alexlebens/infrastructure
1
0
Fork 0
Code Issues 1 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

add services

Browse Source
This commit is contained in:
Alex Lebens
2025-02-17 15:56:09 -06:00
parent d2b6009a36
commit 8faacd7077
20 changed files with 6 additions and 267 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
clusters/standby/services/descheduler/Chart.yaml
View File

@@ -1,20 +0,0 @@
apiVersion: v2
name: descheduler
version: 1.0.0
description: descheduler
keywords:
- descheduler
- kube-scheduler
- kubernetes
home: https://wiki.alexlebens.dev/doc/descheduler-satPWfv7Km
sources:
- https://github.com/kubernetes-sigs/descheduler
- https://github.com/kubernetes-sigs/descheduler/tree/master/charts/descheduler
maintainers:
- name: alexlebens
dependencies:
- name: descheduler
version: 0.32.2
repository: https://kubernetes-sigs.github.io/descheduler/
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/kubernetes.png
appVersion: 0.31.0

70
clusters/standby/services/descheduler/values.yaml
View File

@@ -1,70 +0,0 @@
descheduler:
kind: Deployment
resources:
requests:
cpu: 10m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
privileged: false
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
deschedulingInterval: 5m
replicas: 1
leaderElection:
enabled: false
command:
- "/bin/descheduler"
cmdOptions:
v: 3
deschedulerPolicyAPIVersion: "descheduler/v1alpha2"
deschedulerPolicy:
profiles:
- name: default
pluginConfig:
- name: DefaultEvictor
args:
ignorePvcPods: true
evictLocalStoragePods: false
evictDaemonSetPods: false
- name: RemoveDuplicates
- name: RemovePodsViolatingNodeAffinity
args:
nodeAffinityType:
- requiredDuringSchedulingIgnoredDuringExecution
- name: RemovePodsViolatingNodeTaints
- name: RemovePodsViolatingInterPodAntiAffinity
- name: RemovePodsViolatingTopologySpreadConstraint
- name: LowNodeUtilization
args:
thresholds:
cpu: 20
memory: 20
pods: 20
targetThresholds:
cpu: 60
memory: 60
pods: 60
plugins:
balance:
enabled:
- RemoveDuplicates
- RemovePodsViolatingTopologySpreadConstraint
- LowNodeUtilization
deschedule:
enabled:
- RemovePodsViolatingNodeTaints
- RemovePodsViolatingNodeAffinity
- RemovePodsViolatingInterPodAntiAffinity
rbac:
create: true
serviceAccount:
create: true
service:
enabled: true
serviceMonitor:
enabled: true

20
clusters/standby/services/eraser/Chart.yaml
View File

@@ -1,20 +0,0 @@
apiVersion: v2
name: eraser
version: 1.0.0
description: Eraser
keywords:
- eraser
- images
- kubernetes
home: https://wiki.alexlebens.dev/doc/eraser-XPOB4BLlm7
sources:
- https://github.com/eraser-dev/eraser
- https://github.com/eraser-dev/eraser/tree/main/charts/eraser
maintainers:
- name: alexlebens
dependencies:
- name: eraser
version: v1.3.1
repository: https://eraser-dev.github.io/eraser/charts
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/kubernetes.png
appVersion: v1.3.1

70
clusters/standby/services/eraser/values.yaml
View File

@@ -1,70 +0,0 @@
eraser:
runtimeConfig:
apiVersion: eraser.sh/v1alpha3
kind: EraserConfig
manager:
runtime:
name: containerd
address: unix:///run/containerd/containerd.sock
logLevel: info
scheduling:
repeatInterval: 24h
beginImmediately: true
profile:
enabled: false
port: 6060
imageJob:
successRatio: 1.0
cleanup:
delayOnSuccess: 0s
delayOnFailure: 24h
nodeFilter:
type: exclude
selectors:
- eraser.sh/cleanup.filter
- kubernetes.io/os=windows
components:
collector:
enabled: true
request:
cpu: 10m
memory: 128Mi
scanner:
enabled: false
request:
cpu: 100m
memory: 128Mi
config: "" # |
# cacheDir: /var/lib/trivy
# dbRepo: ghcr.io/aquasecurity/trivy-db
# deleteFailedImages: true
# deleteEOLImages: true
# vulnerabilities:
# ignoreUnfixed: true
# types:
# - os
# - library
# securityChecks:
# - vuln
# severities:
# - CRITICAL
# - HIGH
# - MEDIUM
# - LOW
# ignoredStatuses:
# timeout:
# total: 23h
# perImage: 1h
remover:
request:
cpu: 10m
memory: 128Mi
deploy:
securityContext:
allowPrivilegeEscalation: false
resources:
requests:
cpu: 10m
memory: 30Mi
nodeSelector:
kubernetes.io/os: linux

