fix gitea configuration, install external-secrets

remove placeholdertransformer
replace "bases" with "resources", add buildmetadata
2023-02-07 00:02:13 -05:00 · 2023-02-06 10:31:21 -05:00 · 2023-02-04 23:24:50 -05:00
21 changed files with 200 additions and 56 deletions
--- a/kustomize/bases/drone-runner/drone-runner-deployment.yaml
+++ b/kustomize/bases/drone-runner/drone-runner-deployment.yaml
@ -25,7 +25,7 @@ spec:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: DRONE_RPC_HOST
-              value: drone-server.$(DRONE_NAMESPACE_DEFAULT).svc.cluster.local
+              value: drone-server.gitea.svc.cluster.local # TODO: not hardcode
            - name: DRONE_RPC_PROTO
              value: http
            - name: DRONE_RPC_SECRET
--- a/kustomize/bases/drone-server/drone-server-deployment.yaml
+++ b/kustomize/bases/drone-server/drone-server-deployment.yaml
@ -23,14 +23,14 @@ spec:
        - name: drone
          image: drone/drone
          env:
+            - name: DRONE_GITEA_SERVER
+              value: https://${GITEA_EXTERNAL_HOST}
            - name: DRONE_SERVER_HOST
              value: ${DRONE_EXTERNAL_HOST}
            - name: DRONE_SERVER_PORT
              value: ":80"
            - name: DRONE_SERVER_PROTO
              value: https
-            - name: DRONE_GITEA_SERVER
-              value: https://${GITEA_EXTERNAL_HOST}
            - name: DRONE_GITEA_CLIENT_ID
              valueFrom:
                secretKeyRef:
--- a/kustomize/bases/external-secrets/external-secrets-helmchart.yaml
+++ b/kustomize/bases/external-secrets/external-secrets-helmchart.yaml
@ -0,0 +1,12 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: external-secrets
+  namespace: kube-system
+spec:
+  repo: https://charts.external-secrets.io
+  chart: external-secrets
+  version: 0.7.2
+  targetNamespace: external-secrets
+  set:
+    installCRDs: "true"
--- a/kustomize/bases/external-secrets/external-secrets-namespace.yaml
+++ b/kustomize/bases/external-secrets/external-secrets-namespace.yaml
@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
--- a/kustomize/bases/external-secrets/kustomization.yaml
+++ b/kustomize/bases/external-secrets/kustomization.yaml
@ -0,0 +1,6 @@
+resources:
+  - external-secrets-namespace.yaml
+  - external-secrets-helmchart.yaml
+
+commonLabels:
+  app.kubernetes.io/name: external-secrets
--- a/kustomize/bases/gitea/gitea-deployment.yaml
+++ b/kustomize/bases/gitea/gitea-deployment.yaml
@ -20,12 +20,14 @@ spec:
        - name: gitea
          image: gitea/gitea
          env:
+            - name: GITEA__SERVER__ROOT_URL
+              value: https://${GITEA_EXTERNAL_HOST}
+            - name: GITEA__WEBHOOK_ALLOWED_HOST_LIST
+              value: ${DRONE_EXTERNAL_HOST}
            - name: GITEA__DEFAULT__APP_NAME
              value: Badjware's code stash
            - name: GITEA__SERVICE__DISABLE_REGISTRATION
              value: "yes"
-            - name: GITEA__SERVER__ROOT_URL
-              value: https://${GITEA_EXTERNAL_HOST}
            - name: GITEA__SERVER__SSH_DOMAIN
              value: ${GITEA_EXTERNAL_HOST}
            - name: GITEA__SERVER__SSH_PORT
@ -36,8 +38,6 @@ spec:
              value: repo.wiki
            - name: GITEA__REPOSITORY__DEFAULT_REPO_UNITS
              value: repo.code,repo.releases
-            - name: GITEA__WEBHOOK_ALLOWED_HOST_LIST
-              value: ${DRONE_EXTERNAL_HOST}
          ports:
            - name: http
              containerPort: 3000
--- a/kustomize/bases/longhorn/longhorn-helmchart.yaml
+++ b/kustomize/bases/longhorn/longhorn-helmchart.yaml
@ -10,6 +10,7 @@ spec:
  targetNamespace: longhorn-system
  set:
    backupTargetCredentialSecret: s3-backupstore-credentials
+    ingress.host: ${LONGHORN_EXTERNAL_HOST}
  valuesContent: |-
    defaultSettings:
      backupTarget: s3://longhorn-backups@home/
@ -27,4 +28,3 @@ spec:
          operator: Exists
    ingress:
      enabled: true
-      host: ${LONGHORN_EXTERNAL_HOST}
--- a/kustomize/bases/nextcloud/kustomization.yaml
+++ b/kustomize/bases/nextcloud/kustomization.yaml
@ -1,8 +1,6 @@
-bases:
+resources:
  - ../postgres
  - ../redis
-
-resources:
  - nextcloud-deployment.yaml
  - nextcloud-ingress.yaml

--- a/kustomize/bases/prometheus-operator/kustomization.yaml
+++ b/kustomize/bases/prometheus-operator/kustomization.yaml
@ -1,5 +1,7 @@
 resources:
  - https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/release-0.50/bundle.yaml

+namespace: kube-system
+
 commonLabels:
  app.kubernetes.io/part-of: monitoring
--- a/kustomize/bases/traefik/kustomization.yaml
+++ b/kustomize/bases/traefik/kustomization.yaml
@ -4,5 +4,7 @@ resources:
  - traefik-helmchartconfig.yaml
  - traefik-ingress.yaml

+namespace: kube-system
+
 commonLabels:
  app.kubernetes.io/name: traefik
--- a/kustomize/namespaces/gitea/kustomization.yaml
+++ b/kustomize/namespaces/gitea/kustomization.yaml
@ -1,9 +1,7 @@
-bases:
+resources:
+  - namespace.yaml
  - ../../bases/gitea
  - ../../bases/drone-server
  - ../../bases/drone-runner

-resources:
-  - namespace.yaml
-
 namespace: gitea
--- a/kustomize/namespaces/kube-system/kustomization.yaml
+++ b/kustomize/namespaces/kube-system/kustomization.yaml
@ -1,5 +1,4 @@
-bases:
+resources:
  - ../../bases/traefik
  - ../../bases/prometheus-operator
-
-namespace: kube-system
+  - ../../bases/external-secrets
--- a/kustomize/namespaces/kubernetes-dashboard/kustomization.yaml
+++ b/kustomize/namespaces/kubernetes-dashboard/kustomization.yaml
@ -1,4 +1,4 @@
-bases:
+resources:
  - ../../bases/kubernetes-dashboard

 namespace: kubernetes-dashboard
--- a/kustomize/namespaces/monitoring/kustomization.yaml
+++ b/kustomize/namespaces/monitoring/kustomization.yaml
@ -1,8 +1,9 @@
-bases:
+resources:
+  - namespace.yaml
  - ../../bases/prometheus
  # - ../../bases/node-exporter
  - ../../bases/blackbox-exporter
-  - ../../bases/ecommerce-exporter
+  # - ../../bases/ecommerce-exporter
  - ../../bases/kube-state-metrics
  - ../../bases/grafana-agent
  - ../../bases/grafana
@ -14,7 +15,4 @@ bases:
  # - servicemonitors/node-exporter.yaml
  - probes/blackbox-exporter.yaml

-resources:
-  - namespace.yaml
-
 namespace: monitoring
--- a/kustomize/namespaces/nextcloud/kustomization.yaml
+++ b/kustomize/namespaces/nextcloud/kustomization.yaml
@ -1,7 +1,5 @@
-bases:
-  - ../../bases/nextcloud
-
 resources:
  - namespace.yaml
+  - ../../bases/nextcloud

 namespace: nextcloud
--- a/kustomize/overlays/prod-cluster/kustomization.yaml
+++ b/kustomize/overlays/prod-cluster/kustomization.yaml
@ -1,15 +1,23 @@
-bases:
+resources:
  - ../../namespaces/kube-system
  - ../../bases/longhorn

-# allow "kubectl apply -l app.kubernetes.io/managed-by=cluster --prune ..."
+buildMetadata:
+  - originAnnotations
+
 commonLabels:
  app.kubernetes.io/managed-by: kustomize-cluster

 transformers:
-  - transformers/placeholders.yaml
  - transformers/ssm-secrets.yaml

+configMapGenerator:
+  - name: cluster-replacements
+    namespace: default
+    literals:
+      - TRAEFIK_EXTERNAL_HOST=traefik.badjnet.home
+      - LONGHORN_EXTERNAL_HOST=longhorn.badjnet.home
+
 secretGenerator:
  - name: s3-backupstore-credentials
    type: Opaque
@ -18,4 +26,32 @@ secretGenerator:
    literals:
      - AWS_ACCESS_KEY_ID=${ssm:/k3s/prod/longhorn/s3_access_key_id}
      - AWS_SECRET_ACCESS_KEY=${ssm:/k3s/prod/longhorn/s3_secret_access_key}
-      - AWS_ENDPOINTS=https://s3.badjware.dev
+      - AWS_ENDPOINTS=https://s3.badjware.dev
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: cluster-replacements
+      namespace: default
+      fieldPath: data.TRAEFIK_EXTERNAL_HOST
+    targets:
+      - select:
+          kind: Ingress
+          name: traefik
+          namespace: kube-system
+        fieldPaths:
+          - spec.rules.0.host
+  - source:
+      kind: ConfigMap
+      name: cluster-replacements
+      namespace: default
+      fieldPath: data.LONGHORN_EXTERNAL_HOST
+    targets:
+      - select:
+          kind: HelmChart
+          name: longhorn
+          namespace: kube-system
+        fieldPaths:
+          - spec.set.[ingress.host]
+        options:
+            create: true
--- a/kustomize/overlays/prod-cluster/placeholders.txt
+++ b/kustomize/overlays/prod-cluster/placeholders.txt
@ -1,2 +0,0 @@
-TRAEFIK_EXTERNAL_HOST=traefik.badjnet.home
-LONGHORN_EXTERNAL_HOST=longhorn.badjnet.home
--- a/kustomize/overlays/prod-cluster/transformers/placeholders.yaml
+++ b/kustomize/overlays/prod-cluster/transformers/placeholders.yaml
@ -1,5 +0,0 @@
-apiVersion: badjware/v1
-kind: PlaceholderTransformer
-metadata:
-  name: placeholders
-placeholdersFile: placeholders.txt
--- a/kustomize/overlays/prod/kustomization.yaml
+++ b/kustomize/overlays/prod/kustomization.yaml
@ -7,6 +7,9 @@ resources:
 # resources:
 #   - probes/external-services-bobcat-miner.yaml

+buildMetadata:
+  - originAnnotations
+
 images:
  - name: gitea/gitea
    newTag: 1.16.9
@ -30,11 +33,21 @@ images:
    newTag: 6.2.5

 configMapGenerator:
-  - name: ecommerce-exporter-config
-    namespace: monitoring
-    behavior: replace
-    files:
-      - ecommerce-exporter.yml=configurations/ecommerce-exporter/ecommerce-exporter.yml
+  - name: replacements
+    namespace: default
+    literals:
+      - GITEA_EXTERNAL_HOST=code.badjware.dev
+      - GITEA_EXTERNAL_URL=https://code.badjware.dev
+
+      - DRONE_EXTERNAL_HOST=drone.badjware.dev
+      - NEXTCLOUD_EXTERNAL_HOST=cloud.badjware.dev
+      - GRAFANA_EXTERNAL_HOST=grafana.badjware.dev
+      - PROMETHEUS_EXTERNAL_HOST=prometheus.badjnet.home
+  # - name: ecommerce-exporter-config
+  #   namespace: monitoring
+  #   behavior: replace
+  #   files:
+  #     - ecommerce-exporter.yml=configurations/ecommerce-exporter/ecommerce-exporter.yml

 secretGenerator:
  - name: drone-secret
@ -96,7 +109,6 @@ commonLabels:
  app.kubernetes.io/managed-by: kustomize

 transformers:
-  - transformers/placeholders.yaml
  - transformers/ssm-secrets.yaml

 patchesJson6902:
@ -113,3 +125,101 @@ patchesJson6902:

 # patchesStrategicMerge:
 #   - patches/blackbox-exporter-probe-patch.yaml
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: replacements
+      namespace: default
+      fieldPath: data.GITEA_EXTERNAL_HOST
+    targets:
+      - select:
+          kind: Ingress
+          name: gitea
+          namespace: gitea
+        fieldPaths:
+          - spec.rules.0.host
+  - source:
+      kind: ConfigMap
+      name: replacements
+      namespace: default
+      fieldPath: data.GITEA_EXTERNAL_URL
+    targets:
+      - select:
+          kind: Deployment
+          name: gitea
+          namespace: gitea
+        fieldPaths:
+          - spec.template.spec.containers.0.env.0.value
+      - select:
+          kind: Deployment
+          name: drone-server
+          namespace: gitea
+        fieldPaths:
+          - spec.template.spec.containers.0.env.0.value
+  - source:
+      kind: ConfigMap
+      name: replacements
+      namespace: default
+      fieldPath: data.DRONE_EXTERNAL_HOST
+    targets:
+      - select:
+          kind: Ingress
+          name: drone
+          namespace: gitea
+        fieldPaths:
+          - spec.rules.0.host
+      - select:
+          kind: Deployment
+          name: drone-server
+          namespace: gitea
+        fieldPaths:
+          - spec.template.spec.containers.0.env.1.value
+      - select:
+          kind: Deployment
+          name: gitea
+          namespace: gitea
+        fieldPaths:
+          - spec.template.spec.containers.0.env.1.value
+      - select:
+          kind: Deployment
+          name: drone-server
+          namespace: gitea
+        fieldPaths:
+          - spec.template.spec.containers.0.env.1.value
+  - source:
+      kind: ConfigMap
+      name: replacements
+      namespace: default
+      fieldPath: data.NEXTCLOUD_EXTERNAL_HOST
+    targets:
+      - select:
+          kind: Ingress
+          name: nextcloud
+          namespace: nextcloud
+        fieldPaths:
+          - spec.rules.0.host
+  - source:
+      kind: ConfigMap
+      name: replacements
+      namespace: default
+      fieldPath: data.GRAFANA_EXTERNAL_HOST
+    targets:
+      - select:
+          kind: Ingress
+          name: grafana
+          namespace: monitoring
+        fieldPaths:
+          - spec.rules.0.host
+  - source:
+      kind: ConfigMap
+      name: replacements
+      namespace: default
+      fieldPath: data.PROMETHEUS_EXTERNAL_HOST
+    targets:
+      - select:
+          kind: Ingress
+          name: prometheus
+          namespace: monitoring
+        fieldPaths:
+          - spec.rules.0.host
--- a/kustomize/overlays/prod/placeholders.txt
+++ b/kustomize/overlays/prod/placeholders.txt
@ -1,7 +0,0 @@
-GITEA_EXTERNAL_HOST=code.badjware.dev
-DRONE_EXTERNAL_HOST=drone.badjware.dev
-NEXTCLOUD_EXTERNAL_HOST=cloud.badjware.dev
-
-GRAFANA_EXTERNAL_HOST=grafana.badjware.dev
-KUBERNETES_DASHBOARD_EXTERNAL_HOST=kubernetes-dashboard.badjnet.home
-PROMETHEUS_EXTERNAL_HOST=prometheus.badjnet.home
--- a/kustomize/overlays/prod/transformers/placeholders.yaml
+++ b/kustomize/overlays/prod/transformers/placeholders.yaml
@ -1,5 +0,0 @@
-apiVersion: badjware/v1
-kind: PlaceholderTransformer
-metadata:
-  name: placeholders
-placeholdersFile: placeholders.txt
Author	SHA1	Message	Date
Massaki Archambault	251f012e9a	fix gitea configuration, install external-secrets	2023-02-07 00:02:13 -05:00
Massaki Archambault	77644f5240	remove placeholdertransformer	2023-02-06 10:31:21 -05:00
Massaki Archambault	17e553fce4	replace "bases" with "resources", add buildmetadata	2023-02-04 23:24:50 -05:00