refactor(k8s): consolidate to infra/+apps/ single-source tree, dedicated per-app CNPG (authentik-db/temporal-db), wire monitoring-config, forgejo→cicd ns, drop orphan/stale (data-schemas, ollama, story-crater, sqs/argocd, key-rotation)
This commit is contained in:
Story Crater Bot
@@ -0,0 +1,17 @@
|
||||
cloudflared:
|
||||
tunnelToken: ENC[AES256_GCM,data:GrZNC75M1T304m+MBbgcL9Wa6VD3Cc+joERjUWD7PsI5NlqFpVuorzub4OTaiE/F0sqDXtXdSwQP9jGTkgUnNbviUVEIBDb+zuiyzCfzuhc53oMvoUYRkRNeH5DR9TBEszspj8+mjQMDAKQFKtTmyDodgh8DdPg8LE8YTCqyx6CcpkGZ8yWY06VoKpZfFSOan/gHwRwG2500P8U+rzI676EKVUhWjBFP0iTbwDQR7spI7oz8Gon/0Q==,iv:O3i0v+M5L3i9O7SbBtDAJe5IsQDgw+alI0Y9arZNojs=,tag:/T63FivzvbLFaXEaBsn5FA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpU2tjOGpJNk9leE9LSnlx
|
||||
b2tVbFFMMkZ3OHZuU0VhcUp5Tjl4ZDh2R1U4CjFFMURDWFJtN1lETUNpSmEwbU9u
|
||||
aEIxUW5qWTJGTnlobjV0emlpY00rM28KLS0tIFd0cllZeXFodFhJNTJMNkRLNyt1
|
||||
cXVyNnM4Y2pXeUFTYzU1OXlaOXR2RWcKp7/M/YFfpJg4L6a0AcYTV3Rza+bzaOeD
|
||||
OUIwyns8ZsPtU8ILbRYUUdD2EJFiOPnWP4yX70Ak10v12gfB7vRJ6A==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|
||||
lastmodified: "2026-07-20T17:49:35Z"
|
||||
mac: ENC[AES256_GCM,data:MhuuuInJjGbzoftxVqMZUov1tJpOt5Vb8GwTr0R12hRCVHwdV+cuC1YeXTQidYaduO7neGnYe0p8ESLEpyY06j4nSpCvGRPPaxTeSeA8IcIk71xNtA1X0FVPv51s59rpvVSjiMDCqrcOv1aJybfQnBZoc/9bfmCYGqhDkD6sg1U=,iv:ThTjUGYE9GiyIgXS+0KDLYS20RPJjMG9DKyMSoKGk/4=,tag:KqZYps5qSuKPUI4U3Iabmw==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
@@ -0,0 +1,37 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: cloudflared
|
||||
namespace: cloudflared
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: cloudflared
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: cloudflared
|
||||
spec:
|
||||
containers:
|
||||
- name: cloudflared
|
||||
image: cloudflare/cloudflared:latest
|
||||
args:
|
||||
- tunnel
|
||||
- --no-autoupdate
|
||||
- run
|
||||
- --token
|
||||
- $(TUNNEL_TOKEN)
|
||||
env:
|
||||
- name: TUNNEL_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: cloudflared-token
|
||||
key: token
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: cloudflared
|
||||
resources:
|
||||
- deployment.yaml
|
||||
@@ -0,0 +1,40 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: duckdns-updater
|
||||
namespace: kube-system
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: duckdns-updater
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: duckdns-updater
|
||||
spec:
|
||||
containers:
|
||||
- name: updater
|
||||
image: curlimages/curl:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
while true; do
|
||||
curl -fsS "https://www.duckdns.org/update?domains=riotpiao&token=${DUCKDNS_TOKEN}&ip="
|
||||
sleep 300
|
||||
done
|
||||
env:
|
||||
- name: DUCKDNS_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: duckdns-token
|
||||
key: token
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 16Mi
|
||||
limits:
|
||||
cpu: 50m
|
||||
memory: 32Mi
|
||||
restartPolicy: Always
|
||||
@@ -0,0 +1,4 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- duckdns-corn.yaml
|
||||
@@ -0,0 +1,95 @@
|
||||
# PostSync hook to patch Homarr deployment probes
|
||||
# Chart v8.23.0 doesn't support probe customization via values
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: homarr-fix-probes
|
||||
namespace: dashboard
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||||
spec:
|
||||
backoffLimit: 3
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: Never
|
||||
serviceAccountName: homarr-probe-patcher
|
||||
containers:
|
||||
- name: patch
|
||||
image: python:3.12-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Installing kubectl..."
|
||||
wget -q -O /tmp/kubectl https://dl.k8s.io/release/v1.28.0/bin/linux/amd64/kubectl
|
||||
chmod +x /tmp/kubectl
|
||||
|
||||
echo "Patching Homarr deployment probes..."
