mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-25 10:23:31 +00:00
Compare commits
1
Commits
main
..
08f3e3f5fa
| Author | SHA1 | Date | |
|---|---|---|---|
 renovate[bot]
|
08f3e3f5fa |
@@ -383,13 +383,6 @@ photos:
|
||||
ttl: 300
|
||||
type: A
|
||||
value: 82.64.154.58
|
||||
pkgatlas:
|
||||
octodns:
|
||||
cloudflare:
|
||||
auto-ttl: true
|
||||
ttl: 300
|
||||
type: A
|
||||
value: 82.64.154.58
|
||||
sse-nook:
|
||||
octodns:
|
||||
cloudflare:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
services:
|
||||
fireshare:
|
||||
container_name: fireshare
|
||||
image: shaneisrael/fireshare:1.7.4-lite
|
||||
image: shaneisrael/fireshare:1.7.9-lite
|
||||
ports:
|
||||
- "80"
|
||||
volumes:
|
||||
|
||||
@@ -31,11 +31,6 @@ l2announcements:
|
||||
enabled: true
|
||||
externalIPs:
|
||||
enabled: true
|
||||
# Single-node cluster: the operator defaults to 2 replicas, but both
|
||||
# bind the same host ports, so the second replica can never schedule ("node(s)
|
||||
# didn't have free ports for the requested pod ports") and sits Pending forever.
|
||||
operator:
|
||||
replicas: 1
|
||||
ingressController:
|
||||
enabled: false
|
||||
loadbalancerMode: shared
|
||||
|
||||
@@ -2,7 +2,7 @@ terraform {
|
||||
required_providers {
|
||||
docker = {
|
||||
source = "kreuzwerker/docker"
|
||||
version = "3.9.0"
|
||||
version = "3.6.2"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -44,15 +44,17 @@ statefulset:
|
||||
docker_timeout: 300s
|
||||
# Hard per-job caps (docker create args). Slightly below the
|
||||
# dind limits so the daemon and image cache keep headroom.
|
||||
options: --memory=7g --cpus=1
|
||||
options: --memory=7g --cpus=3
|
||||
dind:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 1500m
|
||||
cpu: 4
|
||||
memory: 8Gi
|
||||
# Same failover tolerations/affinity as the gitea release, so runners can
|
||||
# be scheduled wherever Gitea itself runs (p330 during r740 outage).
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
|
||||
operator: Equal
|
||||
|
||||
@@ -17,33 +17,69 @@ valkey-cluster:
|
||||
# Use standalone Valkey (replaces 'redis' in chart 12.x)
|
||||
valkey:
|
||||
enabled: true
|
||||
primary:
|
||||
master:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
memory: 256Mi
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:fXEKv6sROAEz,iv:ausWhm1zJdx+Mu26pauhi5G+ODZqLZ27SmfkAuMUtYY=,tag:cNYyeG09Hk++uED5M0TBKw==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:7CfH8Lrr7S0=,iv:dv5f/cN1VI2NLQsAYqF2hGEjVjxTnHGXFfNQyCL1KIc=,tag:HTiQN/wZU/mXSHvaz2KqRg==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:2l4bXqCigZWkqfm6zvba/aOwC6zXYd0lufMUrrHA3YZm1/0IXw==,iv:70oryMEsl0nnZz1q4OHHHgjRswmyvLZI9Y6tk0elM5Q=,tag:2/EHDIcaDTSGWl3qRVW8oQ==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: ENC[AES256_GCM,data:dc00KQOBXn587h22VlooFY5ZjbE=,iv:kX5utMKu8uoUSeameD2R0iH+DU/3YXuwP8DaZs9mGYs=,tag:PM5xBnYaP84zMZ2SWTYV+A==,type:str]
|
||||
operator: NotIn
|
||||
values:
|
||||
- "true"
|
||||
postgresql:
|
||||
enabled: true
|
||||
global:
|
||||
postgresql:
|
||||
auth:
|
||||
postgressPassword: ENC[AES256_GCM,data:AGdZp0KNk6+v+w==,iv:dc7B8GYA1hlC6VgO1m3jdHimIVb4QeR1DTmh9kqRDa4=,tag:JEFWOgvgvUDJ+S9yS446cA==,type:str]
|
||||
password: ENC[AES256_GCM,data:kuR59jqrN/YFmA==,iv:qAIwiTzi2Fr9R9fIc3sfPqhIHSPI8K3eNmed8DBm7PQ=,tag:hf7CMUissSbO4RVn+kRUJw==,type:str]
|
||||
postgressPassword: ENC[AES256_GCM,data:3aHXAFDqpYsWeg==,iv:qbrm+izSr+PaAa4fHMVw3Yz0qMuisRMpDxVKdeFSvls=,tag:zVUVALdIUTMhxavsSxlUCw==,type:str]
|
||||
password: ENC[AES256_GCM,data:LCfnttYbxS34WA==,iv:rqU044P/gUmqjhmu+A9B7A64ujnkIhMpKQlYpcmi8MY=,tag:XJws85qfKI+y0BV6S4L1Ig==,type:str]
|
||||
database: gitea
|
||||
username: ENC[AES256_GCM,data:rCEYTAA=,iv:zeWzB+vpMl+oGUfQRPYFneLwnXF7Dlg4XAYB4QynAyk=,tag:zqJDiBiKJJIDgNKdOtGlMg==,type:str]
|
||||
username: ENC[AES256_GCM,data:QDo83dk=,iv:RvuuDiiY1XLZbrjcJ/ANxb/wHrSdf1gaBSck+cMaWhY=,tag:UCEAkWZ2Dmr93oBATQdf8g==,type:str]
|
||||
volumePermissions:
|
||||
enabled: true
|
||||
primary:
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
cpu: 250m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:NplaOmBekcB+,iv:qzQ+QasVZ2JMG87PgdVDJ/7XHDiDXTp+ogxB1w4tws4=,tag:aPyaqwdxVEjct7D3SuKFqw==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:vjsM3Li0p/8=,iv:Y+sjLHWpqwsOJV+vygG2f/3ZXQs2ZQRloPrlcOuzoeM=,tag:t+uR2/uM4NiIq6alJjio9g==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:LQvczGKAK2x1BbFr7S8jo0G7YUaX4DJvc+1Z2E+bCjys4PsBHg==,iv:m4Ses50zYxTF7jXTgbf9nY0kT1hrtgVEEQruLZFN8cU=,tag:UidEMRbb0IPb5V31FjWzYg==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: ENC[AES256_GCM,data:D9N+Fd/g24bKikLdx4WE57WvqE4=,iv:+1oYCzAl6kBJliw0woWhhWT7aWcx4rXkGDn7Anho2Pg=,tag:R+cLK75QCIfWeGL8/eqeFA==,type:str]
|
||||
operator: NotIn
|
||||
values:
|
||||
- "true"
|
||||
livenessProbe:
|
||||
enabled: true
|
||||
initialDelaySeconds: 30
|
||||
@@ -63,7 +99,6 @@ postgresql-ha:
|
||||
persistence:
|
||||
enabled: true
|
||||
subPath: data
|
||||
size: 30Gi
|
||||
extraVolumes:
|
||||
- name: git
|
||||
nfs:
|
||||
@@ -77,8 +112,8 @@ gitea:
|
||||
oauth:
|
||||
- name: Authentik
|
||||
provider: openidConnect
|
||||
key: ENC[AES256_GCM,data:LekdKlJJX6AYZX2PgooenJtANvE8HNdzePN9yeljrnoKV7pbexDnAw==,iv:pZm4+Dj2uqprBRIgchq78nEzqkC/zVoiyRK0cj98WPo=,tag:iSiuwP8N6BBVeGWS54j+dw==,type:str]
|
||||
secret: ENC[AES256_GCM,data:J7WJghH6Xp9Fg3Y+PO1lN1mEEJ0HbVSM1YP2d8//NX2xmYK/PK1y6xSVQ4+VSsYTZhIAM3ZXVrBE/5smuNLUZkoj2EKY275fXcN2kOkEwiftdsJHSKdevCtO57TQipJToh6mfLxz51LDxpz85rVNj4Rvra1d9UvC5x1nUBm8AR0=,iv:lMiMQGsKn4ZxFctakj5MyVlX+8Wu93d5wM9cIqEBhSc=,tag:CkuTAGJqg+dUzyP9z5gwzw==,type:str]
|
||||
key: ENC[AES256_GCM,data:cYaRMEtrziMJWIRj3dg1fuMpp6F3t5ZDO/H2ONOQCg/fZ8s0ZsLb6Q==,iv:VskJ+5Rwpnys0nH531FYZIj253lJqDz1l6sgwKWhE1s=,tag:F3Wj1ruwSwlC5XbVKt1aCQ==,type:str]
|
||||
secret: ENC[AES256_GCM,data:Cro9iaXKcv+uP4G6jEX0tPBW9cjxaZUmnLEVyE72j34aeAAmDFgPiTE/VWSbD3WWK8tuErl0RFHMvHiN63f4W5hq38W9VMP31JDCUYcUbkFBmQg2hrt6ePajZZICR1gHB3D7t5av4pl13O490VByGWfr8OxAK8Z/cGojp/Pt4mo=,iv:nRvFSVRSKFvpNjGmJq6uh/JV3acLsipV0nUHAlt+t80=,tag:BZ7eJiSVCM8J+MY+I5Z48g==,type:str]
|
||||
autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
|
||||
config:
|
||||
APP_NAME: Gitea
|
||||
@@ -107,34 +142,55 @@ gitea:
|
||||
# Resource limits for Gitea container
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
cpu: 1000m
|
||||
memory: 1Gi
|
||||
# Increase replica count is not useful for 1-node cluster
|
||||
replicaCount: 1
|
||||
# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:1O2rrNCMxkGV,iv:dLwAP4NFVRZ0IUNzARm7hPq+ruIshtpXfUVtuuRP3/o=,tag:EmKs8LItQFLoPov8MMjfgw==,type:str]
|
||||
operator: Equal
|
||||
value: ENC[AES256_GCM,data:l0WXlDcRWaY=,iv:F3AxSbB9t/q3L6yOI4NcHlNzZrDwJqiJ/jjfLrQlNAE=,tag:6s/WqyWjNLHHmExGmgl65g==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:RtKkkyNv0zO/IezcKaBBp5Ir9mCBacgVqjFIGyq13U68sU4z5g==,iv:sFr2v6kFKOm2ID73GpxACTvQttvt7fYwg437N7D2Scg=,tag:aPCpFti/jY/0a1FEWF/g4w==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: ENC[AES256_GCM,data:jW8/VevqdIAXrBAMj58udice6HM=,iv:+6nTdgB2io+H6S/jyO4Fc/+VfoyGIY+dqphi6ZNIn3c=,tag:JKJveLWX8pjMN3cnO94UwQ==,type:str]
|
||||
operator: NotIn
|
||||
values:
|
||||
- "true"
|
||||
# (postgresql and valkey tolerations are set in their respective blocks above)
|
||||
sops:
|
||||
lastmodified: "2026-09-22T20:35:36Z"
|
||||
mac: ENC[AES256_GCM,data:xGtSdlGuJL3qSbnfbh/ON1q3c+n6l991fCy9t9ZLnrvSrU15vkK/WVHh84V132C72pEakwRy8nFcUl7KT3C3J2l2uJHJyDWDqA8NTvHq7FAcomKGKpNOqAOFXVUKSr6O4BtQr9x6h4jzAZSlpaTx3GEiLRzygSkZmcEcaXZ6/hU=,iv:JfQ3W3UZV1m1SkapNmUpZ1lkxgTs5F0auXukupK/yAg=,tag:xCNpJUc5mPv2dBhS+ob+fA==,type:str]
|
||||
lastmodified: "2026-08-26T19:28:03Z"
|
||||
