Compare commits
No commits in common. "12f6f42e13e5164436c0c4630a8e94c2a787fa8b" and "674a94e23e161ec59ae0d483403a8d3830530623" have entirely different histories.
12f6f42e13
...
674a94e23e
74 changed files with 247 additions and 8723 deletions
|
|
@ -6,11 +6,6 @@ metadata:
|
||||||
data:
|
data:
|
||||||
config.alloy: |-
|
config.alloy: |-
|
||||||
prometheus.exporter.unix "node" {
|
prometheus.exporter.unix "node" {
|
||||||
set_collectors = [
|
|
||||||
"cpu", "diskstats", "filesystem", "loadavg",
|
|
||||||
"meminfo", "netdev", "netstat", "os",
|
|
||||||
"pressure", "processes", "stat", "uname", "vmstat",
|
|
||||||
]
|
|
||||||
}
|
}
|
||||||
|
|
||||||
discovery.kubernetes "kubernetes_apiservers" {
|
discovery.kubernetes "kubernetes_apiservers" {
|
||||||
|
|
@ -146,11 +141,6 @@ data:
|
||||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||||
target_label = "node"
|
target_label = "node"
|
||||||
}
|
}
|
||||||
|
|
||||||
rule {
|
|
||||||
regex = "pod_template_hash|controller_revision_hash|deployment_kubernetes_io_revision"
|
|
||||||
action = "labeldrop"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
discovery.relabel "kubernetes_services" {
|
discovery.relabel "kubernetes_services" {
|
||||||
|
|
@ -259,11 +249,6 @@ data:
|
||||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||||
target_label = "node"
|
target_label = "node"
|
||||||
}
|
}
|
||||||
|
|
||||||
rule {
|
|
||||||
regex = "pod_template_hash|controller_revision_hash|deployment_kubernetes_io_revision"
|
|
||||||
action = "labeldrop"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
discovery.relabel "pod_logs" {
|
discovery.relabel "pod_logs" {
|
||||||
|
|
@ -313,11 +298,6 @@ data:
|
||||||
target_label = "__path__"
|
target_label = "__path__"
|
||||||
replacement = "/var/log/pods/*$1/*.log"
|
replacement = "/var/log/pods/*$1/*.log"
|
||||||
}
|
}
|
||||||
|
|
||||||
rule {
|
|
||||||
regex = "pod_template_hash|controller_revision_hash|deployment_kubernetes_io_revision"
|
|
||||||
action = "labeldrop"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
local.file_match "pod_logs" {
|
local.file_match "pod_logs" {
|
||||||
|
|
@ -372,19 +352,9 @@ data:
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
prometheus.relabel "cadvisor" {
|
|
||||||
forward_to = [prometheus.remote_write.default.receiver]
|
|
||||||
|
|
||||||
rule {
|
|
||||||
source_labels = ["__name__"]
|
|
||||||
regex = "container_(cpu_usage_seconds_total|memory_usage_bytes|memory_working_set_bytes|memory_rss|memory_cache|memory_swap|network_receive_bytes_total|network_transmit_bytes_total|network_receive_packets_total|network_transmit_packets_total|fs_reads_bytes_total|fs_writes_bytes_total|spec_cpu_quota|spec_cpu_period|spec_memory_limit_bytes|last_seen)"
|
|
||||||
action = "keep"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
prometheus.scrape "kubernetes_nodes_cadvisor" {
|
prometheus.scrape "kubernetes_nodes_cadvisor" {
|
||||||
targets = discovery.relabel.kubernetes_nodes_cadvisor.output
|
targets = discovery.relabel.kubernetes_nodes_cadvisor.output
|
||||||
forward_to = [prometheus.relabel.cadvisor.receiver]
|
forward_to = [prometheus.remote_write.default.receiver]
|
||||||
job_name = "kubernetes-nodes-cadvisor"
|
job_name = "kubernetes-nodes-cadvisor"
|
||||||
scheme = "https"
|
scheme = "https"
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- namespace.yaml
|
|
||||||
- secrets.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
|
||||||
- name: argo-workflows
|
|
||||||
repo: https://argoproj.github.io/argo-helm
|
|
||||||
namespace: argo-workflows
|
|
||||||
releaseName: argo-workflows
|
|
||||||
version: 1.0.14
|
|
||||||
valuesFile: values.yaml
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: argo-workflows
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: argo-workflows-sso
|
|
||||||
namespace: argo-workflows
|
|
||||||
spec:
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: argo-workflows-sso
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app.kubernetes.io/part-of: argo-workflows
|
|
||||||
data:
|
|
||||||
- secretKey: client-id
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/argo-workflows/authentik-sso
|
|
||||||
property: client-id
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
nullBytePolicy: Ignore
|
|
||||||
- secretKey: client-secret
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/argo-workflows/authentik-sso
|
|
||||||
property: client-secret
|
|
||||||
conversionStrategy: Default
|
|
||||||
decodingStrategy: None
|
|
||||||
metadataPolicy: None
|
|
||||||
nullBytePolicy: Ignore
|
|
||||||
|
|
@ -1,342 +0,0 @@
|
||||||
## Custom resource configuration
|
|
||||||
crds:
|
|
||||||
# -- Install and upgrade CRDs
|
|
||||||
install: true
|
|
||||||
# -- Keep CRDs on chart uninstall
|
|
||||||
keep: true
|
|
||||||
# -- Use full CRDs with complete OpenAPI schemas. When false, uses minified CRDs with x-kubernetes-preserve-unknown-fields.
|
|
||||||
# Full CRDs are very large and are installed via a pre-install/pre-upgrade hook Job that uses server-side apply.
|
|
||||||
full: true
|
|
||||||
|
|
||||||
# -- Create ClusterRoles that extend existing ClusterRoles to interact with Argo Workflows CRDs.
|
|
||||||
## Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
|
|
||||||
createAggregateRoles: true
|
|
||||||
|
|
||||||
# -- Restrict Argo to operate only in a single namespace (the namespace of the
|
|
||||||
# Helm release) by apply Roles and RoleBindings instead of the Cluster
|
|
||||||
# equivalents, and start workflow-controller with the --namespaced flag. Use it
|
|
||||||
# in clusters with strict access policy.
|
|
||||||
singleNamespace: false
|
|
||||||
|
|
||||||
workflow:
|
|
||||||
serviceAccount:
|
|
||||||
# -- Specifies whether a service account should be created
|
|
||||||
create: false
|
|
||||||
# -- Labels applied to created service account
|
|
||||||
labels: {}
|
|
||||||
# -- Annotations applied to created service account
|
|
||||||
annotations: {}
|
|
||||||
# -- Service account which is used to run workflows
|
|
||||||
name: "argo-workflow"
|
|
||||||
# -- Secrets with credentials to pull images from a private registry. Same format as `.Values.images.pullSecrets`
|
|
||||||
pullSecrets: []
|
|
||||||
rbac:
|
|
||||||
# -- Adds Role and RoleBinding for the above specified service account to be able to run workflows.
|
|
||||||
# A Role and Rolebinding pair is also created for each namespace in controller.workflowNamespaces (see below)
|
|
||||||
create: true
|
|
||||||
# -- Allows permissions for the Argo Agent. Only required if using http/plugin templates
|
|
||||||
agentPermissions: false
|
|
||||||
# -- Allows permissions for the Argo Artifact GC pod. Only required if using artifact gc
|
|
||||||
artifactGC: false
|
|
||||||
# -- Extra service accounts to be added to the RoleBinding
|
|
||||||
serviceAccounts: []
|
|
||||||
# - name: my-service-account
|
|
||||||
# namespace: my-namespace
|
|
||||||
# -- Additional rules for the service account that runs the workflows.
|
|
||||||
rules: []
|
|
||||||
|
|
||||||
controller:
|
|
||||||
rbac:
|
|
||||||
# -- Adds Role and RoleBinding for the controller.
|
|
||||||
create: true
|
|
||||||
# -- Allows controller to get, list, and watch certain k8s secrets
|
|
||||||
secretWhitelist: []
|
|
||||||
# -- Allows controller to get, list and watch all k8s secrets. Can only be used if secretWhitelist is empty.
|
|
||||||
accessAllSecrets: false
|
|
||||||
# -- Allows controller to create and update ConfigMaps. Enables memoization feature
|
|
||||||
writeConfigMaps: false
|
|
||||||
|
|
||||||
configMap:
|
|
||||||
# -- Create a ConfigMap for the controller
|
|
||||||
create: true
|
|
||||||
# -- ConfigMap name
|
|
||||||
name: ""
|
|
||||||
# -- ConfigMap annotations
|
|
||||||
annotations: {}
|
|
||||||
|
|
||||||
# -- enable Workflow Archive to store the status of workflows. Postgres and MySQL (>= 5.7.8) are available.
|
|
||||||
## Ref: https://argo-workflows.readthedocs.io/en/stable/workflow-archive/
|
|
||||||
persistence: {}
|
|
||||||
# connectionPool:
|
|
||||||
# maxIdleConns: 100
|
|
||||||
# maxOpenConns: 0
|
|
||||||
# # save the entire workflow into etcd and DB
|
|
||||||
# nodeStatusOffLoad: false
|
|
||||||
# # enable archiving of old workflows
|
|
||||||
# archive: false
|
|
||||||
# postgresql:
|
|
||||||
# host: localhost
|
|
||||||
# port: 5432
|
|
||||||
# database: postgres
|
|
||||||
# tableName: argo_workflows
|
|
||||||
# # the database secrets must be in the same namespace of the controller
|
|
||||||
# userNameSecret:
|
|
||||||
# name: argo-postgres-config
|
|
||||||
# key: username
|
|
||||||
# passwordSecret:
|
|
||||||
# name: argo-postgres-config
|
|
||||||
# key: password
|
|
||||||
# ssl: true
|
|
||||||
# # sslMode must be one of: disable, require, verify-ca, verify-full
|
|
||||||
# # you can find more information about those ssl options here: https://godoc.org/github.com/lib/pq
|
|
||||||
# sslMode: require
|
|
||||||
# mysql:
|
|
||||||
# host: localhost
|
|
||||||
# port: 3306
|
|
||||||
# database: argo
|
|
||||||
# tableName: argo_workflows
|
|
||||||
# userNameSecret:
|
|
||||||
# name: argo-mysql-config
|
|
||||||
# key: username
|
|
||||||
# passwordSecret:
|
|
||||||
# name: argo-mysql-config
|
|
||||||
# key: password
|
|
||||||
|
|
||||||
# -- Default values that will apply to all Workflows from this controller, unless overridden on the Workflow-level.
|
|
||||||
# Only valid for 2.7+
|
|
||||||
## See more: https://argo-workflows.readthedocs.io/en/stable/default-workflow-specs/
|
|
||||||
workflowDefaults: {}
|
|
||||||
# spec:
|
|
||||||
# ttlStrategy:
|
|
||||||
# secondsAfterCompletion: 86400
|
|
||||||
# # Ref: https://argo-workflows.readthedocs.io/en/stable/artifact-repository-ref/
|
|
||||||
# artifactRepositoryRef:
|
|
||||||
# configMap: my-artifact-repository # default is "artifact-repositories"
|
|
||||||
# key: v2-s3-artifact-repository # default can be set by the `workflows.argoproj.io/default-artifact-repository` annotation in config map.
