206 lines
6.1 KiB
YAML
206 lines
6.1 KiB
YAML
|
# ----------------------------------------------------------------
|
||
|
|
# BASE TEMPLATE (internal/templates/base_values.yaml)
|
||
|
|
# ----------------------------------------------------------------
|
||
|
|
|
||
|
|
_defaults:
|
||
|
|
helmChart:
|
||
|
|
repo: ""
|
||
|
|
name: "oci://ghcr.io/rancherfederal/charts/rancher-cluster-templates"
|
||
|
|
version: "0.7.2"
|
||
|
|
controlPlaneProfile:
|
||
|
|
cpuCores: 4
|
||
|
|
memoryGb: 8
|
||
|
|
diskGb: 40
|
||
|
|
userData: &userData |
|
||
|
|
#cloud-config
|
||
|
|
package_update: false
|
||
|
|
package_upgrade: false
|
||
|
|
snap:
|
||
|
|
commands:
|
||
|
|
00: snap refresh --hold=forever
|
||
|
|
package_reboot_if_required: true
|
||
|
|
packages:
|
||
|
|
- yq
|
||
|
|
- jq
|
||
|
|
|
||
|
|
disable_root: true
|
||
|
|
ssh_pwauth: false
|
||
|
|
|
||
|
|
write_files:
|
||
|
|
- path: /root/updates.sh
|
||
|
|
permissions: '0550'
|
||
|
|
content: |
|
||
|
|
#!/bin/bash
|
||
|
|
export DEBIAN_FRONTEND=noninteractive
|
||
|
|
apt-mark hold linux-headers-generic
|
||
|
|
apt-mark hold linux-headers-virtual
|
||
|
|
apt-mark hold linux-image-virtual
|
||
|
|
apt-mark hold linux-virtual
|
||
|
|
apt-get update
|
||
|
|
apt-get upgrade -y
|
||
|
|
apt-get autoremove -y
|
||
|
|
|
||
|
|
users:
|
||
|
|
- name: rancher
|
||
|
|
gecos: Rancher service account
|
||
|
|
hashed_passwd: $6$Mas.x2i7B2cefjUy$59363FmEuoU.LiTLNRZmtemlH2W0D0SWsig22KSZ3QzOmfxeZXxdSx5wIw9wO7GXF/M9W.9SHoKVBOYj1HPX3.
|
||
|
|
lock_passwd: false
|
||
|
|
shell: /bin/bash
|
||
|
|
groups: [users, sudo, docker]
|
||
|
|
sudo: ALL=(ALL:ALL) ALL
|
||
|
|
ssh_authorized_keys:
|
||
|
|
- 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwWnnOTAu0LlAZRczQ0Z0KvNlUdPhGQhpZie+nF1O3s'
|
||
|
|
|
||
|
|
disable_root: true
|
||
|
|
ssh_pwauth: true
|
||
|
|
|
||
|
|
runcmd:
|
||
|
|
# - systemctl enable --now qemu-guest-agent
|
||
|
|
- sysctl --system
|
||
|
|
- /root/updates.sh
|
||
|
|
# Immediate run of fix script
|
||
|
|
|
||
|
|
bootcmd:
|
||
|
|
- sudo bash /root/networking.sh
|
||
|
|
|
||
|
|
final_message: |
|
||
|
|
VI_CNV_CLOUD_INIT has been applied successfully.
|
||
|
|
Node ready for Rancher!
|
||
|
|
|
||
|
|
# amazonec2, azure, digitalocean, harvester, vsphere, custom
|
||
|
|
cloudprovider: vsphere
|
||
|
|
|
||
|
|
# cloud provider credentials
|
||
|
|
cloudCredentialSecretName: cc-lhtl9
|
||
|
|
|
||
|
|
# rancher manager url
|
||
|
|
rancher:
|
||
|
|
cattle:
|
||
|
|
url: rancher.tst.vanderlande.com
|
||
|
|
|
||
|
|
# cluster values
|
||
|
|
cluster:
|
||
|
|
|
||
|
|
name: default-cluster-005
|
||
|
|
# labels:
|
||
|
|
# key: value
|
||
|
|
config:
|
||
|
|
kubernetesVersion: v1.31.12+rke2r1
|
||
|
|
enableNetworkPolicy: true
|
||
|
|
localClusterAuthEndpoint:
|
||
|
|
enabled: false
|
||
|
|
|
||
|
|
|
||
|
|
# Pod Security Standard (Replaces PSP)
|
||
|
|
# defaultPodSecurityAdmissionConfigurationTemplateName: "rancher-restricted"
|
||
|
|
|
||
|
|
globalConfig:
|
||
|
|
systemDefaultRegistry: docker.io
|
||
|
|
cni: canal
|
||
|
|
docker: false
|
||
|
|
disable_scheduler: false
|
||
|
|
disable_cloud_controller: false
|
||
|
|
disable_kube_proxy: false
|
||
|
|
etcd_expose_metrics: false
|
||
|
|
profile: ''
|
||
|
|
selinux: false
|
||
|
|
secrets_encryption: false
|
||
|
|
write_kubeconfig_mode: 0600
|
||
|
|
use_service_account_credentials: false
|
||
|
|
protect_kernel_defaults: false
|
||
|
|
cloud_provider_name: ''
|
||
|
|
|
||
|
|
# kube_apiserver_arg:
|
||
|
|
# - "service-account-extend-token-expiration=false"
|
||
|
|
# - "anonymous-auth=false"
|
||
|
|
# - "enable-admission-plugins=NodeRestriction,PodSecurity,EventRateLimit,DenyServiceExternalIPs"
|
||
|
|
# - "admission-control-config-file=/etc/rancher/rke2/rke2-admission.yaml"
|
||
|
|
# - "audit-policy-file=/etc/rancher/rke2/audit-policy.yaml"
|
||
|
|
# - "audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log"
|
||
|
|
# - "audit-log-maxage=30"
|
||
|
|
# - "audit-log-maxbackup=10"
|
||
|
|
# - "audit-log-maxsize=100"
|
||
|
|
|
||
|
|
# kubelet_arg:
|
||
|
|
# # Strong Ciphers (CIS 4.2.12)
|
||
|
|
# - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"
|
||
|
|
# # PID Limit (CIS 4.2.13)
|
||
|
|
# - "pod-max-pids=4096"
|
||
|
|
# # Seccomp Default (CIS 4.2.14)
|
||
|
|
# - "seccomp-default=true"
|
||
|
|
# - "protect-kernel-defaults=true"
|
||
|
|
# - "make-iptables-util-chains=true"
|
||
|
|
|
||
|
|
upgradeStrategy:
|
||
|
|
controlPlaneConcurrency: 10%
|
||
|
|
controlPlaneDrainOptions:
|
||
|
|
enabled: false
|
||
|
|
workerConcurrency: 10%
|
||
|
|
workerDrainOptions:
|
||
|
|
enabled: false
|
||
|
|
addons:
|
||
|
|
monitoring:
|
||
|
|
enabled: false
|
||
|
|
logging:
|
||
|
|
enabled: false
|
||
|
|
longhorn:
|
||
|
|
enabled: true
|
||
|
|
neuvector:
|
||
|
|
enabled: false
|
||
|
|
|
||
|
|
# node and nodepool(s) values
|
||
|
|
# ----------------------------------------------------------------
|
||
|
|
# MANUAL TESTING SECTION
|
||
|
|
# The Operator will DELETE and OVERWRITE this section at runtime.
|
||
|
|
# These values are only used if you run 'helm install' manually.
|
||
|
|
# ----------------------------------------------------------------
|
||
|
|
nodepools:
|
||
|
|
- name: control-plane-nodes
|
||
|
|
displayName: cp-nodes
|
||
|
|
quantity: 1
|
||
|
|
etcd: true
|
||
|
|
controlplane: true
|
||
|
|
worker: false
|
||
|
|
paused: false
|
||
|
|
# VSPHERE SPECIFIC FIELDS
|
||
|
|
cpuCount: 2
|
||
|
|
memorySize: 8192
|
||
|
|
diskSize: 40000
|
||
|
|
vcenter: "vcenter.vanderlande.com"
|
||
|
|
datacenter: "NL001"
|
||
|
|
folder: "ICT Digitalisation - Rancher"
|
||
|
|
pool: "NL001 Development - Rancher/Resources"
|
||
|
|
datastoreCluster: "NL001 Development - Rancher SDRS" # Matches your SDRS input
|
||
|
|
network:
|
||
|
|
- "nl001.vDS.Distri.Vlan.1542"
|
||
|
|
# Provisioning Source
|
||
|
|
creationType: "template"
|
||
|
|
cloneFrom: "nl001-cp-ubuntu-22.04-amd64-20250327-5.15.0-135-rke2-k3s"
|
||
|
|
cloudConfig: *userData # Using the anchor from your base file
|
||
|
|
|
||
|
|
- name: worker-storage-nodes
|
||
|
|
displayName: wk-nodes
|
||
|
|
quantity: 2
|
||
|
|
etcd: false
|
||
|
|
controlplane: false
|
||
|
|
worker: true
|
||
|
|
paused: false
|
||
|
|
# VSPHERE SPECIFIC FIELDS
|
||
|
|
cpuCount: 4
|
||
|
|
memorySize: 8192
|
||
|
|
diskSize: 100000
|
||
|
|
vcenter: "vcenter.vanderlande.com"
|
||
|
|
datacenter: "NL001"
|
||
|
|
folder: "ICT Digitalisation - Rancher"
|
||
|
|
pool: "NL001 Development - Rancher/Resources"
|
||
|
|
datastoreCluster: "NL001 Development - Rancher SDRS" # Matches your SDRS input
|
||
|
|
network:
|
||
|
|
- "nl001.vDS.Distri.Vlan.1542"
|
||
|
|
# Provisioning Source
|
||
|
|
creationType: "template"
|
||
|
|
cloneFrom: "nl001-cp-ubuntu-22.04-amd64-20250327-5.15.0-135-rke2-k3s"
|
||
|
|
cloudConfig: *userData # Using the anchor from your base file
|
||
|
|
|
||
|
|
|
||
|
|
|