Compare commits
3
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 marcio.fernandes
|
064baa08a4 | ||
|
marcio.fernandes
|
a0ff8a03b5 | ||
|
marcio.fernandes
|
6030e44a99 |
@@ -0,0 +1,109 @@
|
||||
# If you come from bash you might have to change your $PATH.
|
||||
# export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:$PATH
|
||||
|
||||
# Path to your Oh My Zsh installation.
|
||||
export ZSH="$HOME/.oh-my-zsh"
|
||||
|
||||
# Set name of the theme to load --- if set to "random", it will
|
||||
# load a random theme each time Oh My Zsh is loaded, in which case,
|
||||
# to know which specific one was loaded, run: echo $RANDOM_THEME
|
||||
# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
|
||||
ZSH_THEME="gnzh"
|
||||
|
||||
# Set list of themes to pick from when loading at random
|
||||
# Setting this variable when ZSH_THEME="devcontainers"
|
||||
# a theme from this variable instead of looking in $ZSH/themes/
|
||||
# If set to an empty array, this variable will have no effect.
|
||||
# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
|
||||
|
||||
# Uncomment the following line to use case-sensitive completion.
|
||||
# CASE_SENSITIVE="true"
|
||||
|
||||
# Uncomment the following line to use hyphen-insensitive completion.
|
||||
# Case-sensitive completion must be off. _ and - will be interchangeable.
|
||||
# HYPHEN_INSENSITIVE="true"
|
||||
|
||||
# Uncomment one of the following lines to change the auto-update behavior
|
||||
# zstyle ':omz:update' mode disabled # disable automatic updates
|
||||
# zstyle ':omz:update' mode auto # update automatically without asking
|
||||
# zstyle ':omz:update' mode reminder # just remind me to update when it's time
|
||||
|
||||
# Uncomment the following line to change how often to auto-update (in days).
|
||||
# zstyle ':omz:update' frequency 13
|
||||
|
||||
# Uncomment the following line if pasting URLs and other text is messed up.
|
||||
# DISABLE_MAGIC_FUNCTIONS="true"
|
||||
|
||||
# Uncomment the following line to disable colors in ls.
|
||||
# DISABLE_LS_COLORS="true"
|
||||
|
||||
# Uncomment the following line to disable auto-setting terminal title.
|
||||
# DISABLE_AUTO_TITLE="true"
|
||||
|
||||
# Uncomment the following line to enable command auto-correction.
|
||||
# ENABLE_CORRECTION="true"
|
||||
|
||||
# Uncomment the following line to display red dots whilst waiting for completion.
|
||||
# You can also set it to another string to have that shown instead of the default red dots.
|
||||
# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
|
||||
# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
|
||||
# COMPLETION_WAITING_DOTS="true"
|
||||
|
||||
# Uncomment the following line if you want to disable marking untracked files
|
||||
# under VCS as dirty. This makes repository status check for large repositories
|
||||
# much, much faster.
|
||||
# DISABLE_UNTRACKED_FILES_DIRTY="true"
|
||||
|
||||
# Uncomment the following line if you want to change the command execution time
|
||||
# stamp shown in the history command output.
|
||||
# You can set one of the optional three formats:
|
||||
# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
|
||||
# or set a custom format using the strftime function format specifications,
|
||||
# see 'man strftime' for details.
|
||||
# HIST_STAMPS="mm/dd/yyyy"
|
||||
|
||||
# Would you like to use another custom folder than $ZSH/custom?
|
||||
# ZSH_CUSTOM=/path/to/new-custom-folder
|
||||
|
||||
# Which plugins would you like to load?
|
||||
# Standard plugins can be found in $ZSH/plugins/
|
||||
# Custom plugins may be added to $ZSH_CUSTOM/plugins/
|
||||
# Example format: plugins=(rails git textmate ruby lighthouse)
|
||||
# Add wisely, as too many plugins slow down shell startup.
|
||||
plugins=(git timer web-search ssh kubectl helm colorize zsh-autosuggestions rclone ansible)
|
||||
ZSH_COLORIZE_TOOL=chroma
|
||||
|
||||
source $ZSH/oh-my-zsh.sh
|
||||
|
||||
# User configuration
|
||||
|
||||
# export MANPATH="/usr/local/man:$MANPATH"
|
||||
|
||||
# You may need to manually set your language environment
|
||||
# export LANG=en_US.UTF-8
|
||||
|
||||
# Preferred editor for local and remote sessions
|
||||
# if [[ -n $SSH_CONNECTION ]]; then
|
||||
# export EDITOR='vim'
|
||||
# else
|
||||
# export EDITOR='nvim'
|
||||
# fi
|
||||
|
||||
# Compilation flags
|
||||
# export ARCHFLAGS="-arch $(uname -m)"
|
||||
|
||||
# Set personal aliases, overriding those provided by Oh My Zsh libs,
|
||||
# plugins, and themes. Aliases can be placed here, though Oh My Zsh
|
||||
# users are encouraged to define aliases within a top-level file in
|
||||
# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
|
||||
# - $ZSH_CUSTOM/aliases.zsh
|
||||
# - $ZSH_CUSTOM/macos.zsh
|
||||
# For a full list of active aliases, run `alias`.
|
||||
#
|
||||
# Example aliases
|
||||
# alias zshconfig="mate ~/.zshrc"
|
||||
# alias ohmyzsh="mate ~/.oh-my-zsh"
|
||||
DISABLE_AUTO_UPDATE=true
|
||||
DISABLE_UPDATE_PROMPT=true
|
||||
|
||||
export PATH=$PATH:/home/vscode/lib
|
||||
@@ -1,21 +1,32 @@
|
||||
// For format details, see https://aka.ms/devcontainer.json. For config options, see the
|
||||
// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
|
||||
{
|
||||
"name": "casa-dev",
|
||||
"image": "oci.limbosolutions.com/public/devcontainers/devops:latest",
|
||||
"remoteUser": "vscode",
|
||||
"runArgs": [
|
||||
"--hostname=casa-dev"
|
||||
],
|
||||
// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
|
||||
"image": "mcr.microsoft.com/devcontainers/base:jammy",
|
||||
"features": {
|
||||
"ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {},
|
||||
"ghcr.io/devcontainers-extra/features/ansible": {},
|
||||
"ghcr.io/devcontainers/features/docker-outside-of-docker": {},
|
||||
},
|
||||
// "features": {},
|
||||
|
||||
// Use 'forwardPorts' to make a list of ports inside the container available locally.
|
||||
// "forwardPorts": [],
|
||||
// Configure tool-specific properties.
|
||||
// "customizations": {},
|
||||
|
||||
"mounts": [
|
||||
"source=${localWorkspaceFolder}/.devcontainer/.zshrc,target=/home/vscode/.zshrc,type=bind",
|
||||
"source=${localWorkspaceFolder}/../lms,target=/workspaces/lms,type=bind",
|
||||
"source=${localWorkspaceFolder}/../homeAssistant,target=/workspaces/homeAssistant,type=bind",
|
||||
"source=${localWorkspaceFolder}/../mosquitto,target=/workspaces/mosquitto,type=bind",
|
||||
"source=${localWorkspaceFolder}/../myLimbo.Jellyfin,target=/workspaces/myLimbo.Jellyfin,type=bind",
|
||||
"source=${localWorkspaceFolder}/../kb,target=/workspaces/kb,type=bind",
|
||||
"source=${localWorkspaceFolder}/../pi.bluetooth.speaker,target=/workspaces/pi.bluetooth.speaker,type=bind",
|
||||
"source=${localWorkspaceFolder}/.env.d/kube,target=/home/vscode/.kube,type=bind",
|
||||
"source=${localEnv:HOME}/.gitconfig,target=/home/vscode/.gitconfig,type=bind,consistency=cached",
|
||||
"source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind,consistency=cached"
|
||||
],
|
||||
"postCreateCommand": "bash .devcontainer/scripts/postCreate.sh",
|
||||
"customizations": {
|
||||
"vscode": {
|
||||
"extensions": [
|
||||
@@ -26,14 +37,11 @@
|
||||
"yzhang.markdown-all-in-one",
|
||||
"davidanson.vscode-markdownlint",
|
||||
"eamodio.gitlens",
|
||||
"m4ns0ur.base64",
|
||||
"rogalmic.bash-debug",
|
||||
"streetsidesoftware.code-spell-checker",
|
||||
"ms-azuretools.vscode-containers",
|
||||
"eamodio.gitlens",
|
||||
"bierner.markdown-preview-github-styles",
|
||||
"weaveworks.vscode-gitops-tools"
|
||||
]
|
||||
"m4ns0ur.base64"
|
||||
],
|
||||
"settings": {
|
||||
"terminal.integrated.defaultProfile.linux": "zsh"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
#setup chroma for zsh colorize
|
||||
chmod +x /home/vscode/lib/chroma
|
||||
curl https://rclone.org/install.sh | sudo bash
|
||||
docker context create casa-prod --description "casa prod context" --docker host=ssh://admin@homesrv01.dev.lan
|
||||
docker context use casa-prod
|
||||
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
on:
|
||||
push:
|
||||
schedule:
|
||||
- cron: '0 16 * * *' # Every day at 16:00
|
||||
jobs:
|
||||
deploy-to-homesrv01:
|
||||
runs-on: "myLimbo-casa-gitea-act-runner"
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
# all certs and key are base64 encoded
|
||||
- name: docker compose up
|
||||
env:
|
||||
KUBERNETES_SERVER: ${{ secrets.KUBERNETES_SERVER }}
|
||||
KUBERNETES_CLIENT_CRT_DATA: ${{ secrets.KUBERNETES_CLIENT_CRT_DATA }}
|
||||
KUBERNETES_CLIENT_KEY_DATA: ${{ secrets.KUBERNETES_CLIENT_KEY_DATA }}
|
||||
KUBERNETES_CRT_AUTHORITY_DATA: ${{ secrets.KUBERNETES_CRT_AUTHORITY_DATA }}
|
||||
run: |
|
||||
docker compose -f ./casa-limbosolutions-com/sync-certs-job/docker-compose.yaml up -d --pull always
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
on:
|
||||
push:
|
||||
schedule:
|
||||
- cron: '0 5 * * SUN' # Every Sunday at 05:00
|
||||
jobs:
|
||||
deploy-to-homesrv01:
|
||||
runs-on: "myLimbo-casa-gitea-act-runner"
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: docker compose up
|
||||
run: docker compose -f ./services/wyoming/docker-compose.yaml up -d --pull always
|
||||
@@ -11,6 +11,3 @@ gitignore/*
|
||||
.secrets
|
||||
ansible/inventory.yml
|
||||
.env.d/*
|
||||
.tmp/**
|
||||
storage-limbosolutions-com/deploy/helm/values.private.yaml
|
||||
**.dec.**
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"folders": [
|
||||
{
|
||||
"path": "."
|
||||
"path": "../../homeAssistant"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,38 +1,89 @@
|
||||
# casa
|
||||
|
||||
Welcome to my casa repository, where Home Assistant and other services are hosted.
|
||||
Welcome to my home server repository, where Home Assistant and other services are hosted.
|
||||
This repository is dedicated to documenting and maintaining the server configuration and workflows.
|
||||
|
||||
The primary goal is to establish an k3s cluster capable of isolating services and communications related to home automation at the network level.
|
||||
The server operates within its own VLAN (`casa`) but requires controlled communication with other VLANs, such as `IOT Vlan`
|
||||
The primary goal is to establish a Docker-based server capable of isolating services and communications related to home automation at the network level.
|
||||
The server operates within its own VLAN (`homesrv`) but requires controlled communication with other VLANs, such as `IOT Vlan`
|
||||
|
||||
For more information about k3s cluster/nodes setup check [readme](./nodes/README.md).
|
||||
<!-- omit in toc -->
|
||||
## Table of Contents
|
||||
|
||||
**Table of Contents:**
|
||||
- [Services](#services)
|
||||
- [myInfra stack](#myinfra-stack)
|
||||
- [docker](#docker)
|
||||
- [rclone plugin](#rclone-plugin)
|
||||
- [nginx](#nginx)
|
||||
- [Home Assistant](#home-assistant)
|
||||
- [Lyrion Music Server (LMS)](#lyrion-music-server-lms)
|
||||
- [Mosquitto](#mosquitto)
|
||||
- [Wyoming](#wyoming)
|
||||
- [Zigbee2mqtt](#zigbee2mqtt)
|
||||
- [Host](#host)
|
||||
- [Proxmox - container](#proxmox---container)
|
||||
- [OS](#os)
|
||||
- [logs](#logs)
|
||||
- [Development, Maintenance and Deployment](#development-maintenance-and-deployment)
|
||||
- [Docker context](#docker-context)
|
||||
|
||||
- [Home Assistant](#home-assistant)
|
||||
- [Lyrion Music Server (LMS)](#lyrion-music-server-lms)
|
||||
- [Mosquitto](#mosquitto)
|
||||
- [Wyoming](#wyoming)
|
||||
- [Zigbee2mqtt](#zigbee2mqtt)
|
||||
- [node-red](#node-red)
|
||||
- [core-dns](#core-dns)
|
||||
## Services
|
||||
|
||||
## Home Assistant
|
||||
### myInfra stack
|
||||
|
||||
docker, promtail and telegraf configuration [maintained on myInfra repo](/:root/marcio.fernandes/myInfrastructure).
|
||||
|
||||
### docker
|
||||
|
||||
#### rclone plugin
|
||||
|
||||
[https://rclone.org/docker/](https://rclone.org/docker/)
|
||||
|
||||
```bash
|
||||
# execute on server
|
||||
sudo apt-get -y install fuse
|
||||
docker plugin install rclone/docker-volume-rclone:amd64 args="-v" --alias rclone --grant-all-permissions
|
||||
docker plugin list
|
||||
```
|
||||
|
||||
if error when enabling plugin.
|
||||
*"rclone.sock: connect: no such file or directory"*
|
||||
remove existing cache.
|
||||
|
||||
```bash
|
||||
rm -r /var/lib/docker-plugins/rclone/cache
|
||||
mkdir -p /var/lib/docker-plugins/rclone/cache
|
||||
```
|
||||
|
||||
[ansible role for plugin configuration](./rclone.docker-plugin.playbook.yaml)
|
||||
|
||||
### nginx
|
||||
|
||||
[Docker Compose](./services/nginx/docker-compose.yaml)
|
||||
|
||||
All sites configurations set during docker build.
|
||||
|
||||
### Home Assistant
|
||||
|
||||
[Git Repo](/:root/marcio.fernandes/homeAssistant)
|
||||
|
||||
## Lyrion Music Server (LMS)
|
||||
### Lyrion Music Server (LMS)
|
||||
|
||||
For instructions on setting up the Lyrion Music Server on kubernetes, refer to the [LMS Git Repository](/:root/marcio.fernandes/lms).
|
||||
For instructions on setting up the Lyrion Music Server Docker container, refer to the [LMS Git Repository](/:root/marcio.fernandes/lms).
|
||||
|
||||
For information on integrating Lyrion Music Server with Home Assistant, visit the [Home Assistant Git Repository](/:root/marcio.fernandes/homeassistant#squeezebox-lyrion-music-server).
|
||||
|
||||
## Mosquitto
|
||||
Using [Docker Rclone plugin](https://rclone.org/docker/) for accessing the bucket where music is stored. Configuration is managed via [Ansible playbook](./rclone.docker-plugin.playbook.yml).