mac: ENC[AES256_GCM,data:hb8HlzvsAU+6A2C4MARpF2j+Mv55mQ25SOjJIo6inV822IskVV+0Ml9I6WS8RK6ZNZAdnVcDtQ07JlGx9QRiIwxAE0xxwuhukhSBBjeHGAc39RPhLXhDvwUF5ZeouGixkVrA5lhAvHiu9ILv241G1st0J9qK/ZaIsTazQN4X3iY=,iv:1ehf3avfeV4Ro8rw0rsFQ0qnFXrvF66tUKqqCY+NXSc=,tag:5kXUpLrLGPbwNSBC+aVIwA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-09-22T20:35:36Z"
|
||||
- created_at: "2026-08-26T19:28:03Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ/8DiM04ZZ18qFndWSlo+hHV05hlt7GmwG9dx/3xEXgpdEb
|
||||
TkA3HNi5rUMvA8j/mStmP4sZiqrxlPk9sdMtVsPAppT3qAihcF3DyyUFYkSoY3oF
|
||||
Et5qeeC6DP1aKdsgAQVVZyeLy7l/CbO5CYORm5+TuGmnr0HxN1qZimbF15pspvNN
|
||||
9pprI7XDKb6QEbXhADN9gafNwTIQgv3LGQVdoQgfyzZEcQR8O5bxUFTwdR9LO646
|
||||
zogHuQfPC70jpA2IRxdBHuSTjDkZimyehsKPzq7MpBso/85q3q1TlSQKJsjxZWrZ
|
||||
NBKmEhL/Q4M+8mj+N/aVFJldIUF2Juto5d2BUuIG/lBtNL2QHdiJN3Rxc1gL4qP2
|
||||
eZYESQ6IRXAycUXAQgMJf5p/lhgmVjv8b3lhKSFJq66hZyo5g6wdhLIEunPglNbP
|
||||
BcJXUbl5SScTgOAi9o/soezUuggvzgg3zwM38PAghve1/j0rL7EupYX+u2v7zbUH
|
||||
BA7T30SnkvDCmTzW4+Sac1dg/w06u+4oSGTNnTuKOzmzfIjGlwkJeAtPVcvSFAgK
|
||||
TCKDmvtkPWUxGrxjBbJZUwqCp4HEOwOp6HeGeNbWFZ2UU+JTvTizkxbReN37Q4+f
|
||||
8oIyQuyRpDHgDV5IrbDtCcqWsEFpUXyi8snIMDTCkKdLZv1WjYhjoNmvOoRagQvS
|
||||
XgEQDrDBeC3HZvUuvqMqgmHI+IEjmpad1CNVGE2q7FnAhFYutjBGF78co2X9t+ib
|
||||
B9o6aIwPzS4ANsh47rupGDBt/x46RCorCYhCaJm4B3v0+tYSA7mSBoHQwp1p+AY=
|
||||
=kRPK
|
||||
hQIMA7uy4qQr71wiAQ/9FF5SJAVg0dLi/+xQreE2yrxMH4GTfdBMHd3GWEVLYger
|
||||
6XwXQ7+Qx3mxf+VprmNGOW7NdKSsC5Re/JHJAjs7p+eWohtieOgKtg7DWEcrTwZA
|
||||
56Rnhtnh0vv2jqmv/pm/Cj49GCLTjQFY+w5azU7g/7eQZpdPezIdrs1ueiSm6LaU
|
||||
T9bMdUzm1pb7/JKQMvzYyPcuw0AfKLlg+x7HHRNI3O434yKuTLC5emVxJEmwQvV4
|
||||
FD6oUAt4gKLqUHvAUuCVo8O5G36MGHO/roHxlWaLbHqjaDPyWh2TGdX0ICKKq1yc
|
||||
fJzw9dYgcwIMXpXilbnsL4gQpv6bKj6VniyCoye6ieMZ2HIoZghd+wL0NoPkS7Nj
|
||||
D+vTcPR8HOEWoZkZ4B01+bFyTmJ5NA8Z0V3peHkuTy+HCTgwxA0Y8PCrHl3YHsCQ
|
||||
C3nANhh+cMqtcJdvqdGrM09X8n3edNc4lf+qg2tk0NbcdVSqcFl9y/MeJOWhOOg3
|
||||
T/bwBrI5O7aRO6gqaCebKuGIrD1PDNURW3LLiKBSU4OTYbMWWXGpdEMCkoSQS56B
|
||||
6Uo9N8KcWhBChCMJG8hbzYRVwYgWGsHsQbfbujkcIiSaoHGy8fklflxBjtLiitLO
|
||||
voawf0zSqyBKbf1YFAmYnrdR0jiasKC5iqtK7c8uc/HyCSvxjK0ygPloWFI8aSPS
|
||||
XgFJiWHT/5gOG64XmDm0VoKdflpojJeTGIC5JU8RAlJgD/oq+uWt23ayJxkjbkMd
|
||||
H7UsqcuzWfbp44MYtmEWbxvI/+Iaui5/7hW7kEzWI60Mh4tVZGIJ64A3WNRL/Xw=
|
||||
=U5nI
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: pkgatlas
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
secretGenerator:
|
||||
- name: pkgatlas-values
|
||||
files:
|
||||
- values.yaml=values.yaml
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
nameReference:
|
||||
- kind: Secret
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- path: spec/valuesFrom/name
|
||||
kind: HelmRelease
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: pkgatlas
|
||||
@@ -1,22 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: pkgatlas
|
||||
namespace: pkgatlas
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: pkgatlas
|
||||
namespace: pkgatlas
|
||||
chart: pkgatlas
|
||||
# CI publishes a timestamped version on every main push and
|
||||
# stamps appVersion with the commit SHA of the image it
|
||||
# builds; this range always picks the latest one.
|
||||
version: '>=0.4.0-0'
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: pkgatlas-values
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: pkgatlas
|
||||
namespace: pkgatlas
|
||||
spec:
|
||||
interval: 1m
|
||||
url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
|
||||
@@ -1,47 +0,0 @@
|
||||
# Chart: https://git.vhaudiquet.fr/vhaudiquet/pkgatlas (chart/pkgatlas).
|
||||
# The image ships both binaries (build + serve) and runs as nonroot
|
||||
# (uid 65532, distroless). Everything else is chart default: discovery
|
||||
# first — build.enabled=false, the first refresh pass builds the whole
|
||||
# live rotation and /v1/readyz stays 503 until it lands; weekly
|
||||
# refresh after that.
|
||||
image:
|
||||
repository: git.vhaudiquet.fr/vhaudiquet/pkgatlas
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
hosts:
