes:
|
||||
- name: registry-ui-data
|
||||
persistentVolumeClaim:
|
||||
claimName: registry-ui-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: registry-ui
|
||||
namespace: registry-ui
|
||||
spec:
|
||||
selector:
|
||||
app: registry-ui
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: registry-ui-ingress
|
||||
namespace: registry-ui
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`registry-ui.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: registry-ui
|
||||
port: 80
|
||||
tls: {}
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: registry-ui-insecure
|
||||
namespace: registry-ui
|
||||
spec:
|
||||
entryPoints:
|
||||
- web
|
||||
routes:
|
||||
- match: Host(`registry-ui.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: registry-ui
|
||||
port: 80
|
||||
170
k3s/stacks/registry.yml
Normal file
170
k3s/stacks/registry.yml
Normal file
@@ -0,0 +1,170 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: registry
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: registry-pv
|
||||
namespace: registry
|
||||
spec:
|
||||
capacity:
|
||||
storage: 20Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/registry
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: registry-pvc
|
||||
namespace: registry
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: registry-http-secret
|
||||
namespace: registry
|
||||
type: Opaque
|
||||
data:
|
||||
http-secret: ZDlmOTNjOGEyMmQ2NDMyZWE4YTMwYTBkNDc5ZjBhMWY=
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: registry-basic-auth
|
||||
namespace: registry
|
||||
type: Opaque
|
||||
data:
|
||||
users: YXBwX3VzZXI6JGFwcjEkMTIzNDUk
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: registry
|
||||
namespace: registry
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: registry
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: registry
|
||||
spec:
|
||||
containers:
|
||||
- name: registry
|
||||
image: registry:2.8.2
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
name: http
|
||||
env:
|
||||
- name: REGISTRY_STORAGE_DELETE_ENABLED
|
||||
value: "true"
|
||||
- name: REGISTRY_HTTP_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: registry-http-secret
|
||||
key: http-secret
|
||||
- name: REGISTRY_HTTP_HEADERS_Access-Control-Allow-Origin
|
||||
value: '["https://registry-ui.apps.mngoma.lab","https://registry.apps.mngoma.lab"]'
|
||||
- name: REGISTRY_HTTP_HEADERS_Access-Control-Allow-Methods
|
||||
value: '["HEAD","GET","OPTIONS","DELETE","PUT","POST"]'
|
||||
- name: REGISTRY_HTTP_HEADERS_Access-Control-Allow-Credentials
|
||||
value: '["true"]'
|
||||
- name: REGISTRY_HTTP_HEADERS_Access-Control-Allow-Headers
|
||||
value: '["Authorization","Accept","Cache-Control","Content-Type","X-Requested-With"]'
|
||||
- name: REGISTRY_HTTP_HEADERS_Access-Control-Expose-Headers
|
||||
value: '["Docker-Content-Digest"]'
|
||||
volumeMounts:
|
||||
- name: registry-data
|
||||
mountPath: /var/lib/registry
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
volumes:
|
||||
- name: registry-data
|
||||
persistentVolumeClaim:
|
||||
claimName: registry-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: registry-server
|
||||
namespace: registry
|
||||
spec:
|
||||
selector:
|
||||
app: registry
|
||||
ports:
|
||||
- name: http
|
||||
port: 5000
|
||||
targetPort: 5000
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: registry-server-ingress
|
||||
namespace: registry
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`registry.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: registry-basic-auth
|
||||
services:
|
||||
- name: registry-server
|
||||
port: 5000
|
||||
tls: {}
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: registry-server-insecure
|
||||
namespace: registry
|
||||
spec:
|
||||
entryPoints:
|
||||
- web
|
||||
routes:
|
||||
- match: Host(`registry.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: registry-server
|
||||
port: 5000
|
||||
---
|
||||
apiVersion: traefik.containo.us/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: registry-basic-auth
|
||||
namespace: registry
|
||||
spec:
|
||||
basicAuth:
|
||||
secret: registry-basic-auth
|
||||
removeHeader: true
|
||||
72
k3s/stacks/searxng.yml
Normal file
72
k3s/stacks/searxng.yml
Normal file
@@ -0,0 +1,72 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: searxng
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: searxng-sa
|
||||
namespace: searxng
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: searxng
|
||||
namespace: searxng
|
||||
labels:
|
||||
app.kubernetes.io/name: searxng-server
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: searxng-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: searxng-server
|
||||
spec:
|
||||
serviceAccountName: searxng-sa
|
||||
containers:
|
||||
- name: searxng
|
||||
image: searxng/searxng:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
- name: SEARXNG_SERVER_HOST
|
||||
value: "0.0.0.0"
|
||||
- name: SEARXNG_SERVER_PORT
|
||||
value: "8080"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: searxng-server
|
||||
namespace: searxng
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: searxng-server
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: searxng-web
|
||||
namespace: searxng
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`searxng.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: searxng-server
|
||||
port: 8080
|
||||
scheme: http
|
||||
tls: {}
|
||||
141
k3s/stacks/uptime-kuma.yml
Normal file
141
k3s/stacks/uptime-kuma.yml
Normal file
@@ -0,0 +1,141 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: uptimekuma
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: uptimekuma-config
|
||||
namespace: uptimekuma
|
||||
data:
|
||||
server.port: "3001"
|
||||
server.disableusageanalytics: "true"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: uptimekuma-secret
|
||||
namespace: uptimekuma
|
||||
type: Opaque
|
||||
data:
|
||||
password: MWhEMjBn
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: uptimekuma-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 2Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/uptimekuma
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: uptimekuma-data
|
||||
namespace: uptimekuma
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: uptimekuma
|
||||