|
|
||||||
|
|
||||||
serviceAccount:
|
|
||||||
# -- Create a service account for the controller
|
|
||||||
create: true
|
|
||||||
# -- Service account name
|
|
||||||
name: ""
|
|
||||||
# -- Labels applied to created service account
|
|
||||||
labels: {}
|
|
||||||
# -- Annotations applied to created service account
|
|
||||||
annotations: {}
|
|
||||||
|
|
||||||
# -- Workflow controller name string
|
|
||||||
name: workflow-controller
|
|
||||||
|
|
||||||
# -- Specify all namespaces where this workflow controller instance will manage
|
|
||||||
# workflows. This controls where the service account and RBAC resources will
|
|
||||||
# be created. Only valid when singleNamespace is false.
|
|
||||||
workflowNamespaces:
|
|
||||||
- default
|
|
||||||
|
|
||||||
logging:
|
|
||||||
# -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
|
|
||||||
level: info
|
|
||||||
# -- Set the glog logging level
|
|
||||||
globallevel: "0"
|
|
||||||
# -- Set the logging format (one of: `text`, `json`)
|
|
||||||
format: "text"
|
|
||||||
|
|
||||||
server:
|
|
||||||
# -- Deploy the Argo Server
|
|
||||||
enabled: true
|
|
||||||
# -- Value for base href in index.html. Used if the server is running behind reverse proxy under subpath different from /.
|
|
||||||
## only updates base url of resources on client side,
|
|
||||||
## it's expected that a proxy server rewrites the request URL and gets rid of this prefix
|
|
||||||
## https://github.com/argoproj/argo-workflows/issues/716#issuecomment-433213190
|
|
||||||
baseHref: /
|
|
||||||
image:
|
|
||||||
# -- Registry to use for the server
|
|
||||||
registry: quay.io
|
|
||||||
# -- Repository to use for the server
|
|
||||||
repository: argoproj/argocli
|
|
||||||
rbac:
|
|
||||||
# -- Adds Role and RoleBinding for the server.
|
|
||||||
create: true
|
|
||||||
# -- Servers container-level security context
|
|
||||||
serviceAccount:
|
|
||||||
# -- Create a service account for the server
|
|
||||||
create: true
|
|
||||||
# -- Service account name
|
|
||||||
name: ""
|
|
||||||
# -- Labels applied to created service account
|
|
||||||
labels: {}
|
|
||||||
# -- Annotations applied to created service account
|
|
||||||
annotations: {}
|
|
||||||
|
|
||||||
# -- A list of supported authentication modes. Available values are `server`, `client`, or `sso`. If you provide sso, please configure `.Values.server.sso` as well.
|
|
||||||
## Ref: https://argo-workflows.readthedocs.io/en/stable/argo-server-auth-mode/
|
|
||||||
authModes:
|
|
||||||
- sso
|
|
||||||
|
|
||||||
## Ingress configuration.
|
|
||||||
# ref: https://kubernetes.io/docs/concepts/services-networking/ingress/
|
|
||||||
ingress:
|
|
||||||
# -- Enable an ingress resource
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
# Gateway API HTTPRoute configuration
|
|
||||||
# NOTE: Gateway API support is in EXPERIMENTAL status
|
|
||||||
# Support depends on your Gateway controller implementation
|
|
||||||
# Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends)
|
|
||||||
# Refer to https://gateway-api.sigs.k8s.io/implementations/ for controller-specific details
|
|
||||||
httproute:
|
|
||||||
# -- Enable HTTPRoute resource for Argo Workflows server (Gateway API)
|
|
||||||
enabled: true
|
|
||||||
# -- Additional HTTPRoute labels
|
|
||||||
labels: {}
|
|
||||||
# -- Additional HTTPRoute annotations
|
|
||||||
annotations: {}
|
|
||||||
# -- Gateway API parentRefs for the HTTPRoute
|
|
||||||
## Must reference an existing Gateway
|
|
||||||
# @default -- `[]` (See [values.yaml])
|
|
||||||
parentRefs:
|
|
||||||
- group: gateway.networking.k8s.io
|
|
||||||
kind: Gateway
|
|
||||||
name: internal
|
|
||||||
namespace: kube-system
|
|
||||||
sectionName: https
|
|
||||||
# -- List of hostnames for the HTTPRoute
|
|
||||||
# @default -- `[]` (See [values.yaml])
|
|
||||||
hostnames:
|
|
||||||
- "workflows.peterg.nl"
|
|
||||||
# @default -- `[]` (See [values.yaml])
|
|
||||||
rules:
|
|
||||||
- matches:
|
|
||||||
- path:
|
|
||||||
type: PathPrefix
|
|
||||||
value: /
|
|
||||||
# filters: []
|
|
||||||
# - type: RequestHeaderModifier
|
|
||||||
# requestHeaderModifier:
|
|
||||||
# add:
|
|
||||||
# - name: X-Custom-Header
|
|
||||||
# value: custom-value
|
|
||||||
|
|
||||||
# Gateway API BackendTLSPolicy configuration
|
|
||||||
# NOTE: BackendTLSPolicy support is in EXPERIMENTAL status
|
|
||||||
# Required for HTTPS backends when using Gateway API
|
|
||||||
# Not all Gateway controllers support this resource (e.g., Cilium does not support it yet)
|
|
||||||
backendTLSPolicy:
|
|
||||||
# -- Enable BackendTLSPolicy resource for Argo Workflows server (Gateway API)
|
|
||||||
enabled: false
|
|
||||||
# -- Additional BackendTLSPolicy labels
|
|
||||||
labels: {}
|
|
||||||
# -- Additional BackendTLSPolicy annotations
|
|
||||||
annotations: {}
|
|
||||||
# -- Target references for the BackendTLSPolicy
|
|
||||||
# @default -- `[]` (See [values.yaml])
|
|
||||||
targetRefs: []
|
|
||||||
# - group: ""
|
|
||||||
# kind: Service
|
|
||||||
# name: argo-workflows-server
|
|
||||||
# sectionName: https
|
|
||||||
# -- TLS validation configuration
|
|
||||||
# @default -- `{}` (See [values.yaml])
|
|
||||||
validation: {}
|
|
||||||
# hostname: argo-workflows-server.argo.svc.cluster.local
|
|
||||||
# caCertificateRefs:
|
|
||||||
# - name: example-ca-cert
|
|
||||||
# group: ""
|
|
||||||
# kind: ConfigMap
|
|
||||||
# wellKnownCACertificates: System
|
|
||||||
|
|
||||||
clusterWorkflowTemplates:
|
|
||||||
# -- Create a ClusterRole and CRB for the server to access ClusterWorkflowTemplates.
|
|
||||||
enabled: true
|
|
||||||
# -- Give the server permissions to edit ClusterWorkflowTemplates.
|
|
||||||
enableEditing: true
|
|
||||||
|
|
||||||
# SSO configuration when SSO is specified as a server auth mode.
|
|
||||||
sso:
|
|
||||||
enabled: true
|
|
||||||
issuer: https://auth.peterg.nl/application/o/argo-workflows/
|
|
||||||
clientId:
|
|
||||||
name: argo-workflows-sso
|
|
||||||
key: client-id
|
|
||||||
clientSecret:
|
|
||||||
name: argo-workflows-sso
|
|
||||||
key: client-secret
|
|
||||||
redirectUrl: https://workflows.peterg.nl/oauth2/callback
|
|
||||||
scopes:
|
|
||||||
- groups
|
|
||||||
rbac:
|
|
||||||
enabled: true
|
|
||||||
|
|
||||||
# -- Array of extra K8s manifests to deploy
|
|
||||||
extraObjects:
|
|
||||||
- apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: admin-user
|
|
||||||
namespace: argo-workflows
|
|
||||||
annotations:
|
|
||||||
workflows.argoproj.io/rbac-rule: "'ArgoCD Admins' in groups"
|
|
||||||
workflows.argoproj.io/rbac-rule-precedence: "1"
|
|
||||||
- apiVersion: v1
|
|
||||||
kind: ServiceAccount
|
|
||||||
metadata:
|
|
||||||
name: read-only
|
|
||||||
namespace: argo-workflows
|
|
||||||
annotations:
|
|
||||||
workflows.argoproj.io/rbac-rule: "true"
|
|
||||||
workflows.argoproj.io/rbac-rule-precedence: "0"
|
|
||||||
- apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: argo-workflows-admin-user
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: admin-user
|
|
||||||
namespace: argo-workflows
|
|
||||||
roleRef:
|
|
||||||
kind: ClusterRole
|
|
||||||
name: argo-workflows-admin
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
- apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: ClusterRoleBinding
|
|
||||||
metadata:
|
|
||||||
name: argo-workflows-read-only
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: read-only
|
|
||||||
namespace: argo-workflows
|
|
||||||
roleRef:
|
|
||||||
kind: ClusterRole
|
|
||||||
name: argo-workflows-view
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
- apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: Role
|
|
||||||
metadata:
|
|
||||||
name: argo-workflows-server-sso
|
|
||||||
namespace: argo-workflows
|
|
||||||
rules:
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- serviceaccounts
|
|
||||||
verbs:
|
|
||||||
- get
|
|
||||||
- apiGroups:
|
|
||||||
- ""
|
|
||||||
resources:
|
|
||||||
- serviceaccounts/token
|
|
||||||
verbs:
|
|
||||||
- create
|
|
||||||
- apiVersion: rbac.authorization.k8s.io/v1
|
|
||||||
kind: RoleBinding
|
|
||||||
metadata:
|
|
||||||
name: argo-workflows-server-sso
|
|
||||||
namespace: argo-workflows
|
|
||||||
subjects:
|
|
||||||
- kind: ServiceAccount
|
|
||||||
name: argo-workflows-server
|
|
||||||
namespace: argo-workflows
|
|
||||||
roleRef:
|
|
||||||
kind: Role
|
|
||||||
name: argo-workflows-server-sso
|
|
||||||
apiGroup: rbac.authorization.k8s.io
|
|
||||||
|
|
@ -17,8 +17,6 @@ spec:
|
||||||
automated:
|
automated:
|
||||||
prune: true
|
prune: true
|
||||||
selfHeal: true
|
selfHeal: true
|
||||||
syncOptions:
|
|
||||||
- ServerSideApply=true
|
|
||||||
---
|
---
|
||||||
apiVersion: argoproj.io/v1alpha1
|
apiVersion: argoproj.io/v1alpha1
|
||||||
kind: Application
|
kind: Application
|
||||||
|
|
@ -80,68 +78,3 @@ spec:
|
||||||
selfHeal: true
|
selfHeal: true
|
||||||
syncOptions:
|
syncOptions:
|
||||||
- ServerSideApply=true
|
- ServerSideApply=true
|
||||||
---
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: metrics-server-peterg
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: https://kubernetes-sigs.github.io/metrics-server
|
|
||||||
targetRevision: 3.13.0
|
|
||||||
chart: metrics-server
|
|
||||||
helm:
|
|
||||||
releaseName: metrics-server
|
|
||||||
values: |
|
|
||||||
args:
|
|
||||||
- --kubelet-insecure-tls=true
|
|
||||||
- --kubelet-preferred-address-types=InternalIP
|
|
||||||
destination:
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
namespace: kube-system
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
---
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: argo-workflows
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: https://code.peterg.nl/wheatley/kubernetes.git