|
||||
- host: pkgatlas.vhaudiquet.fr
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
# TLS terminates at Caddy with the *.vhaudiquet.fr wildcard cert;
|
||||
# Caddy proxies to Traefik by host, so no tls block here (same as
|
||||
# gitea's ingress).
|
||||
tls: []
|
||||
sops:
|
||||
lastmodified: "2026-09-24T19:57:42Z"
|
||||
mac: ENC[AES256_GCM,data:cidn6U0EFjuEx98GA8Jlppg3GobcGGrhs20dPoAnUXdpFogfsp3YOTPCKuKi0LrOw/fxBP84U4drx5lJcjL11Ft/Ozn6Z8tk3l8cdqK+BUm6yijtQ0PXHjPUJYNIeqxrQKJzFlVHS+tOARbhQ3DjoNt71WBMfSPUDcPxrbnwVAA=,iv:Yz85yh9jrLXf6DKeVmOLeiVCWcthKCPGCJJwR3RVikg=,tag:7Mdv4VZUpsjuysitx4b2DA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-09-24T19:57:42Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ/+N+gGPOCbuxleT6xx0FduVN1vspYJlCyrtLsy632Yz17x
|
||||
ucwqSuGciqUf2kF3GwnOzINEY0eLskbKHMX5wkbJg8+X6dXoRyiseX3fdNrpvMGR
|
||||
P1ZC/C4O6BzQoPJOXDQZHuWPI0Imx61PlzDPzsJ44JBvwrkCKgoaWOvzMyTjZHiC
|
||||
iplyHpzDR2sqfMe29aQICrEV6Z87eMWQ3wie6CzX2OYTj89BejsN2Ibg4n5cqdNO
|
||||
c+mM7Ek2nSWMWYGbdL0W2N6WSIbGuQj/aVbS0s6585NUPJtmcznB7uosRroqfbd2
|
||||
9SMP1gaUOr+00kykRxKtd/ZoW7S/21kGbZ8FwvtKZFrBwcoUuLehbSGAHRYLo6dI
|
||||
5WGeky65IrvpKen8Q/B6o6EByTONt2h+XiyJyLwDLeFh13/ldkGqa1oW+4BTHuX9
|
||||
2WvLOboHpr4MGQdO53Q8zm8VCGAltusII6ZVaoEyjilqZtC/Aa9XZIT/HshOGTQi
|
||||
4CITE1BfGEApOcBbBQKdjYofdWcyuLSF/ertXvcvNiCoVe0wYiHSYUht+HulQ3t+
|
||||
Z0K7C2sJ2bx8C+316b2MzCGVrVOuqDABpQJjIr4aiRG9v8BtYTaUc425CLm9TMtA
|
||||
PmZR1Rqowy4ECekrbvk3lNjPoq13HLSqkm2ppL9WFub5zY2XY0npprSeUknTmSDS
|
||||
XgGFDhcroUq0vTUlJbC015kpa6cpynwTmMuQrFaMPeKeBPkL4Le6QFJMjpIi3yg3
|
||||
65bSBv5t7YXoHFJWVFYej005Lz1lxp1VtaMiA0bnKEnyh/SbfcUqD4d9P1WNx+4=
|
||||
=ulvs
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
||||
mac_only_encrypted: true
|
||||
version: 3.10.2
|
||||
@@ -40,8 +40,6 @@ data:
|
||||
|
||||
@umami host umami.vhaudiquet.fr
|
||||
|
||||
@pkgatlas host pkgatlas.vhaudiquet.fr
|
||||
|
||||
handle @authentik {
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
@@ -72,9 +70,6 @@ data:
|
||||
handle @umami {
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
handle @pkgatlas {
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
|
||||
# Docker VM services (via Docker Traefik)
|
||||
@alexscript host alexscript.vhaudiquet.fr
|
||||
|
||||
@@ -10,7 +10,7 @@ image:
|
||||
repository: caddy
|
||||
pullPolicy: IfNotPresent
|
||||
tagSuffix: ""
|
||||
tag: 2.11.4
|
||||
tag: 2.11.2
|
||||
service:
|
||||
type: LoadBalancer
|
||||
# Cluster (not Local) so any node can forward to pods on any other node.
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
name: cert-manager-webhook-ovh
|
||||
namespace: cert-manager
|
||||
chart: cert-manager-webhook-ovh
|
||||
version: "0.9.16"
|
||||
version: "v0.9.13"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -14,7 +14,7 @@ spec:
|
||||
name: stalwart-helm
|
||||
namespace: stalwart
|
||||
chart: stalwart
|
||||
version: "0.7.18"
|
||||
version: "0.7.5"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
# Container image
|
||||
image:
|
||||
repository: stalwartlabs/stalwart
|
||||
tag: v0.16.22
|
||||
tag: v0.16.11
|
||||
pullPolicy: IfNotPresent
|
||||
# Single-node RocksDB deployment.
|
||||
replicaCount: 1
|
||||
|
||||
@@ -29,14 +29,12 @@ resources:
|
||||
- dev/gitea
|
||||
- dev/harbor
|
||||
- dev/renovate
|
||||
- dev/pkgatlas
|
||||
# Home (home automation)
|
||||
- home/home-assistant
|
||||
- home/zigbee2mqtt
|
||||
# Personal (apps storing my own content, grouped by content type)
|
||||
- personal/paperless
|
||||
- personal/radicale
|
||||
- personal/syncthing
|
||||
- personal/media/photoprism
|
||||
- personal/notes/notesnook
|
||||
- personal/notes/obsidian-livesync
|
||||
|
||||
@@ -5,6 +5,5 @@ resources:
|
||||
- openclaw-instance.yaml
|
||||
- openclaw-secrets.yaml
|
||||
- networkpolicy.yaml
|
||||
- networkpolicy-lan-egress.yaml
|
||||
- networkpolicy-mail-egress.yaml
|
||||
- networkpolicy-radicale-egress.yaml
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
|
||||
# only allows DNS (53) and TCP 443 outbound, so any other port toward the local
|
||||
# network is dropped. That blocks the OpenClaw pod from reaching LAN services
|
||||
# that do not speak HTTPS on 443. Measured from inside the pod against
|
||||
# 10.4.1.222, 443 returns RST (admitted, nothing listening) while 7020 times
|
||||
# out, which shows LAN routing works and only the port is being refused.
|
||||
#
|
||||
# The egress rule below sets no `ports`, because the goal is arbitrary LAN
|
||||
# services rather than one known port. Cluster CIDRs are excluded so this does
|
||||
# not become a blanket "any pod, any port" grant; the LAN is what gets admitted.
|
||||
# Note this is additive to the operator's rules, so DNS and 443 everywhere still
|
||||
# hold.
|
||||
#
|
||||
# Written as a sidecar policy rather than via the CR fields
|
||||
# spec.security.networkPolicy.additionalEgress / allowedEgressCIDRs, matching
|
||||
# the existing networkpolicy-mail-egress / -radicale-egress pattern. Those CR
|
||||
# fields DO appear in the 0.39.0 CRD template, contrary to the comments on the
|
||||
# sibling policies, so they are worth retrying once the installed CRD version is
|
||||
# confirmed. Until then the sidecar route is the one known to take effect.
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: openclaw-lan-egress
|
||||
namespace: openclaw
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: openclaw
|
||||
app.kubernetes.io/name: openclaw
|
||||
policyTypes:
|
||||
- Egress
|
||||
egress:
|
||||
- to:
|
||||
- ipBlock:
|
||||
cidr: 10.0.0.0/8
|
||||
except:
|
||||
# Service CIDR and pod CIDR (infra/kube/talconfig.yaml).
|
||||
- 10.96.0.0/12
|
||||
- 10.244.0.0/16
|
||||
@@ -3,35 +3,6 @@ kind: OpenClawInstance
|
||||
metadata:
|
||||
name: openclaw
|
||||
spec:
|
||||
# Pin the gateway image to an immutable version tag. Running `latest` with
|
||||
# pullPolicy=IfNotPresent let a stale node-cached image (old build, state
|
||||
# schema v1) fight the PVC's DB migrated by a newer build (schema v15),
|
||||
# crash-looping the container. Bump this tag alongside upstream releases.
|
||||
image:
|
||||
repository: ghcr.io/openclaw/openclaw
|
||||
tag: "2026.9.3"
|
||||
# Workaround for paperclipinc/openclaw-operator#607: the operator mounts the
|
||||
# PVC root directly at /home/openclaw/.openclaw and only fsGroup is applied,
|
||||
# so the mount root stays owned by root. OpenClaw >= 2026.9 fchmods its config
|
||||
# dir when writing openclaw.json, which fails with EPERM for a non-owner.
|
||||
# This one-shot init container chowns the mount root to the pod UID.
|
||||
initContainers:
|
||||
- name: fix-data-owner
|
||||
image: docker.io/library/busybox:1.37
|
||||
command: ["sh", "-c", "chown 1000:1000 /data && ls -ld /data"]
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
runAsNonRoot: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
add: ["CHOWN"]
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumeMounts:
|
||||
- name: data
|
||||
mountPath: /data
|
||||
# Provider API keys come from the SOPS-encrypted Secret below.
|
||||
# The gateway token is auto-generated by the operator (no mDNS pairing in k8s).
|
||||
envFrom:
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
name: cloudpirates
|
||||
namespace: paperless
|
||||
chart: postgres
|
||||
version: "0.20.5"
|
||||
version: "0.20.0"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
name: cloudpirates
|
||||
namespace: paperless
|
||||
chart: redis
|
||||
version: "0.35.1"
|
||||
version: "0.34.16"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
name: derwitt
|
||||
namespace: radicale
|
||||
chart: radicale
|
||||
version: "2.1.1"
|
||||
version: "2.1.0"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: syncthing
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
secretGenerator:
|
||||
- name: syncthing-values
|
||||
files:
|
||||
- values.yaml=values.yaml
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
nameReference:
|
||||
- kind: Secret
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- path: spec/valuesFrom/name
|
||||
kind: HelmRelease
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: syncthing
|
||||
labels:
|
||||
app.kubernetes.io/name: syncthing
|
||||
app.kubernetes.io/component: file-sync
|
||||
@@ -1,19 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: syncthing
|
||||
namespace: syncthing
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: k8s-home-lab
|
||||
namespace: syncthing
|
||||
chart: syncthing
|
||||
version: "5.2.0"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: syncthing-values
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: k8s-home-lab
|
||||
namespace: syncthing
|
||||
spec:
|
||||
interval: 1h
|
||||
url: https://k8s-home-lab.github.io/helm-charts/
|
||||
@@ -1,152 +0,0 @@
|
||||
# Syncthing continuous file synchronization
|
||||
#
|
||||
# Sync ports (22000 TCP+QUIC, 21027 UDP) are exposed through LoadBalancer
|
||||
# services on the dedicated Cilium pool IP 10.2.2.7 (appended to
|
||||
# kubernetes/system/cilium/pool.yaml). The GUI goes through Traefik like the
|
||||
# other *.lan services.
|
||||
controller:
|
||||
replicas: 1
|
||||
image:
|
||||
repository: syncthing/syncthing
|
||||
tag: "2.1"
|
||||
env:
|
||||
- name: TZ
|
||||
value: Europe/Paris
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
podSecurityContext:
|
||||
fsGroup: 1000
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: 8384
|
||||
# Sync protocol and QUIC share 22000 on the pooled IP; LAN discovery
|
||||
# rides on UDP 21027. externalTrafficPolicy Local preserves client IPs.
|
||||
listen:
|
||||
enabled: true
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: Local
|
||||
loadBalancerIP: 10.2.2.7
|
||||
ports:
|
||||
listen:
|
||||
enabled: true
|
||||
port: 22000
|
||||
protocol: TCP
|
||||
targetPort: 22000
|
||||
quic:
|
||||
enabled: true
|
||||
port: 22000
|
||||
protocol: UDP
|
||||
targetPort: 22000
|
||||
discovery:
|
||||
enabled: true
|
||||
type: LoadBalancer
|
||||
externalTrafficPolicy: Local
|
||||
loadBalancerIP: 10.2.2.7
|
||||
ports:
|
||||
discovery:
|
||||
enabled: true
|
||||
port: 21027
|
||||
protocol: UDP
|
||||
targetPort: 21027
|
||||
probes:
|
||||
liveness:
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /rest/noauth/health
|
||||
port: http
|
||||
readiness:
|
||||
custom: true
|
||||
spec:
|
||||
httpGet:
|
||||
path: /rest/noauth/health
|
||||
port: http
|
||||
ingress:
|
||||
main:
|
||||
enabled: true
|
||||
ingressClassName: traefik
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/enabled: "true"
|
||||
hosts:
|
||||
- host: syncthing.lan
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
mountPath: /var/syncthing/config
|
||||
storageClass: longhorn
|
||||
size: 5Gi
|
||||
# Shares are recreated by hand in the GUI after cutover — the instance
|
||||
# boots with a fresh config (see plans/syncthing-docker-to-kube-migration.md):
|
||||
# valentin's folders at /data/valentin/… and sarah's at /data/sarah/…, all
|
||||
# backed by the same TrueNAS exports as the docker stack. Photoprism
|
||||
# already mounts the valentin Photos export concurrently.
|
||||
valentin-documents:
|
||||
enabled: true
|
||||
type: custom
|
||||
mountPath: /data/valentin/Documents
|
||||
volumeSpec:
|
||||
nfs:
|
||||
server: truenas.lan
|
||||
path: /mnt/main_storage/valentin/Documents
|
||||
valentin-photos:
|
||||
enabled: true
|
||||
type: custom
|
||||
mountPath: /data/valentin/Photos
|
||||
volumeSpec:
|
||||
nfs:
|
||||
server: truenas.lan
|
||||
path: /mnt/main_storage/valentin/Photos
|
||||
sarah-documents:
|
||||
enabled: true
|
||||
type: custom
|
||||
mountPath: /data/sarah/Documents
|
||||
volumeSpec:
|
||||
nfs:
|
||||
server: truenas.lan
|
||||
path: /mnt/main_storage/sarah/Documents
|
||||
sarah-photos:
|
||||
enabled: true
|
||||
type: custom
|
||||
mountPath: /data/sarah/Photos
|
||||
volumeSpec:
|
||||
nfs:
|
||||
server: truenas.lan
|
||||
path: /mnt/main_storage/sarah/Photos
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
limits:
|
||||
memory: 2Gi
|
||||
sops:
|
||||
lastmodified: "2026-09-21T22:28:39Z"
|
||||
mac: ENC[AES256_GCM,data:BR4P4s4C9n4bEHryqfHpzzFHxAlKeujFBO2Qhsc4qdkcI5dftJ7jrknWtW0uv1E2Aljp50Mx1Rk4wglaWh3MS/ZnY/1dUxCfKuXOGkv9+mymQxDk6zJLsUNTH7sMr5kzlVWfv3yzXF50HWuiNl71BAv4mtlrtarXS1KVQrCKNaA=,iv:aG9OxDOhwk7xYNbvESNMFnXIjKhbYNO0gvDn1a9QQvc=,tag:QxM3EX8V2KJzosRz5damrw==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-09-21T22:28:39Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ//cvlMqPSaED2y5dsq8H/W/dqYVOeG7E/ZOuJGaYnImrrp
|
||||
V2W6vPTzQ8QuYTKa1X4aOIlda04n7i2kDQCvpszmdpsU2y0SWtsgOBbyloIU3cAM
|
||||
69HGd1SNqP/FayeZy/hHNvvEjmsgKX/9IV1YBGOcikmd7MqoxgGRgIxXORzY0dBG
|
||||
7oREwV0HubdIBG6Fi6HUyN+Pugftpcumfwtl8ppPUYi1HGKzL5LzIT6gfqXtUcBg
|
||||
8Wl2f0kMZsat1e05sZZah41dg+BAlyDgCRFo/ZQIhzHi28rJkZWG2aZxQfvAFMYJ
|
||||
hUkjVyN7rAO01b2PsXK3bleFjD8iL8PhHY/Rio0/Uizjub7inako2SUd38D7X+ce
|
||||
M1c2GoDVNmwZyXg7jBzb67JxLPn4Ic1kbjUi/JJL22rDzN0pBf6J7ExCpVGxrwK8
|
||||
++YDD1m/rY3YA8/ioM+pTu3ktEd1zu0T1yFySjgtvX8QVmOkrG1AA8E/N3+pzFWP
|
||||
9wrJJ+yp5CYQl9d3j5LQcOzmvROi0EHjeZY75IHw8NwkyWdnRgWFIPsXxVoSUhSk
|
||||
909RE//BuKSSRd1r9D/4w14Eb9KC74bIsUIflyK2Qs/N3rh9+/O8FS/5saryq7Er
|
||||
GO3oAmFqC2F4Y6zFlmXkr43gBFjCPWl0DxI3uUK/gcw8kBpLSJex3j2sDaLViS/S
|
||||
XgFsDLAjHnEo5DC+xyJQI5xMWsQzx/ASNZdBVLrnYPsRt+YG7qfu3lKNS9ujAG7K
|
||||
ti58fACtT97K8IrUMNyEDGieFz65TYPcie4qILnDt2Hkr6QUEdBR8rvn/8z36D8=
|
||||
=47Rw
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(data|stringData|.*key|.*crt)$
|
||||
version: 3.10.2
|
||||
@@ -8,4 +8,3 @@ spec:
|
||||
- cidr: "10.2.2.4/32"
|
||||
- cidr: "10.2.2.5/32"
|
||||
- cidr: "10.2.2.6/32"
|
||||
- cidr: "10.2.2.7/32"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
replicaCount: 2
|
||||
image:
|
||||
repository: coredns/coredns
|
||||
tag: 1.14.7
|
||||
tag: 1.14.3
|
||||
pullPolicy: IfNotPresent
|
||||
deployment:
|
||||
dnsPolicy: ClusterFirst
|
||||
|
||||
@@ -13,5 +13,3 @@ resources:
|
||||
- longhorn-jobs.yaml
|
||||
- openclaw-operator.yaml
|
||||
- openclaw.yaml
|
||||
- kyverno.yaml
|
||||
- kyverno-policies.yaml
|
||||
|
||||
@@ -1,19 +0,0 @@
|
||||
---
|
||||
# Flux Kustomization for Kyverno ClusterPolicies.
|
||||
# dependsOn "kyverno" (the controller + CRDs) so the kyverno.io/v2 CRD exists
|
||||
# before Flux dry-runs the ClusterPolicy. Without this split, Flux fails the
|
||||
# whole Kustomization at dry-run ("no matches for kind ClusterPolicy").
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: kyverno-policies
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 5m
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: homeprod
|
||||
path: ./kubernetes/system/kyverno-policies
|
||||
dependsOn:
|
||||
- name: kyverno
|
||||
@@ -1,24 +0,0 @@
|
||||
---
|
||||
# Flux Kustomization for Kyverno
|
||||
# Separate from main homeprod because Kyverno CRDs (installed by the HelmRelease)
|
||||
# must be present before the ClusterPolicy can be applied.
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: kyverno
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 5m
|
||||
prune: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: homeprod
|
||||
path: ./kubernetes/system/kyverno
|
||||
# Wait for the admission controller Deployment to be Ready before Flux
|
||||
# considers this Kustomization healthy — this ensures the ClusterPolicy
|
||||
# is applied after the CRDs and controller are live.
|
||||
healthChecks:
|
||||
- apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: kyverno-admission-controller
|
||||
namespace: kyverno
|
||||
@@ -1,12 +0,0 @@
|
||||
---
|
||||
# Kyverno ClusterPolicies.
|
||||
# Applied by the Flux Kustomization "kyverno-policies" which dependsOn "kyverno"
|
||||
# (the controller + CRDs). This split is required because Flux dry-runs every
|
||||
# resource in a Kustomization before applying any — the ClusterPolicy references
|
||||
# the kyverno.io/v2 CRD that only exists once the kyverno HelmRelease installs.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
