From 27171b64c4daceb2f1b62d25d6b15d6e776ffdb2 Mon Sep 17 00:00:00 2001 From: auricom <27022259+auricom@users.noreply.github.com> Date: Wed, 12 Jul 2023 19:22:13 +0200 Subject: [PATCH] =?UTF-8?q?fixup!=20=E2=99=BB=EF=B8=8F=20migration=20exter?= =?UTF-8?q?nalsecrets?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../default/ghostfolio/app/helmrelease.yaml | 9 +++-- .../default/hajimari/app/helmrelease.yaml | 2 + .../default/libreddit/app/helmrelease.yaml | 2 + .../apps/default/nitter/app/helmrelease.yaml | 1 + .../default/paperless/app/externalsecret.yaml | 37 +++++++++++++++++++ .../default/paperless/app/helmrelease.yaml | 21 +++++------ .../default/paperless/app/kustomization.yaml | 4 +- .../paperless/app/patches/postgres.yaml | 32 ---------------- .../default/paperless/app/secret.sops.yaml | 33 ----------------- kubernetes/apps/default/paperless/ks.yaml | 1 + 10 files changed, 59 insertions(+), 83 deletions(-) create mode 100644 kubernetes/apps/default/paperless/app/externalsecret.yaml delete mode 100644 kubernetes/apps/default/paperless/app/patches/postgres.yaml delete mode 100644 kubernetes/apps/default/paperless/app/secret.sops.yaml diff --git a/kubernetes/apps/default/ghostfolio/app/helmrelease.yaml b/kubernetes/apps/default/ghostfolio/app/helmrelease.yaml index 8d448c9cc..612a707d7 100644 --- a/kubernetes/apps/default/ghostfolio/app/helmrelease.yaml +++ b/kubernetes/apps/default/ghostfolio/app/helmrelease.yaml @@ -27,6 +27,10 @@ spec: uninstall: keepHistory: false values: + controller: + strategy: RollingUpdate + annotations: + reloader.stakater.com/auto: "true" initContainers: 01-init-db: image: ghcr.io/onedr0p/postgres-init:14.8 @@ -34,15 +38,12 @@ spec: envFrom: &envFrom - secretRef: name: ghostfolio-secret - controller: - annotations: - reloader.stakater.com/auto: "true" image: repository: docker.io/ghostfolio/ghostfolio tag: 1.287.0 env: NODE_ENV: production - REDIS_HOST: redis.default.svc.cluster.local + REDIS_HOST: redis-headless.default.svc.cluster.local REDIS_PORT: 6379 envFrom: *envFrom service: diff --git a/kubernetes/apps/default/hajimari/app/helmrelease.yaml b/kubernetes/apps/default/hajimari/app/helmrelease.yaml index 2ce9daba3..920d6b7e7 100644 --- a/kubernetes/apps/default/hajimari/app/helmrelease.yaml +++ b/kubernetes/apps/default/hajimari/app/helmrelease.yaml @@ -27,6 +27,8 @@ spec: uninstall: keepHistory: false values: + controller: + strategy: RollingUpdate env: TZ: ${TIMEZONE} hajimari: diff --git a/kubernetes/apps/default/libreddit/app/helmrelease.yaml b/kubernetes/apps/default/libreddit/app/helmrelease.yaml index cce04e7b0..babdf5997 100644 --- a/kubernetes/apps/default/libreddit/app/helmrelease.yaml +++ b/kubernetes/apps/default/libreddit/app/helmrelease.yaml @@ -27,6 +27,8 @@ spec: uninstall: keepHistory: false values: + controller: + strategy: RollingUpdate image: repository: ghcr.io/auricom/libreddit tag: 0.30.1@sha256:58108c7aaf963cd7903c0e35f6af041f9ed77fdf8bd7019f79b9a989846ee97a diff --git a/kubernetes/apps/default/nitter/app/helmrelease.yaml b/kubernetes/apps/default/nitter/app/helmrelease.yaml index 865e2b6b5..5a5024d03 100644 --- a/kubernetes/apps/default/nitter/app/helmrelease.yaml +++ b/kubernetes/apps/default/nitter/app/helmrelease.yaml @@ -28,6 +28,7 @@ spec: keepHistory: false values: controller: + strategy: RollingUpdate annotations: reloader.stakater.com/auto: "true" image: diff --git a/kubernetes/apps/default/paperless/app/externalsecret.yaml b/kubernetes/apps/default/paperless/app/externalsecret.yaml new file mode 100644 index 000000000..eb65d6259 --- /dev/null +++ b/kubernetes/apps/default/paperless/app/externalsecret.yaml @@ -0,0 +1,37 @@ +--- +# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: paperless + namespace: default +spec: + secretStoreRef: + kind: ClusterSecretStore + name: onepassword-connect + target: + name: paperless-secret + creationPolicy: Owner + template: + engineVersion: v2 + data: + # App + PAPERLESS_ADMIN_USER: "{{ .USERNAME }}" + PAPERLESS_ADMIN_PASSWORD: "{{ .PASSWORD }}" + PAPERLESS_SECRET_KEY: "{{ .PAPERLESS_SECRET_KEY }}" + PAPERLESS_DBUSER: &dbUser "{{ .POSTGRES_USER }}" + PAPERLESS_DBPASS: &dbPass "{{ .POSTGRES_PASS }}" + PAPERLESS_DBHOST: &dbHost postgres-rw.default.svc.cluster.local + PAPERLESS_DBPORT: "5432" + + # Postgres Init + INIT_POSTGRES_DBNAME: paperless + INIT_POSTGRES_HOST: *dbHost + INIT_POSTGRES_USER: *dbUser + INIT_POSTGRES_PASS: *dbPass + INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}" + dataFrom: + - extract: + key: cloudnative-pg + - extract: + key: paperless diff --git a/kubernetes/apps/default/paperless/app/helmrelease.yaml b/kubernetes/apps/default/paperless/app/helmrelease.yaml index 2b22da13a..ebc2f415e 100644 --- a/kubernetes/apps/default/paperless/app/helmrelease.yaml +++ b/kubernetes/apps/default/paperless/app/helmrelease.yaml @@ -6,7 +6,7 @@ metadata: name: &app paperless namespace: default spec: - interval: 15m + interval: 30m chart: spec: chart: app-template @@ -15,7 +15,7 @@ spec: kind: HelmRepository name: bjw-s namespace: flux-system - maxHistory: 3 + maxHistory: 2 install: createNamespace: true remediation: @@ -27,8 +27,13 @@ spec: uninstall: keepHistory: false values: - global: - nameOverride: *app + initContainers: + 01-init-db: + image: ghcr.io/onedr0p/postgres-init:14.8 + imagePullPolicy: IfNotPresent + envFrom: &envFrom + - secretRef: + name: &secret outline-secret image: repository: ghcr.io/paperless-ngx/paperless-ngx tag: 1.16.5 @@ -42,18 +47,12 @@ spec: PAPERLESS_OCR_LANGUAGES: fra PAPERLESS_OCR_LANGUAGE: fra PAPERLESS_PORT: 8000 - PAPERLESS_DBHOST: ${POSTGRES_HOST} - PAPERLESS_DBPORT: ${POSTGRES_PORT} PAPERLESS_DBNAME: paperless PAPERLESS_REDIS: redis://paperless-redis.default.svc.cluster.local:6379 PAPERLESS_TASK_WORKERS: 2 PAPERLESS_TIME_ZONE: "Europe/Paris" PAPERLESS_URL: https://paperless.${SECRET_CLUSTER_DOMAIN} - envFrom: - - secretRef: - name: *app - podAnnotations: - secret.reloader.stakater.com/reload: *app + envFrom: *envFrom service: main: ports: diff --git a/kubernetes/apps/default/paperless/app/kustomization.yaml b/kubernetes/apps/default/paperless/app/kustomization.yaml index 7f8d2f666..d54e57b8d 100644 --- a/kubernetes/apps/default/paperless/app/kustomization.yaml +++ b/kubernetes/apps/default/paperless/app/kustomization.yaml @@ -4,8 +4,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization namespace: default resources: + - ./externalsecret.yaml - ./helmrelease.yaml - ./redis - - ./secret.sops.yaml -patchesStrategicMerge: - - ./patches/postgres.yaml diff --git a/kubernetes/apps/default/paperless/app/patches/postgres.yaml b/kubernetes/apps/default/paperless/app/patches/postgres.yaml deleted file mode 100644 index 1ddf31417..000000000 --- a/kubernetes/apps/default/paperless/app/patches/postgres.yaml +++ /dev/null @@ -1,32 +0,0 @@ ---- -# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: &app paperless - namespace: default -spec: - values: - initContainers: - init-db: - image: ghcr.io/onedr0p/postgres-initdb:14.8 - env: - - name: POSTGRES_HOST - value: ${POSTGRES_HOST} - - name: POSTGRES_DB - value: *app - - name: POSTGRES_SUPER_PASS - valueFrom: - secretKeyRef: - name: postgres-superuser - key: password - - name: POSTGRES_USER - valueFrom: - secretKeyRef: - name: *app - key: PAPERLESS_DBUSER - - name: POSTGRES_PASS - valueFrom: - secretKeyRef: - name: *app - key: PAPERLESS_DBPASS diff --git a/kubernetes/apps/default/paperless/app/secret.sops.yaml b/kubernetes/apps/default/paperless/app/secret.sops.yaml deleted file mode 100644 index f19e5f026..000000000 --- a/kubernetes/apps/default/paperless/app/secret.sops.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# yamllint disable -apiVersion: v1 -kind: Secret -metadata: - name: paperless - namespace: default -type: Opaque -stringData: - PAPERLESS_ADMIN_USER: ENC[AES256_GCM,data:UMBtTvyE,iv:vZhUUErw66/8mRPcLh1H348ft7ItC9IOI3Gk1hi5w9E=,tag:3IX5RxMb6m87EOKIOqyPNQ==,type:str] - PAPERLESS_ADMIN_PASSWORD: ENC[AES256_GCM,data:3ce/of7nVeVGM0L6PeN21PdnlR8=,iv:WMt1Hagka1Q94XHyKtYOL/2TCHK534VHyPCIdf7m9p4=,tag:7ABSbgLNY+BqTUqQbr6gOg==,type:str] - PAPERLESS_SECRET_KEY: ENC[AES256_GCM,data:ABb6LpEmd7+fsN7U6RNGsj3EY8qOnwGfirljaQ==,iv:ZY+n28JYDGP0zj9DRo/E8hjLF996Hlvfj9Pl/cBv4qw=,tag:BCB3Y8PmeYt7kbnhBu/+PQ==,type:str] - PAPERLESS_DBUSER: ENC[AES256_GCM,data:QJJuRZa5Q2RA,iv:AMdb2Cq7RpJq58y11Y1wZ5DjKItjiIgXuWZw+BDw4kE=,tag:tUhEzpUZtJwwsezJ27sEmQ==,type:str] - PAPERLESS_DBPASS: ENC[AES256_GCM,data:SmOYMCIKVdb055LndV4=,iv:v+fvsgcnxFyITBhNT5Le3Oj4dgJmuuOINSQPe92NQpo=,tag:ATnfIcpuiGXKGaGHzAvRHA==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaU16anJNV2pBZmxPR3h2 - bWREUnpjcTFvd05ZQ2E4VVBDdm1FL2k4WEYwCkdQSStTNWtpdjNkUW51WS9MekdC - VkpTUUFjSjY2a1JMOUtqOVh5M0JRR2sKLS0tIDRmcWpJSEVvaUp4U1lsaTZYZGNw - OGVKWU0zNUZJSFh4aFJxQWFsYm1VeFkKaDeI/hl7z0Qh8t5W39Kxu9ert1dt4xo+ - LX+MjpVqxiZNcfwROD4bkWeQSN+VsxoGOOyj4L15BlggNnlg+L7Hww== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2022-11-23T12:47:16Z" - mac: ENC[AES256_GCM,data:dK2hiLaWxTdeeesw6TuZdP2x572ipTJNser/wEFGwTkxn6ABcT6hQTnoo0TybM7xMNaIaf02DnwBZSOBSqo8LL5n+5d93CR4SE2gd2a3ogBf68r34mQVZ3kWYSZ/1K0L6eOJOjxPK5SoLwplW8JY1J1NhxMO3/zPsBqsFiXOnBw=,iv:5JV8DdNIyRPblCOxGXvAVePRPG038KgBGJh95F67O98=,tag:HITSMQZWEHi4dvD5cf1zOw==,type:str] - pgp: [] - encrypted_regex: ^(data|stringData)$ - version: 3.7.3 diff --git a/kubernetes/apps/default/paperless/ks.yaml b/kubernetes/apps/default/paperless/ks.yaml index a771851bc..bf7b10ed7 100644 --- a/kubernetes/apps/default/paperless/ks.yaml +++ b/kubernetes/apps/default/paperless/ks.yaml @@ -15,6 +15,7 @@ spec: name: home-ops-kubernetes dependsOn: - name: cluster-apps-cloudnative-pg-cluster + - name: cluster-apps-external-secrets-stores healthChecks: - apiVersion: helm.toolkit.fluxcd.io/v2beta1 kind: HelmRelease