rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

staged next wave of operators to add and configure

Browse Source
This commit is contained in:
Ryan Blundon
2025-08-01 13:43:38 -05:00
parent 4fd272ddf7
commit 7ffc2c983b
45 changed files with 1554 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

72
cluster/external-dns/cloudflare.yaml Normal file
View File

@@ -0,0 +1,72 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns-cloudflare
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns
template:
metadata:
labels:
app: external-dns
spec:
serviceAccountName: external-dns
containers:
- name: cloudflare
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
# - --source=service # ingress is also possible
- --source=ingress
- --ingress-class=nginx
- --domain-filter=mk-labs.cloud # (optional) limit to only example.com domains; change to match the zone created above.
- --provider=cloudflare
# - --cloudflare-proxied # (optional) enable the proxy feature of Cloudflare (DDOS protection, CDN...)
- --cloudflare-dns-records-per-page=5000 # (optional) configure how many DNS records to fetch per request
- --policy=sync # or upsert-only
env:
- name: CF_API_TOKEN
valueFrom:
secretKeyRef:
name: cloudflare-api-token
key: api-token
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: external-dns-cloudflare-monetnaildesign
spec:
strategy:
type: Recreate
selector:
matchLabels:
app: external-dns-monetnaildesign
template:
metadata:
labels:
app: external-dns-monetnaildesign
spec:
serviceAccountName: external-dns
containers:
- name: cloudflare
image: registry.k8s.io/external-dns/external-dns:v0.15.0
args:
# - --source=service # ingress is also possible
- --source=ingress
- --ingress-class=nginx
- --domain-filter=monetnaildesign.com # (optional) limit to only example.com domains; change to match the zone created above.
- --provider=cloudflare
# - --cloudflare-proxied # (optional) enable the proxy feature of Cloudflare (DDOS protection, CDN...)
- --cloudflare-dns-records-per-page=5000 # (optional) configure how many DNS records to fetch per request
- --policy=sync # or upsert-only
env:
- name: CF_API_TOKEN
valueFrom:
secretKeyRef:
name: cloudflare-api-token
key: api-token

33
cluster/external-dns/external-dns-operator.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: external-dns
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
destination:
name: in-cluster
namespace: external-dns
project: default
source:
path: 02-cluster-operators/external/external-dns
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: false
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: openshift-gitops
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

15
cluster/external-dns/externalsecrets.yaml Normal file
View File

@@ -0,0 +1,15 @@
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: cloudflare-api-token # This is the secret name
namespace: external-dns
spec:
secretStoreRef:
kind: ClusterSecretStore
name: doppler-cluster
refreshInterval: "1h"
data:
- secretKey: api-token
remoteRef:
key: CLOUDFLARE_TOKEN

16
cluster/external-dns/kustomization.yaml Normal file
View File

@@ -0,0 +1,16 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
# Operator deployment
- namespace.yaml
- operatorgroup.yaml
- subscription.yaml
# Deploy cluster resources
- externalsecrets.yaml
- scc.yaml
- cloudflare.yaml

14
cluster/external-dns/namespace.yaml Normal file
View File

@@ -0,0 +1,14 @@
---
apiVersion: v1
kind: Namespace
metadata:
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
name: external-dns-operator
labels:
argocd.argoproj.io/managed-by: openshift-gitops-operator
kubernetes.io/metadata.name: external-dns-operator
openshift.io/cluster-monitoring: 'true'
spec:
finalizers:
- kubernetes

9
cluster/external-dns/operatorgroup.yaml Normal file
View File

@@ -0,0 +1,9 @@
---
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: external-dns-operator
namespace: external-dns-operator
spec:
targetNamespaces:
- external-dns-operator

41
cluster/external-dns/scc.yaml Normal file
View File

@@ -0,0 +1,41 @@
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: external-dns
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: external-dns
rules:
- apiGroups: [""]
resources: ["services"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["pods"]
verbs: ["get","watch","list"]
- apiGroups: ["networking","networking.k8s.io"]
resources: ["ingresses"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["nodes"]
verbs: ["get","watch","list"]
- apiGroups: [""]
resources: ["endpoints"]
verbs: ["get","watch","list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: external-dns-viewer
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: external-dns
subjects:
- kind: ServiceAccount
name: external-dns
namespace: default

12
cluster/external-dns/subscription.yaml Normal file
View File

@@ -0,0 +1,12 @@
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: external-dns-operator
namespace: external-dns-operator
spec:
channel: stable-v1
installPlanApproval: Automatic
name: external-dns-operator
source: redhat-operators
sourceNamespace: openshift-marketplace

33
cluster/keycloak-operator/keycloak-operator.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: keycloak-operator
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
destination:
name: in-cluster
namespace: keycloak-operator
project: default
source:
path: cluster-applications/keycloak-operator
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: argocd
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