namespace: uptimekuma
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: uptimekuma
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: uptimekuma
|
||||
spec:
|
||||
containers:
|
||||
- name: uptimekuma
|
||||
image: louislam/uptime-kuma:latest
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- containerPort: 3001
|
||||
volumeMounts:
|
||||
- mountPath: /app/data
|
||||
name: uptimekuma-data
|
||||
env:
|
||||
- name: PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: uptimekuma-config
|
||||
key: server.port
|
||||
- name: server.disableusageanalytics
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: uptimekuma-config
|
||||
key: server.disableusageanalytics
|
||||
- name: password
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: uptimekuma-secret
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "500m"
|
||||
volumes:
|
||||
- name: uptimekuma-data
|
||||
persistentVolumeClaim:
|
||||
claimName: uptimekuma-data
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: uptimekuma
|
||||
namespace: uptimekuma
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: uptimekuma
|
||||
ports:
|
||||
- name: http
|
||||
port: 3001
|
||||
targetPort: 3001
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: uptimekuma-ingress
|
||||
namespace: uptimekuma
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`uptimekuma.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: uptimekuma
|
||||
port: 3001
|
||||
tls: {}
|
||||
181
k3s/stacks/wandbox.yml
Normal file
181
k3s/stacks/wandbox.yml
Normal file
@@ -0,0 +1,181 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: wandbox
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: wandbox-sa
|
||||
namespace: wandbox
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: wandbox-role
|
||||
namespace: wandbox
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "endpoints", "persistentvolumeclaims", "configmaps", "secrets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: wandbox-rolebinding
|
||||
namespace: wandbox
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: wandbox-sa
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: wandbox-role
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: wandbox-config
|
||||
namespace: wandbox
|
||||
data:
|
||||
wandbox.domain: "wandbox.apps.mngoma.lab"
|
||||
wandbox.rooturl: "https://wandbox.apps.mngoma.lab"
|
||||
wandbox.port: "5000"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: wandbox-secret
|
||||
namespace: wandbox
|
||||
type: Opaque
|
||||
data:
|
||||
api.key: cG1HeW9xUlBCYW1qdndRV2FRbzZWME9CdmJLS3BFS1RhWlF0bDRndUhMSGpYQlZwc0Y3dnJPZXhXMTNIRWFDRg==
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: wandbox-pv
|
||||
labels:
|
||||
type: local
|
||||
spec:
|
||||
capacity:
|
||||
storage: 5Gi
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
local:
|
||||
path: /home/ansible/k3s/makhiwane/wandbox
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- lead
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: wandbox-pvc
|
||||
namespace: wandbox
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
storageClassName: local-pvs
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: wandbox
|
||||
namespace: wandbox
|
||||
labels:
|
||||
app.kubernetes.io/name: wandbox
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: wandbox
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: wandbox
|
||||
spec:
|
||||
serviceAccountName: wandbox-sa
|
||||
containers:
|
||||
- name: wandbox
|
||||
image: melpon/wandbox:latest
|
||||
ports:
|
||||
- containerPort: 5000
|
||||
env:
|
||||
- name: WANDBOX_PORT
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: wandbox-config
|
||||
key: wandbox.port
|
||||
- name: WANDBOX_ROOTURL
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: wandbox-config
|
||||
key: wandbox.rooturl
|
||||
- name: WANDBOX_DOMAIN
|
||||
valueFrom:
|
||||
configMapKeyRef:
|
||||
name: wandbox-config
|
||||
key: wandbox.domain
|
||||
- name: API_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: wandbox-secret
|
||||
key: api.key
|
||||
volumeMounts:
|
||||
- name: wandbox-data
|
||||
mountPath: /data
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "250m"
|
||||
limits:
|
||||
memory: "1Gi"
|
||||
cpu: "500m"
|
||||
volumes:
|
||||
- name: wandbox-data
|
||||
persistentVolumeClaim:
|
||||
claimName: wandbox-pvc
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: wandbox-service
|
||||
namespace: wandbox
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: wandbox
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 5000
|
||||
type: ClusterIP
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: wandbox-web
|
||||
namespace: wandbox
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`wandbox.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: wandbox-service
|
||||
port: 80
|
||||
scheme: http
|
||||
tls: {}
|
||||
88
k3s/stacks/whoami.yml
Normal file
88
k3s/stacks/whoami.yml
Normal file
@@ -0,0 +1,88 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: whoami
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: whoami-sa
|
||||
namespace: whoami
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: whoami-role
|
||||
namespace: whoami
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: whoami-rolebinding
|
||||
namespace: whoami
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: whoami-sa
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: whoami-role
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: whoami
|
||||
namespace: whoami
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: whoami
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: whoami
|
||||
spec:
|
||||
serviceAccountName: whoami-sa
|
||||
containers:
|
||||
- name: whoami
|
||||
image: traefik/whoami
|
||||
ports:
|
||||
- containerPort: 80
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: whoami
|
||||
namespace: whoami
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: whoami
|
||||
ports:
|
||||
- name: http
|
||||
protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: whoami-web
|
||||
namespace: whoami
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`whoami.apps.mngoma.lab`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: whoami
|
||||
port: 80
|
||||
scheme: http
|
||||
tls: {}
|
||||
Reference in New Issue
Block a user