# Toggleable emergency relief: strips resources.requests.cpu cluster-wide.
|
||||
# See the file header for the toggle (failurePolicy Ignore/Never) commands.
|
||||
- policy-strip-cpu-requests.yaml
|
||||
@@ -1,121 +0,0 @@
|
||||
---
|
||||
# ============================================================================
|
||||
# CPU-REQUEST RELIEF — TOGGLEABLE CLUSTER POLICY
|
||||
# ============================================================================
|
||||
# Emergency relief for CPU-saturated scenarios
|
||||
#
|
||||
# When ENABLED, this Kyverno ClusterPolicy removes the `resources.requests.cpu`
|
||||
# field from every Pod created/updated in the cluster (except Kyverno's own pods,
|
||||
# critical kube-system control-plane pods, and the Longhorn instance-manager /
|
||||
# engine-image / longhorn-manager, which must keep guarantees so admission and
|
||||
# the storage layer keep working). With no CPU request, pods schedule onto
|
||||
# whatever capacity is free and burst freely.
|
||||
#
|
||||
# === TOGGLE ===
|
||||
# The policy is ACTIVE by default (failurePolicy: Ignore = mutate, never block).
|
||||
#
|
||||
# DISABLE relief (restore the per-app CPU requests on next Flux reconcile):
|
||||
# kubectl patch clusterpolicy.kyverno.io strip-cpu-requests --type=merge \
|
||||
# -p '{"spec":{"failurePolicy":"Never"}}'
|
||||
# # failurePolicy: Never tells Kyverno to skip the rule without mutating, so the
|
||||
# # original CPU requests from each HelmRelease are restored on next reconcile.
|
||||
#
|
||||
# RE-ENABLE relief (strip requests again):
|
||||
# kubectl patch clusterpolicy.kyverno.io strip-cpu-requests --type=merge \
|
||||
# -p '{"spec":{"failurePolicy":"Ignore"}}'
|
||||
# ============================================================================
|
||||
apiVersion: kyverno.io/v1
|
||||
kind: ClusterPolicy
|
||||
metadata:
|
||||
name: strip-cpu-requests
|
||||
annotations:
|
||||
policies.kyverno.io/title: Strip CPU Requests (Emergency Relief)
|
||||
policies.kyverno.io/category: Other
|
||||
policies.kyverno.io/severity: low
|
||||
policies.kyverno.io/subject: Pod
|
||||
policies.kyverno.io/description: >-
|
||||
Removes resources.requests.cpu AND resources.limits.cpu from pods so they
|
||||
can be scheduled on an overloaded single-node cluster. Limits must be
|
||||
stripped too: the LimitRanger admission plugin defaults requests.cpu =
|
||||
limits.cpu whenever a limit exists without a request, so stripping only
|
||||
the request is a no-op. Toggle via spec.failurePolicy:
|
||||
Ignore = active (strip), Never = inactive (restore).
|
||||
spec:
|
||||
# Never block a pod if Kyverno admission is itself under pressure.
|
||||
failurePolicy: Ignore
|
||||
# background: true so the backgroundController also mutates ALREADY-EXISTING
|
||||
# pods (not just new/updated ones at admission). This makes the relief take
|
||||
# effect immediately on flip-on, without waiting for a pod restart.
|
||||
background: true
|
||||
rules:
|
||||
- name: remove-cpu-request-from-containers
|
||||
match:
|
||||
any:
|
||||
- resources:
|
||||
kinds:
|
||||
- Pod
|
||||
# Keep guarantees for things that must keep running so admission and the
|
||||
# storage layer keep working even while everything else is bursting.
|
||||
exclude:
|
||||
any:
|
||||
- resources:
|
||||
namespaces:
|
||||
- kyverno
|
||||
- resources:
|
||||
namespaces:
|
||||
- kube-system
|
||||
names:
|
||||
# Control-plane static pods (apiserver, scheduler, controller-manager)
|
||||
- kube-apiserver-*
|
||||
- kube-scheduler-*
|
||||
- kube-controller-manager-*
|
||||
- resources:
|
||||
namespaces:
|
||||
- longhorn-system
|
||||
selector:
|
||||
matchLabels:
|
||||
app: longhorn-manager
|
||||
- resources:
|
||||
namespaces:
|
||||
- longhorn-system
|
||||
selector:
|
||||
matchLabels:
|
||||
app: instance-manager
|
||||
- resources:
|
||||
namespaces:
|
||||
- longhorn-system
|
||||
selector:
|
||||
matchLabels:
|
||||
app: engine-image
|
||||
mutate:
|
||||
# `request.object` is available in BOTH admission and background modes:
|
||||
# the backgroundController synthesizes an admission-like request for
|
||||
# existing resources, so the same foreach works for both.
|
||||
# NOTE 1: inside `foreach`, patchStrategicMerge must be an INLINE YAML
|
||||
# mapping — a `|` block scalar is parsed as a string and fails with
|
||||
# "wrong node kind: expected MappingNode but got ScalarNode".
|
||||
# NOTE 2: limits.cpu MUST be stripped together with requests.cpu.
|
||||
# The LimitRanger admission plugin defaults requests.cpu = limits.cpu
|
||||
# whenever a container has a limit but no request, so stripping only
|
||||
# the request is a no-op for any container that declares a limit.
|
||||
foreach:
|
||||
- list: "request.object.spec.containers"
|
||||
patchStrategicMerge:
|
||||
spec:
|
||||
containers:
|
||||
- name: "{{ element.name }}"
|
||||
resources:
|
||||
requests:
|
||||
cpu: null
|
||||
limits:
|
||||
cpu: null
|
||||
- list: "request.object.spec.initContainers || `[]`"
|
||||
patchStrategicMerge:
|
||||
spec:
|
||||
initContainers:
|
||||
- name: "{{ element.name }}"
|
||||
resources:
|
||||
requests:
|
||||
cpu: null
|
||||
limits:
|
||||
cpu: null
|
||||
@@ -1,17 +0,0 @@
|
||||
---
|
||||
# Kyverno controller + CRDs only.
|
||||
# The ClusterPolicy lives in a SEPARATE directory (kubernetes/system/kyverno-policies)
|
||||
# applied by a SEPARATE Flux Kustomization (kyverno-policies) with dependsOn:
|
||||
# kyverno. This split is required because Flux dry-runs every resource in a
|
||||
# Kustomization before applying any of them — the ClusterPolicy references the
|
||||
# kyverno.io/v2 CRD, which does not exist until this HelmRelease installs it, so
|
||||
# bundling them together makes the whole Kustomization fail at dry-run.
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: kyverno
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
nameReference:
|
||||
- kind: HelmRepository
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- path: spec/chart/spec/sourceRef/name
|
||||
kind: HelmRelease
|
||||
@@ -1,10 +0,0 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: kyverno
|
||||
labels:
|
||||
# Pod Security Admission: Kyverno's own pods run privileged-sidecars/agent.
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
@@ -1,70 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: kyverno
|
||||
namespace: kyverno
|
||||
spec:
|
||||
interval: 5m
|
||||
chart:
|
||||
spec:
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: kyverno
|
||||
namespace: kyverno
|
||||
chart: kyverno
|
||||
version: '3.9.1'
|
||||
interval: 5m
|
||||
# Minimal footprint for a single-node cluster:
|
||||
# - admissionReports disabled (no extra Redis/Postgres)
|
||||
# - admissionController + backgroundController only (no reports, no
|
||||
# cleanupController) — the backgroundController lets the ClusterPolicy also
|
||||
# mutate ALREADY-RUNNING pods (not just new/updated ones), so flipping the
|
||||
# relief on immediately strips CPU requests from existing workloads.
|
||||
# - tolerates the control-plane node (allowSchedulingOnMasters=true on p330)
|
||||
# - low CPU request so Kyverno's own admission doesn't itself deadlock the node
|
||||
values:
|
||||
admissionController:
|
||||
rbac:
|
||||
create: true
|
||||
# Scale to 1 replica on this single-node cluster
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
# The background controller re-applies policies to already-existing resources,
|
||||
# so the CPU-request strip also affects pods that were created BEFORE the policy
|
||||
# (and pods Flux re-applies with their original requests between toggles).
|
||||
backgroundController:
|
||||
enabled: true
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
# Reports/reportsController are for policy-report auditing — not needed for a
|
||||
# one-off relief toggle.
|
||||
reportsController:
|
||||
enabled: false
|
||||
cleanupController:
|
||||
enabled: false
|
||||
# No autoscaling on a single node.
|
||||
autoscaling:
|
||||
admissionController:
|
||||
enabled: false
|
||||
backgroundController:
|
||||
enabled: false
|
||||
@@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: kyverno
|
||||
namespace: kyverno
|
||||
spec:
|
||||
interval: 5m
|
||||
url: https://kyverno.github.io/kyverno/
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
name: longhorn
|
||||
namespace: longhorn-system
|
||||
chart: longhorn
|
||||
version: '1.12.1'
|
||||
version: '1.12.0'
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
# Longhorn Helm Values
|
||||
defaultSettings:
|
||||
# ReplicaCount below is to be updated when cluster node count change.
|
||||
# Single-node clusters can only have 1 replica, multi-node should have 2 or ideally 3 when possible.
|
||||
defaultReplicaCount: 1
|
||||
# 2 replicas so volumes survive single-node loss
|
||||
defaultReplicaCount: 2
|
||||
# Allow full disk usage on single-node
|
||||
storageOverProvisioningPercentage: 100
|
||||
storageMinimalAvailablePercentage: 10
|
||||
@@ -16,28 +15,35 @@ defaultSettings:
|
||||
# set here via the `taintToleration` setting (semicolon-separated `kubectl
|
||||
# taint` syntax), not via per-component `tolerations` blocks.
|
||||
#
|
||||
taintToleration: node-role.kubernetes.io/control-plane:NoSchedule
|
||||
# The P330 node is tainted `dedicated=failover:NoSchedule` (see
|
||||
# infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
|
||||
# engine/replica pods there so a volume can be failed over to the P330.
|
||||
# The control-plane taint is also tolerated defensively, although with
|
||||
# allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
|
||||
taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
|
||||
persistence:
|
||||
defaultClass: true
|
||||
defaultClassReplicaCount: 1
|
||||
defaultClassReplicaCount: 2
|
||||
# Retain volumes on PVC delete — safer during migration
|
||||
reclaimPolicy: Retain
|
||||
# Mount options for ext4
|
||||
fstype: ext4
|
||||
# longhorn-manager is a DaemonSet — it must run on every storage node.
|
||||
# longhorn-manager is a DaemonSet — it must run on every storage node,
|
||||
# including the P330 failover node. The control-plane toleration is defensive
|
||||
# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
|
||||
# R740, but keeps things correct if that ever changes).
|
||||
longhornManager:
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:/lEcTm3XFvlmSSJwYhG0CeYXmDHOfUa+yHXfQFxt9WgHN/EBGQ==,iv:h2ZUX6s/lrhjp6yC+PFYACR10uxH7D86vAESbQ9H/9s=,tag:F5xBv+YpjHeErRKTRzNM6g==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
# Was the failover taint toleration (now a no-op; see note above)
|
||||
# Tolerate the failover taint so longhorn-manager runs on the P330
|
||||
- key: ENC[AES256_GCM,data:dBRTGlRjjGCR,iv:AcPEXMinsw6ow0izpIXFntwZUMAvMOA1P65mJDBwhmw=,tag:0w24kf8BfryNs07RpWme9w==,type:str]
|
||||
value: ENC[AES256_GCM,data:7XvkPrpko5A=,iv:J8qgVcveMb17rgzYN6WgmE5NpsaKDKMU/2EEctaQL5I=,tag:T9ofKbtlEiVPBqX/xEpnFA==,type:str]
|
||||
operator: Equal
|
||||
effect: NoSchedule
|
||||
# longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
|
||||
# taints so CSI operations work. The second toleration was for the removed
|
||||
# failover taint and is now a harmless encrypted no-op.
|
||||
# taints so CSI operations work from the failover node.
|
||||
longhornDriver:
|
||||
tolerations:
|
||||
- key: ENC[AES256_GCM,data:LuvHfPv9JRofL9cOJe/kvfs01+9F3d1hiCjr+WCTzMrxlneCBw==,iv:aC8TMpygwEio0Y6zau5QGTRNMDoxajuBLwVrFF+7fjg=,tag:nSJB+PBouekJkX23ar46kA==,type:str]
|
||||
@@ -47,7 +53,8 @@ longhornDriver:
|
||||
value: ENC[AES256_GCM,data:A7XxyClHSCQ=,iv:cw9fzGcxDcSrELJlWmqxGuzTvZy5aYe/y43Xq0a1xdc=,tag:sj0ZQPBXJQURZ6A3QPJENg==,type:str]
|
||||
operator: Equal
|
||||
effect: NoSchedule
|
||||
# longhorn-ui — tolerate the same taints so the UI is reachable.
|
||||
# longhorn-ui — tolerate the same taints so the UI is reachable even if it
|
||||
# lands on the failover node.
|
||||
longhornUI:
|
||||
replicas: 1
|
||||
tolerations:
|
||||
|
||||
Reference in New Issue
Block a user