13
cluster/keycloak-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,13 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
# Operator deployment
- namespace.yaml
- operatorgroup.yaml
- subscription.yaml
# Deploy cluster resources

13
cluster/keycloak-operator/namespace.yaml Normal file
View File

@@ -0,0 +1,13 @@
---
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: keycloak-operator
name: keycloak-operator
argocd.argoproj.io/managed-by: openshift-gitops-operator
openshift.io/cluster-monitoring: 'true'
name: keycloak-operator
spec:
finalizers:
- kubernetes

9
cluster/keycloak-operator/operatorgroup.yaml Normal file
View File

@@ -0,0 +1,9 @@
---
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: keycloak-operator
namespace: keycloak-operator
spec:
targetNamespaces:
- keycloak-operator

12
cluster/keycloak-operator/subscription.yaml Normal file
View File

@@ -0,0 +1,12 @@
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: keycloak-operator
namespace: keycloak-operator
spec:
channel: fast
installPlanApproval: Automatic #Manual
name: keycloak-operator
source: community-operators
sourceNamespace: openshift-marketplace

96
cluster/nginx-ingress-operator/ingresscontroller-external.yaml Normal file
View File

@@ -0,0 +1,96 @@
---
kind: NginxIngress
apiVersion: charts.nginx.org/v1alpha1
metadata:
name: nginxingress-external
namespace: nginx-ingress-external
spec:
# routeSelector:
# matchLabels:
# type: external-ingress
controller:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/instance: nginx-external
app.kubernetes.io/name: nginx-external
topologyKey: kubernetes.io/hostname
config:
entries:
http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m
max_size=10g inactive=60m use_temp_path=off;
log-format-escaping: json
log-format: |-
{
"msec": "$msec",
"connection": "$connection",
"connection_requests": "$connection_requests",
"pid": "$pid",
"request_id": "$request_id",
"request_length": "$request_length",
"remote_addr": "$remote_addr",
"remote_user": "$remote_user",
"remote_port": "$remote_port",
"time_local": "$time_local",
"time_iso8601": "$time_iso8601",
"request": "$request",
"request_uri": "$request_uri",
"args": "$args",
"status": "$status",
"body_bytes_sent": "$body_bytes_sent",
"bytes_sent": "$bytes_sent",
"http_referer": "$http_referer",
"http_user_agent": "$http_user_agent",
"http_x_forwarded_for": "$http_x_forwarded_for",
"http_host": "$http_host",
"server_name": "$server_name",
"request_time": "$request_time",
"upstream": "$upstream_addr",
"upstream_connect_time": "$upstream_connect_time",
"upstream_header_time": "$upstream_header_time",
"upstream_response_time": "$upstream_response_time",
"upstream_response_length": "$upstream_response_length",
"upstream_cache_status": "$upstream_cache_status",
"ssl_protocol": "$ssl_protocol",
"ssl_cipher": "$ssl_cipher",
"scheme": "$scheme",
"request_method": "$request_method",
"server_protocol": "$server_protocol",
"pipe": "$pipe",
"gzip_ratio": "$gzip_ratio",
"http_cf_ray": "$http_cf_ray"
}
enableCustomResources: true
enableTLSPassthrough: true
enableSnippets: true
image:
pullPolicy: IfNotPresent
repository: nginx/nginx-ingress
tag: 3.7.0-ubi
ingressClass:
create: true
name: nginx-external
setAsDefaultIngress: true
replicaCount: 2
reportIngressStatus:
annotations: {}
enable: true
enableLeaderElection: true
ingressLink: ''
leaderElectionLockName: external-ingress-leader
service:
externalTrafficPolicy: Local
loadBalancerIP: 10.1.82.0
prometheus:
create: true
serviceMonitor:
create: true
volumes:
- name: nginx-cache
persistentVolumeClaim:
claimName: nginx-cache-external
volumeMounts:
- name: nginx-cache
mountPath: /var/cache/nginx

96
cluster/nginx-ingress-operator/ingresscontroller-internal.yaml Normal file
View File

