rblundon/homelab
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

Browse Source
This commit is contained in:
Ryan Blundon
2025-03-30 15:46:16 -05:00
parent 68785684d5 fe564d7227
commit d76d8f8e05
346 changed files with 11754 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cluster-config/clusters/overlays/local.hub/components/acs-operator/certificate.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: central-tls-letsencrypt-cert
namespace: stackrox
spec:
# Replace default secret since ACS doesn't support referencing a different secret
secretName: central-default-tls-cert
issuerRef:
name: letsencrypt-prod
kind: ClusterIssuer
dnsNames:
- central-stackrox.apps.hub.ocplab.com

6
cluster-config/clusters/overlays/local.hub/components/acs-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
resources:
- ../../../../../components/acs-operator/overlays/aggregate
- certificate.yaml

11
cluster-config/clusters/overlays/local.hub/components/consolelinks/acs-consolelink.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: console.openshift.io/v1
kind: ConsoleLink
metadata:
name: acs
spec:
href: 'https://central-stackrox.apps.hub.ocplab.com'
location: ApplicationMenu
text: Advanced Cluster Security
applicationMenu:
section: Red Hat Applications
imageURL: https://central-stackrox.apps.hub.ocplab.com/static/media/rh-favicon.0110fdfc5cab55416acf.ico

6
cluster-config/clusters/overlays/local.hub/components/consolelinks/kustomization.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../../../components/consolelinks/base
- acs-consolelink.yaml

15
cluster-config/clusters/overlays/local.hub/components/cost-management-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,15 @@
kind: Kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
namespace: costmanagement-metrics-operator
bases:
- https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate
patchesJson6902:
- path: patch-source-and-name.yaml
target:
group: costmanagement-metrics-cfg.openshift.io
kind: CostManagementMetricsConfig
name: config
version: v1beta1

6
cluster-config/clusters/overlays/local.hub/components/cost-management-operator/patch-source-and-name.yaml Normal file
View File

@@ -0,0 +1,6 @@
- op: replace
path: /spec/source/name
value: Hub
- op: replace
path: /metadata/name
value: hub-cluster

13
cluster-config/clusters/overlays/local.hub/components/eso/doppler-push-secret-store.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: external-secrets.io/v1beta1
kind: ClusterSecretStore
metadata:
name: doppler-push-secret
spec:
provider:
doppler:
auth:
secretRef:
dopplerToken:
name: eso-token-cluster-push-secret
key: dopplerToken
namespace: hub-secrets

3
cluster-config/clusters/overlays/local.hub/components/eso/kustomization.yaml Normal file
View File

@@ -0,0 +1,3 @@
resources:
- ../../../../../components/eso/overlays/aggregate
- doppler-push-secret-store.yaml

54
cluster-config/clusters/overlays/local.hub/components/lokistack/README.md Normal file
View File

@@ -0,0 +1,54 @@
### Introduction
Installs the Tech Preview LokiStack for cluster logging using local QNAP NAS for object storage.
Installation is based on docs here:
https://github.com/grafana/loki/blob/main/operator/docs/forwarding_logs_to_gateway.md#openshift-logging
# Accessing logs
You can access the logs using the logcli tool from grafana:
https://github.com/grafana/loki/releases/tag/v2.5.0
Example queries:
View raw application logs:
```
export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev"}'
```
View applicatons logs textually without JSON:
```
export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application
logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev", kubernetes_container_name="server"}' --output=raw | jq '."@timestamp",.kubernetes.pod_name,.level,.message' | paste - - - -
```
View infrastructure logs:
```
export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/infrastructure
logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="openshift-logging"}'
```
### Storage Secret
You will need a storage secret for your S3 bucket for Loki to use, format of secret is as follows:
```
apiVersion: v1
data:
access_key_id: XXXXXX
access_key_secret: XXXXXX
bucketnames: XXXXXX
endpoint: XXXXXXXXXXXX
kind: Secret
metadata:
name: loki-storage
namespace: openshift-logging
```
The sealed secret here is referencing Minio running on my QNAP NAS so non AWS S3 buckets do work fine.

8
cluster-config/clusters/overlays/local.hub/components/lokistack/kustomization.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../../../../components/loki/operator/cluster-logging/base
- ../../../../../components/loki/operator/loki/base
- ../../../../../components/loki/instance/overlays/sno
- loki-storage-qnap-secret.yaml

16
cluster-config/clusters/overlays/local.hub/components/lokistack/loki-storage-qnap-secret.yaml Normal file
View File

@@ -0,0 +1,16 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: loki-storage
namespace: openshift-logging
spec:
encryptedData:
access_key_id: AgADsXMtym0OLY598xcLZ4e6zPgh9x3KtCRX59K3J/LriPJPwNuMugAMZcHjLaA9nm+Rwqg095uhGD0pUxK5N336fMiMJ+7WpzMsR8nqMS3eoOtxhXBwML5wXqLmpf2FSxujUXws847JsohHtZiCg6ZBlWuJ2pEaCz6yPecMU8dixz+7OMs079origgakI0FjHlEPMn6BOhAOR4TMCt877mNmeLWrmxNEQt3ql4qMvNH3Ru8G4YijmO+jS9OQYqXYwTbO237zx+D3DDw0PAuUzqMIKXSZZdGNmATXIROu9+4TJGT6YnraMxON81F4t78D+y6reM6AIXN49SDcIxpmSZrtLJ5QQesOPbZ+x4mdR2Rj4RaqyktuNaBknn+CUCtx9aUv5LpWcIu/e+ZXTsVLVXLsmDpVv/k9fe1tyhlQPgdCAg/Iwn+xF3YVvLEpfhrXrkcKFK0snn242NbJk4aTcY28O+XHyJn7lmsbu/BSao7cqtbwJsFNCVo+e23KUkBoenw3LMQ2lyle9AfLyD10JIR5beozyt6pxxPDjnBXx8zlxhA0dPryQkm5O/+fiJd3gidzJmZZuVr8i20DaBoM3RnDhF0uccgDsbbM0N9KkEO1JXco22NGeBveKtkMOQaNy7i1QIHIFafkcyP9CStz8swsaWk5WaSEyr7ysiKpZlYE6tyaHPW2h4/uG/NfrOi6PXzPE4d90oyOeVIC28Obxse3aVRTw==
access_key_secret: AgCE8EHoWhZm4q25TcXlMy65uPopUNULeyw1Z+reSAr3pDaT+9B2k8TkPyo8vwCLYykqQqPS3VV7X6J80upVGWbYBVUM/7kI3W6F1kRl5eQjDmkAUmFa0t2EAxQP7TN1VPHVLZGUhwTGXjARdDGgDHi/We7jhl781ZFIZ8G0nkWCSZrB4T4XI+Mb154nR+GMejrstjzhFdueWgFZX/wX3PmcbmI+eAu0yeiW9IWikmDTrQyv1P46dDyPAKquZc7Dbgy4AxJ/ebeQ4558sOW9hvhTxoQ0hrEezeOMAbzQKqPd2Y5470LxMtoGL+FNqbLHTBQnqSucyDzOO2hiFhnUaCPvpCE/TRT7T3NbQ8uaugYaRR3eNa3w9ILWduMQ2yDsG+cNrYHXcyoUtdAQQ1eRv11jFYFVARRRGuGiFzWsLmMDvokCxQgkYpJXj5HqeZ+oT2xBVgd7P+c6ZQXRzfuwUXTUh+w3QxZ4XrqBq1jv7RRnu+uCj3E+vaavqIS8ipYXfLzjneHFhlAm9GS3rAIbCPlrZCaIIe/r4KRjtP7Gj4f6jhaN5Xo5jvBPqLYfX/RY8fll9XJAZGH6a9k+NDcxrwiV/UBDEQcPgnx83bCuFQ/qvIdd3tnOZ2dIvEHXnLMfBYOd0OyvkC3CoGKgmf4d6x4xvrzyqRHSIBxOGvDMG54IutZwHngFEuQbtGgtD0eN/SsLRO4wcuDugYVgiSPCHQ+IONUqvj7c7IJgRQKad2oxmlP7ZzSExVV8
bucketnames: AgDA2DCtrPQmcdJ/QTBNZgmf2C7VSE96LVwje8J1N9XbmTte/d0oO9V0vUanXRKdraISTlHWBRBrYOxKx42nZMVzxKOHUCBMrdSN2z9ytgxNMhX2XNusTd4oDucsW+KM4IZyg95CXNvOSt01Y/uwdnJNK71VaiCSM1Sp+lIgVBzkwiase/YitOmCXVBofVLubWtsVwIGy5cWMmNhWmD0fjG5aIQ0Nx3OjYq/tIsrM4iB7FOn9Us1PQ9bkUNqJKu3LZtNIklzgDEUY6+uwtULt/jh8bTGHdptG18D1tuBf1SmD/xIWeCHf5Btp7XgRjivBR45DDIZHyc5mNdM7ydNvmae8SgOrugBWACQ37ZYiRIivDHJDs6Aa0fWDDd4ntdYclix7SurmqLx+/wzp7nyNmF3rCJY0u3FyX7twmLO2xZyabfqIqPY+kiGlKBY8uLGkLSDXbaLF78Vkww8Q5m5qdOZklADB+VZyii2PyFxLodeOKWujdG7vFnCiI41hCj3ry1FFM8o6397GO2zL1j4bflsmYh+9c5YKgc3ykzbLnAl+G30A505uXpBLJuXmHHXayGTNzU0D3EtWKnEwXF5NRYRQTdBPrwmUo7ml/UU04bdvJGob9dxGjypjB9CQG9pL3ouGTZZ60kNnSodhnKbRFv+Z1P8oNi4Vz6789eOrLVdn5kRppZy0f231HVRKfCXKjTAw96v
endpoint: AgClXa9d4ePlMAN9w+JajdcDv+Kde3Zp90vgZ2RE3pGebMq4WNpIZ3hHZzUWQWS90ffhJmGsPrry14aGSkKyj+2i5pVLFjrMhRajOcWvQrWcdNa/2XrkijpSoGTM0wXm1yLgmfRZGnhgt5LFWjuiOFze8j984FseGWp7ZKGA86CSfiWFidcaUhzVUaPC4P/tdfQMHRnYq1GdFw/6TxZRvpoEW/RRm3P2B+H6nAyrjILpdOCEzvM88WiVF93IB/oQWw4HnRt92lQ0A2Ni81s/pTngIYhIyXS6KrWt9+0w131fJSdvC5TRidcYXVAllxRyKUm/2hEqEtCA+w3yMyQ7ZW6rEhqWAJrN0qlDzSQ3rmYzRMKWaXQVDxrMhqg6PkaYjuQYQRLmOWzJ+4KCgUXI1jPOce5W3KOGPwVJNUe7RDRrjep3fDn7XjFJoWJG76zzGkAYWsY2QkZ4LwnxzuAFFQ3iyLYw/KDnOGG3BZvIKCHDLhk31PCkrOZV4rlmm1RIPpSeZOmbBGYoM3vSvdXNmUxGzju2LL3mBF0O9OkgKozQO+ihCGVjHJMRvpB5mcoKvcP9g2+HidAwlEAt8igm5uFFx06OMnvv7RmI+kLpcgE+crA3W0L1gZKdxFZKNKxn+AFBxY5TrAoQpaSuGv8czGxuy/ZxLWF0fSKeyv4uCMWY1wq4eXT8QiyJbWYtBh9sqKF6pqNABeDNwg79y4sP8Z76PPJreN8Sy8kq06lQvDbk
template:
metadata:
name: loki-storage
namespace: openshift-logging
type: Opaque

12
cluster-config/clusters/overlays/local.hub/components/lvm-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,12 @@
resources:
- ../../../../../components/lvm-operator/base
patches:
- patch: |-
- op: add
path: /spec/storage/deviceClasses/0/deviceSelector
value:
paths:
- /dev/nvme0n1p5
target:
kind: LVMCluster

19
cluster-config/clusters/overlays/local.hub/components/nmstate/kustomization.yaml Normal file
View File

@@ -0,0 +1,19 @@
resources:
- github.com/redhat-cop/gitops-catalog/nmstate/aggregate/overlays/default
- node-network-configuration-policy.yaml
patches:
- patch: |-
- op: replace
path: /spec/channel
value: "stable"
target:
kind: Subscription
name: kubernetes-nmstate-operator
- patch: |-
- op: add
path: /metadata/annotations/argocd.argoproj.io~1sync-options
value: SkipDryRunOnMissingResource=true
target:
kind: NMState
name: nmstate

68
cluster-config/clusters/overlays/local.hub/components/nmstate/node-network-configuration-policy.yaml Normal file
View File

@@ -0,0 +1,68 @@
apiVersion: nmstate.io/v1
kind: NodeNetworkConfigurationPolicy
metadata:
name: hub-server
annotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
spec:
desiredState:
interfaces:
- name: enp0s31f6
state: absent
type: ethernet
ipv4:
dhcp: true
enabled: true
auto-dns: true
# interfaces:
# - name: bond0
# description: Bond with ports enp4s0 and enp0s31f6
# type: bond
# state: up
# copy-mac-from: enp4s0
# ipv4:
# dhcp: false
# enabled: true
# link-aggregation:
# mode: active-backup
# options:
# miimon: '140'
# port:
# - enp4s0
# - enp0s31f6
# mtu: 1450
# - name: br1
# description: Linux bridge with bond0 as a port
# type: linux-bridge
# state: up
# mtu: 9000
# ipv4:
# enabled: false
# bridge:
# options:
# stp:
# enabled: false
# port:
# - name: bond0
# interfaces:
# - name: enp4s0
# state: up
# type: ethernet
# ipv4:
# dhcp: false
# enabled: true
# - name: enp0s31f6
# state: up
# type: ethernet
# ipv4:
# dhcp: true
# enabled: true
# auto-dns: true
# routes:
# config:
# - destination: 0.0.0.0/0
# next-hop-address: 192.168.1.1
# next-hop-interface: enp4s0
# table-id: 254

15
cluster-config/clusters/overlays/local.hub/components/node-config/kustomization.yaml Normal file
View File

@@ -0,0 +1,15 @@
resources:
- set-max-pods.yaml
- ../../../../../components/wake-on-lan/base
patches:
- patch: |
- op: replace
path: /spec/config/systemd/units/0/name
value: wol@enp0s31f6.service
- op: add
path: /metadata/labels/machineconfiguration.openshift.io~1role
value: master
target:
kind: MachineConfig
name: 99-wol-service

12
cluster-config/clusters/overlays/local.hub/components/node-config/set-max-pods.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
name: set-max-pods
spec:
autoSizingReserved: true
machineConfigPoolSelector:
matchLabels:
pools.operator.machineconfiguration.openshift.io/master: ""
kubeletConfig:
podsPerCore: 10
maxPods: 450

1
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/README.md Normal file
View File

@@ -0,0 +1 @@
Note you need to manually generate the config bundle secret in the generate folder, at some point I'll fully gitops this process.

10
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-bundle-secret-qnap.yaml Normal file
View File

File diff suppressed because one or more lines are too long

31
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml Normal file
View File

@@ -0,0 +1,31 @@
EXTERNAL_TLS_TERMINATION: false
SERVER_HOSTNAME: registry.apps.home.ocplab.com
PREFERRED_URL_SCHEME: https
DISTRIBUTED_STORAGE_CONFIG:
# using Minio on QNAP NAS
radosGWStorage:
- RadosGWStorage
- access_key: XXXXX
secret_key: XXXX
bucket_name: quay
hostname: lab-nas.ocplab.com
is_secure: true
port: 9000
storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
- radosGWStorage
SSO_LOGIN_CONFIG:
CLIENT_ID: quay
CLIENT_SECRET: 723782ba-95d4-4d95-8b04-efebce0adf86
OIDC_SERVER: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift/
LOGIN_SCOPES:
- openid
SERVICE_NAME: OpenShift
SUPER_USERS:
- admin
- quayadmin
FEATURE_DIRECT_LOGIN: true
FEATURE_USER_INITIALIZE: true
FEATURE_QUOTA_MANAGEMENT: true
FEATURE_PROXY_CACHE: true

2
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh Executable file
View File

@@ -0,0 +1,2 @@
oc create secret generic --from-file config.yaml=./config-qnap-private.yaml config-bundle-secret --from-file=ssl.cert=fullchain.pem --from-file=ssl.key=key.pem -o yaml --dry-run=client -n quay > config-bundle-secret-qnap.yaml
kubeseal --format yaml --cert ~/.bitnami/publickey.pem < config-bundle-secret-qnap.yaml

7
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh Executable file
View File

@@ -0,0 +1,7 @@
# Using Route53 with DNS challenge, source AWS creds (not in git repo but just sets access and secret key as env variables)
. aws-creds
mkdir -p qnap-tls
acme.sh --force --issue --dns dns_aws --cert-file "./qnap-tls/cert.pem" --key-file "./qnap-tls/key.pem" --fullchain-file "./qnap-tls/fullchain.pem" --ca-file "./qnap-tls/ca.cer" -d registry.apps.home.ocplab.com
# Convert CA to crt
openssl x509 -inform PEM -in ./qnap-tls/ca.cer -out ./qnap-tls/letsencrypt_ca.crt

83
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-quay-job.yaml Normal file
View File

@@ -0,0 +1,83 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: quay-init
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: quay-init
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: admin
subjects:
- kind: ServiceAccount
name: quay-init
---
apiVersion: batch/v1
kind: Job
metadata:
name: quay-init
annotations:
argocd.argoproj.io/sync-wave: "20"
spec:
template:
spec:
containers:
- image: registry.redhat.io/ansible-automation-platform-21/ee-supported-rhel8:1.0
envFrom:
- secretRef:
name: init-user-password
command:
- /bin/bash
- -c
- |
#!/usr/bin/env bash
echo "Setup temporary OCP user to make ansible happy"
echo "tempuser:x:$(id -u):$(id -g):,,,:${HOME}:/bin/bash" >> /etc/passwd
echo "tempuser:x:$(id -G | cut -d' ' -f 2)" >> /etc/group
id
echo "Waiting for two minutes for quay to be ready"
sleep 120
git clone https://github.com/gnunn-gitops/quay-init
cd quay-init
ansible-galaxy collection install -r collections/requirements.yaml
ansible-playbook quay-init.yaml -e quay_init_password=$quay_init_password -e ansible_remote_tmp=/tmp
echo "Waiting for deploy/registry-clair-app to be available"
until oc get deployment registry-clair-app
do
sleep 5;
done
oc scale deploy/registry-clair-app --replicas=1
echo "Waiting for deploy/registry-quay-app to be available"
until oc get deployment registry-quay-app
do
sleep 5;
done
oc set resources deploy/registry-quay-app -c=quay-app --requests=cpu=1,memory=1Gi --limits=cpu=2,memory=4Gi
oc scale deploy/registry-quay-app --replicas=1
echo "Waiting for deploy/registry-clair-postgres to be available"
until oc get deployment registry-clair-postgres
do
sleep 5;
done
oc set resources deploy/registry-clair-postgres -c=postgres --limits=memory=3Gi
name: init-quay
dnsPolicy: ClusterFirst
restartPolicy: Never
terminationGracePeriodSeconds: 30
serviceAccount: quay-init
serviceAccountName: quay-init

15
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-user-password-secret.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
name: init-user-password
namespace: quay
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
encryptedData:
quay_init_password: AgCFXt2+UWeWWgNO2EwPk10Vv07D8kXOYlVSPTi1AizSTJ35725eautJzhDSd1McS7A+VymUk6fdFDagx5oXJU7+Cr2V7n8sb+sQWQwiyaWuM4017PYHllCpMoU0Q5CF5yyZ11OyPPBi5Ucz391/TxgIZww9PGGXy2KolrL97fuvrVVgPdUdNw8SAG+6TlGTGiMuzg5VngLz8wKfNpQDdPum98DVRVvbzJHEp9Nu+rtglaCdLgsMcgTpWw59MKYsl7Slw7oZIxTZvRlu8m3DqGu+AqiFRGoLJpNhJ9aDMyH5QiQ+sf59VQILdTwTdPvC/wMAETKYqJ/PqEkTkYTsAdhS1AJDcMO2OoYGx7EheKNMRotjHSYor4DHedFqvVaA+X6ZjTU1so1Z5ToFW3tofnLXfrunuzUgU4Ld7pTl297Jyqy3J0kNF2vmsb0RExN8kbW+Rsk5rqHmYKm68lw28s+FI0Cejy29lk23j3V8m+WVY4ANtez1QTS0vU79+iauSVZx9Ab2hrD0IWLdU+18R+k1Mjd/ARBgxT/H6x4cGwhh32GF+46XPQpcNKrXeN0JsyDksllFHp6uXy6BYvDNxwm3eMVefOBdMkYr/z7pUqIYBtpQm9oyIEtr/j0f19CPmVX+glFsArVeCGizRrajtkLOb66x/OfoToZpwQzRalSwtHEHClLLXe8Y/HNm7vqx4golRYn3E3TiVOT0
template:
metadata:
name: init-user-password
namespace: quay
type: Opaque

15
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
commonAnnotations:
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
namespace: quay
resources:
- github.com/redhat-cop/gitops-catalog/quay-operator/operator/overlays/stable-3.8
- init-user-password-secret.yaml
- init-quay-job.yaml
- registry-config-bundle-secret.yaml
- registry.yaml
- registry-app-route.yaml

59
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-app-route.yaml Normal file
View File

@@ -0,0 +1,59 @@
kind: Route
apiVersion: route.openshift.io/v1
metadata:
name: registry-quay-app
labels:
app: quay
quay-component: quay-app
quay-operator/quayregistry: registry
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
host: registry.apps.home.ocplab.com
to:
kind: Service
name: registry-quay-app
weight: 100
port:
targetPort: https
tls:
termination: passthrough
wildcardPolicy: None
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: registry-quay-builder
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
host: registry-builder.apps.home.ocplab.com
port:
targetPort: grpc
tls:
insecureEdgeTerminationPolicy: Redirect
termination: reencrypt
to:
kind: Service
name: registry-quay-app
weight: 100
wildcardPolicy: None
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: registry-quay-config-editor
annotations:
argocd.argoproj.io/sync-wave: "0"
spec:
host: registry-config-editor.apps.home.ocplab.com
port:
targetPort: http
tls:
insecureEdgeTerminationPolicy: Redirect
termination: edge
to:
kind: Service
name: registry-quay-config-editor
weight: 100
wildcardPolicy: None

14
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-config-bundle-secret.yaml Normal file
View File

File diff suppressed because one or more lines are too long

27
cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry.yaml Normal file
View File

@@ -0,0 +1,27 @@
apiVersion: quay.redhat.com/v1
kind: QuayRegistry
metadata:
name: registry
annotations:
argocd.argoproj.io/sync-wave: "10"
spec:
components:
- managed: false
kind: tls
- managed: false
kind: horizontalpodautoscaler
- kind: route
managed: false
- kind: postgres
managed: true
- kind: clair
managed: true
- kind: redis
managed: true
- kind: mirror
managed: true
- kind: monitoring
managed: false
- kind: objectstorage
managed: false
configBundleSecret: config-bundle-secret

14
cluster-config/clusters/overlays/local.hub/components/rhtas-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,14 @@
resources:
- ../../../../../components/rhtas-operator/operator/base
- ../../../../../components/rhtas-operator/instance/base
patches:
- patch: |
- op: replace
path: /spec/fulcio/config/OIDCIssuers/0/Issuer
value: https://sso.ocplab.com/realms/ocplab
- op: replace
path: /spec/fulcio/config/OIDCIssuers/0/IssuerURL
value: https://sso.ocplab.com/realms/ocplab
target:
kind: Securesign