WIP: Draft: feat(atlantis): Add beta instance #63
@@ -0,0 +1,96 @@
|
||||
{
|
||||
"oidc": {
|
||||
"issuer": "https://auth.oceanbox.io/realms/oceanbox",
|
||||
"authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth",
|
||||
"token_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/token",
|
||||
"jwks_uri": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/certs",
|
||||
"userinfo_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/userinfo",
|
||||
"end_session_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/logout",
|
||||
"device_authorization_endpoint": "https://auth.oceanbox.io/realms/oceanbox/protocol/openid-connect/auth/device",
|
||||
"clientId": "atlantis",
|
||||
"clientSecret": "",
|
||||
"scopes": [
|
||||
"openid",
|
||||
"email",
|
||||
"offline_access",
|
||||
"profile"
|
||||
],
|
||||
"audiences": [
|
||||
"atlantis",
|
||||
"atlantis_dev",
|
||||
"sorcerer",
|
||||
"sorcerer_dev"
|
||||
]
|
||||
},
|
||||
"sso": {
|
||||
"cookieDomain": ".oceanbox.io",
|
||||
"cookieName": ".obx.beta",
|
||||
"ttl": 12.0,
|
||||
"signedOutRedirectUri": "https://maps.oceanbox.io",
|
||||
"realm": "atlantis",
|
||||
"environment": "prod",
|
||||
"keyStore": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantis.blob.core.windows.net",
|
||||
"key": "dataprotection-keys"
|
||||
},
|
||||
"keyVault": {
|
||||
"kind": "azure",
|
||||
"uri": "https://atlantisvault.vault.azure.net",
|
||||
"key": "dataencryption-keys"
|
||||
}
|
||||
},
|
||||
"fga": {
|
||||
"apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
|
||||
"apiKey": "",
|
||||
"storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
|
||||
"modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
|
||||
},
|
||||
"sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
|
||||
"plainAuthUsers": [
|
||||
{
|
||||
"username": "admin",
|
||||
"password": "en-to-tre-fire",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
},
|
||||
{
|
||||
"username": "sorcerer",
|
||||
"password": "fire tre to en",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
},
|
||||
{
|
||||
"username": "archivist",
|
||||
"password": "en-to-tre-fire",
|
||||
"groups": [ "/oceanbox" ],
|
||||
"roles": [ "admin" ]
|
||||
}
|
||||
],
|
||||
"plume": "plume.data.oceanbox.io",
|
||||
"redis": "prod-atlantis-redis-master:6379",
|
||||
"objectStore": "https://atlantis.blob.core.windows.net",
|
||||
"connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",
|
||||
"sorcerer" : "https://sorcerer.beta.oceanbox.io",
|
||||
"allowedOrigins": [
|
||||
"https://maps.beta.oceanbox.io",
|
||||
],
|
||||
"appName": "atlantis",
|
||||
"appEnv": "beta",
|
||||
"appNamespace": "atlantis",
|
||||
"appVersion": "2.95.1",
|
||||
"otelCollector": "http://opentelemetry-collector.otel.svc:4317",
|
||||
"pubsubName": "pubsub",
|
||||
"pubsubTopic": "hipster-atlantis",
|
||||
"slurm": {
|
||||
"baseUrl": "https://slurmrestd.ekman.oceanbox.io/",
|
||||
"slurmApi": "slurm/v0.0.42/",
|
||||
"dbdApi": "slurmdbd/v0.0.42/",
|
||||
"accessToken": ""
|
||||
},
|
||||
"amqp": {
|
||||
"auth": "user:hunny-bunny",
|
||||
"host": "10.255.241.201:30673"
|
||||
},
|
||||
"fenceRadius": 1250.0
|
||||
}
|
||||
@@ -0,0 +1,2 @@
|
||||
client-id=simen.kirkvik@tromso.serit.no:simkir-tilt-atlantis
|
||||
secret=d9tInZ1XpeDAxD.DySv'*SB=P
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: slurm-events
|
||||
spec:
|
||||
type: bindings.rabbitmq
|
||||
version: v1
|
||||
metadata:
|
||||
- name: host
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-rabbitmq
|
||||
key: connString
|
||||
- name: queueName
|
||||
value: prod-slurm-job-events
|
||||
- name: durable
|
||||
value: true
|
||||
- name: contentType
|
||||
value: "application/json"
|
||||
- name: route
|
||||
value: /events/slurm
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1,20 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: configstore
|
||||
spec:
|
||||
type: configuration.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: prod-atlantis-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-redis
|
||||
key: redis-password
|
||||
- name: redisDB
|
||||
value: "1"
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1 @@
|
||||
OIDC_CLIENT_SECRET=KOJ6bDHzE5vdyfSrzgwLjtM5PzA809Zm
|
||||
@@ -0,0 +1,10 @@
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: azure-keyvault
|
||||
- op: add
|
||||
path: /spec/template/spec/containers/0/envFrom/-
|
||||
value:
|
||||
secretRef:
|
||||
name: prod-atlantis-env
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: azure-keyvault
|
||||
spec:
|
||||
type: secretstores.azure.keyvault
|
||||
version: v1
|
||||
metadata:
|
||||
- name: vaultName
|
||||
value: atlantisvault
|
||||
- name: azureTenantId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_TENANT_ID
|
||||