|
||||
|
||||
```sh
|
||||
#configure access to s3 bucket
|
||||
ansible-playbook ./rclone.docker-plugin.playbook.yml
|
||||
```
|
||||
|
||||
### Mosquitto
|
||||
|
||||
[Git Repo](/:root/marcio.fernandes/mosquitto)
|
||||
|
||||
## Wyoming
|
||||
### Wyoming
|
||||
|
||||
A peer-to-peer protocol for voice assistants (basically JSONL + PCM audio)
|
||||
|
||||
@@ -48,7 +99,11 @@ This is an open standard of the Open Home Foundation.
|
||||
|
||||
For more information about home assistant integration [check home assistant repo](/:root/marcio.fernandes/homeassistant#wyoming).
|
||||
|
||||
Deployments and scripts on services/wyoming repo folder.
|
||||
[Docker compose file](./services/wyoming/docker-compose.yaml).
|
||||
|
||||
Continuous deploy [gitea action](.gitea/workflows/deploy-wyoming.yml).
|
||||
|
||||
Because of performance wyoming whisper is currently hosted on chimera kubernetes cluster [deployment](./services/wyoming/whisper.kubernetes-deployment.yaml)
|
||||
|
||||
Links:
|
||||
|
||||
@@ -57,39 +112,118 @@ Links:
|
||||
- [https://exitcode0.net/posts/wyoming-whisper-docker-compose/](https://exitcode0.net/posts/wyoming-whisper-docker-compose/)
|
||||
- [https://exitcode0.net/posts/wyoming-piper-docker-compose/](https://exitcode0.net/posts/wyoming-piper-docker-compose/)
|
||||
|
||||
## Zigbee2mqtt
|
||||
### Zigbee2mqtt
|
||||
|
||||
Zigbee to MQTT bridge, get rid of your proprietary Zigbee bridges
|
||||
|
||||
Attached SONOFF Universal Zigbee 3.0 USB Dongle Plus to the Proxmox node and configure USB passthrough so the VM can use it.
|
||||
SONOFF Universal Zigbee 3.0 USB Dongle Plus attached on [proxmox host](#proxmox---lxc-container).
|
||||
|
||||
Deployments and scripts on services/Zigbee2mqtt repo folder.
|
||||
|
||||
## node-red
|
||||
|
||||
check [readme](./services/node-red/README.md) for more information on setup and configuration.
|
||||
|
||||
## core-dns
|
||||
|
||||
Remove warning from logs.
|
||||
|
||||
```log
|
||||
[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.server
|
||||
[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.override
|
||||
```
|
||||
|
||||
1. Apply on kubernetes
|
||||
Patch security on [proxmox host](#proxmox---lxc-container).
|
||||
(usb passthrough to [lxc container](#proxmox---lxc-container))
|
||||
|
||||
```yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: coredns-custom
|
||||
namespace: kube-system
|
||||
data:
|
||||
log.override: |
|
||||
#
|
||||
stub.server: |
|
||||
#
|
||||
#on proxmox hosting server
|
||||
chown 100000:100020 /dev/ttyUSB0
|
||||
chown 100000:100020 /dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0
|
||||
```
|
||||
|
||||
[docker compose](./services/zigbee2mqtt/docker-compose.yaml)
|
||||
|
||||
Links
|
||||
|
||||
- [https://www.zigbee2mqtt.io/](https://www.zigbee2mqtt.io/)
|
||||
- [Home assistant integration](/:root/marcio.fernandes/homeassistant#Zigbee2mqtt)
|
||||
- [Continuos Deploy - git action](./.gitea/workflows/services.zigbee2mqtt.yml)
|
||||
|
||||
## Host
|
||||
|
||||
### Proxmox - container
|
||||
|
||||
Currently hosted on a proxmox ubuntu container.
|
||||
|
||||
```bash
|
||||
# cat /etc/pve/lxc/105.conf
|
||||
arch: amd64
|
||||
cmode: shell
|
||||
cores: 2
|
||||
features: fuse=1,keyctl=1,nesting=1
|
||||
hostname: homesrv01
|
||||
memory: 1500
|
||||
net0: name=eth0,bridge=vmbr0,firewall=1,ip6=dhcp,...,type=veth
|
||||
onboot: 1
|
||||
ostype: ubuntu
|
||||
protection: 1
|
||||
rootfs: local-lvm:vm-105-disk-0,size=32G
|
||||
swap: 1500
|
||||
unprivileged: 1
|
||||
lxc.cgroup2.devices.allow: c 189:* rwm
|
||||
lxc.mount.entry: usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 none bind,optional,create=file
|
||||
lxc.cgroup2.devices.allow: c 188:* rwm
|
||||
lxc.mount.entry: /dev/ttyUSB0 dev/ttyUSB0 none bind,optional,create=file
|
||||
```
|
||||
|
||||
lxc.cgroup2.devices.allow and lxc.mount.entry identification
|
||||
|
||||
```bash
|
||||
# identify usb pen
|
||||
lsusb
|
||||
|
||||
# example
|
||||
# Bus 001 Device 008: ID 10c4:ea60 Silicon Labs CP210x UART Bridge
|
||||
|
||||
|
||||
#replace with bus and device id
|
||||
ls -l /dev/bus/usb/001/008
|
||||
|
||||
#example result
|
||||
# crw-rw-r-- 1 root root 189, 7 May 17 15:56 /dev/bus/usb/001/008
|
||||
|
||||
# so
|
||||
|
||||
#lxc.cgroup2.devices.allow: c 189:* rwm
|
||||
#lxc.mount.entry: usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 none bind,optional,create=file
|
||||
|
||||
ls -l /dev/serial/by-id/
|
||||
# example result
|
||||
#lrwxrwxrwx 1 root root 13 May 17 15:56 usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 -> ../../ttyUSB0
|
||||
|
||||
ls -l /dev/ttyUSB0
|
||||
#example result
|
||||
#crw-rw---- 1 root dialout 188, 0 May 17 15:56 /dev/ttyUSB0
|
||||
|
||||
#so
|
||||
|
||||
#lxc.cgroup2.devices.allow: c 188:* rwm
|
||||
#lxc.mount.entry: /dev/ttyUSB0 dev/ttyUSB0 none bind,optional,create=file
|
||||
```
|
||||
|
||||
### OS
|
||||
|
||||
```bash
|
||||
# lsb_release -a
|
||||
Distributor ID: Ubuntu
|
||||
Description: Ubuntu 24.04 LTS
|
||||
Release: 24.04
|
||||
Codename: noble
|
||||
|
||||
# uname -r
|
||||
6.8.4-3-pve
|
||||
```
|
||||
|
||||
### logs
|
||||
|
||||
```bash
|
||||
# check auto update scripts logs
|
||||
journalctl -r -t auto-update
|
||||
```
|
||||
|
||||
## Development, Maintenance and Deployment
|
||||
|
||||
Using visual studio code, docker, ansible and gitea actions.
|
||||
|
||||
### Docker context
|
||||
|
||||
```bash
|
||||
# create context to homesrv01 docker on development devices
|
||||
docker context create homesrv01 --docker host=ssh://admin@homesrv01.dev.lan
|
||||
```
|
||||
|
||||
+1
-2
@@ -1,3 +1,2 @@
|
||||
# Roles path
|
||||
[defaults]
|
||||
inventory = ./nodes/ansible
|
||||
inventory = ansible/inventory.yml
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
# casa-limbosolutions-com
|
||||
|
||||
## sync cert
|
||||
|
||||
``` bash
|
||||
kubectl annotate secret casa-limbosolutions-com-tls \
|
||||
-n casa-limbosolutions-com \
|
||||
replicator.v1.mittwald.de/replicate-to="home-assistant,node-red,lyrionmusicserver,jellyfin" --overwrite
|
||||
```
|
||||
|
||||
``` bash
|
||||
kubectl kustomize deploy/flux | kubectl apply -f -
|
||||
```
|
||||
@@ -1,2 +0,0 @@
|
||||
**
|
||||
!.gitignore
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: GitRepository
|
||||
metadata:
|
||||
name: casa
|
||||
spec:
|
||||
interval: 1m0s
|
||||
url: ssh://git@git.limbosolutions.com:2222/myLimbo/casa.git
|
||||
ref:
|
||||
branch: main
|
||||
secretRef:
|
||||
name: flux-repo-ssh-credentials
|
||||
@@ -1,18 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: casa-limbosolutions-com
|
||||
resources:
|
||||
- git-repo.yaml
|
||||
secretGenerator:
|
||||
- name: flux-repo-ssh-credentials
|
||||
namespace: casa-limbosolutions-com
|
||||
files:
|
||||
- "identity=./.env.d/flux-repo-ssh-key"
|
||||
- "known_hosts=./.env.d/flux-repo-ssh-known_hosts"
|
||||
- "pubkey=./.env.d/flux-repo-ssh-key.pub"
|
||||
- name: flux-sops-age
|
||||
namespace: casa-limbosolutions-com
|
||||
files:
|
||||
- "age.agekey=./.env.d/age.agekey"
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -0,0 +1,29 @@
|
||||
# casa.limbosolutions.com at icarus
|
||||
|
||||
Use icarus cluster context to all documentation and scrips on this folder. [Check Instructions](#icarus-cluster---access) for how to setup required user and roles on icurus and client kubeconfig.
|
||||
|
||||
## certificates (wildcard)
|
||||
|
||||
```bash
|
||||
kubectl apply -f ./certs.yaml
|
||||
```
|
||||
|
||||
```bash
|
||||
#check certificates
|
||||
kubectl get cert -n casa-limbosolutions-com
|
||||
```
|
||||
|
||||
## Icarus cluster - access
|
||||
|
||||
On user computer.
|
||||
*Access to k3s context not required.*
|
||||
|
||||
```bash
|
||||
# create private key
|
||||
openssl genrsa -out ../../.env.d/kube/casa@icarus-user.key 2048
|
||||
|
||||
# create csr
|
||||
openssl req -new -key ../../.env.d/kube/casa@icarus-user.key -out ../../.env.d/kube/casa@icarus-user.csr -subj "/CN=casa/O=limbosolutions"
|
||||
```
|
||||
|
||||
Follow instructions to [setup user and roles on icarus k3s cluster](./k3s-admin.md), and setup kubectl config [kube config](./k3s-kubctl-config.md).
|
||||
@@ -0,0 +1,95 @@
|
||||
# casa on Icarus - admin
|
||||
|
||||
Requires kubernetes admin user access to icarus. All documentation and scripts must be executed on icarus context with an admin account.
|
||||
|
||||
Currently using an symbolic on icarus project on my dev device to this file.
|
||||
|
||||
## kubernetes Namespace
|
||||
|
||||
```bash
|
||||
# delete namespace
|
||||
kubectl create namespace casa-limbosolutions-com
|
||||
```
|
||||
|
||||
```bash
|
||||
# delete namespace
|
||||
kubectl delete namespace casa-limbosolutions-com
|
||||
```
|
||||
|
||||
## Roles and Bindings
|
||||
|
||||
``` yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
namespace: casa-limbosolutions-com
|
||||
name: casa-limbosolutions-com
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
- cert-manager.io # to access deployments certs from cert-manager
|
||||
- apps # to access deployments
|
||||
- networking.k8s.io # to access ingresses
|
||||
resources:
|
||||
- pods
|
||||
- services
|
||||
- secrets
|
||||
- certificates
|
||||
- deployments
|
||||
- configmaps
|
||||
- ingresses
|
||||
- persistentvolumeclaims
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- create
|
||||
- update
|
||||
- patch
|
||||
- delete
|
||||
- deletecollection
|
||||
```
|
||||
|
||||
``` yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: casa-limbosolutions-com-rb # Replace with your role binding name
|
||||
namespace: casa-limbosolutions-com # Replace with your namespace
|
||||
subjects:
|
||||
- kind: User # or "ServiceAccount" for service accounts
|
||||
name: casa # Replace with the username or service account name
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
namespace: casa-limbosolutions-com
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: casa-limbosolutions-com # The name of the role you created
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
```
|
||||
|
||||
### kubernetes User
|
||||
|
||||
```bash
|
||||
#Deploy csr to k3s
|
||||
cat <<EOF | kubectl apply -f -
|
||||
apiVersion: certificates.k8s.io/v1
|
||||
kind: CertificateSigningRequest
|
||||
metadata:
|
||||
name: casa-user-csr
|
||||
spec:
|
||||
request: $(cat ../.env.d/.kube/casa@icarus-user.csr | base64 | tr -d '\n')
|
||||
signerName: kubernetes.io/kube-apiserver-client
|
||||
usages:
|
||||
- client auth
|
||||
EOF
|
||||
```
|
||||
|
||||
```bash
|
||||
# Approve csr
|
||||
kubectl certificate approve casa-user-csr
|
||||
```
|
||||
|
||||
```bash
|
||||
# Download kubernet user crt
|
||||
kubectl get csr casa-user-csr -o jsonpath='{.status.certificate}' | base64 --decode > ./.env.d/casa@icarus-user.crt
|
||||
```
|
||||
@@ -0,0 +1 @@
|
||||
|
||||
@@ -0,0 +1,78 @@
|
||||
|
||||
configs:
|
||||
sync-certs-sh:
|
||||
content: |
|
||||
#!/bin/bash
|
||||
##############################################################################################################################
|
||||
# notes:
|
||||
# --certificate-authority="$${KUBERNETES_CRT_AUTHORITY}" not working, dont hnow why, so using --insecure-skip-tls-verify
|
||||
##############################################################################################################################
|
||||
|
||||
|
||||
set -e
|
||||
mkdir -p /tmp/.kube
|
||||
|
||||
echo "Trace: Setup kube"
|
||||
|
||||
echo "Trace: Processing KUBERNETES_CRT_AUTHORITY_DATA"
|
||||
base64 -d <<< "${KUBERNETES_CRT_AUTHORITY_DATA}" > "$${KUBERNETES_CRT_AUTHORITY}"
|
||||
echo "Trace: Processing KUBERNETES_CRT_AUTHORITY_DATA"
|
||||
base64 -d <<< "${KUBERNETES_CLIENT_CRT_DATA}" > "$${KUBERNETES_CLIENT_CRT}"
|
||||
echo "Trace: Processing KUBERNETES_CLIENT_KEY_DATA"
|
||||
base64 -d <<< "${KUBERNETES_CLIENT_KEY_DATA}" > "$${KUBERNETES_CLIENT_KEY}"
|
||||
|
||||
# while true ; do
|
||||
# sleep 5
|
||||
# done
|
||||
|
||||
|
||||
echo "Trace: Fetching secrets"
|
||||
CERT_NAMES=$(kubectl get secrets \
|
||||
-n casa-limbosolutions-com \
|
||||
--server="$${KUBERNETES_SERVER}" \
|
||||
--client-key="$${KUBERNETES_CLIENT_KEY}" \
|
||||
--client-certificate="$${KUBERNETES_CLIENT_CRT}" \
|
||||
--insecure-skip-tls-verify \
|
||||
-o json | jq -r '.items[].metadata.name')
|
||||
|
||||
for CERT_NAME in $$CERT_NAMES; do
|
||||
echo "Trace: Syncing certificate: $$CERT_NAME"
|
||||
kubectl get secret "$$CERT_NAME" \
|
||||
-n casa-limbosolutions-com \
|
||||
--server="$${KUBERNETES_SERVER}" \
|
||||
--client-key="$${KUBERNETES_CLIENT_KEY}" \
|
||||
--client-certificate="$${KUBERNETES_CLIENT_CRT}" \
|
||||
--insecure-skip-tls-verify \
|
||||
-o json | \
|
||||
jq -r '.data | to_entries[] | "\(.key) \(.value)"' | \
|
||||
while IFS=' ' read -r KEY VALUE; do
|
||||
echo "Processing key: $$KEY"
|
||||
# Decode the base64 value and save it to the appropriate file
|
||||
echo "Trace: Saving key: $$KEY"
|
||||
echo "$$VALUE" | base64 -d > "/etc/ssl/certs/casa-limbosolutions-com-certs/$${CERT_NAME}_$${KEY}"
|
||||
done
|
||||
done
|
||||
|
||||
echo "Info: Certificates synced successfully."