22
clusters/standby/services/external-dns/Chart.yaml
View File

@@ -1,22 +0,0 @@
apiVersion: v2
name: external-dns
version: 1.0.0
description: External DNS
keywords:
- external-dns
- dns
- unifi
- kubernetes
home: https://wiki.alexlebens.dev/doc/external-dns-Zdhuh9NAT1
sources:
- https://github.com/kubernetes-sigs/external-dns
- https://github.com/kubernetes-sigs/external-dns/tree/master/charts/external-dns
maintainers:
- name: alexlebens
dependencies:
- name: external-dns
alias: external-dns-unifi
version: 1.15.1
repository: https://kubernetes-sigs.github.io/external-dns/
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/kubernetes.png
appVersion: 1.15.0

160
clusters/standby/services/external-dns/templates/dns-endpoint.yaml
View File

@@ -1,160 +0,0 @@
apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
name: external-device-names
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: external-device-names
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: networking
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
endpoints:
# Unifi UDM
- dnsName: unifi.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.1
# Synology Web
- dnsName: synology.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.55
# Synology Storage
- dnsName: synologybond.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.194
# HD Homerun
- dnsName: hdhr.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.213
# Pi KVM
- dnsName: pikvm.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.57
---
apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
name: iot-device-names
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: iot-device-names
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: networking
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
endpoints:
# Airgradient
- dnsName: it01ag.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.100
# Phillips Hue
- dnsName: it02ph.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.57
# TubesZB ZigBee
- dnsName: it03tb.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.193
# TubesZB Z-Wave
- dnsName: it04tb.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.135
---
apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
name: host-names
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: host-names
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: networking
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
endpoints:
# Surface Book 3
- dnsName: pl01wd.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.86
# Synology
- dnsName: ps02sn.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.55
# Synology Storage
- dnsName: ps02sn-bond.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.194
# Desktop
- dnsName: pd05wd.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.115
---
apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
name: cluster-names
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: cluster-names
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: networking
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
endpoints:
# Control
- dnsName: cl01tl.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.35
- 192.168.1.36
- 192.168.1.37
# Workers
- dnsName: cl01tl-endpoint.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.15
- 192.168.1.16
- 192.168.1.17
# Traefik ps08rp
- dnsName: traefik-cl01tl.alexlebens.net
recordTTL: 180
recordType: A
targets:
- 192.168.1.15
- 192.168.1.16
- 192.168.1.17

30
clusters/standby/services/external-dns/templates/external-secret.yaml
View File

@@ -1,30 +0,0 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: external-dns-unifi-secret
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: external-dns-unifi-secret
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: web
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: username
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /unifi/auth
metadataPolicy: None
property: user
- secretKey: password
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /unifi/auth
metadataPolicy: None
property: password

51
clusters/standby/services/external-dns/values.yaml
View File

@@ -1,51 +0,0 @@
external-dns-unifi:
fullnameOverride: external-dns-unifi
serviceMonitor:
enabled: true
interval: 1m
sources:
- ingress
- crd
- gateway-httproute
- gateway-tlsroute
policy: sync
registry: txt
txtOwnerId: default
txtPrefix: k8s.
domainFilters: ["alexlebens.net"]
excludeDomains: []
provider:
name: webhook
webhook:
image:
repository: ghcr.io/kashalls/external-dns-unifi-webhook
tag: v0.4.1
env:
- name: UNIFI_HOST
value: https://192.168.1.1
- name: UNIFI_USER
valueFrom:
secretKeyRef:
name: external-dns-unifi-secret
key: username
- name: UNIFI_PASS
valueFrom:
secretKeyRef:
name: external-dns-unifi-secret
key: password
- name: LOG_LEVEL
value: debug
livenessProbe:
httpGet:
path: /healthz
port: http-webhook
initialDelaySeconds: 10
timeoutSeconds: 5
readinessProbe:
httpGet:
path: /readyz
port: http-webhook
initialDelaySeconds: 10
timeoutSeconds: 5
extraArgs:
- --ignore-ingress-tls-spec

