j00lz/strato-infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Add keel

Browse source
This commit is contained in:
Julius 2022-05-24 09:12:16 +02:00
parent f3c81040d1
commit a62cbc5180
Signed by: j00lz
GPG key ID: AF241B0AA237BBA2
11 changed files with 220 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

101
flux/cluster/apps/keel/deployment.yaml Normal file
View file

@ -0,0 +1,101 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: keel
namespace: "keel"
labels:
app: keel
spec:
replicas: 1
selector:
matchLabels:
app: keel
template:
metadata:
labels:
app: keel
spec:
serviceAccountName: keel
containers:
- name: keel
# Note that we use appVersion to get images tag.
image: "keelhq/keel:latest"
imagePullPolicy: Always
command: ["/bin/keel"]
env:
- name: NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
# Enable GCR with pub/sub support
- name: PROJECT_ID
value: ""
- name: PUBSUB
value: "" # Set to '1' or 'true' to enable GCR pubsub
# Basic auth (to enable UI/API)
- name: BASIC_AUTH_USER
value: j00lz
- name: BASIC_AUTH_PASSWORD
value: admin
- name: AUTHENTICATED_WEBHOOKS
value: "false"
# Helm configuration
# Enable AWS ECR
- name: AWS_ACCESS_KEY_ID
value: ""
- name: AWS_SECRET_ACCESS_KEY
value: ""
- name: AWS_REGION
value: ""
# Enable webhook endpoint
- name: WEBHOOK_ENDPOINT
value: ""
# Enable mattermost endpoint
- name: MATTERMOST_ENDPOINT
value: ""
# Enable MS Teams webhook endpoint
- name: TEAMS_WEBHOOK_URL
value: ""
- name: SLACK_TOKEN
value: ""
- name: SLACK_CHANNELS
value: "general"
- name: SLACK_APPROVALS_CHANNEL
value: "general"
- name: SLACK_BOT_NAME
value: "keel"
# Enable hipchat approvials and notification
- name: HIPCHAT_TOKEN
value: ""
- name: HIPCHAT_CHANNELS
value: ""
- name: HIPCHAT_APPROVALS_CHANNEL
value: ""
- name: HIPCHAT_APPROVALS_BOT_NAME
value: ""
- name: HIPCHAT_APPROVALS_USER_NAME
value: ""
- name: HIPCHAT_APPROVALS_PASSWORT
value: ""
- name: NOTIFICATION_LEVEL
value: "info"
# Enable insecure registries
- name: INSECURE_REGISTRY
value: "false"
ports:
- containerPort: 9300
livenessProbe:
httpGet:
path: /healthz
port: 9300
initialDelaySeconds: 30
timeoutSeconds: 10
resources:
limits:
cpu: 100m
memory: 128Mi
requests:
cpu: 50m
memory: 64Mi

9
flux/cluster/apps/keel/kustomization.yaml Normal file
View file

@ -0,0 +1,9 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- pod-disruption-budget.yaml
- rbac.yaml
- rolebinding.yaml
- service-account.yaml
- service.yaml

10
flux/cluster/apps/keel/pod-disruption-budget.yaml Normal file
View file

@ -0,0 +1,10 @@
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
name: keel
namespace: "keel"
spec:
maxUnavailable: 1
selector:
matchLabels:
app: keel

49
flux/cluster/apps/keel/rbac.yaml Normal file
View file

@ -0,0 +1,49 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: keel
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- watch
- list
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- watch
- list
- apiGroups:
- ""
- extensions
- apps
- batch
resources:
- pods
- replicasets
- replicationcontrollers
- statefulsets
- deployments
- daemonsets
- jobs
- cronjobs
verbs:
- get
- delete # required to delete pods during force upgrade of the same tag
- watch
- list
- update
- apiGroups:
- ""
resources:
- configmaps
- pods/portforward
verbs:
- get
- create
- update

12
flux/cluster/apps/keel/rolebinding.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: keel
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: keel
subjects:
- kind: ServiceAccount
name: keel
namespace: "keel"

7
flux/cluster/apps/keel/service-account.yaml Normal file
View file

@ -0,0 +1,7 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: keel
namespace: "keel"
labels:
app: keel

17
flux/cluster/apps/keel/service.yaml Normal file
View file

@ -0,0 +1,17 @@
apiVersion: v1
kind: Service
metadata:
name: keel
namespace: "keel"
labels:
app: keel
spec:
type: LoadBalancer
ports:
- port: 9300
targetPort: 9300
protocol: TCP
name: keel
selector:
app: keel
sessionAffinity: None

1
flux/cluster/apps/kustomization.yaml
View file

@ -5,3 +5,4 @@ resources:
- authentik
- networking
- drone
- keel

6
flux/cluster/core/namespaces/keel.yaml Normal file
View file

@ -0,0 +1,6 @@
kind: Namespace
apiVersion: v1
metadata:
name: keel
labels:
name: keel

1
flux/cluster/core/namespaces/kustomization.yaml
View file

@ -6,3 +6,4 @@ resources:
- authentik.yaml
- traefik.yaml
- drone.yaml
- keel.yaml

14
nixos/machines/registry/default.nix
View file

@ -27,13 +27,13 @@
path = "/var/lib/keys/htaccess";
};
# notifications.endpoints = [{
# name = "keel";
# url = "http://10.42.20.5:9300/v1/webhooks/registry";
# timeout = "500ms";
# treshold = 5;
# backoff = "1s";
# }];
notifications.endpoints = [{
name = "keel";
url = "http://kubernetes.lxd:9300/v1/webhooks/registry";
timeout = "500ms";
treshold = 5;
backoff = "1s";
}];
};
};
systemd.services.docker-registry.serviceConfig.EnvironmentFile =