Skip to content

Commit dad91f0

Browse files
MooseQuestMooseQuest
committed
Inital reimport from production
1 parent 75b76ae commit dad91f0

File tree

67 files changed

+61321
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+61321
-0
lines changed

‎k8s-preprod/infra/cert-manager.yaml

Lines changed: 8603 additions & 0 deletions
Large diffs are not rendered by default.

‎k8s-preprod/infra/ingress-nginx.yaml

Lines changed: 293 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,293 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: ingress-nginx
5+
labels:
6+
app.kubernetes.io/name: ingress-nginx
7+
app.kubernetes.io/part-of: ingress-nginx
8+
9+
---
10+
11+
kind: ConfigMap
12+
apiVersion: v1
13+
metadata:
14+
name: nginx-configuration
15+
namespace: ingress-nginx
16+
labels:
17+
app.kubernetes.io/name: ingress-nginx
18+
app.kubernetes.io/part-of: ingress-nginx
19+
data:
20+
http-snippet: |
21+
proxy_cache_path /tmp/nginx-cache levels=1:2 keys_zone=static-cache:2m max_size=100m inactive=7d use_temp_path=off;
22+
23+
---
24+
kind: ConfigMap
25+
apiVersion: v1
26+
metadata:
27+
name: tcp-services
28+
namespace: ingress-nginx
29+
labels:
30+
app.kubernetes.io/name: ingress-nginx
31+
app.kubernetes.io/part-of: ingress-nginx
32+
33+
---
34+
kind: ConfigMap
35+
apiVersion: v1
36+
metadata:
37+
name: udp-services
38+
namespace: ingress-nginx
39+
labels:
40+
app.kubernetes.io/name: ingress-nginx
41+
app.kubernetes.io/part-of: ingress-nginx
42+
43+
---
44+
apiVersion: v1
45+
kind: ServiceAccount
46+
metadata:
47+
name: nginx-ingress-serviceaccount
48+
namespace: ingress-nginx
49+
labels:
50+
app.kubernetes.io/name: ingress-nginx
51+
app.kubernetes.io/part-of: ingress-nginx
52+
53+
---
54+
apiVersion: rbac.authorization.k8s.io/v1beta1
55+
kind: ClusterRole
56+
metadata:
57+
name: nginx-ingress-clusterrole
58+
labels:
59+
app.kubernetes.io/name: ingress-nginx
60+
app.kubernetes.io/part-of: ingress-nginx
61+
rules:
62+
- apiGroups:
63+
- ""
64+
resources:
65+
- configmaps
66+
- endpoints
67+
- nodes
68+
- pods
69+
- secrets
70+
verbs:
71+
- list
72+
- watch
73+
- apiGroups:
74+
- ""
75+
resources:
76+
- nodes
77+
verbs:
78+
- get
79+
- apiGroups:
80+
- ""
81+
resources:
82+
- services
83+
verbs:
84+
- get
85+
- list
86+
- watch
87+
- apiGroups:
88+
- ""
89+
resources:
90+
- events
91+
verbs:
92+
- create
93+
- patch
94+
- apiGroups:
95+
- "extensions"
96+
- "networking.k8s.io"
97+
resources:
98+
- ingresses
99+
verbs:
100+
- get
101+
- list
102+
- watch
103+
- apiGroups:
104+
- "extensions"
105+
- "networking.k8s.io"
106+
resources:
107+
- ingresses/status
108+
verbs:
109+
- update
110+
111+
---
112+
apiVersion: rbac.authorization.k8s.io/v1beta1
113+
kind: Role
114+
metadata:
115+
name: nginx-ingress-role
116+
namespace: ingress-nginx
117+
labels:
118+
app.kubernetes.io/name: ingress-nginx
119+
app.kubernetes.io/part-of: ingress-nginx
120+
rules:
121+
- apiGroups:
122+
- ""
123+
resources:
124+
- configmaps
125+
- pods
126+
- secrets
127+
- namespaces
128+
verbs:
129+
- get
130+
- apiGroups:
131+
- ""
132+
resources:
133+
- configmaps
134+
resourceNames:
135+
# Defaults to "<election-id>-<ingress-class>"
136+
# Here: "<ingress-controller-leader>-<nginx>"
137+
# This has to be adapted if you change either parameter
138+
# when launching the nginx-ingress-controller.
139+
- "ingress-controller-leader-nginx"
140+
verbs:
141+
- get
142+
- update
143+
- apiGroups:
144+
- ""
145+
resources:
146+
- configmaps
147+
verbs:
148+
- create
149+
- apiGroups:
150+
- ""
151+
resources:
152+