|
||||
|
||||
services:
|
||||
kubectl:
|
||||
image: bitnami/kubectl:latest
|
||||
environment:
|
||||
KUBERNETES_SERVER: ${KUBERNETES_SERVER}
|
||||
KUBERNETES_CRT_AUTHORITY: /tmp/.kube/ca.crt
|
||||
KUBERNETES_CLIENT_CRT: /tmp/.kube/client.crt
|
||||
KUBERNETES_CLIENT_KEY: /tmp/.kube/client.key
|
||||
container_name: sync-certs-job
|
||||
entrypoint: bash -c /app/sync-certs.sh
|
||||
configs:
|
||||
- source: sync-certs-sh
|
||||
target: /app/sync-certs.sh
|
||||
mode: 0755
|
||||
volumes:
|
||||
- casa-certs:/etc/ssl/certs/casa-limbosolutions-com-certs:rw
|
||||
volumes:
|
||||
casa-certs:
|
||||
name: casa-limbosolutions-com-certs
|
||||
external: true # Atention permission must be set to 1001:1001 (using chown on nginx container command)
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
"folders": [
|
||||
{
|
||||
"path": "./",
|
||||
"name": "casa"
|
||||
"name": "homesrv01"
|
||||
},
|
||||
{
|
||||
"path": "../homeAssistant"
|
||||
@@ -14,18 +14,16 @@
|
||||
{
|
||||
"path": "../mosquitto"
|
||||
},
|
||||
{
|
||||
"name": "Jellyfin",
|
||||
"path": "../myLimbo.Jellyfin"
|
||||
},
|
||||
{
|
||||
"name": "kb",
|
||||
"path": "../kb"
|
||||
},
|
||||
{
|
||||
"name": "pi.bluetooth.speaker",
|
||||
"path": "../pi.bluetooth.speaker"
|
||||
},
|
||||
// {
|
||||
// "name": "kb/kb",
|
||||
// "path": "../../kb/kb"
|
||||
// }
|
||||
|
||||
|
||||
],
|
||||
"settings": {
|
||||
"files.exclude": {
|
||||
@@ -36,80 +34,16 @@
|
||||
"**/.DS_Store": true,
|
||||
"**/Thumbs.db": true,
|
||||
"kb": true,
|
||||
"runme.taskProvider.enabled": false,
|
||||
"runme.scanMode": "off"
|
||||
|
||||
},
|
||||
|
||||
"ansible.python.interpreterPath": "/bin/python",
|
||||
"cSpell.words": [
|
||||
"davidanson",
|
||||
"eamodio",
|
||||
"envsubst",
|
||||
"kubelet",
|
||||
"lmscommunity",
|
||||
"localtime",
|
||||
"LOGLEVEL",
|
||||
"lyrionmusicserver",
|
||||
"mtxr",
|
||||
"nvme",
|
||||
"rclone",
|
||||
"reverseproxy",
|
||||
"rogalmic",
|
||||
"runme",
|
||||
"sqltools",
|
||||
"yzhang"
|
||||
],
|
||||
"githubLocalActions.workflowsDirectory": ".gitea/workflows"
|
||||
},
|
||||
"tasks": {
|
||||
"version": "2.0.0",
|
||||
"tasks": [
|
||||
{
|
||||
"label": "Run current shell file - relative",
|
||||
"type": "shell",
|
||||
"command": "bash",
|
||||
"args": [
|
||||
"${file}"
|
||||
],
|
||||
"options": {
|
||||
"cwd": "${fileDirname}"
|
||||
},
|
||||
"group": {
|
||||
},
|
||||
"presentation": {
|
||||
"echo": true,
|
||||
"reveal": "always",
|
||||
"focus": false,
|
||||
"panel": "shared"
|
||||
}
|
||||
},
|
||||
{
|
||||
"label": "Run current shell file",
|
||||
"type": "shell",
|
||||
"command": "bash",
|
||||
"args": [
|
||||
"${file}"
|
||||
],
|
||||
"group": {
|
||||
"kind": "build",
|
||||
"isDefault": true
|
||||
},
|
||||
"presentation": {
|
||||
"echo": true,
|
||||
"reveal": "always",
|
||||
"focus": false,
|
||||
"panel": "shared"
|
||||
}
|
||||
},
|
||||
{
|
||||
"label": "Kustomize - Deploy - Selected File",
|
||||
"type": "shell",
|
||||
"command": "kubectl apply -k ${fileDirname}",
|
||||
"problemMatcher": [],
|
||||
"group": "build"
|
||||
}
|
||||
|
||||
]
|
||||
}
|
||||
"reverseproxy"
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -1,83 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
annotations:
|
||||
kubectl.kubernetes.io/last-applied-configuration: |
|
||||
{"apiVersion":"kustomize.toolkit.fluxcd.io/v1","kind":"Kustomization","metadata":{"annotations":{},"name":"cilium","namespace":"casa-limbosolutions-com"},"spec":{"interval":"1m","path":"./services/cilium/deploy/app","prune":true,"sourceRef":{"kind":"GitRepository","name":"casa","namespace":"casa-limbosolutions-com"}}}
|
||||
creationTimestamp: "2026-07-11T23:05:18Z"
|
||||
finalizers:
|
||||
- finalizers.fluxcd.io
|
||||
generation: 1
|
||||
name: cilium
|
||||
namespace: casa-limbosolutions-com
|
||||
resourceVersion: "55743107"
|
||||
uid: 92b8e926-c008-4c28-8f11-43ceeec1ecd0
|
||||
spec:
|
||||
force: false
|
||||
interval: 1m
|
||||
path: ./services/cilium/deploy/app
|
||||
prune: false
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: casa
|
||||
namespace: casa-limbosolutions-com
|
||||
status:
|
||||
conditions:
|
||||
- lastTransitionTime: "2026-08-29T19:58:40Z"
|
||||
message: 'Applied revision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba'
|
||||
observedGeneration: 1
|
||||
reason: ReconciliationSucceeded
|
||||
status: "True"
|
||||
type: Ready
|
||||
history:
|
||||
- digest: sha256:16d38a70278518c2adfd7517cf139607767c1b42513b0242ea4a7516185a64b4
|
||||
firstReconciled: "2026-07-16T12:13:07Z"
|
||||
lastReconciled: "2026-08-29T19:58:40Z"
|
||||
lastReconciledDuration: 80.450572ms
|
||||
lastReconciledStatus: ReconciliationSucceeded
|
||||
metadata:
|
||||
revision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba
|
||||
totalReconciliations: 63677
|
||||
- digest: sha256:a5c2fa62ccbee967f13a48f4af93628f4a674753ce3da2ad8cfff9aba224e97a
|
||||
firstReconciled: "2026-07-16T11:14:10Z"
|
||||
lastReconciled: "2026-07-16T12:13:04Z"
|
||||
lastReconciledDuration: 65.016149ms
|
||||
lastReconciledStatus: ReconciliationSucceeded
|
||||
metadata:
|
||||
revision: main@sha1:f52cf91125d3ddc1b52593f9ac7b4a21d8b5fae3
|
||||
totalReconciliations: 60
|
||||
- digest: sha256:f3b4c7dc811a40c031d0c5d45b30f512a1d99dd46ced81f441383e7ef9ff100b
|
||||
firstReconciled: "2026-07-12T13:59:54Z"
|
||||
lastReconciled: "2026-07-16T11:13:48Z"
|
||||
lastReconciledDuration: 65.594843ms
|
||||
lastReconciledStatus: ReconciliationSucceeded
|
||||
metadata:
|
||||
revision: main@sha1:d0e0d6293fbc8ab190adefa380c9f8cfc6fc34d3
|
||||
totalReconciliations: 5338
|
||||
- digest: sha256:c968874ddd0859a7f031dae53abe4a4efaac0b6a2edab82111aa35327954f857
|
||||
firstReconciled: "2026-07-12T13:34:53Z"
|
||||
lastReconciled: "2026-07-12T13:59:51Z"
|
||||
lastReconciledDuration: 80.654786ms
|
||||
lastReconciledStatus: ReconciliationSucceeded
|
||||
metadata:
|
||||
revision: main@sha1:85982571dd573e701a599d29add61a6559d8320a
|
||||
totalReconciliations: 26
|
||||
- digest: sha256:acc2f075adc36298ee4b9acc679e1cbb05219b1a8fdcb4ed0850b800cb53490e
|
||||
firstReconciled: "2026-07-12T12:49:09Z"
|
||||
lastReconciled: "2026-07-12T13:34:16Z"
|
||||
lastReconciledDuration: 92.426021ms
|
||||
lastReconciledStatus: ReconciliationSucceeded
|
||||
metadata:
|
||||
revision: main@sha1:63591efc8f0ccee893b605b9e520786a14b39599
|
||||
totalReconciliations: 43
|
||||
inventory:
|
||||
entries:
|
||||
- id: cilium_cilium-helm-values__Secret
|
||||
v: v1
|
||||
- id: cilium_cilium_helm.toolkit.fluxcd.io_HelmRelease
|
||||
v: v2
|
||||
- id: cilium_cilium_source.toolkit.fluxcd.io_HelmRepository
|
||||
v: v1
|
||||
lastAppliedRevision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba
|
||||
lastAttemptedRevision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba
|
||||
observedGeneration: 1
|
||||
-326
@@ -1,326 +0,0 @@
|
||||
# Casa k3s cluster
|
||||
|
||||
**k3s version:** v1.36.1+k3s1
|
||||
|
||||
**Table of Contents:**
|
||||
|
||||
- [Common](#common)
|
||||
- [OCI Mirrors Cache](#oci-mirrors-cache)
|
||||
- [casa - control Plane](#casa---control-plane)
|
||||
- [casa - control Plane - proxmox vm](#casa---control-plane---proxmox-vm)
|
||||
- [casa - control Plane - network configuration](#casa---control-plane---network-configuration)
|
||||
- [casa - control Plane - k3s setup](#casa---control-plane---k3s-setup)
|
||||
- [minion01 - worker node](#minion01---worker-node)
|
||||
- [Minion01 - proxmox vm](#minion01---proxmox-vm)
|
||||
- [casa-minion-01 - local path config](#casa-minion-01---local-path-config)
|
||||
- [fstab](#fstab)
|
||||
- [casa-mini-minion-01 - worker node](#casa-mini-minion-01---worker-node)
|
||||
- [casa-mini-minion-01 - proxmox vm](#casa-mini-minion-01---proxmox-vm)
|
||||
- [casa-mini-minion-01 taints](#casa-mini-minion-01-taints)
|
||||
|
||||
## Common
|
||||
|
||||
**Disable swap:**
|
||||
|
||||
``` bash
|
||||
swapoff -a
|
||||
Edit /etc/fstab and comment out any swap entries:
|
||||
# /swapfile none swap sw 0 0
|
||||
```
|
||||
|
||||
**Other Packages:**
|
||||
|
||||
``` bash
|
||||
sudo apt update -y && \
|
||||
sudo apt install -y \
|
||||
curl \
|
||||
btop
|
||||
|
||||
```
|
||||
|
||||
**Update system:**
|
||||
|
||||
``` bash
|
||||
sudo apt update -y && \
|
||||
sudo apt upgrade -y && \
|
||||
sudo apt auto-remove -y
|
||||
```
|
||||
|
||||
**name servers:**
|
||||
|
||||
``` bash
|
||||
cat <<EOF > /etc/resolv.conf
|
||||
domain dev.lan
|
||||
search dev.lan. lan.
|
||||
nameserver 192.168.14.254
|
||||
EOF
|
||||
```
|
||||
|
||||
### OCI Mirrors Cache
|
||||
|
||||
``` bash
|
||||
# /etc/rancher/k3s/registries.yaml
|
||||
|
||||
mirrors:
|
||||
# --- Docker Hub (all aliases → docker-mirror) ---
|
||||
docker.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/docker-mirror
|
||||
registry-1.docker.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/docker-mirror
|
||||
index.docker.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/docker-mirror
|
||||
|
||||
# --- GHCR ---
|
||||
ghcr.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/ghcr-mirror
|
||||
|
||||
# --- Quay.io ---
|
||||
quay.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/quay-mirror
|
||||
|
||||
# --- Kubernetes official registry ---
|
||||
registry.k8s.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/k8s-mirror
|
||||
|
||||
# --- Google Container Registry (your "grc-mirror") ---
|
||||
gcr.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/grc-mirror
|
||||
|
||||
# --- AWS Public ECR ---
|
||||
public.ecr.aws:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/aws-mirror
|
||||
|
||||
# --- Microsoft Container Registry ---
|
||||
mcr.microsoft.com:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/mcr-proxy
|
||||
|
||||
# --- GitLab Container Registry ---
|
||||
registry.gitlab.com:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/gitlab-mirror
|
||||
|
||||
# --- Bitnami (namespace under Docker Hub) ---
|
||||
docker.io/bitnami:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/bitnami-mirror
|
||||
|
||||
# --- Red Hat registry ---
|
||||
registry.redhat.io:
|
||||
endpoint:
|
||||
- https://oci.limbosolutions.com/v2/readheat-mirror
|
||||
|
||||
|
||||
configs:
|
||||
oci.limbosolutions.com:
|
||||
auth:
|
||||
username: <username>
|
||||
password: <password>
|
||||
tls:
|
||||
insecure_skip_verify: false
|
||||
```
|
||||
|
||||
## casa - control Plane
|
||||
|
||||
| Name | Value |
|
||||
| --- | --- |
|
||||
| **NAME** | casa.dev.lan |
|
||||
| **VLAN** | casa |
|
||||
| **IP** | 192.168.14.9 |
|
||||
| **OS** | Debian GNU/Linux 12 (bookworm) |
|
||||
| **KERNEL** | 6.1.0-44-amd64 |
|
||||
|
||||
``` bash
|
||||
cat /etc/os-release; uname -r
|
||||
```
|
||||
|
||||
### casa - control Plane - proxmox vm
|
||||
|
||||
*hosted on gaia.*
|
||||
|
||||
``` yaml
|
||||
agent: 1
|
||||
balloon: 0
|
||||
boot: order=scsi0;ide2;net0
|
||||
cores: 2
|
||||
cpu: host
|
||||
ide2: none,media=cdrom
|
||||
memory: 2355
|
||||
meta: creation-qemu=10.1.2,ctime=1762626497
|
||||
name: casa
|
||||
net0: virtio=BXX:XX:XX:XX:XX:XX,bridge=vmbr0,tag=xx
|
||||
numa: 0
|
||||
onboot: 1
|
||||
ostype: l26
|
||||
scsi0: local-lvm:vm-XXX-disk-0,iothread=1,size=24G,ssd=1
|
||||
scsihw: virtio-scsi-single
|
||||
smbios1: uuid=cxxxx-xxxx-xxxx-xxxx-xxxx
|
||||
sockets: 1
|
||||
```
|
||||
|
||||
### casa - control Plane - network configuration
|
||||
|
||||
``` bash
|
||||
ip a # check ethernet name
|
||||
|
||||
# removes automatic configuration as dhcp client
|
||||
sed -i '/ens18/d' /etc/network/interfaces
|
||||
|
||||
cat <<EOF > /etc/network/interfaces.d/ens18
|
||||
# my network configuration
|
||||
auto ens18
|
||||
iface ens18 inet static
|
||||
address 192.168.14.9/24
|
||||
gateway 192.168.0.1
|
||||
EOF
|
||||
|
||||
```
|
||||
|
||||
### casa - control Plane - k3s setup
|
||||
|
||||
**Taint NoSchedule on master node:**
|
||||
|
||||
kubectl taint nodes <master-node-name> node-role.kubernetes.io/control-plane=:NoSchedule
|
||||
|
||||
**Example of selector/tolerations for pods, deployments:**
|
||||
|
||||
``` bash
|
||||
...
