feat: patch coredns not to be deployed in a non-master node

k8s/argo-apps/dcsi.yaml

@@ -19,16 +19,19 @@ spec:
           node:
             driver:
               image:
-                tag: "next@sha256:6b758d6faf96f0e96d4b8ac0e240fc290c7bace23c20d78a3eb93781652cb1f1"
+                tag: next
+                pullPolicy: Always
           controller:
             driver:
               image:
-                tag: "next@sha256:6b758d6faf96f0e96d4b8ac0e240fc290c7bace23c20d78a3eb93781652cb1f1"
+                tag: next
+                pullPolicy: Always
           csiDriver:
             name: org.dcsi.nfs
           driver:
             image:
               tag: next
+              pullPolicy: Always
             existingConfigSecret: secrets-dcsi
             config:
               driver: freenas-api-nfs

k8s/argo-apps/kube-system.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kube-system
+  namespace: argo-cd
+spec:
+  destination:
+    name: ''
+    namespace: kube-system
+    server: https://kubernetes.default.svc
+  sources:
+    - repoURL: https://git.roboces.dev/catalin/fukuops.git
+      path: k8s/services/kube-system
+      targetRevision: main
+  project: management
+  syncPolicy:
+    automated: {}

k8s/argo-apps/renovate.yaml

@@ -37,10 +37,7 @@ spec:
                   "fileMatch": ["k8s/services/.+\\.yaml$"]
                 }
               }
-          existingSecret: secrets-renovate
+          existingSecret: renovate
 
-    - repoURL: https://git.roboces.dev/catalin/fukuops.git
-      path: k8s/services/renovate
-      targetRevision: main
   syncPolicy:
     automated: {}

k8s/argo-apps/rustical.yaml

@@ -1,78 +0,0 @@
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: rustical
-  namespace: argo-cd
-spec:
-  destination:
-    name: ''
-    namespace: apps-roboces
-    server: https://kubernetes.default.svc
-  sources:
-    - repoURL: git.roboces.dev/catalin/fukuops
-      chart: rustical
-      targetRevision: 0.1.2
-      helm:
-        valuesObject:
-          replicaCount: 1
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsUser: 10000
-            runAsGroup: 10000
-            capabilities:
-              drop:
-                - all
-          service:
-            type: LoadBalancer
-            port: 8001
-          ingress:
-            enabled: true
-            className: "traefik"
-            hosts:
-              - host: cal.roboces.dev
-                paths:
-                  - path: /
-                    pathType: Prefix
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-            limits:
-              cpu: 500m
-              memory: 256Mi
-          livenessProbe:
-            tcpSocket:
-              port: 4000
-            initialDelaySeconds: 10
-            timeoutSeconds: 15
-            successThreshold: 1
-            failureThreshold: 3
-            periodSeconds: 10
-          readinessProbe:
-            tcpSocket:
-              port: 4000
-            initialDelaySeconds: 5
-            timeoutSeconds: 2
-            successThreshold: 1
-            failureThreshold: 3
-            periodSeconds: 10
-          persistence:
-            enabled: true
-          rustical:
-            oidc:
-              name: "Authentik"
-              issuer: "https://auth.fukurokuju.dev/application/o/rustical/"
-              claim_userid: "preffered_username"
-              scopes: '["openid", "profile", "groups"]'
-              allow_sign_up: "true"
-            frontend:
-              allow_password_login: "false"
-          secret:
-            existingSecretName: rustical
-  project: roboces
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

k8s/charts/rustical/Chart.yaml

@@ -1,8 +0,0 @@
-apiVersion: v2
-name: rustical
-description: A Helm chart for Rustical
-type: application
-version: 0.1.2
-appVersion: 0.14.1
-annotations:
-  artifacthub.io/images: "- name: rustical\n  image: ghcr.io/lennart-k/rustical:0.14.1\n"

k8s/charts/rustical/README.md

@@ -1,3 +0,0 @@
-# Rustical
-
-A Helm chart for [Rustical](https://github.com/lennart-k/rustical), an LDAP address book application.

k8s/charts/rustical/templates/_helpers.tpl

@@ -1,49 +0,0 @@
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "rustical.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-*/}}
-{{- define "rustical.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "rustical.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "rustical.labels" -}}
-helm.sh/chart: {{ include "rustical.chart" . }}
-{{ include "rustical.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "rustical.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "rustical.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}

k8s/charts/rustical/templates/deployment.yaml

@@ -1,97 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "rustical.fullname" . }}
-  labels:
-    {{- include "rustical.labels" . | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  replicas: {{ .Values.replicaCount }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "rustical.selectorLabels" . | nindent 6 }}
-  strategy:
-    rollingUpdate:
-      maxSurge: 50%
-      maxUnavailable: 50%
-    type: RollingUpdate
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "rustical.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      containers:
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullpolicy }}
-          {{- if or .Values.secret.existingSecretName .Values.secret.enabled }}
-          envFrom:
-            - secretRef:
-                name: {{ .Values.secret.existingSecretName | default (include "rustical.fullname" .) }}
-          {{- end }}
-          env:
-            {{- range $key, $value := .Values.env }}
-            - name: {{ $key }}
-              value: {{ $value | quote }}
-            {{- end }}
-            {{- range $section, $items := .Values.rustical }}
-            {{- range $key, $value := $items }}
-            {{- if not (eq $value nil) }}
-            - name: {{ printf "RUSTICAL_%s__%s" (upper $section) (upper $key) }}
-              value: {{ $value | quote }}
-            {{- end }}
-            {{- end }}
-            {{- end }}
-          ports:
-            - name: http
-              containerPort: 4000
-              protocol: TCP
-          {{- if .Values.persistence.enabled }}
-          volumeMounts:
-            - name: data
-              mountPath: {{ .Values.persistence.mountPath }}
-          {{- end }}
-          livenessProbe:
-            {{- toYaml .Values.livenessProbe | nindent 12 }}
-          readinessProbe:
-            {{- toYaml .Values.readinessProbe | nindent 12 }}
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-      {{- if .Values.persistence.enabled }}
-      volumes:
-        - name: data
-          {{- if .Values.persistence.existingClaim }}
-          persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existingClaim }}
-          {{- else }}
-          persistentVolumeClaim:
-            claimName: {{ include "rustical.fullname" . }}-pvc
-          {{- end }}
-      {{- end }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      restartPolicy: Always
-      automountServiceAccountToken: false

k8s/charts/rustical/templates/ingress.yaml

@@ -1,39 +0,0 @@
-{{- if .Values.ingress.enabled }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: {{ include "rustical.fullname" . }}
-  labels:
-    {{- include "rustical.labels" . | nindent 4 }}
-  {{- with .Values.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress.className }}
-  {{- if .Values.ingress.tls }}
-  tls:
-    {{- range .Values.ingress.tls }}
-    - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- range .Values.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            pathType: {{ .pathType }}
-            backend:
-              service:
-                name: {{ include "rustical.fullname" $ }}
-                port:
-                  number: {{ $.Values.service.port }}
-          {{- end }}
-    {{- end }}
-{{- end }}

k8s/charts/rustical/templates/pvc.yaml

@@ -1,14 +0,0 @@
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: {{ include "rustical.fullname" . }}-pvc
-  labels:
-    {{- include "rustical.labels" . | nindent 4 }}
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: {{ .Values.persistence.size }}
-{{- end }}

k8s/charts/rustical/templates/secret.yaml

@@ -1,13 +0,0 @@
-{{- if and .Values.secret.enabled (not .Values.secret.existingSecretName) -}}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "rustical.fullname" . }}
-  labels:
-    {{- include "rustical.labels" . | nindent 4 }}
-type: Opaque
-stringData:
-  {{- range $key, $value := .Values.secret.data }}
-  {{ $key }}: {{ $value | quote }}
-  {{- end }}
-{{- end }}

k8s/charts/rustical/templates/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "rustical.fullname" . }}
-  labels:
-    {{- include "rustical.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.port }}
-      targetPort: {{ .Values.service.targetPort }}
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "rustical.selectorLabels" . | nindent 4 }}

k8s/charts/rustical/values.yaml

@@ -1,44 +0,0 @@
-replicaCount: 1
-
-image:
-  repository: ghcr.io/lennart-k/rustical
-  pullpolicy: IfNotPresent
-  tag: ""
-
-imagePullSecrets: []
-podAnnotations: {}
-podSecurityContext: {}
-securityContext: {}
-
-service:
-  type: ClusterIP
-  port: 4000
-  targetPort: 4000
-
-ingress:
-  enabled: false
-
-resources: {}
-
-livenessProbe: {}
-readinessProbe: {}
-
-autoscaling:
-  enabled: false
-
-nodeSelector: {}
-tolerations: []
-affinity: {}
-
-rustical: {}
-
-secret:
-  enabled: false
-  existingSecretName: ""
-  data: {}
-
-persistence:
-  enabled: true
-  existingClaim: ""
-  size: "1Gi"
-  mountPath: /var/lib/rustical/

k8s/services/kube-system/kustomization.yaml

@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - patch-coredns.yaml

k8s/services/kube-system/patch-coredns.yaml

@@ -0,0 +1,16 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coredns
+  namespace: kube-system
+spec:
+  template:
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/control-plane
+                    operator: Exists

k8s/services/renovate/sealedsecrets.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: secrets-renovate
-  namespace: apps-fuku
-spec:
-  encryptedData:
-    GITHUB_COM_TOKEN: AgBrTRHbZ+UIFLyQRerBX4jRvJXkpelshOvNV5NsMZdYLcwFI0xnyEqRYHeTy1zoxTFSHdZZuoaU5pWfpN+5Rhs1ETzSy/u/uPdSYwAJcQvKGqYoVza5rRFVpefsXfJPVmmxmdJnckUm447q4+MRqwoDGCxInI20wAQal0K0wjoQWcfI1xKKZJX7XwqiEoscc5lVO0zjFFz291Wqb2ThSusKRcFz9M7M+eDj/jGJjMb5/Eynwmb8UGdfeT4f4T2HyKzLwj1MPPDTHe4CCBncITisvWKoDyYwc4bVx9rSgpv7pteqdTDL5EL83MK97QWqLxn/4et6K7piSBOd8NkqzA9i3rOoa0PnCP+PUmeQVNZc+2bYWP/a+o0AFH+NB0thc7rqT5JIB7NADx4SwP2Y5GgxsLCwpxke32Gf23rx21fCeZCOx+4jwOl0B5sPdn8p7tTCYfI+MrHC4mCZn7eXl4VTOhPTp/283p6Z5+l1rR3WPw7fbIlqyRk7NwV8PojltgBctjVqPtU6XvmpN+YCR30wUUcV+hf7/U3fsT10K6zsZNyyfttpDQ7gmaGa4/wlWcTwW6ZvSfvC22MysF08h1bxQWFj5nuNc5qseMkZx6y8GK0rNUliUN46x3jBKFchnrRU0V/UeASs5UQjMVwiZI6Re20sW+JviSMMXKVRZHNJf9bASv5u7X0GHaAVdQx3Ux4+H9cSiNpjNtZP4KV4RVUrjMlg3a18zGfmJKIm8vFL3uzAEX60Quzr  # yamllint disable rule:line-length
-    RENOVATE_TOKEN: AgAtqjXkearrQYghZxnJVouwlbuy5oZu26/O5+7mF4qyewVmQEocCJL8ucvzhB2ZKn1sBcn2q1WvXxDwXeSXBAhbClMsLToV2+F7cRajormuI7I2nfHvV/Rl3lYxBUnoZEQY4XaccBv5z4XRUtoa8kSZIrj4oVJiS0RUNCCp8+fuLxTOCAEfmxUgBCwiO9DfZafuCMM1fFVqW2im9xJtLyeLEKZO+27Jjcp3PwnOWU85gQPcAhbkbmYWT8vT46dI8KpsWU0O8wUAJJQyXdo8c3C9ioJWRkQQWrOLfuuh8XSoBJyCpsqCSCPckum2zF1ktmSa2Lzda7+Lmyv6tTF4cybg1RUOLNFViFGwoInEl8/wIbrOfCt9TvY53lBldeBgWlGW47E4Ol6x4qesfZgcMTaBB5K8BrQyO4hAIr8p/CHjgNHMLdbKOdeLw2MZxH7xKOj0+DAFxrDUGRzHi5fB8A6HgG0oxH2kMgKAl+7anF2acSUND5ST3IRvRqQR8WWf5wRTYG0AfDTD7EWXJIi7q5df4+UoqgmxFRlexul6MKBbJW7qs/ZTECbtpf6zJrCDDgTaimk+PGYErVcaW/3ICKyvWP8pjxvnwMAlpxnOJ5rQKWWvu6ONsxgMX0K1z/82XASZ1ExPwKV+Hc4+RKSPGtMsU9xQ2Mbt9CU0UT9WeXYBzAUtu2lgtlPj9pTmiLJWXdOQB7ztLYAqrg68Wk4H0T6Bj6qOyo3lX1BylrGmHrrdOuCzg4NwoQ8C  # yamllint disable rule:line-length
-  template:
-    metadata:
-      creationTimestamp: null
-      name: secrets-renovate
-      namespace: apps-fuku