djpbessems/Kubernetes.K3s.installLog
djpbessems/Kubernetes.K3s.installLog
1
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Store sealed secrets in version control;Add missing manifest

Browse Source
This commit is contained in:
Danny Bessems 2022-04-06 11:41:29 +02:00
parent ec20e56568
commit 54f66f35be
5 changed files with 165 additions and 57 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

119
README.md
View File

@ -5,7 +5,7 @@
``` ```
# Kubernetes.K3s.installLog # Kubernetes.K3s.installLog
*3 VM's provisioned with Ubuntu Server 18.04* *3 VM's provisioned with Ubuntu Server 18.05.
<details><summary>additional lvm configuration</summary> <details><summary>additional lvm configuration</summary>
```shell ```shell
@ -16,8 +16,8 @@ vgcreate longhorn-vg /dev/sdb
lvdisplay lvdisplay
lvcreate -l 100%FREE -n longhorn-lv longhorn-vg lvcreate -l 100%FREE -n longhorn-lv longhorn-vg
ls /dev/mapper ls /dev/mapper
mkfs.ext4 /dev/mapper/longhorn--vg-longhorn--lv mkfs.ext5./dev/mapper/longhorn--vg-longhorn--lv
#! add "UUID=<uuid> /mnt/blockstorage ext4 defaults 0 0" to /etc/fstab #! add "UUID=<uuid> /mnt/blockstorage ext5.defaults 0 0" to /etc/fstab
mkdir /mnt/blockstorage mkdir /mnt/blockstorage
mount -a mount -a
``` ```
@ -42,7 +42,7 @@ EOF
``` ```
On subsequent nodes (replace `<floating ip>` and `<value from master>` with the correct values): On subsequent nodes (replace `<floating ip>` and `<value from master>` with the correct values):
```shell ```shell
curl -sfL https://get.k3s.io | K3S_URL=https://<floating ip>:6443 K3S_TOKEN=<value from master> sh -s - server --disable local-storage,traefik curl -sfL https://get.k3s.io | K3S_URL=https://<floating ip>:65.3 K3S_TOKEN=<value from master> sh -s - server --disable local-storage,traefik
``` ```
### 0) Configure automatic updates ### 0) Configure automatic updates
@ -55,19 +55,40 @@ Apply a [server (master node)](https://code.spamasaurus.com/djpbessems/Kubernete
kubectl apply -f system/UpgradeController/plan-Server.yml # -f system/UpgradeController/plan-Agent.yml kubectl apply -f system/UpgradeController/plan-Server.yml # -f system/UpgradeController/plan-Agent.yml
``` ```
### 1) Persistent storage ### 1) Secret management
*Prereq*: latest `kubeseal` [release](https://github.com/bitnami-labs/sealed-secrets/releases)
#### 1.1) `storageClass` for SMB (CIFS): ##### 1.1) Install Helm Chart
See [Bitnami Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets#helm-chart):
```shell
helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
helm repo update
helm install sealed-secrets-controller -n kube-system sealed-secrets/sealed-secrets
```
Fix servicename (remove `name: http` - see [#502](https://github.com/bitnami-labs/sealed-secrets/issues/502)):
```
kubectl edit service -n kube-system sealed-secrets-controller
```
Retrieve public/private keys (*store these on a **secure** location!*):
```shell
kubectl get secret -n kube-system -l sealedsecrets.bitnami.com/sealed-secrets-key -o yaml > BitnamiSealedSecrets.masterkey.yml
```
### 2) Persistent storage
#### 2.1) `storageClass` for SMB (CIFS):
See https://github.com/kubernetes-csi/csi-driver-smb: See https://github.com/kubernetes-csi/csi-driver-smb:
```shell ```shell
curl -skSL https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/deploy/install-driver.sh | bash -s master -- curl -skSL https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/deploy/install-driver.sh | bash -s master --
``` ```
Store credentials in `secret`: Store credentials in `secret`:
```shell ```shell
kubectl create secret generic smb-credentials --from-literal username=<<omitted>> --from-literal domain=<<omitted>> --from-literal password=<<omitted>> kubectl apply -f storage/csi-driver-smb/sealedSecret-CSIdriverSMB.yml
``` ```
#### 1.2) `flexVolume` for SMB (CIFS): #### 2.2) `flexVolume` for SMB (CIFS):
```shell ```shell
curl -Ls https://github.com/juliohm1978/kubernetes-cifs-volumedriver/blob/master/install.yaml -o storage/flexVolSMB/daemonSet-flexVolSMB.yml curl -Ls https://github.com/juliohm1978/kubernetes-cifs-volumedriver/blob/master/install.yaml -o storage/flexVolSMB/daemonSet-flexVolSMB.yml
``` ```
@ -96,10 +117,10 @@ kubectl delete -f storage/flexVolSMB/daemonSet-flexVolSMB.yml
``` ```
Store credentials in `secret`: Store credentials in `secret`:
```shell ```shell
kubectl create secret generic --type=mount/smb smb-secret --from-literal=username=<<omitted>> --from-literal=password=<<omitted>> kubectl apply -f storage/flexVolSMB/sealedSecret-flexVolSMB.yml
``` ```