21
clusters/standby/services/spegel/Chart.yaml
View File

@@ -1,21 +0,0 @@
apiVersion: v2
name: spegel
version: 1.0.0
description: Spegel
keywords:
- spegel
- image
- cache
- kubernetes
home: https://wiki.alexlebens.dev/doc/spegel-sGOCkqO5Gu
sources:
- https://github.com/spegel-org/spegel
- https://github.com/spegel-org/spegel/tree/main/charts/spegel
maintainers:
- name: alexlebens
dependencies:
- name: spegel
version: v0.0.30
repository: oci://ghcr.io/spegel-org/helm-charts
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/kubernetes.png
appVersion: v0.0.27

6
clusters/standby/services/spegel/templates/namespace.yaml
View File

@@ -1,6 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: spegel
labels:
pod-security.kubernetes.io/enforce: privileged

41
clusters/standby/services/spegel/values.yaml
View File

@@ -1,41 +0,0 @@
spegel:
service:
registry:
port: 5000
nodePort: 30021
hostPort: 30020
topologyAwareHintsEnabled: true
router:
port: 5001
metrics:
port: 9090
resources:
requests:
cpu: 10m
memory: 64Mi
nodeSelector:
kubernetes.io/os: linux
tolerations:
- key: CriticalAddonsOnly
operator: Exists
- effect: NoExecute
operator: Exists
- effect: NoSchedule
operator: Exists
serviceMonitor:
enabled: true
priorityClassName: system-node-critical
spegel:
logLevel: "INFO"
registries:
- https://cgr.dev
- https://docker.io
- https://ghcr.io
- https://quay.io
- https://mcr.microsoft.com
- https://public.ecr.aws
- https://gcr.io
- https://registry.k8s.io
- https://k8s.gcr.io
- https://lscr.io
containerdRegistryConfigPath: /etc/cri/conf.d/hosts

23
clusters/standby/services/tailscale-operator/Chart.yaml
View File

@@ -1,23 +0,0 @@
apiVersion: v2
name: tailscale-operator
version: 1.0.0
description: Tailscale Operator
keywords:
- tailscale-operator
- tailscale
- wireguard
- vpn
- kubernetes
home: https://wiki.alexlebens.dev/doc/tailscale-operator-u9TCoCqP12
sources:
- https://github.com/tailscale/tailscale/tree/main/cmd/k8s-operator/deploy
- https://hub.docker.com/r/tailscale/k8s-operator
- https://github.com/tailscale/tailscale/tree/main/cmd/k8s-operator/deploy/chart
maintainers:
- name: alexlebens
dependencies:
- name: tailscale-operator
version: 1.80.0
repository: https://pkgs.tailscale.com/helmcharts
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/tailscale.png
appVersion: v1.78.3

17
clusters/standby/services/tailscale-operator/templates/connector.yaml
View File

@@ -1,17 +0,0 @@
apiVersion: tailscale.com/v1alpha1
kind: Connector
metadata:
name: subnet-router-local
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: subnet-router-local
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: tailscale
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
hostname: subnet-router-local-cl01tl
proxyClass: default
subnetRouter:
advertiseRoutes:
- 192.168.1.0/24

16
clusters/standby/services/tailscale-operator/templates/dns-config.yaml
View File

@@ -1,16 +0,0 @@
apiVersion: tailscale.com/v1alpha1
kind: DNSConfig
metadata:
name: ts-dns
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: ts-dns
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: tailscale
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
nameserver:
image:
repo: tailscale/k8s-nameserver
tag: unstable-v1.79.213

30
clusters/standby/services/tailscale-operator/templates/external-secrets.yaml
View File

@@ -1,30 +0,0 @@
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: operator-oauth
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: operator-oauth
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: web
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
secretStoreRef:
kind: ClusterSecretStore
name: vault
data:
- secretKey: client_id
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/tailscale/operator/oauth
metadataPolicy: None
property: clientId
- secretKey: client_secret
remoteRef:
conversionStrategy: Default
decodingStrategy: None
key: /cl01tl/tailscale/operator/oauth
metadataPolicy: None
property: clientSecret