|
|
||||||
path: k8s-peterg/argo-workflows
|
|
||||||
targetRevision: HEAD
|
|
||||||
destination:
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
namespace: argo-workflows
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
syncOptions:
|
|
||||||
- ServerSideApply=true
|
|
||||||
---
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: renovate-operator
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: https://code.peterg.nl/wheatley/kubernetes.git
|
|
||||||
path: k8s-peterg/renovate-operator
|
|
||||||
targetRevision: HEAD
|
|
||||||
destination:
|
|
||||||
server: https://kubernetes.default.svc
|
|
||||||
namespace: renovate-operator
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
|
|
|
||||||
|
|
@ -80,31 +80,6 @@ spec:
|
||||||
selfHeal: true
|
selfHeal: true
|
||||||
syncOptions:
|
syncOptions:
|
||||||
- ServerSideApply=true
|
- ServerSideApply=true
|
||||||
---
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: metrics-server-wheatley
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: https://kubernetes-sigs.github.io/metrics-server
|
|
||||||
targetRevision: 3.13.0
|
|
||||||
chart: metrics-server
|
|
||||||
helm:
|
|
||||||
releaseName: metrics-server
|
|
||||||
values: |
|
|
||||||
args:
|
|
||||||
- --kubelet-insecure-tls=true
|
|
||||||
- --kubelet-preferred-address-types=InternalIP
|
|
||||||
destination:
|
|
||||||
server: https://10.13.37.10:6443
|
|
||||||
namespace: kube-system
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
|
|
||||||
---
|
---
|
||||||
apiVersion: argoproj.io/v1alpha1
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
|
@ -168,25 +143,6 @@ spec:
|
||||||
---
|
---
|
||||||
apiVersion: argoproj.io/v1alpha1
|
apiVersion: argoproj.io/v1alpha1
|
||||||
kind: Application
|
kind: Application
|
||||||
metadata:
|
|
||||||
name: lidarr
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: https://code.peterg.nl/wheatley/kubernetes.git
|
|
||||||
path: k8s-wheatley/lidarr
|
|
||||||
targetRevision: HEAD
|
|
||||||
destination:
|
|
||||||
server: https://10.13.37.10:6443
|
|
||||||
namespace: lidarr
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
---
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
metadata:
|
||||||
name: prowlarr
|
name: prowlarr
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
|
|
@ -225,25 +181,6 @@ spec:
|
||||||
---
|
---
|
||||||
apiVersion: argoproj.io/v1alpha1
|
apiVersion: argoproj.io/v1alpha1
|
||||||
kind: Application
|
kind: Application
|
||||||
metadata:
|
|
||||||
name: soulseekd
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: https://code.peterg.nl/wheatley/kubernetes.git
|
|
||||||
path: k8s-wheatley/soulseekd
|
|
||||||
targetRevision: HEAD
|
|
||||||
destination:
|
|
||||||
server: https://10.13.37.10:6443
|
|
||||||
namespace: soulseekd
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
---
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
metadata:
|
||||||
name: plex
|
name: plex
|
||||||
namespace: argocd
|
namespace: argocd
|
||||||
|
|
@ -260,22 +197,3 @@ spec:
|
||||||
automated:
|
automated:
|
||||||
prune: true
|
prune: true
|
||||||
selfHeal: true
|
selfHeal: true
|
||||||
---
|
|
||||||
apiVersion: argoproj.io/v1alpha1
|
|
||||||
kind: Application
|
|
||||||
metadata:
|
|
||||||
name: romm
|
|
||||||
namespace: argocd
|
|
||||||
spec:
|
|
||||||
project: default
|
|
||||||
source:
|
|
||||||
repoURL: https://code.peterg.nl/wheatley/kubernetes.git
|
|
||||||
path: k8s-wheatley/romm
|
|
||||||
targetRevision: HEAD
|
|
||||||
destination:
|
|
||||||
server: https://10.13.37.10:6443
|
|
||||||
namespace: romm
|
|
||||||
syncPolicy:
|
|
||||||
automated:
|
|
||||||
prune: true
|
|
||||||
selfHeal: true
|
|
||||||
|
|
|
||||||
File diff suppressed because it is too large
Load diff
|
|
@ -27,7 +27,6 @@ spec:
|
||||||
conversionStrategy: Default
|
conversionStrategy: Default
|
||||||
decodingStrategy: None
|
decodingStrategy: None
|
||||||
metadataPolicy: None
|
metadataPolicy: None
|
||||||
nullBytePolicy: Ignore
|
|
||||||
- secretKey: key
|
- secretKey: key
|
||||||
remoteRef:
|
remoteRef:
|
||||||
key: secrets/provisioned/tls-wildcard-peterg-nl
|
key: secrets/provisioned/tls-wildcard-peterg-nl
|
||||||
|
|
@ -35,4 +34,3 @@ spec:
|
||||||
conversionStrategy: Default
|
conversionStrategy: Default
|
||||||
decodingStrategy: None
|
decodingStrategy: None
|
||||||
metadataPolicy: None
|
metadataPolicy: None
|
||||||
nullBytePolicy: Ignore
|
|
||||||
|
|
|
||||||
|
|
@ -12,4 +12,4 @@ helmCharts:
|
||||||
repo: https://charts.external-secrets.io
|
repo: https://charts.external-secrets.io
|
||||||
namespace: external-secrets
|
namespace: external-secrets
|
||||||
releaseName: external-secrets
|
releaseName: external-secrets
|
||||||
version: 2.5.0
|
version: 2.1.0
|
||||||
|
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: renovate-config
|
|
||||||
namespace: renovate-operator
|
|
||||||
data:
|
|
||||||
config.js: |-
|
|
||||||
module.exports = {
|
|
||||||
platform: 'forgejo',
|
|
||||||
endpoint: 'https://code.peterg.nl/api/v1/',
|
|
||||||
gitAuthor: 'Renovate <renovate@peterg.nl>',
|
|
||||||
username: 'renovate',
|
|
||||||
onboardingConfig: {
|
|
||||||
$schema: 'https://docs.renovatebot.com/renovate-schema.json',
|
|
||||||
extends: ['config:recommended'],
|
|
||||||
},
|
|
||||||
optimizeForDisabled: true,
|
|
||||||
persistRepoData: true,
|
|
||||||
};
|
|
||||||
|
|
@ -1,19 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
namespace: renovate-operator
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- configmap.yaml
|
|
||||||
- namespace.yaml
|
|
||||||
- policies.yaml
|
|
||||||
- renovate-job.yaml
|
|
||||||
- secrets.yaml
|
|
||||||
|
|
||||||
helmCharts:
|
|
||||||
- name: renovate-operator
|
|
||||||
repo: https://helm.mogenius.com/public
|
|
||||||
namespace: renovate-operator
|
|
||||||
releaseName: renovate-operator
|
|
||||||
version: "4.8.1"
|
|
||||||
valuesFile: values.yaml
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: renovate-operator
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
---
|
|
||||||
kind: NetworkPolicy
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
metadata:
|
|
||||||
name: allow-internet-only
|
|
||||||
spec:
|
|
||||||
podSelector: {}
|
|
||||||
policyTypes:
|
|
||||||
- Egress
|
|
||||||
egress:
|
|
||||||
- to:
|
|
||||||
- ipBlock:
|
|
||||||
cidr: 0.0.0.0/0
|
|
||||||
except:
|
|
||||||
- 10.0.0.0/8
|
|
||||||
- 192.168.0.0/16
|
|
||||||
- 172.16.0.0/12
|
|
||||||
---
|
|
||||||
apiVersion: networking.k8s.io/v1
|
|
||||||
kind: NetworkPolicy
|
|
||||||
metadata:
|
|
||||||
name: kubernetes-egress
|
|
||||||
spec:
|
|
||||||
podSelector: {}
|
|
||||||
policyTypes:
|
|
||||||
- Egress
|
|
||||||
egress:
|
|
||||||
- to:
|
|
||||||
- namespaceSelector:
|
|
||||||
matchLabels:
|
|
||||||
kubernetes.io/metadata.name: kube-system
|
|
||||||
- podSelector:
|
|
||||||
matchLabels:
|
|
||||||
k8s-app: kube-apiserver
|
|
||||||
- ports:
|
|
||||||
- protocol: TCP
|
|
||||||
port: 6443
|
|
||||||
|
|
@ -1,27 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: renovate-operator.mogenius.com/v1alpha1
|
|
||||||
kind: RenovateJob
|
|
||||||
metadata:
|
|
||||||
name: renovate
|
|
||||||
namespace: renovate-operator
|
|
||||||
spec:
|
|
||||||
schedule: "0 * * * *"
|
|
||||||
provider:
|
|
||||||
name: forgejo
|
|
||||||
endpoint: https://code.peterg.nl/api/v1/
|
|
||||||
image: ghcr.io/renovatebot/renovate:43.161.0
|
|
||||||
secretRef: renovate-operator-secrets
|
|
||||||
parallelism: 1
|
|
||||||
skipForks: true
|
|
||||||
extraVolumes:
|
|
||||||
- name: renovate-config
|
|
||||||
configMap:
|
|
||||||
name: renovate-config
|
|
||||||
extraVolumeMounts:
|
|
||||||
- name: renovate-config
|
|
||||||
mountPath: /config
|
|
||||||
extraEnv:
|
|
||||||
- name: LOG_LEVEL
|
|
||||||
value: debug
|
|
||||||
- name: RENOVATE_CONFIG_FILE
|
|
||||||
value: /config/config.js
|
|
||||||
|
|
@ -1,22 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: renovate-operator-secrets
|
|
||||||
namespace: renovate-operator
|
|
||||||
spec:
|
|
||||||
refreshInterval: "15s"
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: renovate-operator-secrets
|
|
||||||
data:
|
|
||||||
- secretKey: RENOVATE_TOKEN
|
|
||||||
remoteRef:
|
|
||||||
key: /secrets/managed/renovate/token
|
|
||||||
property: RENOVATE_TOKEN
|
|
||||||
- secretKey: GITHUB_COM_TOKEN
|
|
||||||
remoteRef:
|
|
||||||
key: /secrets/managed/renovate/token
|
|
||||||
property: GITHUB_COM_TOKEN
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
fullnameOverride: "renovate-operator"
|
|
||||||
metrics:
|
|
||||||
enabled: true
|
|
||||||
serviceMonitor:
|
|
||||||
enabled: false
|
|
||||||
|
|
||||||
crd:
|
|
||||||
install: true
|
|
||||||
mode: template
|
|
||||||
|
|
||||||
rbac:
|
|
||||||
ownNamespaceOnly: true
|
|
||||||
|
|
||||||
route:
|
|
||||||
enabled: true
|
|
||||||
hostnames:
|
|
||||||
parentRefs:
|
|
||||||
- name: internal
|
|
||||||
namespace: kube-system
|
|
||||||
sectionName: https
|
|
||||||
|
|
@ -5,13 +5,7 @@ metadata:
|
||||||
name: alloy-config
|
name: alloy-config
|
||||||
data:
|
data:
|
||||||
config.alloy: |-
|
config.alloy: |-
|
||||||
prometheus.exporter.unix "node" {
|
prometheus.exporter.unix "node" {}
|
||||||
set_collectors = [
|
|
||||||
"cpu", "diskstats", "filesystem", "loadavg",
|
|
||||||
"meminfo", "netdev", "netstat", "os",
|
|
||||||
"pressure", "processes", "stat", "uname", "vmstat",
|
|
||||||
]
|
|
||||||
}
|
|
||||||
|
|
||||||
discovery.kubernetes "kubernetes_apiservers" {
|
discovery.kubernetes "kubernetes_apiservers" {
|
||||||
role = "endpoints"
|
role = "endpoints"
|
||||||
|
|
@ -158,11 +152,6 @@ data:
|
