Merge branch 'mrtz/old-helm' into 'main'
chore: Checkout of previous helm config for atlantis, openfga and rabbitmq See merge request oceanbox/manifests!11
This commit was merged in pull request #25.
This commit is contained in:
@@ -0,0 +1,331 @@
|
||||
[
|
||||
{
|
||||
"domain": "oceanbox.io",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@oceanbox.io",
|
||||
"group": "/oceanbox",
|
||||
"roles": [ "admin" ],
|
||||
"capabilities": [
|
||||
"run:*"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "salmar.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@salmar.no",
|
||||
"group": "/salmar",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "leroy.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": "karstein@leroy.no",
|
||||
"group": "/oceanbox",
|
||||
"roles": [ "admin" ],
|
||||
"capabilities": [ "run:*" ]
|
||||
},
|
||||
{
|
||||
"matching": ".*@leroy.no",
|
||||
"group": "/leroy",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "serit.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@tromso.serit.no",
|
||||
"group": "/oceanbox",
|
||||
"roles": [ "admin" ],
|
||||
"capabilities": []
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "aqua-kompetanse.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@aqua-kompetanse.no",
|
||||
"group": "/aqua-kompetanse",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "kelpinor.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@kelpinor.no",
|
||||
"group": "/kelpinor",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "bkmanimalhealth.com",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@bkmanimalhealth.com",
|
||||
"group": "/bkmanimalhealth",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "uio.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@geo.uio.no",
|
||||
"group": "/demo",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "nord.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@.*.nord.no",
|
||||
"group": "/uni-nord",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "argusmiljo.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@argusmiljo.no",
|
||||
"group": "/argusmiljo",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "bakkafrost.com",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@bakkafrost.com",
|
||||
"group": "/bakkafrost",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "multiconsult.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@multiconsult.no",
|
||||
"group": "/multiconsult",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "kpmg.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@kpmg.no",
|
||||
"group": "/kpmg",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "synfaring.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@synfaring.no",
|
||||
"group": "/synfaring",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "boehareide.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@boehareide.no",
|
||||
"group": "/boehareide",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "sinkaberg.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@sinkaberg.no",
|
||||
"group": "/sinkaberg",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "akerbla.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@akerbla.no",
|
||||
"group": "/akerbla",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "nr.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@nr.no",
|
||||
"group": "/nr",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "sjomatnorge.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@sjomatnorge.no",
|
||||
"group": "/sjomatnorge",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "tatidentilbake.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@tatidentilbake.no",
|
||||
"group": "/tatidentilbake",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "oceandata.earth",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@oceandata.earth",
|
||||
"group": "/hubocean",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "masoval.no",
|
||||
"access": [
|
||||
{
|
||||
"matching": ".*@masoval.no",
|
||||
"group": "/masoval",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"domain": "gmail.com",
|
||||
"access": [
|
||||
{
|
||||
"matching": "jonas.juselius@gmail.com",
|
||||
"group": "/bakkafrost",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
},
|
||||
{
|
||||
"matching": ".*@gmail.com",
|
||||
"group": "/demo",
|
||||
"roles": [ "user" ],
|
||||
"capabilities": [
|
||||
"run:transport",
|
||||
"run:sedimentation"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: defaultbackend
|
||||
spec:
|
||||
type: ExternalName
|
||||
externalName: main-ingress-nginx-defaultbackend.ingress-nginx.svc.cluster.local
|
||||
ports:
|
||||
- port: 80
|
||||
@@ -0,0 +1,9 @@
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/livenessProbe/httpGet/path
|
||||
value: /healthz
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/readinessProbe/httpGet/path
|
||||
value: /healthz
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom
|
||||
value: []
|
||||
@@ -0,0 +1,10 @@
|
||||
- op: add
|
||||
path: /spec/rules/0/http/paths/-
|
||||
value:
|
||||
path: /events
|
||||
pathType: ImplementationSpecific
|
||||
backend:
|
||||
service:
|
||||
name: defaultbackend
|
||||
port:
|
||||
number: 80
|
||||
@@ -0,0 +1,16 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
patches:
|
||||
- target:
|
||||
version: v1
|
||||
group: apps
|
||||
kind: Deployment
|
||||
path: deployment_patch.yaml
|
||||
- target:
|
||||
group: networking.k8s.io
|
||||
version: v1
|
||||
kind: Ingress
|
||||
path: ingress_patch.yaml
|
||||
resources:
|
||||
- _manifest.yaml
|
||||
- defaultbackend.yaml
|
||||
@@ -0,0 +1,7 @@
|
||||
- op: add
|
||||
path: /spec/ports/-
|
||||
value:
|
||||
name: intra
|
||||
port: 8000
|
||||
protocol: TCP
|
||||
targetPort: 8000
|
||||
Symlink
+1
@@ -0,0 +1 @@
|
||||
../../charts/atlantis
|
||||
@@ -0,0 +1,96 @@
|
||||
{
|
||||
"oidc": {
|
||||
"issuer": "https://auth.oceanbox.io/realms/oceanbox",
|
||||
"authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
|
||||
"token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
|
||||
"jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