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: casa
|
||||
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: "Exists"
|
||||
effect: "NoSchedule"
|
||||
...
|
||||
|
||||
```
|
||||
|
||||
``` bash
|
||||
kubectl taint nodes casa node-role.kubernetes.io/control-plane=:NoSchedule
|
||||
```
|
||||
|
||||
## minion01 - worker node
|
||||
|
||||
### Minion01 - proxmox vm
|
||||
|
||||
*hosted on gaia.*
|
||||
|
||||
```yaml
|
||||
agent: 1
|
||||
balloon: 0
|
||||
boot: order=scsi0;ide2;net0
|
||||
cores: 4
|
||||
cpu: host
|
||||
ide2: none,media=cdrom
|
||||
memory: 4096
|
||||
meta: creation-qemu=10.1.2,ctime=1763219351
|
||||
name: casa-minion-01
|
||||
net0: virtio=BXX:XX:XX:XX:XX:XX,bridge=vmbr0,tag=xx
|
||||
numa: 0
|
||||
onboot: 1
|
||||
ostype: l26
|
||||
scsi0: fastcore:vm-XXX-disk-0,iothread=1,size=8G,ssd=1
|
||||
scsi1: fluxcore:vm-xx-disk-0,iothread=1,size=32G,ssd=1 # used mainly by jellyfin cache
|
||||
scsi1: fastcore:vm-XXX-disk-2,iothread=1,size=32G,ssd=1 /dataDisk # k3s-data-dir /dataDisk/k3s
|
||||
scsihw: virtio-scsi-single
|
||||
smbios1: xxxx-xxxx-xxxx-xxxx-xxxx
|
||||
sockets: 1
|
||||
```
|
||||
|
||||
| Name | Value |
|
||||
| --- | --- |
|
||||
| **NAME** | minion01 |
|
||||
| **VLAN** | casa |
|
||||
| **IP** | 192.168.14.10 |
|
||||
| **OS** | Debian GNU/Linux 12 (bookworm) |
|
||||
| **KERNEL** | 6.1.0-44-amd64 |
|
||||
|
||||
### casa-minion-01 - local path config
|
||||
|
||||
`kubectl -n kube-system edit configmap local-path-config on kube-system` to set path to provisioner.
|
||||
|
||||
``` yaml
|
||||
config.json: |-
|
||||
{
|
||||
"nodePathMap":[
|
||||
"node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
|
||||
"paths":["/var/lib/rancher/k3s/storage"]
|
||||
},
|
||||
{
|
||||
"node":"casa-minion-01",
|
||||
"paths":["/dataDisk/k3s/storage"]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**Set node labels:**
|
||||
|
||||
``` bash
|
||||
kubectl label node casa-minion-01 role=worker-node
|
||||
```
|
||||
|
||||
### fstab
|
||||
|
||||
```bash
|
||||
UUID=xxxx-xxxx-xxxx-xxxx-xxxx / ext4 errors=remount-ro 0 1
|
||||
UUID=xxxx-xxxx-xxxx-xxxx-xxxx /dataDisks/nvme00 ext4 errors=remount-ro 0 1
|
||||
UUID=xxxx-xxxx-xxxx-xxxx-xxxx /dataDisks/nvme01-ephemeral ext4 errors=remount-ro 0 1
|
||||
UUID=xxxx-xxxx-xxxx-xxxx-xxxx /dataDisks/ssd00 ext4 errors=remount-ro 0 1
|
||||
```
|
||||
|
||||
``` bash
|
||||
# setup kubelet pods data to nvme01-ephemeral
|
||||
ln -s /dataDisks/nvme01-ephemeral/kubelet/pods /var/lib/kubelet/pods
|
||||
# setup k3s containerd data to nvme01-ephemeral
|
||||
ln -s /dataDisks/nvme01-ephemeral/k3s/agent/containerd /dataDisks/nvme00/k3s/agent/containerd
|
||||
```
|
||||
|
||||
## casa-mini-minion-01 - worker node
|
||||
|
||||
### casa-mini-minion-01 - proxmox vm
|
||||
|
||||
*hosted on gaia.
|
||||
|
||||
``` yaml
|
||||
agent: 1
|
||||
balloon: 0
|
||||
boot: order=scsi0;ide2;net0
|
||||
cores: 4
|
||||
cpu: x86-64-v2-AES
|
||||
memory: 2048
|
||||
meta: creation-qemu=11.0.0,ctime=1782516417
|
||||
name: casa-mini-minion-01
|
||||
net0: virtio=xx:xx:xx:xx:xx:xx,bridge=vmbr0,tag=14
|
||||
numa: 0
|
||||
ostype: l26
|
||||
scsi0: fastcore:vm-112-disk-0,iothread=1,size=24G,ssd=1
|
||||
scsihw: virtio-scsi-single
|
||||
sockets: 1
|
||||
usb0: host=1-1.1
|
||||
```
|
||||
|
||||
| Name | Value |
|
||||
| --- | --- |
|
||||
| **NAME** | casa-mini-minion-01 |
|
||||
| **VLAN** | casa |
|
||||
| **IP** | 192.168.14.11 |
|
||||
| **OS** | Debian GNU/Linux 12 (bookworm) |
|
||||
| **KERNEL** | 6.1.0-44-amd64 |
|
||||
|
||||
### casa-mini-minion-01 taints
|
||||
|
||||
``` bash
|
||||
``` bash
|
||||
kubectl taint nodes casa-mini-minion-01 infra.limbosolutions.com/dedicated=casa-mini-minion-01:NoSchedule
|
||||
```
|
||||
@@ -1 +0,0 @@
|
||||
private.yaml
|
||||
@@ -1,3 +0,0 @@
|
||||
k3s_version: "v1.36.3+k3s1"
|
||||
# execute on server to get token
|
||||
# cat /var/lib/rancher/k3s/server/node-token
|
||||
@@ -1 +0,0 @@
|
||||
private.yaml
|
||||
@@ -1,4 +0,0 @@
|
||||
[all]
|
||||
casa
|
||||
casa-mini-minion-01
|
||||
casa-minion-01
|
||||
@@ -1,15 +0,0 @@
|
||||
- name: K3s update instal control plane
|
||||
hosts:
|
||||
- casa
|
||||
become: true
|
||||
tasks:
|
||||
- name: setup k3s - control plane
|
||||
ansible.builtin.shell: "curl -sfL https://get.k3s.io | sh -"
|
||||
environment:
|
||||
INSTALL_K3S_VERSION: "{{ k3s_version }}"
|
||||
INSTALL_K3S_EXEC: "--flannel-backend=none --disable-network-policy --disable=traefik --disable=servicelb"
|
||||
register: k3s_output
|
||||
|
||||
- name: Show output
|
||||
ansible.builtin.debug:
|
||||
var: k3s_output.stdout_lines
|
||||
@@ -1,14 +0,0 @@
|
||||
- name: K3s update instal k3s binaries on
|
||||
hosts:
|
||||
- casa-mini-minion-01
|
||||
become: true
|
||||
tasks:
|
||||
- name: setup k3s - casa-mini-minion-01
|
||||
ansible.builtin.shell: "curl -sfL https://get.k3s.io | sh -"
|
||||
environment:
|
||||
INSTALL_K3S_VERSION: "{{ k3s_version }}"
|
||||
INSTALL_K3S_EXEC: "agent --server https://casa.dev.lan:6443 --token {{ k3s_node_token }}"
|
||||
register: k3s_output
|
||||
- name: Show output
|
||||
ansible.builtin.debug:
|
||||
var: k3s_output.stdout_lines
|
||||
@@ -1,14 +0,0 @@
|
||||
- name: K3s update instal k3s binaries on
|
||||
hosts:
|
||||
- casa-minion-01
|
||||
become: true
|
||||
tasks:
|
||||
- name: setup k3s - casa-minion-01
|
||||
ansible.builtin.shell: "curl -sfL https://get.k3s.io | sh -"
|
||||
environment:
|
||||
INSTALL_K3S_VERSION: "{{ k3s_version }}"
|
||||
INSTALL_K3S_EXEC: "agent --data-dir /dataDisks/nvme00/k3s --server https://casa.dev.lan:6443 --token {{ k3s_node_token }}"
|
||||
register: k3s_output
|
||||
- name: Show output
|
||||
ansible.builtin.debug:
|
||||
var: k3s_output.stdout_lines
|
||||
@@ -1,23 +0,0 @@
|
||||
# requirements, on device running ansible
|
||||
# ansible-galaxy collection install ansible.posix
|
||||
# python3 -m pip show passlib
|
||||
|
||||
- name: Setup System
|
||||
hosts:
|
||||
- ???
|
||||
become: true
|
||||
tasks:
|
||||
- name: Add ansible user
|
||||
ansible.builtin.user:
|
||||
password: "{{ ansible_new_user_password | password_hash('sha512') }}"
|
||||
name: "{{ ansible_new_user }}"
|
||||
groups: sudo
|
||||
shell: /bin/bash
|
||||
create_home: yes
|
||||
state: present
|
||||
|
||||
- name: Add SSH authorized key
|
||||
ansible.posix.authorized_key:
|
||||
user: "{{ ansible_new_user }}"
|
||||
key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"
|
||||
state: present
|
||||
@@ -1,12 +0,0 @@
|
||||
- name: OS update playbook
|
||||
hosts:
|
||||
- all
|
||||
become: true
|
||||
tasks:
|
||||
|
||||
- debug:
|
||||
msg:
|
||||
- "Distribution: {{ hostvars[inventory_hostname].ansible_distribution }}"
|
||||
- "Major version: {{ hostvars[inventory_hostname].ansible_distribution_major_version }}"
|
||||
- "Version: {{ hostvars[inventory_hostname].ansible_distribution_version }}"
|
||||
- "kernel: {{ hostvars[inventory_hostname].ansible_kernel }}"
|
||||
@@ -1,44 +0,0 @@
|
||||
- name: OS update playbook
|
||||
hosts:
|
||||
- casa
|
||||
- casa-minion-01
|
||||
- casa-mini-minion-01
|
||||
become: true
|
||||
tasks:
|
||||
- debug:
|
||||
msg:
|
||||
- "ansible_distribution {{ hostvars[inventory_hostname].ansible_distribution }}"
|
||||
- "major version {{ hostvars[inventory_hostname].ansible_distribution_major_version }}"
|
||||
- "version {{ hostvars[inventory_hostname].ansible_distribution_version }}"
|
||||
- "version {{ hostvars[inventory_hostname].ansible_kernel }}"
|
||||
|
||||
- name: Update all Packages to their latest version
|
||||
ansible.builtin.apt:
|
||||
update_cache: true
|
||||
force_apt_get: true
|
||||
|
||||
- name: Upgrade all packages on servers
|
||||
ansible.builtin.apt:
|
||||
upgrade: dist
|
||||
force_apt_get: true
|
||||
|
||||
- name: Check if a reboot is needed
|
||||
register: reboot_required_file
|
||||
stat: path=/var/run/reboot-required
|
||||
|
||||
- name: Reboot server
|
||||
reboot:
|
||||
msg: "Reboot initiated by Ansible due to kernel updates"
|
||||
connect_timeout: 5
|
||||
reboot_timeout: 300
|
||||
pre_reboot_delay: 0
|
||||
post_reboot_delay: 30
|
||||
test_command: uptime
|
||||
when: reboot_required_file.stat.exists
|
||||
|
||||
- debug:
|
||||
msg:
|
||||
- "ansible_distribution {{ hostvars[inventory_hostname].ansible_distribution }}"
|
||||
- "major version {{ hostvars[inventory_hostname].ansible_distribution_major_version }}"
|
||||
- "version {{ hostvars[inventory_hostname].ansible_distribution_version }}"
|
||||
- "version {{ hostvars[inventory_hostname].ansible_kernel }}"
|
||||
@@ -1,4 +0,0 @@
|
||||
collections:
|
||||
- name: mylimbo.globals
|
||||
source: ssh://git@git.limbosolutions.com:2222/myLimbo/ansible.collection.globals.git
|
||||
type: git
|
||||
@@ -0,0 +1,40 @@
|
||||
- name: Setup rclone docker plugin
|
||||
become: true
|
||||
vars:
|
||||
# rclone_docker_plugin_config: |
|
||||
# [s3-limbo-storage]
|
||||
# type = s3
|
||||
# provider = SeaweedFS
|
||||
# access_key_id = !!! SET ON INVENTORY !!!
|
||||
# secret_access_key = !!! SET ON INVENTORY !!!
|
||||
# endpoint = !!! SET ON INVENTORY !!!
|
||||
|
||||
hosts:
|
||||
- homesrv01
|
||||
tasks:
|
||||
|
||||
- name: Enforce folders
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/docker-plugins/rclone/config
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rwx,g=r,o-rwx
|
||||
recurse: true
|
||||
|
||||
- name: Enforce folders
|
||||
ansible.builtin.file:
|
||||
path: /var/lib/docker-plugins/rclone/cache
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rwx,g=r,o-rwx
|
||||
recurse: true
|
||||
|
||||
- name: Setup rclone s3
|
||||
ansible.builtin.copy:
|
||||
dest: /var/lib/docker-plugins/rclone/config/rclone.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: u=rwx,g-rwx,o-rwx
|
||||
content: "{{ rclone_docker_plugin_config }}"
|
||||
@@ -1,11 +0,0 @@
|
||||
creation_rules:
|
||||
# encrypt all values from file
|
||||
- path_regex: \.private\.dec\.yaml$
|
||||
encrypted_regex: '^(.*)$'
|
||||
age:
|
||||
- age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
# encrypt secrets files
|
||||
- path_regex: .*.yaml
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
age:
|
||||
- age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
@@ -1,15 +0,0 @@
|
||||
# act-runners
|
||||
|
||||
## Setup
|
||||
|
||||
Using flux for reconciliation.
