shpaq/auricom-home-cluster
1
0
Fork 0
mirror of https://github.com/auricom/home-cluster.git synced 2025-09-17 18:24:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixup! ♻️ migration externalsecrets

Browse Source
This commit is contained in:
auricom
2023-07-13 18:33:28 +02:00
parent 4021dac4df
commit eacff455da
125 changed files with 1061 additions and 1474 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
kubernetes/apps/default/vikunja/app/backups/kustomization.yaml
View File

@@ -1,7 +0,0 @@
---
# yaml-language-server: $schema=https://json.schemastore.org/kustomization
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./replicationsource.yaml
- ./restic.sops.yaml

25
kubernetes/apps/default/vikunja/app/backups/replicationsource.yaml
View File

@@ -1,25 +0,0 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: vikunja
namespace: default
spec:
sourcePVC: vikunja-files
trigger:
schedule: "0 0 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 10
repository: vikunja-restic
cacheCapacity: 2Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
retain:
daily: 10
within: 3d

35
kubernetes/apps/default/vikunja/app/backups/restic.sops.yaml
View File

@@ -1,35 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: vikunja-restic
namespace: default
type: Opaque
stringData:
#ENC[AES256_GCM,data:WTM0Lkqp+sxjbUgkNzAVZQnC5g==,iv:4y8R8GpLy2Ogh3Lt3v6ibVbJF7jy8K1BOGi+ONt7S5c=,tag:wRhEBfRNHp0PBvIjM60iSA==,type:comment]
RESTIC_REPOSITORY: ENC[AES256_GCM,data:DRnr4ptC0pZnm1K+Vov2pOS89+PXdZA3xtQVGedWFYJJxKAWnJlF2I4VWvegxNGxDRzDFrPAWOZp,iv:FoHVMYFLdC00BjbSUeoac1CoQA06Jm/fV+NEeWpAx8Y=,tag:AmOc73QKyRAgMPGYpVdMgg==,type:str]
#ENC[AES256_GCM,data:cRvGVeuDnEbJs01G+Und5ls1EgaC9Q2vj61IE/2R,iv:qSjv4bGEX9QWABhXgnCJsoj0p1kjgYaQwQX0Oyu9RHk=,tag:x8i1WXbAvdpC+Iv8pn/drw==,type:comment]
RESTIC_PASSWORD: ENC[AES256_GCM,data:6VI/lJQFZg6hu5r0SqNAKQAQGYY=,iv:UYRMnkHB4jsXcV1tyLDTAqh6dxsd18hYWsDoSpjJarA=,tag:d6hgK6LSgu7vZbLfquKcyA==,type:str]
#ENC[AES256_GCM,data:YIIHR5DwXv3YE9fFvNSAfrm47ZsshZMcY31LbaJ4gwXo0yOOHe6qDEc=,iv:axSMsvrIOkJFlErvw9fcAwLNSEWDh6mUU6dWZu6icIo=,tag:MDNlk43vcI9S4o6tMiWVmw==,type:comment]
#ENC[AES256_GCM,data:8Wspw6gPIPBsumfRS/5dlZrAQQqBJEDMgcpip4a3HCfHq8SeVDv4Gl0j3hyZqUsP5af8nN69Y/9bas7z1hnIERkrb8DqYg==,iv:WqCz9vBfg1JxUEpd97J37YztSW3HkcOHa6nIJI4VK8I=,tag:+LxnOzGidF39ojPKSOrVsg==,type:comment]
AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:I9vuuPEGS6A135zwKUNXvSIAjwk=,iv:dByy2WuuhO6OluWXYRwkdMutK33yKwOcWkR9hvY5bsg=,tag:xHU7Hbx+sxuZ9CRymA55JQ==,type:str]
AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:kRdbENGS1F32JzkvktYkbfhMGBSrUpFSfyCdIpJwLOc+/2TyHAMrxA==,iv:Q+UKNT9aRo+A0KWu/FiST/4bOQKTOBJKHhpP8JXD3ao=,tag:7VE8lx2QAdNutcUj5kMNNA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4RE9wTDZVRlExcnVKYjVZ
THNtblNXbGlSUitoS0FYV2k3dlg3aWZEMWxjCmZETUFGSnR0c3JZU2FHNnFneHdB
TEdlYjJTcjNsSDQ0dmgvNWlnNWo4TWMKLS0tIGR2Q25heThUUGliY0ZicDNra1FN
dGppaVJiME1FQnkzdVJOeTZMcjhYWE0KBrGQAYun1Zs3oyHWQ8iGvmF4hheP3md4
3/Lc9CqEC+V1lT9On8ivEBethjt528vCyVMM5pLMRBEO6CMjlNhJ+g==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-12-28T06:25:36Z"
mac: ENC[AES256_GCM,data:aI42cmAJAJd+NhktFhGTZ7uheN3HOWsJhzXKXZasdj4X0T/+COCO/+vjLcY1JH3rlkRi1GQm/PD+b/qncg1wczrn5YGiJJqyS+UmnGKaElBqFuI+/A78eN9BSX958yHuyHRHNUyXOEC0NCyjb5nOSdQi2nDaZX0biMQwXAxHLQQ=,iv:HQnXpSChZXVRhwbitJw1RIJBQdIi64+hfYG8LYiMfPs=,tag:P6kJp+32HXimosiVBuJVEw==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

