From e518ac744d1909a741138b3f0dc4478d123d0024 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?c=C4=83t=C4=83lin?= Date: Fri, 7 Aug 2026 10:57:57 +0200 Subject: [PATCH] feat: add patch for coredns --- k8s/argo-apps/dcsi.yaml | 7 +- k8s/argo-apps/kube-system.yaml | 18 ++++ k8s/argo-apps/renovate.yaml | 5 +- k8s/argo-apps/rustical.yaml | 78 --------------- k8s/charts/rustical/Chart.yaml | 8 -- k8s/charts/rustical/README.md | 3 - k8s/charts/rustical/templates/_helpers.tpl | 49 ---------- k8s/charts/rustical/templates/deployment.yaml | 97 ------------------- k8s/charts/rustical/templates/ingress.yaml | 39 -------- k8s/charts/rustical/templates/pvc.yaml | 14 --- k8s/charts/rustical/templates/secret.yaml | 13 --- k8s/charts/rustical/templates/service.yaml | 15 --- k8s/charts/rustical/values.yaml | 44 --------- k8s/services/kube-system/kustomization.yaml | 5 + k8s/services/kube-system/patch-coredns.yaml | 19 ++++ k8s/services/renovate/sealedsecrets.yaml | 16 --- 16 files changed, 48 insertions(+), 382 deletions(-) create mode 100644 k8s/argo-apps/kube-system.yaml delete mode 100644 k8s/argo-apps/rustical.yaml delete mode 100644 k8s/charts/rustical/Chart.yaml delete mode 100644 k8s/charts/rustical/README.md delete mode 100644 k8s/charts/rustical/templates/_helpers.tpl delete mode 100644 k8s/charts/rustical/templates/deployment.yaml delete mode 100644 k8s/charts/rustical/templates/ingress.yaml delete mode 100644 k8s/charts/rustical/templates/pvc.yaml delete mode 100644 k8s/charts/rustical/templates/secret.yaml delete mode 100644 k8s/charts/rustical/templates/service.yaml delete mode 100644 k8s/charts/rustical/values.yaml create mode 100644 k8s/services/kube-system/kustomization.yaml create mode 100644 k8s/services/kube-system/patch-coredns.yaml delete mode 100644 k8s/services/renovate/sealedsecrets.yaml diff --git a/k8s/argo-apps/dcsi.yaml b/k8s/argo-apps/dcsi.yaml index b67c794..c7130eb 100644 --- a/k8s/argo-apps/dcsi.yaml +++ b/k8s/argo-apps/dcsi.yaml @@ -19,16 +19,19 @@ spec: node: driver: image: - tag: "next@sha256:6b758d6faf96f0e96d4b8ac0e240fc290c7bace23c20d78a3eb93781652cb1f1" + tag: next + pullPolicy: Always controller: driver: image: - tag: "next@sha256:6b758d6faf96f0e96d4b8ac0e240fc290c7bace23c20d78a3eb93781652cb1f1" + tag: next + pullPolicy: Always csiDriver: name: org.dcsi.nfs driver: image: tag: next + pullPolicy: Always existingConfigSecret: secrets-dcsi config: driver: freenas-api-nfs diff --git a/k8s/argo-apps/kube-system.yaml b/k8s/argo-apps/kube-system.yaml new file mode 100644 index 0000000..e18ee81 --- /dev/null +++ b/k8s/argo-apps/kube-system.yaml @@ -0,0 +1,18 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: kube-system + namespace: argo-cd +spec: + destination: + name: '' + namespace: kube-system + server: https://kubernetes.default.svc + sources: + - repoURL: https://git.roboces.dev/catalin/fukuops.git + path: k8s/services/kube-system + targetRevision: main + project: management + syncPolicy: + automated: {} diff --git a/k8s/argo-apps/renovate.yaml b/k8s/argo-apps/renovate.yaml index 967ef52..081f5be 100644 --- a/k8s/argo-apps/renovate.yaml +++ b/k8s/argo-apps/renovate.yaml @@ -37,10 +37,7 @@ spec: "fileMatch": ["k8s/services/.+\\.yaml$"] } } - existingSecret: secrets-renovate + existingSecret: renovate - - repoURL: https://git.roboces.dev/catalin/fukuops.git - path: k8s/services/renovate - targetRevision: main syncPolicy: automated: {} diff --git a/k8s/argo-apps/rustical.yaml b/k8s/argo-apps/rustical.yaml deleted file mode 100644 index d03ba02..0000000 --- a/k8s/argo-apps/rustical.yaml +++ /dev/null @@ -1,78 +0,0 @@ ---- -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: rustical - namespace: argo-cd -spec: - destination: - name: '' - namespace: apps-roboces - server: https://kubernetes.default.svc - sources: - - repoURL: git.roboces.dev/catalin/fukuops - chart: rustical - targetRevision: 0.1.2 - helm: - valuesObject: - replicaCount: 1 - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - runAsUser: 10000 - runAsGroup: 10000 - capabilities: - drop: - - all - service: - type: LoadBalancer - port: 8001 - ingress: - enabled: true - className: "traefik" - hosts: - - host: cal.roboces.dev - paths: - - path: / - pathType: Prefix - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 500m - memory: 256Mi - livenessProbe: - tcpSocket: - port: 4000 - initialDelaySeconds: 10 - timeoutSeconds: 15 - successThreshold: 1 - failureThreshold: 3 - periodSeconds: 10 - readinessProbe: - tcpSocket: - port: 4000 - initialDelaySeconds: 5 - timeoutSeconds: 2 - successThreshold: 1 - failureThreshold: 3 - periodSeconds: 10 - persistence: - enabled: true - rustical: - oidc: - name: "Authentik" - issuer: "https://auth.fukurokuju.dev/application/o/rustical/" - claim_userid: "preffered_username" - scopes: '["openid", "profile", "groups"]' - allow_sign_up: "true" - frontend: - allow_password_login: "false" - secret: - existingSecretName: rustical - project: roboces - syncPolicy: - automated: - prune: true - selfHeal: true diff --git a/k8s/charts/rustical/Chart.yaml b/k8s/charts/rustical/Chart.yaml deleted file mode 100644 index fcc5b1c..0000000 --- a/k8s/charts/rustical/Chart.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v2 -name: rustical -description: A Helm chart for Rustical -type: application -version: 0.1.2 -appVersion: 0.14.1 -annotations: - artifacthub.io/images: "- name: rustical\n image: ghcr.io/lennart-k/rustical:0.14.1\n" diff --git a/k8s/charts/rustical/README.md b/k8s/charts/rustical/README.md deleted file mode 100644 index 1b22d4f..0000000 --- a/k8s/charts/rustical/README.md +++ /dev/null @@ -1,3 +0,0 @@ -# Rustical - -A Helm chart for [Rustical](https://github.com/lennart-k/rustical), an LDAP address book application. diff --git a/k8s/charts/rustical/templates/_helpers.tpl b/k8s/charts/rustical/templates/_helpers.tpl deleted file mode 100644 index ea556e4..0000000 --- a/k8s/charts/rustical/templates/_helpers.tpl +++ /dev/null @@ -1,49 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "rustical.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -*/}} -{{- define "rustical.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "rustical.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "rustical.labels" -}} -helm.sh/chart: {{ include "rustical.chart" . }} -{{ include "rustical.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "rustical.selectorLabels" -}} -app.kubernetes.io/name: {{ include "rustical.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} diff --git a/k8s/charts/rustical/templates/deployment.yaml b/k8s/charts/rustical/templates/deployment.yaml deleted file mode 100644 index 8cb8860..0000000 --- a/k8s/charts/rustical/templates/deployment.yaml +++ /dev/null @@ -1,97 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "rustical.fullname" . }} - labels: - {{- include "rustical.labels" . | nindent 4 }} -spec: - {{- if not .Values.autoscaling.enabled }} - replicas: {{ .Values.replicaCount }} - {{- end }} - selector: - matchLabels: - {{- include "rustical.selectorLabels" . | nindent 6 }} - strategy: - rollingUpdate: - maxSurge: 50% - maxUnavailable: 50% - type: RollingUpdate - template: - metadata: - {{- with .Values.podAnnotations }} - annotations: - {{- toYaml . | nindent 8 }} - {{- end }} - labels: - {{- include "rustical.selectorLabels" . | nindent 8 }} - spec: - {{- with .Values.imagePullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - containers: - - name: {{ .Chart.Name }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" - imagePullPolicy: {{ .Values.image.pullpolicy }} - {{- if or .Values.secret.existingSecretName .Values.secret.enabled }} - envFrom: - - secretRef: - name: {{ .Values.secret.existingSecretName | default (include "rustical.fullname" .) }} - {{- end }} - env: - {{- range $key, $value := .Values.env }} - - name: {{ $key }} - value: {{ $value | quote }} - {{- end }} - {{- range $section, $items := .Values.rustical }} - {{- range $key, $value := $items }} - {{- if not (eq $value nil) }} - - name: {{ printf "RUSTICAL_%s__%s" (upper $section) (upper $key) }} - value: {{ $value | quote }} - {{- end }} - {{- end }} - {{- end }} - ports: - - name: http - containerPort: 4000 - protocol: TCP - {{- if .Values.persistence.enabled }} - volumeMounts: - - name: data - mountPath: {{ .Values.persistence.mountPath }} - {{- end }} - livenessProbe: - {{- toYaml .Values.livenessProbe | nindent 12 }} - readinessProbe: - {{- toYaml .Values.readinessProbe | nindent 12 }} - resources: - {{- toYaml .Values.resources | nindent 12 }} - {{- if .Values.persistence.enabled }} - volumes: - - name: data - {{- if .Values.persistence.existingClaim }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim }} - {{- else }} - persistentVolumeClaim: - claimName: {{ include "rustical.fullname" . }}-pvc - {{- end }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: - {{- toYaml . | nindent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: - {{- toYaml . | nindent 8 }} - {{- end }} - restartPolicy: Always - automountServiceAccountToken: false diff --git a/k8s/charts/rustical/templates/ingress.yaml b/k8s/charts/rustical/templates/ingress.yaml deleted file mode 100644 index 2af349b..0000000 --- a/k8s/charts/rustical/templates/ingress.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if .Values.ingress.enabled }} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ include "rustical.fullname" . }} - labels: - {{- include "rustical.labels" . | nindent 4 }} - {{- with .Values.ingress.annotations }} - annotations: - {{- toYaml . | nindent 4 }} - {{- end }} -spec: - ingressClassName: {{ .Values.ingress.className }} - {{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} - {{- end }} - rules: - {{- range .Values.ingress.hosts }} - - host: {{ .host | quote }} - http: - paths: - {{- range .paths }} - - path: {{ .path }} - pathType: {{ .pathType }} - backend: - service: - name: {{ include "rustical.fullname" $ }} - port: - number: {{ $.Values.service.port }} - {{- end }} - {{- end }} -{{- end }} diff --git a/k8s/charts/rustical/templates/pvc.yaml b/k8s/charts/rustical/templates/pvc.yaml deleted file mode 100644 index 69ed239..0000000 --- a/k8s/charts/rustical/templates/pvc.yaml +++ /dev/null @@ -1,14 +0,0 @@ -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ include "rustical.fullname" . }}-pvc - labels: - {{- include "rustical.labels" . | nindent 4 }} -spec: - accessModes: - - ReadWriteMany - resources: - requests: - storage: {{ .Values.persistence.size }} -{{- end }} diff --git a/k8s/charts/rustical/templates/secret.yaml b/k8s/charts/rustical/templates/secret.yaml deleted file mode 100644 index c6d6f4f..0000000 --- a/k8s/charts/rustical/templates/secret.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if and .Values.secret.enabled (not .Values.secret.existingSecretName) -}} -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "rustical.fullname" . }} - labels: - {{- include "rustical.labels" . | nindent 4 }} -type: Opaque -stringData: - {{- range $key, $value := .Values.secret.data }} - {{ $key }}: {{ $value | quote }} - {{- end }} -{{- end }} diff --git a/k8s/charts/rustical/templates/service.yaml b/k8s/charts/rustical/templates/service.yaml deleted file mode 100644 index 12b588c..0000000 --- a/k8s/charts/rustical/templates/service.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ include "rustical.fullname" . }} - labels: - {{- include "rustical.labels" . | nindent 4 }} -spec: - type: {{ .Values.service.type }} - ports: - - port: {{ .Values.service.port }} - targetPort: {{ .Values.service.targetPort }} - protocol: TCP - name: http - selector: - {{- include "rustical.selectorLabels" . | nindent 4 }} diff --git a/k8s/charts/rustical/values.yaml b/k8s/charts/rustical/values.yaml deleted file mode 100644 index eaea922..0000000 --- a/k8s/charts/rustical/values.yaml +++ /dev/null @@ -1,44 +0,0 @@ -replicaCount: 1 - -image: - repository: ghcr.io/lennart-k/rustical - pullpolicy: IfNotPresent - tag: "" - -imagePullSecrets: [] -podAnnotations: {} -podSecurityContext: {} -securityContext: {} - -service: - type: ClusterIP - port: 4000 - targetPort: 4000 - -ingress: - enabled: false - -resources: {} - -livenessProbe: {} -readinessProbe: {} - -autoscaling: - enabled: false - -nodeSelector: {} -tolerations: [] -affinity: {} - -rustical: {} - -secret: - enabled: false - existingSecretName: "" - data: {} - -persistence: - enabled: true - existingClaim: "" - size: "1Gi" - mountPath: /var/lib/rustical/ diff --git a/k8s/services/kube-system/kustomization.yaml b/k8s/services/kube-system/kustomization.yaml new file mode 100644 index 0000000..1a222eb --- /dev/null +++ b/k8s/services/kube-system/kustomization.yaml @@ -0,0 +1,5 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - patch-coredns.yaml diff --git a/k8s/services/kube-system/patch-coredns.yaml b/k8s/services/kube-system/patch-coredns.yaml new file mode 100644 index 0000000..d520eff --- /dev/null +++ b/k8s/services/kube-system/patch-coredns.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: coredns + namespace: kube-system +spec: + template: + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: node-role.kubernetes.io/control-plane + operator: Exists + - matchExpressions: + - key: node.kubernetes.io/labels/master + operator: Exists diff --git a/k8s/services/renovate/sealedsecrets.yaml b/k8s/services/renovate/sealedsecrets.yaml deleted file mode 100644 index b703d36..0000000 --- a/k8s/services/renovate/sealedsecrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ ---- -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - creationTimestamp: null - name: secrets-renovate - namespace: apps-fuku -spec: - encryptedData: - GITHUB_COM_TOKEN: AgBrTRHbZ+UIFLyQRerBX4jRvJXkpelshOvNV5NsMZdYLcwFI0xnyEqRYHeTy1zoxTFSHdZZuoaU5pWfpN+5Rhs1ETzSy/u/uPdSYwAJcQvKGqYoVza5rRFVpefsXfJPVmmxmdJnckUm447q4+MRqwoDGCxInI20wAQal0K0wjoQWcfI1xKKZJX7XwqiEoscc5lVO0zjFFz291Wqb2ThSusKRcFz9M7M+eDj/jGJjMb5/Eynwmb8UGdfeT4f4T2HyKzLwj1MPPDTHe4CCBncITisvWKoDyYwc4bVx9rSgpv7pteqdTDL5EL83MK97QWqLxn/4et6K7piSBOd8NkqzA9i3rOoa0PnCP+PUmeQVNZc+2bYWP/a+o0AFH+NB0thc7rqT5JIB7NADx4SwP2Y5GgxsLCwpxke32Gf23rx21fCeZCOx+4jwOl0B5sPdn8p7tTCYfI+MrHC4mCZn7eXl4VTOhPTp/283p6Z5+l1rR3WPw7fbIlqyRk7NwV8PojltgBctjVqPtU6XvmpN+YCR30wUUcV+hf7/U3fsT10K6zsZNyyfttpDQ7gmaGa4/wlWcTwW6ZvSfvC22MysF08h1bxQWFj5nuNc5qseMkZx6y8GK0rNUliUN46x3jBKFchnrRU0V/UeASs5UQjMVwiZI6Re20sW+JviSMMXKVRZHNJf9bASv5u7X0GHaAVdQx3Ux4+H9cSiNpjNtZP4KV4RVUrjMlg3a18zGfmJKIm8vFL3uzAEX60Quzr # yamllint disable rule:line-length - RENOVATE_TOKEN: AgAtqjXkearrQYghZxnJVouwlbuy5oZu26/O5+7mF4qyewVmQEocCJL8ucvzhB2ZKn1sBcn2q1WvXxDwXeSXBAhbClMsLToV2+F7cRajormuI7I2nfHvV/Rl3lYxBUnoZEQY4XaccBv5z4XRUtoa8kSZIrj4oVJiS0RUNCCp8+fuLxTOCAEfmxUgBCwiO9DfZafuCMM1fFVqW2im9xJtLyeLEKZO+27Jjcp3PwnOWU85gQPcAhbkbmYWT8vT46dI8KpsWU0O8wUAJJQyXdo8c3C9ioJWRkQQWrOLfuuh8XSoBJyCpsqCSCPckum2zF1ktmSa2Lzda7+Lmyv6tTF4cybg1RUOLNFViFGwoInEl8/wIbrOfCt9TvY53lBldeBgWlGW47E4Ol6x4qesfZgcMTaBB5K8BrQyO4hAIr8p/CHjgNHMLdbKOdeLw2MZxH7xKOj0+DAFxrDUGRzHi5fB8A6HgG0oxH2kMgKAl+7anF2acSUND5ST3IRvRqQR8WWf5wRTYG0AfDTD7EWXJIi7q5df4+UoqgmxFRlexul6MKBbJW7qs/ZTECbtpf6zJrCDDgTaimk+PGYErVcaW/3ICKyvWP8pjxvnwMAlpxnOJ5rQKWWvu6ONsxgMX0K1z/82XASZ1ExPwKV+Hc4+RKSPGtMsU9xQ2Mbt9CU0UT9WeXYBzAUtu2lgtlPj9pTmiLJWXdOQB7ztLYAqrg68Wk4H0T6Bj6qOyo3lX1BylrGmHrrdOuCzg4NwoQ8C # yamllint disable rule:line-length - template: - metadata: - creationTimestamp: null - name: secrets-renovate - namespace: apps-fuku