feat: socerer helmfile setup
This commit is contained in:
@@ -0,0 +1,11 @@
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/livenessProbe/httpGet/path
|
||||
value: /healthz
|
||||
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/readinessProbe/httpGet/path
|
||||
value: /healthz
|
||||
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom
|
||||
value: []
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
patches:
|
||||
- target:
|
||||
version: v1
|
||||
group: apps
|
||||
kind: Deployment
|
||||
path: deployment_patch.yaml
|
||||
resources:
|
||||
- _manifest.yaml
|
||||
@@ -0,0 +1,75 @@
|
||||
{
|
||||
"oidc": {
|
||||
"issuer": "https://auth.oceanbox.io/realms/oceanbox",
|
||||
"authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
|
||||
"token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
|
||||
"jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
|
||||
"userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
|
||||
"end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
|
||||
"device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
|
||||
"clientId": "sorcerer",
|
||||
"clientSecret": "",
|
||||
"scopes": [
|
||||
"openid",
|
||||
"email",
|
||||
"offline_access",
|
||||
"profile"
|
||||
],
|
||||
"audiences": [
|
||||
"atlantis",
|
||||
"atlantis_dev",
|
||||
"sorcerer",
|
||||
"sorcerer_dev"
|
||||
]
|
||||
},
|
||||
"sso": {
|
||||
"cookieDomain": ".oceanbox.io",
|
||||
"cookieName": ".obx.prod",
|
||||
"ttl": 12.0,
|
||||
"signedOutRedirectUri": "https://maps.oceanbox.io",
|
||||
"realm": "atlantis",
|
||||
"environment": "prod",
|
||||
"keyStore": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantis.blob.core.windows.net",
|
||||
"key": "dataprotection-keys"
|
||||
},
|
||||
"keyVault": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantisvault.vault.azure.net",
|
||||
"key": "dataencryption-keys"
|
||||
}
|
||||
},
|
||||
"plainAuthUsers": [],
|
||||
"fga": {
|
||||
"apiUrl": "https://openfga.srv.oceanbox.io",
|
||||
"apiKey": "",
|
||||
"storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
|
||||
"modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
|
||||
},
|
||||
"redis": "localhost:6379,user=default,password=secret",
|
||||
"allowedOrigins": [
|
||||
"http://localhost:8085",
|
||||
"http://localhost:8080",
|
||||
"https://localhost:8080",
|
||||
"https://sorcerer.data.oceanbox.io",
|
||||
"https://sorcerer.ekman.oceanbox.io",
|
||||
"https://sorcerer.local.oceanbox.io:8080",
|
||||
"https://atlantis.local.oceanbox.io:8080",
|
||||
"https://maps.oceanbox.io",
|
||||
"https://maps.beta.oceanbox.io",
|
||||
"https://atlantis.beta.oceanbox.io",
|
||||
"https://jonas-atlantis.dev.oceanbox.io",
|
||||
"https://stig-atlantis.dev.oceanbox.io",
|
||||
"https://prod-sorcerer.ekman.oceanbox.io",
|
||||
"http://prod-sorcerer.ekman.oceanbox.io"
|
||||
],
|
||||
"appName": "sorcerer",
|
||||
"appEnv": "prod",
|
||||
"appNamespace": "prod-sorcerer",
|
||||
"appVersion": "0.0.0",
|
||||
"otelCollector": "http://10.255.241.12:4317",
|
||||
"archiveSvc": "https://maps.oceanbox.io",
|
||||
"dataDir": "/data/archives",
|
||||
"cacheDir": "/data/archives/cache"
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: pv-prod-backup-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
capacity:
|
||||
storage: 400T
|
||||
local:
|
||||
path: /backup/archives
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
volumeMode: Filesystem
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- ekman
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: prod-oceanbox-backup-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 400T
|
||||
storageClassName: ""
|
||||
volumeMode: Filesystem
|
||||
volumeName: pv-prod-backup-archives
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: configstore
|
||||
spec:
|
||||
type: configuration.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: prod-sorcerer-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: prod-sorcerer-redis
|
||||
key: redis-password
|
||||
- name: redisDB
|
||||
value: "1"
|
||||
scopes:
|
||||
- prod-sorcerer
|
||||
@@ -0,0 +1 @@
|
||||
SEQ_APIKEY=7iIXHJukYjSLQDix6CnZ
|
||||
@@ -0,0 +1,13 @@
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/volumeMounts/0/mountPath
|
||||
value: /data
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: azure-keyvault
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: prod-sorcerer-env
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: azure-keyvault
|
||||
spec:
|
||||
type: secretstores.azure.keyvault
|
||||
version: v1
|
||||
metadata:
|
||||
- name: vaultName
|
||||
value: atlantisvault
|
||||
- name: azureTenantId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_TENANT_ID
|
||||
- name: azureClientId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_ID
|
||||
- name: azureClientSecret
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_SECRET
|
||||
@@ -0,0 +1,23 @@
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
configMapGenerator:
|
||||
- name: prod-sorcerer-appsettings
|
||||
files:
|
||||
- appsettings.json
|
||||
patches:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
path: deployment_patch.yaml
|
||||
resources:
|
||||
- ../base
|
||||
- pv.yaml
|
||||
- pvc.yaml
|
||||
- secrets.yaml
|
||||
- configurations.yaml
|
||||
- keyvault.yaml
|
||||
- rbac.yaml
|
||||
- secretstore.yaml
|
||||
- statestore.yaml
|
||||
- tracing.yaml
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: pv-prod-sorcerer-ceph-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
csi:
|
||||
driver: rook-ceph.cephfs.csi.ceph.com
|
||||
nodeStageSecretRef:
|
||||
name: rook-csi-cephfs-node
|
||||
namespace: rook-ceph
|
||||
volumeAttributes:
|
||||
clusterID: rook-ceph
|
||||
fsName: data
|
||||
rootPath: /
|
||||
staticVolume: "true"
|
||||
volumeHandle: pv-prod-sorcerer-ceph-archives
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
volumeMode: Filesystem
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: prod-sorcerer-ceph-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: ""
|
||||
volumeMode: Filesystem
|
||||
volumeName: pv-prod-sorcerer-ceph-archives
|
||||
status:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: prod-sorcerer
|
||||
namespace: prod-sorcerer
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- prod-sorcerer-appsettings
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- azure-keyvault
|
||||
- prod-sorcerer-redis
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: prod-sorcerer
|
||||
namespace: prod-sorcerer
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: prod-sorcerer
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: prod-sorcerer
|
||||
namespace: prod-sorcerer
|
||||
@@ -0,0 +1,23 @@
|
||||
architecture: replication
|
||||
|
||||
replica:
|
||||
replicaCount: 2
|
||||
|
||||
auth:
|
||||
enabled: true
|
||||
sentinel: true
|
||||
password: ""
|
||||
usePasswordFiles: false
|
||||
existingSecretPasswordKey: ""
|
||||
existingSecret: prod-sorcerer-redis
|
||||
|
||||
master:
|
||||
resources:
|
||||
limits:
|
||||
ephemeral-storage: 1024Mi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: prod-sorcerer-env
|
||||
type: Opaque
|
||||
data:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
kyverno/clone: "true"
|
||||
name: azure-keyvault
|
||||
type: Opaque
|
||||
data:
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: secretstore
|
||||
spec:
|
||||
type: secretstores.kubernetes
|
||||
version: v1
|
||||
metadata:
|
||||
- name: defaultNamespace
|
||||
value: prod-sorcerer
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: statestore
|
||||
spec:
|
||||
type: state.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: prod-sorcerer-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: prod-sorcerer-redis
|
||||
key: redis-password
|
||||
- name: actorStateStore
|
||||
value: "true"
|
||||
- name: redisDB
|
||||
value: "0"
|
||||
scopes:
|
||||
- prod-sorcerer
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: tracing
|
||||
spec:
|
||||
tracing:
|
||||
samplingRate: "1"
|
||||
otel:
|
||||
endpointAddress: "10.255.241.12:4317"
|
||||
protocol: grpc