35
kubernetes/apps/default/vikunja/app/externalsecret.yaml Normal file
View File

@@ -0,0 +1,35 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: vikunja
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: vikunja-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
# App
VIKUNJA_DATABASE_HOST: &dbHost postgres-rw.default.svc.cluster.local.
VIKUNJA_DATABASE_DATABASE: &dbName vikunja
VIKUNJA_DATABASE_USER: &dbUser "{{ .VIKUNJA_POSTGRES_USER }}"
VIKUNJA_DATABASE_PASSWORD: &dbPass "{{ .VIKUNJA_POSTGRES_PASS }}"
VIKUNJA_DATABASE_TYPE: postgres
VIKUNJA_SERVICE_JWTSECRET: "{{ .VIKUNJA_SERVICE_JWTSECRET }}"
# Postgres Init
INIT_POSTGRES_DBNAME: *dbName
INIT_POSTGRES_HOST: *dbHost
INIT_POSTGRES_USER: *dbUser
INIT_POSTGRES_PASS: *dbPass
INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_SUPER_PASS }}"
dataFrom:
- extract:
key: cloudnative-pg
- extract:
key: vikunja

50
kubernetes/apps/default/vikunja/app/helmrelease.yaml
View File

@@ -6,7 +6,7 @@ metadata:
name: &app vikunja
namespace: default
spec:
interval: 15m
interval: 30m
chart:
spec:
chart: app-template
@@ -15,7 +15,7 @@ spec:
kind: HelmRepository
name: bjw-s
namespace: flux-system
maxHistory: 3
maxHistory: 2
install:
createNamespace: true
remediation:
@@ -27,15 +27,27 @@ spec:
uninstall:
keepHistory: false
values:
initContainers:
01-init-db:
image: ghcr.io/onedr0p/postgres-init:14.8
imagePullPolicy: IfNotPresent
envFrom: &envFrom
- secretRef:
name: &secret vikunja-secret
controller:
replicas: 1
annotations:
reloader.stakater.com/auto: "true"
strategy: Recreate
image:
repository: caddy
tag: 2.6.4-alpine
envFrom:
- secretRef:
name: *app
name: vikunja-secret
env:
VIKUNJA_MAILER_HOST: smtp-relay.default.svc.cluster.local.
VIKUNJA_MAILER_PORT: "2525"
VIKUNJA_MAILER_FROMEMAIL: Vikunja <vikunja@${SECRET_DOMAIN}>
service:
main:
ports:
@@ -68,7 +80,7 @@ spec:
type: "custom"
volumeSpec:
configMap:
name: *app
name: vikunja-configmap
vikunja-config:
enabled: "true"
mountPath: /etc/vikunja/config.yml
@@ -76,10 +88,7 @@ spec:
type: "custom"
volumeSpec:
configMap:
name: *app
podAnnotations:
configMap.reloader.stakater.com/reload: *app
secret.reloader.stakater.com/reload: *app
name: vikunja-configmap
resources:
requests:
cpu: 5m
@@ -91,28 +100,7 @@ spec:
name: api
image: vikunja/api:0.21.0
imagePullPolicy: IfNotPresent
env:
- name: VIKUNJA_SERVICE_JWTSECRET
valueFrom:
secretKeyRef:
name: vikunja
key: VIKUNJA_SERVICE_JWTSECRET
- name: VIKUNJA_DATABASE_TYPE
value: postgres
- name: VIKUNJA_DATABASE_HOST
value: ${POSTGRES_HOST}
- name: VIKUNJA_DATABASE_DATABASE
value: vikunja
- name: VIKUNJA_DATABASE_USER
valueFrom:
secretKeyRef:
name: vikunja
key: VIKUNJA_DATABASE_USER
- name: VIKUNJA_DATABASE_PASSWORD
valueFrom:
secretKeyRef:
name: vikunja
key: VIKUNJA_DATABASE_PASSWORD
envFrom: *envFrom
volumeMounts:
- name: vikunja-config
mountPath: /etc/vikunja/config.yml