- name: azureClientId
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_ID
|
||||
- name: azureClientSecret
|
||||
secretKeyRef:
|
||||
name: azure-keyvault
|
||||
key: AZURE_CLIENT_SECRET
|
||||
@@ -0,0 +1,24 @@
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
configMapGenerator:
|
||||
- name: prod-atlantis-appsettings
|
||||
files:
|
||||
- appsettings.json
|
||||
patches:
|
||||
- target:
|
||||
group: apps
|
||||
version: v1
|
||||
kind: Deployment
|
||||
path: deployment_patch.yaml
|
||||
resources:
|
||||
- ../base
|
||||
- secrets.yaml
|
||||
- rbac.yaml
|
||||
- tracing.yaml
|
||||
- bindings.yaml
|
||||
- pubsub.yaml
|
||||
- statestore.yaml
|
||||
- subscriptions.yaml
|
||||
- configurations.yaml
|
||||
- secretstore.yaml
|
||||
- keyvault.yaml
|
||||
@@ -0,0 +1,52 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: pubsub
|
||||
spec:
|
||||
version: v1
|
||||
type: pubsub.rabbitmq
|
||||
metadata:
|
||||
- name: hostname
|
||||
value: prod-rabbitmq.rabbitmq
|
||||
- name: username
|
||||
value: user
|
||||
- name: password
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-rabbitmq
|
||||
key: rabbitmq-password
|
||||
- name: protocol
|
||||
value: amqp
|
||||
- name: durable
|
||||
value: true
|
||||
- name: deletedWhenUnused
|
||||
value: false
|
||||
- name: autoAck
|
||||
value: false
|
||||
- name: deliveryMode
|
||||
value: 1
|
||||
- name: requeueInFailure
|
||||
value: false
|
||||
- name: prefetchCount
|
||||
value: 0
|
||||
- name: reconnectWait
|
||||
value: 0
|
||||
- name: concurrencyMode
|
||||
value: parallel
|
||||
- name: publisherConfirm
|
||||
value: false
|
||||
- name: backOffPolicy
|
||||
value: exponential
|
||||
- name: backOffInitialInterval
|
||||
value: 100
|
||||
- name: backOffMaxRetries
|
||||
value: 16
|
||||
- name: enableDeadLetter # Optional enable dead Letter or not
|
||||
value: true
|
||||
- name: maxLen # Optional max message count in a queue
|
||||
value: 3000
|
||||
- name: maxLenBytes # Optional maximum length in bytes of a queue.
|
||||
value: 10485760
|
||||
- name: exchangeKind
|
||||
value: fanout
|
||||
- name: clientName
|
||||
value: "{appID}"
|
||||
@@ -0,0 +1,40 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: prod-atlantis
|
||||
namespace: prod-atlantis
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- prod-atlantis-appsettings
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- azure-keyvault
|
||||
- prod-atlantis-redis
|
||||
- slurm-access-token
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- watch
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: prod-atlantis
|
||||
namespace: prod-atlantis
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: prod-atlantis
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: prod-atlantis
|
||||
namespace: prod-atlantis
|
||||
@@ -0,0 +1,9 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
annotations:
|
||||
kyverno/clone: "true"
|
||||
kyverno/env: "prod"
|
||||
name: prod-atlantis-rabbitmq
|
||||
type: Opaque
|
||||
data:
|
||||
@@ -0,0 +1,10 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: secretstore
|
||||
spec:
|
||||
type: secretstores.kubernetes
|
||||
version: v1
|
||||
metadata:
|
||||
- name: defaultNamespace
|
||||
value: prod-atlantis
|
||||
@@ -0,0 +1,22 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Component
|
||||
metadata:
|
||||
name: statestore
|
||||
spec:
|
||||
type: state.redis
|
||||
version: v1
|
||||
metadata:
|
||||
- name: redisHost
|
||||
value: prod-atlantis-redis-master:6379
|
||||
- name: redisUsername
|
||||
value: default
|
||||
- name: redisPassword
|
||||
secretKeyRef:
|
||||
name: prod-atlantis-redis
|
||||
key: redis-password
|
||||
- name: actorStateStore
|
||||
value: "true"
|
||||
- name: redisDB
|
||||
value: "0"
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: dapr.io/v2alpha1
|
||||
kind: Subscription
|
||||
metadata:
|
||||
name: hipster-events
|
||||
spec:
|
||||
topic: hipster
|
||||
routes:
|
||||
default: /events/hipster
|
||||
pubsubname: pubsub
|
||||
metadata:
|
||||
queueType: quorum
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
---
|
||||
apiVersion: dapr.io/v2alpha1
|
||||
kind: Subscription
|
||||
metadata:
|
||||
name: inbox-events
|
||||
spec:
|
||||
topic: inbox
|
||||
routes:
|
||||
default: /events/inbox
|
||||
pubsubname: pubsub
|
||||
metadata:
|
||||
queueType: quorum
|
||||
scopes:
|
||||
- prod-atlantis
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: dapr.io/v1alpha1
|
||||
kind: Configuration
|
||||
metadata:
|
||||
name: tracing
|
||||
spec:
|
||||
tracing:
|
||||
samplingRate: "1"
|
||||
otel:
|
||||
endpointAddress: "opentelemetry-collector.otel.svc.cluster.local:4317"
|
||||
protocol: grpc
|
||||
isSecure: false
|
||||
Reference in New Issue
Block a user