Migrate k8s config from Terraform to Argo CD + ESO
Phase 1: Install External Secrets Operator via Argo CD app - apps/external-secrets.yaml — ESO Helm chart install - apps/external-secrets-config.yaml — ClusterSecretStore deployment - k8s/external-secrets/cluster-secret-store.yaml — Vault backend using vault-token Secret Phase 2: Create k8s manifests for all services - k8s/neuron/ — PVC, ConfigMap, ExternalSecrets (neuron-secrets, cloudflared-secret), Ingress - k8s/gitea/ — PVC, ConfigMap (custom CSS), ExternalSecret (gitea-db), Ingress - k8s/github-runner/ — ExternalSecret (github-runner-secret) - k8s/gitea-runner/ — ExternalSecret (gitea-runner-secret) - k8s/monitoring/ — ExternalSecrets (grafana, slack), Alloy OTLP service+middleware, datasources ConfigMap, Ingress - k8s/postgres/ — ExternalSecret (postgres-passwords) - k8s/vault/ — ExternalSecret (vault-gcp-sa from Vault) - k8s/adguard/ — PVCs, ConfigMap, Certificate, Ingress, ddclient Deployment+ExternalSecret - k8s/ollama/ — PVC, Ingress - k8s/headscale/ — PVC - k8s/packages/ — PVCs, ConfigMap, Ingresses - k8s/registry/ — PVC, Ingresses - k8s/backup/ — CronJob, ExternalSecret (backup-credentials) New Argo CD apps for Helm releases: - apps/kube-prometheus-stack.yaml, loki.yaml, tempo.yaml, alloy.yaml - apps/postgres.yaml, redis.yaml, vault.yaml New Argo CD apps for k8s config paths: - apps/neuron-config, gitea-config, ci-config, gitea-runner-config - apps/monitoring-config, adguard-config, ollama-config, headscale-config - apps/packages-config, registry-config, postgres-config, vault-config, backup Phase 3: Strip Terraform to infrastructure-only - All kubernetes_* and helm_release resources removed from service .tf files - Each service .tf now contains only kubernetes_namespace (bootstrap dependency) - variables.tf stripped to only cloudflare_api_key, cloudflare_email, gitea_api_token - namespaces.tf gains external-secrets namespace - ingress.tf, backup.tf, ddclient.tf emptied (resources in k8s/) - cert-manager.tf, argocd.tf, traefik.tf unchanged (bootstrap)
This commit is contained in:
Will Anderson
@@ -0,0 +1,15 @@
|
||||
---
|
||||
# TLS certificate for DoT (DNS-over-TLS) on dot.nook.family:853
|
||||
# Issued via cert-manager DNS-01 challenge (Cloudflare)
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: adguard-dot-tls
|
||||
namespace: dns
|
||||
spec:
|
||||
secretName: adguard-dot-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-prod
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- dot.nook.family
|
||||
@@ -0,0 +1,59 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: adguard-defaults
|
||||
namespace: dns
|
||||
data:
|
||||
AdGuardHome.yaml: |
|
||||
dns:
|
||||
bind_hosts:
|
||||
- 0.0.0.0
|
||||
port: 53
|
||||
upstream_dns:
|
||||
- https://dns.cloudflare.com/dns-query
|
||||
- https://dns.google/dns-query
|
||||
bootstrap_dns:
|
||||
- 1.1.1.1
|
||||
- 8.8.8.8
|
||||
- 9.9.9.10
|
||||
- 149.112.112.10
|
||||
upstream_mode: load_balance
|
||||
cache_enabled: true
|
||||
cache_size: 4194304
|
||||
filters:
|
||||
- enabled: true
|
||||
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt
|
||||
name: AdGuard DNS filter
|
||||
id: 1
|
||||
- enabled: true
|
||||