8
kubernetes/apps/default/vikunja/app/kustomization.yaml
View File

@@ -4,14 +4,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: default
resources:
- ./backups
- ./externalsecret.yaml
- ./helmrelease.yaml
- ./secret.sops.yaml
- ./volsync.yaml
- ./volume.yaml
patchesStrategicMerge:
- ./patches/postgres.yaml
configMapGenerator:
- name: vikunja
- name: vikunja-configmap
files:
- ./config/Caddyfile
generatorOptions:

32
kubernetes/apps/default/vikunja/app/patches/postgres.yaml
View File

@@ -1,32 +0,0 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/helm.toolkit.fluxcd.io/helmrelease_v2beta1.json
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
name: vikunja
namespace: default
spec:
values:
initContainers:
init-db:
image: ghcr.io/onedr0p/postgres-initdb:14.8
env:
- name: POSTGRES_HOST
value: ${POSTGRES_HOST}
- name: POSTGRES_DB
value: vikunja
- name: POSTGRES_SUPER_PASS
valueFrom:
secretKeyRef:
name: postgres-superuser
key: password
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: vikunja
key: VIKUNJA_DATABASE_USER
- name: POSTGRES_PASS
valueFrom:
secretKeyRef:
name: vikunja
key: VIKUNJA_DATABASE_PASSWORD