|
||||
/tmp/kubectl -n dashboard patch deployment homarr --type=json -p='[
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/containers/0/livenessProbe/initialDelaySeconds",
|
||||
"value": 60
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/containers/0/livenessProbe/periodSeconds",
|
||||
"value": 30
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/containers/0/livenessProbe/timeoutSeconds",
|
||||
"value": 5
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/containers/0/readinessProbe/initialDelaySeconds",
|
||||
"value": 45
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/containers/0/readinessProbe/periodSeconds",
|
||||
"value": 15
|
||||
},
|
||||
{
|
||||
"op": "replace",
|
||||
"path": "/spec/template/spec/containers/0/readinessProbe/timeoutSeconds",
|
||||
"value": 5
|
||||
}
|
||||
]'
|
||||
|
||||
echo "✅ Probes patched successfully"
|
||||
echo " Liveness: 60s initial, 30s period, 5s timeout"
|
||||
echo " Readiness: 45s initial, 15s period, 5s timeout"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: homarr-probe-patcher
|
||||
namespace: dashboard
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: homarr-probe-patcher
|
||||
namespace: dashboard
|
||||
rules:
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "patch"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: homarr-probe-patcher
|
||||
namespace: dashboard
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: homarr-probe-patcher
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: homarr-probe-patcher
|
||||
namespace: dashboard
|
||||
@@ -0,0 +1,23 @@
|
||||
apiVersion: ENC[AES256_GCM,data:XZc=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:U2DPsVJ1gCoZw1YcgmT7UA==,type:str]
|
||||
kind: ENC[AES256_GCM,data:SRkjGwsv,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:113xdFELRoJiU4Kn8BmvPA==,type:str]
|
||||
metadata:
|
||||
name: ENC[AES256_GCM,data:stIxzQqOUvpbEANL4aQ=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:2XRGRbPQLNUGbA1dZI9xEQ==,type:str]
|
||||
namespace: ENC[AES256_GCM,data:wIhhcrQi3cDF,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:xnqvCtUdFPB5D9meJb36GA==,type:str]
|
||||
type: ENC[AES256_GCM,data:1qUDnlHH,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:u9PcCfvA2BydFNQQKws1Og==,type:str]
|
||||
stringData:
|
||||
SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:b0h8ekf7RIbQ9YTpaXPmR3aeNonk60lgltPmnRe7lVk9wlAdaXkNChINcAsarw9YhfYvfCZfS8U33/QxLGjaYA==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:JphkeY49bQLm6cPjT6g8LA==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiUW1BVmEvTnJqa3RuQ3NG
|
||||
UFg3SE1SclpWd01TZnFOK0trQ1c2YThUQmpRCkdGc3FJSmRCcFIycWcvZXJCbDdj
|
||||
T1M2cFFUakpOa2FST1k2UHc0a1hCRWMKLS0tIDk0UVdYRUkvTEM4TEVWRElrY3dN
|
||||
SFU2bkZxUGlDL0JNSnY3UU54Z3BhbFUKnJYwwQkUveNjTF9CveVUBF8RO7QjDnYA
|
||||
1+COKzvXuCIupvPcS87AtkrOfbfTu3IK78pfxZn04FmMOuAyj0ynzA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|
||||
lastmodified: "2026-07-22T15:59:29Z"
|
||||
mac: ENC[AES256_GCM,data:uMmKD4fvu39KZc2lDoDD25g/p/eIGW/CYFIwYXcRFPdbLLLi+iW9ks/2l5tHqzlwHEtlL1RH4HLOQr25k3GAJA2FhVnyVmyZ4N2EnJfic/9XTfef9E8tKVo2cXEgYMCPbpH8sVu2OoaQ9BFw8dTM9ZxuTdGKksGOtGp56I4R8hA=,iv:QFhVAZ1jykTNLPDzqjYf9jkg5PuqYA8+s0Hn57ND3KA=,tag:Zz2qYANQP33izwg+3Ap16A==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
@@ -0,0 +1,48 @@
|
||||
# Homarr landing page with Authentik SSO
|
||||
# Probes patched via PostSync hook (chart doesn't support customization)
|
||||
|
||||
image:
|
||||
repository: ghcr.io/homarr-labs/homarr
|
||||
tag: "latest"
|
||||
pullPolicy: Always
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
# Configure SSO via environment variables
|
||||
# Chart supports these via top-level env dict (not array)
|
||||
env:
|
||||
AUTH_PROVIDERS: "oidc,credentials"
|
||||
AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
|
||||
AUTH_OIDC_CLIENT_NAME: "Authentik"
|
||||
AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
|
||||
AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
|
||||
AUTH_OIDC_AUTO_LOGIN: "false"
|
||||
BASE_URL: "https://homarr.riotpiao.com"
|
||||
NEXTAUTH_URL: "https://homarr.riotpiao.com"
|
||||
|
||||
# Client credentials from homarr-oidc secret
|
||||
# Chart doesn't support envFrom, so we add via extraEnv
|
||||
extraEnv:
|
||||
- name: AUTH_OIDC_CLIENT_ID
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: homarr-oidc
|
||||
key: client-id
|
||||
- name: AUTH_OIDC_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: homarr-oidc
|
||||
key: client-secret
|
||||
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
@@ -0,0 +1,7 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: dashboard
|
||||
resources:
|
||||
- fix-probes-job.yaml
|
||||
# PostSync hook to patch Homarr deployment probes
|
||||
# (homarr-secrets.enc.yaml managed by sops-secrets Application)
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v2
|
||||
name: kafka-cluster
|
||||
description: Strimzi Kafka/KafkaNodePool CRs for the kmsvc Kafka cluster (design.md §7)
|
||||
type: application
|
||||
version: 0.1.0
|
||||
@@ -0,0 +1,30 @@
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: Kafka
|
||||
metadata:
|
||||
name: {{ .Values.clusterName }}
|
||||
namespace: {{ .Values.namespace }}
|
||||
annotations:
|
||||
strimzi.io/node-pools: enabled
|
||||
strimzi.io/kraft: enabled
|
||||
spec:
|
||||
kafka:
|
||||
version: 4.0.0
|
||||
metadataVersion: 4.0-IV3
|
||||
listeners:
|
||||
- name: plain
|
||||
port: 9092
|
||||
type: internal
|
||||
tls: false
|
||||
- name: tls
|
||||
port: 9093
|
||||
type: internal
|
||||
tls: true
|
||||
config:
|
||||
default.replication.factor: {{ .Values.kafka.replicationFactor }}
|
||||
min.insync.replicas: {{ .Values.kafka.minInsyncReplicas }}
|
||||
offsets.topic.replication.factor: {{ .Values.kafka.replicationFactor }}
|
||||
transaction.state.log.replication.factor: {{ .Values.kafka.replicationFactor }}
|
||||
transaction.state.log.min.isr: {{ .Values.kafka.minInsyncReplicas }}
|
||||
entityOperator:
|
||||
topicOperator: {}
|
||||
userOperator: {}
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: kafka.strimzi.io/v1beta2
|
||||
kind: KafkaNodePool
|
||||
metadata:
|
||||
name: {{ .Values.clusterName }}-pool
|
||||
namespace: {{ .Values.namespace }}
|
||||
labels:
|
||||
strimzi.io/cluster: {{ .Values.clusterName }}
|
||||
spec:
|
||||
replicas: {{ .Values.nodePool.replicas }}
|
||||
roles:
|
||||
- controller
|
||||
- broker
|
||||
storage:
|
||||
type: persistent-claim
|
||||
size: {{ .Values.nodePool.storage.sizeGi }}Gi
|
||||
class: {{ .Values.nodePool.storage.class }}
|
||||
deleteClaim: false
|
||||
resources:
|
||||
limits:
|
||||
memory: {{ .Values.nodePool.resources.memory }}
|
||||
cpu: {{ .Values.nodePool.resources.cpu | quote }}
|
||||
requests:
|
||||
memory: {{ .Values.nodePool.resources.memory }}
|
||||
cpu: {{ .Values.nodePool.resources.cpu | quote }}
|
||||
template:
|
||||
pod:
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
topologyKey: {{ .Values.nodePool.antiAffinityTopologyKey }}
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
strimzi.io/cluster: {{ .Values.clusterName }}
|
||||
kafkaContainer:
|
||||
env:
|
||||
- name: KAFKA_HEAP_OPTS
|
||||
value: {{ .Values.nodePool.heapOpts | quote }}
|
||||
@@ -0,0 +1,26 @@
|
||||
clusterName: kmsvc
|
||||
namespace: sqs
|
||||
|
||||
nodePool:
|
||||
replicas: 3
|
||||
storage:
|
||||
class: longhorn
|
||||
# Longhorn's per-node scheduling budget on the current 2-node cluster has
|
||||
# only ~36Gi of headroom left (other PVCs already reserve the rest), and
|
||||
# each node hosts one replica of all 3 broker volumes -- so 3 * sizeGi
|
||||
# must fit in that headroom. Revisit once the 3rd node joins.
|
||||
sizeGi: 10
|
||||
resources:
|
||||
memory: 5Gi
|
||||
cpu: "2"
|
||||
heapOpts: "-Xms2g -Xmx2g"