url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt
|
||||
name: AdAway Default Blocklist
|
||||
id: 2
|
||||
- enabled: true
|
||||
url: https://big.oisd.nl/domainswild
|
||||
name: OISD Big
|
||||
id: 3
|
||||
- enabled: true
|
||||
url: https://easylist.to/easylist/easylist.txt
|
||||
name: EasyList
|
||||
id: 4
|
||||
- enabled: true
|
||||
url: https://easylist.to/easylist/easyprivacy.txt
|
||||
name: EasyPrivacy
|
||||
id: 5
|
||||
tls:
|
||||
enabled: true
|
||||
server_name: dot.nook.family
|
||||
port_dns_over_tls: 853
|
||||
certificate_path: /etc/adguard/tls/tls.crt
|
||||
private_key_path: /etc/adguard/tls/tls.key
|
||||
allow_unencrypted_doh: true
|
||||
filtering:
|
||||
filtering_enabled: true
|
||||
rewrites:
|
||||
- domain: '*.nook.family'
|
||||
answer: 192.168.68.77
|
||||
enabled: true
|
||||
- domain: '*.neuralplatform.ai'
|
||||
answer: 192.168.68.77
|
||||
enabled: true
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# ddclient — dynamic DNS daemon keeping dot.nook.family pointed at home public IP
|
||||
# Updates Cloudflare A record every 5 minutes (required for DoT port 853, no CF proxy)
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ddclient
|
||||
namespace: dns
|
||||
labels:
|
||||
app: ddclient
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ddclient
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ddclient
|
||||
spec:
|
||||
containers:
|
||||
- name: ddclient
|
||||
image: ghcr.io/ddclient/ddclient:latest
|
||||
command: ["ddclient", "-file", "/etc/ddclient/ddclient.conf", "-daemon", "300", "-noquiet", "-foreground"]
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /etc/ddclient/ddclient.conf
|
||||
subPath: ddclient.conf
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 32Mi
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64Mi
|
||||
volumes:
|
||||
- name: config
|
||||
secret:
|
||||
secretName: ddclient-config
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# ddclient-config — Cloudflare credentials for dynamic DNS updates
|
||||
# cloudflare_api_key and cloudflare_email stored in Vault at secret/cloudflare
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: ddclient-config
|
||||
namespace: dns
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: ddclient-config
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
data:
|
||||
ddclient.conf: |
|
||||
daemon=300
|
||||
syslog=yes
|
||||
pid=/var/run/ddclient/ddclient.pid
|
||||
use=web, web=https://api.ipify.org
|
||||
|
||||
protocol=cloudflare
|
||||
zone=nook.family
|
||||
ttl=120
|
||||
login={{ .cloudflare_email }}
|
||||
password={{ .cloudflare_api_key }}
|
||||
dot.nook.family
|
||||
data:
|
||||
- secretKey: cloudflare_api_key
|
||||
remoteRef:
|
||||
key: secret/data/cloudflare
|
||||
property: api_key
|
||||
- secretKey: cloudflare_email
|
||||
remoteRef:
|
||||
key: secret/data/cloudflare
|
||||
property: email
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: adguard
|
||||
namespace: dns
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- dns.nook.family
|
||||
secretName: adguard-tls
|
||||
rules:
|
||||
- host: dns.nook.family
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: adguard-ui
|
||||
port:
|
||||
number: 3000
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: adguard-config
|
||||
namespace: dns
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: adguard-data
|
||||
namespace: dns
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -0,0 +1,95 @@
|
||||
---
|
||||
# Nightly backup — dumps Postgres + Gitea data to Cloudflare R2 via restic
|
||||
# Schedule: 2am daily. Retains 30 daily / 12 weekly / 6 monthly snapshots.
|
||||
apiVersion: batch/v1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: gitea-backup
|
||||
namespace: git
|
||||
spec:
|
||||
schedule: "0 2 * * *"
|
||||
concurrencyPolicy: Forbid
|
||||
failedJobsHistoryLimit: 3
|
||||
successfulJobsHistoryLimit: 3
|
||||
jobTemplate:
|
||||
spec:
|
||||
backoffLimit: 2
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
initContainers:
|
||||
- name: pg-dump
|
||||
image: postgres:18-alpine
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- >-
|
||||
pg_dumpall
|
||||
-h postgres-postgresql.platform.svc.cluster.local
|
||||
-U postgres
|
||||
--no-role-passwords
|
||||
> /dump/all-databases.sql
|
||||
&& echo 'DB dump complete, size:' $(du -sh /dump/all-databases.sql)
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: backup-credentials
|
||||
volumeMounts:
|
||||
- name: dump
|
||||
mountPath: /dump
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 256Mi
|
||||
containers:
|
||||
- name: backup
|
||||
image: restic/restic:latest
|
||||
command:
|
||||
- /bin/sh
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
|
||||
# Init repo if first run
|
||||
restic snapshots 2>/dev/null || restic init
|
||||
|
||||
# Back up Gitea data + full DB dump
|
||||
echo "Running restic backup..."
|
||||
restic backup \
|
||||
/gitea-data \
|
||||
/dump/all-databases.sql \
|
||||
--tag legion \
|
||||
--host legion
|
||||
|
||||
# Prune old snapshots
|
||||
restic forget \
|
||||
--keep-daily 30 \
|
||||
--keep-weekly 12 \
|
||||
--keep-monthly 6 \
|
||||
--prune
|
||||
|
||||
echo "Backup complete."
|
||||
restic snapshots --latest 3
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: backup-credentials
|
||||
volumeMounts:
|
||||
- name: gitea-data
|
||||
mountPath: /gitea-data
|
||||
readOnly: true
|
||||
- name: dump
|
||||
mountPath: /dump
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: gitea-data
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-data
|
||||
readOnly: true
|
||||
- name: dump
|
||||
emptyDir: {}
|
||||
@@ -0,0 +1,35 @@
|
||||
---
|
||||
# backup-credentials — R2 access keys + restic password + Postgres password for nightly backup
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: backup-credentials
|
||||
namespace: git
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: backup-credentials
|
||||
creationPolicy: Owner
|
||||
template:
|
||||
data:
|
||||
RESTIC_PASSWORD: "gitea-restic-2026"
|
||||
AWS_ACCESS_KEY_ID: "{{ .r2_access_key_id }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ .r2_secret_access_key }}"
|
||||
RESTIC_REPOSITORY: "s3:https://651161e0a3d321561b4c90b5bcd5f15b.r2.cloudflarestorage.com/legion-gitea-backup"
|
||||
PGPASSWORD: "{{ .postgres_password }}"
|
||||
data:
|
||||
- secretKey: r2_access_key_id
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: access_key_id
|
||||
- secretKey: r2_secret_access_key
|
||||
remoteRef:
|
||||
key: secret/data/r2
|
||||
property: secret_access_key
|
||||
- secretKey: postgres_password
|
||||
remoteRef:
|
||||
key: secret/data/legion-db
|
||||
property: postgres_password
|
||||
@@ -0,0 +1,23 @@
|
||||
---
|
||||
# ClusterSecretStore — connects ESO to Vault using the root token Secret.
|
||||
# The vault-token Secret (name: vault-token, key: token) must be created
|
||||
# via kubectl as a one-time bootstrap step before this store can sync:
|
||||
#
|
||||
# kubectl create secret generic vault-token \
|
||||
# --namespace external-secrets \
|
||||
# --from-literal=token=$(cat ~/Secrets/tokens/vault-root-token)
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: vault
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: "https://vault.neuralplatform.ai"
|
||||
path: "secret"
|
||||
version: "v2"
|
||||
auth:
|
||||
tokenSecretRef:
|
||||
name: vault-token
|
||||
namespace: external-secrets
|
||||
key: token
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
# gitea-runner-secret — Gitea act-runner registration token
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-runner-secret
|
||||
namespace: ci
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: gitea-runner-secret
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: GITEA_INSTANCE_URL
|
||||
remoteRef:
|
||||
key: secret/data/gitea
|
||||
property: instance_url
|
||||
- secretKey: GITEA_RUNNER_REGISTRATION_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/gitea
|
||||
property: runner_token
|
||||
@@ -0,0 +1,104 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: gitea-custom-css
|
||||
namespace: git
|
||||
data:
|
||||
header.tmpl: |
|
||||
<link rel="stylesheet" href="/assets/css/custom.css">
|
||||
custom.css: |
|
||||
/* ── Typography & base ── */
|
||||
:root {
|
||||
--color-primary: #6366f1;
|
||||
--color-primary-dark: #4f46e5;
|
||||
--color-secondary: #8b5cf6;
|
||||
--color-bg: #0f0f17;
|
||||
--color-surface: #16161f;
|
||||
--color-surface-2: #1e1e2e;
|
||||
--color-border: #2a2a3d;
|
||||
--color-text: #e2e2f0;
|
||||
--color-text-muted: #8888aa;
|
||||
--color-green: #22d3a5;
|
||||
--radius: 10px;
|
||||
}
|
||||
|
||||
body {
|
||||
background: var(--color-bg) !important;
|
||||
color: var(--color-text) !important;
|
||||
font-family: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif !important;
|
||||
}
|
||||
|
||||
/* ── Top navbar ── */
|
||||
.navbar, #navbar {
|
||||
background: var(--color-surface) !important;
|
||||
border-bottom: 1px solid var(--color-border) !important;
|
||||
box-shadow: 0 1px 12px rgba(0,0,0,0.4) !important;
|
||||
}
|
||||
|
||||
.navbar .brand svg, .navbar .brand img { filter: brightness(1.2); }
|
||||
|
||||
/* ── Sidebar & panels ── */
|
||||
.repository, .ui.container, .ui.segment,
|
||||
.ui.card, .ui.cards > .card {
|
||||
background: var(--color-surface) !important;
|
||||
border: 1px solid var(--color-border) !important;
|
||||
border-radius: var(--radius) !important;
|
||||
}
|
||||
|
||||
/* ── Buttons ── */
|
||||
.ui.primary.button, .ui.green.button {
|
||||
background: var(--color-primary) !important;
|
||||
border: none !important;
|
||||
border-radius: 8px !important;
|
||||
}
|
||||
.ui.primary.button:hover { background: var(--color-primary-dark) !important; }
|
||||
|
||||
/* ── Inputs ── */
|
||||
input, textarea, select,
|
||||
.ui.input > input, .ui.dropdown {
|
||||
background: var(--color-surface-2) !important;
|
||||
border: 1px solid var(--color-border) !important;
|
||||
color: var(--color-text) !important;
|
||||
border-radius: 8px !important;
|
||||
}
|
||||
|
||||
/* ── Sign-in page ── */
|
||||
.user.signin .ui.segment,
|
||||
.user.signup .ui.segment {
|
||||
background: var(--color-surface) !important;
|
||||
border: 1px solid var(--color-border) !important;
|
||||
border-radius: 16px !important;
|
||||
box-shadow: 0 8px 32px rgba(0,0,0,0.5) !important;
|
||||
padding: 2.5rem !important;
|
||||
}
|
||||
|
||||
/* ── Repo file tree ── */
|
||||
.repository.file.list .file-list {
|
||||
background: var(--color-surface) !important;
|
||||
border-radius: var(--radius) !important;
|
||||
border: 1px solid var(--color-border) !important;
|
||||
}
|
||||
|
||||
.repository.file.list .file-list tr:hover td {
|
||||
background: var(--color-surface-2) !important;
|
||||
}
|
||||
|
||||
/* ── Labels & badges ── */
|
||||
.ui.label { border-radius: 6px !important; }
|
||||
|
||||
/* ── Dashboard activity feed ── */
|
||||
.feeds .news { border-bottom: 1px solid var(--color-border) !important; }
|
||||
|
||||
/* ── Code blocks ── */
|
||||
pre, code {
|
||||
background: var(--color-surface-2) !important;
|
||||
border: 1px solid var(--color-border) !important;
|
||||
border-radius: 6px !important;
|
||||
}
|
||||
|
||||
/* ── Muted footer ── */
|
||||
#footer {
|
||||
background: var(--color-surface) !important;
|
||||
border-top: 1px solid var(--color-border) !important;
|
||||
color: var(--color-text-muted) !important;
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
# gitea-db — password used by the Gitea pod to connect to Postgres
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-db
|
||||
namespace: git
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: gitea-db
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
key: secret/data/gitea
|
||||
property: db_password
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea
|
||||
namespace: git
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- git.neuralplatform.ai
|
||||
secretName: gitea-tls
|
||||
rules:
|
||||
- host: git.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: gitea
|
||||
port:
|
||||
number: 3000
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-data
|
||||
namespace: git
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
# github-runner-secret — GitHub classic PAT for runner registration
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: github-runner-secret
|
||||
namespace: ci
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: github-runner-secret
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: ACCESS_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/github
|
||||
property: classic_pat
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: headscale-data
|
||||
namespace: headscale
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
@@ -0,0 +1,11 @@
|
||||
---
|
||||
# Traefik BasicAuth middleware — strips auth before forwarding to Alloy
|
||||
# Secret alloy-otlp-auth is synced from Vault via ExternalSecret (see external-secrets.yaml)
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: alloy-otlp-auth
|
||||
namespace: monitoring
|
||||
spec:
|
||||
basicAuth:
|
||||
secret: alloy-otlp-auth
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
# Expose Alloy's OTLP HTTP port (4318) for external log/trace ingestion from RunPod pods
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: alloy-otlp
|
||||
namespace: monitoring
|
||||
labels:
|
||||
app: alloy-otlp
|
||||
spec:
|
||||
selector:
|
||||
app.kubernetes.io/name: alloy
|
||||
ports:
|
||||
- name: otlp-http
|
||||
port: 4318
|
||||
targetPort: 4318
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,23 @@
|
||||
---
|
||||
# alloy-otlp-auth — bcrypt htpasswd entry for Traefik BasicAuth middleware
|
||||
# Username: pantheon, password: alloy push token from Vault secret/alloy
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: alloy-otlp-auth
|
||||
namespace: monitoring
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: alloy-otlp-auth
|
||||
creationPolicy: Owner
|
||||
# ESO does not bcrypt — the htpasswd entry must be pre-hashed in Vault.
|
||||
# Store via: vault kv patch secret/alloy htpasswd_entry="pantheon:$(htpasswd -nbB pantheon <token> | cut -d: -f2)"
|
||||
data:
|
||||
- secretKey: users
|
||||
remoteRef:
|
||||
key: secret/data/alloy
|
||||
property: htpasswd_entry
|
||||
@@ -0,0 +1,37 @@
|
||||
---
|
||||
# Grafana extra datasources — Loki and Tempo with cross-linking
|
||||
# Discovered by Grafana sidecar via label grafana_datasource=1
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: grafana-extra-datasources
|
||||
namespace: monitoring
|
||||
labels:
|
||||
grafana_datasource: "1"
|
||||
data:
|
||||
datasources.yaml: |
|
||||
apiVersion: 1
|
||||
datasources:
|
||||
- name: Loki
|
||||
type: loki
|
||||
uid: loki
|
||||
url: http://loki-gateway.monitoring.svc.cluster.local
|
||||
access: proxy
|
||||
jsonData:
|
||||
httpHeaderName1: X-Scope-OrgID
|
||||
secureJsonData:
|
||||
httpHeaderValue1: legion
|
||||
- name: Tempo
|
||||
type: tempo
|
||||
uid: tempo
|
||||
url: http://tempo.monitoring.svc.cluster.local:3100
|
||||
access: proxy
|
||||
jsonData:
|
||||
lokiSearch:
|
||||
datasourceUid: loki
|
||||
tracesToLogsV2:
|
||||
datasourceUid: loki
|
||||
filterByTraceID: true
|
||||
filterBySpanID: false
