diff --git a/homelab/silver-hand/README.md b/archive/silver-hand/README.md similarity index 100% rename from homelab/silver-hand/README.md rename to archive/silver-hand/README.md diff --git a/homelab/silver-hand/certmanager.tf b/archive/silver-hand/certmanager.tf similarity index 100% rename from homelab/silver-hand/certmanager.tf rename to archive/silver-hand/certmanager.tf diff --git a/homelab/silver-hand/cloudflare.tf b/archive/silver-hand/cloudflare.tf similarity index 100% rename from homelab/silver-hand/cloudflare.tf rename to archive/silver-hand/cloudflare.tf diff --git a/homelab/silver-hand/nginx-test.tf b/archive/silver-hand/nginx-test.tf similarity index 100% rename from homelab/silver-hand/nginx-test.tf rename to archive/silver-hand/nginx-test.tf diff --git a/homelab/silver-hand/silver-hand.tf b/archive/silver-hand/silver-hand.tf similarity index 100% rename from homelab/silver-hand/silver-hand.tf rename to archive/silver-hand/silver-hand.tf diff --git a/homelab/silver-hand/traefik.tf b/archive/silver-hand/traefik.tf similarity index 100% rename from homelab/silver-hand/traefik.tf rename to archive/silver-hand/traefik.tf diff --git a/homelab/silver-flame/README.md b/homelab/silver-flame/README.md new file mode 100644 index 00000000..536cd528 --- /dev/null +++ b/homelab/silver-flame/README.md @@ -0,0 +1,9 @@ +# Silver Flame +The Silver Flame is the name given to my k3s cluster, initially comprising Bard, Ranger, and Cleric. + +> The Church of the Silver Flame was founded in the early centuries of the Kingdom of Galifar by the sacrifice of a brave paladin, Tira Miron. The church's influence spread throughout the centuries, but its heart remained in Thrane. During the Last War, King Thalin declared independence in the name of spreading worship. When Thalin died, the Church stepped in to replace the monarchy with a theocracy. +> [Source](https://eberron.fandom.com/wiki/Church_of_the_Silver_Flame) + +# Infrastructure via NixOS, Deploy-rs + +# Services via Kubernetes, Helm, Helmfile \ No newline at end of file diff --git a/nix/nix-lab/configuration.nix b/homelab/silver-flame/configuration.nix similarity index 100% rename from nix/nix-lab/configuration.nix rename to homelab/silver-flame/configuration.nix diff --git a/nix/nix-lab/flake.lock b/homelab/silver-flame/flake.lock similarity index 100% rename from nix/nix-lab/flake.lock rename to homelab/silver-flame/flake.lock diff --git a/nix/nix-lab/flake.nix b/homelab/silver-flame/flake.nix similarity index 100% rename from nix/nix-lab/flake.nix rename to homelab/silver-flame/flake.nix diff --git a/nix/nix-lab/helm/helmfile.yaml b/homelab/silver-flame/helm/helmfile.yaml similarity index 100% rename from nix/nix-lab/helm/helmfile.yaml rename to homelab/silver-flame/helm/helmfile.yaml diff --git a/nix/nix-lab/helm/values/metallb.yaml b/homelab/silver-flame/helm/values/metallb.yaml similarity index 100% rename from nix/nix-lab/helm/values/metallb.yaml rename to homelab/silver-flame/helm/values/metallb.yaml diff --git a/nix/nix-lab/helm/values/traefik.yaml b/homelab/silver-flame/helm/values/traefik.yaml similarity index 100% rename from nix/nix-lab/helm/values/traefik.yaml rename to homelab/silver-flame/helm/values/traefik.yaml diff --git a/nix/nix-lab/hosts/bard/hardware-configuration.nix b/homelab/silver-flame/hosts/bard/hardware-configuration.nix similarity index 100% rename from nix/nix-lab/hosts/bard/hardware-configuration.nix rename to homelab/silver-flame/hosts/bard/hardware-configuration.nix diff --git a/nix/nix-lab/hosts/cleric/hardware-configuration.nix b/homelab/silver-flame/hosts/cleric/hardware-configuration.nix similarity index 100% rename from nix/nix-lab/hosts/cleric/hardware-configuration.nix rename to homelab/silver-flame/hosts/cleric/hardware-configuration.nix diff --git a/nix/nix-lab/hosts/ranger/hardware-configuration.nix b/homelab/silver-flame/hosts/ranger/hardware-configuration.nix similarity index 100% rename from nix/nix-lab/hosts/ranger/hardware-configuration.nix rename to homelab/silver-flame/hosts/ranger/hardware-configuration.nix diff --git a/nix/nix-lab/manifests/cert-manager/cert-manager.yaml b/homelab/silver-flame/manifests/cert-manager/cert-manager.yaml similarity index 100% rename from nix/nix-lab/manifests/cert-manager/cert-manager.yaml rename to homelab/silver-flame/manifests/cert-manager/cert-manager.yaml diff --git a/nix/nix-lab/manifests/longhorn/longhorn.yaml b/homelab/silver-flame/manifests/longhorn/longhorn.yaml similarity index 100% rename from nix/nix-lab/manifests/longhorn/longhorn.yaml rename to homelab/silver-flame/manifests/longhorn/longhorn.yaml diff --git a/nix/nix-lab/manifests/nginx/nginx.yaml b/homelab/silver-flame/manifests/nginx/nginx.yaml similarity index 100% rename from nix/nix-lab/manifests/nginx/nginx.yaml rename to homelab/silver-flame/manifests/nginx/nginx.yaml diff --git a/nix/nix-lab/manifests/send/redis-pod.yaml b/homelab/silver-flame/manifests/send/redis-pod.yaml similarity index 100% rename from nix/nix-lab/manifests/send/redis-pod.yaml rename to homelab/silver-flame/manifests/send/redis-pod.yaml diff --git a/nix/nix-lab/manifests/send/send-claim0-persistentvolumeclaim.yaml b/homelab/silver-flame/manifests/send/send-claim0-persistentvolumeclaim.yaml similarity index 100% rename from nix/nix-lab/manifests/send/send-claim0-persistentvolumeclaim.yaml rename to homelab/silver-flame/manifests/send/send-claim0-persistentvolumeclaim.yaml diff --git a/nix/nix-lab/manifests/send/send-pod.yaml b/homelab/silver-flame/manifests/send/send-pod.yaml similarity index 100% rename from nix/nix-lab/manifests/send/send-pod.yaml rename to homelab/silver-flame/manifests/send/send-pod.yaml diff --git a/nix/nix-lab/manifests/send/send.yaml b/homelab/silver-flame/manifests/send/send.yaml similarity index 100% rename from nix/nix-lab/manifests/send/send.yaml rename to homelab/silver-flame/manifests/send/send.yaml diff --git a/nix/nix-lab/manifests/smb/smb.yaml b/homelab/silver-flame/manifests/smb/smb.yaml similarity index 100% rename from nix/nix-lab/manifests/smb/smb.yaml rename to homelab/silver-flame/manifests/smb/smb.yaml diff --git a/homelab/silver-hand/old/artisans-tools/README.md b/homelab/silver-hand/old/artisans-tools/README.md deleted file mode 100644 index 0932998d..00000000 --- a/homelab/silver-hand/old/artisans-tools/README.md +++ /dev/null @@ -1,2 +0,0 @@ -# Artisan's Tools -Here are the manifests for tools we've added to the cluster to facilitate one or more applications. \ No newline at end of file diff --git a/homelab/silver-hand/old/artisans-tools/datashim.yml b/homelab/silver-hand/old/artisans-tools/datashim.yml deleted file mode 100644 index ae2d1556..00000000 --- a/homelab/silver-hand/old/artisans-tools/datashim.yml +++ /dev/null @@ -1,1389 +0,0 @@ ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-attacher-rbac.yaml -# This YAML file contains RBAC API objects that are necessary to run external -# CSI attacher for nfs flex adapter - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: csi-attacher-nfs - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-nodeplugin-rbac.yaml -# This YAML defines all API objects to create RBAC roles for CSI node plugin -apiVersion: v1 -kind: ServiceAccount -metadata: - name: csi-nodeplugin - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/csi-s3.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: csi-s3 - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/attacher-rbac.yaml -# This YAML file contains all RBAC objects that are necessary to run external -# CSI attacher. -# -# In production, each CSI driver deployment has to be customized: -# - to avoid conflicts, use non-default namespace and different names -# for non-namespaced entities like the ClusterRole -# - decide whether the deployment replicates the external CSI -# attacher, in which case leadership election must be enabled; -# this influences the RBAC setup, see below - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: csi-attacher - # replace with non-default namespace name - namespace: dlf - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/provisioner-rbac.yaml -# This YAML file contains all RBAC objects that are necessary to run external -# CSI provisioner. -# -# In production, each CSI driver deployment has to be customized: -# - to avoid conflicts, use non-default namespace and different names -# for non-namespaced entities like the ClusterRole -# - decide whether the deployment replicates the external CSI -# provisioner, in which case leadership election must be enabled; -# this influences the RBAC setup, see below - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: csi-provisioner - # replace with non-default namespace name - namespace: dlf - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/rbac/service_account.yaml -apiVersion: v1 -kind: ServiceAccount -metadata: - name: dataset-operator - labels: - helm.sh/chart: dataset-operator-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/secrets/server-tls.yaml -apiVersion: v1 -kind: Secret -metadata: - labels: - app.kubernetes.io/name: dlf - name: webhook-server-tls - namespace: dlf -type: kubernetes.io/tls -data: - tls.crt: YmFyCg== - tls.key: YmFyCg== ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/storageclass.yaml -kind: StorageClass -apiVersion: storage.k8s.io/v1 -metadata: - name: csi-s3 - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -provisioner: ch.ctrox.csi.s3-driver -parameters: - # specify which mounter to use - # can be set to s3fs, goofys - # OTHER OPTIONS NOT WORKING! - mounter: goofys - - csi.storage.k8s.io/provisioner-secret-name: ${pvc.name} - csi.storage.k8s.io/provisioner-secret-namespace: ${pvc.namespace} - - csi.storage.k8s.io/controller-publish-secret-name: ${pvc.name} - csi.storage.k8s.io/controller-publish-secret-namespace: ${pvc.namespace} - - csi.storage.k8s.io/node-stage-secret-name: ${pvc.name} - csi.storage.k8s.io/node-stage-secret-namespace: ${pvc.namespace} - - csi.storage.k8s.io/node-publish-secret-name: ${pvc.name} - csi.storage.k8s.io/node-publish-secret-namespace: ${pvc.namespace} ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/crds/com.ie.ibm.hpsys_datasetinternals_crd.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.8.0 - creationTimestamp: null - name: datasetsinternal.datashim.io -spec: - group: datashim.io - names: - kind: DatasetInternal - listKind: DatasetInternalList - plural: datasetsinternal - singular: datasetinternal - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: DatasetInternal is the Schema for the datasetsinternal API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: DatasetSpec defines the desired state of Dataset - properties: - extract: - type: string - format: - type: string - local: - additionalProperties: - type: string - description: Foo is an example field of Dataset. Edit dataset_types.go - to remove/update - type: object - remote: - additionalProperties: - type: string - type: object - type: - description: TODO temp definition for archive - type: string - url: - type: string - type: object - status: - description: DatasetInternalStatus defines the observed state of DatasetInternal - properties: - caching: - properties: - placements: - properties: - datalocations: - items: - properties: - key: - type: string - value: - type: string - type: object - type: array - gateways: - items: - properties: - key: - type: string - value: - type: string - type: object - type: array - type: object - type: object - type: object - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/crds/com.ie.ibm.hpsys_datasets_crd.yaml -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - controller-gen.kubebuilder.io/version: v0.8.0 - creationTimestamp: null - name: datasets.datashim.io -spec: - group: datashim.io - names: - kind: Dataset - listKind: DatasetList - plural: datasets - singular: dataset - scope: Namespaced - versions: - - name: v1alpha1 - schema: - openAPIV3Schema: - description: Dataset is the Schema for the datasets API - properties: - apiVersion: - description: 'APIVersion defines the versioned schema of this representation - of an object. Servers should convert recognized schemas to the latest - internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' - type: string - kind: - description: 'Kind is a string value representing the REST resource this - object