- endpoints
153+
verbs:
154+
- get
155+
156+
---
157+
apiVersion: rbac.authorization.k8s.io/v1beta1
158+
kind: RoleBinding
159+
metadata:
160+
name: nginx-ingress-role-nisa-binding
161+
namespace: ingress-nginx
162+
labels:
163+
app.kubernetes.io/name: ingress-nginx
164+
app.kubernetes.io/part-of: ingress-nginx
165+
roleRef:
166+
apiGroup: rbac.authorization.k8s.io
167+
kind: Role
168+
name: nginx-ingress-role
169+
subjects:
170+
- kind: ServiceAccount
171+
name: nginx-ingress-serviceaccount
172+
namespace: ingress-nginx
173+
174+
---
175+
apiVersion: rbac.authorization.k8s.io/v1beta1
176+
kind: ClusterRoleBinding
177+
metadata:
178+
name: nginx-ingress-clusterrole-nisa-binding
179+
labels:
180+
app.kubernetes.io/name: ingress-nginx
181+
app.kubernetes.io/part-of: ingress-nginx
182+
roleRef:
183+
apiGroup: rbac.authorization.k8s.io
184+
kind: ClusterRole
185+
name: nginx-ingress-clusterrole
186+
subjects:
187+
- kind: ServiceAccount
188+
name: nginx-ingress-serviceaccount
189+
namespace: ingress-nginx
190+
191+
---
192+
193+
apiVersion: apps/v1
194+
kind: Deployment
195+
metadata:
196+
name: nginx-ingress-controller
197+
namespace: ingress-nginx
198+
labels:
199+
app.kubernetes.io/name: ingress-nginx
200+
app.kubernetes.io/part-of: ingress-nginx
201+
spec:
202+
replicas: 3
203+
selector:
204+
matchLabels:
205+
app.kubernetes.io/name: ingress-nginx
206+
app.kubernetes.io/part-of: ingress-nginx
207+
template:
208+
metadata:
209+
labels:
210+
app.kubernetes.io/name: ingress-nginx
211+
app.kubernetes.io/part-of: ingress-nginx
212+
annotations:
213+
prometheus.io/port: "10254"
214+
prometheus.io/scrape: "true"
215+
spec:
216+
serviceAccountName: nginx-ingress-serviceaccount
217+
containers:
218+
- name: nginx-ingress-controller
219+
image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.25.0
220+
args:
221+
- /nginx-ingress-controller
222+
- --configmap=$(POD_NAMESPACE)/nginx-configuration
223+
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
224+
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
225+
- --publish-service=$(POD_NAMESPACE)/ingress-nginx
226+
- --annotations-prefix=nginx.ingress.kubernetes.io
227+
securityContext:
228+
allowPrivilegeEscalation: true
229+
capabilities:
230+
drop:
231+
- ALL
232+
add:
233+
- NET_BIND_SERVICE
234+
# www-data -> 33
235+
runAsUser: 33
236+
env:
237+
- name: POD_NAME
238+
valueFrom:
239+
fieldRef:
240+
fieldPath: metadata.name
241+
- name: POD_NAMESPACE
242+
valueFrom:
243+
fieldRef:
244+
fieldPath: metadata.namespace
245+
ports:
246+
- name: http
247+
containerPort: 80
248+
- name: https
249+
containerPort: 443
250+
livenessProbe:
251+
failureThreshold: 3
252+
httpGet:
253+
path: /healthz
254+
port: 10254
255+
scheme: HTTP
256+
initialDelaySeconds: 10
257+
periodSeconds: 10
258+
successThreshold: 1
259+
timeoutSeconds: 10
260+
readinessProbe:
261+
failureThreshold: 3
262+
httpGet:
263+
path: /healthz
264+
port: 10254
265+
scheme: HTTP
266+
periodSeconds: 10
267+
successThreshold: 1
268+
timeoutSeconds: 10
269+
270+
---
271+
272+
kind: Service
273+
apiVersion: v1
274+
metadata:
275+
name: ingress-nginx
276+
namespace: ingress-nginx
277+
labels:
278+
app.kubernetes.io/name: ingress-nginx
279+
app.kubernetes.io/part-of: ingress-nginx
280+
spec:
281+
externalTrafficPolicy: Local
282+
type: LoadBalancer
283+
selector:
284+
app.kubernetes.io/name: ingress-nginx
285+
app.kubernetes.io/part-of: ingress-nginx
286+
ports:
287+
- name: http
288+
port: 80
289+
targetPort: http
290+
- name: https
291+
port: 443
292+
targetPort: https
293+