|
||||
tracesToMetrics:
|
||||
datasourceUid: prometheus
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
# grafana-admin-secret — Grafana admin password from Vault
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: grafana-admin-secret
|
||||
namespace: monitoring
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: grafana-admin-secret
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: admin-password
|
||||
remoteRef:
|
||||
key: secret/data/grafana
|
||||
property: admin_password
|
||||
---
|
||||
# slack-bot-token — Slack bot token for Alertmanager notifications
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: slack-bot-token
|
||||
namespace: monitoring
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: slack-bot-token
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: bot_token
|
||||
remoteRef:
|
||||
key: secret/data/slack
|
||||
property: bot_token
|
||||
@@ -0,0 +1,29 @@
|
||||
---
|
||||
# Alloy OTLP HTTP ingress — external log/trace ingestion from RunPod pods
|
||||
# Auth: HTTP Basic Auth (username: pantheon, password: ALLOY_PUSH_TOKEN)
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: alloy-otlp
|
||||
namespace: monitoring
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
traefik.ingress.kubernetes.io/router.middlewares: monitoring-alloy-otlp-auth@kubernetescrd
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- alloy.neuralplatform.ai
|
||||
secretName: alloy-otlp-tls
|
||||
rules:
|
||||
- host: alloy.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: alloy-otlp
|
||||
port:
|
||||
number: 4318
|
||||
@@ -0,0 +1,27 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: neuron-config
|
||||
namespace: neuron
|
||||
data:
|
||||
MCP_PORT: "8001"
|
||||
MCP_HOST: "0.0.0.0"
|
||||
WEBHOOK_PORT: "3847"
|
||||
NEURON_DB_PATH: "/data/neuron.db"
|
||||
AXON_DB_PATH: "/data/axon.db"
|
||||
TUNNEL_NAME: "neural-platform"
|
||||
default.yaml: |
|
||||
runtime:
|
||||
name: neuron
|
||||
version: 0.1.0
|
||||
storage:
|
||||
db_path: /data/neuron.db
|
||||
cache:
|
||||
max_l1_size: 1000
|
||||
gc:
|
||||
gen0_threshold: 3
|
||||
gen1_threshold: 5
|
||||
knowledge:
|
||||
base_path: /data/knowledge
|
||||
synapse:
|
||||
path: /data/synapse
|
||||
@@ -0,0 +1,52 @@
|
||||
---
|
||||
# neuron-secrets — GITHUB_WEBHOOK_SECRET, GITEA_WEBHOOK_SECRET, SLACK_BOT_TOKEN, SLACK_SIGNING_SECRET
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: neuron-secrets
|
||||
namespace: neuron
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: neuron-secrets
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: GITHUB_WEBHOOK_SECRET
|
||||
remoteRef:
|
||||
key: secret/data/github
|
||||
property: webhook_secret
|
||||
- secretKey: GITEA_WEBHOOK_SECRET
|
||||
remoteRef:
|
||||
key: secret/data/gitea
|
||||
property: api_token
|
||||
- secretKey: SLACK_BOT_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/slack
|
||||
property: bot_token
|
||||
- secretKey: SLACK_SIGNING_SECRET
|
||||
remoteRef:
|
||||
key: secret/data/slack
|
||||
property: signing_secret
|
||||
---
|
||||
# cloudflared-secret — TUNNEL_TOKEN for the Cloudflare tunnel
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: cloudflared-secret
|
||||
namespace: neuron
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: cloudflared-secret
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: TUNNEL_TOKEN
|
||||
remoteRef:
|
||||
key: secret/data/cloudflare-tunnel
|
||||
property: token
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: neuron
|
||||
namespace: neuron
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- secretName: neuron-tls
|
||||
hosts:
|
||||
- neuron.neuralplatform.ai
|
||||
rules:
|
||||
- host: neuron.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: neuron
|
||||
port:
|
||||
number: 8001
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: neuron-data
|
||||
namespace: neuron
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
@@ -0,0 +1,25 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: ollama
|
||||
namespace: ollama
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- ollama.neuralplatform.ai
|
||||
secretName: ollama-tls
|
||||
rules:
|
||||
- host: ollama.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: ollama
|
||||
port:
|
||||
number: 11434
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: ollama-models
|
||||
