mirror of
https://github.com/morten-olsen/homelab-apps.git
synced 2026-02-08 01:36:28 +01:00
docs: add agent context
This commit is contained in:
Morten Olsen
453
AGENTS.md
Normal file
453
AGENTS.md
Normal file
@@ -0,0 +1,453 @@
|
|||||||
|
# Application Helm Charts Guide
|
||||||
|
|
||||||
|
This document provides guidelines for creating and maintaining Helm charts in this homelab project.
|
||||||
|
|
||||||
|
## Project Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
apps/
|
||||||
|
├── charts/ # Individual application Helm charts
|
||||||
|
│ ├── app-name/
|
||||||
|
│ │ ├── Chart.yaml
|
||||||
|
│ │ ├── values.yaml
|
||||||
|
│ │ └── templates/
|
||||||
|
│ │ ├── deployment.yaml
|
||||||
|
│ │ ├── service.yaml
|
||||||
|
│ │ ├── pvc.yaml
|
||||||
|
│ │ ├── client.yaml # OIDC client configuration
|
||||||
|
│ │ ├── database.yaml # Database provisioning
|
||||||
|
│ │ ├── secret.yaml # Secret generation
|
||||||
|
│ │ └── external-http-service.yaml
|
||||||
|
│ └── ...
|
||||||
|
└── root/ # ArgoCD ApplicationSet for auto-discovery
|
||||||
|
├── Chart.yaml
|
||||||
|
├── values.yaml
|
||||||
|
└── templates/
|
||||||
|
├── applicationset.yaml
|
||||||
|
└── project.yaml
|
||||||
|
|
||||||
|
foundation/
|
||||||
|
├── charts/ # Foundation service Helm charts
|
||||||
|
│ └── ...
|
||||||
|
└── root/ # ArgoCD ApplicationSet for foundation services
|
||||||
|
|
||||||
|
shared/
|
||||||
|
├── charts/ # Shared service Helm charts
|
||||||
|
│ └── ...
|
||||||
|
└── root/ # ArgoCD ApplicationSet for shared services
|
||||||
|
```
|
||||||
|
|
||||||
|
## ArgoCD ApplicationSets
|
||||||
|
|
||||||
|
This project uses three separate ArgoCD ApplicationSets to manage different categories of services:
|
||||||
|
|
||||||
|
1. **apps/** - Individual applications (web apps, tools, services)
|
||||||
|
2. **foundation/** - Core infrastructure for the cluster (monitoring, certificates, operators)
|
||||||
|
3. **shared/** - Infrastructure shared between applications (databases, message queues, caches)
|
||||||
|
|
||||||
|
Each category has its own `root/` chart containing an ApplicationSet that auto-discovers and deploys charts from its respective `charts/` directory.
|
||||||
|
|
||||||
|
## Creating a New Application Chart
|
||||||
|
|
||||||
|
### 1. Basic Chart Structure
|
||||||
|
|
||||||
|
Create a new directory under `apps/charts/` with the following structure:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
mkdir -p apps/charts/my-app/templates
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Chart.yaml
|
||||||
|
```yaml
|
||||||
|
apiVersion: v2
|
||||||
|
version: 1.0.0
|
||||||
|
name: my-app
|
||||||
|
```
|
||||||
|
|
||||||
|
#### values.yaml
|
||||||
|
```yaml
|
||||||
|
image:
|
||||||
|
repository: docker.io/org/my-app
|
||||||
|
tag: v1.0.0
|
||||||
|
pullPolicy: IfNotPresent
|
||||||
|
subdomain: my-app
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. Core Templates
|
||||||
|
|
||||||
|
#### Deployment Template
|
||||||
|
Create `templates/deployment.yaml`:
|
||||||
|
```yaml
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
replicas: 1
|
||||||
|
revisionHistoryLimit: 0
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
containers:
|
||||||
|
- name: "{{ .Release.Name }}"
|
||||||
|
image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
|
||||||
|
imagePullPolicy: "{{ .Values.image.pullPolicy }}"
|
||||||
|
ports:
|
||||||
|
- name: http
|
||||||
|
containerPort: 8080
|
||||||
|
protocol: TCP
|
||||||
|
livenessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
readinessProbe:
|
||||||
|
tcpSocket:
|
||||||
|
port: http
|
||||||
|
volumeMounts:
|
||||||
|
- mountPath: /data
|
||||||
|
name: data
|
||||||
|
volumes:
|
||||||
|
- name: data
|
||||||
|
persistentVolumeClaim:
|
||||||
|
claimName: "{{ .Release.Name }}-data"
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Service Template
|
||||||
|
Create `templates/service.yaml`:
|
||||||
|
```yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: Service
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}"
|
||||||
|
spec:
|
||||||
|
ports:
|
||||||
|
- port: 80
|
||||||
|
targetPort: http
|
||||||
|
protocol: TCP
|
||||||
|
name: http
|
||||||
|
selector:
|
||||||
|
app: "{{ .Release.Name }}"
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Persistent Volume Claim
|
||||||
|
Create `templates/pvc.yaml`:
|
||||||
|
```yaml
|
||||||
|
apiVersion: v1
|
||||||
|
kind: PersistentVolumeClaim
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}-data"
|
||||||
|
spec:
|
||||||
|
accessModes:
|
||||||
|
- ReadWriteOnce
|
||||||
|
resources:
|
||||||
|
requests:
|
||||||
|
storage: 10Gi
|
||||||
|
```
|
||||||
|
|
||||||
|
## Custom Resource Definitions (CRDs)
|
||||||
|
|
||||||
|
This project uses several custom resources that are managed by operators in the cluster:
|
||||||
|
|
||||||
|
### 1. OIDC Client (OpenID Connect Authentication)
|
||||||
|
|
||||||
|
The `OidcClient` resource automatically provisions OAuth2/OIDC clients with your identity provider.
|
||||||
|
|
||||||
|
Create `templates/client.yaml`:
|
||||||
|
```yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: OidcClient
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
redirectUris:
|
||||||
|
- path: /oauth/oidc/callback
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
matchingMode: strict
|
||||||
|
```
|
||||||
|
|
||||||
|
**What it does:**
|
||||||
|
- Creates an OIDC client in your identity provider (e.g., Authentik)
|
||||||
|
- Generates a Kubernetes secret named `{{ .Release.Name }}-client` containing:
|
||||||
|
- `clientId`: The OAuth client ID
|
||||||
|
- `clientSecret`: The OAuth client secret
|
||||||
|
- `configuration`: The OIDC provider URL
|
||||||
|
|
||||||
|
**Using in deployment:**
|
||||||
|
```yaml
|
||||||
|
env:
|
||||||
|
- name: OAUTH_CLIENT_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: clientId
|
||||||
|
- name: OAUTH_CLIENT_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: clientSecret
|
||||||
|
- name: OPENID_PROVIDER_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-client"
|
||||||
|
key: configuration
|
||||||
|
```
|
||||||
|
|
||||||
|
### 2. PostgreSQL Database
|
||||||
|
|
||||||
|
The `PostgresDatabase` resource automatically provisions PostgreSQL databases.
|
||||||
|
|
||||||
|
Create `templates/database.yaml`:
|
||||||
|
```yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: PostgresDatabase
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
```
|
||||||
|
|
||||||
|
**What it does:**
|
||||||
|
- Creates a PostgreSQL database with the same name as your release
|
||||||
|
- Creates a user with appropriate permissions
|
||||||
|
- Generates a Kubernetes secret named `{{ .Release.Name }}-database` containing:
|
||||||
|
- `url`: Complete PostgreSQL connection URL
|
||||||
|
- `host`: Database hostname
|
||||||
|
- `port`: Database port
|
||||||
|
- `database`: Database name
|
||||||
|
- `username`: Database username
|
||||||
|
- `password`: Database password
|
||||||
|
|
||||||
|
**Using in deployment:**
|
||||||
|
```yaml
|
||||||
|
env:
|
||||||
|
- name: DATABASE_URL
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-database"
|
||||||
|
key: url
|
||||||
|
```
|
||||||
|
|
||||||
|
### 3. Secret Generation
|
||||||
|
|
||||||
|
The `GenerateSecret` resource creates secure random secrets.
|
||||||
|
|
||||||
|
Create `templates/secret.yaml`:
|
||||||
|
```yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: GenerateSecret
|
||||||
|
metadata:
|
||||||
|
name: "{{ .Release.Name }}-secrets"
|
||||||
|
spec:
|
||||||
|
fields:
|
||||||
|
- name: encryptionkey
|
||||||
|
encoding: hex # Options: hex, base64, alphanumeric
|
||||||
|
length: 64 # Length in bytes (before encoding)
|
||||||
|
- name: apitoken
|
||||||
|
encoding: base64
|
||||||
|
length: 32
|
||||||
|
```
|
||||||
|
|
||||||
|
**What it does:**
|
||||||
|
- Generates cryptographically secure random values
|
||||||
|
- Creates a Kubernetes secret with the specified fields
|
||||||
|
- Supports different encoding formats for different use cases
|
||||||
|
|
||||||
|
**Using in deployment:**
|
||||||
|
```yaml
|
||||||
|
env:
|
||||||
|
- name: ENCRYPTION_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: "{{ .Release.Name }}-secrets"
|
||||||
|
key: encryptionkey
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. External HTTP Service
|
||||||
|
|
||||||
|
The `ExternalHttpService` resource configures ingress routing for your application.
|
||||||
|
|
||||||
|
Create `templates/external-http-service.yaml`:
|
||||||
|
```yaml
|
||||||
|
apiVersion: homelab.mortenolsen.pro/v1
|
||||||
|
kind: ExternalHttpService
|
||||||
|
metadata:
|
||||||
|
name: '{{ .Release.Name }}'
|
||||||
|
spec:
|
||||||
|
environment: '{{ .Values.globals.environment }}'
|
||||||
|
subdomain: '{{ .Values.subdomain }}'
|
||||||
|
destination:
|
||||||
|
host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
|
||||||
|
port:
|
||||||
|
number: 80
|
||||||
|
```
|
||||||
|
|
||||||
|
**What it does:**
|
||||||
|
- Creates ingress routes for your application
|
||||||
|
- Configures subdomain routing (e.g., `myapp.yourdomain.com`)
|
||||||
|
- Handles TLS termination automatically
|
||||||
|
- Integrates with your service mesh (if applicable)
|
||||||
|
|
||||||
|
## Best Practices
|
||||||
|
|
||||||
|
### 1. Naming Conventions
|
||||||
|
- Use `{{ .Release.Name }}` consistently for all resource names
|
||||||
|
- Suffix resource names appropriately: `-data`, `-secrets`, `-client`, `-database`
|
||||||
|
|
||||||
|
### 2. Container Configuration
|
||||||
|
- Always specify health checks (liveness and readiness probes)
|
||||||
|
- Use named ports (e.g., `http`, `grpc`) instead of port numbers
|
||||||
|
- Set `revisionHistoryLimit: 0` to prevent accumulation of old ReplicaSets
|
||||||
|
|
||||||
|
### 3. Environment Variables
|
||||||
|
- Never hardcode secrets in values.yaml
|
||||||
|
- Use secretKeyRef to reference generated secrets
|
||||||
|
- Group related environment variables together
|
||||||
|
|
||||||
|
### 4. Persistent Storage
|
||||||
|
- Always use PVCs for stateful data
|
||||||
|
- Consider storage requirements carefully (start with reasonable defaults)
|
||||||
|
- Mount data at standard paths for the application
|
||||||
|
|
||||||
|
### 5. OIDC Integration
|
||||||
|
- Set `ENABLE_SIGNUP: "false"` if using OIDC
|
||||||
|
- Enable OIDC signup with `ENABLE_OAUTH_SIGNUP: "true"`
|
||||||
|
- Configure email merging if needed with `OAUTH_MERGE_ACCOUNTS_BY_EMAIL`
|
||||||
|
|
||||||
|
### 6. Database Usage
|
||||||
|
- Only include database.yaml if the app needs PostgreSQL
|
||||||
|
- Applications should support DATABASE_URL environment variable
|
||||||
|
- Consider connection pooling settings for production
|
||||||
|
|
||||||
|
## Disabling Applications
|
||||||
|
|
||||||
|
To temporarily disable an application, rename its directory with `.disabled` suffix:
|
||||||
|
```bash
|
||||||
|
mv apps/charts/my-app apps/charts/my-app.disabled
|
||||||
|
```
|
||||||
|
|
||||||
|
The ArgoCD ApplicationSet will automatically exclude directories matching `*.disabled`.
|
||||||
|
|
||||||
|
## Testing Your Chart
|
||||||
|
|
||||||
|
1. **Lint your chart:**
|
||||||
|
```bash
|
||||||
|
helm lint apps/charts/my-app
|
||||||
|
```
|
||||||
|
|
||||||
|
2. **Render templates locally:**
|
||||||
|
```bash
|
||||||
|
helm template my-app apps/charts/my-app
|
||||||
|
```
|
||||||
|
|
||||||
|
3. **Dry run installation:**
|
||||||
|
```bash
|
||||||
|
helm install my-app apps/charts/my-app --dry-run --debug
|
||||||
|
```
|
||||||
|
|
||||||
|
## Deployment Workflow
|
||||||
|
|
||||||
|
**IMPORTANT:** There is no test environment. When creating or modifying applications:
|
||||||
|
|
||||||
|
1. **Make changes directly to the files** - The agent will write changes to the actual chart files
|
||||||
|
2. **User deploys the changes** - After changes are made, the user must deploy them to the cluster
|
||||||
|
3. **Debug with kubectl** - If issues arise after deployment, agents can use kubectl to:
|
||||||
|
- Check pod status and logs
|
||||||
|
- Inspect generated resources
|
||||||
|
- Verify secret creation
|
||||||
|
- Troubleshoot configuration issues
|
||||||
|
|
||||||
|
**Note:** Agents cannot deploy applications themselves. They can only:
|
||||||
|
- Create and modify chart files
|
||||||
|
- Use kubectl to investigate deployment issues
|
||||||
|
- Provide debugging assistance and recommendations
|
||||||
|
|
||||||
|
## Common Patterns
|
||||||
|
|
||||||
|
### Application with OIDC + Database
|
||||||
|
For apps requiring both authentication and database:
|
||||||
|
- Include `client.yaml` for OIDC
|
||||||
|
- Include `database.yaml` for PostgreSQL
|
||||||
|
- Reference both secrets in deployment
|
||||||
|
|
||||||
|
### Stateless Applications
|
||||||
|
For simple stateless apps:
|
||||||
|
- Omit `pvc.yaml`
|
||||||
|
- Remove volume mounts from deployment
|
||||||
|
- Consider using `Deployment` scaling if appropriate
|
||||||
|
|
||||||
|
### Background Services
|
||||||
|
For services without web interface:
|
||||||
|
- Omit `external-http-service.yaml`
|
||||||
|
- Omit `client.yaml` (no OIDC needed)
|
||||||
|
- Focus on service discovery within cluster
|
||||||
|
|
||||||
|
## Troubleshooting
|
||||||
|
|
||||||
|
### Secret Not Found
|
||||||
|
If secrets are not being created:
|
||||||
|
1. Check that the CRD controller is running
|
||||||
|
2. Verify the `environment` value matches your setup
|
||||||
|
3. Check controller logs for provisioning errors
|
||||||
|
|
||||||
|
### OIDC Issues
|
||||||
|
1. Verify redirect URIs match exactly
|
||||||
|
2. Check that the identity provider is accessible
|
||||||
|
3. Ensure the client secret is being properly mounted
|
||||||
|
|
||||||
|
### Database Connection
|
||||||
|
1. Verify the database operator is running
|
||||||
|
2. Check network policies between namespaces
|
||||||
|
3. Ensure the database server has capacity
|
||||||
|
|
||||||
|
## Global Values
|
||||||
|
|
||||||
|
Applications can access global values through `{{ .Values.globals }}`:
|
||||||
|
- `environment`: The deployment environment (e.g., "production", "staging")
|
||||||
|
- Additional values can be added at the root chart level
|
||||||
|
|
||||||
|
## Maintenance
|
||||||
|
|
||||||
|
### Updating Images
|
||||||
|
1. Update the tag in `values.yaml`:
|
||||||
|
```yaml
|
||||||
|
tag: v1.0.0 # Use semantic version tags only
|
||||||
|
```
|
||||||
|
2. **Note:** Do not include SHA digests in tags. Immutable digests are automatically added later by Renovate
|
||||||
|
|
||||||
|
### Renovate Integration
|
||||||
|
The project uses Renovate for automated dependency updates. Configure in `renovate.json5` to:
|
||||||
|
- Auto-update container images
|
||||||
|
- Create pull requests for updates
|
||||||
|
- Group related updates
|
||||||
|
|
||||||
|
### Backup Considerations
|
||||||
|
For applications with persistent data:
|
||||||
|
1. Consider implementing backup CronJobs
|
||||||
|
2. Use volume snapshots if available
|
||||||
|
3. Export data regularly for critical applications
|
||||||
|
|
||||||
|
## Contributing
|
||||||
|
|
||||||
|
When adding new applications:
|
||||||
|
1. Follow the existing patterns and conventions
|
||||||
|
2. Document any special requirements in the chart's README
|
||||||
|
3. Consider security implications of all configurations
|
||||||
|
4. Update this document if introducing new patterns
|
||||||
|
|
||||||
|
## Maintaining This Document
|
||||||
|
|
||||||
|
**IMPORTANT:** When making changes to the project structure, patterns, or custom resources:
|
||||||
|
- Keep this AGENTS.md file up to date with any changes
|
||||||
|
- Document new CRDs or custom resources as they are added
|
||||||
|
- Update examples if the patterns change
|
||||||
|
- Add new sections for significant new features or patterns
|
||||||
|
- Ensure all code examples remain accurate and tested
|
||||||
|
|
||||||
|
This document serves as the primary reference for creating and maintaining applications in this project. Keeping it current ensures consistency and helps onboard new contributors.
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
apiVersion: v2
|
|
||||||
version: 1.0.0
|
|
||||||
name: monitoring
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-falco'
|
|
||||||
spec:
|
|
||||||
interval: 1h
|
|
||||||
url: https://falcosecurity.github.io/charts
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
||||||
kind: HelmRelease
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-falco'
|
|
||||||
spec:
|
|
||||||
chart:
|
|
||||||
spec:
|
|
||||||
chart: falco
|
|
||||||
reconcileStrategy: ChartVersion
|
|
||||||
sourceRef:
|
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
name: '{{ .Release.Name }}-falco'
|
|
||||||
namespace: '{{ .Release.Namespace }}'
|
|
||||||
interval: 1h
|
|
||||||
values: {}
|
|
||||||
@@ -1,53 +0,0 @@
|
|||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
metadata:
|
|
||||||
name: "{{ .Release.Name }}-prometheus-community"
|
|
||||||
spec:
|
|
||||||
interval: 1h
|
|
||||||
url: https://prometheus-community.github.io/helm-charts/
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
||||||
kind: HelmRelease
|
|
||||||
metadata:
|
|
||||||
name: "{{ .Release.Name }}-prometheus-community"
|
|
||||||
spec:
|
|
||||||
chart:
|
|
||||||
spec:
|
|
||||||
chart: kube-prometheus-stack
|
|
||||||
reconcileStrategy: ChartVersion
|
|
||||||
sourceRef:
|
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
name: "{{ .Release.Name }}-prometheus-community"
|
|
||||||
namespace: "{{ .Release.Namespace }}"
|
|
||||||
interval: 1h
|
|
||||||
values:
|
|
||||||
grafana:
|
|
||||||
env:
|
|
||||||
GF_SERVER_ROOT_URL: https://grafana.olsen.cloud # TODO
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: homelab.mortenolsen.pro/v1
|
|
||||||
kind: HttpService
|
|
||||||
metadata:
|
|
||||||
name: "{{ .Release.Name }}-prometheus-community"
|
|
||||||
spec:
|
|
||||||
environment: "{{ .Values.globals.environment }}"
|
|
||||||
subdomain: "{{ .Values.grafana.subdomain }}"
|
|
||||||
destination:
|
|
||||||
host: "{{ .Release.Name }}-prometheus-community-grafana.{{ .Release.Namespace }}.svc.cluster.local"
|
|
||||||
port:
|
|
||||||
number: 80
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: homelab.mortenolsen.pro/v1
|
|
||||||
kind: OidcClient
|
|
||||||
metadata:
|
|
||||||
name: "{{ .Release.Name }}-grafana"
|
|
||||||
spec:
|
|
||||||
environment: "{{ .Values.globals.environment }}"
|
|
||||||
redirectUris:
|
|
||||||
- path: /login/generic_oauth
|
|
||||||
subdomain: "{{ .Values.grafana.subdomain }}"
|
|
||||||
matchingMode: strict
|
|
||||||
@@ -1,121 +0,0 @@
|
|||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-loki'
|
|
||||||
spec:
|
|
||||||
interval: 1h
|
|
||||||
url: https://grafana.github.io/helm-charts
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
||||||
kind: HelmRelease
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-loki'
|
|
||||||
spec:
|
|
||||||
chart:
|
|
||||||
spec:
|
|
||||||
chart: loki
|
|
||||||
reconcileStrategy: ChartVersion
|
|
||||||
sourceRef:
|
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
name: '{{ .Release.Name }}-loki'
|
|
||||||
namespace: '{{ .Release.Namespace }}'
|
|
||||||
interval: 1h
|
|
||||||
values:
|
|
||||||
deploymentMode: SingleBinary
|
|
||||||
loki:
|
|
||||||
auth_enabled: false
|
|
||||||
server:
|
|
||||||
http_listen_port: 3100
|
|
||||||
|
|
||||||
# memberlist:
|
|
||||||
# join_members:
|
|
||||||
# - loki-memberlist
|
|
||||||
|
|
||||||
schemaConfig:
|
|
||||||
configs:
|
|
||||||
- from: 2020-05-15
|
|
||||||
store: tsdb
|
|
||||||
object_store: filesystem
|
|
||||||
schema: v13
|
|
||||||
index:
|
|
||||||
prefix: index_
|
|
||||||
period: 24h
|
|
||||||
|
|
||||||
storage:
|
|
||||||
type: filesystem
|
|
||||||
|
|
||||||
storage_config:
|
|
||||||
filesystem:
|
|
||||||
directory: /loki/chunks
|
|
||||||
|
|
||||||
limits_config:
|
|
||||||
reject_old_samples: true
|
|
||||||
reject_old_samples_max_age: 168h
|
|
||||||
max_cache_freshness_per_query: 10m
|
|
||||||
split_queries_by_interval: 15m
|
|
||||||
volume_enabled: true
|
|
||||||
|
|
||||||
common:
|
|
||||||
path_prefix: /loki
|
|
||||||
storage:
|
|
||||||
filesystem:
|
|
||||||
chunks_directory: /loki/chunks
|
|
||||||
rules_directory: /loki/rules
|
|
||||||
replication_factor: 1
|
|
||||||
ring:
|
|
||||||
instance_addr: 127.0.0.1
|
|
||||||
kvstore:
|
|
||||||
store: inmemory
|
|
||||||
|
|
||||||
# Enable persistent storage
|
|
||||||
singleBinary:
|
|
||||||
persistence:
|
|
||||||
enabled: true
|
|
||||||
size: 10Gi
|
|
||||||
storageClass: '{{ .Values.globals.environment }}' # Uses default storage class
|
|
||||||
extraVolumeMounts:
|
|
||||||
- name: storage
|
|
||||||
mountPath: /loki
|
|
||||||
|
|
||||||
backend:
|
|
||||||
replicas: 0
|
|
||||||
read:
|
|
||||||
replicas: 0
|
|
||||||
write:
|
|
||||||
replicas: 0
|
|
||||||
|
|
||||||
ingester:
|
|
||||||
replicas: 0
|
|
||||||
querier:
|
|
||||||
replicas: 0
|
|
||||||
queryFrontend:
|
|
||||||
replicas: 0
|
|
||||||
queryScheduler:
|
|
||||||
replicas: 0
|
|
||||||
distributor:
|
|
||||||
replicas: 0
|
|
||||||
compactor:
|
|
||||||
replicas: 0
|
|
||||||
indexGateway:
|
|
||||||
replicas: 0
|
|
||||||
bloomCompactor:
|
|
||||||
replicas: 0
|
|
||||||
bloomGateway:
|
|
||||||
replicas: 0
|
|
||||||
promtail:
|
|
||||||
enabled: true
|
|
||||||
config:
|
|
||||||
snippets:
|
|
||||||
extraScrapeConfigs: |
|
|
||||||
- job_name: kubernetes-pods
|
|
||||||
kubernetes_sd_configs:
|
|
||||||
- role: pod
|
|
||||||
relabel_configs:
|
|
||||||
- source_labels: ["__meta_kubernetes_pod_container_name"]
|
|
||||||
target_label: "container"
|
|
||||||
- source_labels: ["__meta_kubernetes_pod_name"]
|
|
||||||
target_label: "pod"
|
|
||||||
- source_labels: ["__meta_kubernetes_pod_namespace"]
|
|
||||||
target_label: "namespace"
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-kyverno'
|
|
||||||
spec:
|
|
||||||
interval: 1h
|
|
||||||
url: https://kyverno.github.io/kyverno/
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
||||||
kind: HelmRelease
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-kyverno'
|
|
||||||
spec:
|
|
||||||
chart:
|
|
||||||
spec:
|
|
||||||
chart: kyverno
|
|
||||||
reconcileStrategy: ChartVersion
|
|
||||||
sourceRef:
|
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
name: '{{ .Release.Name }}-kyverno'
|
|
||||||
namespace: '{{ .Release.Namespace }}'
|
|
||||||
interval: 1h
|
|
||||||
values: {}
|
|
||||||
@@ -1,25 +0,0 @@
|
|||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-aqua'
|
|
||||||
spec:
|
|
||||||
interval: 1h
|
|
||||||
url: https://aquasecurity.github.io/helm-charts/
|
|
||||||
|
|
||||||
---
|
|
||||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
||||||
kind: HelmRelease
|
|
||||||
metadata:
|
|
||||||
name: '{{ .Release.Name }}-aqua'
|
|
||||||
spec:
|
|
||||||
chart:
|
|
||||||
spec:
|
|
||||||
chart: trivy-operator
|
|
||||||
reconcileStrategy: ChartVersion
|
|
||||||
sourceRef:
|
|
||||||
apiVersion: source.toolkit.fluxcd.io/v1
|
|
||||||
kind: HelmRepository
|
|
||||||
name: '{{ .Release.Name }}-aqua'
|
|
||||||
namespace: '{{ .Release.Namespace }}'
|
|
||||||
interval: 1h
|
|
||||||
values: {}
|
|
||||||
@@ -1,4 +0,0 @@
|
|||||||
globals:
|
|
||||||
environment: prod
|
|
||||||
grafana:
|
|
||||||
subdomain: grafana
|
|
||||||
@@ -1,3 +0,0 @@
|
|||||||
apiVersion: v2
|
|
||||||
version: '1.0.0'
|
|
||||||
name: rules
|
|
||||||
@@ -1,32 +0,0 @@
|
|||||||
apiVersion: kyverno.io/v1
|
|
||||||
kind: Policy
|
|
||||||
metadata:
|
|
||||||
name: enforce-immutable-filesystem
|
|
||||||
annotations:
|
|
||||||
policies.kyverno.io/category: Security
|
|
||||||
policies.kyverno.io/severity: medium
|
|
||||||
policies.kyverno.io/description: |
|
|
||||||
This policy automatically sets 'readOnlyRootFilesystem: true' for all containers
|
|
||||||
within new Pods, enforcing an immutable root filesystem. This enhances security
|
|
||||||
by preventing applications from writing to their root filesystem at runtime,
|
|
||||||
making it harder for attackers to persist changes or introduce malware.
|
|
||||||
spec:
|
|
||||||
validationFailureAction: Audit
|
|
||||||
rules:
|
|
||||||
- name: enforce-read-only-root-filesystem
|
|
||||||
match:
|
|
||||||
any:
|
|
||||||
- resources:
|
|
||||||
kinds:
|
|
||||||
- Pod
|
|
||||||
mutate:
|
|
||||||
patchStrategicMerge:
|
|
||||||
spec:
|
|
||||||
containers:
|
|
||||||
- (name): '*' # Apply to all containers
|
|
||||||
securityContext:
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
initContainers:
|
|
||||||
- (name): '*' # Apply to all init containers
|
|
||||||
securityContext:
|
|
||||||
readOnlyRootFilesystem: true
|
|
||||||
Reference in New Issue
Block a user