represents. Servers may infer this from the endpoint the client - submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' - type: string - metadata: - type: object - spec: - description: DatasetSpec defines the desired state of Dataset - properties: - extract: - type: string - format: - type: string - local: - additionalProperties: - type: string - description: Foo is an example field of Dataset. Edit dataset_types.go - to remove/update - type: object - remote: - additionalProperties: - type: string - type: object - type: - description: TODO temp definition for archive - type: string - url: - type: string - type: object - status: - description: DatasetStatus defines the observed state of Dataset - properties: - caching: - properties: - info: - type: string - status: - type: string - type: object - provision: - properties: - info: - type: string - status: - type: string - type: object - type: object - type: object - served: true - storage: true - subresources: - status: {} -status: - acceptedNames: - kind: "" - plural: "" - conditions: [] - storedVersions: [] ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-attacher-rbac.yaml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: external-attacher-runner-nfs - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "watch"] - - apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments"] - verbs: ["get", "list", "watch", "update", "patch"] ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-nodeplugin-rbac.yaml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-nodeplugin - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments"] - verbs: ["get", "list", "watch", "update"] ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/csi-s3.yaml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-s3 - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "update"] - - apiGroups: [""] - resources: ["namespaces"] - verbs: ["get", "list"] - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments"] - verbs: ["get", "list", "watch", "update","create"] ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/attacher-rbac.yaml -# Attacher must be able to work with PVs, CSINodes and VolumeAttachments -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: external-attacher-runner - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -rules: - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "update", "patch"] #Adding "update" - - apiGroups: ["storage.k8s.io"] - resources: ["csinodes"] - verbs: ["get", "list", "watch"] - - apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments"] - verbs: ["get", "list", "watch", "update", "patch", "create"] #Adding "update" - - apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments/status"] - verbs: ["patch"] -#Secret permission is optional. -#Enable it if you need value from secret. -#For example, you have key `csi.storage.k8s.io/controller-publish-secret-name` in StorageClass.parameters -#see https://kubernetes-csi.github.io/docs/secrets-and-credentials.html -# - apiGroups: [""] -# resources: ["secrets"] -# verbs: ["get", "list"] ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/provisioner-rbac.yaml -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: external-provisioner-runner - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -rules: - # The following rule should be uncommented for plugins that require secrets - # for provisioning. #Enabling secrets - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "list"] - - apiGroups: [""] - resources: ["persistentvolumes"] - verbs: ["get", "list", "watch", "create", "delete"] - - apiGroups: [""] - resources: ["persistentvolumeclaims"] - verbs: ["get", "list", "watch", "update"] - - apiGroups: ["storage.k8s.io"] - resources: ["storageclasses"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["events"] - verbs: ["list", "watch", "create", "update", "patch"] - - apiGroups: ["snapshot.storage.k8s.io"] - resources: ["volumesnapshots"] - verbs: ["get", "list"] - - apiGroups: ["snapshot.storage.k8s.io"] - resources: ["volumesnapshotcontents"] - verbs: ["get", "list"] - - apiGroups: ["storage.k8s.io"] - resources: ["csinodes"] - verbs: ["get", "list", "watch"] - - apiGroups: [""] - resources: ["nodes"] - verbs: ["get", "list", "watch"] - # Access to volumeattachments is only needed when the CSI driver - # has the PUBLISH_UNPUBLISH_VOLUME controller capability. - # In that case, external-provisioner will watch volumeattachments - # to determine when it is safe to delete a volume. - - apiGroups: ["storage.k8s.io"] - resources: ["volumeattachments"] - verbs: ["get", "list", "watch","create"] ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/rbac/role.yaml -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - creationTimestamp: null - name: dataset-operator - labels: - helm.sh/chart: dataset-operator-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -rules: -- apiGroups: - - "" - resources: - - pods - - services - - endpoints - - persistentvolumeclaims - - persistentvolumes - - events - - configmaps - - secrets - verbs: - - '*' -- apiGroups: - - apps - resources: - - deployments - - daemonsets - - replicasets - - statefulsets - verbs: - - '*' -- apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - - create -- apiGroups: - - apps - resourceNames: - - dataset-operator - resources: - - deployments/finalizers - verbs: - - update -- apiGroups: - - "" - resources: - - pods - verbs: - - get -- apiGroups: - - apps - resources: - - replicasets - verbs: - - get -- apiGroups: - - datashim.io - resources: - - '*' - - datasetsinternal - - datasets - verbs: - - '*' -- apiGroups: - - storage.k8s.io - resources: - - '*' - verbs: - - '*' -- apiGroups: - - objectbucket.io - resources: - - '*' - verbs: - - '*' -- apiGroups: - - admissionregistration.k8s.io - resources: - - mutatingwebhookconfigurations - verbs: - - '*' -- apiGroups: ["batch", "extensions"] - resources: ["jobs"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-attacher-rbac.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-attacher-role-nfs - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -subjects: - - kind: ServiceAccount - name: csi-attacher-nfs - namespace: dlf -roleRef: - kind: ClusterRole - name: external-attacher-runner-nfs - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-nodeplugin-rbac.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-nodeplugin - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -subjects: - - kind: ServiceAccount - name: csi-nodeplugin - namespace: dlf -roleRef: - kind: ClusterRole - name: csi-nodeplugin - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/csi-s3.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-s3 - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -subjects: - - kind: ServiceAccount - name: csi-s3 - namespace: dlf -roleRef: - kind: ClusterRole - name: csi-s3 - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/attacher-rbac.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-attacher-role - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -subjects: - - kind: ServiceAccount - name: csi-attacher - # replace with non-default namespace name - namespace: dlf -roleRef: - kind: ClusterRole - name: external-attacher-runner - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/provisioner-rbac.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-provisioner-role - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -subjects: - - kind: ServiceAccount - name: csi-provisioner - # replace with non-default namespace name - namespace: dlf -roleRef: - kind: ClusterRole - name: external-provisioner-runner - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/rbac/role_binding.yaml -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: dataset-operator - labels: - helm.sh/chart: dataset-operator-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -subjects: -- kind: ServiceAccount - name: dataset-operator - namespace: dlf -roleRef: - kind: ClusterRole - name: dataset-operator - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/attacher-rbac.yaml -# Attacher must be able to work with configmaps or leases in the current namespace -# if (and only if) leadership election is enabled -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - # replace with non-default namespace name - namespace: dlf - name: external-attacher-cfg - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -rules: - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch", "list", "delete", "update", "create"] ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/provisioner-rbac.yaml -# Provisioner must be able to work with endpoints in current namespace -# if (and only if) leadership election is enabled -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - # replace with non-default namespace name - namespace: dlf - name: external-provisioner-cfg - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -rules: - # Only one of the following rules for endpoints or leases is required based on - # what is set for `--leader-election-type`. Endpoints are deprecated in favor of Leases. - - apiGroups: [""] - resources: ["endpoints"] - verbs: ["get", "watch", "list", "delete", "update", "create"] - - apiGroups: ["coordination.k8s.io"] - resources: ["leases"] - verbs: ["get", "watch", "list", "delete", "update", "create"] - # Permissions for CSIStorageCapacity are only needed enabling the publishing - # of storage capacity information. - - apiGroups: ["storage.k8s.io"] - resources: ["csistoragecapacities"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] - # The GET permissions below are needed for walking up the ownership chain - # for CSIStorageCapacity. They are sufficient for deployment via - # StatefulSet (only needs to get Pod) and Deployment (needs to get - # Pod and then ReplicaSet to find the Deployment). - - apiGroups: [""] - resources: ["pods"] - verbs: ["get"] - - apiGroups: ["apps"] - resources: ["replicasets"] - verbs: ["get"] ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/attacher-rbac.yaml -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-attacher-role-cfg - # replace with non-default namespace name - namespace: dlf - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -subjects: - - kind: ServiceAccount - name: csi-attacher - # replace with non-default namespace name - namespace: dlf -roleRef: - kind: Role - name: external-attacher-cfg - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/csi-sidecars-rbac/templates/provisioner-rbac.yaml -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: csi-provisioner-role-cfg - # replace with non-default namespace name - namespace: dlf - labels: - helm.sh/chart: csi-sidecars-rbac-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -subjects: - - kind: ServiceAccount - name: csi-provisioner - # replace with non-default namespace name - namespace: dlf -roleRef: - kind: Role - name: external-provisioner-cfg - apiGroup: rbac.authorization.k8s.io ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-attacher-nfsplugin.yaml -# This YAML file contains attacher & csi driver API objects that are necessary -# to run external CSI attacher for nfs -kind: Service -apiVersion: v1 -metadata: - name: csi-attacher-nfsplugin - namespace: dlf - labels: - app: csi-attacher-nfsplugin - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -spec: - selector: - app: csi-attacher-nfsplugin - ports: - - name: dummy - port: 12345 ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/attacher.yaml -# needed for StatefulSet -kind: Service -apiVersion: v1 -metadata: - name: csi-attacher-s3 - namespace: dlf - labels: - app: csi-attacher-s3 - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -spec: - selector: - app: csi-attacher-s3 - ports: - - name: dummy - port: 12345 ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/provisioner.yaml -kind: Service -apiVersion: v1 -metadata: - name: csi-provisioner-s3 - namespace: dlf - labels: - app: csi-provisioner-s3 - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -spec: - selector: - app: csi-provisioner-s3 - ports: - - name: dummy - port: 12345 ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/apps/operator.yaml -apiVersion: v1 -kind: Service -metadata: - name: webhook-server - labels: - helm.sh/chart: dataset-operator-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -spec: - ports: - - port: 443 - protocol: TCP - targetPort: webhook-api - selector: - name: dataset-operator ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-nodeplugin-nfsplugin.yaml -# This YAML file contains driver-registrar & csi driver nodeplugin API objects -# that are necessary to run CSI nodeplugin for nfs -kind: DaemonSet -apiVersion: apps/v1 -metadata: - name: csi-nodeplugin-nfsplugin - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -spec: - selector: - matchLabels: - app: csi-nodeplugin-nfsplugin - template: - metadata: - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - app: csi-nodeplugin-nfsplugin - spec: - serviceAccountName: csi-nodeplugin - hostNetwork: true - containers: - - name: node-driver-registrar - image: "k8s.gcr.io/sig-storage/csi-node-driver-registrar:v2.3.0" - lifecycle: - preStop: - exec: - command: ["/bin/sh", "-c", "rm -rf /registration/csi-nfsplugin /registration/csi-nfsplugin-reg.sock"] - args: - - --v=10 - - --csi-address=/plugin/csi.sock - - --kubelet-registration-path=/var/lib/kubelet/plugins/csi-nfsplugin/csi.sock - env: - - name: KUBE_NODE_NAME - valueFrom: - fieldRef: - fieldPath: spec.nodeName - volumeMounts: - - name: plugin-dir - mountPath: /plugin - - name: registration-dir - mountPath: /registration - - name: nfs - securityContext: - privileged: true - capabilities: - add: ["SYS_ADMIN"] - allowPrivilegeEscalation: true - image: "quay.io/datashim-io/csi-nfs:latest" - args : - - "--nodeid=$(NODE_ID)" - - "--endpoint=$(CSI_ENDPOINT)" - env: - - name: NODE_ID - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: CSI_ENDPOINT - value: unix://plugin/csi.sock - imagePullPolicy: "Always" - volumeMounts: - - name: plugin-dir - mountPath: /plugin - - name: pods-mount-dir - mountPath: /var/lib/kubelet/pods - mountPropagation: "Bidirectional" - volumes: - - name: plugin-dir - hostPath: - path: /var/lib/kubelet/plugins/csi-nfsplugin - type: DirectoryOrCreate - - name: pods-mount-dir - hostPath: - path: /var/lib/kubelet/pods - type: Directory - - hostPath: - path: /var/lib/kubelet/plugins_registry - type: Directory - name: registration-dir ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/csi-s3.yaml -kind: DaemonSet -apiVersion: apps/v1 -metadata: - name: csi-s3 - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -spec: - selector: - matchLabels: - app: csi-s3 - template: - metadata: - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - app: csi-s3 - spec: - serviceAccountName: csi-s3 - containers: - - name: driver-registrar - image: "k8s.gcr.io/sig-storage/csi-node-driver-registrar:v2.3.0" - imagePullPolicy: Always - args: - - --v=5 - - --csi-address=/csi/csi.sock - - --kubelet-registration-path=/var/lib/kubelet/plugins/csi-s3/csi.sock - securityContext: - # This is necessary only for systems with SELinux, where - # non-privileged sidecar containers cannot access unix domain socket - # created by privileged CSI driver container. - privileged: false - env: - - name: KUBE_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - volumeMounts: - - mountPath: /csi - name: socket-dir - - mountPath: /registration - name: registration-dir - - name: csi-s3 - image: "quay.io/datashim-io/csi-s3:latest" - imagePullPolicy: Always - args: - - "--v=5" - - "--endpoint=$(CSI_ENDPOINT)" - - "--nodeid=$(KUBE_NODE_NAME)" - env: - - name: CSI_ENDPOINT - value: unix:///csi/csi.sock - - name: KUBE_NODE_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.nodeName - - name: cheap - value: "off" - securityContext: - privileged: true - # ports: - # - containerPort: 9898 - # name: healthz - # protocol: TCP - # TODO make it configurable and build it for ppc64le - # livenessProbe: - # failureThreshold: 5 - # httpGet: - # path: /healthz - # port: healthz - # initialDelaySeconds: 10 - # timeoutSeconds: 3 - # periodSeconds: 2 - volumeMounts: - - mountPath: /csi - name: socket-dir - - mountPath: /var/lib/kubelet/pods - mountPropagation: Bidirectional - name: mountpoint-dir - - mountPath: /dev - name: dev-dir - ##TODO make it configurable and build it for ppc64le - # - name: liveness-probe - # volumeMounts: - # - mountPath: /csi - # name: socket-dir - # image: quay.io/k8scsi/livenessprobe:v1.1.0 - # args: - # - --csi-address=/csi/csi.sock - # - --health-port=9898 - volumes: - - hostPath: - path: /var/lib/kubelet/plugins/csi-s3 - type: DirectoryOrCreate - name: socket-dir - - hostPath: - path: /var/lib/kubelet/pods - type: DirectoryOrCreate - name: mountpoint-dir - - hostPath: - path: /var/lib/kubelet/plugins_registry - type: Directory - name: registration-dir - - hostPath: - path: /dev - type: Directory - name: dev-dir ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/apps/operator.yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: dataset-operator - labels: - helm.sh/chart: dataset-operator-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -spec: - replicas: 1 - selector: - matchLabels: - name: dataset-operator - template: - metadata: - annotations: - sidecar.istio.io/inject: "false" - labels: - name: dataset-operator - helm.sh/chart: dataset-operator-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - spec: - serviceAccountName: dataset-operator - initContainers: - - name: generate-keys - image: "quay.io/datashim-io/generate-keys:latest" - imagePullPolicy: Always - env: - - name: DATASET_OPERATOR_NAMESPACE - value: dlf - containers: - - name: dataset-operator - # Replace this with the built image name - image: "quay.io/datashim-io/dataset-operator:latest" - command: - - /manager - imagePullPolicy: Always - ports: - - containerPort: 9443 - name: webhook-api - env: - - name: WATCH_NAMESPACE - value: "" - - name: POD_NAME - valueFrom: - fieldRef: - fieldPath: metadata.name - - name: OPERATOR_NAME - value: "dataset-operator" - - name: OPERATOR_NAMESPACE - valueFrom: - fieldRef: - fieldPath: metadata.namespace - volumeMounts: - - name: webhook-tls-certs - mountPath: /tmp/k8s-webhook-server/serving-certs - readOnly: true - volumes: - - name: webhook-tls-certs - secret: - secretName: webhook-server-tls ---- -# Source: datashim-charts/charts/csi-nfs-chart/templates/csi-attacher-nfsplugin.yaml -kind: StatefulSet -apiVersion: apps/v1 -metadata: - name: csi-attacher-nfsplugin - namespace: dlf - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -spec: - selector: - matchLabels: - app: csi-attacher-nfsplugin - serviceName: "csi-attacher-nfsplugin" - replicas: 1 - template: - metadata: - labels: - helm.sh/chart: csi-nfs-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - app: csi-attacher-nfsplugin - spec: - serviceAccountName: csi-attacher-nfs - containers: - - name: csi-attacher - image: "k8s.gcr.io/sig-storage/csi-attacher:v3.3.0" - args: - - "--v=10" - - "--csi-address=$(ADDRESS)" - env: - - name: ADDRESS - value: /csi/csi.sock - imagePullPolicy: Always - volumeMounts: - - name: socket-dir - mountPath: /csi - - name: nfs - image: "quay.io/datashim-io/csi-nfs:latest" - args : - - "--nodeid=$(NODE_ID)" - - "--endpoint=$(CSI_ENDPOINT)" - env: - - name: NODE_ID - valueFrom: - fieldRef: - fieldPath: spec.nodeName - - name: CSI_ENDPOINT - value: unix://plugin/csi.sock - imagePullPolicy: Always - volumeMounts: - - name: socket-dir - mountPath: /plugin - volumes: - - name: socket-dir - emptyDir: {} ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/attacher.yaml -kind: StatefulSet -apiVersion: apps/v1 -metadata: - name: csi-attacher-s3 - namespace: dlf - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf -spec: - serviceName: "csi-attacher-s3" - replicas: 1 - selector: - matchLabels: - app: csi-attacher-s3 - template: - metadata: - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - app: csi-attacher-s3 - spec: - serviceAccountName: csi-attacher - containers: - - name: csi-attacher - image: "k8s.gcr.io/sig-storage/csi-attacher:v3.3.0" - imagePullPolicy: Always - args: - - --v=5 - - --csi-address=/csi/csi.sock - securityContext: - # This is necessary only for systems with SELinux, where - # non-privileged sidecar containers cannot access unix domain socket - # created by privileged CSI driver container. - privileged: true - volumeMounts: - - mountPath: /csi - name: socket-dir - - volumes: - - hostPath: - path: /var/lib/kubelet/plugins/csi-s3 - type: DirectoryOrCreate - name: socket-dir ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/provisioner.yaml -kind: StatefulSet -apiVersion: apps/v1 -metadata: - name: csi-provisioner-s3 - labels: - helm.sh/chart: csi-s3-chart-0.1.0 - app.kubernetes.io/name: datashim - app.kubernetes.io/instance: default - app.kubernetes.io/managed-by: Helm - meta.helm.sh/release-name: default - meta.helm.sh/release-namespace: dlf - namespace: dlf -spec: - serviceName: "csi-provisioner-s3" - replicas: 1 - selector: - matchLabels: - app: csi-provisioner-s3 - template: - metadata: - labels: - app: csi-provisioner-s3 - spec: - serviceAccountName: csi-provisioner - containers: - - name: csi-provisioner - image: "k8s.gcr.io/sig-storage/csi-provisioner:v2.2.2" - imagePullPolicy: Always - args: - - -v=5 - - --csi-address=/csi/csi.sock - - --feature-gates=Topology=true - securityContext: - # This is necessary only for systems with SELinux, where - # non-privileged sidecar containers cannot access unix domain socket - # created by privileged CSI driver container. - privileged: true - volumeMounts: - - mountPath: /csi - name: socket-dir - volumes: - - hostPath: - path: /var/lib/kubelet/plugins/csi-s3 - type: DirectoryOrCreate - name: socket-dir ---- -# Source: datashim-charts/charts/csi-s3-chart/templates/driver.yaml -apiVersion: storage.k8s.io/v1 -kind: CSIDriver -metadata: - name: ch.ctrox.csi.s3-driver -spec: - attachRequired: false - podInfoOnMount: false - volumeLifecycleModes: - - Persistent -# - Ephemeral ---- -# Source: datashim-charts/charts/dataset-operator-chart/templates/apps/webhook-definition.yaml -apiVersion: admissionregistration.k8s.io/v1 -kind: MutatingWebhookConfiguration -metadata: - name: dlf-mutating-webhook-cfg diff --git a/homelab/silver-hand/old/cert-manager/cert-manager.issuer.yml b/homelab/silver-hand/old/cert-manager/cert-manager.issuer.yml deleted file mode 100644 index 9c187225..00000000 --- a/homelab/silver-hand/old/cert-manager/cert-manager.issuer.yml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-issuer -spec: - acme: - email: jafner425@gmail.com - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-issuer-account-key - solvers: - - selector: {} - dns01: - cloudflare: - apiTokenSecretRef: - name: cloudflare-token - key: token \ No newline at end of file diff --git a/homelab/silver-hand/old/cert-manager/default-values.yaml b/homelab/silver-hand/old/cert-manager/default-values.yaml deleted file mode 100644 index 7630c048..00000000 --- a/homelab/silver-hand/old/cert-manager/default-values.yaml +++ /dev/null @@ -1,1349 +0,0 @@ -# +docs:section=Global - -# Default values for cert-manager. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. -global: - # Reference to one or more secrets to be used when pulling images. - # For more information, see [Pull an Image from a Private Registry](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). - # - # For example: - # imagePullSecrets: - # - name: "image-pull-secret" - imagePullSecrets: [] - - # Labels to apply to all resources. - # Please note that this does not add labels to the resources created dynamically by the controllers. - # For these resources, you have to add the labels in the template in the cert-manager custom resource: - # For example, podTemplate/ ingressTemplate in ACMEChallengeSolverHTTP01Ingress - # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#acme.cert-manager.io/v1.ACMEChallengeSolverHTTP01Ingress). - # For example, secretTemplate in CertificateSpec - # For more information, see the [cert-manager documentation](https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec). - commonLabels: {} - - # The number of old ReplicaSets to retain to allow rollback (if not set, the default Kubernetes value is set to 10). - # +docs:property - # revisionHistoryLimit: 1 - - # The optional priority class to be used for the cert-manager pods. - priorityClassName: "" - - rbac: - # Create required ClusterRoles and ClusterRoleBindings for cert-manager. - create: true - # Aggregate ClusterRoles to Kubernetes default user-facing roles. For more information, see [User-facing roles](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) - aggregateClusterRoles: true - - podSecurityPolicy: - # Create PodSecurityPolicy for cert-manager. - # - # Note that PodSecurityPolicy was deprecated in Kubernetes 1.21 and removed in Kubernetes 1.25. - enabled: false - # Configure the PodSecurityPolicy to use AppArmor. - useAppArmor: true - - # Set the verbosity of cert-manager. A range of 0 - 6, with 6 being the most verbose. - logLevel: 2 - - leaderElection: - # Override the namespace used for the leader election lease. - namespace: "kube-system" - - # The duration that non-leader candidates will wait after observing a - # leadership renewal until attempting to acquire leadership of a led but - # unrenewed leader slot. This is effectively the maximum duration that a - # leader can be stopped before it is replaced by another candidate. - # +docs:property - # leaseDuration: 60s - - # The interval between attempts by the acting master to renew a leadership - # slot before it stops leading. This must be less than or equal to the - # lease duration. - # +docs:property - # renewDeadline: 40s - - # The duration the clients should wait between attempting acquisition and - # renewal of a leadership. - # +docs:property - # retryPeriod: 15s - -# This option is equivalent to setting crds.enabled=true and crds.keep=true. -# Deprecated: use crds.enabled and crds.keep instead. -installCRDs: false - -crds: - # This option decides if the CRDs should be installed - # as part of the Helm installation. - enabled: false - - # This option makes it so that the "helm.sh/resource-policy": keep - # annotation is added to the CRD. This will prevent Helm from uninstalling - # the CRD when the Helm release is uninstalled. - # WARNING: when the CRDs are removed, all cert-manager custom resources - # (Certificates, Issuers, ...) will be removed too by the garbage collector. - keep: true - -# +docs:section=Controller - -# The number of replicas of the cert-manager controller to run. -# -# The default is 1, but in production set this to 2 or 3 to provide high -# availability. -# -# If `replicas > 1`, consider setting `podDisruptionBudget.enabled=true`. -# -# Note that cert-manager uses leader election to ensure that there can -# only be a single instance active at a time. -replicaCount: 1 - -# Deployment update strategy for the cert-manager controller deployment. -# For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy). -# -# For example: -# strategy: -# type: RollingUpdate -# rollingUpdate: -# maxSurge: 0 -# maxUnavailable: 1 -strategy: {} - -podDisruptionBudget: - # Enable or disable the PodDisruptionBudget resource. - # - # This prevents downtime during voluntary disruptions such as during a Node upgrade. - # For example, the PodDisruptionBudget will block `kubectl drain` - # if it is used on the Node where the only remaining cert-manager - # Pod is currently running. - enabled: false - - # This configures the minimum available pods for disruptions. It can either be set to - # an integer (e.g. 1) or a percentage value (e.g. 25%). - # It cannot be used if `maxUnavailable` is set. - # +docs:property - # minAvailable: 1 - - # This configures the maximum unavailable pods for disruptions. It can either be set to - # an integer (e.g. 1) or a percentage value (e.g. 25%). - # it cannot be used if `minAvailable` is set. - # +docs:property - # maxUnavailable: 1 - -# A comma-separated list of feature gates that should be enabled on the -# controller pod. -featureGates: "" - -# The maximum number of challenges that can be scheduled as 'processing' at once. -maxConcurrentChallenges: 60 - -image: - # The container registry to pull the manager image from. - # +docs:property - # registry: quay.io - - # The container image for the cert-manager controller. - # +docs:property - repository: quay.io/jetstack/cert-manager-controller - - # Override the image tag to deploy by setting this variable. - # If no value is set, the chart's appVersion is used. - # +docs:property - # tag: vX.Y.Z - - # Setting a digest will override any tag. - # +docs:property - # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 - - # Kubernetes imagePullPolicy on Deployment. - pullPolicy: IfNotPresent - -# Override the namespace used to store DNS provider credentials etc. for ClusterIssuer -# resources. By default, the same namespace as cert-manager is deployed within is -# used. This namespace will not be automatically created by the Helm chart. -clusterResourceNamespace: "" - -# This namespace allows you to define where the services are installed into. -# If not set then they use the namespace of the release. -# This is helpful when installing cert manager as a chart dependency (sub chart). -namespace: "" - -serviceAccount: - # Specifies whether a service account should be created. - create: true - - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - # +docs:property - # name: "" - - # Optional additional annotations to add to the controller's Service Account. - # +docs:property - # annotations: {} - - # Optional additional labels to add to the controller's Service Account. - # +docs:property - # labels: {} - - # Automount API credentials for a Service Account. - automountServiceAccountToken: true - -# Automounting API credentials for a particular pod. -# +docs:property -# automountServiceAccountToken: true - -# When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted. -enableCertificateOwnerRef: false - -# This property is used to configure options for the controller pod. -# This allows setting options that would usually be provided using flags. -# An APIVersion and Kind must be specified in your values.yaml file. -# Flags will override options that are set here. -# -# For example: -# config: -# apiVersion: controller.config.cert-manager.io/v1alpha1 -# kind: ControllerConfiguration -# logging: -# verbosity: 2 -# format: text -# leaderElectionConfig: -# namespace: kube-system -# kubernetesAPIQPS: 9000 -# kubernetesAPIBurst: 9000 -# numberOfConcurrentWorkers: 200 -# featureGates: -# AdditionalCertificateOutputFormats: true -# DisallowInsecureCSRUsageDefinition: true -# ExperimentalCertificateSigningRequestControllers: true -# ExperimentalGatewayAPISupport: true -# LiteralCertificateSubject: true -# SecretsFilteredCaching: true -# ServerSideApply: true -# StableCertificateRequestName: true -# UseCertificateRequestBasicConstraints: true -# ValidateCAA: true -# metricsTLSConfig: -# dynamic: -# secretNamespace: "cert-manager" -# secretName: "cert-manager-metrics-ca" -# dnsNames: -# - cert-manager-metrics -# - cert-manager-metrics.cert-manager -# - cert-manager-metrics.cert-manager.svc -config: {} - -# Setting Nameservers for DNS01 Self Check. -# For more information, see the [cert-manager documentation](https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check). - -# A comma-separated string with the host and port of the recursive nameservers cert-manager should query. -dns01RecursiveNameservers: "" - -# Forces cert-manager to use only the recursive nameservers for verification. -# Enabling this option could cause the DNS01 self check to take longer owing to caching performed by the recursive nameservers. -dns01RecursiveNameserversOnly: false - -# Option to disable cert-manager's build-in auto-approver. The auto-approver -# approves all CertificateRequests that reference issuers matching the 'approveSignerNames' -# option. This 'disableAutoApproval' option is useful when you want to make all approval decisions -# using a different approver (like approver-policy - https://github.com/cert-manager/approver-policy). -disableAutoApproval: false - -# List of signer names that cert-manager will approve by default. CertificateRequests -# referencing these signer names will be auto-approved by cert-manager. Defaults to just -# approving the cert-manager.io Issuer and ClusterIssuer issuers. When set to an empty -# array, ALL issuers will be auto-approved by cert-manager. To disable the auto-approval, -# because eg. you are using approver-policy, you can enable 'disableAutoApproval'. -# ref: https://cert-manager.io/docs/concepts/certificaterequest/#approval -# +docs:property -approveSignerNames: -- issuers.cert-manager.io/* -- clusterissuers.cert-manager.io/* - -# Additional command line flags to pass to cert-manager controller binary. -# To see all available flags run `docker run quay.io/jetstack/cert-manager-controller: --help`. -# -# Use this flag to enable or disable arbitrary controllers. For example, to disable the CertificiateRequests approver. -# -# For example: -# extraArgs: -# - --controllers=*,-certificaterequests-approver -extraArgs: [] - -# Additional environment variables to pass to cert-manager controller binary. -extraEnv: [] -# - name: SOME_VAR -# value: 'some value' - -# Resources to provide to the cert-manager controller pod. -# -# For example: -# requests: -# cpu: 10m -# memory: 32Mi -# -# For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). -resources: {} - -# Pod Security Context. -# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). -# +docs:property -securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - -# Container Security Context to be set on the controller component container. -# For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). -# +docs:property -containerSecurityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - -# Additional volumes to add to the cert-manager controller pod. -volumes: [] - -# Additional volume mounts to add to the cert-manager controller container. -volumeMounts: [] - -# Optional additional annotations to add to the controller Deployment. -# +docs:property -# deploymentAnnotations: {} - -# Optional additional annotations to add to the controller Pods. -# +docs:property -# podAnnotations: {} - -# Optional additional labels to add to the controller Pods. -podLabels: {} - -# Optional annotations to add to the controller Service. -# +docs:property -# serviceAnnotations: {} - -# Optional additional labels to add to the controller Service. -# +docs:property -# serviceLabels: {} - -# Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services). -# +docs:property -# serviceIPFamilyPolicy: "" - -# Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6. -# +docs:property -# serviceIPFamilies: [] - -# Optional DNS settings. These are useful if you have a public and private DNS zone for -# the same domain on Route 53. The following is an example of ensuring -# cert-manager can access an ingress or DNS TXT records at all times. -# Note that this requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for -# the cluster to work. - -# Pod DNS policy. -# For more information, see [Pod's DNS Policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy). -# +docs:property -# podDnsPolicy: "None" - -# Pod DNS configuration. The podDnsConfig field is optional and can work with any podDnsPolicy -# settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified. -# For more information, see [Pod's DNS Config](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config). -# +docs:property -# podDnsConfig: -# nameservers: -# - "1.1.1.1" -# - "8.8.8.8" - -# Optional hostAliases for cert-manager-controller pods. May be useful when performing ACME DNS-01 self checks. -hostAliases: [] -# - ip: 127.0.0.1 -# hostnames: -# - foo.local -# - bar.local -# - ip: 10.1.2.3 -# hostnames: -# - foo.remote -# - bar.remote - -# The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with -# matching labels. -# For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). -# -# This default ensures that Pods are only scheduled to Linux nodes. -# It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. -# +docs:property -nodeSelector: - kubernetes.io/os: linux - -# +docs:ignore -ingressShim: {} - - # Optional default issuer to use for ingress resources. - # +docs:property=ingressShim.defaultIssuerName - # defaultIssuerName: "" - - # Optional default issuer kind to use for ingress resources. - # +docs:property=ingressShim.defaultIssuerKind - # defaultIssuerKind: "" - - # Optional default issuer group to use for ingress resources. - # +docs:property=ingressShim.defaultIssuerGroup - # defaultIssuerGroup: "" - -# Use these variables to configure the HTTP_PROXY environment variables. - -# Configures the HTTP_PROXY environment variable where a HTTP proxy is required. -# +docs:property -# http_proxy: "http://proxy:8080" - -# Configures