||||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||||
target_label = "node"
|
target_label = "node"
|
||||||
}
|
}
|
||||||
|
|
||||||
rule {
|
|
||||||
regex = "pod_template_hash|controller_revision_hash|deployment_kubernetes_io_revision"
|
|
||||||
action = "labeldrop"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
discovery.relabel "kubernetes_services" {
|
discovery.relabel "kubernetes_services" {
|
||||||
|
|
@ -271,11 +260,6 @@ data:
|
||||||
source_labels = ["__meta_kubernetes_pod_node_name"]
|
source_labels = ["__meta_kubernetes_pod_node_name"]
|
||||||
target_label = "node"
|
target_label = "node"
|
||||||
}
|
}
|
||||||
|
|
||||||
rule {
|
|
||||||
regex = "pod_template_hash|controller_revision_hash|deployment_kubernetes_io_revision"
|
|
||||||
action = "labeldrop"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
discovery.relabel "pod_logs" {
|
discovery.relabel "pod_logs" {
|
||||||
|
|
@ -325,11 +309,6 @@ data:
|
||||||
target_label = "__path__"
|
target_label = "__path__"
|
||||||
replacement = "/var/log/pods/*$1/*.log"
|
replacement = "/var/log/pods/*$1/*.log"
|
||||||
}
|
}
|
||||||
|
|
||||||
rule {
|
|
||||||
regex = "pod_template_hash|controller_revision_hash|deployment_kubernetes_io_revision"
|
|
||||||
action = "labeldrop"
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
local.file_match "pod_logs" {
|
local.file_match "pod_logs" {
|
||||||
|
|
@ -390,19 +369,9 @@ data:
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
prometheus.relabel "cadvisor" {
|
|
||||||
forward_to = [prometheus.remote_write.default.receiver]
|
|
||||||
|
|
||||||
rule {
|
|
||||||
source_labels = ["__name__"]
|
|
||||||
regex = "container_(cpu_usage_seconds_total|memory_usage_bytes|memory_working_set_bytes|memory_rss|memory_cache|memory_swap|network_receive_bytes_total|network_transmit_bytes_total|network_receive_packets_total|network_transmit_packets_total|fs_reads_bytes_total|fs_writes_bytes_total|spec_cpu_quota|spec_cpu_period|spec_memory_limit_bytes|last_seen)"
|
|
||||||
action = "keep"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
prometheus.scrape "kubernetes_nodes_cadvisor" {
|
prometheus.scrape "kubernetes_nodes_cadvisor" {
|
||||||
targets = discovery.relabel.kubernetes_nodes_cadvisor.output
|
targets = discovery.relabel.kubernetes_nodes_cadvisor.output
|
||||||
forward_to = [prometheus.relabel.cadvisor.receiver]
|
forward_to = [prometheus.remote_write.default.receiver]
|
||||||
job_name = "kubernetes-nodes-cadvisor"
|
job_name = "kubernetes-nodes-cadvisor"
|
||||||
scheme = "https"
|
scheme = "https"
|
||||||
clustering {
|
clustering {
|
||||||
|
|
|
||||||
|
|
@ -11,5 +11,5 @@ helmCharts:
|
||||||
repo: https://cloudnative-pg.github.io/charts
|
repo: https://cloudnative-pg.github.io/charts
|
||||||
namespace: cnpg-system
|
namespace: cnpg-system
|
||||||
releaseName: cloudnative-pg
|
releaseName: cloudnative-pg
|
||||||
version: 0.28.2
|
version: 0.27.1
|
||||||
valuesFile: values.yaml
|
valuesFile: values.yaml
|
||||||
|
|
|
||||||
|
|
@ -27,7 +27,6 @@ spec:
|
||||||
conversionStrategy: Default
|
conversionStrategy: Default
|
||||||
decodingStrategy: None
|
decodingStrategy: None
|
||||||
metadataPolicy: None
|
metadataPolicy: None
|
||||||
nullBytePolicy: Ignore
|
|
||||||
- secretKey: key
|
- secretKey: key
|
||||||
remoteRef:
|
remoteRef:
|
||||||
key: secrets/provisioned/tls-wildcard-wheatley-in
|
key: secrets/provisioned/tls-wildcard-wheatley-in
|
||||||
|
|
@ -35,4 +34,3 @@ spec:
|
||||||
conversionStrategy: Default
|
conversionStrategy: Default
|
||||||
decodingStrategy: None
|
decodingStrategy: None
|
||||||
metadataPolicy: None
|
metadataPolicy: None
|
||||||
nullBytePolicy: Ignore
|
|
||||||
|
|
|
||||||
|
|
@ -12,4 +12,4 @@ helmCharts:
|
||||||
repo: https://charts.external-secrets.io
|
repo: https://charts.external-secrets.io
|
||||||
namespace: external-secrets
|
namespace: external-secrets
|
||||||
releaseName: external-secrets
|
releaseName: external-secrets
|
||||||
version: 2.5.0
|
version: 2.1.0
|
||||||
|
|
|
||||||
|
|
@ -1,9 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: lidarr-envs
|
|
||||||
data:
|
|
||||||
PUID: "1000"
|
|
||||||
PGID: "1000"
|
|
||||||
TZ: Europe/Amsterdam
|
|
||||||
|
|
@ -1,55 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: lidarr
|
|
||||||
labels:
|
|
||||||
app: lidarr
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
serviceName: lidarr
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: lidarr
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: lidarr
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- name: lidarr
|
|
||||||
image: linuxserver/lidarr
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
ports:
|
|
||||||
- containerPort: 8686
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: lidarr-envs
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /config
|
|
||||||
name: lidarr-config
|
|
||||||
- mountPath: /shared/media/music
|
|
||||||
name: nfs-media-music
|
|
||||||
- mountPath: /shared/media/downloads
|
|
||||||
name: nfs-media-downloads
|
|
||||||
securityContext:
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
add:
|
|
||||||
- "CHOWN"
|
|
||||||
- "SETUID"
|
|
||||||
- "SETGID"
|
|
||||||
volumes:
|
|
||||||
- name: lidarr-config
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: lidarr-storage
|
|
||||||
- name: nfs-media-music
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-music
|
|
||||||
- name: nfs-media-downloads
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-downloads
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
name: lidarr-route
|
|
||||||
spec:
|
|
||||||
parentRefs:
|
|
||||||
- name: internal
|
|
||||||
namespace: kube-system
|
|
||||||
sectionName: https
|
|
||||||
hostnames:
|
|
||||||
- "lidarr.wheatley.in"
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: lidarr
|
|
||||||
port: 80
|
|
||||||
|
|
@ -1,50 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
namespace: lidarr
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- configmap.yaml
|
|
||||||
- deployments.yaml
|
|
||||||
- ingress.yaml
|
|
||||||
- pvc.yaml
|
|
||||||
- services.yaml
|
|
||||||
- namespace.yaml
|
|
||||||
|
|
||||||
components:
|
|
||||||
- ../../kustomize-bases/nfs-media/components/music
|
|
||||||
- ../../kustomize-bases/nfs-media/components/downloads
|
|
||||||
|
|
||||||
patches:
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-music
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-lidarr-music
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-music
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-lidarr-music
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-lidarr-downloads
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-lidarr-downloads
|
|
||||||
|
|
||||||
images:
|
|
||||||
- name: linuxserver/lidarr
|
|
||||||
newTag: 3.1.3-nightly@sha256:1e6019d60c5f16e73d4656a1d97d1f6ec48c8389695c0670a845fe8932b106a2
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: lidarr
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: lidarr-storage
|
|
||||||
spec:
|
|
||||||
storageClassName: piraeus-lvmthin
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 10Gi
|
|
||||||
|
|
@ -28,14 +28,8 @@ spec:
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /config
|
- mountPath: /config
|
||||||
name: plex-config
|
name: plex-config
|
||||||
- mountPath: /data/movies
|
- mountPath: /data
|
||||||
name: nfs-media-movies
|
name: nfs-media
|
||||||
- mountPath: /data/series
|
|
||||||
name: nfs-media-series
|
|
||||||
- mountPath: /data/anime
|
|
||||||
name: nfs-media-anime
|
|
||||||
- mountPath: /data/music
|
|
||||||
name: nfs-media-music
|
|
||||||
securityContext:
|
securityContext:
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: RuntimeDefault
|
type: RuntimeDefault
|
||||||
|
|
@ -51,15 +45,6 @@ spec:
|
||||||
- name: plex-config
|
- name: plex-config
|
||||||
persistentVolumeClaim:
|
persistentVolumeClaim:
|
||||||
claimName: plex-storage
|
claimName: plex-storage
|
||||||
- name: nfs-media-movies
|
- name: nfs-media
|
||||||
persistentVolumeClaim:
|
persistentVolumeClaim:
|
||||||
claimName: nfs-media-movies
|
claimName: nfs-media
|
||||||
- name: nfs-media-series
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-series
|
|
||||||
- name: nfs-media-anime
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-anime
|
|
||||||
- name: nfs-media-music
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-music
|
|
||||||
|
|
|
||||||
|
|
@ -12,94 +12,6 @@ resources:
|
||||||
- services.yaml
|
- services.yaml
|
||||||
- namespace.yaml
|
- namespace.yaml
|
||||||
|
|
||||||
components:
|
|
||||||
- ../../kustomize-bases/nfs-media/components/movies
|
|
||||||
- ../../kustomize-bases/nfs-media/components/series
|
|
||||||
- ../../kustomize-bases/nfs-media/components/anime
|
|
||||||
- ../../kustomize-bases/nfs-media/components/music
|
|
||||||
|
|
||||||
patches:
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-movies
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-plex-movies
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-movies
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-plex-movies
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-series
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-plex-series
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-series
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-plex-series
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-anime
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-plex-anime
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-anime
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-plex-anime
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-music