|
||||
# design.md §7: 3 real zones now exist (talos-cp-1=az-a, talos-worker-1=az-b,
|
||||
# talos-worker-2=az-c), so anti-affinity keys off zone instead of hostname —
|
||||
# spreads the 3 broker pods one-per-zone/one-per-node (equivalent today,
|
||||
# but zone is the correct long-term key if a node ever gets replaced within
|
||||
# the same zone).
|
||||
antiAffinityTopologyKey: topology.kubernetes.io/zone
|
||||
|
||||
kafka:
|
||||
replicationFactor: 3
|
||||
minInsyncReplicas: 2
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v2
|
||||
name: management-service
|
||||
description: kmsvc message-plane gRPC+REST server (design.md §1, §7a, §9)
|
||||
type: application
|
||||
version: 0.1.0
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: management-service-config
|
||||
namespace: {{ .Values.namespace }}
|
||||
data:
|
||||
KMSVC_KAFKA_BROKERS: {{ .Values.env.kafkaBrokers | quote }}
|
||||
KMSVC_REDIS_ADDR: {{ .Values.env.redisAddr | quote }}
|
||||
KMSVC_AUTHENTIK_ISSUER_URL: {{ .Values.env.authentikIssuerURL | quote }}
|
||||
KMSVC_AUTHENTIK_AUDIENCE: {{ .Values.env.authentikAudience | quote }}
|
||||
KMSVC_GRPC_LISTEN_ADDR: ":{{ .Values.grpcPort }}"
|
||||
KMSVC_HTTP_LISTEN_ADDR: ":{{ .Values.httpPort }}"
|
||||
@@ -0,0 +1,49 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: management-service
|
||||
namespace: {{ .Values.namespace }}
|
||||
spec:
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: management-service
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: management-service
|
||||
spec:
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app: management-service
|
||||
containers:
|
||||
- name: management-service
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
ports:
|
||||
- name: grpc
|
||||
containerPort: {{ .Values.grpcPort }}
|
||||
- name: http
|
||||
containerPort: {{ .Values.httpPort }}
|
||||
env:
|
||||
- name: GOMEMLIMIT
|
||||
value: {{ .Values.goMemLimit | quote }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: management-service-config
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: {{ .Values.httpPort }}
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: {{ .Values.httpPort }}
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 20
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if .Values.hpa.enabled }}
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: management-service
|
||||
namespace: {{ .Values.namespace }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: management-service
|
||||
minReplicas: {{ .Values.hpa.minReplicas }}
|
||||
maxReplicas: {{ .Values.hpa.maxReplicas }}
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.hpa.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.hpa.targetMemoryUtilizationPercentage }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if and .Values.ingress.enabled .Values.ingress.grpcEnabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: management-service-grpc
|
||||
namespace: {{ .Values.namespace }}
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
|
||||
spec:
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ .Values.ingress.host }}
|
||||
secretName: {{ .Values.ingress.tlsSecretName }}
|
||||
rules:
|
||||
- host: {{ .Values.ingress.host }}
|
||||
http:
|
||||
paths:
|
||||
- path: {{ .Values.ingress.grpcPathPrefix }}
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: management-service
|
||||
port:
|
||||
number: {{ .Values.grpcPort }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- if .Values.ingress.enabled }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: management-service
|
||||
namespace: {{ .Values.namespace }}
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: {{ .Values.ingress.clusterIssuer }}
|
||||
spec:
|
||||
ingressClassName: {{ .Values.ingress.className }}
|
||||
tls:
|
||||
- hosts:
|
||||
- {{ .Values.ingress.host }}
|
||||
secretName: {{ .Values.ingress.tlsSecretName }}
|
||||
rules:
|
||||
- host: {{ .Values.ingress.host }}
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: management-service
|
||||
port:
|
||||
number: {{ .Values.httpPort }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: management-service
|
||||
namespace: {{ .Values.namespace }}
|
||||
spec:
|
||||
selector:
|
||||
app: management-service
|
||||
ports:
|
||||
- name: grpc
|
||||
port: {{ .Values.grpcPort }}
|
||||
targetPort: {{ .Values.grpcPort }}
|
||||
- name: http
|
||||
port: {{ .Values.httpPort }}
|
||||
targetPort: {{ .Values.httpPort }}
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,50 @@
|
||||
namespace: sqs
|
||||
replicaCount: 3
|
||||
|
||||
image:
|
||||
repository: ghcr.io/riotpiaole/kmsvc-management-service
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
|
||||
grpcPort: 9090
|
||||
httpPort: 8080
|
||||
|
||||
env:
|
||||
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
|
||||
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
|
||||
authentikIssuerURL: ""
|
||||
authentikAudience: ""
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 512Mi
|
||||
|
||||
# Go's GC only reacts to GOGC by default and has no idea about the cgroup
|
||||
# memory limit above -- it'll happily grow heap until the kernel OOMKills it.
|
||||
# Setting GOMEMLIMIT to ~90% of the container limit makes the GC self-throttle
|
||||
# before that happens. Keep this in sync with resources.limits.memory.
|
||||
goMemLimit: "460MiB"
|
||||
|
||||
hpa:
|
||||
enabled: true
|
||||
minReplicas: 3
|
||||
maxReplicas: 9
|
||||
targetCPUUtilizationPercentage: 70
|
||||
targetMemoryUtilizationPercentage: 80
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
clusterIssuer: homelab-ca
|
||||
host: kmsvc.riotpiao.com
|
||||
tlsSecretName: kmsvc-tls
|
||||
# kmsvc-cli connects via gRPC directly to --server/KMSVC_SERVER (default
|
||||
# kmsvc.riotpiao.com:443, see kmsvc-cli's README), so raw gRPC needs an
|
||||
# external path too — scoped to the gRPC service's own path prefix on the
|
||||
# same host/port, rather than opening the whole host to gRPC passthrough.
|
||||
grpcEnabled: true
|
||||
grpcPathPrefix: /kafkamgmt.v1.QueueService/
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: v2
|
||||
name: queue-crd
|
||||
description: Queue CRD definition + queue-operator Deployment/RBAC (design.md §2a)
|
||||
type: application
|
||||
version: 0.1.0
|
||||
@@ -0,0 +1,274 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.21.0
|
||||
name: queues.kmsvc.io
|
||||
spec:
|
||||
group: kmsvc.io
|
||||
names:
|
||||
kind: Queue
|
||||
listKind: QueueList
|
||||
plural: queues
|
||||
shortNames:
|
||||
- queue
|
||||
- queues
|
||||
singular: queue
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.fifoQueue
|
||||
name: FIFO
|
||||
type: boolean
|
||||
- jsonPath: .status.phase
|
||||
name: Phase
|
||||
type: string
|
||||
name: v1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Queue is the Schema for the queues API — see design.md §2a.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: QueueSpec defines the desired state of a Queue (design.md
|
||||
§2a).
|
||||
properties:
|
||||
deadLetterTargetQueue:
|
||||
description: |-
|
||||
DeadLetterTargetQueue is the name of another Queue to route exhausted
|
||||
messages to. Must not point at itself or at another DLQ (design.md §5).
|
||||
type: string
|
||||
delaySeconds:
|
||||
description: DelaySeconds is the default delivery delay applied to
|
||||
sent messages.
|
||||
format: int32
|
||||
maximum: 900
|
||||
minimum: 0
|
||||
type: integer
|
||||
fifoQueue:
|
||||
default: false
|
||||
description: FIFOQueue enables per-MessageGroupId ordering and deduplication
|
||||
semantics.
|
||||
type: boolean
|
||||
isDLQ:
|
||||
description: |-
|
||||
IsDLQ marks this queue as itself a dead-letter queue, used to enforce
|
||||
the no-DLQ-chaining validation rule in design.md §5.
|
||||
type: boolean
|
||||
maxReceiveCount:
|
||||
default: 5
|
||||
description: |-
|
||||
MaxReceiveCount is how many times a message may be redelivered before
|
||||
being routed to DeadLetterTargetQueue.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
maxShards:
|
||||
default: 8
|
||||
description: MaxShards is the ceiling on shard count the operator
|
||||
may split up to (design.md §2c).
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
messageRetentionPeriodSeconds:
|
||||
default: 345600
|
||||
description: MessageRetentionPeriodSeconds maps to the underlying
|
||||
Kafka topic's retention.ms.
|
||||
format: int32
|
||||
maximum: 1209600
|
||||
minimum: 60
|
||||
type: integer
|
||||
minShards:
|
||||
default: 1
|
||||
description: MinShards is the floor on shard count; the operator never
|
||||
merges below this.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
partitionsPerShard:
|
||||
default: 6
|
||||
description: PartitionsPerShard is the Kafka partition count on each
|
||||
shard's topic.
|
||||
format: int32
|
||||
minimum: 1
|
||||
type: integer
|
||||
shardSplitCooldownSeconds:
|
||||
default: 300
|
||||
description: |-
|
||||
ShardSplitCooldownSeconds is the minimum age a shard must reach before it
|
||||
is eligible to be split again, preventing rapid re-splitting of a child
|
||||
that hasn't yet absorbed its share of traffic.
|
||||
format: int32
|
||||
minimum: 0
|
||||
type: integer
|
||||
shardSplitThresholdBytesPerSec:
|
||||
default: 5242880
|
||||
description: |-
|
||||
ShardSplitThresholdBytesPerSec is the sustained per-shard throughput that
|
||||
triggers a split into two child shards (design.md §2c).
|
||||
format: int64
|
||||
minimum: 1
|
||||
type: integer
|
||||
visibilityTimeoutSeconds:
|
||||
default: 30
|
||||
description: |-
|
||||
VisibilityTimeoutSeconds is how long a received-but-unacked message stays
|
||||
invisible to other consumers before being redelivered.
|
||||
format: int32
|
||||
maximum: 43200
|
||||
minimum: 0
|
||||
type: integer
|
||||
type: object
|
||||
status:
|
||||
description: QueueStatus defines the observed state of a Queue.
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions hold detailed status information.
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
phase:
|
||||
description: Phase is the current reconciliation phase.
|
||||
enum:
|
||||
- Pending
|
||||
- Ready
|
||||
- Failed
|
||||
type: string
|
||||
shards:
|
||||
description: |-
|
||||
Shards lists every shard backing this queue, active or draining
|
||||
(design.md §2a/§2c).
|
||||
items:
|
||||
description: ShardStatus describes one shard backing a Queue (design.md
|
||||
§2a/§2c).
|
||||
properties:
|
||||
availabilityZones:
|
||||
description: |-
|
||||
AvailabilityZones lists the topology.kubernetes.io/zone values of every
|
||||
node currently hosting a Kafka replica of this shard's topic, resolved
|
||||
from the broker pods' node placement each reconcile. Empty until the
|
||||
first successful resolution (e.g. node lookup failed transiently).
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
createdAt:
|
||||
description: |-
|
||||
CreatedAt timestamps when this shard was created, used to enforce
|
||||
ShardSplitCooldownSeconds.
|
||||
format: date-time
|
||||
type: string
|
||||
hashRangeEnd:
|
||||
format: int64
|
||||
type: integer
|
||||
hashRangeStart:
|
||||
description: |-
|
||||
HashRangeStart/HashRangeEnd define the [start, end) murmur2 hash range
|
||||
this shard owns over the 32-bit key space. Stored as int64 (not uint32)
|
||||
because controller-gen maps Go uint32 to OpenAPI format:int32, whose max
|
||||
(2147483647) is smaller than FullHashRangeEnd (0xFFFFFFFF) and the
|
||||
apiserver rejects the status update.
|
||||
format: int64
|
||||
type: integer
|
||||
id:
|
||||
description: ID is the shard's identifier, used in its topic
|
||||
name (kmsvc.{queue}.shard-{id}).
|
||||
type: string
|
||||
parentId:
|
||||
description: |-
|
||||
ParentID is the shard ID this shard was split from, empty for the
|
||||
original shard-0.
|
||||
type: string
|
||||
phase:
|
||||
description: Phase is this shard's lifecycle state.
|
||||
enum:
|
||||
- Active
|
||||
- Closing
|
||||
- Closed
|
||||
type: string
|
||||
topic:
|
||||
description: Topic is the underlying Kafka topic name for this
|
||||
shard.
|
||||
type: string
|
||||
required:
|
||||
- hashRangeEnd
|
||||
- hashRangeStart
|
||||
- id
|
||||
- phase
|
||||
- topic
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,38 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: queue-operator
|
||||
namespace: {{ .Values.namespace }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: queue-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: queue-operator
|
||||
spec:
|
||||
serviceAccountName: queue-operator
|
||||
containers:
|
||||
- name: queue-operator
|
||||
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
command: ["/queue-operator"]
|
||||
env:
|
||||
- name: KMSVC_KAFKA_BROKERS
|
||||
value: {{ .Values.kafkaBrokers | quote }}
|
||||
- name: KMSVC_REDIS_ADDR
|
||||
value: {{ .Values.redisAddr | quote }}
|
||||
- name: GOMEMLIMIT
|
||||
value: {{ .Values.goMemLimit | quote }}
|
||||
- name: KMSVC_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: KMSVC_KAFKA_CLUSTER_NAME
|
||||
value: {{ .Values.kafkaClusterName | quote }}
|
||||
- name: KMSVC_KAFKA_POOL_NAME
|
||||
value: {{ .Values.kafkaPoolName | quote }}
|
||||
resources:
|
||||
{{- toYaml .Values.resources | nindent 12 }}
|
||||
@@ -0,0 +1,45 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: queue-operator
|
||||
namespace: {{ .Values.namespace }}
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: queue-operator
|
||||
rules:
|
||||
- apiGroups: ["kmsvc.io"]
|
||||
resources: ["queues", "temporalworkers"]
|
||||
verbs: ["get", "list", "watch", "update", "patch"]
|
||||
- apiGroups: ["kmsvc.io"]
|
||||
resources: ["queues/status", "temporalworkers/status"]
|
||||
verbs: ["get", "update", "patch"]
|
||||
- apiGroups: ["kmsvc.io"]
|
||||
resources: ["queues/finalizers", "temporalworkers/finalizers"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "nodes"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: queue-operator
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: queue-operator
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: queue-operator
|
||||
namespace: {{ .Values.namespace }}
|
||||
@@ -0,0 +1,62 @@
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
name: temporalworkers.kmsvc.io
|
||||
spec:
|
||||
group: kmsvc.io
|
||||
names:
|
||||
kind: TemporalWorker
|
||||
plural: temporalworkers
|
||||
singular: temporalworker
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1
|
||||
served: true
|
||||
storage: true
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
properties:
|
||||
apiVersion:
|
||||
type: string
|
||||
kind:
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
type: object
|
||||
description: Temporal worker specification
|
||||
properties:
|
||||
namespace:
|
||||
type: string
|
||||
description: Temporal namespace
|
||||
taskQueue:
|
||||
type: string
|
||||
description: Task queue name
|
||||
workflowTypes:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: List of workflow types to execute
|
||||
activityTypes:
|
||||
type: array
|
||||
items:
|
||||
type: string
|
||||
description: List of activity types to execute
|
||||
concurrency:
|
||||
type: integer
|
||||
minimum: 1
|
||||
description: Worker concurrency level
|
||||
status:
|
||||
type: object
|
||||
description: Temporal worker status
|
||||
properties:
|
||||
ready:
|
||||
type: boolean
|
||||
lastHeartbeat:
|
||||
type: string
|
||||
format: date-time
|
||||
error:
|
||||
type: string
|
||||
@@ -0,0 +1,26 @@
|
||||
namespace: sqs
|
||||
|
||||
image:
|
||||
repository: ghcr.io/riotpiaole/kmsvc-management-service
|
||||
tag: latest
|
||||
pullPolicy: Always
|
||||
|
||||
kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
|
||||
redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
|
||||
|
||||
# Must match kafka-cluster chart's clusterName/derived pool name -- used to
|
||||
# resolve "<kafkaClusterName>-<kafkaPoolName>-<brokerID>" broker pod names
|
||||
# for AZ-aware Queue status (design.md §2a).
|
||||
kafkaClusterName: kmsvc
|
||||
kafkaPoolName: kmsvc-pool
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 256Mi
|
||||
|
||||
# See management-service/values.yaml's goMemLimit comment -- same reasoning.
|
||||
goMemLimit: "230MiB"
|
||||
@@ -0,0 +1,5 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: portainer
|
||||
resources: []
|
||||
# Portainer deployed via Helm chart or existing manifests
|
||||
@@ -0,0 +1,58 @@
|
||||
# k8s/portainer/portainer-values.yaml
|
||||
# Portainer — web UI for browsing cluster workloads, exec-ing into pods,
|
||||
# and viewing logs without kubectl. Operator-only access (ClusterIP + port-forward).
|
||||
#
|
||||
# Node failure behaviour:
|
||||
# Portainer is a Deployment (not StatefulSet), so K8s auto-evicts and
|
||||
# reschedules it ~5 min after a node becomes unreachable. Longhorn
|
||||
# reattaches the PVC on the new node in ~1-2 min. Worst case: ~7-10 min.
|
||||
#
|
||||
# To cut that down: in Longhorn UI → Settings set
|
||||
# nodeDownPodDeletionPolicy = delete-deployment-pod
|
||||
# Longhorn will force-delete the stuck pod immediately when the node is
|
||||
# fenced rather than waiting for Kubernetes' eviction timeout.
|
||||
|
||||
# ── Service ───────────────────────────────────────────────────────────────────
|
||||
# ClusterIP — no external exposure. Access via:
|
||||
# kubectl -n dashboard port-forward svc/portainer 9000:9000
|
||||
# Portainer holds cluster-admin credentials; never expose as LoadBalancer.
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
# ── TLS ───────────────────────────────────────────────────────────────────────
|
||||
# Portainer by default redirects HTTP → HTTPS using a self-signed cert.
|
||||
# force: false disables the redirect so plain HTTP over port-forward works
|
||||
# without browser cert warnings. TLS is terminated at the ingress layer
|
||||
# if/when an ingress rule is added.
|
||||
tls:
|
||||
force: false
|
||||
|
||||
# ── Persistence ───────────────────────────────────────────────────────────────
|
||||
# Stores Portainer's own config: environment registrations, user accounts,
|
||||
# stack definitions, and access control settings. Longhorn provides the
|
||||
# RWO block volume. 10Gi is generous for config data but cheap on Longhorn.
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: "longhorn-wffc"
|
||||
size: 10Gi
|
||||
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
|
||||
# ── Scheduling ────────────────────────────────────────────────────────────────
|
||||
# Allow scheduling on talos-cp-1 (carries NoSchedule taint) so Portainer
|
||||
# keeps running even when the worker node is down.
|
||||
tolerations:
|
||||
- key: node-role.kubernetes.io/control-plane
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
|
||||
# Pin to az-a (talos-cp-1) — sole Longhorn storage node. Its RWO PVC can only
|
||||
# attach there; without this the pod may land on cp-2/cp-3 and fail to mount.
|
||||
nodeSelector:
|
||||
topology.kubernetes.io/zone: az-a
|
||||
@@ -0,0 +1,18 @@
|
||||
temporal:
|
||||
oidc_client_id: ENC[AES256_GCM,data:y6eSNJpCNCg=,iv:4n5fIeiVG2JZOCD4yZ4Asm/gWvRl0QNFiRGTR1bs8ws=,tag:liLSr9sadR82UPq6d3gqGA==,type:str]
|
||||
oidc_client_secret: ENC[AES256_GCM,data:ebk0FVtSfq7JbIT+84cigdLg8zfN+4HTfGxlgqLw6hs1H92SFRHQFXO1l3U=,iv:qxa8aqUVoN31PpzAhs6bNMDCM6yPvOT27urIrM1rfo0=,tag:Vo25X8Znw7eh5DNq1eIJEw==,type:str]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArZ1pyMXZ0Y3RFQVZkcTg5
|
||||
aENyemRueXpIM0FaUVhMc2ZyVDRyWWlzK1JzCjA0OTZ0aGJDNVVSM29CY1RzQWJL
|
||||
eVNiSCtMSXdmbEtKeGt1L3NYMy9ibUEKLS0tIGJnU3A4MjVnZ1pCa1lPMnVoM0xo
|
||||
dWs1cVM5ZCszbXp6eFltRVhGbFc0ajQKyCc8lClnSqWUxhNOr1FDCwn5V7nvjxPN
|
||||
7kjQpldseaRbsy+TM5sFQ1w6Acmun9uYjzs8PtmTNaayc/AFfspufA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1smu533f803gmd0jq60s2zaj9zlznajy0ca6rtewd4r37mr2hs3uqsrldfh
|
||||
lastmodified: "2026-07-15T23:22:55Z"
|
||||
mac: ENC[AES256_GCM,data:0YuRxQHfdeKbjJzxHI4iBc7I2KnalNJmybB6bVQxvdRutsxKXW/bu99yqHkD4y/nI66Pi6d7LhrPhhGat3x2c6Drs7QRYVWnZ75thil6yWsOcpH7H1esxEWTP3cpoMzGdS0aF6zwU9H+WDvfm/t1wpeDpJly3eczcPvfbK1joDU=,iv:TgwfpI+ZVLyd2c/PKWsJbCI9yKkADpPPafJ5No0fLks=,tag:nqwQHtZ263CI+fY9iTUAzQ==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
@@ -0,0 +1,142 @@
|
||||
# k8s/temporal/temporal-values.yaml
|
||||
# Temporal — workflow engine
|
||||
# Uses external CNPG PostgreSQL for persistence (temporal-db)
|
||||
# Visibility via same PostgreSQL instance, separate database.
|
||||
#
|
||||
# IMPORTANT — chart schema note (root-caused after Postgres never actually
|
||||
# taking effect despite looking configured):
|
||||
# We're pinned to temporalio/helm-charts @ 0.74.0 (see targetRevision in
|
||||
# k8s/argocd/apps/60-applications.yaml), which uses the OLD flat persistence
|
||||
# schema:
|
||||
# server.config.persistence.<default|visibility>.driver: "sql"|"cassandra"
|
||||
# server.config.persistence.<default|visibility>.sql: {...}
|
||||
# NOT the newer `datastores:`-wrapped schema
|
||||
# (server.config.persistence.datastores.<store>.sql) shown in the current
|
||||
# chart's values/values.postgresql.yaml example - that key was introduced in
|
||||
# a later major version and doesn't exist in 0.74.0. Helm doesn't validate
|
||||
# unknown keys, so a `datastores:` block here is silently a no-op: Temporal
|
||||
# would keep defaulting to Cassandra (with empty hosts: []) regardless of
|
||||
# anything nested inside it. Verified via `helm template` against the actual
|
||||
# 0.74.0 chart before writing this file - see chat history for the
|
||||
# side-by-side proof (rendered manifest showed CASSANDRA_HOST env vars and
|
||||
# temporal-cassandra-tool commands using the old datastores:-based values).
|
||||
#
|
||||
# Likewise `schema.setup.enabled` / `schema.update.enabled` /
|
||||
# `schema.createDatabase.enabled` are the real toggles for the schema-setup
|
||||
# Job (all default true) - there is no `jobs.autoSetup` key in this chart.
|
||||
|
||||
# ── Disable every bundled/optional sub-chart ─────────────────────────────────
|
||||
# postgresql/mysql: never enable - we never want the chart to deploy its own
|
||||
# DB, only to know how to talk to our external CNPG instance (which happens
|
||||
# via server.config.persistence.*.sql below, independent of these flags).
|
||||
postgresql:
|
||||
enabled: false
|
||||
mysql:
|
||||
enabled: false
|
||||
cassandra:
|
||||
enabled: false
|
||||
elasticsearch:
|
||||
enabled: false
|
||||
prometheus:
|
||||
enabled: false
|
||||
grafana:
|
||||
enabled: false
|
||||
|
||||
# ── Schema setup/update Jobs ──────────────────────────────────────────────────
|
||||
# The `temporal` DB is created by the dedicated temporal-db cluster's initdb and
|
||||
# `temporal_visibility` by a CNPG Database CR — both in
|
||||
# k8s/infra/databases/temporal-db.yaml — so createDatabase stays disabled.
|
||||
# setup/update run temporal-sql-tool as the `app` owner against those existing
|
||||
# DBs to install and migrate the
|
||||
# Temporal server schema — without them both DBs have zero tables and the
|
||||
# server dies on "no usable database connection found" (no schema_version row).
|
||||
schema:
|
||||
createDatabase:
|
||||
enabled: false
|
||||
setup:
|
||||
enabled: true
|
||||
update:
|
||||
enabled: true
|
||||
|
||||
# ── Temporal server config (PostgreSQL persistence) ──────────────────────────
|
||||
server:
|
||||
replicaCount: 1
|
||||
# temporalio/server:1.30.0+ dropped the `dockerize` binary and switched to
|
||||
# built-in sprig config templating. The chart still defaults to the legacy
|
||||
# configMapsToMount: "dockerize" + setConfigFilePath: false, which produces a
|
||||
# config the 1.30 server never loads — it then falls back to its embedded
|
||||
# env-only template (Cassandra default) and dies with
|
||||
# "Persistence.DataStores[default](value).Cassandra.Hosts: zero value".
|
||||
# Switch to the sprig ConfigMap and point the server at it (chart's own
|
||||
# recommendation for 1.30.0+ images; sprig mode requires setConfigFilePath).
|
||||
configMapsToMount: "sprig"
|
||||
setConfigFilePath: true
|
||||
jobService:
|
||||
enabled: false
|
||||
affinity:
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: temporal
|
||||
topologyKey: kubernetes.io/hostname
|
||||
config:
|
||||
logLevel: "info"
|
||||
persistence:
|
||||
defaultStore: default
|
||||
visibilityStore: visibility
|
||||
numHistoryShards: 512
|
||||
default:
|
||||
driver: "sql"
|
||||
sql:
|
||||
driver: "postgres12"
|
||||
host: "temporal-db-rw.temporal.svc.cluster.local"
|
||||
port: 5432
|
||||
database: "temporal"
|
||||
user: "app"
|
||||
# existingSecret + secretKey: point directly at the CNPG-generated
|
||||
# Secret (kubernetes.io/basic-auth, keys: username/password/...)
|
||||
# rather than duplicating the password in git as plaintext. When
|
||||
# existingSecret is set the chart's own server-secret.yaml Secret
|
||||
# template is skipped entirely (see templates/server-secret.yaml:
|
||||
# `not $driverConfig.existingSecret` guards its creation).
|
||||
# Use unified temporal-db-app secret (generated in temporal namespace)
|
||||
existingSecret: "temporal-db-app"
|
||||
secretKey: "password"
|
||||
maxConns: 20
|
||||
maxIdleConns: 10
|
||||
maxConnLifetime: "1h"
|
||||
# NOTE: no `connectAttributes: { tx_isolation: ... }` here — tx_isolation
|
||||
# is a MySQL-only connection parameter. The Postgres `pq` driver rejects
|
||||
# it ("unrecognized configuration parameter"), which killed every DB
|
||||
# connection (schema-setup job AND server) with the misleading
|
||||
# "no usable database connection found". Postgres defaults to READ
|
||||
# COMMITTED isolation anyway, so nothing is lost by omitting it.
|
||||
visibility:
|
||||
driver: "sql"
|
||||
sql:
|
||||
driver: "postgres12"
|
||||
host: "temporal-db-rw.temporal.svc.cluster.local"
|
||||
port: 5432
|
||||
database: "temporal_visibility"
|
||||
user: "app"
|
||||
# Use unified temporal-db-app secret (generated in temporal namespace)
|
||||
existingSecret: "temporal-db-app"
|
||||
secretKey: "password"
|
||||
maxConns: 20
|
||||
maxIdleConns: 10
|
||||
maxConnLifetime: "1h"
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
# ── Temporal Web UI ────────────────────────────────────────────────────────
|
||||
web:
|
||||
replicaCount: 1
|
||||
service:
|
||||
type: ClusterIP
|
||||
|
||||
# ── Ingress ────────────────────────────────────────────────────────
|
||||
ingress:
|
||||
enabled: false
|
||||
Reference in New Issue
Block a user