|
||||
isSecure: false
|
||||
@@ -0,0 +1,76 @@
|
||||
{
|
||||
"oidc": {
|
||||
"issuer": "https://auth.oceanbox.io/realms/oceanbox",
|
||||
"authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
|
||||
"token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
|
||||
"jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
|
||||
"userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
|
||||
"end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
|
||||
"device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
|
||||
"clientId": "sorcerer_dev",
|
||||
"clientSecret": "",
|
||||
"scopes": [
|
||||
"openid",
|
||||
"email",
|
||||
"offline_access",
|
||||
"profile"
|
||||
],
|
||||
"audiences": [
|
||||
"atlantis",
|
||||
"atlantis_dev",
|
||||
"sorcerer",
|
||||
"sorcerer_dev"
|
||||
]
|
||||
},
|
||||
"sso": {
|
||||
"cookieDomain": ".oceanbox.io",
|
||||
"cookieName": ".obx.staging",
|
||||
"ttl": 12.0,
|
||||
"signedOutRedirectUri": "https://atlantis.beta.oceanbox.io",
|
||||
"realm": "atlantis",
|
||||
"environment": "staging",
|
||||
"keyStore": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantis.blob.core.windows.net",
|
||||
"key": "dataprotection-keys"
|
||||
},
|
||||
"keyVault": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantisvault.vault.azure.net",
|
||||
"key": "dataencryption-keys"
|
||||
}
|
||||
},
|
||||
"plainAuthUsers": [],
|
||||
"fga": {
|
||||
"apiUrl": "https://openfga.dev.oceanbox.io",
|
||||
"apiKey": "",
|
||||
"storeId": "01JKTQKHSGJH4RW04WFVCPWNTE",
|
||||
"modelId": "01JKTQMXBE7219XRYE3NGYNXSR"
|
||||
},
|
||||
"redis": "localhost:6379,user=default,password=secret",
|
||||
"allowedOrigins": [
|
||||
"http://localhost:8085",
|
||||
"http://localhost:8080",
|
||||
"https://localhost:8080",
|
||||
"https://sorcerer.ekman.oceanbox.io",
|
||||
"https://sorcerer.local.oceanbox.io:8080",
|
||||
"https://atlantis.local.oceanbox.io:8080",
|
||||
"https://maps.oceanbox.io",
|
||||
"https://maps.beta.oceanbox.io",
|
||||
"https://atlantis.beta.oceanbox.io",
|
||||
"https://jonas-atlantis.dev.oceanbox.io",
|
||||
"https://stig-atlantis.dev.oceanbox.io",
|
||||
"https://oty-atlantis.dev.oceanbox.io",
|
||||
"https://bast-atlantis.dev.oceanbox.io",
|
||||
"https://staging-sorcerer.ekman.oceanbox.io",
|
||||
"http://staging-sorcerer.ekman.oceanbox.io"
|
||||
],
|
||||
"appName": "sorcerer",
|
||||
"appEnv": "staging",
|
||||
"appNamespace": "staging-sorcerer",
|
||||
"appVersion": "0.0.0",
|
||||
"otelCollector": "http://10.255.241.12:4317",
|
||||
"archiveSvc": "https://atlantis.beta.oceanbox.io",
|
||||
"dataDir": "/data/archives",
|
||||
"cacheDir": "/data/archives/cache"
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: pv-staging-backup-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
capacity:
|
||||
storage: 400T
|
||||
local:
|
||||
path: /backup/archives
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
volumeMode: Filesystem
|
||||
nodeAffinity:
|
||||
required:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: kubernetes.io/hostname
|
||||
operator: In
|
||||
values:
|
||||
- ekman
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: staging-oceanbox-backup-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 400T
|
||||
storageClassName: ""
|
||||
volumeMode: Filesystem
|
||||
volumeName: pv-staging-backup-archives
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: configstore
|
||||
spec:
|
||||
type: configuration.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: staging-sorcerer-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: staging-sorcerer-redis
|
||||
key: redis-password
|
||||
- name: redisDB
|
||||
value: "1"
|
||||
scopes:
|
||||
- staging-sorcerer
|
||||
@@ -0,0 +1,13 @@
|
||||
- op: replace
|
||||
path: /spec/template/spec/containers/0/volumeMounts/0/mountPath
|
||||
value: /data
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: azure-keyvault
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: staging-sorcerer-env
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: azure-keyvault
|
||||