the HTTPS_PROXY environment variable where a HTTP proxy is required. -# +docs:property -# https_proxy: "https://proxy:8080" - -# Configures the NO_PROXY environment variable where a HTTP proxy is required, -# but certain domains should be excluded. -# +docs:property -# no_proxy: 127.0.0.1,localhost - - -# A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core). -# -# For example: -# affinity: -# nodeAffinity: -# requiredDuringSchedulingIgnoredDuringExecution: -# nodeSelectorTerms: -# - matchExpressions: -# - key: foo.bar.com/role -# operator: In -# values: -# - master -affinity: {} - -# A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core). -# -# For example: -# tolerations: -# - key: foo.bar.com/role -# operator: Equal -# value: master -# effect: NoSchedule -tolerations: [] - -# A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core -# -# For example: -# topologySpreadConstraints: -# - maxSkew: 2 -# topologyKey: topology.kubernetes.io/zone -# whenUnsatisfiable: ScheduleAnyway -# labelSelector: -# matchLabels: -# app.kubernetes.io/instance: cert-manager -# app.kubernetes.io/component: controller -topologySpreadConstraints: [] - -# LivenessProbe settings for the controller container of the controller Pod. -# -# This is enabled by default, in order to enable the clock-skew liveness probe that -# restarts the controller in case of a skew between the system clock and the monotonic clock. -# LivenessProbe durations and thresholds are based on those used for the Kubernetes -# controller-manager. For more information see the following on the -# [Kubernetes GitHub repository](https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245) -# +docs:property -livenessProbe: - enabled: true - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 15 - successThreshold: 1 - failureThreshold: 8 - -# enableServiceLinks indicates whether information about services should be -# injected into the pod's environment variables, matching the syntax of Docker -# links. -enableServiceLinks: false - -# +docs:section=Prometheus - -prometheus: - # Enable Prometheus monitoring for the cert-manager controller to use with the - # Prometheus Operator. If this option is enabled without enabling `prometheus.servicemonitor.enabled` or - # `prometheus.podmonitor.enabled`, 'prometheus.io' annotations are added to the cert-manager Deployment - # resources. Additionally, a service is created which can be used together - # with your own ServiceMonitor (managed outside of this Helm chart). - # Otherwise, a ServiceMonitor/ PodMonitor is created. - enabled: true - - servicemonitor: - # Create a ServiceMonitor to add cert-manager to Prometheus. - enabled: false - - # Specifies the `prometheus` label on the created ServiceMonitor. This is - # used when different Prometheus instances have label selectors matching - # different ServiceMonitors. - prometheusInstance: default - - # The target port to set on the ServiceMonitor. This must match the port that the - # cert-manager controller is listening on for metrics. - targetPort: 9402 - - # The path to scrape for metrics. - path: /metrics - - # The interval to scrape metrics. - interval: 60s - - # The timeout before a metrics scrape fails. - scrapeTimeout: 30s - - # Additional labels to add to the ServiceMonitor. - labels: {} - - # Additional annotations to add to the ServiceMonitor. - annotations: {} - - # Keep labels from scraped data, overriding server-side labels. - honorLabels: false - - # EndpointAdditionalProperties allows setting additional properties on the - # endpoint such as relabelings, metricRelabelings etc. - # - # For example: - # endpointAdditionalProperties: - # relabelings: - # - action: replace - # sourceLabels: - # - __meta_kubernetes_pod_node_name - # targetLabel: instance - # - # +docs:property - endpointAdditionalProperties: {} - - # Note that you can not enable both PodMonitor and ServiceMonitor as they are mutually exclusive. Enabling both will result in a error. - podmonitor: - # Create a PodMonitor to add cert-manager to Prometheus. - enabled: false - - # Specifies the `prometheus` label on the created PodMonitor. This is - # used when different Prometheus instances have label selectors matching - # different PodMonitors. - prometheusInstance: default - - # The path to scrape for metrics. - path: /metrics - - # The interval to scrape metrics. - interval: 60s - - # The timeout before a metrics scrape fails. - scrapeTimeout: 30s - - # Additional labels to add to the PodMonitor. - labels: {} - - # Additional annotations to add to the PodMonitor. - annotations: {} - - # Keep labels from scraped data, overriding server-side labels. - honorLabels: false - - # EndpointAdditionalProperties allows setting additional properties on the - # endpoint such as relabelings, metricRelabelings etc. - # - # For example: - # endpointAdditionalProperties: - # relabelings: - # - action: replace - # sourceLabels: - # - __meta_kubernetes_pod_node_name - # targetLabel: instance - # - # +docs:property - endpointAdditionalProperties: {} - -# +docs:section=Webhook - -webhook: - # Number of replicas of the cert-manager webhook to run. - # - # The default is 1, but in production set this to 2 or 3 to provide high - # availability. - # - # If `replicas > 1`, consider setting `webhook.podDisruptionBudget.enabled=true`. - replicaCount: 1 - - # The number of seconds the API server should wait for the webhook to respond before treating the call as a failure. - # The value must be between 1 and 30 seconds. For more information, see - # [Validating webhook configuration v1](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/). - # - # The default is set to the maximum value of 30 seconds as - # users sometimes report that the connection between the K8S API server and - # the cert-manager webhook server times out. - # If *this* timeout is reached, the error message will be "context deadline exceeded", - # which doesn't help the user diagnose what phase of the HTTPS connection timed out. - # For example, it could be during DNS resolution, TCP connection, TLS - # negotiation, HTTP negotiation, or slow HTTP response from the webhook - # server. - # By setting this timeout to its maximum value the underlying timeout error - # message has more chance of being returned to the end user. - timeoutSeconds: 30 - - # This is used to configure options for the webhook pod. - # This allows setting options that would usually be provided using flags. - # An APIVersion and Kind must be specified in your values.yaml file. - # Flags override options that are set here. - # - # For example: - # apiVersion: webhook.config.cert-manager.io/v1alpha1 - # kind: WebhookConfiguration - # # The port that the webhook listens on for requests. - # # In GKE private clusters, by default Kubernetes apiservers are allowed to - # # talk to the cluster nodes only on 443 and 10250. Configuring - # # securePort: 10250 therefore will work out-of-the-box without needing to add firewall - # # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000. - # # This should be uncommented and set as a default by the chart once - # # the apiVersion of WebhookConfiguration graduates beyond v1alpha1. - # securePort: 10250 - config: {} - - # The update strategy for the cert-manager webhook deployment. - # For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) - # - # For example: - # strategy: - # type: RollingUpdate - # rollingUpdate: - # maxSurge: 0 - # maxUnavailable: 1 - strategy: {} - - # Pod Security Context to be set on the webhook component Pod. - # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). - # +docs:property - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - - # Container Security Context to be set on the webhook component container. - # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). - # +docs:property - containerSecurityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - - podDisruptionBudget: - # Enable or disable the PodDisruptionBudget resource. - # - # This prevents downtime during voluntary disruptions such as during a Node upgrade. - # For example, the PodDisruptionBudget will block `kubectl drain` - # if it is used on the Node where the only remaining cert-manager - # Pod is currently running. - enabled: false - - # This property configures the minimum available pods for disruptions. Can either be set to - # an integer (e.g. 1) or a percentage value (e.g. 25%). - # It cannot be used if `maxUnavailable` is set. - # +docs:property - # minAvailable: 1 - - # This property configures the maximum unavailable pods for disruptions. Can either be set to - # an integer (e.g. 1) or a percentage value (e.g. 25%). - # It cannot be used if `minAvailable` is set. - # +docs:property - # maxUnavailable: 1 - - # Optional additional annotations to add to the webhook Deployment. - # +docs:property - # deploymentAnnotations: {} - - # Optional additional annotations to add to the webhook Pods. - # +docs:property - # podAnnotations: {} - - # Optional additional annotations to add to the webhook Service. - # +docs:property - # serviceAnnotations: {} - - # Optional additional annotations to add to the webhook MutatingWebhookConfiguration. - # +docs:property - # mutatingWebhookConfigurationAnnotations: {} - - # Optional additional annotations to add to the webhook ValidatingWebhookConfiguration. - # +docs:property - # validatingWebhookConfigurationAnnotations: {} - - validatingWebhookConfiguration: - # Configure spec.namespaceSelector for validating webhooks. - # +docs:property - namespaceSelector: - matchExpressions: - - key: "cert-manager.io/disable-validation" - operator: "NotIn" - values: - - "true" - - mutatingWebhookConfiguration: - # Configure spec.namespaceSelector for mutating webhooks. - # +docs:property - namespaceSelector: {} - # matchLabels: - # key: value - # matchExpressions: - # - key: kubernetes.io/metadata.name - # operator: NotIn - # values: - # - kube-system - - - # Additional command line flags to pass to cert-manager webhook binary. - # To see all available flags run `docker run quay.io/jetstack/cert-manager-webhook: --help`. - extraArgs: [] - # Path to a file containing a WebhookConfiguration object used to configure the webhook. - # - --config= - - # Comma separated list of feature gates that should be enabled on the - # webhook pod. - featureGates: "" - - # Resources to provide to the cert-manager webhook pod. - # - # For example: - # requests: - # cpu: 10m - # memory: 32Mi - # - # For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). - resources: {} - - # Liveness probe values. - # For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). - # - # +docs:property - livenessProbe: - failureThreshold: 3 - initialDelaySeconds: 60 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - - # Readiness probe values. - # For more information, see [Container probes](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). - # - # +docs:property - readinessProbe: - failureThreshold: 3 - initialDelaySeconds: 5 - periodSeconds: 5 - successThreshold: 1 - timeoutSeconds: 1 - - # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with - # matching labels. - # For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). - # - # This default ensures that Pods are only scheduled to Linux nodes. - # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. - # +docs:property - nodeSelector: - kubernetes.io/os: linux - - # A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core). - # - # For example: - # affinity: - # nodeAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # nodeSelectorTerms: - # - matchExpressions: - # - key: foo.bar.com/role - # operator: In - # values: - # - master - affinity: {} - - # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core). - # - # For example: - # tolerations: - # - key: foo.bar.com/role - # operator: Equal - # value: master - # effect: NoSchedule - tolerations: [] - - # A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core). - # - # For example: - # topologySpreadConstraints: - # - maxSkew: 2 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: ScheduleAnyway - # labelSelector: - # matchLabels: - # app.kubernetes.io/instance: cert-manager - # app.kubernetes.io/component: controller - topologySpreadConstraints: [] - - # Optional additional labels to add to the Webhook Pods. - podLabels: {} - - # Optional additional labels to add to the Webhook Service. - serviceLabels: {} - - # Optionally set the IP family policy for the controller Service to configure dual-stack; see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services). - serviceIPFamilyPolicy: "" - - # Optionally set the IP families for the controller Service that should be supported, in the order in which they should be applied to ClusterIP. Can be IPv4 and/or IPv6. - serviceIPFamilies: [] - - image: - # The container registry to pull the webhook image from. - # +docs:property - # registry: quay.io - - # The container image for the cert-manager webhook - # +docs:property - repository: quay.io/jetstack/cert-manager-webhook - - # Override the image tag to deploy by setting this variable. - # If no value is set, the chart's appVersion will be used. - # +docs:property - # tag: vX.Y.Z - - # Setting a digest will override any tag - # +docs:property - # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 - - # Kubernetes imagePullPolicy on Deployment. - pullPolicy: IfNotPresent - - serviceAccount: - # Specifies whether a service account should be created. - create: true - - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - # +docs:property - # name: "" - - # Optional additional annotations to add to the controller's Service Account. - # +docs:property - # annotations: {} - - # Optional additional labels to add to the webhook's Service Account. - # +docs:property - # labels: {} - - # Automount API credentials for a Service Account. - automountServiceAccountToken: true - - # Automounting API credentials for a particular pod. - # +docs:property - # automountServiceAccountToken: true - - # The port that the webhook listens on for requests. - # In GKE private clusters, by default Kubernetes apiservers are allowed to - # talk to the cluster nodes only on 443 and 10250. Configuring - # securePort: 10250, therefore will work out-of-the-box without needing to add firewall - # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000. - securePort: 10250 - - # Specifies if the webhook should be started in hostNetwork mode. - # - # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom - # CNI (such as calico), because control-plane managed by AWS cannot communicate - # with pods' IP CIDR and admission webhooks are not working - # - # Since the default port for the webhook conflicts with kubelet on the host - # network, `webhook.securePort` should be changed to an available port if - # running in hostNetwork mode. - hostNetwork: false - - # Specifies how the service should be handled. Useful if you want to expose the - # webhook outside of the cluster. In some cases, the control plane cannot - # reach internal services. - serviceType: ClusterIP - - # Specify the load balancer IP for the created service. - # +docs:property - # loadBalancerIP: "10.10.10.10" - - # Overrides the mutating webhook and validating webhook so they reach the webhook - # service using the `url` field instead of a service. - url: {} - # host: - - # Enables default network policies for webhooks. - networkPolicy: - # Create network policies for the webhooks. - enabled: false - - # Ingress rule for the webhook network policy. By default, it allows all - # inbound traffic. - # +docs:property - ingress: - - from: - - ipBlock: - cidr: 0.0.0.0/0 - - # Egress rule for the webhook network policy. By default, it allows all - # outbound traffic to ports 80 and 443, as well as DNS ports. - # +docs:property - egress: - - ports: - - port: 80 - protocol: TCP - - port: 443 - protocol: TCP - - port: 53 - protocol: TCP - - port: 53 - protocol: UDP - # On OpenShift and OKD, the Kubernetes API server listens on. - # port 6443. - - port: 6443 - protocol: TCP - to: - - ipBlock: - cidr: 0.0.0.0/0 - - # Additional volumes to add to the cert-manager controller pod. - volumes: [] - - # Additional volume mounts to add to the cert-manager controller container. - volumeMounts: [] - - # enableServiceLinks indicates whether information about services should be - # injected into the pod's environment variables, matching the syntax of Docker - # links. - enableServiceLinks: false - -# +docs:section=CA Injector - -cainjector: - # Create the CA Injector deployment - enabled: true - - # The number of replicas of the cert-manager cainjector to run. - # - # The default is 1, but in production set this to 2 or 3 to provide high - # availability. - # - # If `replicas > 1`, consider setting `cainjector.podDisruptionBudget.enabled=true`. - # - # Note that cert-manager uses leader election to ensure that there can - # only be a single instance active at a time. - replicaCount: 1 - - # This is used to configure options for the cainjector pod. - # It allows setting options that are usually provided via flags. - # An APIVersion and Kind must be specified in your values.yaml file. - # Flags override options that are set here. - # - # For example: - # apiVersion: cainjector.config.cert-manager.io/v1alpha1 - # kind: CAInjectorConfiguration - # logging: - # verbosity: 2 - # format: text - # leaderElectionConfig: - # namespace: kube-system - config: {} - - # Deployment update strategy for the cert-manager cainjector deployment. - # For more information, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy). - # - # For example: - # strategy: - # type: RollingUpdate - # rollingUpdate: - # maxSurge: 0 - # maxUnavailable: 1 - strategy: {} - - # Pod Security Context to be set on the cainjector component Pod - # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). - # +docs:property - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - - # Container Security Context to be set on the cainjector component container - # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). - # +docs:property - containerSecurityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - - podDisruptionBudget: - # Enable or disable the PodDisruptionBudget resource. - # - # This prevents downtime during voluntary disruptions such as during a Node upgrade. - # For example, the PodDisruptionBudget will block `kubectl drain` - # if it is used on the Node where the only remaining cert-manager - # Pod is currently running. - enabled: false - - # `minAvailable` configures the minimum available pods for disruptions. It can either be set to - # an integer (e.g. 1) or a percentage value (e.g. 25%). - # Cannot be used if `maxUnavailable` is set. - # +docs:property - # minAvailable: 1 - - # `maxUnavailable` configures the maximum unavailable pods for disruptions. It can either be set to - # an integer (e.g. 1) or a percentage value (e.g. 25%). - # Cannot be used if `minAvailable` is set. - # +docs:property - # maxUnavailable: 1 - - # Optional additional annotations to add to the cainjector Deployment. - # +docs:property - # deploymentAnnotations: {} - - # Optional additional annotations to add to the cainjector Pods. - # +docs:property - # podAnnotations: {} - - # Additional command line flags to pass to cert-manager cainjector binary. - # To see all available flags run `docker run quay.io/jetstack/cert-manager-cainjector: --help`. - extraArgs: [] - # Enable profiling for cainjector. - # - --enable-profiling=true - - # Comma separated list of feature gates that should be enabled on the - # cainjector pod. - featureGates: "" - - # Resources to provide to the cert-manager cainjector pod. - # - # For example: - # requests: - # cpu: 10m - # memory: 32Mi - # - # For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). - resources: {} - - - # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with - # matching labels. - # For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). - # - # This default ensures that Pods are only scheduled to Linux nodes. - # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. - # +docs:property - nodeSelector: - kubernetes.io/os: linux - - # A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core). - # - # For example: - # affinity: - # nodeAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # nodeSelectorTerms: - # - matchExpressions: - # - key: foo.bar.com/role - # operator: In - # values: - # - master - affinity: {} - - # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core). - # - # For example: - # tolerations: - # - key: foo.bar.com/role - # operator: Equal - # value: master - # effect: NoSchedule - tolerations: [] - - # A list of Kubernetes TopologySpreadConstraints, if required. For more information, see [Topology spread constraint v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core). - # - # For example: - # topologySpreadConstraints: - # - maxSkew: 2 - # topologyKey: topology.kubernetes.io/zone - # whenUnsatisfiable: ScheduleAnyway - # labelSelector: - # matchLabels: - # app.kubernetes.io/instance: cert-manager - # app.kubernetes.io/component: controller - topologySpreadConstraints: [] - - # Optional additional labels to add to the CA Injector Pods. - podLabels: {} - - image: - # The container registry to pull the cainjector image from. - # +docs:property - # registry: quay.io - - # The container image for the cert-manager cainjector - # +docs:property - repository: quay.io/jetstack/cert-manager-cainjector - - # Override the image tag to deploy by setting this variable. - # If no value is set, the chart's appVersion will be used. - # +docs:property - # tag: vX.Y.Z - - # Setting a digest will override any tag. - # +docs:property - # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 - - # Kubernetes imagePullPolicy on Deployment. - pullPolicy: IfNotPresent - - serviceAccount: - # Specifies whether a service account should be created. - create: true - - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template - # +docs:property - # name: "" - - # Optional additional annotations to add to the controller's Service Account. - # +docs:property - # annotations: {} - - # Optional additional labels to add to the cainjector's Service Account. - # +docs:property - # labels: {} - - # Automount API credentials for a Service Account. - automountServiceAccountToken: true - - # Automounting API credentials for a particular pod. - # +docs:property - # automountServiceAccountToken: true - - # Additional volumes to add to the cert-manager controller pod. - volumes: [] - - # Additional volume mounts to add to the cert-manager controller container. - volumeMounts: [] - - # enableServiceLinks indicates whether information about services should be - # injected into the pod's environment variables, matching the syntax of Docker - # links. - enableServiceLinks: false - -# +docs:section=ACME Solver - -acmesolver: - image: - # The container registry to pull the acmesolver image from. - # +docs:property - # registry: quay.io - - # The container image for the cert-manager acmesolver. - # +docs:property - repository: quay.io/jetstack/cert-manager-acmesolver - - # Override the image tag to deploy by setting this variable. - # If no value is set, the chart's appVersion is used. - # +docs:property - # tag: vX.Y.Z - - # Setting a digest will override any tag. - # +docs:property - # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 - - # Kubernetes imagePullPolicy on Deployment. - pullPolicy: IfNotPresent - -# +docs:section=Startup API Check -# This startupapicheck is a Helm post-install hook that waits for the webhook -# endpoints to become available. -# The check is implemented using a Kubernetes Job - if you are injecting mesh -# sidecar proxies into cert-manager pods, ensure that they -# are not injected into this Job's pod. Otherwise, the installation may time out -# owing to the Job never being completed because the sidecar proxy does not exit. -# For more information, see [this note](https://github.com/cert-manager/cert-manager/pull/4414). - -startupapicheck: - # Enables the startup api check. - enabled: true - - # Pod Security Context to be set on the startupapicheck component Pod. - # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). - # +docs:property - securityContext: - runAsNonRoot: true - seccompProfile: - type: RuntimeDefault - - # Container Security Context to be set on the controller component container. - # For more information, see [Configure a Security Context for a Pod or Container](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/). - # +docs:property - containerSecurityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - - # Timeout