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-plex-music
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-music
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-plex-music
|
|
||||||
- op: replace
|
|
||||||
path: /spec/accessModes/0
|
|
||||||
value: ReadOnlyMany
|
|
||||||
|
|
||||||
images:
|
images:
|
||||||
- name: plexinc/pms-docker
|
- name: plexinc/pms-docker
|
||||||
newTag: 1.43.2.10687-563d026ea@sha256:c37106c57fed7a6624f5dee5a3ce460ff011f09a2aa7f4ee9e8dbbd08ae1b87e
|
newTag: 1.43.0.10492-121068a07@sha256:1131c4cd21fa22f8196f749f1dbb69af306776c3c83c7f5b061e51dc49bcff7f
|
||||||
|
|
|
||||||
|
|
@ -10,3 +10,36 @@ spec:
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: 20Gi
|
storage: 20Gi
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: nfs-media
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadOnlyMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 40Ti
|
||||||
|
volumeName: nfs-media-plex
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: nfs-media-plex
|
||||||
|
spec:
|
||||||
|
capacity:
|
||||||
|
storage: 40Ti
|
||||||
|
accessModes:
|
||||||
|
- ReadOnlyMany
|
||||||
|
nfs:
|
||||||
|
server: 10.0.69.10
|
||||||
|
path: /tank/media
|
||||||
|
mountOptions:
|
||||||
|
- vers=4.1
|
||||||
|
- rsize=1048576
|
||||||
|
- wsize=1048576
|
||||||
|
- hard
|
||||||
|
- timeo=600
|
||||||
|
- noatime
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
|
|
||||||
|
|
@ -16,4 +16,4 @@ images:
|
||||||
- name: flaresolverr/flaresolverr
|
- name: flaresolverr/flaresolverr
|
||||||
newTag: v3.4.6@sha256:7962759d99d7e125e108e0f5e7f3cdbcd36161776d058d1d9b7153b92ef1af9e
|
newTag: v3.4.6@sha256:7962759d99d7e125e108e0f5e7f3cdbcd36161776d058d1d9b7153b92ef1af9e
|
||||||
- name: linuxserver/prowlarr
|
- name: linuxserver/prowlarr
|
||||||
newTag: 2.3.5@sha256:c9fe528f34b1fd3715438b6f6d6991d64e2965f2c055db36398bc66a0e7eab01
|
newTag: 2.3.0@sha256:9ef5d8bf832edcacb6082f9262cb36087854e78eb7b1c3e1d4375056055b2d82
|
||||||
|
|
|
||||||
|
|
@ -9,26 +9,22 @@ data:
|
||||||
VPN_TYPE: "wireguard"
|
VPN_TYPE: "wireguard"
|
||||||
VPN_PORT_FORWARDING: on
|
VPN_PORT_FORWARDING: on
|
||||||
VPN_PORT_FORWARDING_PROVIDER: protonvpn
|
VPN_PORT_FORWARDING_PROVIDER: protonvpn
|
||||||
VPN_PORT_FORWARDING_UP_COMMAND: "/scripts/port-up.sh"
|
VPN_PORT_FORWARDING_UP_COMMAND: |
|
||||||
VPN_PORT_FORWARDING_DOWN_COMMAND: "/scripts/port-down.sh"
|
/bin/sh -c '
|
||||||
FIREWALL_OUTBOUND_SUBNETS: 10.244.0.0/16,10.96.0.0/12
|
|
||||||
FIREWALL_INPUT_PORTS: "8112"
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: gluetun-scripts
|
|
||||||
data:
|
|
||||||
port-up.sh: |
|
|
||||||
#!/bin/sh
|
|
||||||
wget -O- --retry-connrefused \
|
wget -O- --retry-connrefused \
|
||||||
--post-data "json={\"listen_port\":{{PORTS}},\"current_network_interface\":\"tun0\",\"random_port\":false,\"upnp\":false}" \
|
--post-data "json={\"listen_port\":{{PORTS}},\"current_network_interface\":\"tun0\",\"random_port\":false,\"upnp\":false}" \
|
||||||
http://127.0.0.1:8112/api/v2/app/setPreferences 2>&1
|
http://127.0.0.1:8112/api/v2/app/setPreferences 2>&1
|
||||||
port-down.sh: |
|
'
|
||||||
#!/bin/sh
|
VPN_PORT_FORWARDING_DOWN_COMMAND: |
|
||||||
|
/bin/sh -c '
|
||||||
wget -O- --retry-connrefused \
|
wget -O- --retry-connrefused \
|
||||||
--post-data "json={\"listen_port\":0,\"current_network_interface\":\"lo\"}" \
|
--post-data "json={\"listen_port\":0,\"current_network_interface\":\"lo\"}" \
|
||||||
http://127.0.0.1:8112/api/v2/app/setPreferences 2>&1
|
http://127.0.0.1:8112/api/v2/app/setPreferences 2>&1
|
||||||
|
'
|
||||||
|
FIREWALL_OUTBOUND_SUBNETS: 10.244.0.0/16,10.96.0.0/12
|
||||||
|
FIREWALL_INPUT_PORTS: "8112"
|
||||||
|
DNS_KEEP_NAMESERVER: on
|
||||||
|
DOT: off
|
||||||
---
|
---
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: ConfigMap
|
kind: ConfigMap
|
||||||
|
|
|
||||||
|
|
@ -17,39 +17,25 @@ spec:
|
||||||
labels:
|
labels:
|
||||||
app: qbittorrent
|
app: qbittorrent
|
||||||
spec:
|
spec:
|
||||||
nodeName: k8s-wheatley-worker02
|
|
||||||
initContainers:
|
initContainers:
|
||||||
- name: gluetun
|
- name: gluetun
|
||||||
image: ghcr.io/qdm12/gluetun
|
image: ghcr.io/qdm12/gluetun
|
||||||
ports:
|
ports:
|
||||||
- name: qbit-http
|
- name: http
|
||||||
containerPort: 8112
|
containerPort: 8112
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
envFrom:
|
envFrom:
|
||||||
- configMapRef:
|
- configMapRef:
|
||||||
name: gluetun-envs
|
name: gluetun-envs
|
||||||
- secretRef:
|
|
||||||
name: gluetun-env-secrets
|
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /dev/net/tun
|
- mountPath: /dev/net/tun
|
||||||
name: dev-tun
|
name: dev-tun
|
||||||
- mountPath: /gluetun/wireguard
|
- mountPath: "/gluetun/wireguard"
|
||||||
name: gluetun-wgconfig
|
name: gluetun-wgconfig
|
||||||
readOnly: true
|
readOnly: true
|
||||||
- name: gluetun-scripts
|
|
||||||
mountPath: /scripts
|
|
||||||
- name: gluetun-tmp
|
- name: gluetun-tmp
|
||||||
mountPath: /tmp/gluetun
|
mountPath: /tmp/gluetun
|
||||||
restartPolicy: Always
|
restartPolicy: Always
|
||||||
lifecycle:
|
|
||||||
postStart:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
[
|
|
||||||
"/bin/sh",
|
|
||||||
"-c",
|
|
||||||
"(ip rule del table 51820; ip -6 rule del table 51820) || true",
|
|
||||||
]
|
|
||||||
readinessProbe:
|
readinessProbe:
|
||||||
exec:
|
exec:
|
||||||
command:
|
command:
|
||||||
|
|
@ -92,7 +78,7 @@ spec:
|
||||||
- mountPath: /config
|
- mountPath: /config
|
||||||
name: qbittorrent-config
|
name: qbittorrent-config
|
||||||
- mountPath: /shared/media/downloads
|
- mountPath: /shared/media/downloads
|
||||||
name: nfs-media-downloads
|
name: nfs-media
|
||||||
securityContext:
|
securityContext:
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: RuntimeDefault
|
type: RuntimeDefault
|
||||||
|
|
@ -112,7 +98,7 @@ spec:
|
||||||
name: unpackerr-env-secrets
|
name: unpackerr-env-secrets
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /shared/media/downloads
|
- mountPath: /shared/media/downloads
|
||||||
name: nfs-media-downloads
|
name: nfs-media
|
||||||
securityContext:
|
securityContext:
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: RuntimeDefault
|
type: RuntimeDefault
|
||||||
|
|
@ -133,12 +119,8 @@ spec:
|
||||||
- name: gluetun-wgconfig
|
- name: gluetun-wgconfig
|
||||||
secret:
|
secret:
|
||||||
secretName: gluetun-wgconfig
|
secretName: gluetun-wgconfig
|
||||||
- name: gluetun-scripts
|
|
||||||
configMap:
|
|
||||||
name: gluetun-scripts
|
|
||||||
defaultMode: 0755
|
|
||||||
- name: gluetun-tmp
|
- name: gluetun-tmp
|
||||||
emptyDir: {}
|
emptyDir: {}
|
||||||
- name: nfs-media-downloads
|
- name: nfs-media
|
||||||
persistentVolumeClaim:
|
persistentVolumeClaim:
|
||||||
claimName: nfs-media-downloads
|
claimName: nfs-media
|
||||||
|
|
|
||||||
|
|
@ -14,16 +14,3 @@ spec:
|
||||||
- backendRefs:
|
- backendRefs:
|
||||||
- name: qbittorrent
|
- name: qbittorrent
|
||||||
port: 80
|
port: 80
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: qbittorrent
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: qbittorrent
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 8112
|
|
||||||
|
|
|
||||||
|
|
@ -9,27 +9,9 @@ resources:
|
||||||
- ingress.yaml
|
- ingress.yaml
|
||||||
- pvc.yaml
|
- pvc.yaml
|
||||||
- secrets.yaml
|
- secrets.yaml
|
||||||
|
- services.yaml
|
||||||
- namespace.yaml
|
- namespace.yaml
|
||||||
|
|
||||||
components:
|
|
||||||
- ../../kustomize-bases/nfs-media/components/downloads
|
|
||||||
|
|
||||||
patches:
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-qbittorrent-downloads
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-qbittorrent-downloads
|
|
||||||
|
|
||||||
images:
|
images:
|
||||||
- name: ghcr.io/qdm12/gluetun
|
- name: ghcr.io/qdm12/gluetun
|
||||||
newTag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
|
newTag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
|
||||||
|
|
|
||||||
|
|
@ -10,3 +10,36 @@ spec:
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: 5Gi
|
storage: 5Gi
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: nfs-media
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 40Ti
|
||||||
|
volumeName: nfs-media-qbittorrent
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: nfs-media-qbittorrent
|
||||||
|
spec:
|
||||||
|
capacity:
|
||||||
|
storage: 40Ti
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
server: 10.0.69.10
|
||||||
|
path: /tank/media/downloads
|
||||||
|
mountOptions:
|
||||||
|
- vers=4.1
|
||||||
|
- rsize=1048576
|
||||||
|
- wsize=1048576
|
||||||
|
- hard
|
||||||
|
- timeo=600
|
||||||
|
- noatime
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
|
|
||||||
|
|
@ -17,24 +17,6 @@ spec:
|
||||||
remoteRef:
|
remoteRef:
|
||||||
key: secrets/managed/qbittorrent/protonvpn-wgconfig
|
key: secrets/managed/qbittorrent/protonvpn-wgconfig
|
||||||
property: config
|
property: config
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: gluetun-env-secrets
|
|
||||||
spec:
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: gluetun-env-secrets
|
|
||||||
data:
|
|
||||||
- secretKey: HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/qbittorrent/gluetun-env-secrets
|
|
||||||
property: HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE
|
|
||||||
|
|
||||||
---
|
---
|
||||||
apiVersion: external-secrets.io/v1
|
apiVersion: external-secrets.io/v1
|
||||||
kind: ExternalSecret
|
kind: ExternalSecret
|
||||||
|
|
|
||||||
|
|
@ -2,11 +2,11 @@
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: Service
|
kind: Service
|
||||||
metadata:
|
metadata:
|
||||||
name: lidarr
|
name: qbittorrent
|
||||||
spec:
|
spec:
|
||||||
selector:
|
selector:
|
||||||
app: lidarr
|
app: qbittorrent
|
||||||
ports:
|