@@ -0,0 +1,96 @@
---
kind: NginxIngress
apiVersion: charts.nginx.org/v1alpha1
metadata:
name: nginxingress-internal
namespace: nginx-ingress-internal
spec:
routeSelector:
matchLabels:
type: internal-ingress
controller:
affinity:
podAntiAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
- labelSelector:
matchLabels:
app.kubernetes.io/instance: nginx-internal
app.kubernetes.io/name: nginx-internal
topologyKey: kubernetes.io/hostname
config:
entries:
http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m
max_size=10g inactive=60m use_temp_path=off;
log-format-escaping: json
log-format: |-
{
"msec": "$msec",
"connection": "$connection",
"connection_requests": "$connection_requests",
"pid": "$pid",
"request_id": "$request_id",
"request_length": "$request_length",
"remote_addr": "$remote_addr",
"remote_user": "$remote_user",
"remote_port": "$remote_port",
"time_local": "$time_local",
"time_iso8601": "$time_iso8601",
"request": "$request",
"request_uri": "$request_uri",
"args": "$args",
"status": "$status",
"body_bytes_sent": "$body_bytes_sent",
"bytes_sent": "$bytes_sent",
"http_referer": "$http_referer",
"http_user_agent": "$http_user_agent",
"http_x_forwarded_for": "$http_x_forwarded_for",
"http_host": "$http_host",
"server_name": "$server_name",
"request_time": "$request_time",
"upstream": "$upstream_addr",
"upstream_connect_time": "$upstream_connect_time",
"upstream_header_time": "$upstream_header_time",
"upstream_response_time": "$upstream_response_time",
"upstream_response_length": "$upstream_response_length",
"upstream_cache_status": "$upstream_cache_status",
"ssl_protocol": "$ssl_protocol",
"ssl_cipher": "$ssl_cipher",
"scheme": "$scheme",
"request_method": "$request_method",
"server_protocol": "$server_protocol",
"pipe": "$pipe",
"gzip_ratio": "$gzip_ratio",
"http_cf_ray": "$http_cf_ray"
}
enableCustomResources: true
enableTLSPassthrough: true
enableSnippets: true
image:
pullPolicy: IfNotPresent
repository: nginx/nginx-ingress
tag: 3.7.0-ubi
ingressClass:
create: true
name: nginx-internal
setAsDefaultIngress: false
replicaCount: 2
reportIngressStatus:
annotations: {}
enable: true
enableLeaderElection: true
ingressLink: ''
leaderElectionLockName: internal-ingress-leader
service:
externalTrafficPolicy: Local
loadBalancerIP: 10.1.82.2
prometheus:
create: true
serviceMonitor:
create: true
volumes:
- name: nginx-cache
persistentVolumeClaim:
claimName: nginx-cache-internal
volumeMounts:
- name: nginx-cache
mountPath: /var/cache/nginx

16
cluster/nginx-ingress-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,16 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
# Operator deployment
- subscription.yaml
# Deploy cluster resources
- scc.yaml
- namespace.yaml
- pvcs.yaml
- ingresscontroller-external.yaml
- ingresscontroller-internal.yaml

24
cluster/nginx-ingress-operator/namespace.yaml Normal file
View File

@@ -0,0 +1,24 @@
---
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: nginx-ingress-external
name: nginx-ingress-external
argocd.argoproj.io/managed-by: openshift-gitops-operator
name: nginx-ingress-external
spec:
finalizers:
- kubernetes
---
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: nginx-ingress-internal
name: nginx-ingress-internal
argocd.argoproj.io/managed-by: openshift-gitops-operator
name: nginx-ingress-internal
spec:
finalizers:
- kubernetes

33
cluster/nginx-ingress-operator/nginx-ingress-operator.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: nginx-ingress-operator
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "2"
spec:
destination:
name: in-cluster
namespace: nginx-ingress-operator
project: default
source:
path: cluster-applications/nginx-ingress-operator
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: argocd
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

26
cluster/nginx-ingress-operator/pvcs.yaml Normal file
View File

@@ -0,0 +1,26 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nginx-cache-external
namespace: nginx-ingress-external
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
storageClassName: synology-nfs
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: nginx-cache-internal
namespace: nginx-ingress-internal
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 5Gi
storageClassName: synology-nfs

44
cluster/nginx-ingress-operator/scc.yaml Normal file
View File

@@ -0,0 +1,44 @@
---
kind: SecurityContextConstraints
apiVersion: security.openshift.io/v1
metadata:
name: nginx-ingress-admin
annotations:
kubernetes.io/description: nginx-ingress-admin allows nginx-ingress to
use the level of capabilities it requires, while forcing all processes
to run as UID 101 as reflected in the official docker images.
allowPrivilegeEscalation: false
allowPrivilegedContainer: true
runAsUser:
type: MustRunAs
uid: 101
seLinuxContext:
type: MustRunAs
fsGroup:
type: MustRunAs
supplementalGroups:
type: MustRunAs
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowHostDirVolumePlugin: false
allowHostIPC: false
readOnlyRootFilesystem: false
seccompProfiles:
- runtime/default
volumes:
- configMap
- downwardAPI
- emptyDir
- persistentVolumeClaim
- projected
- secret
allowedCapabilities:
- NET_BIND_SERVICE
defaultAddCapabilities:
- NET_BIND_SERVICE
requiredDropCapabilities:
- ALL
users:
- 'system:serviceaccount:*:nginx-ingress'
groups: []

12
cluster/nginx-ingress-operator/subscription.yaml Normal file
View File

@@ -0,0 +1,12 @@
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: nginx-ingress-operator
namespace: openshift-operators
spec:
channel: alpha
installPlanApproval: Automatic #Manual
name: nginx-ingress-operator
source: certified-operators
sourceNamespace: openshift-marketplace

13
cluster/opencost/Chart.yaml Normal file
View File

@@ -0,0 +1,13 @@
---
apiVersion: v2
name: opencost-umbrella
description: A helm chart to include opencost with values
type: application
version: 0.1.0
appVersion: 0.1.0
dependencies:
- name: opencost
version: 1.9.8
repository: https://opencost.github.io/opencost-helm-chart
# condition: opencost.enabled

11
cluster/opencost/kustomization.yaml Normal file
View File

@@ -0,0 +1,11 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
#- namespace.yaml
- https://raw.githubusercontent.com/opencost/opencost/develop/kubernetes/opencost.yaml

14
cluster/opencost/namespace.yaml Normal file
View File

@@ -0,0 +1,14 @@
---
apiVersion: v1
kind: Namespace
metadata:
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
name: opencost
labels:
argocd.argoproj.io/managed-by: openshift-gitops-operator
kubernetes.io/metadata.name: opencost
openshift.io/cluster-monitoring: 'true'
spec:
finalizers:
- kubernetes

35
cluster/opencost/opencost.yaml Normal file
View File

@@ -0,0 +1,35 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: opencost
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "5"
spec:
destination:
name: in-cluster
namespace: opencost
project: default
source:
# path: opencost/opencost/develop/kubernetes/opencost.yaml
# repoURL: https://raw.githubusercontent.com/
path: cluster-applications/opencost
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: false
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: openshift-gitops
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

512
cluster/opencost/values.yaml Normal file
View File

@@ -0,0 +1,512 @@
# -- Overwrite the default name of the chart
nameOverride: ""
# -- Overwrite all resources name created by the chart
fullnameOverride: ""
# -- Override the deployment namespace
namespaceOverride: ""
loglevel: info
plugins:
enabled: false
install:
enabled: true
fullImageName: curlimages/curl:latest
securityContext:
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1001031000
folder: /opt/opencost/plugin
# leave this commented to always download most recent version of plugins
# version: <INSERT_SPECIFIC_PLUGINS_VERSION>
configs:
# datadog: |
# {
# "datadog_site": "<INSERT_DATADOG_SITE>",
# "datadog_api_key": "<INSERT_DATADOG_API_KEY>",
# "datadog_app_key": "<INSERT_DATADOG_APP_KEY>"
# }
# -- List of secret names to use for pulling the images
imagePullSecrets: []
serviceAccount:
# -- Specifies whether a service account should be created
create: true
# -- Annotations to add to the service account
annotations: {}
# eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/eksctl-opencost
# The name of the service account to use.
# If not set and create is true, a name is generated using the fullname template
name: ""
# -- Whether pods running as this service account should have an API token automatically mounted
automountServiceAccountToken: true
# NetworkPolicies for ingress
networkPolicies:
# -- Specifies whether networkpolicies should be created
enabled: false
# -- Internal Prometheus settings related to NetworkPolicies
prometheus:
# -- Namespace where internal Prometheus is installed
namespace: prometheus-system
# -- Pod port of in-cluster Prometheus
port: 9090
# -- Labels applied to the Prometheus server pod(s)
labels:
app.kubernetes.io/name: prometheus
# -- Extra egress rule
extraEgress: []
# -- Strategy to be used for the Deployment
updateStrategy:
rollingUpdate:
maxSurge: 1
maxUnavailable: 1
type: RollingUpdate
# -- Annotations to add to the all the resources
annotations: {}
# -- Annotations to add to the OpenCost Pod
podAnnotations: {}
# -- Annotations to add to the Secret
secretAnnotations: {}
# -- Labels to add to the OpenCost Pod
podLabels: {}
# -- Pod priority
priorityClassName: ~
# -- Holds pod-level security attributes and common container settings
podSecurityContext: {}
# fsGroup: 2000
service:
enabled: true
# -- Annotations to add to the service
annotations: {}
# -- Labels to add to the service account
labels: {}
# -- Kubernetes Service type
type: ClusterIP
# -- NodePort if service type is NodePort
nodePort: {}
# -- extra ports. Useful for sidecar pods such as oauth-proxy
extraPorts: []
# - name: oauth-proxy
# port: 8081
# targetPort: 8081
# - name: oauth-metrics
# port: 8082
# targetPort: 8082
# -- LoadBalancer Source IP CIDR if service type is LoadBalancer and cloud provider supports this
loadBalancerSourceRanges: []
# Create cluster role policies
rbac:
enabled: true
opencost:
# -- <SECRET_NAME> for the secret containing the Cloud Costs cloud-integration.json https://www.opencost.io/docs/configuration/#cloud-costs
# -- kubectl create secret generic <SECRET_NAME> --from-file=cloud-integration.json -n opencost
cloudIntegrationSecret: ""
exporter:
# API_PORT for the cost-model to listen on
apiPort: 9003
# debugPort: 40000 # for development purposes (debugging with delve) and not for production.
# -- The GCP Pricing API requires a key. This is supplied just for evaluation.
cloudProviderApiKey: ""
# -- Default cluster ID to use if cluster_id is not set in Prometheus metrics.
defaultClusterId: 'default-cluster'
image:
# -- Exporter container image registry
registry: ghcr.io
# -- Exporter container image name
repository: opencost/opencost
# -- Exporter container image tag
tag: "1.113.0@sha256:b313d6d320058bbd3841a948fb636182f49b46df2368d91e2ae046ed03c0f83c"
# -- Exporter container image pull policy
pullPolicy: IfNotPresent
# -- Override the full image name for development purposes
fullImageName: null
# -- List of extra arguments for the command, e.g.: log-format=json
extraArgs: []
# -- Number of OpenCost replicas to run
replicas: 1
resources:
# -- CPU/Memory resource requests
requests:
cpu: '10m'
memory: '55Mi'
# -- CPU/Memory resource limits
limits:
cpu: '999m'
memory: '1Gi'
# Startup probe configuration
startupProbe:
# -- Whether probe is enabled
enabled: true
# -- Probe path
path: /healthz
# -- Number of seconds before probe is initiated
initialDelaySeconds: 10
# -- Probe frequency in seconds
periodSeconds: 5
# -- Number of failures for probe to be considered failed
failureThreshold: 30
# Liveness probe configuration
livenessProbe:
# -- Whether probe is enabled
enabled: true
# -- Probe path
path: /healthz
# -- Number of seconds before probe is initiated
initialDelaySeconds: 10
# -- Probe frequency in seconds
periodSeconds: 20
# -- Number of failures for probe to be considered failed
failureThreshold: 3
# Readiness probe configuration
readinessProbe:
# -- Whether probe is enabled
enabled: true
# -- Probe path
path: /healthz
# -- Number of seconds before probe is initiated
initialDelaySeconds: 10
# -- Probe frequency in seconds
periodSeconds: 10
# -- Number of failures for probe to be considered failed
failureThreshold: 3
# -- The security options the container should be run with
securityContext: # {}
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1001031000
# Path of CSV file
csv_path: ""
# Persistent volume claim for storing the data. eg: csv file
persistence:
enabled: false
# -- Annotations for persistent volume
annotations: {}
# -- Access mode for persistent volume
accessMode: ""
# -- Storage class for persistent volume
storageClass: ""
# -- Size for persistent volume
size: ""
aws:
# -- AWS secret access key
secret_access_key: ""
# -- AWS secret key id
access_key_id: ""
# -- A list of volume mounts to be added to the pod
extraVolumeMounts: []
# -- List of additional environment variables to set in the container
env: []
# -- Any extra environment variables you would like to pass on to the pod
extraEnv: {}
# FOO: BAR
# For example, if accessing mimir directly and getting 401 Unauthorized
# PROMETHEUS_HEADER_X_SCOPE_ORGID: anonymous
customPricing:
# -- Enables custom pricing configuration
enabled: false
# -- Customize the configmap name used for custom pricing
configmapName: custom-pricing-model
# -- Path for the pricing configuration.
configPath: /tmp/custom-config
# -- Configures the pricing model provided in the values file.
createConfigmap: true
# -- Sets the provider type for the custom pricing file.
provider: custom
# -- More information about these values here: https://www.opencost.io/docs/configuration/on-prem#custom-pricing-using-the-opencost-helm-chart
costModel:
description: Modified pricing configuration.
CPU: 1.25
spotCPU: 0.006655
RAM: 0.50
spotRAM: 0.000892
GPU: 0.95
storage: 0.25
zoneNetworkEgress: 0.01
regionNetworkEgress: 0.01
internetNetworkEgress: 0.12
dataRetention:
dailyResolutionDays: 15
carbonCost:
# -- Enable carbon cost exposed in the API
enabled: false
cloudCost:
# -- Enable cloud cost ingestion and querying, dependant on valid integration credentials
enabled: false
# -- Number of hours between each run of the Cloud Cost pipeline
refreshRateHours: 6
# -- Number of days into the past that a Cloud Cost standard run will query for
runWindowDays: 3
# -- The number of standard runs before a Month-to-Date run occurs
monthToDateInterval: 6
# -- The max number of days that any single query will be made to construct Cloud Costs
queryWindowDays: 7
metrics:
kubeStateMetrics:
# -- (bool) Enable emission of pod annotations
emitPodAnnotations: ~
# -- (bool) Enable emission of namespace annotations
emitNamespaceAnnotations: ~
# -- (bool) Enable emission of KSM v1 metrics
emitKsmV1Metrics: ~
# -- (bool) Enable only emission of KSM v1 metrics that do not exist in KSM 2 by default
emitKsmV1MetricsOnly: ~
serviceMonitor:
# -- Create ServiceMonitor resource for scraping metrics using PrometheusOperator
enabled: false
# -- Additional labels to add to the ServiceMonitor
additionalLabels: {}
# -- Specify if the ServiceMonitor will be deployed into a different namespace (blank deploys into same namespace as chart)
namespace: ""
# -- Interval at which metrics should be scraped
scrapeInterval: 30s
# -- Timeout after which the scrape is ended
scrapeTimeout: 10s
# -- HonorLabels chooses the metric's labels on collisions with target labels
honorLabels: true
# -- RelabelConfigs to apply to samples before scraping. Prometheus Operator automatically adds relabelings for a few standard Kubernetes fields
relabelings: []
# -- MetricRelabelConfigs to apply to samples before ingestion
metricRelabelings: []
# -- extra Endpoints to add to the ServiceMonitor. Useful for scraping sidecars
extraEndpoints: []
# - port: oauth-metrics
# path: /metrics
# -- HTTP scheme used for scraping. Defaults to `http`
scheme: http
# -- TLS configuration for scraping metrics
tlsConfig: {}
# caFile: /etc/prom-certs/root-cert.pem
# certFile: /etc/prom-certs/cert-chain.pem
# insecureSkipVerify: true
# keyFile: /etc/prom-certs/key.pem
config:
# -- Enables creating the metrics.json configuration as a ConfigMap
enabled: false
# -- Customize the configmap name used for metrics
configmapName: custom-metrics
# -- List of metrics to be disabled
disabledMetrics: []
# - <metric-to-be-disabled>
# - <metric-to-be-disabled>
prometheus:
# -- Secret name that contains credentials for Prometheus
secret_name: ~
# -- Existing secret name that contains credentials for Prometheus
existingSecretName: ~
# -- Prometheus Basic auth username
username: ""
# -- Key in the secret that references the username
username_key: DB_BASIC_AUTH_USERNAME
# -- Prometheus Basic auth password
password: ""
# -- Key in the secret that references the password
password_key: DB_BASIC_AUTH_PW
# -- Prometheus Bearer token
bearer_token: ""
bearer_token_key: DB_BEARER_TOKEN
external:
# -- Use external Prometheus (eg. Grafana Cloud)
enabled: false
# -- External Prometheus url
url: "https://prometheus.example.com/prometheus"
internal:
# -- Use in-cluster Prometheus
enabled: true
# -- Service name of in-cluster Prometheus
serviceName: prometheus-server
# -- Namespace of in-cluster Prometheus
namespaceName: prometheus-system
# -- Service port of in-cluster Prometheus
port: 80
amp:
# -- Use Amazon Managed Service for Prometheus (AMP)
enabled: false # If true, opencost will be configured to remote_write and query from Amazon Managed Service for Prometheus.
# -- Workspace ID for AMP
workspaceId: ""
thanos:
enabled: false
queryOffset: ''
maxSourceResolution: ''
internal:
enabled: true
serviceName: my-thanos-query
namespaceName: opencost
port: 10901
external:
enabled: false
url: 'https://thanos-query.example.com/thanos'
ui:
# -- Enable OpenCost UI
enabled: true
image:
# -- UI container image registry
registry: ghcr.io
# -- UI container image name
repository: opencost/opencost-ui
# -- UI container image tag
# @default -- `""` (use appVersion in Chart.yaml)
tag: "1.113.0@sha256:4f408cf765217f889f4cb5cfcc97356e09892045a6ec951b27817a42ecb6748d"
# -- UI container image pull policy
pullPolicy: IfNotPresent
# -- Override the full image name for development purposes
fullImageName: null
resources:
# -- CPU/Memory resource requests
requests:
cpu: '10m'
memory: '55Mi'
# -- CPU/Memory resource limits
limits:
cpu: '999m'
memory: '1Gi'
# used in the default.nginx.conf if you want to switch for using with Docker
# apiServer: 0.0.0.0
uiPort: 9090
# Liveness probe configuration
livenessProbe:
# -- Whether probe is enabled
enabled: true
# -- Probe path
path: /healthz
# -- Number of seconds before probe is initiated
initialDelaySeconds: 30
# -- Probe frequency in seconds
periodSeconds: 10
# -- Number of failures for probe to be considered failed
failureThreshold: 3
# Readiness probe configuration
readinessProbe:
# -- Whether probe is enabled
enabled: true
# -- Probe path
path: /healthz
# -- Number of seconds before probe is initiated
initialDelaySeconds: 30
# -- Probe frequency in seconds
periodSeconds: 10
# -- Number of failures for probe to be considered failed
failureThreshold: 3
# -- The security options the container should be run with
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 1000
# -- A list of environment variables to be added to the pod
extraEnv: []
# -- A list of volume mounts to be added to the pod
extraVolumeMounts: []
ingress:
# -- Ingress for OpenCost UI
enabled: false
# -- Ingress controller which implements the resource
ingressClassName: ""
# -- Annotations for Ingress resource
annotations: {}
# kubernetes.io/tls-acme: "true"
# -- A list of host rules used to configure the Ingress
# @default -- See [values.yaml](values.yaml)
hosts:
- host: example.local
paths:
- /
# -- Redirect ingress to an extraPort defined on the service such as oauth-proxy
servicePort: http-ui
# servicePort: oauth-proxy
# -- Ingress TLS configuration
tls: []
# - secretName: chart-example-tls
# hosts:
# - chart-example.local
sigV4Proxy:
image: public.ecr.aws/aws-observability/aws-sigv4-proxy:latest
imagePullPolicy: IfNotPresent
name: aps
port: 8005
region: us-west-2 # The AWS region
host: aps-workspaces.us-west-2.amazonaws.com # The hostname for AMP service.
# role_arn: arn:aws:iam::<account>:role/role-name # The AWS IAM role to assume.
extraEnv: # Pass extra env variables to sigV4Proxy
# - name: AWS_ACCESS_KEY_ID
# value: <access_key>
# - name: AWS_SECRET_ACCESS_KEY
# value: <secret_key>
resources: {}
# limits:
# cpu: 200m
# memory: 500Mi
# requests:
# cpu: 20m
# memory: 32Mi
securityContext: {}
# capabilities:
# drop:
# - ALL
# readOnlyRootFilesystem: true
# runAsNonRoot: true
# runAsUser: 65534
# -- Toleration labels for pod assignment
tolerations: []
# -- Node labels for pod assignment
nodeSelector: {}
# -- Affinity settings for pod assignment
affinity: {}
# -- Assign custom TopologySpreadConstraints rules
topologySpreadConstraints: []
# -- extra sidecars to add to the pod. Useful for things like oauth-proxy for the UI
extraContainers: []
# - name: oauth-proxy
# image: quay.io/oauth2-proxy/oauth2-proxy:v7.5.1
# args:
# - --upstream=http://127.0.0.1:9090
# - --http-address=0.0.0.0:8081
# - --metrics-address=0.0.0.0:8082
# - ...
# ports:
# - name: oauth-proxy
# containerPort: 8081
# protocol: TCP
# - name: oauth-metrics
# containerPort: 8082
# protocol: TCP
# resources: {}
# -- A list of volumes to be added to the pod
extraVolumes: []

