storage: Add local path provisioner
This commit is contained in:
parent
39c5a400d1
commit
246da87bda
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
|
||||
resources:
|
||||
- local-path-cm.yaml
|
||||
- storage-class.yaml
|
||||
|
|
@ -0,0 +1,42 @@
|
|||
kind: ConfigMap
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
name: local-path-config
|
||||
namespace: kube-system
|
||||
data:
|
||||
config.json: |-
|
||||
{
|
||||
"nodePathMap": [
|
||||
{
|
||||
"node": "DEFAULT_PATH_FOR_NON_LISTED_NODES",
|
||||
"paths": [
|
||||
"/mnt/data"
|
||||
]
|
||||
}
|
||||
],
|
||||
"setupCommand": "/manager",
|
||||
"teardownCommand": "/manager"
|
||||
}
|
||||
setup: |-
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
mkdir -m 0777 -p "$VOL_DIR"
|
||||
teardown: |-
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
rm -rf "$VOL_DIR"
|
||||
helperPod.yaml: |-
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: helper-pod
|
||||
spec:
|
||||
priorityClassName: system-node-critical
|
||||
tolerations:
|
||||
- key: node.kubernetes.io/disk-pressure
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: helper-pod
|
||||
image: busybox
|
||||
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
apiVersion: storage.k8s.io/v1
|
||||
kind: StorageClass
|
||||
metadata:
|
||||
name: retain-local-path
|
||||
provisioner: rancher.io/local-path
|
||||
volumeBindingMode: WaitForFirstConsumer
|
||||
reclaimPolicy: Retain
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
|
||||
generators:
|
||||
- ./secret-generator.yaml
|
||||
|
||||
|
||||
helmCharts:
|
||||
- name: traefik
|
||||
releaseName: traefik
|
||||
version: 25.0.0
|
||||
repo: https://helm.traefik.io/traefik
|
||||
namespace: kube-system
|
||||
includeCRDs: true
|
||||
valuesFile: values.yaml
|
||||
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
apiVersion: viaduct.ai/v1
|
||||
kind: ksops
|
||||
metadata:
|
||||
name: authelia-secret-generator
|
||||
annotations:
|
||||
config.kubernetes.io/function: |
|
||||
exec:
|
||||
path: ksops
|
||||
secretFrom:
|
||||
- metadata:
|
||||
name: traefik-cf-secret
|
||||
namespace: kube-system
|
||||
annotations:
|
||||
kustomize.config.k8s.io/needs-hash: "false"
|
||||
envs:
|
||||
- ./secret.enc.env
|
||||
|
|
@ -0,0 +1,8 @@
|
|||
CF_DNS_API_TOKEN=ENC[AES256_GCM,data:pgwhUhsLXCc4dtXtdPYlhhQ66H8ur7Nj+PWsWaFFtdUtvL5BR2LBLA==,iv:ngsYYLF1ByRsMaYsLcDnGtIRN5+m19LN75o8XV8nWRQ=,tag:ui60I/hhLTJbuRCgRlVYOg==,type:str]
|
||||
CF_API_EMAIL=ENC[AES256_GCM,data:VhQlU6MsfhjEjvuRJXSt4mk=,iv:Inv+pthRc8PaAYT48I05ImF1JJtYwqWB2g57kH0UyI4=,tag:0zrcVQJMTdUE6rW9QZweWg==,type:str]
|
||||
sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzK2EraFF2aURMMnFRZjF5\nS3FDZHRwNldBbldyMTlCZ0d3MmowK29qMzJvCk9KL01CZERTL0haZFRBci9MazNy\naTlNQTk2Yk9TWSs2QUdRNlJweTNMTm8KLS0tIG13OWFBUi92UG54a1FobUdmQkhh\nZCtzZHFtSlhnSUFobU1DeTR2Qy9ib2sKcNKGJLPhJkZ5h3FMYi4oxMatlhgpfXws\nWI9h6x4aTJAvQXUHWQXieA4SlCE6vO1pesLDuoNdsyPZIQaW6i6+Fw==\n-----END AGE ENCRYPTED FILE-----\n
|
||||
sops_age__list_0__map_recipient=age14dgmts59tc2gv2xu9305auvu854n3pfl8vkheqzzqyrygyeequ0sjhl92v
|
||||
sops_lastmodified=2023-11-28T21:12:41Z
|
||||
sops_mac=ENC[AES256_GCM,data:G9f/oSqe+ewSY7F72//Q3vNbBN5C9+mTTF/Vxwd22sc32rpgB2Zv2xbofb/yMcBZnTHBjYsW3pDKYvKC134BOezdQs7HoC5QcQ1O4OfSIV26uuXqHz2JZfHadrhkSjT1zLSV4NakAEsAj9U2XlepYWRtmGhUW5ElxCkocgHR+KI=,iv:CwgkHxqUGB/vjQePH3tI+Q5cBkkSwgJnrfE9dhaxTWs=,tag:pCBDRFtdbnUqb25czJKj5A==,type:str]
|
||||
sops_unencrypted_regex=^(apiVersion|metadata|kind|type)$
|
||||
sops_version=3.8.1
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
|
||||
deployment:
|
||||
initContainers:
|
||||
- name: volume-permissions
|
||||
image: busybox:latest
|
||||
command: ["sh", "-c", "rm /data/acme.json; touch /data/acme.json; chown 65532:65532 /data/acme.json; chmod -v 600 /data/acme.json; chown -R 65532:65532 /var/log/traefik"]
|
||||
securityContext:
|
||||
runAsNonRoot: false
|
||||
runAsGroup: 0
|
||||
runAsUser: 0
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: access-log
|
||||
mountPath: /var/log/traefik
|
||||
additionalVolumes:
|
||||
- name: access-log
|
||||
hostPath:
|
||||
path: /var/log/traefik/
|
||||
certResolvers:
|
||||
letsencrypt:
|
||||
email: namesny.matus@gmail.com
|
||||
dnsChallenge:
|
||||
provider: cloudflare
|
||||
delayBeforeCheck: 30
|
||||
resolvers:
|
||||
- 1.1.1.1
|
||||
- 8.8.8.8
|
||||
storage: /data/acme.json
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: traefik-cf-secret
|
||||
additionalVolumeMounts:
|
||||
- name: access-log
|
||||
mountPath: /var/log/traefik/
|
||||
logs:
|
||||
access:
|
||||
enabled: true
|
||||
filePath: /var/log/traefik/access.log
|
||||
ingressRoute:
|
||||
dashboard:
|
||||
enabled: true
|
||||
matchRule: Host(`traefik.namesny.com`)
|
||||
entryPoints: ["websecure"]
|
||||
middlewares:
|
||||
- name: "auth-authelia@kubernetescrd"
|
||||
providers:
|
||||
kubernetesCRD:
|
||||
allowCrossNamespace: true
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: retain-local-path
|
||||
ports:
|
||||
websecure:
|
||||
tls:
|
||||
enabled: true
|
||||
certResolver: letsencrypt
|
||||
domains:
|
||||
- main: namesny.com
|
||||
sans:
|
||||
- "*.namesny.com"
|
||||
web:
|
||||
redirectTo:
|
||||
port: websecure
|
||||
service:
|
||||
spec:
|
||||
externalTrafficPolicy: Local
|
||||
Loading…
Reference in New Issue