Compare commits
18 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Gitea Actions Bot
|
4dde5bf38b | ||
 Ultradesu
|
37c77a899d | ||
|
Ultradesu
|
f84f4ff972 | ||
|
Ultradesu
|
897498eedb | ||
|
Ultradesu
|
6202f0f24c | ||
|
Ultradesu
|
1746d210b1 | ||
|
Ultradesu
|
8ee4d7ebbf | ||
|
Ultradesu
|
ad7fce508f | ||
 ab
|
204f794b5d | ||
|
ab
|
5a7e32336e | ||
|
Ultradesu
|
d3ee23c3de | ||
|
Ultradesu
|
0df274c0b2 | ||
|
Ultradesu
|
658ec19ff1 | ||
|
Ultradesu
|
eb27dcf65b | ||
|
Ultradesu
|
e44cf95bb2 | ||
|
Ultradesu
|
df6ab28165 | ||
|
Ultradesu
|
72cbcc3952 | ||
|
Ultradesu
|
2afe27bfd4 |
@@ -22,6 +22,7 @@ ArgoCD homelab project
|
||||
| **kube-system-custom** | [](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
|
||||
| **kubernetes-dashboard** | [](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
|
||||
| **longhorn** | [](https://ag.hexor.cy/applications/argocd/longhorn) |
|
||||
| **oauth2-proxy** | [](https://ag.hexor.cy/applications/argocd/oauth2-proxy) |
|
||||
| **postgresql** | [](https://ag.hexor.cy/applications/argocd/postgresql) |
|
||||
| **prom-stack** | [](https://ag.hexor.cy/applications/argocd/prom-stack) |
|
||||
| **system-upgrade** | [](https://ag.hexor.cy/applications/argocd/system-upgrade) |
|
||||
|
||||
@@ -70,7 +70,7 @@ kind: Deployment
|
||||
metadata:
|
||||
name: gitea-runner
|
||||
spec:
|
||||
replicas: 1
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: gitea-runner
|
||||
@@ -79,11 +79,19 @@ spec:
|
||||
labels:
|
||||
app: gitea-runner
|
||||
spec:
|
||||
dnsConfig:
|
||||
options:
|
||||
- name: ndots
|
||||
value: "2"
|
||||
tolerations:
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: desktop
|
||||
effect: NoSchedule
|
||||
- key: workload
|
||||
operator: Equal
|
||||
value: ai
|
||||
effect: NoSchedule
|
||||
volumes:
|
||||
- name: docker-sock
|
||||
hostPath:
|
||||
@@ -93,6 +101,12 @@ spec:
|
||||
emptyDir:
|
||||
sizeLimit: 30Gi
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels:
|
||||
app: gitea-runner
|
||||
topologyKey: kubernetes.io/hostname
|
||||
nodeAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
@@ -102,6 +116,7 @@ spec:
|
||||
operator: In
|
||||
values:
|
||||
- uk-desktop.tail2fe2d.ts.net
|
||||
- ai.tail2fe2d.ts.net
|
||||
- weight: 50
|
||||
preference:
|
||||
matchExpressions:
|
||||
@@ -109,22 +124,7 @@ spec:
|
||||
operator: In
|
||||
values:
|
||||
- home.homenet
|
||||
- weight: 30
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- master.tail2fe2d.ts.net
|
||||
- weight: 10
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- it.tail2fe2d.ts.net
|
||||
- ch.tail2fe2d.ts.net
|
||||
- us.tail2fe2d.ts.net
|
||||
containers:
|
||||
- name: gitea-runner
|
||||
image: gitea/act_runner:nightly
|
||||
@@ -144,13 +144,18 @@ spec:
|
||||
mountPath: /data
|
||||
env:
|
||||
- name: GITEA_INSTANCE_URL
|
||||
#value: "http://gitea.gitea.svc.cluster.local"
|
||||
value: "https://gt.hexor.cy"
|
||||
- name: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-runner-act-runner-secrets
|
||||
key: token
|
||||
- name: NODE_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: spec.nodeName
|
||||
- name: GITEA_RUNNER_NAME
|
||||
value: "k8s-runner"
|
||||
value: "$(NODE_NAME)"
|
||||
- name: GITEA_RUNNER_LABELS
|
||||
value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
|
||||
|
||||
@@ -12,4 +12,5 @@ resources:
|
||||
- ./telemt-servicemonitor.yaml
|
||||
- ./service.yaml
|
||||
- ./secret-reader.yaml
|
||||
- ./secret-reader-ingress.yaml
|
||||
# - ./storage.yaml
|
||||
|
||||
@@ -0,0 +1,45 @@
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: keycloak-auth
|
||||
spec:
|
||||
forwardAuth:
|
||||
address: http://oauth2-proxy.oauth2-proxy.svc:80
|
||||
trustForwardHeader: true
|
||||
authResponseHeaders:
|
||||
- X-Auth-Request-User
|
||||
- X-Auth-Request-Email
|
||||
- X-Auth-Request-Groups
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: secret-reader
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`secret-reader.hexor.cy`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: keycloak-auth
|
||||
services:
|
||||
- name: secret-reader
|
||||
port: 80
|
||||
tls:
|
||||
secretName: secret-reader-tls
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: secret-reader-tls
|
||||
spec:
|
||||
secretName: secret-reader-tls
|
||||
issuerRef:
|
||||
name: letsencrypt
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- secret-reader.hexor.cy
|
||||
@@ -16,22 +16,8 @@ extraEnvFrom: |
|
||||
name: keycloak-creds
|
||||
|
||||
extraEnv: |
|
||||
- name: KC_DB
|
||||
value: postgres
|
||||
- name: KC_DB_URL_HOST
|
||||
value: psql.psql.svc
|
||||
- name: KC_DB_URL_PORT
|
||||
value: "5432"
|
||||
- name: KC_DB_URL_DATABASE
|
||||
value: keycloak
|
||||
- name: KC_HOSTNAME
|
||||
value: auth.hexor.cy
|
||||
- name: KC_HTTP_ENABLED
|
||||
value: "true"
|
||||
- name: KC_HEALTH_ENABLED
|
||||
value: "true"
|
||||
- name: KC_METRICS_ENABLED
|
||||
value: "true"
|
||||
- name: JAVA_OPTS_APPEND
|
||||
value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
|
||||
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
apiVersion: argoproj.io/v1alpha1
|
||||
kind: Application
|
||||
metadata:
|
||||
name: oauth2-proxy
|
||||
namespace: argocd
|
||||
spec:
|
||||
project: core
|
||||
destination:
|
||||
namespace: oauth2-proxy
|
||||
server: https://kubernetes.default.svc
|
||||
source:
|
||||
repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
|
||||
targetRevision: HEAD
|
||||
path: k8s/core/oauth2-proxy
|
||||
syncPolicy:
|
||||
automated:
|
||||
selfHeal: true
|
||||
prune: true
|
||||
syncOptions:
|
||||
- CreateNamespace=true
|
||||
- ServerSideApply=true
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: oauth2-proxy-creds
|
||||
spec:
|
||||
target:
|
||||
name: oauth2-proxy-creds
|
||||
deletionPolicy: Delete
|
||||
template:
|
||||
type: Opaque
|
||||
data:
|
||||
client-id: oauth2-proxy
|
||||
client-secret: |-
|
||||
{{ .client_secret }}
|
||||
cookie-secret: |-
|
||||
{{ .cookie_secret }}
|
||||
data:
|
||||
- secretKey: client_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
property: login.password
|
||||
- secretKey: cookie_secret
|
||||
sourceRef:
|
||||
storeRef:
|
||||
name: vaultwarden-login
|
||||
kind: ClusterSecretStore
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
metadataPolicy: None
|
||||
key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
|
||||
property: fields[0].value
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- app.yaml
|
||||
- external-secrets.yaml
|
||||
|
||||
helmCharts:
|
||||
- name: oauth2-proxy
|
||||
repo: https://oauth2-proxy.github.io/manifests
|
||||
version: 10.4.3
|
||||
releaseName: oauth2-proxy
|
||||
namespace: oauth2-proxy
|
||||
valuesFile: values.yaml
|
||||
@@ -0,0 +1,3 @@
|
||||
# Middleware is deployed per-namespace alongside each IngressRoute
|
||||
# because Traefik does not allow cross-namespace middleware references.
|
||||
# See k8s/apps/mtproxy/secret-reader-ingress.yaml for example.
|
||||
@@ -0,0 +1,51 @@
|
||||
replicaCount: 1
|
||||
|
||||
config:
|
||||
existingSecret: oauth2-proxy-creds
|
||||
configFile: |-
|
||||
provider = "keycloak-oidc"
|
||||
provider_display_name = "Keycloak"
|
||||
oidc_issuer_url = "https://auth.hexor.cy/auth/realms/hexor"
|
||||
redirect_url = "https://oauth.hexor.cy/oauth2/callback"
|
||||
email_domains = ["*"]
|
||||
cookie_domains = [".hexor.cy"]
|
||||
whitelist_domains = [".hexor.cy"]
|
||||
cookie_secure = true
|
||||
cookie_samesite = "lax"
|
||||
upstreams = ["static://200"]
|
||||
reverse_proxy = true
|
||||
set_xauthrequest = true
|
||||
set_authorization_header = true
|
||||
pass_access_token = true
|
||||
pass_authorization_header = true
|
||||
skip_provider_button = true
|
||||
code_challenge_method = "S256"
|
||||
scope = "openid profile email"
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt
|
||||
traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
|
||||
hosts:
|
||||
- oauth.hexor.cy
|
||||
tls:
|
||||
- secretName: oauth2-proxy-tls
|
||||
hosts:
|
||||
- oauth.hexor.cy
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: master.tail2fe2d.ts.net
|
||||
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/master
|
||||
effect: NoSchedule
|
||||
Reference in New Issue
Block a user