ports:
|
||||||
- port: 80
|
- port: 80
|
||||||
protocol: TCP
|
protocol: TCP
|
||||||
targetPort: 8686
|
targetPort: 8112
|
||||||
|
|
@ -28,10 +28,8 @@ spec:
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /config
|
- mountPath: /config
|
||||||
name: radarr-config
|
name: radarr-config
|
||||||
- mountPath: /shared/media/movies
|
- mountPath: /shared/media
|
||||||
name: nfs-media-movies
|
name: nfs-media
|
||||||
- mountPath: /shared/media/downloads
|
|
||||||
name: nfs-media-downloads
|
|
||||||
securityContext:
|
securityContext:
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: RuntimeDefault
|
type: RuntimeDefault
|
||||||
|
|
@ -47,9 +45,6 @@ spec:
|
||||||
- name: radarr-config
|
- name: radarr-config
|
||||||
persistentVolumeClaim:
|
persistentVolumeClaim:
|
||||||
claimName: radarr-storage
|
claimName: radarr-storage
|
||||||
- name: nfs-media-movies
|
- name: nfs-media
|
||||||
persistentVolumeClaim:
|
persistentVolumeClaim:
|
||||||
claimName: nfs-media-movies
|
claimName: nfs-media
|
||||||
- name: nfs-media-downloads
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-downloads
|
|
||||||
|
|
|
||||||
|
|
@ -12,40 +12,6 @@ resources:
|
||||||
- services.yaml
|
- services.yaml
|
||||||
- namespace.yaml
|
- namespace.yaml
|
||||||
|
|
||||||
components:
|
|
||||||
- ../../kustomize-bases/nfs-media/components/movies
|
|
||||||
- ../../kustomize-bases/nfs-media/components/downloads
|
|
||||||
|
|
||||||
patches:
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-movies
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-radarr-movies
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-movies
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-radarr-movies
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-radarr-downloads
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-radarr-downloads
|
|
||||||
|
|
||||||
images:
|
images:
|
||||||
- name: linuxserver/radarr
|
- name: linuxserver/radarr
|
||||||
newTag: 6.1.1@sha256:079e48870584baf2a3e7e43e7ba6d3c834555931851a59c82c51cc792d285caf
|
newTag: 6.0.4@sha256:ca43905eaf2dd11425efdcfe184892e43806b1ae0a830440c825cecbc2629cfb
|
||||||
|
|
|
||||||
|
|
@ -10,3 +10,36 @@ spec:
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: 5Gi
|
storage: 5Gi
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: nfs-media
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 40Ti
|
||||||
|
volumeName: nfs-media-radarr
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: nfs-media-radarr
|
||||||
|
spec:
|
||||||
|
capacity:
|
||||||
|
storage: 40Ti
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
server: 10.0.69.10
|
||||||
|
path: /tank/media
|
||||||
|
mountOptions:
|
||||||
|
- vers=4.1
|
||||||
|
- rsize=1048576
|
||||||
|
- wsize=1048576
|
||||||
|
- hard
|
||||||
|
- timeo=600
|
||||||
|
- noatime
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
|
|
||||||
|
|
@ -1,21 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: romm-db-envs
|
|
||||||
data:
|
|
||||||
MARIADB_DATABASE: romm
|
|
||||||
MARIADB_USER: romm
|
|
||||||
TZ: Europe/Amsterdam
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: romm-envs
|
|
||||||
data:
|
|
||||||
DB_HOST: 127.0.0.1
|
|
||||||
DB_NAME: romm
|
|
||||||
DB_USER: romm
|
|
||||||
ROMM_PORT: "8080"
|
|
||||||
HASHEOUS_API_ENABLED: "true"
|
|
||||||
TZ: Europe/Amsterdam
|
|
||||||
|
|
@ -1,83 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: romm
|
|
||||||
labels:
|
|
||||||
app: romm
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
serviceName: romm
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: romm
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: romm
|
|
||||||
spec:
|
|
||||||
initContainers:
|
|
||||||
- name: romm-db
|
|
||||||
image: mariadb
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: romm-db-envs
|
|
||||||
- secretRef:
|
|
||||||
name: romm-db-env-secrets
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /var/lib/mysql
|
|
||||||
name: romm-db-data
|
|
||||||
restartPolicy: Always
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- "healthcheck.sh --connect --innodb_initialized"
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 3
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 3
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- "healthcheck.sh --connect --innodb_initialized"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 15
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 3
|
|
||||||
containers:
|
|
||||||
- name: romm
|
|
||||||
image: rommapp/romm
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
ports:
|
|
||||||
- containerPort: 8080
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: romm-envs
|
|
||||||
- secretRef:
|
|
||||||
name: romm-env-secrets
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /romm
|
|
||||||
name: romm-data
|
|
||||||
- mountPath: /romm/library
|
|
||||||
name: nfs-media-roms
|
|
||||||
readOnly: true
|
|
||||||
- mountPath: /romm/downloads
|
|
||||||
name: nfs-media-downloads
|
|
||||||
readOnly: true
|
|
||||||
volumes:
|
|
||||||
- name: romm-db-data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: romm-db-storage
|
|
||||||
- name: romm-data
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: romm-storage
|
|
||||||
- name: nfs-media-roms
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-roms
|
|
||||||
- name: nfs-media-downloads
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-downloads
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
name: romm-route
|
|
||||||
spec:
|
|
||||||
parentRefs:
|
|
||||||
- name: internal
|
|
||||||
namespace: kube-system
|
|
||||||
sectionName: https
|
|
||||||
hostnames:
|
|
||||||
- "roms.wheatley.in"
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: romm
|
|
||||||
port: 80
|
|
||||||
|
|
@ -1,53 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
namespace: romm
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- configmap.yaml
|
|
||||||
- deployments.yaml
|
|
||||||
- ingress.yaml
|
|
||||||
- pvc.yaml
|
|
||||||
- secrets.yaml
|
|
||||||
- services.yaml
|
|
||||||
- namespace.yaml
|
|
||||||
|
|
||||||
components:
|
|
||||||
- ../../kustomize-bases/nfs-media/components/roms
|
|
||||||
- ../../kustomize-bases/nfs-media/components/downloads
|
|
||||||
|
|
||||||
patches:
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-roms
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-romm-roms
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-romm-downloads
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-roms
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-romm-roms
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-romm-downloads
|
|
||||||
|
|
||||||
images:
|
|
||||||
- name: mariadb
|
|
||||||
newTag: lts@sha256:78185355dd49b54dd6909072531ce8d7e06aa0eccd7aa5b23c93ebb7e34c5aaa
|
|
||||||
- name: rommapp/romm
|
|
||||||
newTag: 4.8.1@sha256:2b7a1714b287f69b081ad2a63bb8c2fa673666a17b2f21322b580b0cd51cb266
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: romm
|
|
||||||
|
|
@ -1,24 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: romm-db-storage
|
|
||||||
spec:
|
|
||||||
storageClassName: piraeus-lvmthin
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 5Gi
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: romm-storage
|
|
||||||
spec:
|
|
||||||
storageClassName: piraeus-lvmthin
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 10Gi
|
|
||||||
|
|
@ -1,52 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: romm-db-env-secrets
|
|
||||||
spec:
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: romm-db-env-secrets
|
|
||||||
data:
|
|
||||||
- secretKey: MARIADB_ROOT_PASSWORD
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/romm/romm-db
|
|
||||||
property: ROOT_PASSWORD
|
|
||||||
- secretKey: MARIADB_PASSWORD
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/romm/romm-db
|
|
||||||
property: PASSWORD
|
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: romm-env-secrets
|
|
||||||
spec:
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: romm-env-secrets
|
|
||||||
data:
|
|
||||||
- secretKey: DB_PASSWD
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/romm/romm-db
|
|
||||||
property: PASSWORD
|
|
||||||
- secretKey: ROMM_AUTH_SECRET_KEY
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/romm/romm
|
|
||||||
property: SECRET_KEY
|
|
||||||
- secretKey: IGDB_CLIENT_ID
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/romm/romm
|
|
||||||
property: IGDB_CLIENT_ID
|
|
||||||
- secretKey: IGDB_CLIENT_SECRET
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/romm/romm
|
|
||||||
property: IGDB_CLIENT_SECRET
|
|
||||||
- secretKey: STEAMGRIDDB_API_KEY
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/romm/romm
|
|
||||||
property: STEAMGRIDDB_API_KEY
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: romm
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: romm
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 8080
|
|
||||||
|
|
@ -16,7 +16,6 @@ spec:
|
||||||
labels:
|
labels:
|
||||||
app: sonarr
|
app: sonarr
|
||||||
spec:
|
spec:
|
||||||
nodeName: k8s-wheatley-worker03
|
|
||||||
containers:
|
containers:
|
||||||
- name: sonarr
|
- name: sonarr
|
||||||
image: linuxserver/sonarr
|
image: linuxserver/sonarr
|
||||||
|
|
@ -29,12 +28,8 @@ spec:
|
||||||
volumeMounts:
|
volumeMounts:
|
||||||
- mountPath: /config
|
- mountPath: /config
|
||||||
name: sonarr-config
|
name: sonarr-config
|
||||||
- mountPath: /shared/media/series
|
- mountPath: /shared/media
|
||||||
name: nfs-media-series
|
name: nfs-media
|
||||||
- mountPath: /shared/media/anime
|
|
||||||
name: nfs-media-anime
|
|
||||||
- mountPath: /shared/media/downloads
|
|
||||||
name: nfs-media-downloads
|
|