26
clusters/standby/services/tailscale-operator/templates/proxy-class.yaml
View File

@@ -1,26 +0,0 @@
apiVersion: tailscale.com/v1alpha1
kind: ProxyClass
metadata:
name: default
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: default
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: proxy
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
metrics:
enable: true
serviceMonitor:
enable: true
statefulSet:
pod:
tailscaleContainer:
resources:
limits:
squat.ai/tun: "1"
tailscaleInitContainer:
resources:
limits:
squat.ai/tun: "1"

21
clusters/standby/services/tailscale-operator/values.yaml
View File

@@ -1,21 +0,0 @@
tailscale-operator:
oauth: {}
installCRDs: true
operatorConfig:
defaultTags:
- "tag:k8s-operator"
logging: info
hostname: tailscale-operator-cl01tl
nodeSelector:
kubernetes.io/os: linux
operatorConfig:
securityContext:
capabilities:
add:
- NET_ADMIN
proxyConfig:
defaultTags: "tag:k8s"
firewallMode: auto
defaultProxyClass: "default"
apiServerProxyConfig:
mode: "false"

21
clusters/standby/services/traefik/Chart.yaml
View File

@@ -1,21 +0,0 @@
apiVersion: v2
name: traefik
version: 1.0.0
description: Traefik
keywords:
- traefik
- reverse-proxy
- tls
- kubernetes
home: https://wiki.alexlebens.dev/doc/traefik-nMRQxYCVUF
sources:
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik-helm-chart
maintainers:
- name: alexlebens
dependencies:
- name: traefik
version: 34.2.0
repository: https://traefik.github.io/charts
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/traefik.png
appVersion: v3.2.3

19
clusters/standby/services/traefik/templates/certificate.yaml
View File

@@ -1,19 +0,0 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: traefik-certificate
namespace: {{ .Release.Namespace }}
labels:
app.kubernetes.io/name: {{ .Release.Name }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: {{ .Chart.AppVersion }}
app.kubernetes.io/component: web
app.kubernetes.io/part-of: {{ .Release.Name }}
spec:
secretName: traefik-secret-tls
dnsNames:
- "alexlebens.net"
- "*.alexlebens.net"
issuerRef:
name: letsencrypt-issuer
kind: ClusterIssuer

88
clusters/standby/services/traefik/values.yaml
View File

@@ -1,88 +0,0 @@
traefik:
deployment:
kind: DaemonSet
ingressClass:
enabled: true
isDefaultClass: true
ingressRoute:
dashboard:
enabled: true
matchRule: (Host(`traefik-cl01tl.alexlebens.net`) && (PathPrefix(`/api/`) || PathPrefix(`/dashboard/`)))
entryPoints: ["websecure"]
providers:
kubernetesCRD:
allowCrossNamespace: true
allowEmptyServices: true
kubernetesIngress:
allowEmptyServices: true
publishedService:
enabled: true
metrics:
prometheus:
service:
enabled: true
disableAPICheck:
serviceMonitor:
enabled: true
prometheusRule:
enabled: false
globalArguments: []
ports:
web:
expose:
default: true
exposedPort: 80
redirections:
entryPoint:
to: websecure
scheme: https
permanent: true
forwardedHeaders:
trustedIPs:
- 10.0.0.0/8
- 172.16.0.0/16
- 192.168.0.0/16
- fc00::/7
insecure: false
proxyProtocol:
trustedIPs:
- 10.0.0.0/8
- 172.16.0.0/16
- 192.168.0.0/16
- fc00::/7
insecure: false
websecure:
port: 8443
expose:
default: true
exposedPort: 443
forwardedHeaders:
trustedIPs:
- 10.0.0.0/8
- 172.16.0.0/16
- 192.168.0.0/16
- fc00::/7
insecure: false
proxyProtocol:
trustedIPs:
- 10.0.0.0/8
- 172.16.0.0/16
- 192.168.0.0/16
- fc00::/7
insecure: false
tls:
enabled: true
metrics:
expose:
default: false
tlsStore:
default:
defaultCertificate:
secretName: traefik-secret-tls
service:
enabled: true
type: LoadBalancer
externalIPs:
- 192.168.1.17
- 192.168.1.16
- 192.168.1.15