for 'kubectl check api' command. - timeout: 1m - - # Job backoffLimit - backoffLimit: 4 - - # Optional additional annotations to add to the startupapicheck Job. - # +docs:property - jobAnnotations: - helm.sh/hook: post-install - helm.sh/hook-weight: "1" - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - - # Optional additional annotations to add to the startupapicheck Pods. - # +docs:property - # podAnnotations: {} - - # Additional command line flags to pass to startupapicheck binary. - # To see all available flags run `docker run quay.io/jetstack/cert-manager-startupapicheck: --help`. - # - # Verbose logging is enabled by default so that if startupapicheck fails, you - # can know what exactly caused the failure. Verbose logs include details of - # the webhook URL, IP address and TCP connect errors for example. - # +docs:property - extraArgs: - - -v - - # Resources to provide to the cert-manager controller pod. - # - # For example: - # requests: - # cpu: 10m - # memory: 32Mi - # - # For more information, see [Resource Management for Pods and Containers](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/). - resources: {} - - - # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with - # matching labels. - # For more information, see [Assigning Pods to Nodes](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/). - # - # This default ensures that Pods are only scheduled to Linux nodes. - # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. - # +docs:property - nodeSelector: - kubernetes.io/os: linux - - # A Kubernetes Affinity, if required. For more information, see [Affinity v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core). - # For example: - # affinity: - # nodeAffinity: - # requiredDuringSchedulingIgnoredDuringExecution: - # nodeSelectorTerms: - # - matchExpressions: - # - key: foo.bar.com/role - # operator: In - # values: - # - master - affinity: {} - - # A list of Kubernetes Tolerations, if required. For more information, see [Toleration v1 core](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core). - # - # For example: - # tolerations: - # - key: foo.bar.com/role - # operator: Equal - # value: master - # effect: NoSchedule - tolerations: [] - - # Optional additional labels to add to the startupapicheck Pods. - podLabels: {} - - image: - # The container registry to pull the startupapicheck image from. - # +docs:property - # registry: quay.io - - # The container image for the cert-manager startupapicheck. - # +docs:property - repository: quay.io/jetstack/cert-manager-startupapicheck - - # Override the image tag to deploy by setting this variable. - # If no value is set, the chart's appVersion is used. - # +docs:property - # tag: vX.Y.Z - - # Setting a digest will override any tag. - # +docs:property - # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 - - # Kubernetes imagePullPolicy on Deployment. - pullPolicy: IfNotPresent - - rbac: - # annotations for the startup API Check job RBAC and PSP resources. - # +docs:property - annotations: - helm.sh/hook: post-install - helm.sh/hook-weight: "-5" - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - - # Automounting API credentials for a particular pod. - # +docs:property - # automountServiceAccountToken: true - - serviceAccount: - # Specifies whether a service account should be created. - create: true - - # The name of the service account to use. - # If not set and create is true, a name is generated using the fullname template. - # +docs:property - # name: "" - - # Optional additional annotations to add to the Job's Service Account. - # +docs:property - annotations: - helm.sh/hook: post-install - helm.sh/hook-weight: "-5" - helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded - - # Automount API credentials for a Service Account. - # +docs:property - automountServiceAccountToken: true - - # Optional additional labels to add to the startupapicheck's Service Account. - # +docs:property - # labels: {} - - # Additional volumes to add to the cert-manager controller pod. - volumes: [] - - # Additional volume mounts to add to the cert-manager controller container. - volumeMounts: [] - - # enableServiceLinks indicates whether information about services should be - # injected into pod's environment variables, matching the syntax of Docker - # links. - enableServiceLinks: false - -# Create dynamic manifests via values. -# -# For example: -# extraObjects: -# - | -# apiVersion: v1 -# kind: ConfigMap -# metadata: -# name: '{{ template "cert-manager.name" . }}-extra-configmap' -extraObjects: [] diff --git a/homelab/silver-hand/old/helm/README.md b/homelab/silver-hand/old/helm/README.md deleted file mode 100644 index 43b59038..00000000 --- a/homelab/silver-hand/old/helm/README.md +++ /dev/null @@ -1,26 +0,0 @@ -# Helm -This directory contains documentation and files related to configuring Helm for the Silver Hand cluster. - -### Repositories Used -- [kubernetes-dashboard](https://kubernetes.github.io/dashboard/) to provide [Kubernetes Dashboard](https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/). - -### Steps Taken So Far -``` -helm repo add kubernetes-dashboard https://kubernetes.github.io/dashboard/ -helm upgrade --install kubernetes-dashboard kubernetes-dashboard/kubernetes-dashboard --create-namespace --namespace kubernetes-dashboard -``` - -``` -helm repo add traefik https://traefik.github.io/charts -helm install traefik traefik/traefik --version 30.0.2 -``` - -``` -kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.2/cert-manager.crds.yaml -helm repo add jetstack https://charts.jetstack.io --force-update -helm install cert-manager --namespace cert-manager --version v1.15.2 jetstack/cert-manager - -``` - -#### Sources: -[Deploy and Access the Kubernetes Dashboard - Kubernetes.io](https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/) \ No newline at end of file diff --git a/homelab/silver-hand/old/jafner-dev/jafner-dev.dataset.yml b/homelab/silver-hand/old/jafner-dev/jafner-dev.dataset.yml deleted file mode 100644 index 3898040b..00000000 --- a/homelab/silver-hand/old/jafner-dev/jafner-dev.dataset.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: datashim.io/v1alpha1 -kind: Dataset -metadata: - namespace: jafner-dev - name: jafner-dev -spec: - local: - type: "COS" - secret-name: jafner-dev-aws-credentials - endpoint: "https://s3.us-west-2.amazonaws.com" - bucket: "jafner-dev" - region: "us-west-2" \ No newline at end of file diff --git a/homelab/silver-hand/old/jafner-dev/jafner-dev.ingress.yml b/homelab/silver-hand/old/jafner-dev/jafner-dev.ingress.yml deleted file mode 100644 index 28568436..00000000 --- a/homelab/silver-hand/old/jafner-dev/jafner-dev.ingress.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - namespace: jafner-dev - name: jafner-dev - annotations: - nginx.ingress.kubernetes.io/rewrite-target: / -spec: - ingressClassName: jafner-dev - rules: - - host: "jafner-dev.k3s.jafner.net" - http: - paths: - - pathType: Prefix - path: "/" - backend: - service: - name: jafner-dev-service - port: - number: 80 \ No newline at end of file diff --git a/homelab/silver-hand/old/jafner-dev/jafner-dev.namespace.yml b/homelab/silver-hand/old/jafner-dev/jafner-dev.namespace.yml deleted file mode 100644 index 9eaed95a..00000000 --- a/homelab/silver-hand/old/jafner-dev/jafner-dev.namespace.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: jafner-dev \ No newline at end of file diff --git a/homelab/silver-hand/old/jafner-dev/jafner-dev.pod.yml b/homelab/silver-hand/old/jafner-dev/jafner-dev.pod.yml deleted file mode 100644 index 3f4caeb5..00000000 --- a/homelab/silver-hand/old/jafner-dev/jafner-dev.pod.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -apiVersion: v1 -kind: Pod -metadata: - namespace: jafner-dev - name: nginx - labels: - app: jafner-dev - dataset.0.id: "jafner-dev" - dataset.0.useas: "mount" -spec: - containers: - - name: nginx - image: nginx - ports: - - containerPort: 80 - name: http - volumeMounts: - - mountPath: "/usr/share/nginx/html" - name: "jafner-dev" - volumes: - - name: "jafner-dev" - persistentVolumeClaim: - claimName: "jafner-dev" \ No newline at end of file diff --git a/homelab/silver-hand/old/jafner-dev/jafner-dev.service.yml b/homelab/silver-hand/old/jafner-dev/jafner-dev.service.yml deleted file mode 100644 index 6c5d063e..00000000 --- a/homelab/silver-hand/old/jafner-dev/jafner-dev.service.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -apiVersion: v1 -kind: Service -metadata: - namespace: jafner-dev - name: jafner-dev-service -spec: - type: LoadBalancer - selector: - app: jafner-dev - ports: - - port: 80 - targetPort: 80 diff --git a/homelab/silver-hand/old/kubernetes-dashboard/dashboard.admin-user-role.yml b/homelab/silver-hand/old/kubernetes-dashboard/dashboard.admin-user-role.yml deleted file mode 100644 index 6db3be51..00000000 --- a/homelab/silver-hand/old/kubernetes-dashboard/dashboard.admin-user-role.yml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: admin-user -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: -- kind: ServiceAccount - name: admin-user - namespace: kubernetes-dashboard diff --git a/homelab/silver-hand/old/kubernetes-dashboard/dashboard.admin-user.yml b/homelab/silver-hand/old/kubernetes-dashboard/dashboard.admin-user.yml deleted file mode 100644 index 54cabb72..00000000 --- a/homelab/silver-hand/old/kubernetes-dashboard/dashboard.admin-user.yml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: admin-user - namespace: kubernetes-dashboard diff --git a/homelab/silver-hand/old/kubernetes-dashboard/dashboard.deployment.yml b/homelab/silver-hand/old/kubernetes-dashboard/dashboard.deployment.yml deleted file mode 100644 index 217383d7..00000000 --- a/homelab/silver-hand/old/kubernetes-dashboard/dashboard.deployment.yml +++ /dev/null @@ -1,302 +0,0 @@ -# Copyright 2017 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: kubernetes-dashboard - ---- - -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard - ---- - -kind: Service -apiVersion: v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -spec: - ports: - - port: 443 - targetPort: 8443 - selector: - k8s-app: kubernetes-dashboard - ---- - -apiVersion: v1 -kind: Secret -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-certs - namespace: kubernetes-dashboard -type: Opaque - ---- - -apiVersion: v1 -kind: Secret -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-csrf - namespace: kubernetes-dashboard -type: Opaque -data: - csrf: "" - ---- - -apiVersion: v1 -kind: Secret -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-key-holder - namespace: kubernetes-dashboard -type: Opaque - ---- - -kind: ConfigMap -apiVersion: v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-settings - namespace: kubernetes-dashboard - ---- - -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -rules: - # Allow Dashboard to get, update and delete Dashboard exclusive secrets. - - apiGroups: [""] - resources: ["secrets"] - resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"] - verbs: ["get", "update", "delete"] - # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - - apiGroups: [""] - resources: ["configmaps"] - resourceNames: ["kubernetes-dashboard-settings"] - verbs: ["get", "update"] - # Allow Dashboard to get metrics. - - apiGroups: [""] - resources: ["services"] - resourceNames: ["heapster", "dashboard-metrics-scraper"] - verbs: ["proxy"] - - apiGroups: [""] - resources: ["services/proxy"] - resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"] - verbs: ["get"] - ---- - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard -rules: - # Allow Metrics Scraper to get metrics from the Metrics server - - apiGroups: ["metrics.k8s.io"] - resources: ["pods", "nodes"] - verbs: ["get", "list", "watch"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: kubernetes-dashboard -subjects: - - kind: ServiceAccount - name: kubernetes-dashboard - namespace: kubernetes-dashboard - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kubernetes-dashboard -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kubernetes-dashboard -subjects: - - kind: ServiceAccount - name: kubernetes-dashboard - namespace: kubernetes-dashboard - ---- - -kind: Deployment -apiVersion: apps/v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - k8s-app: kubernetes-dashboard - template: - metadata: - labels: - k8s-app: kubernetes-dashboard - spec: - containers: - - name: kubernetes-dashboard - image: kubernetesui/dashboard:v2.0.4 - imagePullPolicy: Always - ports: - - containerPort: 8443 - protocol: TCP - args: - - --auto-generate-certificates - - --namespace=kubernetes-dashboard - # Uncomment the following line to manually specify Kubernetes API server Host - # If not specified, Dashboard will attempt to auto discover the API server and connect - # to it. Uncomment only if the default does not work. - # - --apiserver-host=http://my-address:port - volumeMounts: - - name: kubernetes-dashboard-certs - mountPath: /certs - # Create on-disk volume to store exec logs - - mountPath: /tmp - name: tmp-volume - livenessProbe: - httpGet: - scheme: HTTPS - path: / - port: 8443 - initialDelaySeconds: 30 - timeoutSeconds: 30 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsUser: 1001 - runAsGroup: 2001 - volumes: - - name: kubernetes-dashboard-certs - secret: - secretName: kubernetes-dashboard-certs - - name: tmp-volume - emptyDir: {} - serviceAccountName: kubernetes-dashboard - nodeSelector: - "kubernetes.io/os": linux - # Comment the following tolerations if Dashboard must not be deployed on master - tolerations: - - key: node-role.kubernetes.io/master - effect: NoSchedule - ---- - -kind: Service -apiVersion: v1 -metadata: - labels: - k8s-app: dashboard-metrics-scraper - name: dashboard-metrics-scraper - namespace: kubernetes-dashboard -spec: - ports: - - port: 8000 - targetPort: 8000 - selector: - k8s-app: dashboard-metrics-scraper - ---- - -kind: Deployment -apiVersion: apps/v1 -metadata: - labels: - k8s-app: dashboard-metrics-scraper - name: dashboard-metrics-scraper - namespace: kubernetes-dashboard -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - k8s-app: dashboard-metrics-scraper - template: - metadata: - labels: - k8s-app: dashboard-metrics-scraper - annotations: - seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' - spec: - containers: - - name: dashboard-metrics-scraper - image: kubernetesui/metrics-scraper:v1.0.4 - ports: - - containerPort: 8000 - protocol: TCP - livenessProbe: - httpGet: - scheme: HTTP - path: / - port: 8000 - initialDelaySeconds: 30 - timeoutSeconds: 30 - volumeMounts: - - mountPath: /tmp - name: tmp-volume - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsUser: 1001 - runAsGroup: 2001 - serviceAccountName: kubernetes-dashboard - nodeSelector: - "kubernetes.io/os": linux - # Comment the following tolerations if Dashboard must not be deployed on master - tolerations: - - key: node-role.kubernetes.io/master - effect: NoSchedule - volumes: - - name: tmp-volume - emptyDir: {} diff --git a/homelab/silver-hand/old/kubernetes-dashboard/kubernetes-dashboard.yml b/homelab/silver-hand/old/kubernetes-dashboard/kubernetes-dashboard.yml deleted file mode 100644 index 11e0aaec..00000000 --- a/homelab/silver-hand/old/kubernetes-dashboard/kubernetes-dashboard.yml +++ /dev/null @@ -1,325 +0,0 @@ -# Copyright 2017 The Kubernetes Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -apiVersion: v1 -kind: Namespace -metadata: - name: kubernetes-dashboard - ---- - -apiVersion: v1 -kind: ServiceAccount -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard - ---- - -kind: Service -apiVersion: v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -spec: - ports: - - port: 443 - targetPort: 8443 - selector: - k8s-app: kubernetes-dashboard - ---- - -apiVersion: v1 -kind: Secret -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-certs - namespace: kubernetes-dashboard -type: Opaque - ---- - -apiVersion: v1 -kind: Secret -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-csrf - namespace: kubernetes-dashboard -type: Opaque -data: - csrf: "" - ---- - -apiVersion: v1 -kind: Secret -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-key-holder - namespace: kubernetes-dashboard -type: Opaque - ---- - -kind: ConfigMap -apiVersion: v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard-settings - namespace: kubernetes-dashboard - ---- - -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -rules: - # Allow Dashboard to get, update and delete Dashboard exclusive secrets. - - apiGroups: [""] - resources: ["secrets"] - resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"] - verbs: ["get", "update", "delete"] - # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map. - - apiGroups: [""] - resources: ["configmaps"] - resourceNames: ["kubernetes-dashboard-settings"] - verbs: ["get", "update"] - # Allow Dashboard to get metrics. - - apiGroups: [""] - resources: ["services"] - resourceNames: ["heapster", "dashboard-metrics-scraper"] - verbs: ["proxy"] - - apiGroups: [""] - resources: ["services/proxy"] - resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"] - verbs: ["get"] - ---- - -kind: ClusterRole -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard -rules: - # Allow Metrics Scraper to get metrics from the Metrics server - - apiGroups: ["metrics.k8s.io"] - resources: ["pods", "nodes"] - verbs: ["get", "list", "watch"] - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: kubernetes-dashboard -subjects: - - kind: ServiceAccount - name: kubernetes-dashboard - namespace: kubernetes-dashboard - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: kubernetes-dashboard -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: kubernetes-dashboard -subjects: - - kind: ServiceAccount - name: kubernetes-dashboard - namespace: kubernetes-dashboard - ---- - -kind: Deployment -apiVersion: apps/v1 -metadata: - labels: - k8s-app: kubernetes-dashboard - name: kubernetes-dashboard - namespace: kubernetes-dashboard -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - k8s-app: kubernetes-dashboard - template: - metadata: - labels: - k8s-app: kubernetes-dashboard - spec: - containers: - - name: kubernetes-dashboard - image: kubernetesui/dashboard:v2.0.4 - imagePullPolicy: Always - ports: - - containerPort: 8443 - protocol: TCP - args: - - --auto-generate-certificates - - --namespace=kubernetes-dashboard - # Uncomment the following line to manually specify Kubernetes API server Host - # If not specified, Dashboard will attempt to auto discover the API server and connect - # to it. Uncomment only if the default does not work. - # - --apiserver-host=http://my-address:port - volumeMounts: - - name: kubernetes-dashboard-certs - mountPath: /certs - # Create on-disk volume to store exec logs - - mountPath: /tmp - name: tmp-volume - livenessProbe: - httpGet: - scheme: HTTPS - path: / - port: 8443 - initialDelaySeconds: 30 - timeoutSeconds: 30 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsUser: 1001 - runAsGroup: 2001 - volumes: - - name: kubernetes-dashboard-certs - secret: - secretName: kubernetes-dashboard-certs - - name: tmp-volume - emptyDir: {} - serviceAccountName: kubernetes-dashboard - nodeSelector: - "kubernetes.io/os": linux - # Comment the following tolerations if Dashboard must not be deployed on master - tolerations: - - key: node-role.kubernetes.io/master - effect: NoSchedule - ---- - -kind: Service -apiVersion: v1 -metadata: - labels: - k8s-app: dashboard-metrics-scraper - name: dashboard-metrics-scraper - namespace: kubernetes-dashboard -spec: - ports: - - port: 8000 - targetPort: 8000 - selector: - k8s-app: dashboard-metrics-scraper - ---- - -kind: Deployment -apiVersion: apps/v1 -metadata: - labels: - k8s-app: dashboard-metrics-scraper - name: dashboard-metrics-scraper - namespace: kubernetes-dashboard -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - k8s-app: dashboard-metrics-scraper - template: - metadata: - labels: - k8s-app: dashboard-metrics-scraper - annotations: - seccomp.security.alpha.kubernetes.io/pod: 'runtime/default' - spec: - containers: - - name: dashboard-metrics-scraper - image: kubernetesui/metrics-scraper:v1.0.4 - ports: - - containerPort: 8000 - protocol: TCP - livenessProbe: - httpGet: - scheme: HTTP - path: / - port: 8000 - initialDelaySeconds: 30 - timeoutSeconds: 30 - volumeMounts: - - mountPath: /tmp - name: tmp-volume - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsUser: 1001 - runAsGroup: 2001 - serviceAccountName: kubernetes-dashboard - nodeSelector: - "kubernetes.io/os": linux - # Comment the following tolerations if Dashboard must not be deployed on master - tolerations: - - key: node-role.kubernetes.io/master - effect: NoSchedule - volumes: - - name: tmp-volume - emptyDir: {} - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: admin-user -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: -- kind: ServiceAccount - name: admin-user - namespace: kubernetes-dashboard - ---- - -apiVersion: v1 -kind: ServiceAccount -metadata: - name: admin-user - namespace: kubernetes-dashboard diff --git a/homelab/silver-hand/old/traefik/traefik-custom-values.yml b/homelab/silver-hand/old/traefik/traefik-custom-values.yml deleted file mode 100644 index 66c2a569..00000000 --- a/homelab/silver-hand/old/traefik/traefik-custom-values.yml +++ /dev/null @@ -1,90 +0,0 @@ -certResolvers: - cloudflare: - dnsChallenge: - provider: cloudflare - storage: /ssl-certs/acme-cloudflare.json - -env: - - name: CF_DNS_API_TOKEN - valueFrom: - secretKeyRef: - key: token - name: cloudflare-token-jafner-net-dns-edit - -logs: - general: - level: error - -ports: - web: - redirectTo: - port: websecure - websecure: - tls: - enabled: true - certResolver: cloudflare - -ingressRoute: - dashboard: - enabled: true - -additionalArguments: -- "--api.insecure=true" - -tlsStore: - default: - defaultCertificate: - secretName: traefik-k3s-jafner-net - -persistence: - enabled: true - name: ssl-certs - size: 1Gi - path: /ssl-certs - storageClass: local-path - -deployment: - initContainers: - - name: volume-permissions - image: busybox:1.36.1 - command: ["sh", "-c", "touch /ssl-certs/acme-cloudflare.json; chmod -v 600 /ssl-certs/acme-cloudflare.json"] - volumeMounts: - - name: ssl-certs - mountPath: /ssl-certs - -ingressClass: - enabled: true - isDefaultClass: true - -extraObjects: - - apiVersion: v1 - kind: Service - metadata: - name: traefik-dashboard - spec: - selector: - app.kubernetes.io/name: traefik - app.kubernetes.io/instance: traefik-traefik - ports: - - port: 8080 - name: traefik - targetPort: 9000 - protocol: TCP - - apiVersion: networking.k8s.io/v1 - kind: Ingress - metadata: - name: traefik-dashboard - annotations: - traefik.ingress.kubernetes.io/router.entrypoints: websecure - spec: - rules: - - host: traefik.k3s.jafner.net - http: - paths: - - path: / - pathType: Prefix - backend: - service: - name: traefik-dashboard - port: - name: traefik \ No newline at end of file diff --git a/homelab/silver-hand/old/traefik/traefik-dashboard.yml b/homelab/silver-hand/old/traefik/traefik-dashboard.yml deleted file mode 100644 index d92b4879..00000000 --- a/homelab/silver-hand/old/traefik/traefik-dashboard.yml +++ /dev/null @@ -1,90 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: traefik - ---- -apiVersion: cert-manager.io/v1 -kind: Issuer -metadata: - name: cloudflare - namespace: traefik -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: jafner425@gmail.com - privateKeySecretRef: - name: cloudflare-key - solvers: - - dns01: - cloudflare: - apiTokenSecretRef: - name: cloudflare-token-jafner-net-dns-edit - key: token - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: traefik-k3s-jafner-net - namespace: traefik -spec: - secretName: traefik-k3s-jafner-net - dnsNames: - - "traefik.k3s.jafner.net" - issuerRef: - name: cloudflare - kind: Issuer - - -# --- -# apiVersion: traefik.containo.us/v1alpha1 -# kind: IngressRoute -# metadata: -# name: traefik-dashboard -# namespace: traefik -# spec: -# entryPoints: ["websecure"] -# routes: -# tls: -# certResolver: cloudflare - -# --- -# apiVersion: v1 -# kind: Service -# metadata: -# name: traefik-dashboard -# namespace: traefik -# spec: -# selector: -# app.kubernetes.io/name: traefik -# type: ClusterIP -# ports: -# - name: http -# port: 80 -# targetPort: 9000 - -# --- -# apiVersion: networking.k8s.io/v1 -# kind: Ingress -# metadata: -# name: traefik-dashboard -# namespace: traefik -# spec: -# tls: -# - hosts: -# - traefik.k3s.jafner.net -# secretName: cloudflare-token-jafner-net-dns-edit -# rules: -# - host: traefik.k3s.jafner.net -# http: -# paths: -# - path: / -# pathType: Prefix -# backend: -# service: -# name: traefik-dashboard -# port: -# number: 80 -