||||||
securityContext:
|
securityContext:
|
||||||
seccompProfile:
|
seccompProfile:
|
||||||
type: RuntimeDefault
|
type: RuntimeDefault
|
||||||
|
|
@ -50,12 +45,6 @@ spec:
|
||||||
- name: sonarr-config
|
- name: sonarr-config
|
||||||
persistentVolumeClaim:
|
persistentVolumeClaim:
|
||||||
claimName: sonarr-storage
|
claimName: sonarr-storage
|
||||||
- name: nfs-media-series
|
- name: nfs-media
|
||||||
persistentVolumeClaim:
|
persistentVolumeClaim:
|
||||||
claimName: nfs-media-series
|
claimName: nfs-media
|
||||||
- name: nfs-media-anime
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-anime
|
|
||||||
- name: nfs-media-downloads
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-downloads
|
|
||||||
|
|
|
||||||
|
|
@ -12,55 +12,6 @@ resources:
|
||||||
- services.yaml
|
- services.yaml
|
||||||
- namespace.yaml
|
- namespace.yaml
|
||||||
|
|
||||||
components:
|
|
||||||
- ../../kustomize-bases/nfs-media/components/series
|
|
||||||
- ../../kustomize-bases/nfs-media/components/anime
|
|
||||||
- ../../kustomize-bases/nfs-media/components/downloads
|
|
||||||
|
|
||||||
patches:
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-series
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-sonarr-series
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-series
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-sonarr-series
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-anime
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-sonarr-anime
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-anime
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-sonarr-anime
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-sonarr-downloads
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-sonarr-downloads
|
|
||||||
|
|
||||||
images:
|
images:
|
||||||
- name: linuxserver/sonarr
|
- name: linuxserver/sonarr
|
||||||
newTag: 4.0.17@sha256:0b5c4803f92456fb9b65bae8375716ea120b4ea17b3cced7da32b63f0085782b
|
newTag: 4.0.16@sha256:21c1c3d52248589bb064f5adafec18cad45812d7a01d317472955eef051e619b
|
||||||
|
|
|
||||||
|
|
@ -9,4 +9,37 @@ spec:
|
||||||
- ReadWriteOnce
|
- ReadWriteOnce
|
||||||
resources:
|
resources:
|
||||||
requests:
|
requests:
|
||||||
storage: 10Gi
|
storage: 5Gi
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: nfs-media
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 40Ti
|
||||||
|
volumeName: nfs-media-sonarr
|
||||||
|
---
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolume
|
||||||
|
metadata:
|
||||||
|
name: nfs-media-sonarr
|
||||||
|
spec:
|
||||||
|
capacity:
|
||||||
|
storage: 40Ti
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteMany
|
||||||
|
nfs:
|
||||||
|
server: 10.0.69.10
|
||||||
|
path: /tank/media
|
||||||
|
mountOptions:
|
||||||
|
- vers=4.1
|
||||||
|
- rsize=1048576
|
||||||
|
- wsize=1048576
|
||||||
|
- hard
|
||||||
|
- timeo=600
|
||||||
|
- noatime
|
||||||
|
persistentVolumeReclaimPolicy: Retain
|
||||||
|
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: gluetun-envs
|
|
||||||
data:
|
|
||||||
TZ: Europe/Amsterdam
|
|
||||||
VPN_SERVICE_PROVIDER: "custom"
|
|
||||||
VPN_TYPE: "wireguard"
|
|
||||||
VPN_PORT_FORWARDING: on
|
|
||||||
VPN_PORT_FORWARDING_PROVIDER: protonvpn
|
|
||||||
FIREWALL_OUTBOUND_SUBNETS: 10.244.0.0/16,10.96.0.0/12
|
|
||||||
FIREWALL_INPUT_PORTS: "5030"
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: ConfigMap
|
|
||||||
metadata:
|
|
||||||
name: slskd-envs
|
|
||||||
data:
|
|
||||||
TZ: Europe/Amsterdam
|
|
||||||
PUID: "1000"
|
|
||||||
PGID: "1000"
|
|
||||||
SLSKD_DOWNLOADS_DIR: /shared/media/downloads/_slsk-downloads
|
|
||||||
SLSKD_INCOMPLETE_DIR: /shared/media/downloads/_slsk-incomplete
|
|
||||||
SLSKD_SHARED_DIR: "[Music]/shared/media/music"
|
|
||||||
SLSKD_REMOTE_CONFIGURATION: "true"
|
|
||||||
SLSKD_VPN: "true"
|
|
||||||
SLSKD_VPN_PORT_FORWARDING: "true"
|
|
||||||
SLSKD_VPN_GLUETUN_URL: http://localhost:8000
|
|
||||||
|
|
@ -1,127 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: apps/v1
|
|
||||||
kind: StatefulSet
|
|
||||||
metadata:
|
|
||||||
name: soulseekd
|
|
||||||
namespace: soulseekd
|
|
||||||
labels:
|
|
||||||
app: soulseekd
|
|
||||||
spec:
|
|
||||||
replicas: 1
|
|
||||||
serviceName: soulseekd
|
|
||||||
selector:
|
|
||||||
matchLabels:
|
|
||||||
app: soulseekd
|
|
||||||
template:
|
|
||||||
metadata:
|
|
||||||
labels:
|
|
||||||
app: soulseekd
|
|
||||||
spec:
|
|
||||||
nodeName: k8s-wheatley-worker01
|
|
||||||
initContainers:
|
|
||||||
- name: gluetun
|
|
||||||
image: ghcr.io/qdm12/gluetun
|
|
||||||
ports:
|
|
||||||
- name: slskd-http
|
|
||||||
containerPort: 5030
|
|
||||||
protocol: TCP
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: gluetun-envs
|
|
||||||
- secretRef:
|
|
||||||
name: gluetun-env-secrets
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /dev/net/tun
|
|
||||||
name: dev-tun
|
|
||||||
- mountPath: /gluetun/wireguard
|
|
||||||
name: gluetun-wgconfig
|
|
||||||
readOnly: true
|
|
||||||
- name: gluetun-tmp
|
|
||||||
mountPath: /tmp/gluetun
|
|
||||||
restartPolicy: Always
|
|
||||||
lifecycle:
|
|
||||||
postStart:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
[
|
|
||||||
"/bin/sh",
|
|
||||||
"-c",
|
|
||||||
"(ip rule del table 51820; ip -6 rule del table 51820) || true",
|
|
||||||
]
|
|
||||||
readinessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- "ping -c 1 9.9.9.9"
|
|
||||||
initialDelaySeconds: 5
|
|
||||||
periodSeconds: 3
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 3
|
|
||||||
livenessProbe:
|
|
||||||
exec:
|
|
||||||
command:
|
|
||||||
- sh
|
|
||||||
- -c
|
|
||||||
- "ping -c 1 9.9.9.9"
|
|
||||||
initialDelaySeconds: 10
|
|
||||||
periodSeconds: 15
|
|
||||||
timeoutSeconds: 2
|
|
||||||
failureThreshold: 3
|
|
||||||
securityContext:
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
allowPrivilegeEscalation: true
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
add:
|
|
||||||
- "CHOWN"
|
|
||||||
- "NET_ADMIN"
|
|
||||||
- "NET_RAW"
|
|
||||||
containers:
|
|
||||||
- name: slskd
|
|
||||||
image: docker.io/slskd/slskd
|
|
||||||
imagePullPolicy: IfNotPresent
|
|
||||||
envFrom:
|
|
||||||
- configMapRef:
|
|
||||||
name: slskd-envs
|
|
||||||
- secretRef:
|
|
||||||
name: slskd-env-secrets
|
|
||||||
volumeMounts:
|
|
||||||
- mountPath: /config
|
|
||||||
name: slskd-config
|
|
||||||
- mountPath: /shared/media/downloads
|
|
||||||
name: nfs-media-downloads
|
|
||||||
- mountPath: /shared/media/music
|
|
||||||
name: nfs-media-music
|
|
||||||
securityContext:
|
|
||||||
seccompProfile:
|
|
||||||
type: RuntimeDefault
|
|
||||||
allowPrivilegeEscalation: false
|
|
||||||
capabilities:
|
|
||||||
drop:
|
|
||||||
- "ALL"
|
|
||||||
add:
|
|
||||||
- "CHOWN"
|
|
||||||
- "SETUID"
|
|
||||||
- "SETGID"
|
|
||||||
volumes:
|
|
||||||
- name: dev-tun
|
|
||||||
hostPath:
|
|
||||||
path: /dev/net/tun
|
|
||||||
type: CharDevice
|
|
||||||
- name: slskd-config
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: slskd-storage
|
|
||||||
- name: gluetun-wgconfig
|
|
||||||
secret:
|
|
||||||
secretName: gluetun-wgconfig
|
|
||||||
- name: gluetun-tmp
|
|
||||||
emptyDir: {}
|
|
||||||
- name: nfs-media-downloads
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-downloads
|
|
||||||
- name: nfs-media-music
|
|
||||||
persistentVolumeClaim:
|
|
||||||
claimName: nfs-media-music
|
|
||||||
|
|
@ -1,28 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: gateway.networking.k8s.io/v1
|
|
||||||
kind: HTTPRoute
|
|
||||||
metadata:
|
|
||||||
name: slskd-route
|
|
||||||
spec:
|
|
||||||
parentRefs:
|
|
||||||
- name: internal
|
|
||||||
namespace: kube-system
|
|
||||||
sectionName: https
|
|
||||||
hostnames:
|
|
||||||
- "slskd.wheatley.in"
|
|
||||||
rules:
|
|
||||||
- backendRefs:
|
|
||||||
- name: slskd
|
|
||||||
port: 80
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Service
|
|
||||||
metadata:
|
|
||||||
name: slskd
|
|
||||||
spec:
|
|
||||||
selector:
|
|
||||||
app: soulseekd
|
|
||||||
ports:
|
|
||||||
- port: 80
|
|
||||||
protocol: TCP
|
|
||||||
targetPort: 5030
|
|
||||||
|
|
@ -1,52 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
||||||
kind: Kustomization
|
|
||||||
namespace: soulseekd
|
|
||||||
|
|
||||||
resources:
|
|
||||||
- configmap.yaml
|
|
||||||
- deployments.yaml
|
|
||||||
- ingress.yaml
|
|
||||||
- pvc.yaml
|
|
||||||
- secrets.yaml
|
|
||||||
- namespace.yaml
|
|
||||||
|
|
||||||
components:
|
|
||||||
- ../../kustomize-bases/nfs-media/components/downloads
|
|
||||||
- ../../kustomize-bases/nfs-media/components/music
|
|
||||||
|
|
||||||
patches:
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-soulseekd-downloads
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-downloads
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-soulseekd-downloads
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolume
|
|
||||||
name: nfs-media-music
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /metadata/name
|
|
||||||
value: nfs-media-soulseekd-music
|
|
||||||
- target:
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
name: nfs-media-music
|
|
||||||
patch: |
|
|
||||||
- op: replace
|
|
||||||
path: /spec/volumeName
|
|
||||||
value: nfs-media-soulseekd-music
|
|
||||||
|
|
||||||
images:
|
|
||||||
- name: ghcr.io/qdm12/gluetun
|
|
||||||
newTag: v3.41.1@sha256:1a5bf4b4820a879cdf8d93d7ef0d2d963af56670c9ebff8981860b6804ebc8ab
|
|
||||||
- name: docker.io/slskd/slskd
|
|
||||||
newTag: 0.25.1@sha256:ab9ed50e028b524cefdb7c1dd8ebca368a076e18441ee8ac2326473eb850b4c3
|
|
||||||
|
|
@ -1,7 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: Namespace
|
|
||||||
metadata:
|
|
||||||
name: soulseekd
|
|
||||||
labels:
|
|
||||||
pod-security.kubernetes.io/enforce: privileged
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: slskd-storage
|
|
||||||
spec:
|
|
||||||
storageClassName: piraeus-lvmthin
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteOnce
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 1Gi
|
|
||||||
|
|
@ -1,69 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: gluetun-wgconfig
|
|
||||||
spec:
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: gluetun-wgconfig
|
|
||||||
template:
|
|
||||||
data:
|
|
||||||
wg0.conf: "{{ .config }}"
|
|
||||||
data:
|
|
||||||
- secretKey: config
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/soulseekd/protonvpn-wgconfig
|
|
||||||
property: config
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: slskd-env-secrets
|
|
||||||
spec:
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: slskd-env-secrets
|
|
||||||
data:
|
|
||||||
- secretKey: SLSKD_VPN_GLUETUN_API_KEY
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/soulseekd/slskd-env-secrets
|
|
||||||
property: GLUETUN_API_KEY
|
|
||||||
- secretKey: SLSKD_SLSK_USERNAME
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/soulseekd/slskd-env-secrets
|
|
||||||
property: SLSK_USERNAME
|
|
||||||
- secretKey: SLSKD_SLSK_PASSWORD
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/soulseekd/slskd-env-secrets
|
|
||||||
property: SLSK_PASSWORD
|
|
||||||
- secretKey: SLSKD_PASSWORD
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/soulseekd/slskd-env-secrets
|
|
||||||
property: SLSKD_PASSWORD
|
|
||||||
- secretKey: SLSKD_API_KEY
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/soulseekd/slskd-env-secrets
|
|
||||||
property: API_KEY
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: external-secrets.io/v1
|
|
||||||
kind: ExternalSecret
|
|
||||||
metadata:
|
|
||||||
name: gluetun-env-secrets
|
|
||||||
spec:
|
|
||||||
secretStoreRef:
|
|
||||||
name: vault-wheatley
|
|
||||||
kind: ClusterSecretStore
|
|
||||||
target:
|
|
||||||
name: gluetun-env-secrets
|
|
||||||
data:
|
|
||||||
- secretKey: HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE
|
|
||||||
remoteRef:
|
|
||||||
key: secrets/managed/soulseekd/gluetun-env-secrets
|
|
||||||
property: HTTP_CONTROL_SERVER_AUTH_DEFAULT_ROLE
|
|
||||||
|
|
@ -9,14 +9,14 @@ resources:
|
||||||
helmCharts:
|
helmCharts:
|
||||||
- name: alloy
|
- name: alloy
|
||||||
repo: https://grafana.github.io/helm-charts
|
repo: https://grafana.github.io/helm-charts
|
||||||
version: "1.8.2"
|
version: "1.6.2"
|
||||||
releaseName: alloy
|
releaseName: alloy
|
||||||
valuesFile: values.yaml
|
valuesFile: values.yaml
|
||||||
- name: kube-state-metrics
|
- name: kube-state-metrics
|
||||||
repo: https://prometheus-community.github.io/helm-charts
|
repo: https://prometheus-community.github.io/helm-charts
|
||||||
version: "7.4.0"
|
version: "7.2.1"
|
||||||
releaseName: kube-state-metrics
|
releaseName: kube-state-metrics
|
||||||
- name: prometheus-operator-crds
|
- name: prometheus-operator-crds
|
||||||
repo: https://prometheus-community.github.io/helm-charts
|
repo: https://prometheus-community.github.io/helm-charts
|
||||||
version: "29.0.0"
|
version: "27.0.0"
|
||||||
releaseName: prometheus-operator-crds
|
releaseName: prometheus-operator-crds
|
||||||
|
|
|
||||||
|
|
@ -127,7 +127,7 @@ configReloader:
|
||||||
# -- Repository to get config reloader image from.
|
# -- Repository to get config reloader image from.
|
||||||
repository: prometheus-operator/prometheus-config-reloader
|
repository: prometheus-operator/prometheus-config-reloader
|
||||||
# -- Tag of image to use for config reloading.
|
# -- Tag of image to use for config reloading.
|
||||||
tag: v0.91.0@sha256:7d9e4eea5f1139e602508871f422b0116c60e87c662f3dcd234d5ab60cd0d8c1
|
tag: v0.89.0@sha256:cb4ac6a56555bef0e202bec11e367dfe07ffb241cf4d30566b12b864692607a8
|
||||||
# -- SHA256 digest of image to use for config reloading (either in format "sha256:XYZ" or "XYZ"). When set, will override `configReloader.image.tag`
|
# -- SHA256 digest of image to use for config reloading (either in format "sha256:XYZ" or "XYZ"). When set, will override `configReloader.image.tag`
|
||||||
digest: ""
|
digest: ""
|
||||||
# -- Override the args passed to the container.
|
# -- Override the args passed to the container.
|
||||||
|
|
|
||||||
|
|
@ -13,5 +13,5 @@ helmCharts:
|
||||||
repo: https://helm.cilium.io
|
repo: https://helm.cilium.io
|
||||||
namespace: kube-system
|
namespace: kube-system
|
||||||
releaseName: cilium
|
releaseName: cilium
|
||||||
version: 1.18.10
|
version: 1.18.6
|
||||||
valuesFile: values.yaml
|
valuesFile: values.yaml
|
||||||
|
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
|
||||||
kind: Component
|
|
||||||
resources:
|
|
||||||
- pvc.yaml
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolume
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-anime
|
|
||||||
spec:
|
|
||||||
capacity:
|
|
||||||
storage: 40Ti
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
nfs:
|
|
||||||
server: 10.0.69.10
|
|
||||||
path: /tank/media/anime
|
|
||||||
mountOptions:
|
|
||||||
- vers=4.1
|
|
||||||
- rsize=1048576
|
|
||||||
- wsize=1048576
|
|
||||||
- hard
|
|
||||||
- timeo=600
|
|
||||||
- noatime
|
|
||||||
persistentVolumeReclaimPolicy: Retain
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-anime
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 40Ti
|
|
||||||
volumeName: nfs-media-anime
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
|
||||||
kind: Component
|
|
||||||
resources:
|
|
||||||
- pvc.yaml
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolume
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-downloads
|
|
||||||
spec:
|
|
||||||
capacity:
|
|
||||||
storage: 40Ti
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
nfs:
|
|
||||||
server: 10.0.69.10
|
|
||||||
path: /tank/media/downloads
|
|
||||||
mountOptions:
|
|
||||||
- vers=4.1
|
|
||||||
- rsize=1048576
|
|
||||||
- wsize=1048576
|
|
||||||
- hard
|
|
||||||
- timeo=600
|
|
||||||
- noatime
|
|
||||||
persistentVolumeReclaimPolicy: Retain
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-downloads
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 40Ti
|
|
||||||
volumeName: nfs-media-downloads
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
|
||||||
kind: Component
|
|
||||||
resources:
|
|
||||||
- pvc.yaml
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolume
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-movies
|
|
||||||
spec:
|
|
||||||
capacity:
|
|
||||||
storage: 40Ti
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
nfs:
|
|
||||||
server: 10.0.69.10
|
|
||||||
path: /tank/media/movies
|
|
||||||
mountOptions:
|
|
||||||
- vers=4.1
|
|
||||||
- rsize=1048576
|
|
||||||
- wsize=1048576
|
|
||||||
- hard
|
|
||||||
- timeo=600
|
|
||||||
- noatime
|
|
||||||
persistentVolumeReclaimPolicy: Retain
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-movies
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 40Ti
|
|
||||||
volumeName: nfs-media-movies
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
|
||||||
kind: Component
|
|
||||||
resources:
|
|
||||||
- pvc.yaml
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolume
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-music
|
|
||||||
spec:
|
|
||||||
capacity:
|
|
||||||
storage: 40Ti
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
nfs:
|
|
||||||
server: 10.0.69.10
|
|
||||||
path: /tank/media/music
|
|
||||||
mountOptions:
|
|
||||||
- vers=4.1
|
|
||||||
- rsize=1048576
|
|
||||||
- wsize=1048576
|
|
||||||
- hard
|
|
||||||
- timeo=600
|
|
||||||
- noatime
|
|
||||||
persistentVolumeReclaimPolicy: Retain
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-music
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 40Ti
|
|
||||||
volumeName: nfs-media-music
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
|
||||||
kind: Component
|
|
||||||
resources:
|
|
||||||
- pvc.yaml
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolume
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-roms
|
|
||||||
spec:
|
|
||||||
capacity:
|
|
||||||
storage: 40Ti
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
nfs:
|
|
||||||
server: 10.0.69.10
|
|
||||||
path: /tank/media/roms
|
|
||||||
mountOptions:
|
|
||||||
- vers=4.1
|
|
||||||
- rsize=1048576
|
|
||||||
- wsize=1048576
|
|
||||||
- hard
|
|
||||||
- timeo=600
|
|
||||||
- noatime
|
|
||||||
persistentVolumeReclaimPolicy: Retain
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-roms
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 40Ti
|
|
||||||
volumeName: nfs-media-roms
|
|
||||||
|
|
@ -1,5 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: kustomize.config.k8s.io/v1alpha1
|
|
||||||
kind: Component
|
|
||||||
resources:
|
|
||||||
- pvc.yaml
|
|
||||||
|
|
@ -1,33 +0,0 @@
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolume
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-series
|
|
||||||
spec:
|
|
||||||
capacity:
|
|
||||||
storage: 40Ti
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
nfs:
|
|
||||||
server: 10.0.69.10
|
|
||||||
path: /tank/media/series
|
|
||||||
mountOptions:
|
|
||||||
- vers=4.1
|
|
||||||
- rsize=1048576
|
|
||||||
- wsize=1048576
|
|
||||||
- hard
|
|
||||||
- timeo=600
|
|
||||||
- noatime
|
|
||||||
persistentVolumeReclaimPolicy: Retain
|
|
||||||
---
|
|
||||||
apiVersion: v1
|
|
||||||
kind: PersistentVolumeClaim
|
|
||||||
metadata:
|
|
||||||
name: nfs-media-series
|
|
||||||
spec:
|
|
||||||
accessModes:
|
|
||||||
- ReadWriteMany
|
|
||||||
resources:
|
|
||||||
requests:
|
|
||||||
storage: 40Ti
|
|
||||||
volumeName: nfs-media-series
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue