catalin/fukuops
1
0
Fork 1
Code Issues 9 Pull requests Projects 2 Releases Packages 10 Activity

feat: add patch for coredns

Browse source
This commit is contained in:
cătălin 2026-08-07 10:57:57 +02:00
commit e518ac744d
No known key found for this signature in database
16 changed files with 48 additions and 382 deletions
Download patch file Download diff file Expand all files Collapse all files

7
k8s/argo-apps/dcsi.yaml
View file

@ -19,16 +19,19 @@ spec:
node:
driver:
image:
tag: "next@sha256:6b758d6faf96f0e96d4b8ac0e240fc290c7bace23c20d78a3eb93781652cb1f1"
tag: next
pullPolicy: Always
controller:
driver:
image:
tag: "next@sha256:6b758d6faf96f0e96d4b8ac0e240fc290c7bace23c20d78a3eb93781652cb1f1"
tag: next
pullPolicy: Always
csiDriver:
name: org.dcsi.nfs
driver:
image:
tag: next
pullPolicy: Always
existingConfigSecret: secrets-dcsi
config:
driver: freenas-api-nfs

18
k8s/argo-apps/kube-system.yaml Normal file
View file

@ -0,0 +1,18 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: kube-system
namespace: argo-cd
spec:
destination:
name: ''
namespace: kube-system
server: https://kubernetes.default.svc
sources:
- repoURL: https://git.roboces.dev/catalin/fukuops.git
path: k8s/services/kube-system
targetRevision: main
project: management
syncPolicy:
automated: {}

5
k8s/argo-apps/renovate.yaml
View file

@ -37,10 +37,7 @@ spec:
"fileMatch": ["k8s/services/.+\\.yaml$"]
}
}
existingSecret: secrets-renovate
existingSecret: renovate
- repoURL: https://git.roboces.dev/catalin/fukuops.git
path: k8s/services/renovate
targetRevision: main
syncPolicy:
automated: {}

78
k8s/argo-apps/rustical.yaml
View file

@ -1,78 +0,0 @@
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: rustical
namespace: argo-cd
spec:
destination:
name: ''
namespace: apps-roboces
server: https://kubernetes.default.svc
sources:
- repoURL: git.roboces.dev/catalin/fukuops
chart: rustical
targetRevision: 0.1.2
helm:
valuesObject:
replicaCount: 1
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsUser: 10000
runAsGroup: 10000
capabilities:
drop:
- all
service:
type: LoadBalancer
port: 8001
ingress:
enabled: true
className: "traefik"
hosts:
- host: cal.roboces.dev
paths:
- path: /
pathType: Prefix
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 256Mi
livenessProbe:
tcpSocket:
port: 4000
initialDelaySeconds: 10
timeoutSeconds: 15
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
readinessProbe:
tcpSocket:
port: 4000
initialDelaySeconds: 5
timeoutSeconds: 2
successThreshold: 1
failureThreshold: 3
periodSeconds: 10
persistence:
enabled: true
rustical:
oidc:
name: "Authentik"
issuer: "https://auth.fukurokuju.dev/application/o/rustical/"
claim_userid: "preffered_username"
scopes: '["openid", "profile", "groups"]'
allow_sign_up: "true"
frontend:
allow_password_login: "false"
secret:
existingSecretName: rustical
project: roboces
syncPolicy:
automated:
prune: true
selfHeal: true

8
k8s/charts/rustical/Chart.yaml
View file

@ -1,8 +0,0 @@
apiVersion: v2
name: rustical
description: A Helm chart for Rustical
type: application
version: 0.1.2
appVersion: 0.14.1
annotations:
artifacthub.io/images: "- name: rustical\n image: ghcr.io/lennart-k/rustical:0.14.1\n"

3
k8s/charts/rustical/README.md
View file

@ -1,3 +0,0 @@
# Rustical
A Helm chart for [Rustical](https://github.com/lennart-k/rustical), an LDAP address book application.

49
k8s/charts/rustical/templates/_helpers.tpl
View file

@ -1,49 +0,0 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "rustical.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "rustical.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "rustical.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "rustical.labels" -}}
helm.sh/chart: {{ include "rustical.chart" . }}
{{ include "rustical.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "rustical.selectorLabels" -}}
app.kubernetes.io/name: {{ include "rustical.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}

97
k8s/charts/rustical/templates/deployment.yaml
View file

@ -1,97 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "rustical.selectorLabels" . | nindent 6 }}
strategy:
rollingUpdate:
maxSurge: 50%
maxUnavailable: 50%
type: RollingUpdate
template:
metadata:
{{- with .Values.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "rustical.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullpolicy }}
{{- if or .Values.secret.existingSecretName .Values.secret.enabled }}
envFrom:
- secretRef:
name: {{ .Values.secret.existingSecretName | default (include "rustical.fullname" .) }}
{{- end }}
env:
{{- range $key, $value := .Values.env }}
- name: {{ $key }}
value: {{ $value | quote }}
{{- end }}
{{- range $section, $items := .Values.rustical }}
{{- range $key, $value := $items }}
{{- if not (eq $value nil) }}
- name: {{ printf "RUSTICAL_%s__%s" (upper $section) (upper $key) }}
value: {{ $value | quote }}
{{- end }}
{{- end }}
{{- end }}
ports:
- name: http
containerPort: 4000
protocol: TCP
{{- if .Values.persistence.enabled }}
volumeMounts:
- name: data
mountPath: {{ .Values.persistence.mountPath }}
{{- end }}
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- if .Values.persistence.enabled }}
volumes:
- name: data
{{- if .Values.persistence.existingClaim }}
persistentVolumeClaim:
claimName: {{ .Values.persistence.existingClaim }}
{{- else }}
persistentVolumeClaim:
claimName: {{ include "rustical.fullname" . }}-pvc
{{- end }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 8 }}
{{- end }}
restartPolicy: Always
automountServiceAccountToken: false

39
k8s/charts/rustical/templates/ingress.yaml
View file

@ -1,39 +0,0 @@
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
ingressClassName: {{ .Values.ingress.className }}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
pathType: {{ .pathType }}
backend:
service:
name: {{ include "rustical.fullname" $ }}
port:
number: {{ $.Values.service.port }}
{{- end }}
{{- end }}
{{- end }}

14
k8s/charts/rustical/templates/pvc.yaml
View file

@ -1,14 +0,0 @@
{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: {{ include "rustical.fullname" . }}-pvc
labels:
{{- include "rustical.labels" . | nindent 4 }}
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: {{ .Values.persistence.size }}
{{- end }}

13
k8s/charts/rustical/templates/secret.yaml
View file

@ -1,13 +0,0 @@
{{- if and .Values.secret.enabled (not .Values.secret.existingSecretName) -}}
apiVersion: v1
kind: Secret
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
type: Opaque
stringData:
{{- range $key, $value := .Values.secret.data }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}

15
k8s/charts/rustical/templates/service.yaml
View file

@ -1,15 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "rustical.fullname" . }}
labels:
{{- include "rustical.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: {{ .Values.service.targetPort }}
protocol: TCP
name: http
selector:
{{- include "rustical.selectorLabels" . | nindent 4 }}

44
k8s/charts/rustical/values.yaml
View file

@ -1,44 +0,0 @@
replicaCount: 1
image:
repository: ghcr.io/lennart-k/rustical
pullpolicy: IfNotPresent
tag: ""
imagePullSecrets: []
podAnnotations: {}
podSecurityContext: {}
securityContext: {}
service:
type: ClusterIP
port: 4000
targetPort: 4000
ingress:
enabled: false
resources: {}
livenessProbe: {}
readinessProbe: {}
autoscaling:
enabled: false
nodeSelector: {}
tolerations: []
affinity: {}
rustical: {}
secret:
enabled: false
existingSecretName: ""
data: {}
persistence:
enabled: true
existingClaim: ""
size: "1Gi"
mountPath: /var/lib/rustical/

5
k8s/services/kube-system/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
---
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- patch-coredns.yaml

19
k8s/services/kube-system/patch-coredns.yaml Normal file
View file

@ -0,0 +1,19 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: coredns
namespace: kube-system
spec:
template:
spec:
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: node-role.kubernetes.io/control-plane
operator: Exists
- matchExpressions:
- key: node.kubernetes.io/labels/master
operator: Exists

16
k8s/services/renovate/sealedsecrets.yaml
View file

@ -1,16 +0,0 @@
---
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: secrets-renovate
namespace: apps-fuku
spec:
encryptedData:
GITHUB_COM_TOKEN: AgBrTRHbZ+UIFLyQRerBX4jRvJXkpelshOvNV5NsMZdYLcwFI0xnyEqRYHeTy1zoxTFSHdZZuoaU5pWfpN+5Rhs1ETzSy/u/uPdSYwAJcQvKGqYoVza5rRFVpefsXfJPVmmxmdJnckUm447q4+MRqwoDGCxInI20wAQal0K0wjoQWcfI1xKKZJX7XwqiEoscc5lVO0zjFFz291Wqb2ThSusKRcFz9M7M+eDj/jGJjMb5/Eynwmb8UGdfeT4f4T2HyKzLwj1MPPDTHe4CCBncITisvWKoDyYwc4bVx9rSgpv7pteqdTDL5EL83MK97QWqLxn/4et6K7piSBOd8NkqzA9i3rOoa0PnCP+PUmeQVNZc+2bYWP/a+o0AFH+NB0thc7rqT5JIB7NADx4SwP2Y5GgxsLCwpxke32Gf23rx21fCeZCOx+4jwOl0B5sPdn8p7tTCYfI+MrHC4mCZn7eXl4VTOhPTp/283p6Z5+l1rR3WPw7fbIlqyRk7NwV8PojltgBctjVqPtU6XvmpN+YCR30wUUcV+hf7/U3fsT10K6zsZNyyfttpDQ7gmaGa4/wlWcTwW6ZvSfvC22MysF08h1bxQWFj5nuNc5qseMkZx6y8GK0rNUliUN46x3jBKFchnrRU0V/UeASs5UQjMVwiZI6Re20sW+JviSMMXKVRZHNJf9bASv5u7X0GHaAVdQx3Ux4+H9cSiNpjNtZP4KV4RVUrjMlg3a18zGfmJKIm8vFL3uzAEX60Quzr # yamllint disable rule:line-length
RENOVATE_TOKEN: AgAtqjXkearrQYghZxnJVouwlbuy5oZu26/O5+7mF4qyewVmQEocCJL8ucvzhB2ZKn1sBcn2q1WvXxDwXeSXBAhbClMsLToV2+F7cRajormuI7I2nfHvV/Rl3lYxBUnoZEQY4XaccBv5z4XRUtoa8kSZIrj4oVJiS0RUNCCp8+fuLxTOCAEfmxUgBCwiO9DfZafuCMM1fFVqW2im9xJtLyeLEKZO+27Jjcp3PwnOWU85gQPcAhbkbmYWT8vT46dI8KpsWU0O8wUAJJQyXdo8c3C9ioJWRkQQWrOLfuuh8XSoBJyCpsqCSCPckum2zF1ktmSa2Lzda7+Lmyv6tTF4cybg1RUOLNFViFGwoInEl8/wIbrOfCt9TvY53lBldeBgWlGW47E4Ol6x4qesfZgcMTaBB5K8BrQyO4hAIr8p/CHjgNHMLdbKOdeLw2MZxH7xKOj0+DAFxrDUGRzHi5fB8A6HgG0oxH2kMgKAl+7anF2acSUND5ST3IRvRqQR8WWf5wRTYG0AfDTD7EWXJIi7q5df4+UoqgmxFRlexul6MKBbJW7qs/ZTECbtpf6zJrCDDgTaimk+PGYErVcaW/3ICKyvWP8pjxvnwMAlpxnOJ5rQKWWvu6ONsxgMX0K1z/82XASZ1ExPwKV+Hc4+RKSPGtMsU9xQ2Mbt9CU0UT9WeXYBzAUtu2lgtlPj9pTmiLJWXdOQB7ztLYAqrg68Wk4H0T6Bj6qOyo3lX1BylrGmHrrdOuCzg4NwoQ8C # yamllint disable rule:line-length
template:
metadata:
creationTimestamp: null
name: secrets-renovate
namespace: apps-fuku