|
||||
"userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
|
||||
"end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
|
||||
"device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
|
||||
"clientId": "atlantis",
|
||||
"clientSecret": "",
|
||||
"scopes": [
|
||||
"openid",
|
||||
"email",
|
||||
"offline_access",
|
||||
"profile"
|
||||
],
|
||||
"audiences": [
|
||||
"atlantis",
|
||||
"atlantis_dev",
|
||||
"sorcerer",
|
||||
"sorcerer_dev"
|
||||
]
|
||||
},
|
||||
"sso": {
|
||||
"cookieDomain": ".oceanbox.io",
|
||||
"cookieName": ".obx.prod",
|
||||
"ttl": 12.0,
|
||||
"signedOutRedirectUri": "https://maps.beta.oceanbox.io",
|
||||
"realm": "atlantis",
|
||||
"environment": "prod",
|
||||
"keyStore": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantis.blob.core.windows.net",
|
||||
"key": "dataprotection-keys"
|
||||
},
|
||||
"keyVault": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantisvault.vault.azure.net",
|
||||
"key": "dataencryption-keys"
|
||||
}
|
||||
},
|
||||
"fga": {
|
||||
"apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
|
||||
"apiKey": "",
|
||||
"storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
|
||||
"modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
|
||||
},
|
||||
"plainAuthUsers": [
|
||||
{
|
||||
"username": "admin",
|
||||
"password": "en-to-tre-fire",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
},
|
||||
{
|
||||
"username": "sorcerer",
|
||||
"password": "fire tre to en",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
},
|
||||
{
|
||||
"username": "archivist",
|
||||
"password": "en-to-tre-fire",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
}
|
||||
],
|
||||
"redis": "prod-atlantis-redis-master:6379",
|
||||
"objectStore": "https://atlantis.blob.core.windows.net",
|
||||
"connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
|
||||
"sorcerer" : "https://sorcerer.data.oceanbox.io",
|
||||
"allowedOrigins": [
|
||||
"https://maps.oceanbox.io",
|
||||
"https://maps.beta.oceanbox.io",
|
||||
],
|
||||
"appName": "atlantis",
|
||||
"appEnv": "prod",
|
||||
"appNamespace": "atlantis",
|
||||
"appVersion": "2.95.1",
|
||||
"otelCollector": "http://opentelemetry-collector.otel.svc:4317",
|
||||
"pubsubName": "pubsub",
|
||||
"pubsubTopic": "hipster-atlantis",
|
||||
"slurm": {
|
||||
"baseUrl": "https://hipster-slurmrestd.ekman.oceanbox.io/",
|
||||
"slurmApi": "slurm/v0.0.39/",
|
||||
"dbdApi": "slurmdbd/v0.0.39/",
|
||||
"user": "serf",
|
||||
"password": "wooqueiLee3ao0ha"
|
||||
},
|
||||
"amqp": {
|
||||
"auth": "user:hunny-bunny",
|
||||
"host": "10.255.241.201:30673"
|
||||
},
|
||||
"fenceRadius": 1250.0
|
||||
}
|
||||
@@ -0,0 +1,2 @@
|
||||
client-id=simen.kirkvik@tromso.serit.no:simkir-tilt-atlantis
|
||||
secret=d9tInZ1XpeDAxD.DySv'*SB=P
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: slurm-events
|
||||
spec:
|
||||
type: bindings.rabbitmq
|
||||
version: v1
|
||||
metadata:
|
||||
- name: host
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-rabbitmq
|
||||
key: connString
|
||||
- name: queueName
|
||||
value: prod-slurm-job-events
|
||||
- name: durable
|
||||
value: true
|
||||
- name: contentType
|
||||
value: "application/json"
|
||||
- name: route
|
||||
value: /events/slurm
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: configstore
|
||||
spec:
|
||||
type: configuration.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: prod-atlantis-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-redis
|
||||
key: redis-password
|
||||
- name: redisDB
|
||||
value: "1"
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1 @@
|
||||
OIDC_CLIENT_SECRET=KOJ6bDHzE5vdyfSrzgwLjtM5PzA809Zm
|
||||
@@ -0,0 +1,10 @@
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: azure-keyvault
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: prod-atlantis-env
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: azure-keyvault
|
||||
spec:
|
||||
type: secretstores.azure.keyvault
|
||||
version: v1
|
||||
metadata:
|
||||
- name: vaultName
|
||||
value: atlantisvault
|
||||
- name: azureTenantId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_TENANT_ID
|
||||
- name: azureClientId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_ID
|
||||
- name: azureClientSecret
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_SECRET
|
||||
@@ -0,0 +1,24 @@
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
configMapGenerator:
|
||||
- name: prod-atlantis-appsettings
|
||||
files:
|
||||
- appsettings.json
|
||||
patches:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
path: deployment_patch.yaml
|
||||
resources:
|
||||
- ../base
|
||||
- secrets.yaml
|
||||
- rbac.yaml
|
||||
- tracing.yaml
|
||||
- bindings.yaml
|
||||
- pubsub.yaml
|
||||
- statestore.yaml
|
||||
- subscriptions.yaml
|
||||
- configurations.yaml
|
||||
- secretstore.yaml
|
||||
- keyvault.yaml
|
||||
@@ -0,0 +1,52 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: pubsub
|
||||
spec:
|
||||
version: v1
|
||||
type: pubsub.rabbitmq
|
||||
metadata:
|
||||
- name: hostname
|
||||
value: prod-rabbitmq.rabbitmq
|
||||
- name: username
|
||||
value: user
|
||||
- name: password
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-rabbitmq
|
||||
key: rabbitmq-password
|
||||
- name: protocol
|
||||
value: amqp
|
||||
- name: durable
|
||||
value: true
|
||||
- name: deletedWhenUnused
|
||||
value: false
|
||||
- name: autoAck
|
||||
value: false
|
||||
- name: deliveryMode
|
||||
value: 1
|
||||
- name: requeueInFailure
|
||||
value: false
|
||||
- name: prefetchCount
|
||||
value: 0
|
||||
- name: reconnectWait
|
||||
value: 0
|
||||
- name: concurrencyMode
|
||||
value: parallel
|
||||
- name: publisherConfirm
|
||||
value: false
|
||||
- name: backOffPolicy
|
||||
value: exponential
|
||||
- name: backOffInitialInterval
|
||||
value: 100
|
||||
- name: backOffMaxRetries
|
||||
value: 16
|
||||
- name: enableDeadLetter # Optional enable dead Letter or not
|
||||
value: true
|
||||
- name: maxLen # Optional max message count in a queue
|
||||
value: 3000
|
||||
- name: maxLenBytes # Optional maximum length in bytes of a queue.
