Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'
This commit is contained in:
3
cluster-config/clusters/overlays/local.hub/README.md
Normal file
3
cluster-config/clusters/overlays/local.hub/README.md
Normal file
@@ -0,0 +1,3 @@
|
||||
#### Home (local) Cluster
|
||||
|
||||
This is my home cluster which runs on a server under my desk and uses the highly original cluster name of 'home'. It runs in libvirt on a Ryzen 3900x server with 128 GB of memory. It is typically configured as three combined master/worker nodes with 7 vCPU and 35 GB per node.
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: central-tls-letsencrypt-cert
|
||||
namespace: stackrox
|
||||
spec:
|
||||
# Replace default secret since ACS doesn't support referencing a different secret
|
||||
secretName: central-default-tls-cert
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- central-stackrox.apps.hub.ocplab.com
|
||||
@@ -0,0 +1,6 @@
|
||||
commonAnnotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
|
||||
resources:
|
||||
- ../../../../../components/acs-operator/overlays/aggregate
|
||||
- certificate.yaml
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: console.openshift.io/v1
|
||||
kind: ConsoleLink
|
||||
metadata:
|
||||
name: acs
|
||||
spec:
|
||||
href: 'https://central-stackrox.apps.hub.ocplab.com'
|
||||
location: ApplicationMenu
|
||||
text: Advanced Cluster Security
|
||||
applicationMenu:
|
||||
section: Red Hat Applications
|
||||
imageURL: https://central-stackrox.apps.hub.ocplab.com/static/media/rh-favicon.0110fdfc5cab55416acf.ico
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../../../components/consolelinks/base
|
||||
- acs-consolelink.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
kind: Kustomization
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
|
||||
namespace: costmanagement-metrics-operator
|
||||
|
||||
bases:
|
||||
- https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate
|
||||
|
||||
patchesJson6902:
|
||||
- path: patch-source-and-name.yaml
|
||||
target:
|
||||
group: costmanagement-metrics-cfg.openshift.io
|
||||
kind: CostManagementMetricsConfig
|
||||
name: config
|
||||
version: v1beta1
|
||||
@@ -0,0 +1,6 @@
|
||||
- op: replace
|
||||
path: /spec/source/name
|
||||
value: Hub
|
||||
- op: replace
|
||||
path: /metadata/name
|
||||
value: hub-cluster
|
||||
@@ -0,0 +1,13 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: doppler-push-secret
|
||||
spec:
|
||||
provider:
|
||||
doppler:
|
||||
auth:
|
||||
secretRef:
|
||||
dopplerToken:
|
||||
name: eso-token-cluster-push-secret
|
||||
key: dopplerToken
|
||||
namespace: hub-secrets
|
||||
@@ -0,0 +1,3 @@
|
||||
resources:
|
||||
- ../../../../../components/eso/overlays/aggregate
|
||||
- doppler-push-secret-store.yaml
|
||||
@@ -0,0 +1,54 @@
|
||||
|
||||
|
||||
### Introduction
|
||||
|
||||
Installs the Tech Preview LokiStack for cluster logging using local QNAP NAS for object storage.
|
||||
|
||||
Installation is based on docs here:
|
||||
|
||||
https://github.com/grafana/loki/blob/main/operator/docs/forwarding_logs_to_gateway.md#openshift-logging
|
||||
|
||||
# Accessing logs
|
||||
|
||||
You can access the logs using the logcli tool from grafana:
|
||||
|
||||
https://github.com/grafana/loki/releases/tag/v2.5.0
|
||||
|
||||
Example queries:
|
||||
|
||||
View raw application logs:
|
||||
```
|
||||
export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
|
||||
logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev"}'
|
||||
```
|
||||
|
||||
View applicatons logs textually without JSON:
|
||||
```
|
||||
export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
|
||||
logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev", kubernetes_container_name="server"}' --output=raw | jq '."@timestamp",.kubernetes.pod_name,.level,.message' | paste - - - -
|
||||
```
|
||||
|
||||
View infrastructure logs:
|
||||
```
|
||||
export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/infrastructure
|
||||
logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="openshift-logging"}'
|
||||
```
|
||||
|
||||
### Storage Secret
|
||||
|
||||
You will need a storage secret for your S3 bucket for Loki to use, format of secret is as follows:
|
||||
|
||||
```
|
||||
apiVersion: v1
|
||||
data:
|
||||
access_key_id: XXXXXX
|
||||
access_key_secret: XXXXXX
|
||||
bucketnames: XXXXXX
|
||||
endpoint: XXXXXXXXXXXX
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: loki-storage
|
||||
namespace: openshift-logging
|
||||
```
|
||||
|
||||
The sealed secret here is referencing Minio running on my QNAP NAS so non AWS S3 buckets do work fine.
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- ../../../../../components/loki/operator/cluster-logging/base
|
||||
- ../../../../../components/loki/operator/loki/base
|
||||
- ../../../../../components/loki/instance/overlays/sno
|
||||
- loki-storage-qnap-secret.yaml
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
name: loki-storage
|
||||
namespace: openshift-logging
|
||||
spec:
|
||||
encryptedData:
|
||||
access_key_id: AgADsXMtym0OLY598xcLZ4e6zPgh9x3KtCRX59K3J/LriPJPwNuMugAMZcHjLaA9nm+Rwqg095uhGD0pUxK5N336fMiMJ+7WpzMsR8nqMS3eoOtxhXBwML5wXqLmpf2FSxujUXws847JsohHtZiCg6ZBlWuJ2pEaCz6yPecMU8dixz+7OMs079origgakI0FjHlEPMn6BOhAOR4TMCt877mNmeLWrmxNEQt3ql4qMvNH3Ru8G4YijmO+jS9OQYqXYwTbO237zx+D3DDw0PAuUzqMIKXSZZdGNmATXIROu9+4TJGT6YnraMxON81F4t78D+y6reM6AIXN49SDcIxpmSZrtLJ5QQesOPbZ+x4mdR2Rj4RaqyktuNaBknn+CUCtx9aUv5LpWcIu/e+ZXTsVLVXLsmDpVv/k9fe1tyhlQPgdCAg/Iwn+xF3YVvLEpfhrXrkcKFK0snn242NbJk4aTcY28O+XHyJn7lmsbu/BSao7cqtbwJsFNCVo+e23KUkBoenw3LMQ2lyle9AfLyD10JIR5beozyt6pxxPDjnBXx8zlxhA0dPryQkm5O/+fiJd3gidzJmZZuVr8i20DaBoM3RnDhF0uccgDsbbM0N9KkEO1JXco22NGeBveKtkMOQaNy7i1QIHIFafkcyP9CStz8swsaWk5WaSEyr7ysiKpZlYE6tyaHPW2h4/uG/NfrOi6PXzPE4d90oyOeVIC28Obxse3aVRTw==
|
||||
access_key_secret: AgCE8EHoWhZm4q25TcXlMy65uPopUNULeyw1Z+reSAr3pDaT+9B2k8TkPyo8vwCLYykqQqPS3VV7X6J80upVGWbYBVUM/7kI3W6F1kRl5eQjDmkAUmFa0t2EAxQP7TN1VPHVLZGUhwTGXjARdDGgDHi/We7jhl781ZFIZ8G0nkWCSZrB4T4XI+Mb154nR+GMejrstjzhFdueWgFZX/wX3PmcbmI+eAu0yeiW9IWikmDTrQyv1P46dDyPAKquZc7Dbgy4AxJ/ebeQ4558sOW9hvhTxoQ0hrEezeOMAbzQKqPd2Y5470LxMtoGL+FNqbLHTBQnqSucyDzOO2hiFhnUaCPvpCE/TRT7T3NbQ8uaugYaRR3eNa3w9ILWduMQ2yDsG+cNrYHXcyoUtdAQQ1eRv11jFYFVARRRGuGiFzWsLmMDvokCxQgkYpJXj5HqeZ+oT2xBVgd7P+c6ZQXRzfuwUXTUh+w3QxZ4XrqBq1jv7RRnu+uCj3E+vaavqIS8ipYXfLzjneHFhlAm9GS3rAIbCPlrZCaIIe/r4KRjtP7Gj4f6jhaN5Xo5jvBPqLYfX/RY8fll9XJAZGH6a9k+NDcxrwiV/UBDEQcPgnx83bCuFQ/qvIdd3tnOZ2dIvEHXnLMfBYOd0OyvkC3CoGKgmf4d6x4xvrzyqRHSIBxOGvDMG54IutZwHngFEuQbtGgtD0eN/SsLRO4wcuDugYVgiSPCHQ+IONUqvj7c7IJgRQKad2oxmlP7ZzSExVV8
|
||||
bucketnames: AgDA2DCtrPQmcdJ/QTBNZgmf2C7VSE96LVwje8J1N9XbmTte/d0oO9V0vUanXRKdraISTlHWBRBrYOxKx42nZMVzxKOHUCBMrdSN2z9ytgxNMhX2XNusTd4oDucsW+KM4IZyg95CXNvOSt01Y/uwdnJNK71VaiCSM1Sp+lIgVBzkwiase/YitOmCXVBofVLubWtsVwIGy5cWMmNhWmD0fjG5aIQ0Nx3OjYq/tIsrM4iB7FOn9Us1PQ9bkUNqJKu3LZtNIklzgDEUY6+uwtULt/jh8bTGHdptG18D1tuBf1SmD/xIWeCHf5Btp7XgRjivBR45DDIZHyc5mNdM7ydNvmae8SgOrugBWACQ37ZYiRIivDHJDs6Aa0fWDDd4ntdYclix7SurmqLx+/wzp7nyNmF3rCJY0u3FyX7twmLO2xZyabfqIqPY+kiGlKBY8uLGkLSDXbaLF78Vkww8Q5m5qdOZklADB+VZyii2PyFxLodeOKWujdG7vFnCiI41hCj3ry1FFM8o6397GO2zL1j4bflsmYh+9c5YKgc3ykzbLnAl+G30A505uXpBLJuXmHHXayGTNzU0D3EtWKnEwXF5NRYRQTdBPrwmUo7ml/UU04bdvJGob9dxGjypjB9CQG9pL3ouGTZZ60kNnSodhnKbRFv+Z1P8oNi4Vz6789eOrLVdn5kRppZy0f231HVRKfCXKjTAw96v
|
||||
endpoint: AgClXa9d4ePlMAN9w+JajdcDv+Kde3Zp90vgZ2RE3pGebMq4WNpIZ3hHZzUWQWS90ffhJmGsPrry14aGSkKyj+2i5pVLFjrMhRajOcWvQrWcdNa/2XrkijpSoGTM0wXm1yLgmfRZGnhgt5LFWjuiOFze8j984FseGWp7ZKGA86CSfiWFidcaUhzVUaPC4P/tdfQMHRnYq1GdFw/6TxZRvpoEW/RRm3P2B+H6nAyrjILpdOCEzvM88WiVF93IB/oQWw4HnRt92lQ0A2Ni81s/pTngIYhIyXS6KrWt9+0w131fJSdvC5TRidcYXVAllxRyKUm/2hEqEtCA+w3yMyQ7ZW6rEhqWAJrN0qlDzSQ3rmYzRMKWaXQVDxrMhqg6PkaYjuQYQRLmOWzJ+4KCgUXI1jPOce5W3KOGPwVJNUe7RDRrjep3fDn7XjFJoWJG76zzGkAYWsY2QkZ4LwnxzuAFFQ3iyLYw/KDnOGG3BZvIKCHDLhk31PCkrOZV4rlmm1RIPpSeZOmbBGYoM3vSvdXNmUxGzju2LL3mBF0O9OkgKozQO+ihCGVjHJMRvpB5mcoKvcP9g2+HidAwlEAt8igm5uFFx06OMnvv7RmI+kLpcgE+crA3W0L1gZKdxFZKNKxn+AFBxY5TrAoQpaSuGv8czGxuy/ZxLWF0fSKeyv4uCMWY1wq4eXT8QiyJbWYtBh9sqKF6pqNABeDNwg79y4sP8Z76PPJreN8Sy8kq06lQvDbk
|
||||
template:
|
||||
metadata:
|
||||
name: loki-storage
|
||||
namespace: openshift-logging
|
||||
type: Opaque
|
||||
@@ -0,0 +1,12 @@
|
||||
resources:
|
||||
- ../../../../../components/lvm-operator/base
|
||||
|
||||
patches:
|
||||
- patch: |-
|
||||
- op: add
|
||||
path: /spec/storage/deviceClasses/0/deviceSelector
|
||||
value:
|
||||
paths:
|
||||
- /dev/nvme0n1p5
|
||||
target:
|
||||
kind: LVMCluster
|
||||
@@ -0,0 +1,19 @@
|
||||
resources:
|
||||
- github.com/redhat-cop/gitops-catalog/nmstate/aggregate/overlays/default
|
||||
- node-network-configuration-policy.yaml
|
||||
|
||||
patches:
|
||||
- patch: |-
|
||||
- op: replace
|
||||
path: /spec/channel
|
||||
value: "stable"
|
||||
target:
|
||||
kind: Subscription
|
||||
name: kubernetes-nmstate-operator
|
||||
- patch: |-
|
||||
- op: add
|
||||
path: /metadata/annotations/argocd.argoproj.io~1sync-options
|
||||
value: SkipDryRunOnMissingResource=true
|
||||
target:
|
||||
kind: NMState
|
||||
name: nmstate
|
||||
@@ -0,0 +1,68 @@
|
||||
apiVersion: nmstate.io/v1
|
||||
kind: NodeNetworkConfigurationPolicy
|
||||
metadata:
|
||||
name: hub-server
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
spec:
|
||||
desiredState:
|
||||
interfaces:
|
||||
- name: enp0s31f6
|
||||
state: absent
|
||||
type: ethernet
|
||||
ipv4:
|
||||
dhcp: true
|
||||
enabled: true
|
||||
auto-dns: true
|
||||
|
||||
# interfaces:
|
||||
# - name: bond0
|
||||
# description: Bond with ports enp4s0 and enp0s31f6
|
||||
# type: bond
|
||||
# state: up
|
||||
# copy-mac-from: enp4s0
|
||||
# ipv4:
|
||||
# dhcp: false
|
||||
# enabled: true
|
||||
# link-aggregation:
|
||||
# mode: active-backup
|
||||
# options:
|
||||
# miimon: '140'
|
||||
# port:
|
||||
# - enp4s0
|
||||
# - enp0s31f6
|
||||
# mtu: 1450
|
||||
# - name: br1
|
||||
# description: Linux bridge with bond0 as a port
|
||||
# type: linux-bridge
|
||||
# state: up
|
||||
# mtu: 9000
|
||||
# ipv4:
|
||||
# enabled: false
|
||||
# bridge:
|
||||
# options:
|
||||
# stp:
|
||||
# enabled: false
|
||||
# port:
|
||||
# - name: bond0
|
||||
|
||||
# interfaces:
|
||||
# - name: enp4s0
|
||||
# state: up
|
||||
# type: ethernet
|
||||
# ipv4:
|
||||
# dhcp: false
|
||||
# enabled: true
|
||||
# - name: enp0s31f6
|
||||
# state: up
|
||||
# type: ethernet
|
||||
# ipv4:
|
||||
# dhcp: true
|
||||
# enabled: true
|
||||
# auto-dns: true
|
||||
# routes:
|
||||
# config:
|
||||
# - destination: 0.0.0.0/0
|
||||
# next-hop-address: 192.168.1.1
|
||||
# next-hop-interface: enp4s0
|
||||
# table-id: 254
|
||||
@@ -0,0 +1,15 @@
|
||||
resources:
|
||||
- set-max-pods.yaml
|
||||
- ../../../../../components/wake-on-lan/base
|
||||
|
||||
patches:
|
||||
- patch: |
|
||||
- op: replace
|
||||
path: /spec/config/systemd/units/0/name
|
||||
value: wol@enp0s31f6.service
|
||||
- op: add
|
||||
path: /metadata/labels/machineconfiguration.openshift.io~1role
|
||||
value: master
|
||||
target:
|
||||
kind: MachineConfig
|
||||
name: 99-wol-service
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: machineconfiguration.openshift.io/v1
|
||||
kind: KubeletConfig
|
||||
metadata:
|
||||
name: set-max-pods
|
||||
spec:
|
||||
autoSizingReserved: true
|
||||
machineConfigPoolSelector:
|
||||
matchLabels:
|
||||
pools.operator.machineconfiguration.openshift.io/master: ""
|
||||
kubeletConfig:
|
||||
podsPerCore: 10
|
||||
maxPods: 450
|
||||
@@ -0,0 +1 @@
|
||||
Note you need to manually generate the config bundle secret in the generate folder, at some point I'll fully gitops this process.
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,31 @@
|
||||
EXTERNAL_TLS_TERMINATION: false
|
||||
SERVER_HOSTNAME: registry.apps.home.ocplab.com
|
||||
PREFERRED_URL_SCHEME: https
|
||||
DISTRIBUTED_STORAGE_CONFIG:
|
||||
# using Minio on QNAP NAS
|
||||
radosGWStorage:
|
||||
- RadosGWStorage
|
||||
- access_key: XXXXX
|
||||
secret_key: XXXX
|
||||
bucket_name: quay
|
||||
hostname: lab-nas.ocplab.com
|
||||
is_secure: true
|
||||
port: 9000
|
||||
storage_path: /datastorage/registry
|
||||
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
|
||||
DISTRIBUTED_STORAGE_PREFERENCE:
|
||||
- radosGWStorage
|
||||
SSO_LOGIN_CONFIG:
|
||||
CLIENT_ID: quay
|
||||
CLIENT_SECRET: 723782ba-95d4-4d95-8b04-efebce0adf86
|
||||
OIDC_SERVER: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift/
|
||||
LOGIN_SCOPES:
|
||||
- openid
|
||||
SERVICE_NAME: OpenShift
|
||||
SUPER_USERS:
|
||||
- admin
|
||||
- quayadmin
|
||||
FEATURE_DIRECT_LOGIN: true
|
||||
FEATURE_USER_INITIALIZE: true
|
||||
FEATURE_QUOTA_MANAGEMENT: true
|
||||
FEATURE_PROXY_CACHE: true
|
||||
@@ -0,0 +1,2 @@
|
||||
oc create secret generic --from-file config.yaml=./config-qnap-private.yaml config-bundle-secret --from-file=ssl.cert=fullchain.pem --from-file=ssl.key=key.pem -o yaml --dry-run=client -n quay > config-bundle-secret-qnap.yaml
|
||||
kubeseal --format yaml --cert ~/.bitnami/publickey.pem < config-bundle-secret-qnap.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
# Using Route53 with DNS challenge, source AWS creds (not in git repo but just sets access and secret key as env variables)
|
||||
. aws-creds
|
||||
mkdir -p qnap-tls
|
||||
acme.sh --force --issue --dns dns_aws --cert-file "./qnap-tls/cert.pem" --key-file "./qnap-tls/key.pem" --fullchain-file "./qnap-tls/fullchain.pem" --ca-file "./qnap-tls/ca.cer" -d registry.apps.home.ocplab.com
|
||||
|
||||
# Convert CA to crt
|
||||
openssl x509 -inform PEM -in ./qnap-tls/ca.cer -out ./qnap-tls/letsencrypt_ca.crt
|
||||
@@ -0,0 +1,83 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: quay-init
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: quay-init
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: admin
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: quay-init
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: quay-init
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "20"
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- image: registry.redhat.io/ansible-automation-platform-21/ee-supported-rhel8:1.0
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: init-user-password
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
#!/usr/bin/env bash
|
||||
|
||||
echo "Setup temporary OCP user to make ansible happy"
|
||||
|
||||
echo "tempuser:x:$(id -u):$(id -g):,,,:${HOME}:/bin/bash" >> /etc/passwd
|
||||
echo "tempuser:x:$(id -G | cut -d' ' -f 2)" >> /etc/group
|
||||
id
|
||||
|
||||
echo "Waiting for two minutes for quay to be ready"
|
||||
|
||||
sleep 120
|
||||
|
||||
git clone https://github.com/gnunn-gitops/quay-init
|
||||
|
||||
cd quay-init
|
||||
|
||||
ansible-galaxy collection install -r collections/requirements.yaml
|
||||
|
||||
ansible-playbook quay-init.yaml -e quay_init_password=$quay_init_password -e ansible_remote_tmp=/tmp
|
||||
|
||||
echo "Waiting for deploy/registry-clair-app to be available"
|
||||
until oc get deployment registry-clair-app
|
||||
do
|
||||
sleep 5;
|
||||
done
|
||||
oc scale deploy/registry-clair-app --replicas=1
|
||||
|
||||
echo "Waiting for deploy/registry-quay-app to be available"
|
||||
until oc get deployment registry-quay-app
|
||||
do
|
||||
sleep 5;
|
||||
done
|
||||
oc set resources deploy/registry-quay-app -c=quay-app --requests=cpu=1,memory=1Gi --limits=cpu=2,memory=4Gi
|
||||
oc scale deploy/registry-quay-app --replicas=1
|
||||
|
||||
echo "Waiting for deploy/registry-clair-postgres to be available"
|
||||
until oc get deployment registry-clair-postgres
|
||||
do
|
||||
sleep 5;
|
||||
done
|
||||
oc set resources deploy/registry-clair-postgres -c=postgres --limits=memory=3Gi
|
||||
|
||||
name: init-quay
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Never
|
||||
terminationGracePeriodSeconds: 30
|
||||
serviceAccount: quay-init
|
||||
serviceAccountName: quay-init
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: bitnami.com/v1alpha1
|
||||
kind: SealedSecret
|
||||
metadata:
|
||||
name: init-user-password
|
||||
namespace: quay
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
encryptedData:
|
||||
quay_init_password: AgCFXt2+UWeWWgNO2EwPk10Vv07D8kXOYlVSPTi1AizSTJ35725eautJzhDSd1McS7A+VymUk6fdFDagx5oXJU7+Cr2V7n8sb+sQWQwiyaWuM4017PYHllCpMoU0Q5CF5yyZ11OyPPBi5Ucz391/TxgIZww9PGGXy2KolrL97fuvrVVgPdUdNw8SAG+6TlGTGiMuzg5VngLz8wKfNpQDdPum98DVRVvbzJHEp9Nu+rtglaCdLgsMcgTpWw59MKYsl7Slw7oZIxTZvRlu8m3DqGu+AqiFRGoLJpNhJ9aDMyH5QiQ+sf59VQILdTwTdPvC/wMAETKYqJ/PqEkTkYTsAdhS1AJDcMO2OoYGx7EheKNMRotjHSYor4DHedFqvVaA+X6ZjTU1so1Z5ToFW3tofnLXfrunuzUgU4Ld7pTl297Jyqy3J0kNF2vmsb0RExN8kbW+Rsk5rqHmYKm68lw28s+FI0Cejy29lk23j3V8m+WVY4ANtez1QTS0vU79+iauSVZx9Ab2hrD0IWLdU+18R+k1Mjd/ARBgxT/H6x4cGwhh32GF+46XPQpcNKrXeN0JsyDksllFHp6uXy6BYvDNxwm3eMVefOBdMkYr/z7pUqIYBtpQm9oyIEtr/j0f19CPmVX+glFsArVeCGizRrajtkLOb66x/OfoToZpwQzRalSwtHEHClLLXe8Y/HNm7vqx4golRYn3E3TiVOT0
|
||||
template:
|
||||
metadata:
|
||||
name: init-user-password
|
||||
namespace: quay
|
||||
type: Opaque
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
commonAnnotations:
|
||||
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
|
||||
|
||||
namespace: quay
|
||||
|
||||
resources:
|
||||
- github.com/redhat-cop/gitops-catalog/quay-operator/operator/overlays/stable-3.8
|
||||
- init-user-password-secret.yaml
|
||||
- init-quay-job.yaml
|
||||
- registry-config-bundle-secret.yaml
|
||||
- registry.yaml
|
||||
- registry-app-route.yaml
|
||||
@@ -0,0 +1,59 @@
|
||||
kind: Route
|
||||
apiVersion: route.openshift.io/v1
|
||||
metadata:
|
||||
name: registry-quay-app
|
||||
labels:
|
||||
app: quay
|
||||
quay-component: quay-app
|
||||
quay-operator/quayregistry: registry
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
host: registry.apps.home.ocplab.com
|
||||
to:
|
||||
kind: Service
|
||||
name: registry-quay-app
|
||||
weight: 100
|
||||
port:
|
||||
targetPort: https
|
||||
tls:
|
||||
termination: passthrough
|
||||
wildcardPolicy: None
|
||||
---
|
||||
apiVersion: route.openshift.io/v1
|
||||
kind: Route
|
||||
metadata:
|
||||
name: registry-quay-builder
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
host: registry-builder.apps.home.ocplab.com
|
||||
port:
|
||||
targetPort: grpc
|
||||
tls:
|
||||
insecureEdgeTerminationPolicy: Redirect
|
||||
termination: reencrypt
|
||||
to:
|
||||
kind: Service
|
||||
name: registry-quay-app
|
||||
weight: 100
|
||||
wildcardPolicy: None
|
||||
---
|
||||
apiVersion: route.openshift.io/v1
|
||||
kind: Route
|
||||
metadata:
|
||||
name: registry-quay-config-editor
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
host: registry-config-editor.apps.home.ocplab.com
|
||||
port:
|
||||
targetPort: http
|
||||
tls:
|
||||
insecureEdgeTerminationPolicy: Redirect
|
||||
termination: edge
|
||||
to:
|
||||
kind: Service
|
||||
name: registry-quay-config-editor
|
||||
weight: 100
|
||||
wildcardPolicy: None
|
||||
File diff suppressed because one or more lines are too long
@@ -0,0 +1,27 @@
|
||||
apiVersion: quay.redhat.com/v1
|
||||
kind: QuayRegistry
|
||||
metadata:
|
||||
name: registry
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "10"
|
||||
spec:
|
||||
components:
|
||||
- managed: false
|
||||
kind: tls
|
||||
- managed: false
|
||||
kind: horizontalpodautoscaler
|
||||
- kind: route
|
||||
managed: false
|
||||
- kind: postgres
|
||||
managed: true
|
||||
- kind: clair
|
||||
managed: true
|
||||
- kind: redis
|
||||
managed: true
|
||||
- kind: mirror
|
||||
managed: true
|
||||
- kind: monitoring
|
||||
managed: false
|
||||
- kind: objectstorage
|
||||
managed: false
|
||||
configBundleSecret: config-bundle-secret
|
||||
@@ -0,0 +1,14 @@
|
||||
resources:
|
||||
- ../../../../../components/rhtas-operator/operator/base
|
||||
- ../../../../../components/rhtas-operator/instance/base
|
||||
|
||||
patches:
|
||||
- patch: |
|
||||
- op: replace
|
||||
path: /spec/fulcio/config/OIDCIssuers/0/Issuer
|
||||
value: https://sso.ocplab.com/realms/ocplab
|
||||
- op: replace
|
||||
path: /spec/fulcio/config/OIDCIssuers/0/IssuerURL
|
||||
value: https://sso.ocplab.com/realms/ocplab
|
||||
target:
|
||||
kind: Securesign
|
||||
Reference in New Issue
Block a user