Skip to content

Commit 2cf31ff

Browse files
svcAPLBotsvcAPLBot
authored
Merge branch 'main' into ci-update-cloudnative-pg-to-0.27.0
2 parents 64d289e + b8c16dd commit 2cf31ff

File tree

6 files changed

+141
-25
lines changed

6 files changed

+141
-25
lines changed

‎values/harbor/harbor-raw.gotmpl‎

Lines changed: 44 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{{- $v := .Values }}
2+
{{- $cm := $v.apps | get "cert-manager" }}
23
{{- $h := $v.apps.harbor }}
34
{{- $harborDomain := printf "harbor.%s" $v.cluster.domainSuffix }}
45
{{- $otomiAdmin := "otomi-admin" }}
@@ -32,21 +33,60 @@ resources:
3233
issuerRef:
3334
name: custom-ca
3435
kind: ClusterIssuer
36+
- apiVersion: v1
37+
kind: Secret
38+
metadata:
39+
name: harbor-admin-password
40+
data:
41+
HARBOR_ADMIN_PASSWORD: "{{ $h.adminPassword | b64enc }}"
42+
- apiVersion: v1
43+
kind: Secret
44+
metadata:
45+
name: harbor-registry-credentials
46+
data:
47+
REGISTRY_PASSWD: "{{ $h.registry.credentials.password | b64enc }}"
48+
REGISTRY_HTPASSWD: "{{ $h.registry.credentials.htpasswd | b64enc }}"
49+
{{- if ne $h.secretKey nil }}
50+
- apiVersion: v1
51+
kind: Secret
52+
metadata:
53+
name: harbor-secret-key
54+
data:
55+
secretKey: "{{ $h.secretKey | b64enc }}"
56+
- apiVersion: v1
57+
kind: Secret
58+
metadata:
59+
name: harbor-core-secret
60+
data:
61+
secret: "{{ $h.core.secret | b64enc }}"
62+
{{- end }}
63+
- apiVersion: v1
64+
kind: Secret
65+
metadata:
66+
name: harbor-jobservice-secret
67+
data:
68+
JOBSERVICE_SECRET: "{{ $h.jobservice.secret | default "" | b64enc }}"
69+
- apiVersion: v1
70+
kind: Secret
71+
metadata:
72+
name: harbor-registry-http
73+
data:
74+
REGISTRY_HTTP_SECRET: "{{ $h.registry.secret | default "" | b64enc }}"
3575
{{- if eq $obj.type "minioLocal" }}
3676
- apiVersion: v1
3777
kind: Secret
3878
metadata:
3979
name: minio-creds
4080
data:
41-
MINIO_ACCESS_KEY: "{{ $otomiAdmin | b64enc }}"
42-
MINIO_SECRET_KEY: "{{ $v.otomi.adminPassword | b64enc }}"
81+
REGISTRY_STORAGE_S3_ACCESSKEY: "{{ $otomiAdmin | b64enc }}"
82+
REGISTRY_STORAGE_S3_SECRETKEY: "{{ $v.otomi.adminPassword | b64enc }}"
4383
{{- end }}
4484
{{- if eq $obj.type "linode" }}
4585
- apiVersion: v1
4686
kind: Secret
4787
metadata:
4888
name: linode-creds
4989
data:
50-
S3_STORAGE_ACCOUNT: "{{ $obj.linode.accessKeyId | b64enc }}"
51-
S3_STORAGE_KEY: "{{ $obj.linode.secretAccessKey | b64enc }}"
90+
REGISTRY_STORAGE_S3_ACCESSKEY: "{{ $obj.linode.accessKeyId | b64enc }}"
91+
REGISTRY_STORAGE_S3_SECRETKEY: "{{ $obj.linode.secretAccessKey | b64enc }}"
5292
{{- end }}

‎values/harbor/harbor.gotmpl‎

Lines changed: 8 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ fullnameOverride: harbor
1414
# logLevel - debug, info, warning, error or fatal
1515
logLevel: warning
1616