|
||||
|
||||
``` bash
|
||||
./ops-scripts/apply-flux.sh
|
||||
```
|
||||
|
||||
**Encrypt secrets:**
|
||||
|
||||
``` bash
|
||||
sops -e deploy/app/secret.dec.yaml > deploy/app/secret.yaml
|
||||
```
|
||||
@@ -1,18 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: act-runner
|
||||
data:
|
||||
config.yaml: |
|
||||
log:
|
||||
level: info
|
||||
|
||||
runner:
|
||||
capacity: 1
|
||||
labels:
|
||||
- kubectl
|
||||
- linux
|
||||
- casa-vlan
|
||||
|
||||
cache:
|
||||
enabled: false
|
||||
@@ -1,89 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: casa-vlan-cicd-runners
|
||||
labels:
|
||||
app: casa-vlan-cicd-runners
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: casa-vlan-cicd-runners
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: casa-vlan-cicd-runners
|
||||
spec:
|
||||
nodeSelector:
|
||||
role: worker-node
|
||||
containers:
|
||||
- name: mylimbo-casa-vlan-cicd-runner
|
||||
image: oci.limbosolutions.com/public/gitea-act-runners/kubectl:3.0.2
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: GITEA_INSTANCE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: casa-vlan-cicd-runners
|
||||
key: GITEA_INSTANCE_URL
|
||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: casa-vlan-cicd-runners
|
||||
key: GITEA_MYLIMBO_RUNNER_REGISTRATION_TOKEN
|
||||
- name: GITEA_RUNNER_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: casa-vlan-cicd-runners
|
||||
key: GITEA_MYLIMBO_RUNNER_NAME
|
||||
|
||||
resources:
|
||||
requests:
|
||||
memory: "128Mi"
|
||||
cpu: "100m"
|
||||
limits:
|
||||
memory: "512Mi"
|
||||
cpu: "400m"
|
||||
volumeMounts:
|
||||
- name: config-map
|
||||
mountPath: /etc/act_runner/config.yaml
|
||||
subPath: config.yaml
|
||||
|
||||
- name: mf-casa-vlan-cicd-runner
|
||||
image: oci.limbosolutions.com/public/gitea-act-runners/kubectl:3.0.2
|
||||
imagePullPolicy: Always
|
||||
env:
|
||||
- name: GITEA_INSTANCE_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: casa-vlan-cicd-runners
|
||||
key: GITEA_INSTANCE_URL
|
||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: casa-vlan-cicd-runners
|
||||
key: GITEA_MF_RUNNER_REGISTRATION_TOKEN
|
||||
- name: GITEA_RUNNER_NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: casa-vlan-cicd-runners
|
||||
key: GITEA_MF_RUNNER_NAME
|
||||
|
||||
- name: GITEA_RUNNER_EPHEMERAL
|
||||
value: "0"
|
||||
resources:
|
||||
requests:
|
||||
memory: "128Mi"
|
||||
cpu: "100m"
|
||||
limits:
|
||||
memory: " 512Mi"
|
||||
cpu: "400m"
|
||||
volumeMounts:
|
||||
- name: config-map
|
||||
mountPath: /etc/act_runner/config.yaml
|
||||
subPath: config.yaml
|
||||
|
||||
volumes:
|
||||
- name: config-map
|
||||
configMap:
|
||||
name: act-runner
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: casa-vlan-cicd
|
||||
resources:
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
- secret.yaml
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: casa-vlan-cicd-runners
|
||||
type: Opaque
|
||||
data:
|
||||
GITEA_INSTANCE_URL: ENC[AES256_GCM,data:hLBx+4IPLa+nKzh6pD3+QzGovKL/gVlCviP7fDFRd0W9INxzzPbg4w==,iv:NAAfQ68Zxver9/EjwLhI8FVWaFizNR6Zf6UfVvKc9ls=,tag:S2Jhg8A4JE+TZ8u5+GGzBg==,type:str]
|
||||
GITEA_MYLIMBO_RUNNER_NAME: ENC[AES256_GCM,data:jYnpxF0S/fIrVlYhsj9N2ocL+Hc2Wzf6/V8j9g==,iv:RwugntwZ9BJ0Kb1vMVZzszgLPeIftIchuv5jN57CXDc=,tag:YZoyBpNCNOIE5fMSGNkFDw==,type:str]
|
||||
GITEA_MYLIMBO_RUNNER_REGISTRATION_TOKEN: ENC[AES256_GCM,data:bCwCfcKo41KXe/t5IyccVoA897thPsApYmL0N9XHfNxkAnDJZLEdlcL5NYtdnukKSHyep04TckM=,iv:JfwLKBKOhEAPm03o/gLlT3LyofPs0oXq2dwaq8CmwHc=,tag:1rgxsK1H27+w0w33NWj+Ow==,type:str]
|
||||
GITEA_MF_RUNNER_NAME: ENC[AES256_GCM,data:GJPv4aeaukypILywmLDuBbm8e78=,iv:1Etlpm4cgnlRyfzDjMQtpIY3nG9XIrsaWWzDq4kCjD4=,tag:5RvVxf5Mm49TjFAhKpfXyQ==,type:str]
|
||||
GITEA_MF_RUNNER_REGISTRATION_TOKEN: ENC[AES256_GCM,data:ubx3PuK+Vs4reZyMBk60CmZiPHO0W8csCQSMxWy/TgfLdPUi+YxmuEigQZNtDzLPgyD9t3C/aNE=,iv:oEscOTjpKjV3YLjNqZpIpt/c2YfsX4CoKNEPkBi7p00=,tag:4CF9s4l1FULxDpKFt1jc8w==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQUpiV0thblB1T1Q3Umti
|
||||
aWVSQkhnQXpwWFg3ZDdxcHZLREpIMU1jRUY4ClZKRUlEdzgxMVczakx3Mmpvck1n
|
||||
eWdmWlkyRUNwMXBEek1BNk9SdkJnUVkKLS0tIFZMUDdpYnZlY3h3S0VyR3JrMzhJ
|
||||
OGg4c0hIRUZaZGtFS1l0Um01enl2RkUKOSAaXSC5166lEMZVihmvTStQeVtqPLyN
|
||||
VB0Hkihei9CGl6yZLdN9ATavzrC0a7Szmzwt1KCIaINJP4Dr229XhA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
lastmodified: "2026-09-03T23:58:19Z"
|
||||
mac: ENC[AES256_GCM,data:WeuZ+6A/uESLVx3bjLR9cdE4WazBmL1PxxAhaefq3n1dAsYCbJx0VFksP3IitVh4bc09hdpLcXMlzjVdbbCOQskMXaaY7Lg+AI2XaddLu1QkXWi7vgsM94lhRm/tV7EmEc2rEgZjzx6B1o47SOaXo0lzq/3MeUEUYO84P30VIbY=,iv:GsFEOokOATfS5LzHKMR+ogsW+d1ddrYurdIEs4rwsiA=,tag:mzytJ+FdaPeKUFeYc42HtQ==,type:str]
|
||||
version: 3.13.1
|
||||
@@ -1,2 +0,0 @@
|
||||
**
|
||||
!.gitignore
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: act-runners
|
||||
spec:
|
||||
interval: 1m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: casa
|
||||
namespace: casa-limbosolutions-com
|
||||
path: services/casa-vlan-cicd-runners/deploy/app
|
||||
prune: true
|
||||
decryption:
|
||||
provider: sops
|
||||
secretRef:
|
||||
name: flux-sops-age
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: casa-vlan-cicd
|
||||
resources:
|
||||
- app-sync.yaml
|
||||
secretGenerator:
|
||||
- name: flux-sops-age
|
||||
files:
|
||||
- "age.agekey=./.env.d/age.agekey"
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,2 +0,0 @@
|
||||
#!/bin/bash
|
||||
kubectl kustomize deploy/flux | kubectl apply -f -
|
||||
@@ -1,2 +0,0 @@
|
||||
.env.d/**
|
||||
.env
|
||||
@@ -1,91 +0,0 @@
|
||||
# cert-manager
|
||||
|
||||
- [cloudflare](#cloudflare)
|
||||
- [api secrets](#api-secrets)
|
||||
- [Cluster Issuer](#cluster-issuer)
|
||||
- [Staging](#staging)
|
||||
- [Deploy](#deploy)
|
||||
- [Describe](#describe)
|
||||
- [Production](#production)
|
||||
- [Deploy (Production)](#deploy-production)
|
||||
- [Describe (Production)](#describe-production)
|
||||
- [helm chart](#helm-chart)
|
||||
|
||||
## cloudflare
|
||||
|
||||
## api secrets
|
||||
|
||||
[cloudflare-api-token.yaml](./cloudflare-api-token.yaml).
|
||||
|
||||
```bash
|
||||
set -a
|
||||
source ./.env
|
||||
set +a
|
||||
envsubst < ./cloudflare-api-token.yaml \
|
||||
| kubectl apply -n kube-system -f -
|
||||
```
|
||||
|
||||
## Cluster Issuer
|
||||
|
||||
### Staging
|
||||
|
||||
#### Deploy
|
||||
|
||||
[letsencrypt-clusterissuer-staging.yaml](./letsencrypt-clusterissuer-staging.yaml).
|
||||
|
||||
```bash
|
||||
set -a
|
||||
source ./.env
|
||||
set +a
|
||||
envsubst < ./letsencrypt-clusterissuer-staging.yaml \
|
||||
| kubectl apply -n kube-system -f -
|
||||
```
|
||||
|
||||
#### Describe
|
||||
|
||||
```bash
|
||||
kubectl describe clusterissuer letsencrypt-staging
|
||||
```
|
||||
|
||||
### Production
|
||||
|
||||
#### Deploy (Production)
|
||||
|
||||
[letsencrypt-clusterissuer-prod.yaml](./letsencrypt-clusterissuer-prod.yaml).
|
||||
|
||||
```bash
|
||||
set -a
|
||||
source ./.env
|
||||
set +a
|
||||
envsubst < ./letsencrypt-clusterissuer-prod.yaml \
|
||||
| kubectl apply -n kube-system -f -
|
||||
```
|
||||
|
||||
```bash
|
||||
set -a
|
||||
source ./.env
|
||||
set +a
|
||||
envsubst < ./letsencrypt-clusterissuer-staging.yaml \
|
||||
| kubectl apply -n kube-system -f -
|
||||
```
|
||||
|
||||
#### Describe (Production)
|
||||
|
||||
```bash
|
||||
kubectl describe clusterissuer letsencrypt-prod
|
||||
```
|
||||
|
||||
**Force cert refresh:**
|
||||
|
||||
``` bash
|
||||
kubectl delete certificaterequest -l cert-manager.io/certificate-name=monitoring-limbosolutions-com-tls
|
||||
kubectl delete order -l cert-manager.io/certificate-name=monitoring-limbosolutions-com-tls
|
||||
```
|
||||
|
||||
## helm chart
|
||||
|
||||
Using flux for reconciliation.
|
||||
|
||||
``` bash
|
||||
kubectl kustomize deploy/flux | kubectl apply -f -
|
||||
```
|
||||
@@ -1,15 +0,0 @@
|
||||
#########################################################################
|
||||
# requires ./.env
|
||||
# ./.env example:
|
||||
# EMAIL="myemail@example.com"
|
||||
# check README.md for more information
|
||||
##########################################################################
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: cloudflare-api-token
|
||||
namespace: kube-system
|
||||
type: Opaque
|
||||
stringData:
|
||||
api-token: ${CLOUDFLARE_API_TOKEN}
|
||||
@@ -1,25 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cert-manager
|
||||
spec:
|
||||
releaseName: cert-manager
|
||||
interval: 40h
|
||||
chart:
|
||||
spec:
|
||||
chart: cert-manager
|
||||
version: 1.x.x
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cert-manager
|
||||
interval: 40h
|
||||
values:
|
||||
crds:
|
||||
enabled: true
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: casa-mini-minion-01
|
||||
tolerations:
|
||||
- key: "infra.limbosolutions.com/dedicated"
|
||||
operator: "Equal"
|
||||
value: "casa-mini-minion-01"
|
||||
effect: "NoSchedule"
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: cert-manager
|
||||
spec:
|
||||
interval: 40h
|
||||
url: https://charts.jetstack.io
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- helm-repo.yaml
|
||||
- helm-release.yaml
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cert-manager
|
||||
spec:
|
||||
interval: 1m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: casa
|
||||
namespace: casa-limbosolutions-com
|
||||
path: services/cert-manager/deploy/app
|
||||
prune: true
|
||||
@@ -1,5 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kube-system
|
||||
resources:
|
||||
- app-sync.yaml
|
||||
@@ -1,28 +0,0 @@
|
||||
#########################################################################
|
||||
# requires ./.env
|
||||
# ./.env example:
|
||||
# EMAIL="myemail@example.com"
|
||||
# check README.md for more information
|
||||
##########################################################################
|
||||
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
namespace: kube-system
|
||||
spec:
|
||||
acme:
|
||||
email: "${EMAIL}"
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
solvers:
|
||||
- selector:
|
||||
dnsZones:
|
||||
- "limbosolutions.com"
|
||||
dns01:
|
||||
cloudflare:
|
||||
apiTokenSecretRef:
|
||||
name: cloudflare-api-token
|
||||
key: api-token
|
||||
@@ -1,29 +0,0 @@
|
||||
#########################################################################
|
||||
# requires ./.env
|
||||
# ./.env example:
|
||||
# EMAIL="myemail@example.com"
|
||||
# CLOUDFLARE_API_TOKEN="clouddlare api key"
|
||||
# check README.md for more information
|
||||
##########################################################################
|
||||
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
namespace: kube-system
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
# Replace with your domain email.
|
||||
email: "${EMAIL}"
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- dns01:
|
||||
cloudflare:
|
||||
email: ${EMAIL}
|
||||
apiTokenSecretRef:
|
||||
name: cloudflare-api-token
|
||||
key: api-token
|
||||
|
||||
|
||||
@@ -1,21 +0,0 @@
|
||||
# Cilium
|
||||
|
||||
<oci://quay.io/cilium/charts/cilium>
|
||||
<https://docs.cilium.io/en/stable/helm-reference/#helm-reference>
|
||||
<https://docs.cilium.io/en/stable/installation/k8s-install-helm/>
|
||||
|
||||
## setup and deploy
|
||||
|
||||
Using flux for reconciliation.
|
||||
|
||||
``` bash
|
||||
POD_NAME=$(kubectl get pod -l 'app.kubernetes.io/name'=cilium-agent -n cilium -o jsonpath='{.items[0].metadata.name}')
|
||||
kubectl exec -n cilium ${POD_NAME} -c cilium-agent -- cilium-dbg status
|
||||
```
|
||||
|
||||
**list load balancers ip pools:**
|
||||
*Required after changes*
|
||||
|
||||
```bash
|
||||
kubectl get CiliumLoadBalancerIPPool -A
|
||||
```
|
||||
@@ -1,23 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: cilium
|
||||
spec:
|
||||
releaseName: cilium
|
||||
interval: 1m
|
||||
|
||||
chart:
|
||||
spec:
|
||||
chart: cilium
|
||||
version: 1.19.5
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: cilium
|
||||
namespace: cilium
|
||||
interval: 40h
|
||||
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: cilium-helm-values
|
||||
valuesKey: values.yaml
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: cilium
|
||||
spec:
|
||||
interval: 40h
|
||||
url: https://helm.cilium.io/
|
||||
@@ -1,36 +0,0 @@
|
||||
kubeProxyReplacement: true
|
||||
installCRDs: true
|
||||
routingMode: native
|
||||
enableIPv4Masquerade: true # required even if using bpf.masquerade: true
|
||||
autoDirectNodeRoutes: true
|
||||
ipv4NativeRoutingCIDR: "10.42.0.0/16"
|
||||
bpf:
|
||||
masquerade: true
|
||||
hostLegacyRouting: false # force use of bfp
|
||||
ipam:
|
||||
operator:
|
||||
clusterPoolIPv4PodCIDR: "10.42.0.0/16"
|
||||
clusterPoolIPv4MaskSize: 24
|
||||
l2announcements:
|
||||
enabled: true
|
||||
loadBalancer:
|
||||
mode: hybrid
|
||||
|
||||
operator:
|
||||
replicas: 1
|
||||
|
||||
|
||||
# fix error="listen tcp :30913: bind: address already in use" in agent
|
||||
nodePort:
|
||||
enableHealthCheck: false
|
||||
enableHealthCheckLoadBalancerIP: false
|
||||
|
||||
advertisement:
|
||||
loadBalancerIPs: true
|
||||
externalIPs: true
|
||||
|
||||
hubble:
|
||||
relay:
|
||||
enabled: true
|
||||
ui:
|
||||
enabled: true
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: cilium
|
||||
resources:
|
||||
- helm-repo.yaml
|
||||
- helm-release.yaml
|
||||
secretGenerator:
|
||||
- name: cilium-helm-values
|
||||
files:
|
||||
- values.yaml=helm-values.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: cilium
|
||||
namespace: cilium
|
||||
spec:
|
||||
interval: 1m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: casa
|
||||
namespace: casa-limbosolutions-com
|
||||
path: ./services/cilium/deploy/app
|
||||
prune: true
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: cilium.io/v2alpha1
|
||||
kind: CiliumL2AnnouncementPolicy
|
||||
metadata:
|
||||
name: casa-l2
|
||||
spec:
|
||||
serviceSelector:
|
||||
matchLabels:
|
||||
casa-lan-l2-expose: "true"
|
||||
interfaces:
|
||||
- ens18
|
||||
externalIPs: true
|
||||
loadBalancerIPs: true
|
||||
---
|
||||
apiVersion: cilium.io/v2
|
||||
kind: CiliumLoadBalancerIPPool
|
||||
metadata:
|
||||
name: casa-l2
|
||||
spec:
|
||||
blocks:
|
||||
- cidr: 192.168.14.0/24
|
||||
@@ -1,2 +0,0 @@
|
||||
# fluxcd-system
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: flux-operator
|
||||
spec:
|
||||
interval: 1m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: casa
|
||||
namespace: casa-limbosolutions-com
|
||||
path: ./services/fluxcd/deploy/flux-operator
|
||||
prune: true
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: flux-system
|
||||
resources:
|
||||
- flux-system-sync.yaml
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: flux-operator
|
||||
spec:
|
||||
releaseName: flux-operator
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
chart: flux-operator
|
||||
version: 0.x.x
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: controlplaneio-fluxcd
|
||||
interval: 40h
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: controlplaneio-fluxcd
|
||||
spec:
|
||||
type: oci
|
||||
interval: 24h
|
||||
url: oci://ghcr.io/controlplaneio-fluxcd/charts
|
||||
provider: generic
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
apiVersion: fluxcd.controlplane.io/v1
|
||||
kind: FluxInstance
|
||||
metadata:
|
||||
name: flux
|
||||
namespace: flux-system
|
||||
annotations:
|
||||
fluxcd.controlplane.io/reconcile: "enabled"
|
||||
fluxcd.controlplane.io/reconcileEvery: "1h"
|
||||
fluxcd.controlplane.io/reconcileTimeout: "10m"
|
||||
spec:
|
||||
distribution:
|
||||
version: "2.x"
|
||||
registry: "ghcr.io/fluxcd"
|
||||
artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
|
||||
components:
|
||||
- source-controller
|
||||
- source-watcher
|
||||
- kustomize-controller
|
||||
- helm-controller
|
||||
- notification-controller
|
||||
- image-reflector-controller
|
||||
- image-automation-controller
|
||||
cluster:
|
||||
type: kubernetes
|
||||
size: medium
|
||||
multitenant: false
|
||||
networkPolicy: true
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: flux-system
|
||||
resources:
|
||||
- flux-helm-repo.yaml
|
||||
- flux-helm-release.yaml
|
||||
- flux-instance.yaml
|
||||
- pod-monitor.yaml
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: flux-system
|
||||
namespace: flux-system
|
||||
labels:
|
||||
app.kubernetes.io/part-of: flux
|
||||
app.kubernetes.io/component: monitoring
|
||||
prometheus-monitoring: enabled
|
||||
spec:
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- flux-system
|
||||
selector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- helm-controller
|
||||
- source-controller
|
||||
- kustomize-controller
|
||||
- notification-controller
|
||||
- image-automation-controller
|
||||
- image-reflector-controller
|
||||
podMetricsEndpoints:
|
||||
- port: http-prom
|
||||
@@ -1,11 +0,0 @@
|
||||
creation_rules:
|
||||
# encrypt all values from file
|
||||
- path_regex: \.private\.dec\.yaml$
|
||||
encrypted_regex: '^(.*)$'
|
||||
age:
|
||||
- age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
# encrypt secrets files
|
||||
- path_regex: .*.yaml
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
age:
|
||||
- age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
@@ -1,17 +0,0 @@
|
||||
# monitoring
|
||||
|
||||
## alloy
|
||||
|
||||
**promtail Encrypt secrets:**
|
||||
|
||||
``` bash
|
||||
sops -e deploy/alloy/global/secrets.dec.yaml > deploy/alloy/global/secrets.yaml
|
||||
```
|
||||
|
||||
**Check agent:**
|
||||
|
||||
``` bash
|
||||
http://localhost:9090/agent
|
||||
```
|
||||
|
||||
## prometheus - kube-state-metrics
|
||||
@@ -1,144 +0,0 @@
|
||||
// ============================================
|
||||
// LOKI WRITE TARGET
|
||||
// ============================================
|
||||
loki.write "loki_srv" {
|
||||
endpoint {
|
||||
url = env("LOKI_URL")
|
||||
}
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// POD LOGS: DISCOVERY + RELABEL
|
||||
// ============================================
|
||||
|
||||
// Discover Kubernetes pods
|
||||
discovery.kubernetes "pod_logs" {
|
||||
role = "pod"
|
||||
}
|
||||
|
||||
discovery.relabel "pod_logs" {
|
||||
targets = discovery.kubernetes.pod_logs.targets
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_namespace"]
|
||||
target_label = "namespace"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_name"]
|
||||
regex = "^(.+?)-[0-9a-zA-Z]{4,16}(?:-[0-9a-zA-Z]{4,16})?$"
|
||||
replacement = "$1"
|
||||
target_label = "pod"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_container_name"]
|
||||
target_label = "container"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_node_name"]
|
||||
target_label = "node_name"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = [
|
||||
"__meta_kubernetes_pod_controller_name",
|
||||
]
|
||||
regex = "([0-9a-z-.]+?)(-[0-9a-f]{8,10})?"
|
||||
target_label = "controller_name"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = [
|
||||
"__meta_kubernetes_pod_label_app_kubernetes_io_name",
|
||||
"__meta_kubernetes_pod_label_app",
|
||||
"controller_name",
|
||||
"__meta_kubernetes_pod_name",
|
||||
]
|
||||
regex = "^;*([^;]+)(;.*)?$"
|
||||
target_label = "app"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = [
|
||||
"__meta_kubernetes_pod_label_app_kubernetes_io_component",
|
||||
"__meta_kubernetes_pod_label_component",
|
||||
]
|
||||
regex = "^;*([^;]+)(;.*)?$"
|
||||
target_label = "component"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["namespace", "app"]
|
||||
separator = "/"
|
||||
target_label = "job"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["job", "container"]
|
||||
separator = ":"
|
||||
target_label = "instance"
|
||||
}
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||
separator = ":"
|
||||
target_label = "host"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// ============================================
|
||||
// POD LOGS: SOURCE → PROCESS → WRITE
|
||||
// ============================================
|
||||
|
||||
// Tail logs from Kubernetes pods
|
||||
loki.source.kubernetes "pod_logs" {
|
||||
// targets = discovery.kubernetes.pod_logs.targets
|
||||
targets = discovery.relabel.pod_logs.output
|
||||
forward_to = [loki.process.pod_logs.receiver]
|
||||
}
|
||||
|
||||
// Add static labels and forward logs to Loki
|
||||
loki.process "pod_logs" {
|
||||
|
||||
stage.static_labels {
|
||||
values = {
|
||||
cluster = env("CLUSTER_NAME"),
|
||||
zone = env("ZONE"),
|
||||
}
|
||||
}
|
||||
|
||||
forward_to = [loki.write.loki_srv.receiver]
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// KUBERNETES EVENTS
|
||||
// ============================================
|
||||
|
||||
// Tail Kubernetes events and convert them to log entries
|
||||
loki.source.kubernetes_events "cluster_events" {
|
||||
job_name = "integrations/kubernetes/eventhandler"
|
||||
log_format = "logfmt"
|
||||
forward_to = [
|
||||
loki.process.cluster_events.receiver,
|
||||
]
|
||||
}
|
||||
|
||||
// Add static labels and forward events to Loki
|
||||
loki.process "cluster_events" {
|
||||
forward_to = [loki.write.loki_srv.receiver]
|
||||
|
||||
stage.static_labels {
|
||||
values = {
|
||||
cluster = env("CLUSTER_NAME"),
|
||||
host = "env("CLUSTER_NAME")",
|
||||
job = "cluster_events",
|
||||
zone = env("ZONE"),
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
@@ -1,146 +0,0 @@
|
||||
// ============================================
|
||||
// Metrics: Discovery Kubernetes Services
|
||||
// ============================================
|
||||
|
||||
// discovery.kubernetes "k8s_services" {
|
||||
// role = "service"
|
||||
// }
|
||||
|
||||
// ============================================
|
||||
// Metrics: Kube State Metrics (k8s_services)
|
||||
// ============================================
|
||||
|
||||
// prometheus.scrape "kube_state_metrics" {
|
||||
// job_name = "integrations/kubernetes/kube-state-metrics"
|
||||
// targets = discovery.relabel.kube_state_metrics.output
|
||||
//
|
||||
// scheme = "http"
|
||||
//
|
||||
// forward_to = [prometheus.remote_write.prometheus_srv.receiver]
|
||||
// }
|
||||
|
||||
// ============================================
|
||||
// API Server discovery
|
||||
// ============================================
|
||||
|
||||
// discovery.relabel "apiserver" {
|
||||
// targets = discovery.kubernetes.k8s_services.targets
|
||||
|
||||
// rule {
|
||||
// source_labels = ["__meta_kubernetes_service_name"]
|
||||
// regex = "kubernetes"
|
||||
// action = "keep"
|
||||
// }
|
||||
// rule {
|
||||
// target_label = "cluster"
|
||||
// replacement = env("CLUSTER_NAME")
|
||||
// }
|
||||
// }
|
||||
|
||||
// prometheus.scrape "apiserver" {
|
||||
// job_name = "integrations/kubernetes/apiserver"
|
||||
// targets = discovery.relabel.apiserver.output
|
||||
|
||||
// scheme = "https"
|
||||
// metrics_path = "/metrics"
|
||||
|
||||
// tls_config {
|
||||
// server_name = "kubernetes"
|
||||
// ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
|
||||
// insecure_skip_verify = true
|
||||
// }
|
||||
|
||||
// bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
|
||||
|
||||
// forward_to = [prometheus.remote_write.prometheus_srv.receiver]
|
||||
// }
|
||||
|
||||
// ============================================
|
||||
// CoreDNS discovery
|
||||
// ============================================
|
||||
// discovery.relabel "coredns" {
|
||||
// targets = discovery.kubernetes.k8s_services.targets
|
||||
//
|
||||
// rule {
|
||||
// source_labels = ["__meta_kubernetes_pod_label_k8s_app"]
|
||||
// regex = "kube-dns"
|
||||
// action = "keep"
|
||||
// }
|
||||
// rule {
|
||||
// target_label = "cluster"
|
||||
// replacement = env("CLUSTER_NAME")
|
||||
// }
|
||||
// }
|
||||
|
||||
// prometheus.scrape "coredns" {
|
||||
// job_name = "integrations/kubernetes/coredns-pods"
|
||||
// targets = discovery.relabel.coredns.output
|
||||
|
||||
// scheme = "http"
|
||||
// metrics_path = "/metrics"
|
||||
//
|
||||
// forward_to = [prometheus.remote_write.prometheus_srv.receiver]
|
||||
// }
|
||||
|
||||
|
||||
// ============================================
|
||||
// Prometheus: prometheus_srv
|
||||
// ============================================
|
||||
|
||||
prometheus.remote_write "prometheus_srv" {
|
||||
|
||||
endpoint {
|
||||
url = env("PROMETHEUS_URL")
|
||||
}
|
||||
|
||||
// global labels
|
||||
external_labels = {
|
||||
cluster = env("CLUSTER_NAME"),
|
||||
zone = env("ZONE"),
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
// ===============================================================================
|
||||
// prometheus / Metrics - Node exporter
|
||||
// Requirements:
|
||||
// - discovery.relabel - node_exporter
|
||||
// ===============================================================================
|
||||
prometheus.scrape "node_exporter" {
|
||||
job_name = "integrations/kubernetes/node-exporter"
|
||||