‎k8s-preprod/infra/kube-prometheus/alertmanager-alertmanager.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
apiVersion: monitoring.coreos.com/v1
2+
kind: Alertmanager
3+
metadata:
4+
labels:
5+
alertmanager: main
6+
name: main
7+
namespace: monitoring
8+
spec:
9+
image: quay.io/prometheus/alertmanager:v0.20.0
10+
nodeSelector:
11+
kubernetes.io/os: linux
12+
replicas: 3
13+
securityContext:
14+
fsGroup: 2000
15+
runAsNonRoot: true
16+
runAsUser: 1000
17+
serviceAccountName: alertmanager-main
18+
version: v0.20.0

‎k8s-preprod/infra/kube-prometheus/alertmanager-secret.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
apiVersion: v1
2+
data: {}
3+
kind: Secret
4+
metadata:
5+
name: alertmanager-main
6+
namespace: monitoring
7+
stringData:
8+
alertmanager.yaml: |-
9+
"global":
10+
"resolve_timeout": "5m"
11+
"inhibit_rules":
12+
- "equal":
13+
- "namespace"
14+
- "alertname"
15+
"source_match":
16+
"severity": "critical"
17+
"target_match_re":
18+
"severity": "warning|info"
19+
- "equal":
20+
- "namespace"
21+
- "alertname"
22+
"source_match":
23+
"severity": "warning"
24+
"target_match_re":
25+
"severity": "info"
26+
"receivers":
27+
- "name": "Default"
28+
- "name": "Watchdog"
29+
- "name": "Critical"
30+
"route":
31+
"group_by":
32+
- "namespace"
33+
"group_interval": "5m"
34+
"group_wait": "30s"
35+
"receiver": "Default"
36+
"repeat_interval": "12h"
37+
"routes":
38+
- "match":
39+
"alertname": "Watchdog"
40+
"receiver": "Watchdog"
41+
- "match":
42+
"severity": "critical"
43+
"receiver": "Critical"
44+
type: Opaque

‎k8s-preprod/infra/kube-prometheus/alertmanager-service.yaml

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
labels:
5+
alertmanager: main
6+
name: alertmanager-main
7+
namespace: monitoring
8+
spec:
9+
ports:
10+
- name: web
11+
port: 9093
12+
targetPort: web
13+
selector:
14+
alertmanager: main
15+
app: alertmanager
16+
sessionAffinity: ClientIP

‎k8s-preprod/infra/kube-prometheus/alertmanager-serviceAccount.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: alertmanager-main
5+
namespace: monitoring

‎k8s-preprod/infra/kube-prometheus/alertmanager-serviceMonitor.yaml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: monitoring.coreos.com/v1
2+
kind: ServiceMonitor
3+
metadata:
4+
labels:
5+
k8s-app: alertmanager
6+
name: alertmanager
7+
namespace: monitoring
8+
spec:
9+
endpoints:
10+
- interval: 30s
11+
port: web
12+
selector:
13+
matchLabels:
14+
alertmanager: main

0 commit comments

Comments
 (0)