jwetzell/ontime-k8s
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add back local cluster

Browse Source
This commit is contained in:
Joel Wetzell
2025-12-29 14:34:19 -06:00
parent c7a9b86a4b
commit 670052c26d
15 changed files with 10945 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
clusters/ontime-jwetzell/configs/gateway.yaml Normal file
View File

@@ -0,0 +1,45 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
annotations:
cert-manager.io/cluster-issuer: lets-encrypt-prod
name: ontime-dev
namespace: kube-system
spec:
gatewayClassName: cilium
listeners:
- hostname: ontime-dev.jwetzell.com
name: http
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: All
- hostname: ontime-dev.jwetzell.com
name: https
port: 443
protocol: HTTPS
allowedRoutes:
namespaces:
from: All
tls:
mode: Terminate
certificateRefs:
- name: ontime-dev.jwetzell.com-tls
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: http-filter-redirect
namespace: kube-system
spec:
parentRefs:
- name: ontime-dev
sectionName: http
namespace: kube-system
rules:
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301

5
clusters/ontime-jwetzell/configs/kustomization.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- gateway.yaml
- storageclass.yaml

17
clusters/ontime-jwetzell/configs/storageclass.yaml Normal file
View File

@@ -0,0 +1,17 @@
---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
name: csi-s3
provisioner: ru.yandex.s3.csi
parameters:
mounter: rclone
bucket: stages-volume
csi.storage.k8s.io/provisioner-secret-name: csi-s3-secret
csi.storage.k8s.io/provisioner-secret-namespace: csi-s3
csi.storage.k8s.io/controller-publish-secret-name: csi-s3-secret
csi.storage.k8s.io/controller-publish-secret-namespace: csi-s3
csi.storage.k8s.io/node-stage-secret-name: csi-s3-secret
csi.storage.k8s.io/node-stage-secret-namespace: csi-s3
csi.storage.k8s.io/node-publish-secret-name: csi-s3-secret
csi.storage.k8s.io/node-publish-secret-namespace: csi-s3

10193
clusters/ontime-jwetzell/flux-system/gotk-components.yaml Normal file
View File

File diff suppressed because it is too large Load Diff

27
clusters/ontime-jwetzell/flux-system/gotk-sync.yaml Normal file
View File

@@ -0,0 +1,27 @@
# This manifest was generated by flux. DO NOT EDIT.
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: flux-system
namespace: flux-system
spec:
interval: 1m0s
ref:
branch: main
secretRef:
name: flux-system
url: ssh://git@git.jwetzell.com/jwetzell/ontime-k8s
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: flux-system
namespace: flux-system
spec:
interval: 10m0s
path: ./clusters/ontime-jwetzell
prune: true
sourceRef:
kind: GitRepository
name: flux-system

5
clusters/ontime-jwetzell/flux-system/kustomization.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- gotk-components.yaml
- gotk-sync.yaml

16
clusters/ontime-jwetzell/infrastructure.yaml Normal file
View File

@@ -0,0 +1,16 @@
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: infrastructure
namespace: flux-system
spec:
interval: 1h
retryInterval: 1m
timeout: 5m
sourceRef:
kind: GitRepository
name: flux-system
path: ./infrastructure/ontime-jwetzell
prune: true
wait: true

39
infrastructure/ontime-jwetzell/csi-s3/csi-s3.yaml Normal file
View File

@@ -0,0 +1,39 @@
---
apiVersion: v1
kind: Namespace
metadata:
name: csi-s3
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: csi-s3
namespace: csi-s3
spec:
interval: 24h
url: https://yandex-cloud.github.io/k8s-csi-s3/charts
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: csi-s3
namespace: csi-s3
spec:
interval: 30m
chart:
spec:
chart: csi-s3
version: "0.43.2"
sourceRef:
kind: HelmRepository
name: csi-s3
namespace: csi-s3
interval: 12h
values:
secret:
create: false
storageClass:
create: true
images:
provisioner: registry.k8s.io/sig-storage/csi-provisioner:v6.0.0
registrar: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.0