targets = discovery.relabel.node_exporter.output
|
||||
scheme = "http"
|
||||
forward_to = [prometheus.remote_write.prometheus_srv.receiver]
|
||||
}
|
||||
|
||||
|
||||
discovery.relabel "node_exporter" {
|
||||
targets = discovery.kubernetes.kube_pods.targets
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
|
||||
regex = "node-exporter|prometheus-node-exporter"
|
||||
action = "keep"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_container_port_number"]
|
||||
regex = "9100"
|
||||
action = "keep"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||
target_label = "node"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||
target_label = "nodename"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||
target_label = "instance"
|
||||
}
|
||||
}
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: grafana
|
||||
spec:
|
||||
interval: 24h
|
||||
url: https://grafana.github.io/helm-charts
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- secrets.yaml
|
||||
- grafana-helm-repo.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,22 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: alloy-global
|
||||
stringData:
|
||||
loki_url: ENC[AES256_GCM,data:2DeZZ+7deDbojQ/+YNgT8KwDmjFFyAqMcTX8l6itlF15hilXKgYP1p/SNoyw1JGJ7x5VZqUl0VIVhVY=,iv:SlFiLvEeIqj+zQ/8Jspc9FL/ElneIlWBzGsM+6mGZLc=,tag:9tIl6fi+xfmF+TJpMXgbKg==,type:str]
|
||||
prometheus_url: ENC[AES256_GCM,data:k8Z3lvZRxOmlw6Wx4aLAgV93hPcEawtoprWU2Kn6j/WIe/YDHM9iuB+pRy7ght4I6jxyNFLotN0BaHE1yg==,iv:EEnRoS287e9EV8+25NtlEO31zN0eyfRBOUe9GVBah18=,tag:2K/MnM1QlWPbceQBqCwylw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYmx1dGJTSGZvbVdpV1di
|
||||
Z3dKNUJPVGNkK1hBSnVoRXZrb0R4TmxnUjM4CmpyUXpGN2lneDViN3VPNC9Fa3d6
|
||||
RURxZTFuV0o1SzF5ZEhzSVZyYkY5alkKLS0tIEF1T0tINnRUa0tDOGlaSVRJajF5
|
||||
bTFTd0c4Z3p1aUNWWTZ0ZFVXQVdrMjAKku2YU048qf4E9vEPO19HNfAg78E3fSFQ
|
||||
WBiUgiqtqG/T4cI5cf4CUWoUogtABawBG4z5G5+ud7sfVMzfqW+W1g==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
lastmodified: "2026-08-30T22:14:34Z"
|
||||
mac: ENC[AES256_GCM,data:XQ2zRn6zGBONfBiyaip3DpwzIfDBN1mPI65fVfH3c7tsEeY1mV/ZRPD+5iJsiwxlnBa7Rq0iJNOr2f84JE+CiuqYz8UKuQMS02gsvqXuBSgUn5vDRcX/aBV3+1GSOzv3ilmwMkJI/jxfyyXL4YsxKl0fsFEOJRsa3VCCVF0OvrM=,iv:enk8h+TfYBIOFln3SlOw30arg2T/kSU3IMwusrm68Qc=,tag:yp9eQc56Ht6g3x3QnMqMZg==,type:str]
|
||||
version: 3.13.1
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: alloy-kube-scraper
|
||||
spec:
|
||||
releaseName: alloy-kube-scraper
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
chart: alloy
|
||||
version: 1.x.x
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: grafana
|
||||
interval: 40h
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: alloy-kube-scraper-helm-values
|
||||
valuesKey: values.yaml
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,265 +0,0 @@
|
||||
controller:
|
||||
type: 'deployment'
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: casa-minion-01
|
||||
alloy:
|
||||
|
||||
# https://grafana.com/docs/alloy/latest/collect/logs-in-kubernetes/
|
||||
configMap:
|
||||
content: |
|
||||
// ============================================
|
||||
// Discovery: Kubernetes - Nodes
|
||||
// used by:
|
||||
// - prometheus - Kube_node_metrics - cAdvisor
|
||||
// ============================================
|
||||
|
||||
discovery.kubernetes "kube_nodes" {
|
||||
role = "node"
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// Discovery: Kubernetes - pods
|
||||
// used by:
|
||||
// - loki kubernetes pod logs
|
||||
// ============================================
|
||||
|
||||
discovery.kubernetes "kube_pods" {
|
||||
role = "pod"
|
||||
}
|
||||
|
||||
|
||||
// ============================================
|
||||
// Discovery: Kubernetes - endpoints
|
||||
// used by:
|
||||
// - loki kubernetes kube state metrics
|
||||
// ============================================
|
||||
discovery.kubernetes "kube_endpoints" {
|
||||
role = "endpoint"
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// Logs: Loki config
|
||||
// ============================================
|
||||
|
||||
loki.write "loki_srv" {
|
||||
endpoint {
|
||||
url = env("LOKI_URL")
|
||||
}
|
||||
}
|
||||
|
||||
loki.process "loki_srv" {
|
||||
stage.static_labels {
|
||||
values = {
|
||||
cluster = env("CLUSTER_NAME"),
|
||||
zone = env("ZONE"),
|
||||
}
|
||||
}
|
||||
forward_to = [loki.write.loki_srv.receiver]
|
||||
}
|
||||
|
||||
|
||||
// ============================================
|
||||
// Loki.source kube_pod_logs
|
||||
// Requirements:
|
||||
// - discovery.relabel: kube_pod_logs
|
||||
// - discovery.process: loki_srv
|
||||
// ============================================
|
||||
|
||||
loki.source.kubernetes "kube_pod_logs" {
|
||||
targets = discovery.relabel.kube_pod_logs.output
|
||||
forward_to = [loki.process.loki_srv.receiver]
|
||||
}
|
||||
|
||||
|
||||
// ============================================
|
||||
// Discovery:relabel: kube_pod_logs
|
||||
// Requirements:
|
||||
// - discovery.kubernetes.role.pod: kube_pods
|
||||
// ============================================
|
||||
|
||||
discovery.relabel "kube_pod_logs" {
|
||||
targets = discovery.kubernetes.kube_pods.targets
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_namespace"]
|
||||
target_label = "namespace"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_name"]
|
||||
regex = "^(.+?)-[0-9a-zA-Z]{4,16}(?:-[0-9a-zA-Z]{4,16})?$"
|
||||
replacement = "$1"
|
||||
target_label = "pod"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_container_name"]
|
||||
target_label = "container"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_node_name"]
|
||||
target_label = "node_name"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = [
|
||||
"__meta_kubernetes_pod_controller_name",
|
||||
]
|
||||
regex = "([0-9a-z-.]+?)(-[0-9a-f]{8,10})?"
|
||||
target_label = "controller_name"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = [
|
||||
"__meta_kubernetes_pod_label_app_kubernetes_io_name",
|
||||
"__meta_kubernetes_pod_label_app",
|
||||
"controller_name",
|
||||
"__meta_kubernetes_pod_name",
|
||||
]
|
||||
regex = "^;*([^;]+)(;.*)?$"
|
||||
target_label = "app"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = [
|
||||
"__meta_kubernetes_pod_label_app_kubernetes_io_component",
|
||||
"__meta_kubernetes_pod_label_component",
|
||||
]
|
||||
regex = "^;*([^;]+)(;.*)?$"
|
||||
target_label = "component"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["namespace", "app"]
|
||||
separator = "/"
|
||||
target_label = "job"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["job", "container"]
|
||||
separator = ":"
|
||||
target_label = "instance"
|
||||
}
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||
separator = ":"
|
||||
target_label = "host"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// ===============================================================================
|
||||
// prometheus / Metrics - Scrape kube_state_metrics
|
||||
// Requirements:
|
||||
// - discovery.relabel - kube_state_metrics
|
||||
// ===============================================================================
|
||||
prometheus.scrape "kube_state_metrics" {
|
||||
job_name = "integrations/kubernetes/kube-state-metrics"
|
||||
targets = discovery.relabel.kube_state_metrics.output
|
||||
|
||||
scheme = "http"
|
||||
|
||||
forward_to = [prometheus.remote_write.prometheus_srv.receiver]
|
||||
}
|
||||
|
||||
discovery.relabel "kube_state_metrics" {
|
||||
targets = discovery.kubernetes.kube_endpoints.targets
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_service_name"]
|
||||
regex = "kube-state-metrics"
|
||||
action = "keep"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_endpoint_node_name"]
|
||||
target_label = "node"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_endpoint_node_name"]
|
||||
target_label = "host"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["__meta_kubernetes_endpoint_node_name"]
|
||||
target_label = "nodename"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
// ===============================================================================
|
||||
// Scrape Kubernetes pods containers metrics / cAdvisor
|
||||
// Requirements:
|
||||
// - discovery.relabel - kube_pods_metrics (cAdviser)
|
||||
// ===============================================================================
|
||||
|
||||
prometheus.scrape "cadvisor" {
|
||||
job_name = "integrations/kubernetes/cadvisor"
|
||||
targets = discovery.relabel.kube_pods_metrics.output
|
||||
scheme = "https"
|
||||
|
||||
tls_config {
|
||||
server_name = "kubernetes"
|
||||
ca_file = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
|
||||
insecure_skip_verify = true
|
||||
}
|
||||
|
||||
bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
|
||||
forward_to = [prometheus.remote_write.prometheus_srv.receiver]
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
// ===========================================================
|
||||
// Discovery:relabel: kube_pods_metrics (cAdviser)
|
||||
// Requirements:
|
||||
// - discovery.kubernetes.role.node: kube_nodes
|
||||
// ===========================================================
|
||||
|
||||
discovery.relabel "kube_node_metrics" {
|
||||
targets = discovery.kubernetes.kube_nodes.targets
|
||||
rule {
|
||||
action = "replace"
|
||||
source_labels = ["__meta_kubernetes_node_name"]
|
||||
regex = "(.+)"
|
||||
target_label = "node"
|
||||
}
|
||||
|
||||
rule {
|
||||
source_labels = ["node"]
|
||||
target_label = "host"
|
||||
}
|
||||
|
||||
// rule {
|
||||
// source_labels = ["host"]
|
||||
// target_label = "nodename"
|
||||
// }
|
||||
|
||||
rule {
|
||||
replacement = "/metrics/cadvisor"
|
||||
target_label = "__metrics_path__"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
extraEnv:
|
||||
|
||||
- name: CLUSTER_NAME
|
||||
value: casa
|
||||
- name: ZONE
|
||||
value: casa-vlan
|
||||
|
||||
- name: LOKI_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: alloy-global
|
||||
key: loki_url
|
||||
|
||||
- name: PROMETHEUS_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: alloy-global
|
||||
key: prometheus_url
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- helm-release.yaml
|
||||
secretGenerator:
|
||||
- name: alloy-kube-scraper-helm-values
|
||||
files:
|
||||
- values.yaml=helm-values.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,9 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- global
|
||||
- node-scraper
|
||||
- kube-scraper
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: alloy-node-scraper
|
||||
spec:
|
||||
releaseName: alloy-node-scraper
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
chart: alloy
|
||||
version: 1.x.x
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: grafana
|
||||
interval: 40h
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: alloy-node-scraper-helm-values
|
||||
valuesKey: values.yaml
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,231 +0,0 @@
|
||||
controller:
|
||||
nameOverride: "alloy-node-scrapper"
|
||||
volumes:
|
||||
extra:
|
||||
# requires host journal configuration storage = volatile
|
||||
- name: run-log-journal
|
||||
hostPath:
|
||||
path: /run/log/journal
|
||||
# Log scrapers (e.g., Alloy/Loki) read this ID from the journal metadata and use it to separate log streams per machine.
|
||||
- name: etc-machine-id
|
||||
hostPath:
|
||||
path: /etc/machine-id
|
||||
- name: rootfs
|
||||
hostPath:
|
||||
path: /
|
||||
- name: proc
|
||||
hostPath:
|
||||
path: /proc
|
||||
- name: sys
|
||||
hostPath:
|
||||
path: /sys
|
||||
- name: dev
|
||||
hostPath:
|
||||
path: /dev
|
||||
|
||||
tolerations:
|
||||
- key: "node-role.kubernetes.io/control-plane"
|
||||
operator: "Exists"
|
||||
effect: "NoSchedule"
|
||||
- key: "infra.limbosolutions.com/dedicated"
|
||||
operator: "Exists"
|
||||
effect: "NoSchedule"
|
||||
|
||||
alloy:
|
||||
mounts:
|
||||
varlog: true # Mounts /var/log from the host (persistent journal)
|
||||
extra:
|
||||
# requires host journal configuration storage = volatile
|
||||
- name: run-log-journal
|
||||
mountPath: /run/log/journal
|
||||
readOnly: true
|
||||
# required
|
||||
- name: etc-machine-id
|
||||
mountPath: /etc/machine-id
|
||||
readOnly: true
|
||||
- name: rootfs
|
||||
mountPath: /host
|
||||
readOnly: true
|
||||
- name: proc
|
||||
mountPath: /host/proc
|
||||
readOnly: true
|
||||
- name: sys
|
||||
mountPath: /host/sys
|
||||
readOnly: true
|
||||
- name: dev
|
||||
mountPath: /host/dev
|
||||
readOnly: true
|
||||
# https://grafana.com/docs/alloy/latest/collect/logs-in-kubernetes/
|
||||
configMap:
|
||||
content: |
|
||||
|
||||
// ============================================
|
||||
// LOKI WRITE TARGET
|
||||
// ============================================
|
||||
loki.write "loki_srv" {
|
||||
endpoint {
|
||||
url = env("LOKI_URL")
|
||||
}
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// HOST JOURNALD SOURCE
|
||||
// ============================================
|
||||
|
||||
// Read journald logs from the host
|
||||
loki.source.journal "journal" {
|
||||
max_age = "24h"
|
||||
relabel_rules = discovery.relabel.host_journal.rules
|
||||
forward_to = [loki.process.host_journal.receiver]
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// HOST JOURNALD RELABELING
|
||||
// ============================================
|
||||
|
||||
// Convert journald metadata into Loki labels
|
||||
discovery.relabel "host_journal" {
|
||||
targets = []
|
||||
|
||||
// Systemd unit name
|
||||
rule {
|
||||
source_labels = ["__journal__systemd_unit"]
|
||||
target_label = "systemd_unit"
|
||||
}
|
||||
|
||||
// Transport type (stdout, syslog, kernel, audit, etc.)
