commit bc30e675537b50e0db1e65d9696f1da9e1690f69
parent 609b262e630b243d302a274d03c0345839e7622a
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 31 Mar 2025 16:09:11 +0200
Prepare moving bugzilla to mariadb
Diffstat:
9 files changed, 482 insertions(+), 358 deletions(-)
diff --git a/apps/2024_cluster/secrets/bugzilla.yaml b/apps/2024_cluster/secrets/bugzilla.yaml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+ name: bugzilla
+ namespace: bugzilla
+type: Opaque
+stringData:
+ password: ENC[AES256_GCM,data:H7iWKOZmIm0flAn4xmBuA0sKdWQkaMLZOZ4C9+YjFMUCxL3Huvw0kMR4/nIgHPKAIE0VwWyPd+xUM7PBNJQgwQ==,iv:nkbhEZzL6x7JFURymcjdydbKHy0LnYYYfYhfuFZutcI=,tag:ftu7J98BLfH7478zlrPTgg==,type:str]
+ db_password: ENC[AES256_GCM,data:MTSfaE0L8Xt+pG2p2aa+iyBrQvXXKXYXEWjxKc8OF60WbBYv1gtnyOckZZ9lqGDGctTQGg1IpSQnpfcvWvsXFg==,iv:WpEti4zvgWH/i7kV3njDDYXiv5xrB/gHxrcLvVhXLD8=,tag:MR83fwX40dyhdihOhRTiLg==,type:str]
+ site_wide_secret: ENC[AES256_GCM,data:37XaTLD0u7JhtXUefanNXGsFc+TNvliRk3jqvHjGT6++lpg+GIh+QOoOaa+Qg3vIFzh/64lbzroT9yCxhijfkw==,iv:RuK2Cg4FZlFjdqx4hDD1fw0MxNgAroFiCjVZjHEOEqc=,tag:omypbLwiXmHwWtaqNTSyeQ==,type:str]
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnMXBxQWI5aStZcDNWYmEz
+ M2ZMU0ZpbVNaWUpuVXRrVXUzYVNabDdNYTBzCnZPTW01dW1VcUhMMllaamRpdmtF
+ Yi9hRjJ0NGlRWkpTcnRBYUhoN1hhK1UKLS0tIDFpWDZmb2xNNU9MZmZLQk5UVmY5
+ Z3pJbGtXSmY3NTg5NHJhTHIzR3ZXVzAK/xJlRjRk/Jf+Wqhagnf+uQ3mFTmzggoU
+ a7XuQlkIk/Yi2YJ14+2zwqyIOZjQspHqYagbMTexTNQw9rlvk2mY6w==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-03-31T14:07:13Z"
+ mac: ENC[AES256_GCM,data:KngZbPAV+fTnUxPDw5fqr7QYGhIf6wRflqjrLJfASgkG/lHNPr7hF+FPeprsp92askSi2buR52Z8Pt1QSvxgRZg3yrVzZvbnzso5dmWKt2pu4SFKhy824xp620emunFn/Yn4K8pvoSAih0HUD7U0z3xqlFUFl69urEpRMrcQTmk=,iv:rTLhB/jsD7I7TvagvBQKKhaUjYiry2sMFVcbQeIZgaE=,tag:o4fgvxUBKDd+fjmaT9FZDw==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
diff --git a/apps/2024_cluster/secrets/mariadb-operator.yaml b/apps/2024_cluster/secrets/mariadb-operator.yaml
@@ -1,6 +1,6 @@
apiVersion: v1
stringData:
- password: ENC[AES256_GCM,data:xQ9sZCJsZ1GDUn8vbm6AZXQ6Eq/ZPV7SFwKX27IP3mJ1JrDYbT6bQEfE9O2as1ZGp+mcjxu0A3MKVjZZlkzaVQ==,iv:oxpKX8tpBXa9llPX8uE7PLi1HI2/uHSA6/KZGbhXlNU=,tag:5ANl995mK/z/q3g3bhTOKA==,type:str]
+ password: ENC[AES256_GCM,data:1n57UxVIMT7iqjLdmXJGFrwNoPWQOdjUnNryTxUWgoJg5Cdyp+szCpdcaGckw/PSxwGiZD8AYuJqThyO8GclFQ==,iv:tWK2VP4AMFeGN5pqYsrcf0b7kHjU2q8xLT27hncNupc=,tag:pvUVVG8wk6n5Eyybx3g0XQ==,type:str]
kind: Secret
metadata:
name: mariadb-osticket
@@ -14,21 +14,21 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSQXF3MXFKVlVmU2lhVi9V
- c0dDK3p2SmpnT29zYjlTV05Rbk9JYndCeEZvCkVPNVJTekpycys5MGJQN3JFQXJT
- SUlFa1ozb2o2ZCswRUxpeC9xVWxoZGcKLS0tIDZnM2ZjQkxxd2U1YlZKdnVFYXBI
- K1dxajlEUVVCTlI2TkZ0R21mY1ZZNEEKCb0zLtFZHOrKWSjH0CB9mU/PmxdNpr6z
- bbZiBmM105pmfcPQuSwxPXFFI8zsEy5hjXzL/4kGpEYCe8j5X625cA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMklRb2pBRk13TWQ0OGgy
+ RGF0eWZEYko4eTcxUkhqRjQ4eXRGaE9kcEVBClU5eDFLV1UrbzdJVFBSQ0NIaG5u
+ ekpQSllYQXdIclJPeFpkb1BCWUtFQUkKLS0tIElLbCtQNUppT2NDNjBXMHJGTDd2
+ dlA2bzBzTE9RZEdpSmIvTEtzWmtSNFEKoh0Ro4Bm3Cx+6fmhxuLHl4kJ3hVMnC7r
+ 2ZxZIcDYxvfJa4HNUPPhgvW07GPxcOsFpVY3Rk2eprLIIo/jVGEkwA==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-03-10T09:54:43Z"
- mac: ENC[AES256_GCM,data:i+0x2iuiXVCoD4ioFlFOzL2GRCzMH1W13OheEV7HTQv0X6fcN+479ow8a5I75t+OMEtR4Jo5qQI/x4VKQ9iAMPPpcbRScoCWyi9ITawEpUiVWWUhbogpT2WgdMweDyvBbnazGotJNmYcsKomk1/mabR2czSHXMnQa3UVYDkkbXw=,iv:ALAuviL2mJm+kR2hCMRLM0bNX39DDmngAgQXJJgryKU=,tag:nU8cljPz566rt5mgncZlQw==,type:str]
+ lastmodified: "2025-03-31T14:00:12Z"
+ mac: ENC[AES256_GCM,data:VaeS7DrpBcfbRY7waA6pJMq+sARW1qteqJyQvvWf2OsMenii+pZvDkxqeXkccDSnuPBKQskOx1lZRWTBTyUWG5elAo4BhGh2+nok5M/vixGnWCNZwuFrZ9y9wJ22tORPbueHSxOUR1Gs1DktlvEtpaX2/rWQfnMNU00dwnEh8EA=,iv:Qf32meXfuOs9KtQeuCp9KGfHI4HTJrxYszBIMgDGcHY=,tag:LJtSL/uIIuDVB8M/0uDhOg==,type:str]
pgp: []
encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
---
apiVersion: v1
stringData:
- password: ENC[AES256_GCM,data:EPg5V8IuCTPSsDw3b41bqcfLNpGAiZTvMIlFYkCRu9xn+S/Cvr+xCnEKB5+LbhPNrmyYE3IQOZqNSBvOtMIBpQ==,iv:NCrSnkW1LxY77XbHgzD/DQoeUvloNJ30Fw94Srr6bF0=,tag:6E1tNTG/vfmLDGjOH606Eg==,type:str]
+ password: ENC[AES256_GCM,data:g5PIyg/qjUpxqCD5zPIqJKtqpJh9q0ecCafV2elA3LxqLxAvYKP0MxT8t+Y8f61V2WKPW4xVp0DPLz1pMEc3PA==,iv:fu/ueCNA9EAnQ+cMbCXnaI0QWGLXNB6yq35D2pHFnoc=,tag:O1dETNJVpmT+Ngue7N2tOA==,type:str]
kind: Secret
metadata:
name: mariadb-hubzilla
@@ -42,14 +42,42 @@ sops:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSQXF3MXFKVlVmU2lhVi9V
- c0dDK3p2SmpnT29zYjlTV05Rbk9JYndCeEZvCkVPNVJTekpycys5MGJQN3JFQXJT
- SUlFa1ozb2o2ZCswRUxpeC9xVWxoZGcKLS0tIDZnM2ZjQkxxd2U1YlZKdnVFYXBI
- K1dxajlEUVVCTlI2TkZ0R21mY1ZZNEEKCb0zLtFZHOrKWSjH0CB9mU/PmxdNpr6z
- bbZiBmM105pmfcPQuSwxPXFFI8zsEy5hjXzL/4kGpEYCe8j5X625cA==
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMklRb2pBRk13TWQ0OGgy
+ RGF0eWZEYko4eTcxUkhqRjQ4eXRGaE9kcEVBClU5eDFLV1UrbzdJVFBSQ0NIaG5u
+ ekpQSllYQXdIclJPeFpkb1BCWUtFQUkKLS0tIElLbCtQNUppT2NDNjBXMHJGTDd2
+ dlA2bzBzTE9RZEdpSmIvTEtzWmtSNFEKoh0Ro4Bm3Cx+6fmhxuLHl4kJ3hVMnC7r
+ 2ZxZIcDYxvfJa4HNUPPhgvW07GPxcOsFpVY3Rk2eprLIIo/jVGEkwA==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-03-10T09:54:43Z"
- mac: ENC[AES256_GCM,data:i+0x2iuiXVCoD4ioFlFOzL2GRCzMH1W13OheEV7HTQv0X6fcN+479ow8a5I75t+OMEtR4Jo5qQI/x4VKQ9iAMPPpcbRScoCWyi9ITawEpUiVWWUhbogpT2WgdMweDyvBbnazGotJNmYcsKomk1/mabR2czSHXMnQa3UVYDkkbXw=,iv:ALAuviL2mJm+kR2hCMRLM0bNX39DDmngAgQXJJgryKU=,tag:nU8cljPz566rt5mgncZlQw==,type:str]
+ lastmodified: "2025-03-31T14:00:12Z"
+ mac: ENC[AES256_GCM,data:VaeS7DrpBcfbRY7waA6pJMq+sARW1qteqJyQvvWf2OsMenii+pZvDkxqeXkccDSnuPBKQskOx1lZRWTBTyUWG5elAo4BhGh2+nok5M/vixGnWCNZwuFrZ9y9wJ22tORPbueHSxOUR1Gs1DktlvEtpaX2/rWQfnMNU00dwnEh8EA=,iv:Qf32meXfuOs9KtQeuCp9KGfHI4HTJrxYszBIMgDGcHY=,tag:LJtSL/uIIuDVB8M/0uDhOg==,type:str]
+ pgp: []
+ encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
+ version: 3.9.1
+---
+apiVersion: v1
+stringData:
+ password: ENC[AES256_GCM,data:0OI6Avd7zUJLUF7pFWOUEalPFJI5/29PKZjdUyKJYuAbWy8bIk4Qt9/u34k8J/lzd+pM2QOZWs/FBfR+ppYn+w==,iv:6jPq3BLZNEkf/miCk2A6GFHY+X+UozgyV7m3gy8+Gpw=,tag:nu3kRSomYpSps5tq7qPrnw==,type:str]
+kind: Secret
+metadata:
+ name: mariadb-bugzilla
+ namespace: mariadb-operator
+sops:
+ kms: []
+ gcp_kms: []
+ azure_kv: []
+ hc_vault: []
+ age:
+ - recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
+ enc: |
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMklRb2pBRk13TWQ0OGgy
+ RGF0eWZEYko4eTcxUkhqRjQ4eXRGaE9kcEVBClU5eDFLV1UrbzdJVFBSQ0NIaG5u
+ ekpQSllYQXdIclJPeFpkb1BCWUtFQUkKLS0tIElLbCtQNUppT2NDNjBXMHJGTDd2
+ dlA2bzBzTE9RZEdpSmIvTEtzWmtSNFEKoh0Ro4Bm3Cx+6fmhxuLHl4kJ3hVMnC7r
+ 2ZxZIcDYxvfJa4HNUPPhgvW07GPxcOsFpVY3Rk2eprLIIo/jVGEkwA==
+ -----END AGE ENCRYPTED FILE-----
+ lastmodified: "2025-03-31T14:00:12Z"
+ mac: ENC[AES256_GCM,data:VaeS7DrpBcfbRY7waA6pJMq+sARW1qteqJyQvvWf2OsMenii+pZvDkxqeXkccDSnuPBKQskOx1lZRWTBTyUWG5elAo4BhGh2+nok5M/vixGnWCNZwuFrZ9y9wJ22tORPbueHSxOUR1Gs1DktlvEtpaX2/rWQfnMNU00dwnEh8EA=,iv:Qf32meXfuOs9KtQeuCp9KGfHI4HTJrxYszBIMgDGcHY=,tag:LJtSL/uIIuDVB8M/0uDhOg==,type:str]
pgp: []
encrypted_regex: ^(adminPassword|adminEmail|jenkinsAdminEmail|securityRealm|gerrit.config|routing_key|DATABASE_URL|SMTP_PASSWORD|SECRET_KEY_BASE|admin_password|extraCommands|key|clickhouseDatabaseURL|databaseURL|client_id|client_secret|secret_key_base|otp_secret|private_key|public_key|primaryKey|deterministicKey|keyDerivationSalt|token|clientId|secretKey|installationId|installationKey|uriOverride|adminToken.value|password.value|sql_password|erlangCookie|AUTHENTICATION_PASSWORD|ROOM_API_SECRET_KEY|adminPassword|configPassword|adminUser|configUser|MAIL_PASSWORD|APP_KEY|api_key|api_secret|keys|livekit_key|livekit_secret|secret_key|admin_pass|admin_email|mariadbPassword|mariadbRootPassword|privateKey|data|stringData|PASSWD|password|pass|postgresPassword|postgresqlPassword|redminePassword|smtpPassword|registration_shared_secret|shared_secret|secret|admin_token|integrationKey|rootPassword)$
version: 3.9.1
diff --git a/apps/base/docuseal/network_policy.yaml b/apps/base/docuseal/network_policy.yaml
@@ -13,46 +13,46 @@ spec:
- Egress
ingress:
- from:
- - namespaceSelector:
- matchLabels:
- kubernetes.io/metadata.name: envoy-gateway
- podSelector:
- matchLabels:
- app.kubernetes.io/component: proxy
- app.kubernetes.io/name: envoy
- gateway.envoyproxy.io/owning-gateway-name: envoy-gateway
- gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
+ - namespaceSelector:
+ matchLabels:
+ kubernetes.io/metadata.name: envoy-gateway
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/component: proxy
+ app.kubernetes.io/name: envoy
+ gateway.envoyproxy.io/owning-gateway-name: envoy-gateway
+ gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway
ports:
- - port: 3000
- protocol: TCP
+ - port: 3000
+ protocol: TCP
egress:
- to:
- - namespaceSelector:
- matchLabels:
- kubernetes.io/metadata.name: postgres-cluster
- podSelector:
- matchLabels:
- cnpg.io/cluster: pg-cluster-v2
- cnpg.io/instanceName: pg-cluster-v2-5
- cnpg.io/instanceRole: primary
- cnpg.io/podRole: instance
- role: primary
+ - namespaceSelector:
+ matchLabels:
+ kubernetes.io/metadata.name: postgres-cluster
+ podSelector:
+ matchLabels:
+ cnpg.io/cluster: pg-cluster-v2
+ cnpg.io/instanceName: pg-cluster-v2-5
+ cnpg.io/instanceRole: primary
+ cnpg.io/podRole: instance
+ role: primary
ports:
- - port: 5432
- protocol: TCP
+ - port: 5432
+ protocol: TCP
- to:
- - namespaceSelector: {}
- podSelector:
- matchLabels:
- k8s-app: kube-dns
+ - namespaceSelector: {}
+ podSelector:
+ matchLabels:
+ k8s-app: kube-dns
ports:
- - port: 53
- protocol: UDP
+ - port: 53
+ protocol: UDP
- to:
- - ipBlock:
- cidr: 169.254.0.0/16
+ - ipBlock:
+ cidr: 169.254.0.0/16
ports:
- - port: 53
- protocol: TCP
- - port: 53
- protocol: UDP
+ - port: 53
+ protocol: TCP
+ - port: 53
+ protocol: UDP
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -75,42 +75,42 @@ spec:
protocol: TCP
port: 25
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submissions
protocol: TCP
port: 465
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: submission
protocol: TCP
port: 587
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imap
protocol: TCP
port: 143
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: imaps
protocol: TCP
port: 993
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
@@ -135,371 +135,371 @@ spec:
hostname: "mas.matrix.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mas.matrix.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mas.matrix.midnightthoughts.space-tls
- name: https-matrix-midnightthoughts
protocol: HTTPS
hostname: "matrix.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.midnightthoughts.space-tls
- name: https-draupnir-midnightthoughts
protocol: HTTPS
hostname: "draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: draupnir.midnightthoughts.space-tls
- name: https-matrix-draupnir-midnightthoughts
protocol: HTTPS
hostname: "matrix.draupnir.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: matrix.draupnir.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: matrix.draupnir.midnightthoughts.space-tls
- name: https-docuseal-midnightthoughts
protocol: HTTPS
hostname: "docuseal.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: docuseal.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: docuseal.midnightthoughts.space-tls
- name: https-midnightthoughts-neoboard
protocol: HTTPS
hostname: "miro-export.neoboard.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: miro-export.neoboard.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: miro-export.neoboard.midnightthoughts.space-tls
- name: https-midnightthoughts-certs
protocol: HTTPS
hostname: "certs.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: certs.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: certs.midnightthoughts.space-tls
- name: https-midnightthoughts-capacitor
protocol: HTTPS
hostname: "ui.k8s.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ui.k8s.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ui.k8s.midnightthoughts.space-tls
- name: https-midnightthoughts-auth
protocol: HTTPS
hostname: "auth.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: auth.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: auth.midnightthoughts.space-tls
- name: https-midnightthoughts-ldap
protocol: HTTPS
hostname: "ldap.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: ldap.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: ldap.midnightthoughts.space-tls
- name: https-midnightthoughts-status-webhook
protocol: HTTPS
hostname: "webhook.status.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.status.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.status.midnightthoughts.space-tls
- name: https-midnightthoughts-budget
protocol: HTTPS
hostname: "budget.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: budget.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: budget.midnightthoughts.space-tls
- name: https-midnightthoughts-bugzilla
protocol: HTTPS
hostname: "bugzilla.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: bugzilla.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: bugzilla.midnightthoughts.space-tls
- name: https-midnightthoughts-root
protocol: HTTPS
hostname: "midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: midnightthoughts.space-tls
- name: https-midnightthoughts-status
protocol: HTTPS
hostname: "status.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: status.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: status.midnightthoughts.space-tls
- name: https-midnightthoughts-webhook-kubernetes
protocol: HTTPS
hostname: "webhook.kubernetes.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: webhook.kubernetes.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: webhook.kubernetes.midnightthoughts.space-tls
- name: https-midnightthoughts-rspamd
protocol: HTTPS
hostname: "rspamd.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rspamd.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rspamd.midnightthoughts.space-tls
- name: https-midnightthoughts-grafana
protocol: HTTPS
hostname: "grafana.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: grafana.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: grafana.midnightthoughts.space-tls
- name: https-midnightthoughts-osticket
protocol: HTTPS
hostname: "osticket.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: osticket.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: osticket.midnightthoughts.space-tls
- name: https-midnightthoughts-vault
protocol: HTTPS
hostname: "vault.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: vault.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: vault.midnightthoughts.space-tls
- name: https-midnightthoughts-rook
protocol: HTTPS
hostname: "rook.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: rook.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: rook.midnightthoughts.space-tls
- name: https-midnightthoughts-jenkins
protocol: HTTPS
hostname: "jenkins.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: jenkins.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: jenkins.midnightthoughts.space-tls
- name: https-midnightthoughts-gerrit
protocol: HTTPS
hostname: "gerrit.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: gerrit.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: gerrit.midnightthoughts.space-tls
- name: https-midnightthoughts-uptime
protocol: HTTPS
hostname: "uptime.midnightthoughts.space"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: uptime.midnightthoughts.space-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: uptime.midnightthoughts.space-tls
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-nordgedanken
protocol: HTTPS
hostname: "*.nordgedanken.dev"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: nordgedanken.dev-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: nordgedanken.dev-tls
- name: https-mtrnord-blog-root
protocol: HTTPS
hostname: "mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mtrnord.blog-tls
- name: https-mtrnord-blog-hubzilla
protocol: HTTPS
hostname: "hub.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: hub.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: hub.mtrnord.blog-tls
- name: https-mtrnord-blog-mastodon
protocol: HTTPS
hostname: "mastodon.mtrnord.blog"
port: 443
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
tls:
- mode: Terminate
- certificateRefs:
- - kind: Secret
- name: mastodon.mtrnord.blog-tls
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: mastodon.mtrnord.blog-tls
- name: http
protocol: HTTP
port: 80
allowedRoutes:
- namespaces:
- from: "All"
+ namespaces:
+ from: "All"
- name: ldap
protocol: TCP
port: 389
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
- name: gerrit-ssh
protocol: TCP
port: 29418
allowedRoutes:
- kinds:
- - kind: TCPRoute
- namespaces:
- from: All
+ kinds:
+ - kind: TCPRoute
+ namespaces:
+ from: All
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
diff --git a/apps/base/mariadb-operator/mariadb.yaml b/apps/base/mariadb-operator/mariadb.yaml
@@ -81,6 +81,7 @@ spec:
innodb_autoinc_lock_mode=2
innodb_buffer_pool_size=3200MB
max_allowed_packet=1GB
+ ft_min_word_len=2
# Schedule Pods in different Nodes to achieve real HA.
affinity:
antiAffinityEnabled: true
@@ -226,3 +227,69 @@ spec:
username: hubzilla
grantOption: false
host: "%"
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Database
+metadata:
+ name: bugzilla
+spec:
+ mariaDbRef:
+ name: mariadb
+ characterSet: utf8
+ collate: utf8_general_ci
+ # Delete the resource in the database whenever the CR gets deleted.
+ # Alternatively, you can specify Skip in order to omit deletion.
+ cleanupPolicy: Delete
+ requeueInterval: 30s
+ retryInterval: 5s
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: User
+metadata:
+ name: bugzilla
+spec:
+ # If you want the user to be created with a different name than the resource name
+ # name: user-custom
+ mariaDbRef:
+ name: mariadb
+ passwordSecretKeyRef:
+ name: mariadb-bugzilla
+ key: password
+ # This field defaults to 10
+ maxUserConnections: 10
+ host: "%"
+ # Delete the resource in the database whenever the CR gets deleted.
+ # Alternatively, you can specify Skip in order to omit deletion.
+ cleanupPolicy: Delete
+ requeueInterval: 30s
+ retryInterval: 5s
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Grant
+metadata:
+ name: grant-bugzilla
+spec:
+ mariaDbRef:
+ name: bugzilla
+ privileges:
+ - "ALL PRIVILEGES"
+ database: "bugzilla"
+ table: "*"
+ username: bugzilla
+ grantOption: false
+ host: "%"
+---
+apiVersion: k8s.mariadb.com/v1alpha1
+kind: Grant
+metadata:
+ name: grant-bugzilla-show-db
+spec:
+ mariaDbRef:
+ name: mariadb
+ privileges:
+ - "SHOW DATABASES"
+ database: "*"
+ table: "*"
+ username: bugzilla
+ grantOption: false
+ host: "%"
diff --git a/apps/base/mastodon/release.yaml b/apps/base/mastodon/release.yaml
@@ -46,10 +46,10 @@ spec:
hosts:
- host: mastodon.mtrnord.blog
paths:
- - path: /
+ - path: /
tls:
- hosts:
- - mastodon.mtrnord.blog
+ - mastodon.mtrnord.blog
secretName: mastodon.mtrnord.blog-tls
mastodon:
sidekiq:
@@ -68,18 +68,18 @@ spec:
concurrency: 25
replicas: 1
resources:
- limits: {}
- requests:
- cpu: 136m
- memory: 542Mi
+ limits: {}
+ requests:
+ cpu: 136m
+ memory: 542Mi
queues:
- - default,8
- - push,6
- - ingress,4
- - mailers,2
- - pull
- # Make sure the scheduler queue only exists once and with a worker that has 1 replica.
- - scheduler
+ - default,8
+ - push,6
+ - ingress,4
+ - mailers,2
+ - pull
+ # Make sure the scheduler queue only exists once and with a worker that has 1 replica.
+ - scheduler
web:
updateStrategy:
type: RollingUpdate
@@ -165,13 +165,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTlZFSW5NTmlsSnRlR1pN
- blM2RWN3SGhBWnRIT1lNcVQ2SnpHZEVOMGg4CkZocUh3eDB4dzdXSVJyZlYvKzFt
- N0VSUFpIQ21zWCtya0JYamo4a09KS28KLS0tIHNndnJSNVljaHlnTERnbVVxSC9C
- aHhKamtXT1Vpb2V5VTN5ZDByVTlHdzgKZFwoWZiMA8m4/EsROS5Czpd2sqqFx/+E
- aOHqzS6D0j2jhz6mPyQ9jnjUXqy2WJsjgINxgST9y1jk5IkJmxjcCA==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTlZFSW5NTmlsSnRlR1pN
+ blM2RWN3SGhBWnRIT1lNcVQ2SnpHZEVOMGg4CkZocUh3eDB4dzdXSVJyZlYvKzFt
+ N0VSUFpIQ21zWCtya0JYamo4a09KS28KLS0tIHNndnJSNVljaHlnTERnbVVxSC9C
+ aHhKamtXT1Vpb2V5VTN5ZDByVTlHdzgKZFwoWZiMA8m4/EsROS5Czpd2sqqFx/+E
+ aOHqzS6D0j2jhz6mPyQ9jnjUXqy2WJsjgINxgST9y1jk5IkJmxjcCA==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-03-19T13:13:05Z"
mac: ENC[AES256_GCM,data:M/NesUN1qH4vfk86zEaZKqixDZcAlcBmuwkw9gg1XZoDGkX+xf5f/nDhMeyolrpZZcCT8h/LzdiYqQjjNsVx3CZpzcG50opnZA27xLy0JvnwelT/bAyF1JN9lorO5p+XIV3mml/ChfMzkaTYs4V1DuuMeWboKihNobC9NRUdn2U=,iv:+4dLDS4EB5ZKYezlYuUbSrVD4DOdHKBOJivVPtXxkQg=,tag:p8YVLETlYyBC6PzRY28pfg==,type:str]
pgp: []
@@ -191,25 +191,25 @@ spec:
- mastodon.mtrnord.blog
rules:
- backendRefs:
- - name: mastodon-streaming
- port: 4000
+ - name: mastodon-streaming
+ port: 4000
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
matches:
- - path:
- type: PathPrefix
- value: /api/v1/streaming
+ - path:
+ type: PathPrefix
+ value: /api/v1/streaming
- backendRefs:
- - name: mastodon-web
- port: 3000
+ - name: mastodon-web
+ port: 3000
timeouts:
- request: 240s
- backendRequest: 0s
+ request: 240s
+ backendRequest: 0s
matches:
- - path:
- type: PathPrefix
- value: /
+ - path:
+ type: PathPrefix
+ value: /
sops:
kms: []
gcp_kms: []
@@ -218,13 +218,13 @@ sops:
age:
- recipient: age1esjyg2qfy49awv0ptkzvpk425adczjr38m37w2mmcahzc4p8n54sll2nzh
enc: |
- -----BEGIN AGE ENCRYPTED FILE-----
- YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTlZFSW5NTmlsSnRlR1pN
- blM2RWN3SGhBWnRIT1lNcVQ2SnpHZEVOMGg4CkZocUh3eDB4dzdXSVJyZlYvKzFt
- N0VSUFpIQ21zWCtya0JYamo4a09KS28KLS0tIHNndnJSNVljaHlnTERnbVVxSC9C
- aHhKamtXT1Vpb2V5VTN5ZDByVTlHdzgKZFwoWZiMA8m4/EsROS5Czpd2sqqFx/+E
- aOHqzS6D0j2jhz6mPyQ9jnjUXqy2WJsjgINxgST9y1jk5IkJmxjcCA==
- -----END AGE ENCRYPTED FILE-----
+ -----BEGIN AGE ENCRYPTED FILE-----
+ YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTlZFSW5NTmlsSnRlR1pN
+ blM2RWN3SGhBWnRIT1lNcVQ2SnpHZEVOMGg4CkZocUh3eDB4dzdXSVJyZlYvKzFt
+ N0VSUFpIQ21zWCtya0JYamo4a09KS28KLS0tIHNndnJSNVljaHlnTERnbVVxSC9C
+ aHhKamtXT1Vpb2V5VTN5ZDByVTlHdzgKZFwoWZiMA8m4/EsROS5Czpd2sqqFx/+E
+ aOHqzS6D0j2jhz6mPyQ9jnjUXqy2WJsjgINxgST9y1jk5IkJmxjcCA==
+ -----END AGE ENCRYPTED FILE-----
lastmodified: "2025-03-19T13:13:05Z"
mac: ENC[AES256_GCM,data:M/NesUN1qH4vfk86zEaZKqixDZcAlcBmuwkw9gg1XZoDGkX+xf5f/nDhMeyolrpZZcCT8h/LzdiYqQjjNsVx3CZpzcG50opnZA27xLy0JvnwelT/bAyF1JN9lorO5p+XIV3mml/ChfMzkaTYs4V1DuuMeWboKihNobC9NRUdn2U=,iv:+4dLDS4EB5ZKYezlYuUbSrVD4DOdHKBOJivVPtXxkQg=,tag:p8YVLETlYyBC6PzRY28pfg==,type:str]
pgp: []
diff --git a/apps/base/uptime-kuma/release.yaml b/apps/base/uptime-kuma/release.yaml
@@ -1,4 +1,3 @@
----
apiVersion: apps/v1
kind: Deployment
metadata:
@@ -18,38 +17,38 @@ spec:
image: louislam/uptime-kuma:1.23.16-debian
imagePullPolicy: IfNotPresent
resources:
- limits:
- memory: "700Mi"
- cpu: "500m"
+ limits:
+ memory: "700Mi"
+ cpu: "500m"
ports:
- - containerPort: 3001
+ - containerPort: 3001
livenessProbe:
- exec:
- command:
- - "extra/healthcheck"
- initialDelaySeconds: 180
- periodSeconds: 10
- timeoutSeconds: 2
- successThreshold: 1
- failureThreshold: 3
+ exec:
+ command:
+ - "extra/healthcheck"
+ initialDelaySeconds: 180
+ periodSeconds: 10
+ timeoutSeconds: 2
+ successThreshold: 1
+ failureThreshold: 3
readinessProbe:
- httpGet:
- path: /
- port: 3001
- scheme: HTTP
- httpHeaders: []
- initialDelaySeconds: 10
- periodSeconds: 10
- timeoutSeconds: 5
- successThreshold: 1
- failureThreshold: 3
+ httpGet:
+ path: /
+ port: 3001
+ scheme: HTTP
+ httpHeaders: []
+ initialDelaySeconds: 10
+ periodSeconds: 10
+ timeoutSeconds: 5
+ successThreshold: 1
+ failureThreshold: 3
volumeMounts:
- - name: uptime-kuma
- mountPath: /app/data
+ - name: uptime-kuma
+ mountPath: /app/data
volumes:
- name: uptime-kuma
persistentVolumeClaim:
- claimName: uptime-kuma
+ claimName: uptime-kuma
---
apiVersion: v1
kind: PersistentVolumeClaim
@@ -91,5 +90,5 @@ spec:
- uptime.midnightthoughts.space
rules:
- backendRefs:
- - name: uptime-kuma-service
- port: 3001
+ - name: uptime-kuma-service
+ port: 3001
diff --git a/apps/base/vaultwarden/pvc.yaml b/apps/base/vaultwarden/pvc.yaml
@@ -16,14 +16,14 @@ spec:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
- name: vaultwarden-data-vaultwarden-0
- namespace: vaultwarden
+ name: vaultwarden-data-vaultwarden-0
+ namespace: vaultwarden
spec:
- accessModes:
- - ReadWriteMany
- resources:
- requests:
- storage: 512Mi
- storageClassName: ceph-filesystem
- volumeMode: Filesystem
- volumeName: pvc-ec794040-ad06-4ac1-b3bd-ecbf57c276bf
+ accessModes:
+ - ReadWriteMany
+ resources:
+ requests:
+ storage: 512Mi
+ storageClassName: ceph-filesystem
+ volumeMode: Filesystem
+ volumeName: pvc-ec794040-ad06-4ac1-b3bd-ecbf57c276bf
diff --git a/infrastructure/controllers/etcd-defrag-cronjob.yaml b/infrastructure/controllers/etcd-defrag-cronjob.yaml
@@ -13,36 +13,36 @@ spec:
- name: etcd-defrag
image: ghcr.io/ahrtr/etcd-defrag:v0.25.0 # Please replace the version with the latest version.
args:
- - --endpoints=https://127.0.0.1:4001
- - --cacert=/ca.crt
- - --cert=/client.crt
- - --key=/client.key
- - --cluster
- - --defrag-rule
- - "dbQuotaUsage > 0.8 || dbSize - dbSizeInUse > 200*1024*1024"
+ - --endpoints=https://127.0.0.1:4001
+ - --cacert=/ca.crt
+ - --cert=/client.crt
+ - --key=/client.key
+ - --cluster
+ - --defrag-rule
+ - "dbQuotaUsage > 0.8 || dbSize - dbSizeInUse > 200*1024*1024"
volumeMounts:
- - mountPath: /ca.crt
- name: ca-crt
- readOnly: true
- - mountPath: /client.crt
- name: client-crt
- readOnly: true
- - mountPath: /client.key
- name: client-key
- readOnly: true
+ - mountPath: /ca.crt
+ name: ca-crt
+ readOnly: true
+ - mountPath: /client.crt
+ name: client-crt
+ readOnly: true
+ - mountPath: /client.key
+ name: client-key
+ readOnly: true
volumes:
- name: ca-crt
hostPath:
- path: /srv/kubernetes/kube-apiserver/etcd-ca.crt
- type: File
+ path: /srv/kubernetes/kube-apiserver/etcd-ca.crt
+ type: File
- name: client-crt
hostPath:
- path: /srv/kubernetes/kube-apiserver/etcd-client.crt
- type: File
+ path: /srv/kubernetes/kube-apiserver/etcd-client.crt
+ type: File
- name: client-key
hostPath:
- path: /srv/kubernetes/kube-apiserver/etcd-client.key
- type: File
+ path: /srv/kubernetes/kube-apiserver/etcd-client.key
+ type: File
restartPolicy: OnFailure
hostNetwork: true # needed in order to reach the etcd server with 127.0.0.1:2379
securityContext:
@@ -57,5 +57,5 @@ spec:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- - key: node-role.kubernetes.io/control-plane
- operator: Exists
+ - key: node-role.kubernetes.io/control-plane
+ operator: Exists