17-
harborAdminPassword: {{ $h.adminPassword | quote }}
17+
existingSecretAdminPassword: harbor-admin-password
1818
nameOverride: harbor
19-
secretKey: {{ $h | get "secretKey" nil }}
19+
existingSecretSecretKey: harbor-secret-key
2020

2121
updateStrategy:
2222
type: Recreate
@@ -30,8 +30,7 @@ core:
3030
{{- end }}
3131

3232
resources: {{- $h.resources.core | toYaml | nindent 4 }}
33-
secret: {{ $h | get "core.secret" nil | quote }}
34-
# secretName: {{ $harborSecretName }}
33+
existingSecret: harbor-core-secret
3534
xsrfKey: {{ $h | get "core.xsrfKey" nil }}
3635

3736
database:
@@ -68,7 +67,7 @@ jobservice:
6867
jobLoggers:
6968
- stdout
7069
resources: {{- $h.resources.jobservice | toYaml | nindent 4 }}
71-
secret: {{ $h | get "jobservice.secret" nil | quote }}
70+
existingSecret: harbor-jobservice-secret
7271

7372
metrics:
7473
serviceMonitor:
@@ -131,16 +130,14 @@ persistence:
131130
bucket: harbor
132131
region: us-east-1
133132
regionendpoint: http://minio.minio.svc.cluster.local:9000
134-
accesskey: otomi-admin
135-
secretkey: {{ $v.otomi.adminPassword | quote }}
133+
existingSecret: minio-creds
136134
secure: false
137135
v4auth: true
138136
{{- end }}
139137
{{- if eq $obj.type "linode" }}
140138
bucket: {{ $obj.linode.buckets.harbor }}
141139
regionendpoint: https://{{ $obj.linode.region }}.linodeobjects.com
142-
accesskey: {{ $obj.linode.accessKeyId }}
143-
secretkey: {{ $obj.linode.secretAccessKey | quote }}
140+
existingSecret: linode-creds
144141
region: {{ $obj.linode.region }}
145142
encrypt: false
146143
secure: true
@@ -174,7 +171,7 @@ redis:
174171

175172
registry:
176173
priorityClassName: otomi-critical
177-
secret: {{ $h | get "registry.secret" nil | quote }}
174+
existingSecret: harbor-registry-http
178175

179176
registry:
180177
{{- if $v.otomi.linodeLkeImageRepository }}
@@ -191,8 +188,7 @@ registry:
191188
relativeurls: false
192189
credentials:
193190
username: {{ $h.registry.credentials.username }}
194-
password: {{ $h.registry.credentials.password | quote }}
195-
htpasswdString: {{ $h.registry.credentials.htpasswd }}
191+
existingSecret: harbor-registry-credentials
196192

197193
trivy:
198194
priorityClassName: otomi-critical

‎values/loki/loki-raw.gotmpl‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
{{- $v := .Values }}
22
{{- $l := $v.apps | get "loki" }}
3+
{{- $otomiAdmin := "otomi-admin" }}
4+
{{- $obj := $v.obj.provider }}
35
{{- if $v.otomi.isMultitenant }}
46
resources:
57
- apiVersion: v1
@@ -10,4 +12,28 @@ resources:
1012
name: reverse-proxy-auth-config
1113
data:
1214
authn.yaml: {{ tpl (readFile "auth-config.gotmpl") (dict "adminPassword" $l.adminPassword "teams" $v.teamConfig) | b64enc }}
13-
{{- end }}
15+
{{- if eq $obj.type "linode" }}
16+
- apiVersion: v1
17+
kind: Secret
18+
metadata:
19+
labels:
20+
app: loki
21+
name: loki-s3-linode-credentials
22+
type: Opaque
23+
data:
24+
AWS_ACCESS_KEY_ID: "{{ $obj.linode.accessKeyId | b64enc }}"
25+
AWS_SECRET_ACCESS_KEY: "{{ $obj.linode.secretAccessKey | b64enc }}"
26+
{{- end }}
27+
{{- if eq $obj.type "minioLocal" }}
28+
- apiVersion: v1
29+
kind: Secret
30+
metadata:
31+
labels:
32+
app: loki
33+
name: loki-s3-minio-credentials
34+
type: Opaque
35+
data:
36+
AWS_ACCESS_KEY_ID: "{{ $otomiAdmin | b64enc }}"
37+
AWS_SECRET_ACCESS_KEY: "{{ $v.otomi.adminPassword | b64enc }}"
38+
{{- end }}
39+
{{- end }}