|
||||
rule {
|
||||
source_labels = ["__journal__transport"]
|
||||
target_label = "journal_transport"
|
||||
}
|
||||
|
||||
// Priority (info, warning, error)
|
||||
rule {
|
||||
source_labels = ["__journal_priority_keyword"]
|
||||
target_label = "level"
|
||||
}
|
||||
}
|
||||
|
||||
// ============================================
|
||||
// HOST JOURNALD PROCESSING
|
||||
// ============================================
|
||||
|
||||
// Add static labels and forward journald logs to Loki
|
||||
loki.process "host_journal" {
|
||||
stage.static_labels {
|
||||
values = {
|
||||
cluster = env("CLUSTER_NAME"),
|
||||
host = env("HOSTNAME"),
|
||||
zone = env("ZONE"),
|
||||
job = "journald",
|
||||
service_name = "journald",
|
||||
}
|
||||
}
|
||||
|
||||
forward_to = [loki.write.loki_srv.receiver]
|
||||
}
|
||||
|
||||
|
||||
// ============================================
|
||||
// Metrics: Prometheus connection config
|
||||
// ============================================
|
||||
|
||||
prometheus.remote_write "metrics_service" {
|
||||
endpoint {
|
||||
url = env("PROMETHEUS_URL")
|
||||
}
|
||||
|
||||
// global labels
|
||||
external_labels = {
|
||||
cluster = env("CLUSTER_NAME"),
|
||||
zone = env("ZONE"),
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// ============================================
|
||||
// Metrics: Prometheus Unix Exporter
|
||||
// ============================================
|
||||
|
||||
prometheus.exporter.unix "node_exporter" {
|
||||
rootfs_path = "/host"
|
||||
disable_collectors = ["ipvs", "btrfs", "infiniband", "xfs", "zfs"]
|
||||
enable_collectors = [
|
||||
"cpu",
|
||||
"meminfo",
|
||||
"vmstat",
|
||||
"loadavg",
|
||||
"filesystem",
|
||||
"netdev",
|
||||
"uname",
|
||||
]
|
||||
|
||||
filesystem {
|
||||
mount_points_exclude = "^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)"
|
||||
fs_types_exclude = "^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$"
|
||||
mount_timeout = "5s"
|
||||
}
|
||||
|
||||
netclass {
|
||||
ignored_devices = "^(veth.*|cali.*|[a-f0-9]{15})$"
|
||||
}
|
||||
|
||||
netdev {
|
||||
device_exclude = "^(veth.*|cali.*|[a-f0-9]{15})$"
|
||||
}
|
||||
}
|
||||
|
||||
prometheus.scrape "node_exporter" {
|
||||
targets = prometheus.exporter.unix.node_exporter.targets
|
||||
scrape_interval = "30s"
|
||||
|
||||
forward_to = [prometheus.relabel.node_exporter.receiver]
|
||||
}
|
||||
|
||||
prometheus.relabel "node_exporter" {
|
||||
forward_to = [prometheus.remote_write.metrics_service.receiver]
|
||||
|
||||
rule {
|
||||
action = "replace"
|
||||
replacement = env("HOSTNAME")
|
||||
target_label = "nodename"
|
||||
}
|
||||
|
||||
rule {
|
||||
action = "replace"
|
||||
replacement = env("HOSTNAME")
|
||||
target_label = "node"
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
extraEnv:
|
||||
- name: NODE_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.hostIP
|
||||
- name: CLUSTER_NAME
|
||||
value: casa
|
||||
- name: JOB
|
||||
value: node-exporter
|
||||
- name: CONTAINER
|
||||
value: node-exporter
|
||||
- name: NS
|
||||
value: monitoring
|
||||
- name: POD
|
||||
value: alloy-node-scraper
|
||||
- name: SERVICE
|
||||
value: alloy-node-scraper
|
||||
- name: ZONE
|
||||
value: casa-vlan
|
||||
- name: LOKI_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: alloy-global
|
||||
key: loki_url
|
||||
- name: PROMETHEUS_URL
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: alloy-global
|
||||
key: prometheus_url
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- helm-release.yaml
|
||||
secretGenerator:
|
||||
- name: alloy-node-scraper-helm-values
|
||||
files:
|
||||
- values.yaml=helm-values.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,2 +0,0 @@
|
||||
**
|
||||
!.gitignore
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: alloy
|
||||
spec:
|
||||
interval: 1m
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: casa
|
||||
namespace: casa-limbosolutions-com
|
||||
path: services/monitoring/deploy/alloy
|
||||
prune: true
|
||||
decryption:
|
||||
provider: sops
|
||||
secretRef:
|
||||
name: flux-sops-age
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- flux-kustomization-alloy.yaml
|
||||
secretGenerator:
|
||||
- name: flux-sops-age
|
||||
files:
|
||||
- "age.agekey=./.env.d/age.agekey"
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
@@ -1,15 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kube-state-metrics
|
||||
spec:
|
||||
releaseName: kube-state-metrics
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
chart: kube-state-metrics
|
||||
version: 8.x.x
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: prometheus
|
||||
interval: 40h
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: prometheus
|
||||
spec:
|
||||
interval: 40h
|
||||
url: https://prometheus-community.github.io/helm-charts
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- helm-repo.yaml
|
||||
- helm-release.yaml
|
||||
@@ -0,0 +1,140 @@
|
||||
services:
|
||||
act-runner:
|
||||
container_name: myLimbo-casa-gitea-act-runner
|
||||
image: docker.io/gitea/act_runner:latest
|
||||
restart: always
|
||||
volumes:
|
||||
- myLimbo-casa-gitea-act-runner-data:/data
|
||||
- myLimbo-casa-gitea-act-runner-config:/config
|
||||
- /var/run/docker.sock:/var/run/docker.sock
|
||||
|
||||
environment:
|
||||
- GITEA_INSTANCE_URL=${GITEA_INSTANCE_URL}
|
||||
# When using Docker Secrets, it's also possible to use
|
||||
# GITEA_RUNNER_REGISTRATION_TOKEN_FILE to pass the location.
|
||||
# The env var takes precedence.
|
||||
# Needed only for the first start.
|
||||
- CONFIG_FILE= /config/config.yaml
|
||||
- GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
|
||||
- GITEA_RUNNER_NAME=myLimbo-casa-gitea-act-runner
|
||||
#- GITEA_RUNNER_CONFIG_FILE="/config/config.yaml"
|
||||
|
||||
|
||||
configs:
|
||||
- source: act-runner-config
|
||||
target: /config/config.yaml
|
||||
mode: 0444
|
||||
|
||||
volumes:
|
||||
myLimbo-casa-gitea-act-runner-data:
|
||||
name: myLimbo-casa-gitea-act-runner-data
|
||||
myLimbo-casa-gitea-act-runner-config:
|
||||
name: myLimbo-casa-gitea-act-runner-config
|
||||
|
||||
|
||||
configs:
|
||||
act-runner-config:
|
||||
content: |
|
||||
# Example configuration file, it's safe to copy this as the default config file without any modification.
|
||||
|
||||
# You don't have to copy this file to your instance,
|
||||
# just run `./act_runner generate-config > config.yaml` to generate a config file.
|
||||
|
||||
log:
|
||||
# The level of logging, can be trace, debug, info, warn, error, fatal
|
||||
level: info
|
||||
|
||||
runner:
|
||||
# Where to store the registration result.
|
||||
file: .runner
|
||||
# Execute how many tasks concurrently at the same time.
|
||||
capacity: 1
|
||||
# Extra environment variables to run jobs.
|
||||
envs:
|
||||
A_TEST_ENV_NAME_1: a_test_env_value_1
|
||||
A_TEST_ENV_NAME_2: a_test_env_value_2
|
||||
# Extra environment variables to run jobs from a file.
|
||||
# It will be ignored if it's empty or the file doesn't exist.
|
||||
env_file: .env
|
||||
# The timeout for a job to be finished.
|
||||
# Please note that the Gitea instance also has a timeout (3h by default) for the job.
|
||||
# So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
|
||||
timeout: 3h
|
||||
# The timeout for the runner to wait for running jobs to finish when shutting down.
|
||||
# Any running jobs that haven't finished after this timeout will be cancelled.
|
||||
shutdown_timeout: 0s
|
||||
# Whether skip verifying the TLS certificate of the Gitea instance.
|
||||
insecure: false
|
||||
# The timeout for fetching the job from the Gitea instance.
|
||||
fetch_timeout: 5s
|
||||
# The interval for fetching the job from the Gitea instance.
|
||||
fetch_interval: 2s
|
||||
# The labels of a runner are used to determine which jobs the runner can run, and how to run them.
|
||||
# Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
|
||||
# Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
|
||||
# If it's empty when registering, it will ask for inputting labels.
|
||||
# If it's empty when execute `daemon`, will use labels in `.runner` file.
|
||||
labels:
|
||||
- "myLimbo-casa-gitea-act-runner:docker://gitea/runner-images:ubuntu-latest"
|
||||
#- "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
|
||||
#- "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
|
||||
#- "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
|
||||
|
||||
cache:
|
||||
# Enable cache server to use actions/cache.
|
||||
enabled: true
|
||||
# The directory to store the cache data.
|
||||
# If it's empty, the cache data will be stored in $HOME/.cache/actcache.
|
||||
dir: ""
|
||||
# The host of the cache server.
|
||||
# It's not for the address to listen, but the address to connect from job containers.
|
||||
# So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
|
||||
host: ""
|
||||
# The port of the cache server.
|
||||
# 0 means to use a random available port.
|
||||
port: 0
|
||||
# The external cache server URL. Valid only when enable is true.
|
||||
# If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
|
||||
# The URL should generally end with "/".
|
||||
external_server: ""
|
||||
|
||||
container:
|
||||
# Specifies the network to which the container will connect.
|
||||
# Could be host, bridge or the name of a custom network.
|
||||
# If it's empty, act_runner will create a network automatically.
|
||||
network: ""
|
||||
# Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
|
||||
privileged: false
|
||||
# And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
|
||||
options:
|
||||
# The parent directory of a job's working directory.
|
||||
# NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically.
|
||||
# If the path starts with '/', the '/' will be trimmed.
|
||||
# For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
|
||||
# If it's empty, /workspace will be used.
|
||||
workdir_parent:
|
||||
# Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
|
||||
# You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
|
||||
# For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
|
||||
# valid_volumes:
|
||||
# - data
|
||||
# - /src/*.json
|
||||
# If you want to allow any volume, please use the following configuration:
|
||||
# valid_volumes:
|
||||
# - '**'
|
||||
valid_volumes: []
|
||||
# overrides the docker client host with the specified one.
|
||||
# If it's empty, act_runner will find an available docker host automatically.
|
||||
# If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
|
||||
# If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
|
||||
docker_host: ""
|
||||
# Pull docker image(s) even if already present
|
||||
force_pull: true
|
||||
# Rebuild docker image(s) even if already present
|
||||
force_rebuild: false
|
||||
|
||||
host:
|
||||
# The parent directory of a job's working directory.
|
||||
# If it's empty, $HOME/.cache/act/ will be used.
|
||||
workdir_parent:
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
configs:
|
||||
run-sh:
|
||||
content: |
|
||||
#!/bin/sh
|
||||
# patch security so kubctl on sync-certs-job can write to the mounted volume
|
||||
chown -R 1001:1001 /etc/ssl/certs/casa-limbosolutions-com-certs
|
||||
while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"
|
||||
|
||||
services:
|
||||
nginx:
|
||||
build:
|
||||
context: ./docker
|
||||
pull_policy: build
|
||||
image: homesrv/nginx:latest
|
||||
volumes:
|
||||
- casa-limbosolutions-com-certs:/etc/ssl/certs/casa-limbosolutions-com-certs
|
||||
ports:
|
||||
- 443:443
|
||||
- 80:80
|
||||
networks:
|
||||
- public
|
||||
restart: unless-stopped
|
||||
command: /bin/sh -c '/run.sh'
|
||||
configs:
|
||||
- source: run-sh
|
||||
target: /run.sh
|
||||
mode: 0755
|
||||
volumes:
|
||||
nginx-conf.d:
|
||||
|
||||
casa-limbosolutions-com-certs:
|
||||
name: casa-limbosolutions-com-certs
|
||||
external: false
|
||||
|
||||
networks:
|
||||
public:
|
||||
name: reverseproxy_public
|
||||
external: true
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
FROM nginx:latest
|
||||
|
||||
COPY nginx.conf.d/* /etc/nginx/conf.d
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
map $http_upgrade $connection_upgrade {
|
||||
default upgrade;
|
||||
'' close;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name casa.limbosolutions.com *.casa.limbosolutions.com has.lan;
|
||||
return 301 https://has.casa.limbosolutions.com$request_uri;
|
||||
}
|
||||
|
||||
|
||||
server {
|
||||
|
||||
listen 443 ssl;
|
||||
ssl_certificate /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.crt;
|
||||
ssl_certificate_key /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
|
||||
location / {
|
||||
proxy_pass http://homeassistant-app:80;
|
||||
proxy_set_header Host $host;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
server {
|
||||
server_name lms.casa.limbosolutions.com music.casa.limbosolutions.com;
|
||||
listen 443 ssl;
|
||||
ssl_certificate /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.crt;
|
||||
ssl_certificate_key /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.key;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
ssl_ciphers HIGH:!aNULL:!MD5;
|
||||
|
||||
location / {
|
||||
set $upstream lms-lms-1;
|
||||
#docker default resolver
|
||||
resolver 127.0.0.11 ipv6=off;
|
||||
proxy_pass http://$upstream:9002;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Protocol $scheme;
|
||||
proxy_set_header X-Url-Scheme $scheme;
|
||||
|
||||
# WebSocket support
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name lms.casa.limbosolutions.com music.casa.limbosolutions.com lms.lan music.lan;
|
||||
return 301 https://lms.casa.limbosolutions.com$request_uri;
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
server {
|
||||
listen 80;
|
||||
proxy_buffering off;
|
||||
server_name zigbee2mqtt.lan;
|
||||
|
||||
location / {
|
||||
proxy_pass http://zigbee2mqtt:8080/;
|
||||
proxy_set_header Host $http_host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_set_header X-Forwarded-Protocol $scheme;
|
||||
proxy_set_header X-Url-Scheme $scheme;
|
||||
|
||||
# WebSocket support
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -1,11 +0,0 @@
|
||||
creation_rules:
|
||||
# encrypt all values from file
|
||||
- path_regex: \.private\.dec\.yaml$
|
||||
encrypted_regex: '^(.*)$'
|
||||
age:
|
||||
- age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
# encrypt secrets files
|
||||
- path_regex: .*.yaml
|
||||
encrypted_regex: ^(data|stringData)$
|
||||
age:
|
||||
- age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
|
||||
@@ -1,21 +0,0 @@
|
||||
# node-red
|
||||
|
||||
``` bash
|
||||
#npm install bcryptjs
|
||||
node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 8));" YOUR-PASSWORD
|
||||
```
|
||||
|
||||
## Setup
|
||||
|
||||
Using flux for reconciliation.
|
||||
|
||||
``` bash
|
||||
./ops-scripts/apply-flux.sh
|
||||
```
|
||||
|
||||
**Encrypt secrets:**
|
||||
|
||||
``` bash
|
||||
sops -e deploy/app/limbomox-ssh-secret.dec.yaml > deploy/app/limbomox-ssh-secret.yaml
|
||||
sops -e deploy/app/node-red-settings-secret.dec.yaml > deploy/app/node-red-settings-secret.yaml
|
||||
```
|
||||
@@ -1,49 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: node-red
|
||||
namespace: node-red
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: node-red
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: node-red
|
||||
spec:
|
||||
containers:
|
||||
- name: node-red
|
||||
### Maintained by flux - Image Update Automation
|
||||
image: nodered/node-red:latest@sha256:02a2b92a41b73d2bc388238b86e4fcaab7fb5466373adb24e1df6aa5845265ff # {"$imagepolicy": "node-red:node-red"}
|
||||
###
|
||||
imagePullPolicy: Always
|
||||
ports:
|
||||
- containerPort: 1880
|
||||
volumeMounts:
|
||||
- name: node-red-data
|
||||
mountPath: /data
|
||||
- name: node-red-settings
|
||||
mountPath: /data/settings.js
|
||||
subPath: settings.js
|
||||
- name: limbomox-ssh
|
||||
mountPath: /.keys/limbomox-ssh-node-red/id_ed25519
|
||||
subPath: id-ed25519
|
||||
resources:
|
||||
requests:
|
||||
memory: "128Mi"
|
||||
cpu: "100m"
|
||||
limits:
|
||||
memory: "256Mi"
|
||||
cpu: "500m"
|
||||
volumes:
|
||||
- name: node-red-data
|
||||
persistentVolumeClaim:
|
||||
claimName: node-red
|
||||
- name: node-red-settings
|
||||
secret:
|
||||
secretName: node-red-settings
|
||||
- name: limbomox-ssh
|
||||
secret:
|
||||
secretName: limbomox-ssh
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
kind: ImagePolicy
|
||||
metadata:
|
||||
name: node-red
|
||||
spec:
|
||||
imageRepositoryRef:
|
||||
name: node-red
|
||||
filterTags:
|
||||
pattern: '^latest$'
|
||||
policy:
|
||||
alphabetical: {}
|
||||
digestReflectionPolicy: Always
|
||||
interval: 24h
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
kind: ImageRepository
|
||||
metadata:
|
||||
name: node-red
|
||||
spec:
|
||||
image: nodered/node-red
|
||||
interval: 72h
|
||||
@@ -1,25 +0,0 @@
|
||||
apiVersion: image.toolkit.fluxcd.io/v1
|
||||
kind: ImageUpdateAutomation
|
||||
metadata:
|
||||
name: node-red
|
||||
spec:
|
||||
interval: 72h
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: casa
|
||||
namespace: casa-limbosolutions-com
|
||||
git:
|
||||
checkout:
|
||||
ref:
|
||||
branch: main
|
||||
commit:
|
||||
author:
|
||||
name: FluxCD
|
||||
email: flux@local
|
||||
messageTemplate: |
|
||||
Update node-red image.
|
||||
push:
|
||||
branch: main
|
||||
update:
|
||||
path: ./services/node-red/deploy/app/deployment.yaml
|
||||
strategy: Setters
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user