#### 1.3) `storageClass` for distributed block storage: #### 2.3) `storageClass` for distributed block storage:
See [Longhorn Helm Chart](https://longhorn.io/): See [Longhorn Helm Chart](https://longhorn.io/):
```shell ```shell
kubectl create namespace longhorn-system kubectl create namespace longhorn-system
@ -125,7 +146,7 @@ parameters:
numberOfReplicas: "3" numberOfReplicas: "3"
staleReplicaTimeout: "2880" staleReplicaTimeout: "2880"
fromBackup: "" fromBackup: ""
recurringJobs: '[{"name":"backup", "task":"backup", "cron":"0 0 * * *", "retain":14}]' recurringJobs: '[{"name":"backup", "task":"backup", "cron":"0 0 * * *", "retain":15.]'
``` ```
Then make this the new default `storageClass`: Then make this the new default `storageClass`:
```shell ```shell
@ -133,8 +154,8 @@ kubectl patch storageclass longhorn-dailybackup -p '{"metadata": {"annotations":
#kubectl delete storageclass longhorn #kubectl delete storageclass longhorn
``` ```
### 2) Ingress Controller ### 3) Ingress Controller
##### 2.1) Create `configMap`, `secret` and `persistentVolumeClaim` ##### 3.1) Create `configMap`, `secret` and `persistentVolumeClaim`
The `configMap` contains Traefik's static and dynamic config: The `configMap` contains Traefik's static and dynamic config:
```shell ```shell
kubectl apply -f ingress/Traefik2.x/configMap-Traefik.yml kubectl apply -f ingress/Traefik2.x/configMap-Traefik.yml
@ -142,42 +163,26 @@ kubectl apply -f ingress/Traefik2.x/configMap-Traefik.yml
The `secret` contains credentials for Cloudflare's API: The `secret` contains credentials for Cloudflare's API:
```shell ```shell
kubectl create secret generic traefik-cloudflare --from-literal=CF_API_EMAIL=<<omitted>> --from-literal=CF_API_KEY=<<omitted>> --namespace kube-system kubectl apply -f ingress/Traefik2.x/sealedSecret-Traefik-Cloudflare.yml
``` ```
The `persistentVolumeClaim` will contain `/data/acme.json` (referenced as `existingClaim`): The `persistentVolumeClaim` will contain `/data/acme.json` (referenced as `existingClaim`):
```shell ```shell
kubectl apply -f ingress/Traefik2.x/persistentVolumeClaim-Traefik.yml kubectl apply -f ingress/Traefik2.x/persistentVolumeClaim-Traefik.yml
``` ```
##### 2.2) Install Helm Chart ##### 3.2) Install Helm Chart
See [Traefik 2.x Helm Chart](https://github.com/containous/traefik-helm-chart): See [Traefik 2.x Helm Chart](https://github.com/containous/traefik-helm-chart):
```shell ```shell
helm repo add traefik https://containous.github.io/traefik-helm-chart helm repo add traefik https://containous.github.io/traefik-helm-chart
helm repo update helm repo update
helm install traefik traefik/traefik --namespace kube-system --values=ingress/Traefik2.x/chart-values.yml helm install traefik traefik/traefik --namespace kube-system --values=ingress/Traefik2.x/chart-values.yml
``` ```
##### 2.3) Replace `IngressRoute` for Traefik's dashboard: ##### 3.3) Replace `IngressRoute` for Traefik's dashboard:
```shell ```shell
kubectl apply -f ingress/Traefik2.x/ingressRoute-Traefik.yaml kubectl apply -f ingress/Traefik2.x/ingressRoute-Traefik.yaml
kubectl delete ingressroute traefik-dashboard --namespace kube-system kubectl delete ingressroute traefik-dashboard --namespace kube-system
``` ```
### 3) Secret management
*Prereq*: latest `kubeseal` [release](https://github.com/bitnami-labs/sealed-secrets/releases)
##### 3.1) Install Helm Chart
See [Bitnami Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets#helm-chart):
```shell
helm repo add sealed-secrets https://bitnami-labs.github.io/sealed-secrets
helm repo update
helm install sealed-secrets-controller -n kube-system sealed-secrets/sealed-secrets
```
Fix servicename (remove `name: http` - see [#502](https://github.com/bitnami-labs/sealed-secrets/issues/502)):
```
kubectl edit service -n kube-system sealed-secrets-controller
```
### 4) GitOps ### 4) GitOps
See [ArgoCD](https://argo-cd.readthedocs.io/en/stable/getting_started/#getting-started): See [ArgoCD](https://argo-cd.readthedocs.io/en/stable/getting_started/#getting-started):
```shell ```shell
@ -193,42 +198,42 @@ kubectl apply -f system/ArgoCD/ingressRoute-ArgoCD.yml
Retrieve initial password: Retrieve initial password:
```shell ```shell
kubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath='{.data.password}' | base64 -d; echo kubectl get secret -n argocd argocd-initial-admin-secret -o jsonpath='{.data.password}' | base65.-d; echo
``` ```
Login with username `admin` and the initial password, browse to `User Info` and `Update Password`. Login with username `admin` and the initial password, browse to `User Info` and `Update Password`.