namespace: ollama
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
@@ -0,0 +1,32 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: verdaccio-config
|
||||
namespace: packages
|
||||
data:
|
||||
config.yaml: |
|
||||
storage: /verdaccio/storage
|
||||
auth:
|
||||
htpasswd:
|
||||
file: /verdaccio/storage/htpasswd
|
||||
max_users: 1
|
||||
uplinks:
|
||||
npmjs:
|
||||
url: https://registry.npmjs.org/
|
||||
cache: true
|
||||
packages:
|
||||
'@harmonic-framework/*':
|
||||
access: $authenticated
|
||||
publish: $authenticated
|
||||
unpublish: $authenticated
|
||||
'**':
|
||||
access: $all
|
||||
publish: $authenticated
|
||||
proxy: npmjs
|
||||
listen: 0.0.0.0:4873
|
||||
server:
|
||||
keepAliveTimeout: 60
|
||||
log:
|
||||
type: stdout
|
||||
format: pretty
|
||||
level: http
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
# npm registry — Verdaccio
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: npm-registry
|
||||
namespace: packages
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- npm.neuralplatform.ai
|
||||
secretName: npm-registry-tls
|
||||
rules:
|
||||
- host: npm.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verdaccio
|
||||
port:
|
||||
number: 4873
|
||||
---
|
||||
# PyPI registry — devpi
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: pypi-registry
|
||||
namespace: packages
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- pypi.neuralplatform.ai
|
||||
secretName: pypi-registry-tls
|
||||
rules:
|
||||
- host: pypi.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: devpi
|
||||
port:
|
||||
number: 3141
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: verdaccio-data
|
||||
namespace: packages
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: devpi-data
|
||||
namespace: packages
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# postgres-passwords — Postgres superuser + Kong DB passwords from Vault
|
||||
# These are passed to the Bitnami postgresql chart via the app's Helm values.
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: postgres-passwords
|
||||
namespace: platform
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: postgres-passwords
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: postgres-password
|
||||
remoteRef:
|
||||
key: secret/data/legion-db
|
||||
property: postgres_password
|
||||
- secretKey: kong-db-password
|
||||
remoteRef:
|
||||
key: secret/data/legion-db
|
||||
property: kong_db_password
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
# Docker registry ingress with chunked upload middleware
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: registry
|
||||
namespace: registry
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
traefik.ingress.kubernetes.io/router.middlewares: registry-chunked@kubernetescrd
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "0"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
|
||||
nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- registry.neuralplatform.ai
|
||||
secretName: registry-tls
|
||||
rules:
|
||||
- host: registry.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: registry
|
||||
port:
|
||||
number: 5000
|
||||
---
|
||||
# Docker registry UI
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: registry-ui
|
||||
namespace: registry
|
||||
annotations:
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
tls:
|
||||
- hosts:
|
||||
- docker.neuralplatform.ai
|
||||
secretName: docker-ui-tls
|
||||
rules:
|
||||
- host: docker.neuralplatform.ai
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: registry-ui
|
||||
port:
|
||||
number: 80
|
||||
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: registry-data
|
||||
namespace: registry
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
# vault-gcp-sa — GCP service account JSON for KMS auto-unseal
|
||||
# The SA JSON is stored in Vault at secret/data/vault-gcp-sa
|
||||
# Store it: vault kv put secret/vault-gcp-sa sa_json=@vault-gcp-sa.json
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: vault-gcp-sa
|
||||
namespace: vault
|
||||
spec:
|
||||
refreshInterval: 24h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: vault-gcp-sa
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: sa.json
|
||||
remoteRef:
|
||||
key: secret/data/vault-gcp-sa
|
||||
property: sa_json
|
||||
Reference in New Issue
Block a user