34
kubernetes/apps/default/vikunja/app/secret.sops.yaml
View File

@@ -1,34 +0,0 @@
# yamllint disable
apiVersion: v1
kind: Secret
metadata:
name: vikunja
namespace: default
type: Opaque
stringData:
VIKUNJA_SERVICE_JWTSECRET: ENC[AES256_GCM,data:4J8HtMOUKxNTEksSXYKrAAQ2KNFvdluzTvzY05/8T7k=,iv:h/666tO3f5hplYEaVJsh4BGjPlO/sFopb3+ryI3dzsQ=,tag:8dJLb9f2QgH9S/8qwF2ryg==,type:str]
VIKUNJA_DATABASE_USER: ENC[AES256_GCM,data:IzqNYqs+HQ==,iv:bfIcOoN/DhtqAcTYtSRBXnnPF+0zM4YY+kKYGesEUJo=,tag:4C1FeAoG6QOc2AqKRKxaSw==,type:str]
VIKUNJA_DATABASE_PASSWORD: ENC[AES256_GCM,data:7EylHKZA0JLmu+9ooB8oVw==,iv:AaXKHrU9yBPE1hci/cfOtnkxq5XHVeoJbRLzJ/SjLxE=,tag:x9stCWILtUYHjxBKNrhXEg==,type:str]
VIKUNJA_MAILER_HOST: ENC[AES256_GCM,data:oRfkMDOjxFl1f/EOlAkkHgEFTufyYjcvv6RwFSMRyLGKt/wr8A==,iv:U3Jafk0PMBnjzEfvyZ9x5oUUfulCee7j6FTgg+bNGiA=,tag:b0EYelcD1+mZJgF6MGQbiA==,type:str]
VIKUNJA_MAILER_PORT: ENC[AES256_GCM,data:hR5uWg==,iv:r7C2+WKphiadrgSC5yPlSEzB848im2sycU/3JW/B8PQ=,tag:W1wZ+onDoOtQc/Ew40JFkg==,type:str]
VIKUNJA_MAILER_FROMEMAIL: ENC[AES256_GCM,data:UpQWnJN0aLcBYAi238SGkWg1TrjOqUXA3JtBSalZVfuroA==,iv:VVUjuNiIc82KlH2pd0qMlOIZEoRi3DHcRqP1yGTk/IU=,tag:PVqBIYoD9Tz1hg74coLeHA==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1hhurqwmfvl9m3vh3hk8urulfzcdsrep2ax2neazqt435yhpamu3qj20asg
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4TWU5YTlFY3FPQWhnZ2I2
akxnZ2xIRVNFZTdOWmg0dFhxTUNoZEFIM1cwCit5WnduNlQ1MkF2aytCVldMeVlC
Yk5QNWRQRllOT3ZTL3VGcjJNK1VqeUkKLS0tIFMyWHNFd29nc2tMektxclJkK0pT
Ny9OQ0l4ZXMrdW40NmRsbzgvZ0w5V3cKqTGvN5zk2TPgtxoVfwI7Wsz4N+lC9+Kq
DCXTgTU/QXm9dvo4ErPPzeWFqdk4JchExhvSJV2JfM32O+3z+EGhNg==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2022-09-16T20:42:23Z"
mac: ENC[AES256_GCM,data:0fH3fnxti4QLymzxc0gN5SWXbzpKUl0Mq2OG/fs5jx3YB9YW2ZNR6D7eO7A0dtF8G61YZT/fL4+MJtcQW8Gl/snVAFdEU2GLs6Jr5orCFvoHzaIzkl68/eehrWC6CFHpfljlBqNn5lA85GU8t4zrIbZiO207rDdPYsTZIXu3G8E=,iv:bOzx4OVPkoTbvABLsRF11VshmYIyTImhgRbPEiCF6lM=,tag:3I2VNKnAeqwK5yqdYiK0hQ==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$
version: 3.7.3

49
kubernetes/apps/default/vikunja/app/volsync.yaml Normal file
View File

@@ -0,0 +1,49 @@
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/external-secrets.io/externalsecret_v1beta1.json
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: vikunja-restic
namespace: default
spec:
secretStoreRef:
kind: ClusterSecretStore
name: onepassword-connect
target:
name: vikunja-restic-secret
creationPolicy: Owner
template:
engineVersion: v2
data:
RESTIC_REPOSITORY: '{{ .REPOSITORY_TEMPLATE }}/vikunja'
RESTIC_PASSWORD: '{{ .RESTIC_PASSWORD }}'
AWS_ACCESS_KEY_ID: '{{ .AWS_ACCESS_KEY_ID }}'
AWS_SECRET_ACCESS_KEY: '{{ .AWS_SECRET_ACCESS_KEY }}'
dataFrom:
- extract:
key: volsync-restic-template
---
# yaml-language-server: $schema=https://kubernetes-schemas.devbu.io/volsync.backube/replicationsource_v1alpha1.json
apiVersion: volsync.backube/v1alpha1
kind: ReplicationSource
metadata:
name: vikunja
namespace: default
spec:
sourcePVC: vikunja-files
trigger:
schedule: "0 7 * * *"
restic:
copyMethod: Snapshot
pruneIntervalDays: 7
repository: vikunja-restic-secret
cacheCapacity: 20Gi
volumeSnapshotClassName: csi-ceph-blockpool
storageClassName: rook-ceph-block
moverSecurityContext:
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
retain:
daily: 7
within: 3d

1
kubernetes/apps/default/vikunja/ks.yaml
View File

@@ -15,6 +15,7 @@ spec:
name: home-ops-kubernetes
dependsOn:
- name: cluster-apps-cloudnative-pg-cluster
- name: cluster-apps-external-secrets-stores
- name: cluster-apps-rook-ceph-cluster
- name: cluster-apps-volsync-app
healthChecks: