7 Commits

13 changed files with 415 additions and 44 deletions

View File

@ -5,42 +5,42 @@ releases:
- <<: *drone
installed: true
namespace: drone-service
createNamespace: false
createNamespace: true
- <<: *drone-runner-docker
installed: true
namespace: drone-service
createNamespace: false
createNamespace: true
- <<: *longhorn
installed: true
namespace: longhorn-system
createNamespace: false
createNamespace: true
- <<: *argocd
installed: true
namespace: argo-system
createNamespace: false
createNamespace: true
- <<: *nrodionov
installed: true
namespace: nrodionov-application
createNamespace: false
createNamespace: true
- <<: *minecraft
installed: true
namespace: minecraft-application
createNamespace: false
createNamespace: true
- <<: *gitea
installed: true
namespace: gitea-service
createNamespace: false
createNamespace: true
- <<: *funkwhale
installed: true
namespace: funkwhale-application
createNamespace: false
createNamespace: true
- <<: *prometheus
installed: true
@ -50,16 +50,11 @@ releases:
- <<: *loki
installed: true
namespace: monitoring-system
createNamespace: false
createNamespace: true
- <<: *promtail
installed: true
namespace: monitoring-system
createNamespace: false
- <<: *bitwarden
installed: false
namespace: bitwarden-application
createNamespace: true
- <<: *redis
@ -82,11 +77,6 @@ releases:
namespace: database-service
createNamespace: true
- <<: *mysql
installed: false
namespace: database-service
createNamespace: true
- <<: *docker-mailserver
installed: true
namespace: mail-service
@ -95,7 +85,7 @@ releases:
- <<: *istio-gateway-resources
installed: true
namespace: istio-system
createNamespace: false
createNamespace: true
- <<: *vaultwarden
createNamespace: true
@ -107,6 +97,16 @@ releases:
namespace: woodpecker-ci
createNamespace: true
- <<: *rook-ceph
installed: true
namespace: rook-ceph
createNamespace: true
- <<: *rook-ceph-cluster
installed: true
namespace: rook-ceph-cluster
createNamespace: true
bases:
- ../environments.yaml
- ../repositories.yaml

View File

@ -2,7 +2,7 @@ vaultwarden:
smtp:
username: ENC[AES256_GCM,data:6kAu3et5PmRgZ7B/qQQKA/hwsubozpBEcuzA,iv:cqNO3VWKFRWqBRAFTf2AyMQskuZvcDghseT2PWEsCjA=,tag:nkzugvJTJ/KhLuldXxdBrg==,type:str]
password:
value: ENC[AES256_GCM,data:9PJzeGeXiNN50GrWMxU1ho9+jHs=,iv:wOrU8g/xBBKFRYvDB1G/I+VG3lpvFdMirgJmP01PbhQ=,tag:dlDq9S+SQmlb4SZIGYhrlQ==,type:str]
value: ENC[AES256_GCM,data:rTCIH4vU7sfCNu6FxfdfyPKKQ01MQHBM0g==,iv:ZKD98V5W1GH0NZCfYG86AdFhbe8Ig+nCHFdU0NGcQT4=,tag:cL3fSAKntmWZ/QvSPYwbvw==,type:str]
adminToken:
value: ENC[AES256_GCM,data:PT62LcyiNqW1NVeuZ5+HTj8fzwSwuD1av/Z8S2GnR6j62+F8/aibhW/ATFG92chw++w=,iv:LnaRBem4dsggV4u4IlNjlWY301ajAHot2D259Y383m0=,tag:f24QDtGrtNJFA95Qo6Umqg==,type:str]
sops:
@ -20,8 +20,8 @@ sops:
U25tMkxQS1gzcyt6R2NkZnVLRVVoOWMKZSaIZxzTlYim2kmiHrQcgRu9XmWelRkT
HZZmSa0L9yEdksUCK3+iqjCZhQBYc/6qJHRYvuAaJ+/hs5RxuLUr8g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2023-10-20T07:01:25Z"
mac: ENC[AES256_GCM,data:Oa6UiHJR5U8Tquo/FmKM2LNR1l7Tdc95T55sl8IbC80ywC5hmJcpOdYXSeVzAdEtr2EauEH74FAwyFtjeFHpneRjkl8Hx0Vann3qBMJ1laxYEQhKESqeyJTcMv15Hu61aUQ+OhW9hP9xkcRCNmkXHa0KeoCXy1aloTWc3u7Ls8E=,iv:SsywMpg5KQvfsFbIRiZkEadtQ7Ce2AqjM9+zeaG/ZaM=,tag:X426dGhxmeMqDJnRs4Qhww==,type:str]
lastmodified: "2023-12-25T19:33:37Z"
mac: ENC[AES256_GCM,data:Fl9x8f4YlhAciCdRNRWukK4lj/OqP+TJ8+xEXUSb+1FqUAv/aHocy/f3IuzEhgq/+i9RSKORy2+glYBdK+tL50FzaPQCXz9YgYMtshsIkfkVIw2j9R7sqs5Uo5fQ6g5V3ir5/czb8FSqoS7S+2onyHxZawuG1XCWYPPLATVrKa8=,iv:7K6NABns5rzYIJgthRxqkGD5bQXKPhgIxoCs2ZS0JGY=,tag:FvTTObosyFZom45xuVABog==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.8.1

View File

@ -76,7 +76,7 @@ istio-gateway:
- '*'
port:
name: ssh
number: 22
number: 2022
protocol: TCP
- name: badhouseplants-minecraft
servers:

View File

@ -6,7 +6,7 @@ service:
protocol: TCP
targetPort: 25565
- name: ssh-gitea
port: 22
port: 2222
protocol: TCP
targetPort: 22
- name: http2
@ -21,10 +21,6 @@ service:
port: 1194
protocol: TCP
targetPort: 1194
- name: tcp
port: 25
protocol: TCP
targetPort: 25
# -----------
# -- Email
# -----------

View File

@ -1,7 +1,11 @@
metrics:
enabled: false
secretAnnotations:
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "gitea-service,funkwhale-application"
architecture: standalone
master:
persistence:
enabled: false
enabled: false

View File

@ -0,0 +1,96 @@
cephFileSystems:
- name: ceph-filesystem
spec:
metadataPool:
replicated:
size: 3
dataPools:
- failureDomain: host
replicated:
size: 3
name: data0
metadataServer:
activeCount: 1
activeStandby: true
resources:
limits:
cpu: "200m"
memory: "256Mi"
requests:
cpu: "50m"
memory: "128Mi"
priorityClassName: system-cluster-critical
storageClass:
enabled: true
isDefault: false
name: ceph-filesystem
pool: data0
reclaimPolicy: Delete
allowVolumeExpansion: true
volumeBindingMode: "Immediate"
mountOptions: []
parameters:
csi.storage.k8s.io/provisioner-secret-name: rook-csi-cephfs-provisioner
csi.storage.k8s.io/provisioner-secret-namespace: "{{ .Release.Namespace }}"
csi.storage.k8s.io/controller-expand-secret-name: rook-csi-cephfs-provisioner
csi.storage.k8s.io/controller-expand-secret-namespace: "{{ .Release.Namespace }}"
csi.storage.k8s.io/node-stage-secret-name: rook-csi-cephfs-node
csi.storage.k8s.io/node-stage-secret-namespace: "{{ .Release.Namespace }}"
csi.storage.k8s.io/fstype: ext4
cephObjectStores: []
# - name: ceph-objectstore
# spec:
# metadataPool:
# failureDomain: host
# replicated:
# size: 3
# dataPool:
# failureDomain: host
# erasureCoded:
# dataChunks: 2
# codingChunks: 1
# preservePoolsOnDelete: true
# gateway:
# port: 80
# resources:
# limits:
# cpu: "150m"
# memory: "256Mi"
# requests:
# cpu: "50m"
# memory: "128Mi"
# instances: 1
# priorityClassName: system-cluster-critical
# storageClass:
# enabled: true
# name: ceph-bucket
# reclaimPolicy: Delete
# volumeBindingMode: "Immediate"
# parameters:
# region: us-east-1
# ingress:
# enabled: false
cephClusterSpec:
resources:
mgr:
limits:
cpu: "200m"
memory: "512Mi"
requests:
cpu: "100m"
memory: "128Mi"
mon:
limits:
cpu: "200m"
memory: "512Mi"
requests:
cpu: "100m"
memory: "128Mi"
osd:
limits:
cpu: "200m"
memory: "2Gi"
requests:
cpu: "100m"
memory: "256Mi"

View File

@ -0,0 +1,215 @@
---
csi:
csiRBDProvisionerResource: |
- name : csi-provisioner
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-resizer
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-attacher
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-snapshotter
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-rbdplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-omap-generator
resource:
requests:
memory: 12Mi
cpu: 250m
limits:
memory: 1Gi
cpu: 500m
- name : liveness-prometheus
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
# -- CEPH CSI RBD plugin resource requirement list
# @default -- see values.yaml
csiRBDPluginResource: |
- name : driver-registrar
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
- name : csi-rbdplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
- name : liveness-prometheus
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
# -- CEPH CSI CephFS provisioner resource requirement list
# @default -- see values.yaml
csiCephFSProvisionerResource: |
- name : csi-provisioner
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-resizer
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-attacher
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-snapshotter
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-cephfsplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
- name : liveness-prometheus
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
# -- CEPH CSI CephFS plugin resource requirement list
# @default -- see values.yaml
csiCephFSPluginResource: |
- name : driver-registrar
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
- name : csi-cephfsplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
- name : liveness-prometheus
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
# -- CEPH CSI NFS provisioner resource requirement list
# @default -- see values.yaml
csiNFSProvisionerResource: |
- name : csi-provisioner
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 200m
- name : csi-nfsplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
- name : csi-attacher
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
# -- CEPH CSI NFS plugin resource requirement list
# @default -- see values.yaml
csiNFSPluginResource: |
- name : driver-registrar
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m
- name : csi-nfsplugin
resource:
requests:
memory: 128Mi
cpu: 50m
limits:
memory: 256Mi
cpu: 50m

View File

@ -18,6 +18,11 @@ ext-database:
credentials:
WOODPECKER_DATABASE_DATASOURCE: "postgres://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{ .Port }}/{{ .Database }}?sslmode=disable"
server:
#image:
# registry: git.badhouseplants.net
# repository: allanger/woodpecker-server
# pullPolicy: Always
# tag: icon
enabled: true
env:
WOODPECKER_GITEA: true
@ -33,14 +38,10 @@ server:
extraSecretNamesForEnvFrom:
- woodpecker-postgres16-creds
agent:
image:
# -- The image registry
image:
registry: git.badhouseplants.net
# -- The image repository
repository: allanger/woodpecker-agent
# -- The pull policy for the image
pullPolicy: Always
# -- Overrides the image tag whose default is the chart appVersion.
tag: dev
enabled: true
extraSecretNamesForEnvFrom: []

View File

@ -1,5 +1,5 @@
environments:
badhouseplants:
kubeContext: badhouseplants
kubeContext: badhouseplants-arm
etersoft:
kubeContext: etersoft

View File

@ -9,42 +9,47 @@ releases:
- <<: *metrics-server
installed: true
namespace: kube-system
createNamespace: false
createNamespace: true
- <<: *istio-base
installed: true
namespace: istio-system
createNamespace: false
createNamespace: true
- <<: *istio-gateway
installed: true
namespace: istio-system
createNamespace: false
createNamespace: true
- <<: *istiod
installed: true
namespace: istio-system
createNamespace: false
createNamespace: true
- <<: *cert-manager
installed: true
namespace: cert-manager
createNamespace: false
createNamespace: true
- <<: *minio
installed: true
namespace: minio-service
createNamespace: false
createNamespace: true
- <<: *openvpn
installed: true
namespace: openvpn-service
createNamespace: false
createNamespace: true
- <<: *metallb
installed: true
namespace: metallb-system
createNamespace: true
- <<: *reflector
installed: true
namespace: reflector-system
createNamespace: true
helmfiles:
- path: {{.Environment.Name }}/helmfile.yaml

View File

@ -352,3 +352,22 @@ templates:
- template: default-env-secrets
- template: ext-istio-resource
- template: ext-database
reflector: &reflector
name: reflector
chart: emberstack/reflector
version: 7.1.216
rook-ceph: &rook-ceph
name: rook-ceph
chart: rook/rook-ceph
version: v1.13.1
inherit:
- template: default-env-values
rook-ceph-cluster: &rook-ceph-cluster
name: rook-ceph-cluster
chart: rook/rook-ceph-cluster
version: v1.13.1
inherit:
- template: default-env-values

View File

@ -1,4 +1,3 @@
---
repositories:
- name: metrics-server
url: https://kubernetes-sigs.github.io/metrics-server/
@ -40,3 +39,9 @@ repositories:
url: https://badhouseplants.github.io/helm-charts/
- name: woodpecker
url: https://woodpecker-ci.org
- name: firefly-iii
url: https://firefly-iii.github.io/kubernetes/
- name: emberstack
url: https://emberstack.github.io/helm-charts
- name: rook
url: https://charts.rook.io/release

30
test/test.yaml Normal file
View File

@ -0,0 +1,30 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: pvc-test
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi
---
apiVersion: v1
kind: Pod
metadata:
name: pvc-test
spec:
restartPolicy: Never
volumes:
- name: vol
persistentVolumeClaim:
claimName: pvc-test
containers:
- name: pv-recycler
image: ubuntu
command: ["/bin/sh", "-c", "sleep 10000"]
volumeMounts:
- name: vol
mountPath: /data