7
cluster/openshift-virtualization/hyperconverged.yaml Normal file
View File

@@ -0,0 +1,7 @@
---
apiVersion: hco.kubevirt.io/v1beta1
kind: HyperConverged
metadata:
name: kubevirt-hyperconverged
namespace: openshift-cnv
spec: {}

13
cluster/openshift-virtualization/kustomization.yaml Normal file
View File

@@ -0,0 +1,13 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
- namespace.yaml
- subscription.yaml
- operatorgroup.yaml
- hyperconverged.yaml
- storageprofile.yaml

11
cluster/openshift-virtualization/namespace.yaml Normal file
View File

@@ -0,0 +1,11 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: openshift-cnv
labels:
name: openshift-cnv
argocd.argoproj.io/managed-by: openshift-gitops-operator
spec:
finalizers:
- kubernetes

33
cluster/openshift-virtualization/openshift-virtualization.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: openshift-virtualization
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "4"
spec:
destination:
name: in-cluster
namespace: openshift-cnv
project: default
source:
path: cluster-applications/openshift-virtualization
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: false
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: openshift-gitops
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

9
cluster/openshift-virtualization/operatorgroup.yaml Normal file
View File

@@ -0,0 +1,9 @@
---
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: kubevirt-hyperconverged-group
namespace: openshift-cnv
spec:
targetNamespaces:
- openshift-cnv

19
cluster/openshift-virtualization/storageprofile.yaml Normal file
View File

@@ -0,0 +1,19 @@
---
apiVersion: cdi.kubevirt.io/v1beta1
kind: StorageProfile
metadata:
name: synology-iscsi-storage
spec:
claimPropertySets:
- accessModes:
- ReadWriteOnce
volumeMode:
Block
- accessModes:
- ReadWriteMany
volumeMode:
Block
cloneStrategy: csi-clone
status:
provisioner: csi.san.synology.com
storageClass: synology-iscsi-storage