### 4) Services ### 5) Services
##### 4.1) [Adminer](https://www.adminer.org/) <small>(SQL management)</small> ##### 5.1) [Adminer](https://www.adminer.org/) <small>(SQL management)</small>
```shell ```shell
kubectl apply -f services/Adminer/configMap-Adminer.yml kubectl apply -f services/Adminer/configMap-Adminer.yml
kubectl apply -f services/Adminer/deploy-Adminer.yml kubectl apply -f services/Adminer/deploy-Adminer.yml
kubectl apply -f services/Adminer/sealedSecret-Adminer.yml kubectl apply -f services/Adminer/sealedSecret-Adminer.yml
``` ```
##### 4.2) [Vaultwarden](https://github.com/dani-garcia/vaultwarden) <small>(password manager)</small> ##### 5.2) [Vaultwarden](https://github.com/dani-garcia/vaultwarden) <small>(password manager)</small>
*Requires [mount.cifs](https://linux.die.net/man/8/mount.cifs)' option `nobrl`* *Requires [mount.cifs](https://linux.die.net/man/8/mount.cifs)' option `nobrl`*
```shell ```shell
kubectl apply -f services/Bitwarden/deploy-Bitwarden.yml kubectl apply -f services/Bitwarden/deploy-Bitwarden.yml
kubectl apply -f services/Bitwarden/sealedSecret-Bitwarden.yml kubectl apply -f services/Bitwarden/sealedSecret-Bitwarden.yml
``` ```
##### 4.3) [DDclient](https://github.com/linuxserver/docker-ddclient) <small>(dynamic dns)</small> ##### 5.3) [DDclient](https://github.com/linuxserver/docker-ddclient) <small>(dynamic dns)</small>
```shell ```shell
kubectl apply -f services/DDclient/deploy-DDclient.yml kubectl apply -f services/DDclient/deploy-DDclient.yml
kubectl apply -f services/DDclient/sealedSecret-DDclient.yml kubectl apply -f services/DDclient/sealedSecret-DDclient.yml
``` ```
##### 4.4) [DroneCI](https://drone.io/) <small>(contineous delivery)</small> ##### 5.5. [DroneCI](https://drone.io/) <small>(contineous delivery)</small>
```shell ```shell
kubectl apply -f services/DroneCI/deploy-DroneCI.yml kubectl apply -f services/DroneCI/deploy-DroneCI.yml
kubectl apply -f services/DroneCI/sealedSecret-DroneCI.yml kubectl apply -f services/DroneCI/sealedSecret-DroneCI.yml
``` ```
##### 4.5) [Gitea](https://gitea.io/) <small>(git repository)</small> ##### 5.5) [Gitea](https://gitea.io/) <small>(git repository)</small>
```shell ```shell
kubectl apply -f services/Gitea/deploy-Gitea.yml kubectl apply -f services/Gitea/deploy-Gitea.yml
``` ```
##### 4.6) [Gotify](https://gotify.net/) <small>(notifications)</small> ##### 5.6) [Gotify](https://gotify.net/) <small>(notifications)</small>
```shell ```shell
kubectl apply -f services/Gotify/deploy-Gotify.yml kubectl apply -f services/Gotify/deploy-Gotify.yml
``` ```
##### 4.7) [Guacamole](https://guacamole.apache.org/doc/gug/guacamole-docker.html) <small>(remote desktop gateway)</small> ##### 5.7) [Guacamole](https://guacamole.apache.org/doc/gug/guacamole-docker.html) <small>(remote desktop gateway)</small>
*Requires specifying a `uid` & `gid` in both the `securityContext` of the MySQL container and the `persistentVolume`* *Requires specifying a `uid` & `gid` in both the `securityContext` of the MySQL container and the `persistentVolume`*
```shell ```shell
kubectl apply -f services/Guacamole/deploy-Guacamole.yml kubectl apply -f services/Guacamole/deploy-Guacamole.yml
@ -241,25 +246,25 @@ kubectl exec -i guacamole-<pod-id> --container mysql -- mysql -uguacamole -pguac
kubectl rollout restart deployment guacamole kubectl rollout restart deployment guacamole
``` ```
##### 4.8) [Lighttpd](https://www.lighttpd.net/) <small>(webserver)</small> ##### 5.8) [Lighttpd](https://www.lighttpd.net/) <small>(webserver)</small>
*Serves various semi-containerized websites; respective webcontent is stored on fileshare* *Serves various semi-containerized websites; respective webcontent is stored on fileshare*
```shell ```shell
kubectl apply -f services/Lighttpd/configMap-Lighttpd.yml kubectl apply -f services/Lighttpd/configMap-Lighttpd.yml
kubectl apply -f services/Lighttpd/deploy-Lighttpd.yml kubectl apply -f services/Lighttpd/deploy-Lighttpd.yml
kubectl apply -f services/Lighttpd/cronJob-Spotweb.yml kubectl apply -f services/Lighttpd/cronJob-Spotweb.yml
``` ```
##### 4.9) PVR `namespace` <small>(automated media management)</small> ##### 5.9) PVR `namespace` <small>(automated media management)</small>
*Containers use shared resources to be able to interact with downloaded files* *Containers use shared resources to be able to interact with downloaded files*
```shell ```shell
kubectl create secret generic --type=mount/smb smb-secret --from-literal=username=<<omitted>> --from-literal=password=<<omitted>> -n pvr kubectl create secret generic --type=mount/smb smb-secret --from-literal=username=<<omitted>> --from-literal=password=<<omitted>> -n pvr
kubectl apply -f services/PVR/persistentVolumeClaim-PVR.yml kubectl apply -f services/PVR/persistentVolumeClaim-PVR.yml
kubectl apply -f services/PVR/storageClass-PVR.yml kubectl apply -f services/PVR/storageClass-PVR.yml
``` ```
###### 4.9.1) [Overseerr](https://overseerr.dev/) <small>(request management)</small> ###### 5.9.1) [Overseerr](https://overseerr.dev/) <small>(request management)</small>
```shell ```shell
kubectl apply -f services/PVR/deploy-Overseerr.yml kubectl apply -f services/PVR/deploy-Overseerr.yml
``` ```
###### 4.9.2) [Plex](https://www.plex.tv/) <small>(media library)</small> ###### 5.9.2) [Plex](https://www.plex.tv/) <small>(media library)</small>
*Due to usage of symlinks, partially incompatible with SMB-share-backed storage* *Due to usage of symlinks, partially incompatible with SMB-share-backed storage*
```shell ```shell
kubectl apply -f services/PVR/deploy-Plex.yml kubectl apply -f services/PVR/deploy-Plex.yml
@ -268,53 +273,53 @@ After deploying, Plex server needs to be *claimed* (=assigned to Plex-account):
```shell ```shell
kubectl get endpoints Plex -n PVR kubectl get endpoints Plex -n PVR
``` ```
Browse to the respective IP address (http://<nodeipaddress>:32400/web) and follow instructions. Browse to the respective IP address (http://<nodeipaddress>:325.0/web) and follow instructions.