|
||||
value: 10485760
|
||||
- name: exchangeKind
|
||||
value: fanout
|
||||
- name: clientName
|
||||
value: "{appID}"
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: prod-atlantis
|
||||
namespace: prod-atlantis
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- prod-atlantis-appsettings
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- azure-keyvault
|
||||
- prod-atlantis-redis
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: prod-atlantis
|
||||
namespace: prod-atlantis
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: prod-atlantis
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: prod-atlantis
|
||||
namespace: prod-atlantis
|
||||
@@ -0,0 +1,23 @@
|
||||
architecture: replication
|
||||
|
||||
replica:
|
||||
replicaCount: 2
|
||||
|
||||
auth:
|
||||
enabled: true
|
||||
sentinel: true
|
||||
password: ""
|
||||
usePasswordFiles: false
|
||||
existingSecretPasswordKey: ""
|
||||
existingSecret: prod-atlantis-redis
|
||||
|
||||
master:
|
||||
resources:
|
||||
limits:
|
||||
ephemeral-storage: 1024Mi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
kyverno/clone: "true"
|
||||
kyverno/env: "prod"
|
||||
name: prod-atlantis-rabbitmq
|
||||
type: Opaque
|
||||
data:
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: secretstore
|
||||
spec:
|
||||
type: secretstores.kubernetes
|
||||
version: v1
|
||||
metadata:
|
||||
- name: defaultNamespace
|
||||
value: prod-atlantis
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: statestore
|
||||
spec:
|
||||
type: state.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: prod-atlantis-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-redis
|
||||
key: redis-password
|
||||
- name: actorStateStore
|
||||
value: "true"
|
||||
- name: redisDB
|
||||
value: "0"
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: dapr.io/v2alpha1
|
||||
kind: Subscription
|
||||
metadata:
|
||||
name: hipster-events
|
||||
spec:
|
||||
topic: hipster
|
||||
routes:
|
||||
default: /events/hipster
|
||||
pubsubname: pubsub
|
||||
metadata:
|
||||
queueType: quorum
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
---
|
||||
apiVersion: dapr.io/v2alpha1
|
||||
kind: Subscription
|
||||
metadata:
|
||||
name: inbox-events
|
||||
spec:
|
||||
topic: inbox
|
||||
routes:
|
||||
default: /events/inbox
|
||||
pubsubname: pubsub
|
||||
metadata:
|
||||
queueType: quorum
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: tracing
|
||||
spec:
|
||||
tracing:
|
||||
samplingRate: "1"
|
||||
otel:
|
||||
endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
|
||||
protocol: grpc
|
||||
isSecure: false
|
||||
@@ -0,0 +1,97 @@
|
||||
{
|
||||
"oidc": {
|
||||
"issuer": "https://auth.oceanbox.io/realms/oceanbox",
|
||||
"authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
|
||||
"token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
|
||||
"jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
|
||||
"userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
|
||||
"end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
|
||||
"device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
|
||||
"clientId": "atlantis_dev",
|
||||
"clientSecret": "",
|
||||
"scopes": [
|
||||
"openid",
|
||||
"email",
|
||||
"offline_access",
|
||||
"profile"
|
||||
],
|
||||
"audiences": [
|
||||
"atlantis",
|
||||
"atlantis_dev",
|
||||
"sorcerer",
|
||||
"sorcerer_dev"
|
||||
]
|
||||
},
|
||||
"sso": {
|
||||
"cookieDomain": ".oceanbox.io",
|
||||
"cookieName": ".obx.staging",
|
||||
"ttl": 12.0,
|
||||
"signedOutRedirectUri": "https://atlantis.beta.oceanbox.io",
|
||||
"realm": "atlantis",
|
||||
"environment": "staging",
|
||||
"keyStore": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantis.blob.core.windows.net",
|
||||
"key": "dataprotection-keys"
|
||||
},
|
||||
"keyVault": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantisvault.vault.azure.net",
|
||||
"key": "dataencryption-keys"
|
||||
}
|
||||
},
|
||||
"fga": {
|
||||
"apiUrl": "http://staging-openfga.openfga.svc.cluster.local:8080",
|
||||
"apiKey": "",
|
||||
"storeId": "01JKTQKHSGJH4RW04WFVCPWNTE",
|
||||
"modelId": "01JKTQMXBE7219XRYE3NGYNXSR"
|
||||
},
|
||||
"plainAuthUsers": [
|
||||
{
|
||||
"username": "admin",
|
||||
"password": "en-to-tre-fire",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
},
|
||||
{
|
||||
"username": "sorcerer",
|
||||
"password": "fire tre to en",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
},
|
||||
{
|
||||
"username": "archivist",
|
||||
"password": "en-to-tre-fire",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
}
|
||||
],
|
||||
"redis": "staging-atlantis-redis-master:6379",
|
||||
"objectStore": "https://atlantis.blob.core.windows.net",
|
||||
"connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
|
||||
"sorcerer" : "https://sorcerer.ekman.oceanbox.io",
|
||||
"allowedOrigins": [
|
||||
"https://atlantis.beta.oceanbox.io",
|
||||
"https://atlantis.dev.oceanbox.io",
|
||||
"https://atlantis.local.oceanbox.io:8080"
|
||||
],
|
||||
"appName": "atlantis",
|
||||
"appEnv": "staging",
|
||||
"appNamespace": "atlantis",
|
||||
"appVersion": "0.0.0",
|
||||
"otelCollector": "http://opentelemetry-collector.otel.svc:4317",
|
||||
"pubsubName": "pubsub",
|
||||
"pubsubTopic": "hipster-atlantis",
|
||||
"slurm": {
|
||||
"baseUrl": "https://hipster-slurmrestd.ekman.oceanbox.io/",
|
||||
"slurmApi": "slurm/v0.0.39/",
|
||||
"dbdApi": "slurmdbd/v0.0.39/",
|
||||
"user": "serf",
|
||||
"password": "wooqueiLee3ao0ha"
|
||||
},
|
||||
"amqp": {
|
||||
"auth": "user:hunny-bunny",
|
||||
"host": "10.255.241.201:31673"
|
||||
},
|
||||
"fenceRadius": 1250.0
|
||||
}
|
||||
@@ -0,0 +1 @@
|
||||
oceanbox:$apr1$4njCUY7A$fmWQSymNJ6abSHvwDpNGU/
|
||||
@@ -0,0 +1,2 @@
|
||||
client-id=simen.kirkvik@tromso.serit.no:simkir-tilt-atlantis
|
||||
secret=d9tInZ1XpeDAxD.DySv'*SB=P
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: slurm-events
|
||||
spec:
|
||||
type: bindings.rabbitmq
|
||||
version: v1
|
||||
metadata:
|
||||
- name: host
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-rabbitmq
|
||||
key: connString
|
||||
- name: queueName
|
||||
value: staging-slurm-job-events
|
||||
- name: durable
|
||||
value: true
|
||||
- name: contentType
|
||||
value: "application/json"
|
||||
- name: route
|
||||
value: /events/slurm
|
||||
scopes:
|
||||
- staging-atlantis
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: configstore
|
||||
spec:
|
||||
type: configuration.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: staging-atlantis-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-redis
|
||||
key: redis-password
|
||||
- name: redisDB
|
||||
value: "1"
|
||||
scopes:
|
||||
- staging-atlantis
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: configstore
|
||||
spec:
|
||||
type: configuration.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: staging-atlantis-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-redis
|
||||
key: redis-password
|
||||
- name: redisDB
|
||||
value: "2"
|
||||
scopes:
|
||||
- staging-atlantis
|
||||
@@ -0,0 +1 @@
|
||||
OIDC_CLIENT_SECRET=3QjfSPmAemjn34XVA2o1fvoS7I4gKvOR
|
||||
@@ -0,0 +1,10 @@
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: azure-keyvault
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: staging-atlantis-env
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: azure-keyvault
|
||||
spec:
|
||||
type: secretstores.azure.keyvault
|
||||
version: v1
|
||||
metadata:
|
||||
- name: vaultName
|
||||
value: atlantisvault
|
||||
- name: azureTenantId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_TENANT_ID
|
||||
- name: azureClientId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_ID
|
||||
- name: azureClientSecret
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_SECRET
|
||||
@@ -0,0 +1,24 @@
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
configMapGenerator:
|
||||
- name: staging-atlantis-appsettings
|
||||
files:
|
||||
- appsettings.json
|
||||
patches:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
path: deployment_patch.yaml
|
||||
resources:
|
||||
- ../base
|
||||
- rbac.yaml
|
||||
- secrets.yaml
|
||||
- tracing.yaml
|
||||
- bindings.yaml
|
||||
- pubsub.yaml
|
||||
- statestore.yaml
|
||||
- subscriptions.yaml
|
||||
- configurations.yaml
|
||||
- secretstore.yaml
|
||||
- keyvault.yaml
|
||||
@@ -0,0 +1,52 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: pubsub
|
||||
spec:
|
||||
version: v1
|
||||
type: pubsub.rabbitmq
|
||||
metadata:
|
||||
- name: hostname
|
||||
value: staging-rabbitmq.rabbitmq
|
||||
- name: username
|
||||
value: user
|
||||
- name: password
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-rabbitmq
|
||||
key: rabbitmq-password
|
||||
- name: protocol
|
||||
value: amqp
|
||||
- name: durable
|
||||
value: true
|
||||
- name: deletedWhenUnused
|
||||
value: false
|
||||
- name: autoAck
|
||||
value: false
|
||||
- name: deliveryMode
|
||||
value: 1
|
||||
- name: requeueInFailure
|
||||
value: false
|
||||
- name: prefetchCount
|
||||
value: 0
|
||||
- name: reconnectWait
|
||||
value: 0
|
||||
- name: concurrencyMode
|
||||
value: parallel
|
||||
- name: publisherConfirm
|
||||
value: false
|
||||
- name: backOffPolicy
|
||||
value: exponential
|
||||
- name: backOffInitialInterval
|
||||
value: 100
|
||||
- name: backOffMaxRetries
|
||||
value: 16
|
||||
- name: enableDeadLetter # Optional enable dead Letter or not
|
||||
value: true
|
||||
- name: maxLen # Optional max message count in a queue
|
||||
value: 3000
|
||||
- name: maxLenBytes # Optional maximum length in bytes of a queue.
|
||||
value: 10485760
|
||||
- name: exchangeKind
|
||||
value: fanout
|
||||
- name: clientName
|
||||
value: "{appID}"
|
||||
@@ -0,0 +1,40 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: staging-atlantis
|
||||
namespace: staging-atlantis
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- staging-atlantis-appsettings
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- azure-keyvault
|
||||
- staging-atlantis-redis
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: staging-atlantis
|
||||
namespace: staging-atlantis
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: staging-atlantis
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: staging-atlantis
|
||||
namespace: staging-atlantis
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
architecture: standalone
|
||||
|
||||
replica:
|
||||
replicaCount: 1
|
||||
|
||||
auth:
|
||||
enabled: true
|
||||
sentinel: true
|
||||
password: ""
|
||||
usePasswordFiles: false
|
||||
existingSecretPasswordKey: ""
|
||||
existingSecret: staging-atlantis-redis
|
||||
|
||||
master:
|
||||
resources:
|
||||
limits:
|
||||
ephemeral-storage: 1024Mi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
|
||||
@@ -0,0 +1,36 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: staging-atlantis-env
|
||||
type: Opaque
|
||||
data:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
kyverno/clone: "true"
|
||||
name: azure-keyvault
|
||||
type: Opaque
|
||||
data:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
kyverno/clone: "true"
|
||||
name: dapr-api-token
|
||||
type: Opaque
|
||||
data:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
kyverno/clone: "true"
|
||||
kyverno/env: "staging"
|
||||
name: staging-atlantis-rabbitmq
|
||||
type: Opaque
|
||||
data:
|
||||
|
||||
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: secretstore
|
||||
spec:
|
||||
type: secretstores.kubernetes
|
||||
version: v1
|
||||
metadata:
|
||||
- name: defaultNamespace
|
||||
value: staging-atlantis
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: statestore
|
||||
spec:
|
||||
type: state.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: staging-atlantis-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-redis
|
||||
key: redis-password
|
||||
- name: actorStateStore
|
||||
value: "true"
|
||||
- name: redisDB
|
||||
value: "0"
|
||||
scopes:
|
||||
- staging-atlantis
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: dapr.io/v2alpha1
|
||||
kind: Subscription
|
||||
metadata:
|
||||
name: hipster-events
|
||||
spec:
|
||||
topic: hipster
|
||||
routes:
|
||||
default: /events/hipster
|
||||
pubsubname: pubsub
|
||||
metadata:
|
||||
queueType: quorum
|
||||
scopes:
|
||||
- staging-atlantis
|
||||
---
|
||||
apiVersion: dapr.io/v2alpha1
|
||||
kind: Subscription
|
||||
metadata:
|
||||
name: inbox-events
|
||||
spec:
|
||||
topic: inbox
|
||||
routes:
|
||||
default: /events/inbox
|
||||
pubsubname: pubsub
|
||||
metadata:
|
||||
queueType: quorum
|
||||
scopes:
|
||||
- staging-atlantis
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: tracing
|
||||
spec:
|
||||
tracing:
|
||||
samplingRate: "1"
|
||||
otel:
|
||||
endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
|
||||
protocol: grpc
|
||||
isSecure: false
|
||||
@@ -0,0 +1,79 @@
|
||||
replicaCount: 2
|
||||
|
||||
podAnnotations:
|
||||
dapr.io/app-id: "prod-atlantis"
|
||||
|
||||
env:
|
||||
- name: APP_NAMESPACE
|
||||
value: prod-atlantis
|
||||
- name: APP_VERSION
|
||||
value: "2.97.4"
|
||||
- name: LOG_LEVEL
|
||||
value: "2"
|
||||
- name: REDIS_USER
|
||||
value: default
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-redis
|
||||
key: redis-password
|
||||
- name: DB_HOST
|
||||
value: prod-atlantis-db-rw
|
||||
- name: DB_PORT
|
||||
value: "5432"
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-db-superuser
|
||||
key: username
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-db-superuser
|
||||
key: password
|
||||
- name: DAPR_API_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: dapr-api-token
|
||||
key: token
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
|
||||
hosts:
|
||||
- host: maps.oceanbox.io
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
internal:
|
||||
- path: /internal
|
||||
pathType: ImplementationSpecific
|
||||
- path: /dapr
|
||||
pathType: ImplementationSpecific
|
||||
- path: /actors
|
||||
pathType: ImplementationSpecific
|
||||
- path: /job
|
||||
pathType: ImplementationSpecific
|
||||
- path: /events
|
||||
pathType: ImplementationSpecific
|
||||