12
cluster/openshift-virtualization/subscription.yaml Normal file
View File

@@ -0,0 +1,12 @@
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: hco-operatorhub
namespace: openshift-cnv
spec:
source: redhat-operators
sourceNamespace: openshift-marketplace
name: kubevirt-hyperconverged
startingCSV: kubevirt-hyperconverged-operator.v4.16.0
channel: "stable"

13
cluster/prometheus-operator/cluster-secret-store.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
name: doppler-cluster
spec:
provider:
doppler:
auth:
secretRef:
dopplerToken:
name: doppler-cluster-token
key: dopplerToken
namespace: external-secrets

33
cluster/prometheus-operator/external-dns.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: external-dns-operator
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
destination:
name: in-cluster
namespace: external-dns-operator
project: default
source:
path: applications/external-dns
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: false
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: openshift-gitops
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

12
cluster/prometheus-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,12 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
- namespace.yaml
- operatorgroup.yaml
- subscription.yaml
#- cluster-secret-store.yaml

14
cluster/prometheus-operator/namespace.yaml Normal file
View File

@@ -0,0 +1,14 @@
---
apiVersion: v1
kind: Namespace
metadata:
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
name: prometheus-system
labels:
argocd.argoproj.io/managed-by: openshift-gitops-operator
kubernetes.io/metadata.name: prometheus-system
openshift.io/cluster-monitoring: 'true'
spec:
finalizers:
- kubernetes

10
cluster/prometheus-operator/operatorgroup.yaml Normal file
View File

@@ -0,0 +1,10 @@
---
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
name: prometheus
namespace: prometheus
spec:
upgradeStrategy: Default
targetNamespaces:
- prometheus

33
cluster/prometheus-operator/prometheus-operator.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: prometheus
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "4"
spec:
destination:
name: in-cluster
namespace: prometheus-system
project: default
source:
path: cluster-applications/prometheus-operator
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: false
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: openshift-gitops
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

12
cluster/prometheus-operator/subscription.yaml Normal file
View File

@@ -0,0 +1,12 @@
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: prometheus
namespace: prometheus
spec:
channel: beta
installPlanApproval: Automatic
name: prometheus
source: community-operators
sourceNamespace: openshift-marketplace

19
cluster/service-mesh-operator/istio.yaml Normal file
View File

@@ -0,0 +1,19 @@
---
apiVersion: sailoperator.io/v1alpha1
kind: Istio
metadata:
name: default
spec:
namespace: istio-system
updateStrategy:
type: InPlace
inactiveRevisionDeletionGracePeriodSeconds: 30
version: v1.23.0
---
kind: IstioCNI
apiVersion: sailoperator.io/v1alpha1
metadata:
name: default
spec:
namespace: istio-cni
version: v1.23.0

11
cluster/service-mesh-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,11 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
- subscription.yaml
- namespace.yaml
- istio.yaml

24
cluster/service-mesh-operator/namespace.yaml Normal file
View File

@@ -0,0 +1,24 @@
---
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: istio-system
name: istio-system
argocd.argoproj.io/managed-by: openshift-gitops-operator
name: istio-system
spec:
finalizers:
- kubernetes
---
apiVersion: v1
kind: Namespace
metadata:
labels:
kubernetes.io/metadata.name: istio-cni
name: istio-cni
argocd.argoproj.io/managed-by: openshift-gitops-operator
name: istio-cni
spec:
finalizers:
- kubernetes

33
cluster/service-mesh-operator/service-mesh-operator.yaml Normal file
View File

@@ -0,0 +1,33 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: service-mesh-operator
finalizers:
- resources-finalizer.argocd.argoproj.io
annotations:
argocd.argoproj.io/sync-wave: "3"
spec:
destination:
name: in-cluster
namespace: service-mesh-operator
project: default
source:
path: cluster-applications/service-mesh-operator
repoURL: git@github.com:rblundon/MK-Labs.git
targetRevision: HEAD
syncPolicy:
automated:
prune: true
selfHeal: true
syncOptions:
- RespectIgnoreDifferences=true
- CreateNamespace=true
managedNamespaceMetadata:
labels:
argocd.argoproj.io/managed-by: argocd
ignoreDifferences:
- group: apps
kind: Deployment
jsonPointers:
- /spec/replicas

12
cluster/service-mesh-operator/subscription.yaml Normal file
View File

@@ -0,0 +1,12 @@
---
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
name: servicemeshoperator3
namespace: openshift-operators
spec:
channel: candidates
installPlanApproval: Automatic #Manual
name: servicemeshoperator3
source: redhat-operators
sourceNamespace: openshift-marketplace