sa_8001/dsk-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

dsk-dev kubespray 이동

Browse Source
This commit is contained in:
ByeonJungHun
2023-12-19 14:31:22 +09:00
parent a35325e16b
commit 5671a92148
2568 changed files with 0 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-cm.yml.j2 Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: registry-config
namespace: {{ registry_namespace }}
{% if registry_config %}
data:
config.yml: |-
{{ registry_config | to_yaml(indent=2, width=1337) | indent(width=4) }}
{% endif %}

15
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-cr.yml.j2 Normal file
View File

@@ -0,0 +1,15 @@
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: psp:registry
namespace: {{ registry_namespace }}
rules:
- apiGroups:
- policy
resourceNames:
- registry
resources:
- podsecuritypolicies
verbs:
- use

13
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-crb.yml.j2 Normal file
View File

@@ -0,0 +1,13 @@
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: psp:registry
namespace: {{ registry_namespace }}
subjects:
- kind: ServiceAccount
name: registry
namespace: {{ registry_namespace }}
roleRef:
kind: ClusterRole
name: psp:registry
apiGroup: rbac.authorization.k8s.io

27
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-ing.yml.j2 Normal file
View File

@@ -0,0 +1,27 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: registry
namespace: {{ registry_namespace }}
{% if registry_ingress_annotations %}
annotations:
{{ registry_ingress_annotations | to_nice_yaml(indent=2, width=1337) | indent(width=4) }}
{% endif %}
spec:
{% if registry_ingress_tls_secret %}
tls:
- hosts:
- {{ registry_ingress_host }}
secretName: {{ registry_ingress_tls_secret }}
{% endif %}
rules:
- host: {{ registry_ingress_host }}
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: registry
port:
number: {{ registry_port }}

7
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-ns.yml.j2 Normal file
View File

@@ -0,0 +1,7 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: {{ registry_namespace }}
labels:
name: {{ registry_namespace }}

44
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-psp.yml.j2 Normal file
View File

@@ -0,0 +1,44 @@
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: registry
annotations:
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'runtime/default'
{% if apparmor_enabled %}
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
{% endif %}
labels:
addonmanager.kubernetes.io/mode: Reconcile
spec:
privileged: false
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
volumes:
- 'configMap'
- 'emptyDir'
- 'projected'
- 'secret'
- 'downwardAPI'
- 'persistentVolumeClaim'
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: 'RunAsAny'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: false

15
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-pvc.yml.j2 Normal file
View File

@@ -0,0 +1,15 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: registry-pvc
namespace: {{ registry_namespace }}
labels:
addonmanager.kubernetes.io/mode: Reconcile
spec:
accessModes:
- {{ registry_storage_access_mode }}
storageClassName: {{ registry_storage_class }}
resources:
requests:
storage: {{ registry_disk_size }}

115
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-rs.yml.j2 Normal file
View File

@@ -0,0 +1,115 @@
---
apiVersion: apps/v1
kind: ReplicaSet
metadata:
name: registry
namespace: {{ registry_namespace }}
labels:
k8s-app: registry
version: v{{ registry_image_tag }}
addonmanager.kubernetes.io/mode: Reconcile
spec:
{% if registry_storage_class != "" and registry_storage_access_mode == "ReadWriteMany" %}
replicas: {{ registry_replica_count }}
{% else %}
replicas: 1
{% endif %}
selector:
matchLabels:
k8s-app: registry
version: v{{ registry_image_tag }}
template:
metadata:
labels:
k8s-app: registry
version: v{{ registry_image_tag }}
spec:
priorityClassName: {% if registry_namespace == 'kube-system' %}system-cluster-critical{% else %}k8s-cluster-critical{% endif %}{{''}}
serviceAccountName: registry
securityContext:
fsGroup: 1000
runAsUser: 1000
containers:
- name: registry
image: {{ registry_image_repo }}:{{ registry_image_tag }}
imagePullPolicy: {{ k8s_image_pull_policy }}
command:
- /bin/registry
- serve
- /etc/docker/registry/config.yml
env:
- name: REGISTRY_HTTP_ADDR
value: :{{ registry_port }}
- name: REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY
value: /var/lib/registry
{% if registry_htpasswd != "" %}
- name: REGISTRY_AUTH
value: "htpasswd"
- name: REGISTRY_AUTH_HTPASSWD_REALM
value: "Registry Realm"
- name: REGISTRY_AUTH_HTPASSWD_PATH
value: "/auth/htpasswd"
{% endif %}
{% if registry_tls_secret != "" %}
- name: REGISTRY_HTTP_TLS_CERTIFICATE
value: /etc/ssl/docker/tls.crt
- name: REGISTRY_HTTP_TLS_KEY
value: /etc/ssl/docker/tls.key
{% endif %}
volumeMounts:
- name: registry-pvc
mountPath: /var/lib/registry
- name: registry-config
mountPath: /etc/docker/registry
{% if registry_htpasswd != "" %}
- name: auth
mountPath: /auth
readOnly: true
{% endif %}
{% if registry_tls_secret != "" %}
- name: tls-cert
mountPath: /etc/ssl/docker
readOnly: true
{% endif %}
ports:
- containerPort: {{ registry_port }}
name: registry
protocol: TCP
livenessProbe:
httpGet:
{% if registry_tls_secret != "" %}
scheme: HTTPS
{% endif %}
path: /
port: {{ registry_port }}
readinessProbe:
httpGet:
{% if registry_tls_secret != "" %}
scheme: HTTPS
{% endif %}
path: /
port: {{ registry_port }}
volumes:
- name: registry-pvc
{% if registry_storage_class != "" %}
persistentVolumeClaim:
claimName: registry-pvc
{% else %}
emptyDir: {}
{% endif %}
- name: registry-config
configMap:
name: registry-config
{% if registry_htpasswd != "" %}
- name: auth
secret:
secretName: registry-secret
items:
- key: htpasswd
path: htpasswd
{% endif %}
{% if registry_tls_secret != "" %}
- name: tls-cert
secret:
secretName: {{ registry_tls_secret }}
{% endif %}

5
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-sa.yml.j2 Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: registry
namespace: {{ registry_namespace }}

10
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-secrets.yml.j2 Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: v1
kind: Secret
metadata:
name: registry-secret
namespace: {{ registry_namespace }}
type: Opaque
data:
{% if registry_htpasswd != "" %}
htpasswd: {{ registry_htpasswd | b64encode }}
{% endif %}

32
ansible/kubespray/roles/kubernetes-apps/registry/templates/registry-svc.yml.j2 Normal file
View File

@@ -0,0 +1,32 @@
---
apiVersion: v1
kind: Service
metadata:
name: registry
namespace: {{ registry_namespace }}
labels:
k8s-app: registry
addonmanager.kubernetes.io/mode: Reconcile
kubernetes.io/name: "KubeRegistry"
{% if registry_service_annotations %}
annotations:
{{ registry_service_annotations | to_nice_yaml(indent=2, width=1337) | indent(width=4) }}
{% endif %}
spec:
selector:
k8s-app: registry
type: {{ registry_service_type }}
{% if registry_service_type == "ClusterIP" and registry_service_cluster_ip != "" %}
clusterIP: {{ registry_service_cluster_ip }}
{% endif %}
{% if registry_service_type == "LoadBalancer" and registry_service_loadbalancer_ip != "" %}
loadBalancerIP: {{ registry_service_loadbalancer_ip }}
{% endif %}
ports:
- name: registry
port: {{ registry_port }}
protocol: TCP
targetPort: {{ registry_port }}
{% if registry_service_type == "NodePort" and registry_service_nodeport != "" %}
nodePort: {{ registry_service_nodeport }}
{% endif %}