‎values/loki/loki.gotmpl‎

Lines changed: 50 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22
{{- $l:= $v.apps.loki }}
33
{{- $obj := $v.obj.provider }}
44
{{- $useObjectStorage := eq $obj.type "minioLocal" "linode" }}
5+
{{- $s3SecretName := "" }}
6+
{{- if $useObjectStorage }}
7+
{{- if eq $obj.type "linode" }}
8+
{{- $s3SecretName = "loki-s3-linode-credentials" }}
9+
{{- else if eq $obj.type "minioLocal" }}
10+
{{- $s3SecretName = "loki-s3-minio-credentials" }}
11+
{{- end }}
12+
{{- end }}
513

614
nameOverride: loki
715

@@ -30,6 +38,7 @@ loki:
3038
podAnnotations:
3139
sidecar.istio.io/inject: "false"
3240
auth_enabled: true
41+
3342
schemaConfig:
3443
configs:
3544
- from: "2020-09-07"
@@ -43,6 +52,7 @@ loki:
4352
index:
4453
prefix: loki_index_
4554
period: 24h
55+
4656
storageConfig:
4757
boltdb_shipper:
4858
active_index_directory: /var/loki/index
@@ -55,13 +65,13 @@ loki:
5565
{{- end }}
5666
{{- if $useObjectStorage }}
5767
aws:
58-
{{- if eq $obj.type "minioLocal" }}
59-
s3: http://otomi-admin:{{ $v.otomi.adminPassword }}@minio.minio.svc.cluster.local.:9000/loki
60-
s3forcepathstyle: true
61-
{{- end }}
6268
{{- if eq $obj.type "linode" }}
63-
s3: https://{{ $obj.linode.accessKeyId }}:{{ $obj.linode.secretAccessKey }}@{{ $obj.linode.region }}.linodeobjects.com/{{ $obj.linode.buckets.loki }}
69+
s3: s3://{{ $obj.linode.region }}.linodeobjects.com/{{ $obj.linode.buckets.loki }}
70+
{{- else if eq $obj.type "minioLocal" }}
71+
s3: s3://@minio.minio.svc.cluster.local:9000/loki
72+
{{- end }}
6473
s3forcepathstyle: true
74+
{{- if eq $obj.type "linode" }}
6575
sse_encryption: false
6676
http_config:
6777
idle_conn_timeout: 90s
@@ -85,6 +95,12 @@ loki:
8595
ingester:
8696
resources: {{- $l.resources.ingester | toYaml | nindent 4 }}
8797

98+
{{- if $s3SecretName }}
99+
extraEnvFrom:
100+
- secretRef:
101+
name: {{ $s3SecretName }}
102+
{{- end }}
103+
88104
autoscaling:
89105
enabled: {{ $l.autoscaling.ingester.enabled }}
90106
minReplicas: {{ $l.autoscaling.ingester.minReplicas }}
@@ -107,6 +123,13 @@ gateway:
107123

108124
querier:
109125
resources: {{- $l.resources.querier | toYaml | nindent 4 }}
126+
127+
{{- if $s3SecretName }}
128+
extraEnvFrom:
129+
- secretRef:
130+
name: {{ $s3SecretName }}
131+
{{- end }}
132+
110133
autoscaling:
111134
enabled: {{ $l.autoscaling.querier.enabled }}
112135
minReplicas: {{ $l.autoscaling.querier.minReplicas }}
@@ -123,6 +146,13 @@ querier:
123146

124147
distributor:
125148
resources: {{- $l.resources.distributor | toYaml | nindent 4 }}
149+
150+
{{- if $s3SecretName }}
151+
extraEnvFrom:
152+
- secretRef:
153+
name: {{ $s3SecretName }}
154+
{{- end }}
155+
126156
autoscaling:
127157
enabled: {{ $l.autoscaling.distributor.enabled }}
128158
minReplicas: {{ $l.autoscaling.distributor.minReplicas }}
@@ -134,6 +164,13 @@ queryFrontend:
134164
resources: {{- $l.resources.queryFrontend | toYaml | nindent 4 }}
135165
podAnnotations:
136166
checksum/team-config: {{ ( toString (keys $v.teamConfig | sortAlpha ) ) | sha256sum }}
167+
168+
{{- if $s3SecretName }}
169+
extraEnvFrom:
170+
- secretRef:
171+
name: {{ $s3SecretName }}
172+
{{- end }}
173+
137174
autoscaling:
138175
enabled: {{ $l.autoscaling.queryFrontend.enabled }}
139176
minReplicas: {{ $l.autoscaling.queryFrontend.minReplicas }}
@@ -160,10 +197,12 @@ queryFrontend:
160197
volumeMounts:
161198
- name: reverse-proxy-auth-config
162199
mountPath: /etc/reverse-proxy-conf
200+
163201
extraVolumes:
164202
- name: reverse-proxy-auth-config
165203
secret:
166204
secretName: reverse-proxy-auth-config
205+
167206
extraPorts:
168207
- port: 3101
169208
protocol: TCP
@@ -174,6 +213,12 @@ compactor:
174213
enabled: true
175214
resources: {{- $l.resources.compactor | toYaml | nindent 4 }}
176215

216+
{{- if $s3SecretName }}
217+
extraEnvFrom:
218+
- secretRef:
219+
name: {{ $s3SecretName }}
220+
{{- end }}
221+
177222
{{- if not $useObjectStorage }}
178223
persistence:
179224
enabled: true

‎values/oauth2-proxy/oauth2-proxy-raw.gotmpl‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,21 @@
11
{{- $v := .Values }}
2+
{{- $k := $v.apps.keycloak }}
3+
{{- $oauth2 := $v.apps | get "oauth2-proxy" }}
24
{{- $escapedDomain := $v.cluster.domainSuffix | replace "." "\\." }}
35
{{- $consoleUrl := printf "https://console.%s" $v.cluster.domainSuffix }}
46
{{- $cm := $v.apps | get "cert-manager" }}
57
{{- $ingress := $v.ingress.platformClass }}
68

79
resources:
10+
- apiVersion: v1
11+
kind: Secret
12+
metadata:
13+
name: oauth2-proxy-client-access
14+
type: Opaque
15+
data:
16+
client-id: {{ $k.idp.clientID | b64enc }}
17+
client-secret: {{ $k.idp.clientSecret | b64enc }}
18+
cookie-secret: {{ $oauth2 | get "config.cookieSecret" (randAlpha 32) | b64enc }}
819
- apiVersion: networking.k8s.io/v1
920
kind: Ingress
1021
metadata:

‎values/oauth2-proxy/oauth2-proxy.gotmpl‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,7 @@
2121
{{- $domains = append $domains (print "." $v.cluster.domainSuffix) }}
2222

2323
config:
24-
clientID: {{ $k.idp.clientID | quote }}
25-
clientSecret: {{ $k.idp.clientSecret | quote }}
26-
cookieSecret: {{ $oauth2 | get "config.cookieSecret" (randAlpha 16) }}
24+
existingSecret: oauth2-proxy-client-access
2725
configFile: |-
2826
# Defaults
2927
email_domains = [ "*" ]

0 commit comments

Comments
 (0)