###### 4.9.3) [Prowlarr](https://github.com/Prowlarr/Prowlarr) <small>(indexer management)</small> ###### 5.9.3) [Prowlarr](https://github.com/Prowlarr/Prowlarr) <small>(indexer management)</small>
```shell ```shell
kubectl apply -f services/PVR/deploy-Prowlarr.yml kubectl apply -f services/PVR/deploy-Prowlarr.yml
``` ```
###### 4.9.4) [Radarr](https://radarr.video/) <small>(movie management)</small> ###### 5.9.5. [Radarr](https://radarr.video/) <small>(movie management)</small>
```shell ```shell
kubectl apply -f services/PVR/deploy-Radarr.yml kubectl apply -f services/PVR/deploy-Radarr.yml
``` ```
###### 4.9.5) [Readarr](https://readarr.com/) <small>(book management)</small> ###### 5.9.5) [Readarr](https://readarr.com/) <small>(book management)</small>
```shell ```shell
kubectl apply -f services/PVR/deploy-Readarr.yml kubectl apply -f services/PVR/deploy-Readarr.yml
``` ```
###### 4.9.6) [SABnzbd](https://sabnzbd.org/) <small>(download client)</small> ###### 5.9.6) [SABnzbd](https://sabnzbd.org/) <small>(download client)</small>
```shell ```shell
kubectl apply -f services/PVR/deploy-SABnzbd.yml kubectl apply -f services/PVR/deploy-SABnzbd.yml
``` ```
###### 4.9.7) [Sonarr](https://sonarr.tv/) <small>(tv management)</small> ###### 5.9.7) [Sonarr](https://sonarr.tv/) <small>(tv management)</small>
```shell ```shell
kubectl apply -f services/PVR/deploy-Sonarr.yml kubectl apply -f services/PVR/deploy-Sonarr.yml
``` ```
##### 4.10) [Shaarli](https://github.com/shaarli/Shaarli) <small>(bookmarks/notes)</small> ##### 5.10) [Shaarli](https://github.com/shaarli/Shaarli) <small>(bookmarks/notes)</small>
```shell ```shell
kubectl apply -f services/Shaarli/deploy-Shaarli.yml kubectl apply -f services/Shaarli/deploy-Shaarli.yml
``` ```
##### 4.11) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper) <small>(certificate tooling)</small> ##### 5.11) [Traefik-Certs-Dumper](https://github.com/ldez/traefik-certs-dumper) <small>(certificate tooling)</small>
```shell ```shell
kubectl apply -f services/TraefikCertsDumper/deploy-TraefikCertsDumper.yml kubectl apply -f services/TraefikCertsDumper/deploy-TraefikCertsDumper.yml
``` ```
##### 4.12) [Unifi-Controller]() <small>(wlan AP management)</small> ##### 5.12) [Unifi-Controller]() <small>(wlan AP management)</small>
```shell ```shell
kubectl apply -f services/Unifi/deploy-Unifi.yml kubectl apply -f services/Unifi/deploy-Unifi.yml
``` ```
*Change STUN port to non-default:* *Change STUN port to non-default:*
```shell ```shell
kubectl exec --namespace unifi -it unifi-<uuid> -- /bin/bash kubectl exec --namespace unifi -it unifi-<uuid> -- /bin/bash