- path: /metrics
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- hosts:
|
||||
- maps.oceanbox.io
|
||||
secretName: prod-atlantis-tls
|
||||
|
||||
cluster:
|
||||
instances: 2
|
||||
bootstrap:
|
||||
enabled: false
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 1Gi
|
||||
@@ -0,0 +1,102 @@
|
||||
replicaCount: 1
|
||||
image:
|
||||
tag: 77d6efd6-debug
|
||||
podAnnotations:
|
||||
dapr.io/app-id: "staging-atlantis"
|
||||
env:
|
||||
- name: APP_NAMESPACE
|
||||
value: staging-atlantis
|
||||
- name: APP_VERSION
|
||||
value: "2.95.1"
|
||||
- name: LOG_LEVEL
|
||||
value: "1"
|
||||
- name: REDIS_USER
|
||||
value: default
|
||||
- name: REDIS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-redis
|
||||
key: redis-password
|
||||
- name: DB_HOST
|
||||
value: staging-atlantis-db-rw
|
||||
- name: DB_PORT
|
||||
value: "5432"
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-db-superuser
|
||||
key: username
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: staging-atlantis-db-superuser
|
||||
key: password
|
||||
- name: DAPR_API_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: dapr-api-token
|
||||
key: token
|
||||
ingress:
|
||||
enabled: true
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
|
||||
# nginx.ingress.kubernetes.io/affinity: "cookie"
|
||||
# nginx.ingress.kubernetes.io/session-cookie-name: "http-affinity"
|
||||
# nginx.ingress.kubernetes.io/session-cookie-expires: "86400"
|
||||
# nginx.ingress.kubernetes.io/session-cookie-max-age: "86400"
|
||||
# atlantis.oceanbox.io/expose: internal
|
||||
hosts:
|
||||
- host: atlantis.beta.oceanbox.io
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
internal:
|
||||
- path: /internal
|
||||
pathType: ImplementationSpecific
|
||||
- path: /dapr
|
||||
pathType: ImplementationSpecific
|
||||
- path: /actors
|
||||
pathType: ImplementationSpecific
|
||||
- path: /job
|
||||
pathType: ImplementationSpecific
|
||||
- path: /events
|
||||
pathType: ImplementationSpecific
|
||||
- path: /metrics
|
||||
pathType: ImplementationSpecific
|
||||
- host: atlas.oceanbox.io
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
internal:
|
||||
- path: /internal
|
||||
pathType: ImplementationSpecific
|
||||
- path: /dapr
|
||||
pathType: ImplementationSpecific
|
||||
- path: /actors
|
||||
pathType: ImplementationSpecific
|
||||
- path: /job
|
||||
pathType: ImplementationSpecific
|
||||
- path: /events
|
||||
pathType: ImplementationSpecific
|
||||
- path: /metrics
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- hosts:
|
||||
- atlantis.beta.oceanbox.io
|
||||
- atlas.oceanbox.io
|
||||
secretName: staging-atlantis-tls
|
||||
cluster:
|
||||
instances: 1
|
||||
bootstrap:
|
||||
enabled: true
|
||||
source:
|
||||
db: prod-atlantis-db
|
||||
namespace: prod-atlantis
|
||||
resources:
|
||||
limits:
|
||||
cpu: 250m
|
||||
memory: 1Gi
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 1Gi
|
||||
@@ -0,0 +1,12 @@
|
||||
|
||||
podAnnotations:
|
||||
dapr.io/enabled: "true"
|
||||
dapr.io/app-port: "8085"
|
||||
dapr.io/api-token-secret: "dapr-api-token"
|
||||
dapr.io/config: "tracing"
|
||||
dapr.io/app-protocol: "http"
|
||||
dapr.io/log-as-json: "true"
|
||||
dapr.io/sidecar-cpu-request: "10m"
|
||||
dapr.io/sidecar-memory-request: "50Mi"
|
||||
# dapr.io/sidecar-cpu-limit: "100m"
|
||||
# dapr.io/sidecar-memory-limit: "1000Mi"
|
||||
@@ -0,0 +1,41 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: staging-openfga-migrate
|
||||
labels:
|
||||
helm.sh/chart: openfga-0.2.12
|
||||
app.kubernetes.io/name: openfga
|
||||
app.kubernetes.io/instance: staging
|
||||
app.kubernetes.io/version: "v1.5.9"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
annotations:
|
||||
helm.sh/hook: post-install, post-upgrade, post-rollback, post-delete
|
||||
helm.sh/hook-delete-policy: before-hook-creation
|
||||
helm.sh/hook-weight: "-5"
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
helm.sh/hook: post-install, post-upgrade, post-rollback, post-delete
|
||||
helm.sh/hook-delete-policy: before-hook-creation
|
||||
helm.sh/hook-weight: "-5"
|
||||
spec:
|
||||
serviceAccountName: staging-openfga
|
||||
containers:
|
||||
- name: migrate-database
|
||||
securityContext:
|
||||
{}
|
||||
image: "openfga/openfga:v1.5.9"
|
||||
args: ["migrate"]
|
||||
env:
|
||||
- name: OPENFGA_DATASTORE_ENGINE
|
||||
value: "postgres"
|
||||
- name: OPENFGA_DATASTORE_URI
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: "staging-openfga-db-superuser"
|
||||
key: "uri"
|
||||
resources:
|
||||
{}
|
||||
restartPolicy: Never
|
||||
backoffLimit: 1
|
||||
@@ -0,0 +1,19 @@
|
||||
apiVersion: v1
|
||||
stringData:
|
||||
postgres-password: blT6zzv37KyFvzb1Ct3bhfAwPxhTG2fBO1EiIASQWI4wnEOB8AOWvmVa2sogGexr
|
||||
uri: postgres://postgres:blT6zzv37KyFvzb1Ct3bhfAwPxhTG2fBO1EiIASQWI4wnEOB8AOWvmVa2sogGexr@prod-openfga-rw.openfga.svc.cluster.local:5432/postgres?sslmode=disable
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: prod-openfga-postgresql
|
||||
namespace: openfga
|
||||
type: Opaque
|
||||
---
|
||||
apiVersion: v1
|
||||
stringData:
|
||||
postgres-password: iAnMHs3eEuQM0D4jeAP1dwEoLWUBSwNXwhBuPDOgmfoeZ58iV0zogQ77U3GNUbwa
|
||||
uri: postgres://postgres:iAnMHs3eEuQM0D4jeAP1dwEoLWUBSwNXwhBuPDOgmfoeZ58iV0zogQ77U3GNUbwa@staging-openfga-rw.openfga.svc.cluster.local:5432/postgres?sslmode=disable
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: staging-openfga-postgresql
|
||||
namespace: openfga
|
||||
type: Opaque
|
||||
@@ -0,0 +1,57 @@
|
||||
replicaCount: 2
|
||||
|
||||
datastore:
|
||||
engine: postgres
|
||||
uriSecret: prod-openfga-db-superuser
|
||||
migrationType: initContainer
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
playground:
|
||||
enabled: false
|
||||
|
||||
telemetry:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
enableRPCHistograms: true
|
||||
trace:
|
||||
enabled: true
|
||||
otlp:
|
||||
endpoint: opentelemetry-collector.otel.svc.cluster.local:4317
|
||||
sampleRatio: 0.1
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
|
||||
hosts:
|
||||
- host: openfga.srv.oceanbox.io
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- secretName: prod-openfga-tls
|
||||
hosts:
|
||||
- openfga.srv.oceanbox.io
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: prod-openfga-db
|
||||
namespace: openfga
|
||||
spec:
|
||||
instances: 2
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:17-bookworm
|
||||
storage:
|
||||
resizeInUseVolumes: true
|
||||
size: 10Gi
|
||||
backup:
|
||||
retentionPolicy: 60d
|
||||
target: prefer-standby
|
||||
@@ -0,0 +1,78 @@
|
||||
replicaCount: 1
|
||||
|
||||
datastore:
|
||||
engine: postgres
|
||||
uriSecret: staging-openfga-db-superuser
|
||||
migrationType: initContainer
|
||||
|
||||
postgresql:
|
||||
enabled: false
|
||||
|
||||
playground:
|
||||
enabled: false
|
||||
|
||||
telemetry:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
enableRPCHistograms: true
|
||||
trace:
|
||||
enabled: true
|
||||
otlp:
|
||||
endpoint: opentelemetry-collector.otel.svc.cluster.local:4317
|
||||
sampleRatio: 0.1
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: nginx
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
|
||||
hosts:
|
||||
- host: openfga.dev.oceanbox.io
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
tls:
|
||||
- secretName: staging-openfga-tls
|
||||
hosts:
|
||||
- openfga.dev.oceanbox.io
|
||||
|
||||
extraObjects:
|
||||
- apiVersion: postgresql.cnpg.io/v1
|
||||
kind: Cluster
|
||||
metadata:
|
||||
name: staging-openfga-db
|
||||
namespace: openfga
|
||||
spec:
|
||||
instances: 1
|
||||
imageName: ghcr.io/cloudnative-pg/postgresql:17-bookworm
|
||||
storage:
|
||||
resizeInUseVolumes: true
|
||||
size: 10Gi
|
||||
backup:
|
||||
retentionPolicy: 60d
|
||||
target: prefer-standby
|
||||
bootstrap:
|
||||
pg_basebackup:
|
||||
database: ""
|
||||
owner: ""
|
||||
source: openfga
|
||||
enableSuperuserAccess: true
|
||||
externalClusters:
|
||||
- name: openfga
|
||||
connectionParameters:
|
||||
host: prod-openfga-db-rw.openfga
|
||||
sslmode: verify-full
|
||||
user: streaming_replica
|
||||
sslCert:
|
||||
key: tls.crt
|
||||
name: prod-openfga-db-replication
|
||||
sslKey:
|
||||
key: tls.key
|
||||
name: prod-openfga-db-replication
|
||||
sslRootCert:
|
||||
key: ca.crt
|
||||
name: prod-openfga-db-ca
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: prod-rabbitmq-nodeport
|
||||
namespace: rabbitmq
|
||||
spec:
|
||||
ports:
|
||||
- name: amqp
|
||||
nodePort: 30672
|
||||
port: 5672
|
||||
protocol: TCP
|
||||
targetPort: 5672
|
||||
- name: amqp-http
|
||||
nodePort: 30673
|
||||
port: 15672
|
||||
protocol: TCP
|
||||
targetPort: 15672
|
||||
selector:
|
||||
app.kubernetes.io/instance: prod-rabbitmq
|
||||
app.kubernetes.io/name: rabbitmq
|
||||
type: NodePort
|
||||
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: staging-rabbitmq-nodeport
|
||||
namespace: rabbitmq
|
||||
spec:
|
||||
ports:
|
||||
- name: amqp
|
||||
nodePort: 31672
|
||||
port: 5672
|
||||
protocol: TCP
|
||||
targetPort: 5672
|
||||
- name: amqp-http
|
||||
nodePort: 31673
|
||||
port: 15672
|
||||
protocol: TCP
|
||||
targetPort: 15672
|
||||
selector:
|
||||
app.kubernetes.io/instance: staging-rabbitmq
|
||||
app.kubernetes.io/name: rabbitmq
|
||||
type: NodePort
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
replicaCount: 3
|
||||
auth:
|
||||
erlangCookie: prod-rabbitmq
|
||||
existingErlangSecret: prod-rabbitmq
|
||||
existingPasswordSecret: prod-rabbitmq
|
||||
password: ""
|
||||
username: user
|
||||
clusterDomain: cluster.local
|
||||
ingress:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-production
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
atlantis.oceanbox.io/expose: internal
|
||||
enabled: true
|
||||
extraHosts: []
|
||||
extraPaths: []
|
||||
extraRules: []
|
||||
hostname: rabbitmq.srv.oceanbox.io
|
||||
ingressClassName: ""
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
secrets: []
|
||||
selfSigned: false
|
||||
tls: true
|
||||
persistence:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
size: 8Gi
|
||||
storageClass: ""
|
||||
|
||||
@@ -0,0 +1,38 @@
|
||||
replicaCount: 1
|
||||
auth:
|
||||
erlangCookie: staging-rabbitmq
|
||||
existingErlangSecret: staging-rabbitmq
|
||||
existingPasswordSecret: staging-rabbitmq
|
||||
password: ""
|
||||
username: user
|
||||
clusterDomain: cluster.local
|
||||
ingress:
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
atlantis.oceanbox.io/expose: internal
|
||||
enabled: true
|
||||
ingressClassName: ""
|
||||
extraHosts:
|
||||
- name: rabbitmq.dev.oceanbox.io
|
||||
path: /
|
||||
extraTls:
|
||||
- hosts:
|
||||
- rabbitmq.dev.oceanbox.io
|
||||
secretName: rabbitmq.dev.oceanbox.io-tls
|
||||
extraPaths: []
|
||||
extraRules: []
|
||||
hostname: rabbitmq.beta.oceanbox.io
|
||||
path: /
|
||||
pathType: ImplementationSpecific
|
||||
secrets: []
|
||||
selfSigned: false
|
||||
tls: true
|
||||
persistence:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
enabled: true
|
||||
existingClaim: ""
|
||||
size: 8Gi
|
||||
storageClass: ""
|
||||
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: prod-redis-nodeport
|
||||
spec:
|
||||
externalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: redis
|
||||
nodePort: 30379
|
||||
port: 6379
|
||||
protocol: TCP
|
||||
targetPort: 6379
|
||||
selector:
|
||||
app.kubernetes.io/instance: prod-redis
|
||||
app.kubernetes.io/name: redis
|
||||
sessionAffinity: None
|
||||
type: NodePort
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: stagin-redis-nodeport
|
||||
spec:
|
||||
externalTrafficPolicy: Cluster
|
||||
ports:
|
||||
- name: redis
|
||||
nodePort: 31379
|
||||
port: 6379
|
||||
protocol: TCP
|
||||
targetPort: 6379
|
||||
selector:
|
||||
app.kubernetes.io/instance: staging-redis
|
||||
app.kubernetes.io/name: redis
|
||||
sessionAffinity: None
|
||||
type: NodePort
|
||||
@@ -0,0 +1,37 @@
|
||||
# image:
|
||||
# repository: redis/redis-stack-server
|
||||
# tag: 7.2.0-v10
|
||||
|
||||
architecture: replication
|
||||
|
||||
replica:
|
||||
replicaCount: 2
|
||||
# command:
|
||||
# - "/opt/redis-stack/bin/redis-server"
|
||||
# - "--loadmodule"
|
||||
# - "/opt/redis-stack/lib/redisearch.so"
|
||||
# - "MAXSEARCHRESULTS"
|
||||
# - "10000"
|
||||
# - "MAXAGGREGATERESULTS"
|
||||
# - "10000"
|
||||
# - "--loadmodule"
|
||||
# - "/opt/redis-stack/lib/rejson.so"
|
||||
|
||||
auth:
|
||||
enabled: true
|
||||
sentinel: true
|
||||
password: ""
|
||||
usePasswordFiles: false
|
||||
existingSecretPasswordKey: ""
|
||||
# existingSecret: staging-redis
|
||||
|
||||
master:
|
||||
resources:
|
||||
limits:
|
||||
ephemeral-storage: 1024Mi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
|
||||
@@ -0,0 +1,37 @@
|
||||
# image:
|
||||
# repository: redis/redis-stack-server
|
||||
# tag: 7.2.0-v10
|
||||
|
||||
architecture: standalone
|
||||
|
||||
replica:
|
||||
replicaCount: 1
|
||||
# command:
|
||||
# - "/opt/redis-stack/bin/redis-server"
|
||||
# - "--loadmodule"
|
||||
# - "/opt/redis-stack/lib/redisearch.so"
|
||||
# - "MAXSEARCHRESULTS"
|
||||
# - "10000"
|
||||
# - "MAXAGGREGATERESULTS"
|
||||
# - "10000"
|
||||
# - "--loadmodule"
|
||||
# - "/opt/redis-stack/lib/rejson.so"
|
||||
|
||||
auth:
|
||||
enabled: true
|
||||
sentinel: true
|
||||
password: ""
|
||||
usePasswordFiles: false
|
||||
existingSecretPasswordKey: ""
|
||||
# existingSecret: staging-redis
|
||||
|
||||
master:
|
||||
resources:
|
||||
limits:
|
||||
ephemeral-storage: 1024Mi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
|
||||
Reference in New Issue
Block a user