diff --git a/remodel/k8s/README.md b/remodel/k8s/README.md index 3e941b3..f62efa3 100644 --- a/remodel/k8s/README.md +++ b/remodel/k8s/README.md @@ -9,7 +9,7 @@ kubectl kustomize --enable-helm infra/network/cilium | kubectl apply -f - ## Sealed-secrets ```shell -kubectl kustomize --enable-helm infra/controllers/sealed-secrets | kubectl apply -f - +kustomize build --enable-helm infra/controllers/sealed-secrets | kubectl apply -f - ``` ## Proxmox CSI Plugin @@ -25,7 +25,15 @@ kubectl get csistoragecapacities -ocustom-columns=CLASS:.storageClassName,AVAIL: ## Argo CD ```shell -kubectl kustomize --enable-helm infra/controllers/argocd | kubectl apply -f - +kubeseal -oyaml --controller-namespace=sealed-secrets < argocd-docker-secret.yaml > infra/argocd/docker-helm-credentials.yaml +``` + +```shell +kubeseal -oyaml --controller-namespace=sealed-secrets < argocd-ghcr-secret.yaml > infra/argocd/ghcr-helm-credentials.yaml +``` + +```shell +kustomize build --enable-helm infra/argocd | kubectl apply -f - ``` ```shell @@ -34,4 +42,8 @@ kubectl -n argocd get secret argocd-initial-admin-secret -ojson | jq -r ' .data. ```shell kubectl kustomize --enable-helm infra/storage | kubectl apply -f - -``` \ No newline at end of file +``` + +```shell +kubectl kustomize --enable-helm infra/controllers | kubectl apply -f - +``` diff --git a/remodel/k8s/infra/controllers/argocd/docker-helm-credentials.yaml b/remodel/k8s/infra/controllers/argocd/docker-helm-credentials.yaml new file mode 100644 index 0000000..d597b3b --- /dev/null +++ b/remodel/k8s/infra/controllers/argocd/docker-helm-credentials.yaml @@ -0,0 +1,13 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: argocd-docker-helm-credentials + namespace: argocd +spec: + encryptedData: + password: AgDYFcrvLka10TTS5ozL/1o5VZDe7eRsYNHKAwx5yn+/taEtCP5a2ldzOdFYWdrdCPXQHdJk0vBnf2qKzyTem2HiWy42vqtOe95KujPT/WD4mnoAwU9iI4aQQjfI4tj4BJuo2hyCA4kS9V5PPmNul3wa6vigbrnPBgYPMT3vlMpIW/eKWcGvX/uvX8JWdg1LYSQqIhW5d8pzTu6cVoWyJwv1Sh5yfy33sbjQ5Mdy1LQEV4O5J+YjCDTIuEYtJo7GFuhxMseJIwy8m0NmiAj/ItG9H3n8TVj0SBlICNPCL3Du9oXCgHy3IfPymhoC9aWLgnMA9vhn0h96U2hbzRzLufVkogM869nSqfty45xcAPxRCtPV6Yr5JlGRE0CmlLCw7NIbTBU2CREcBARQLNbO5Rrp0bUvLOuP9CxLwppHkZJmNbJ7UYFh5q/5a0tT3cBp9PjC4PoMsoEg9EydmSd4layxIGRcy/tkdbYqyzheQNWV1Vv5iJ0ecArnt/jjMyAxwRYkeNoTVb8g6QSjFxtUErbXHNK5YJKywLFDrrus/QTNZE2q/xDRWpPKJpF74eCNFwCm2Mk3BXwvTfGgze0szuu1nwzkgYnozmGAZCmwlG5UQgFMrgB1RGABScYEiXtqowfH0bSjQHAAv5E6XnDAhO1qZEl205ohnGhza30QAXUlVNHNCNnvJkS5XL/+hAsY9Afrda9bVh3xhLnk0ckYF4+vni24NaIzqMecCcmMV/RHbcirfpI= + username: AgAPHJn1UFPef0ZEbeGQ8wZpfIPMJ1UWLyqkIaXFtGJYDO82OsU6pwxzJpKYWXjysSg3S0RNraA3JsObs5NOcxB5dOecKNs50k5s/mAGrS5n/q2LRAekRZFYRYNBQhaa17Q2D7vVkj2gYNhCJkk9Orgc1N7iJbpienNEH/R0bjplGa2AvOk5T4HB8qaQB5LTLR7it3gVzak/Uo3fl3TATGF/YBgHVWsZioEIxs7Z8QK9R2NCWQm+63ddXKqvnZjqDf2KTKYTLlNcmEi8XNjW2/5CfWfZbB/7d5jbqBYOSLsr0SZ4JuAOeFhifOVqIXqHm0CBV9jB0IoL7Nlxoy4jD9SUN2CackAuktM+LDs8BEeKiB0YAMIiX/4pkaxGnc8D1n/6AfRZ/tlJgIhLkB6BjjsYhObfCKQRTu8pGUpOyoHrCalZW6Cx3pz5Qjcidac8K4CN9kCuIGUlpwXUi1jgPioJRfPRwlGdQpZK51vE4FiNByDntCSr4vSDcGNxuE4kwwPJz0pXhZG+pRnGVYe4ok+bHgyxlw/OzOqqj+UdD6Sv1FoLvyibxIYj0ZmsGCbxwI9wZR6Wmx1w9OV2H25k4QDpH8yXOtCag6PPF7Y9LTN6aeX3CrXV3bMBUE4NSia7WQ+sDs0vGQlmz9a/yUTw6ziD5XIqqOHUF1XJy2Hk6JZ6MJRKzf0xfEY2b2fF2qLl1H2Zl9dbL60= + template: + metadata: + name: argocd-docker-helm-credentials + namespace: argocd diff --git a/remodel/k8s/infra/controllers/argocd/ghcr-helm-credentials.yaml b/remodel/k8s/infra/controllers/argocd/ghcr-helm-credentials.yaml new file mode 100644 index 0000000..9935c84 --- /dev/null +++ b/remodel/k8s/infra/controllers/argocd/ghcr-helm-credentials.yaml @@ -0,0 +1,13 @@ +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + name: argocd-ghcr-helm-credentials + namespace: argocd +spec: + encryptedData: + password: AgDJl0Iry4mvGquzKgJ+2cthSMbbkDigY0t9D4uy8cL7cq4TFCFgy/yPsBnjbFjbRPMCo0HeaTPcvsQn0oidex8KfCccRZZJhj7U9i5p0yL5GhEWFgqejh0/82GviXtz9apDdkeqHCAxO7SP9MlrPKPQb1Je2RcSWl5sqRbGcCRxAZ5655Okx8k3ReFOFCBSqu22asQ/SHTOHHJgdT1tZ2jIV4vYtbOSWIRToSsXOxiHHqczrjTmj/LhpH4dKHUNowZxlV9V6Sklr0iXsOZQ4uWMraO14iWEMcX4TLbpXUr4ynLuqHNraoLvSd8/qiJOjcj+TSAFMZ0gkKJo1oLkvHWfVCh0oTAtAztlOwtrKGC7jEM8H29DX3QCM0A707AYWcpp7rHnX73xR0QNuzgExxvtNuBnQEz2tsCAmaOJxI/5h3P5SJzNl9/kzA1j9v+mUg59UJcswtGtCyXl2nNs2oZZNq70jTW0H5kbEbl4PIuudZ8KR4ly7cmpUI+SJFzLp0dvtfe7KJPJ21EOPoyULws6z+G6ju66WHO3wnprsHJGJX1mvBOG8/c83f0J2mp3PnaOupPDvRGIpf9P8oFNpxurrQKrG3sMdbYCGF/Go2FnR77YV0U8WtjtOodMH5JM6AfdEPGumqbpPjrXLWoc0jjX0fmx6lO7ptuVTzTLjMC/ds/9KsTxyP3l1J0qFkxAWFzdpptnqlfei7SdmSfA2xxOzgu/Q7Juve3Yu9DBu9kHf0zSFoY9cUDIHonplpo0w3LVl86qs5kgVmkszOfGbn/I7qSiwijdB2aj7Po2sv05FgJm+TbhtFRBC9pv1pk= + username: AgAhWDU81aYqCplI25qaQM8TmlfrEjrHAM/RZfao40b4dpr93rWYAhhehnfH+UpoYftt/epGPZ1Jw6N61ph1+cEOjCdDYT497va4IjL3EYLrjODMQdRqeem06DMGmoWFj6BaQPdA5FuIOJJnqbcFHuyloYHjnWSQVzLLGlc2DLhAPmsIog625+SXjHCRGMFR6Gwsndfc2P47CBshnXNv/t4JgluyIwW0iKMHVsafAJhf5JWc9gldcV0CBkqRf9fRKh777Dz6+SKJJkd+2bD+N7kXr+CBcr7SPuJa+/Hia2S1tbUukjfZ3gjwNz1vzxNBzJ/sbVJM6w0qbESyMtKUYBPEkOx5F3fmsvZ1nihch/pM/Hz+nlk2Z+6+DqZC5yW7qpNE/kBpMFcUgusqXUEJeEwGNs+fcf+thVXXLqqiF/IhSsWBms4C+hOX2ECdzrd2t/gD9XmcflaqhrbkWt596RkTH1sAC8lR6MncwNJk/AtlydQxZHWJNMr5nA+c3AvdSaVgsUTMmC8hJVeOCQaVC9JhtRpqZqQ+RS2pl7SZo829GxCuKuOFkqc1GVudWVJe2R5Xw+CJzwg0xxyt86whXC5If0g6mCRMfd44lFPiHJKa94VZDZkQtA5eaDG++yYoIVbF370g1DTk+S3Lndtsc2KzDPdKYqaWETKdenpEWxadzxHXyakfu98EbUbf04xn6tbi1BvPyTA= + template: + metadata: + name: argocd-ghcr-helm-credentials + namespace: argocd \ No newline at end of file diff --git a/remodel/k8s/infra/argocd/http-route.yaml b/remodel/k8s/infra/controllers/argocd/http-route.yaml similarity index 100% rename from remodel/k8s/infra/argocd/http-route.yaml rename to remodel/k8s/infra/controllers/argocd/http-route.yaml diff --git a/remodel/k8s/infra/argocd/kustomization.yaml b/remodel/k8s/infra/controllers/argocd/kustomization.yaml similarity index 75% rename from remodel/k8s/infra/argocd/kustomization.yaml rename to remodel/k8s/infra/controllers/argocd/kustomization.yaml index 017b201..be8be74 100644 --- a/remodel/k8s/infra/argocd/kustomization.yaml +++ b/remodel/k8s/infra/controllers/argocd/kustomization.yaml @@ -3,12 +3,14 @@ kind: Kustomization resources: - ns.yaml +# - ghcr-helm-credentials.yaml +# - docker-helm-credentials.yaml # - http-route.yaml helmCharts: - name: argo-cd repo: https://argoproj.github.io/argo-helm - version: 7.3.3 + version: 7.3.4 releaseName: "argocd" namespace: argocd valuesFile: values.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/argocd/ns.yaml b/remodel/k8s/infra/controllers/argocd/ns.yaml similarity index 100% rename from remodel/k8s/infra/argocd/ns.yaml rename to remodel/k8s/infra/controllers/argocd/ns.yaml diff --git a/remodel/k8s/infra/argocd/values.yaml b/remodel/k8s/infra/controllers/argocd/values.yaml similarity index 59% rename from remodel/k8s/infra/argocd/values.yaml rename to remodel/k8s/infra/controllers/argocd/values.yaml index d75aa9b..70932c5 100644 --- a/remodel/k8s/infra/argocd/values.yaml +++ b/remodel/k8s/infra/controllers/argocd/values.yaml @@ -17,7 +17,58 @@ crds: # -- Keep CRDs on chart uninstall keep: false +controller: + resources: + limits: + cpu: 1000m + memory: 2Gi + requests: + cpu: 100m + memory: 700Mi + +dex: + resources: + limits: + cpu: 50m + memory: 64Mi + requests: + cpu: 10m + memory: 32Mi + +redis: + resources: + limits: + cpu: 200m + memory: 128Mi + requests: + cpu: 100m + memory: 64Mi + +server: + resources: + limits: + cpu: 100m + memory: 128Mi + requests: + cpu: 50m + memory: 64Mi + repoServer: + containerSecurityContext: + readOnlyRootFilesystem: true + volumes: + - name: cmp-kustomize-build-with-helm + configMap: + name: argocd-cmp-cm + - name: cmp-tmp + emptyDir: { } + resources: + limits: + cpu: 50m + memory: 512Mi + requests: + cpu: 10m + memory: 256Mi extraContainers: - name: kustomize-build-with-helm command: @@ -40,10 +91,22 @@ repoServer: subPath: kustomize-build-with-helm.yaml - mountPath: /tmp name: cmp-tmp - volumes: - - name: cmp-kustomize-build-with-helm - configMap: - name: argocd-cmp-cm - - name: cmp-tmp - emptyDir: { } +applicationSet: + resources: + limits: + cpu: 50m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + +notifications: + enabled: false + resources: + limits: + cpu: 50m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi diff --git a/remodel/k8s/infra/controllers/sealed-secrets/kustomization.yaml b/remodel/k8s/infra/controllers/sealed-secrets/kustomization.yaml index 13f6955..6fba9ea 100644 --- a/remodel/k8s/infra/controllers/sealed-secrets/kustomization.yaml +++ b/remodel/k8s/infra/controllers/sealed-secrets/kustomization.yaml @@ -5,7 +5,7 @@ helmCharts: - name: sealed-secrets # repo: https://bitnami-labs.github.io/sealed-secrets # version: 2.16.0 - repo: oci://registry-1.docker.io/bitnamicharts/sealed-secrets + repo: oci://registry-1.docker.io/bitnamicharts version: 2.3.6 releaseName: sealed-secrets-controller namespace: sealed-secrets diff --git a/remodel/k8s/infra/storage/proxmox-csi/kustomization.yaml b/remodel/k8s/infra/storage/proxmox-csi/kustomization.yaml index a924ce0..b0b6e9a 100644 --- a/remodel/k8s/infra/storage/proxmox-csi/kustomization.yaml +++ b/remodel/k8s/infra/storage/proxmox-csi/kustomization.yaml @@ -1,9 +1,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization -resources: -# - https://raw.githubusercontent.com/sergelogvinov/proxmox-csi-plugin/v0.7.0/docs/deploy/proxmox-csi-plugin-release.yml - - storage-class.yaml +#resources: +# - ns.yaml +## - https://raw.githubusercontent.com/sergelogvinov/proxmox-csi-plugin/v0.7.0/docs/deploy/proxmox-csi-plugin-release.yml +# - storage-class.yaml #images: # - name: ghcr.io/sergelogvinov/proxmox-csi-node @@ -13,8 +14,18 @@ resources: helmCharts: - name: proxmox-csi-plugin - repo: oci://ghcr.io/sergelogvinov/charts/proxmox-csi-plugin - version: 0.7.0 + repo: oci://ghcr.io/sergelogvinov/charts + version: 0.2.5 releaseName: proxmox-csi-plugin includeCRDs: true namespace: csi-proxmox + valuesFile: values.yaml + +#helmCharts: +# - name: proxmox-csi-plugin +# releaseName: proxmox-csi-plugin +# namespace: csi-proxmox +# repo: oci://ghcr.io/sergelogvinov/charts +# version: 0.2.5 +# includeCRDs: true +# valuesFile: values.yaml \ No newline at end of file diff --git a/remodel/k8s/infra/storage/proxmox-csi/values.yaml b/remodel/k8s/infra/storage/proxmox-csi/values.yaml new file mode 100644 index 0000000..5b63502 --- /dev/null +++ b/remodel/k8s/infra/storage/proxmox-csi/values.yaml @@ -0,0 +1,9 @@ +storageClass: + - name: proxmox-csi + cache: writethrough + fstype: ext4 + reclaimPolicy: Retain + ssd: true + storage: local-zfs + mountOptions: + - noatime \ No newline at end of file