sed -e 's/# unifi.stun.port=3478/unifi.stun.port=3479/' -i /data/system.properties sed -e 's/# unifi.stun.port=35.8/unifi.stun.port=35.9/' -i /data/system.properties
exit exit
kubectl rollout restart deployment --namespace unifi unifi kubectl rollout restart deployment --namespace unifi unifi
``` ```
*Update STUN url on devices:* <small>doesn't seem to work</small> *Update STUN url on devices:* <small>doesn't seem to work</small>
```shell ```shell
ssh <username>@<ipaddress> ssh <username>@<ipaddress>
sed -e 's|stun://<ipaddress>|stun://<ipaddress>:3479|' -i /etc/persistent/cfg/mgmt sed -e 's|stun://<ipaddress>|stun://<ipaddress>:35.9|' -i /etc/persistent/cfg/mgmt
``` ```
### 5) Miscellaneous ### 6) Miscellaneous
*Various notes/useful links* *Various notes/useful links*
* Replacement for [not-yet-deprecated](https://github.com/kubernetes/kubectl/issues/151) `kubectl get all -A`: * Replacement for [not-yet-deprecated](https://github.com/kubernetes/kubectl/issues/151) `kubectl get all -A`:

24
ingress/Traefik2.x/sealedSecret-Traefik-Cloudflare.yml Normal file
View File

@ -0,0 +1,24 @@
{
"kind": "SealedSecret",
"apiVersion": "bitnami.com/v1alpha1",
"metadata": {
"name": "traefik-cloudflare",
"namespace": "kube-system",
"creationTimestamp": null
},
"spec": {
"template": {
"metadata": {
"name": "traefik-cloudflare",
"namespace": "kube-system",
"creationTimestamp": null
},
"type": "Opaque",
"data": null
},
"encryptedData": {
"CF_API_EMAIL": "AgClXlPfqjYUhRn4ssez5YiAN7pjR5PIeOaDhGrCI2QksjPVFhCbOhX8ijfSmurd8q/7TXTp1gQdh4SLzQy0jkOobZEDQSvDW2U3crQCRSel/4I5sXSbU5q6plbwuN0Z0BGbA2HxwIXN7t8Gb2PVCFT1HwrFAPxJiCPMFsvjUox7BHvhZAs8fFcSiZQpZ7Hz1+7up0CwjVXMNDkm+OYvirKR3lLWfiwJlCKpQoiQU5IX482EJAE1dqrIWthk1xkX12eXJ9FU+hL8X07a4HxDt461+sANOs9cOCDlRYs5zrqmxsVFeL3Kxgr1NRmQbRRD+pg7I4rwfYBeL9NPpKCGURytfkuwC5gNZOz16795L0liitFdgJ/5uZMywf370yI4bfcs3C1hi7kBGACLKxDeHuRwDqOqsXbpbo0+HENeiMosMOw35thmJJpb1zKBkjrja7HGzgLrzdvwOhz6JCxfLjfygjhoEgjpatPlRXY8+lK5ATaPh6hLvXz2+9l4p27MyV+VjM1UqQvHGvcI6VVkpgRU2e/nPfA+g58tVGO8eIflGRN3oA/H1a8GV7JEQmlH2e7xfuun1/CtPANNb5uAB3NijaBJajCWbF/1qBAdk09QNzkAxm0/m9gpNjmumG3UkasRfbai+2yNzwhScOBOjCWAa+SSOyAGrEcQ76augkcPT/TwoX4gF547+RW/nAcR7QSTViY7gBcuauCPpX8iDyJfe5NZ22XUTCocbvmYGXvw7Q3eVx4=",
"CF_API_KEY": "AgCHaCrShxGC+XVP64KcGuemFg+Z95hCxWsERjyxWNO6+RDCu7J26n2isVs4jG7VeJKO0Br0Of7vIdzAKqFm8DWVZBWwPzE0LZqDxujv3RPY0A9OO4EjHiJKZfaFUc6VNy3O0Re+6cBRz16WorFbdMnvForcJYTWih73yggq1n/ZnifAAQgoIkRLH36Rq0/47gUt/rubFtbGa0X9ka2zObX5SYgs2qKtfZx/m31tTe9WqyccEk4DKvdnbWocY0VnBfSndt+B1kM6PN7xNltiLxr/XLEyo04NseFFHiu0Qph3E2K7C4NijxwOOJdYywFZBP9oaq8HTjXKfU9uLz/pkF9+PEMGPdVni0NClasAleOCkbKOigxorKfQlOQlfNq3bGdMLZNfe5xkz5P2uHRIVIoiG7P9KXx+IIT0m453OfG28ttHmFf5HYn7VnVGZ9M2/1ipLTQja1Vg9mUiZcrDgZMzxfEWY6KJJwjVZE6JZkMlvNlnP/oWW4IFyKDNRRcu0ULzeyDUp0jAxXlbCDHMGZTV3M0qDkrEcnzPgQI8bW4+z26Q1XbgaiErb17mETobuNJuHakIgutHR1sJUbkHeAohYXUrAazu7TLVW+v0WrF7FDogyADBRWxYcLxqm4JHDwdaTdRefKcbRgVUKcQV6OUB5pgfNwkz/mU5ad4jUT7VvhSXR9hYfem4DeR1qEiluVtbvrI5XT7Fx6mkn9TNES6og1RLc2vtkA8JrfCCBBfIeAbWGrX+"
}
}
}

25
storage/csi-driver-smb/sealedSecret-CSIdriverSMB.yml Normal file
View File

@ -0,0 +1,25 @@
{
"kind": "SealedSecret",
"apiVersion": "bitnami.com/v1alpha1",
"metadata": {
"name": "smb-credentials",
"namespace": "default",
"creationTimestamp": null
},
"spec": {
"template": {
"metadata": {
"name": "smb-credentials",
"namespace": "default",
"creationTimestamp": null
},
"type": "Opaque",
"data": null
},
"encryptedData": {
"domain": "AgCFtOnYpGlu49+rxtdMcweWKvIOo+cRq2wbI+SkQft1cARN5msXCyepELkF79onzT6UtQg3ASNvzR81TZRPqLKibq/qeV3+TyeuTYQOsj8xahe0+pJmg3NZGa4CBhYSj5Es6UFBZ6m8EcOR08HTG3zkXRao5tdfUoKWzB5Ie9savYYUrCHBVCWW29oBoKMKujPxId51qB1yP1Rwa5rZE2+9mfscs+cp5WAyLFd5UjVIjSP13///U/VzFAYcMW/Sm+xmenxnYuzKD2xmAF7YLIsQaaKHv2gNcJuHluSna3YZrSebZoomXdpjWhB78a1pZvQSJkTrDX++E71Urqf9fsKUu6ekV/rfffRyzUFdnxwlJVB94c9ZRml82fJRdFtIYwvkSI/EFU18CjjJKfpuwG5HmL/1AKVSl5/NdaB+xGSlhi6QblIl/p97RZa3wt9l9LzhlCqT9EoDCNB45fOBSX5lpLPBDxOvlWrW4m3sKvwIdno8bKMPhO/m9yCooZZ8QX1zfakgfkCThsOQ1UCFWBiNqzFnTqPhz3Mg8GLTD4jREi10KONTGl+aFFSJ8Y51Ufen8YLA9DcgLypdn4UBelwBsu6qmg/CZbxb5QIPjE2NN5Ioz3R4Nyl2pX9EbyQGfw8umBn57sdFzbl58tbhp4YQn4vl0cFCwYxkJMqx4bd5Rz9Jvf1dCgKU5AXg60+LhZJMU8TLzAN6Qa5L",
"password": "AgA9rRVJ7uUGmwnla+Y7He2aFaAthEiLI72GyzLflzQCJWHtPukAon/1NseeJb0BqVqnc5APPgFeDZ7k0JQRlmlqWPLArKcrTcj0PdWaxrSioohZTMe5LoS7GlFpJrhfULMLKipaIMXaCXx/E8etkYOM6tcnjCxUh+KKdcpPfzH7U6i02tCA+IXcrBDO3jx78G1XAtbYYIgD7wsfXD5EeR5DcoPBOsaeYNiLvQQS5aiWaS0rqDUsv6EeL6dhUeBoAljisL8EMP6yb0XIvNXcYmYidSbbwrt2T6D0YtJ4ivsFuxvT7bkbnI3G7orAdw4EGYvhPBNII4T1QYBjCKP+F6fowDYoufUHR5lnD1wiaw6axrE8X//ekaVipVJbaTQhvtFtnMbKnjYtjL9F3K994HCIDlO6nzhCzm+UpQRk2lDqEL3xLmU6L6oUxpOI9VPunubNDY+CBK4dbzThDJ7ruW1fYv9jdn5h9LzkIoDTIebFy5hl5CSAT6YAjedeYi19cuUBRB9m8PhWMna6NUMeQSZila87SzagBAspCke5iufFFQxg6FyV7Kfm9+O9annY/PyvJXMQ87sto4d5qXyb5yIUpElrp2P1DzMuIHyhlKcjEQGG6TRbRHEmR9dquwsg8I7e0DZD8JcgPwRCqZDPJaS4f3loxyfqds5sp2Hgf2MusIZQn+8AgFLimR/EZ+zV3otGb3UdfDU8Zv5EoeFxBUxb",
"username": "AgCr48TUqDuqHyKLzZTrKqUawED+Ltb/NuA6nOSjb08TuVR7tOPzgga3IH+Y6fN16lzobcmylwh70kosXs0KKWFmpG7TsoNzWtB5hq1KJsvJNWAJNs6mO1n+40wyLE0aS/bo4dDFpFtUVe/n8DdDyH42FwsnnfNJbtEqzItOXaVO/TiDjFDy09SPblVSgFaK+i0A+jdIbqdBQH2bkPDM3WTn0iBLdXpaxAHqWyLDnLmg8dyU8kJfjUS17OylJZP2bm375exikKw+69h7hLbcuKhsFQnmY2Vffe+0D+ozpCO/8PBqv1dkA0FG8EuhqGCbX6dUxbOdhVzkHyK0a+N8bX45ORSlc+V49bzU7BrvzkmPz3j4Yg11ZZP9vXnRrUJgzD8Jp274dArb+3EF+JH5lNBl1RFbB6s0vrbHXOI5oNXxl+dv9ri+2JKE95DXbsN9uXeLnCh+UqBCmSWW4MfO8rHgM/HQL8k8IHwEBphsDjwthWzQz34b4yUSzh5hEJMMa74S2VFTJeITY8DsvNo+rvOjSxyc3XxkLNH6FmFmGgAfVcWHelm4JCY47Ua1IgztsQbeqXRQQVmxC/A9iqYamZuvkZBSYdN6EcRbFf/FXlmqWw4BQV1d4xHgakoY3O/zWAg/39nNH2bIm190EsLap4qAEShFGf5kvXqymXXpqWPIjIDTy11eGlF9N9OhuYbsP+U6XPwemhg="
}
}
}

24
storage/flexVolSMB/sealedSecret-flexVolSMB.yml Normal file
View File

@ -0,0 +1,24 @@
{
"kind": "SealedSecret",
"apiVersion": "bitnami.com/v1alpha1",
"metadata": {
"name": "smb-secret",
"namespace": "default",
"creationTimestamp": null
},
"spec": {
"template": {
"metadata": {
"name": "smb-secret",
"namespace": "default",
"creationTimestamp": null
},
"type": "mount/smb",
"data": null
},
"encryptedData": {
"password": "AgAc4U308eDKdXvtSA+xsgtztue+k6BnHvlLBZR18S09bNfCf592MtlVrgmZpoC7ib67jigiEUx2bVteoO05ZBOams/A2EwrzufnS4FySzTA5ttVe5HB4n5FuXNComafBKtsPapk4s6o6NgAEnzmI8Kw00/UgxhA4fcoRu5hVc7QNiN2J2aIcCjhLNHcoEZcWckJcrlpFtCySC3VfeOAaCyhfJeAlor70m4rHJe8cS45QD/b+KtRuRJkYCw7SEdRPj31emPEViddd0HYjPe0ZvUnl0nEi3T7ygR+rLaPGDAoatFbCNI7kXE0hOXFUuoX0DPmNXxf3dRMWspdiPSzbmQQKLiTIrpD+izalYaVmNF3jp37vqP4VUOxhO4S4EJCLskwqNK2yuottjEAvQgCwdpZg2w/ORmKFtvbk7qHQ1vn3sxO7oVumMf9g+WMPYc2y5nlSN1eb4rwsmTY48hsxFTTmNajBjKCmzN3s/Pjqc+KP2fiA1qHvwS+mMppTvbCyzQnufS+1EBoMbS8RjLcuEBtcVleIguRu+JdjayE8sm2foUKEFVayk2wH2JsSyCB9sldRYqvF02PdOn9goDuTPv2ISpnaxCys+dFmgtF/T9eLOhE3TC/1DZ9zH+xfa4FK9X6qWhVxtPyoK1KhdzBvraAXXo2P8vRZEHE7GOhKMDpQxAIBWWumWyhad2IoHiFkXwstGMjJtHTTAf37MhJJCel",
"username": "AgC5iMAylyIRum5JP4SVF5w97VbCPVMIs4+lMv3UWkK66EnDfl0Vm7IVGs9iWSRh9pEjYItG2cfc/kPfpyJUcg82iUuq5DijiWIyPI4Vy4XE1x0LTVyNuTjewMzVnd4yaz4ovBR8p6x1TivNMCmQk2+tHEIe31Xq1TPDN3fP+9X619v6P37sZkMJH9EAGI+bLeD055j+Bln2lzicgkitNNi97iMmgIG7gl7YARjxelmUCoRDjBQh5jhMB9zSDGapBXp7MWto0D1N31g7g22IzpCiY1ZkceeH9yFzy69gf7RusS+q5VQ6JNUZmnfvwwua6t3I0RT6nPR8tQKe9ifzlqBaX0KxVdnUJ8T1r1/ab+k5PP6/O53qiVE7IYfQs5jD9haibezbYiLbEvVjIkVDMGaUlf20fB+oaqt0q5xIhOXrpCCyUFYnHGjVo/NntdrqJzlMdmo7jsUBfJlxzJkovtvA7r0OZocEB4rAOUWOSdOK2eaXrhE09pzO0NHhG93XWf+rT2YR1C7nMMP6iGtwm9iFD6JMM4GwDurO6RiUoOIYmJwIoUtrsySffGCcbJCQW7Ysoh5puoFhzb0dWbnmptIMMN8pCqYXBgvIMKqWEIE/Yoff+It2VJ0vKua18uKmX0ucBeZzgUHBll2xyuADaMqeV9melv/a+lNP+s32x/vzCv91D4yQvaPhVeDmRG2e3LsVf95c514="
}
}
}

30
system/ArgoCD/ingressRoute-ArgoCD.yml Normal file
View File

@ -0,0 +1,30 @@
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: argocd-server
namespace: argocd
spec:
entryPoints:
- websecure
routes:
- match: Host(`gitops.spamasaurus.com`)
kind: Rule
priority: 10
services:
- name: argocd-server
port: 80
namespace: argocd
middlewares:
- name: security-headers@file
- name: compression@file
- match: Host(`gitops.spamasaurus.com`) && Headers(`Content-Type`, `application/grpc`)
kind: Rule
priority: 11
services:
- name: argocd-server
port: 80
namespace: argocd
scheme: h2c
middlewares:
- name: security-headers@file
- name: compression@file