spec:
|
||||
type: secretstores.azure.keyvault
|
||||
version: v1
|
||||
metadata:
|
||||
- name: vaultName
|
||||
value: atlantisvault
|
||||
- name: azureTenantId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_TENANT_ID
|
||||
- name: azureClientId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_ID
|
||||
- name: azureClientSecret
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_SECRET
|
||||
@@ -0,0 +1,23 @@
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
configMapGenerator:
|
||||
- name: staging-sorcerer-appsettings
|
||||
files:
|
||||
- appsettings.json
|
||||
patches:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
path: deployment_patch.yaml
|
||||
resources:
|
||||
- ../base
|
||||
- pv.yaml
|
||||
- pvc.yaml
|
||||
- secrets.yaml
|
||||
- configurations.yaml
|
||||
- keyvault.yaml
|
||||
- rbac.yaml
|
||||
- secretstore.yaml
|
||||
- statestore.yaml
|
||||
- tracing.yaml
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolume
|
||||
metadata:
|
||||
name: pv-staging-sorcerer-ceph-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
csi:
|
||||
driver: rook-ceph.cephfs.csi.ceph.com
|
||||
nodeStageSecretRef:
|
||||
name: rook-csi-cephfs-node
|
||||
namespace: rook-ceph
|
||||
volumeAttributes:
|
||||
clusterID: rook-ceph
|
||||
fsName: data
|
||||
rootPath: /
|
||||
staticVolume: "true"
|
||||
volumeHandle: pv-staging-sorcerer-ceph-archives
|
||||
persistentVolumeReclaimPolicy: Retain
|
||||
volumeMode: Filesystem
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: staging-sorcerer-ceph-archives
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
storageClassName: ""
|
||||
volumeMode: Filesystem
|
||||
volumeName: pv-staging-sorcerer-ceph-archives
|
||||
status:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
capacity:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,39 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: staging-sorcerer
|
||||
namespace: staging-sorcerer
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- staging-sorcerer-appsettings
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- azure-keyvault
|
||||
- staging-sorcerer-redis
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: staging-sorcerer
|
||||
namespace: staging-sorcerer
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: staging-sorcerer
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: staging-sorcerer
|
||||
namespace: staging-sorcerer
|
||||
@@ -0,0 +1,24 @@
|
||||
|
||||
architecture: standalone
|
||||
|
||||
replica:
|
||||
replicaCount: 1
|
||||
|
||||
auth:
|
||||
enabled: true
|
||||
sentinel: true
|
||||
password: ""
|
||||
usePasswordFiles: false
|
||||
existingSecretPasswordKey: ""
|
||||
existingSecret: staging-sorcerer-redis
|
||||
|
||||
master:
|
||||
resources:
|
||||
limits:
|
||||
ephemeral-storage: 1024Mi
|
||||
memory: 192Mi
|
||||
requests:
|
||||
cpu: 150m
|
||||
ephemeral-storage: 50Mi
|
||||
memory: 128Mi
|
||||
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: staging-sorcerer-env
|
||||
type: Opaque
|
||||
data:
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
kyverno/clone: "true"
|
||||
name: azure-keyvault
|
||||
type: Opaque
|
||||
data:
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: secretstore
|
||||
spec:
|
||||
type: secretstores.kubernetes
|
||||
version: v1
|
||||
metadata:
|
||||
- name: defaultNamespace
|
||||
value: staging-sorcerer
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: statestore
|
||||
spec:
|
||||
type: state.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: staging-sorcerer-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: staging-sorcerer-redis
|
||||
key: redis-password
|
||||
- name: actorStateStore
|
||||
value: "true"
|
||||
- name: redisDB
|
||||
value: "0"
|
||||
scopes:
|
||||
- staging-sorcerer
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: tracing
|
||||
spec:
|
||||
tracing:
|
||||
samplingRate: "1"
|
||||
otel:
|
||||
endpointAddress: "10.255.241.12:4317"
|
||||
protocol: grpc
|
||||
isSecure: false
|
||||
Reference in New Issue
Block a user