26
infrastructure/ontime-jwetzell/gateway-api/gateway-api.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: gateway-api
namespace: kube-system
spec:
interval: 5m
url: https://github.com/kubernetes-sigs/gateway-api
ref:
tag: v1.4.0
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: gateway-api
namespace: kube-system
spec:
interval: 10m
targetNamespace: kube-system
sourceRef:
kind: GitRepository
name: gateway-api
namespace: kube-system
path: "./config/crd"
prune: true
timeout: 1m

26
infrastructure/ontime-jwetzell/metrics-server/metrics-server.yaml Normal file
View File

@@ -0,0 +1,26 @@
---
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: metrics-server
namespace: kube-system
spec:
interval: 24h
url: https://kubernetes-sigs.github.io/metrics-server/
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: metrics-server
namespace: kube-system
spec:
interval: 30m
chart:
spec:
chart: metrics-server
version: "3.13.0"
sourceRef:
kind: HelmRepository
name: metrics-server
namespace: kube-system
interval: 12h

34
infrastructure/ontime-jwetzell/ontime-operator/cluster-role-binding.yaml Normal file
View File

@@ -0,0 +1,34 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: edit-namespaces
rules:
- apiGroups: [""]
resources: ["namespaces"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: edit-stages-clusterrolebinding
subjects:
- kind: ServiceAccount
name: stage-editor
namespace: ontime-operator
roleRef:
kind: ClusterRole
name: ontime-operator-stage-editor-role
apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: edit-namespaces-clusterrolebinding
subjects:
- kind: ServiceAccount
name: stage-editor
namespace: ontime-operator
roleRef:
kind: ClusterRole
name: edit-namespaces
apiGroup: rbac.authorization.k8s.io

402
infrastructure/ontime-jwetzell/ontime-operator/deploy.yaml Normal file
View File

@@ -0,0 +1,402 @@
apiVersion: v1
kind: Namespace
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
control-plane: controller-manager
name: ontime-operator
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
name: stages.cloud.getontime.no
spec:
group: cloud.getontime.no
names:
kind: Stage
listKind: StageList
plural: stages
singular: stage
scope: Namespaced
versions:
- name: v1
schema:
openAPIV3Schema:
description: Stage is the Schema for the stages API
properties:
apiVersion:
description: 'APIVersion defines the versioned schema of this representation
of an object. Servers should convert recognized schemas to the latest
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
type: string
kind:
description: 'Kind is a string value representing the REST resource this
object represents. Servers may infer this from the endpoint the client
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
type: string
metadata:
type: object
spec:
description: Spec defines the desired state of Stage
type: object
x-kubernetes-preserve-unknown-fields: true
status:
description: Status defines the observed state of Stage
type: object
x-kubernetes-preserve-unknown-fields: true
type: object
served: true
storage: true
subresources:
status: {}
---
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
name: ontime-operator-controller-manager
namespace: ontime-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
name: ontime-operator-leader-election-role
namespace: ontime-operator
rules:
- apiGroups:
- ""
resources:
- configmaps
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- coordination.k8s.io
resources:
- leases
verbs:
- get
- list
- watch
- create
- update
- patch
- delete
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: ontime-operator-manager-role
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- secrets
verbs:
- '*'
- apiGroups:
- ""
resources:
- configmaps
verbs:
- '*'
- apiGroups:
- ""
resources:
- events
verbs:
- create
- apiGroups:
- cloud.getontime.no
resources:
- stages
- stages/status
- stages/finalizers
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- ""
resources:
- services
- persistentvolumeclaims
verbs:
- '*'
- apiGroups:
- apps
resources:
- deployments
verbs:
- '*'
- apiGroups:
- networking.k8s.io
resources:
- ingresses
verbs:
- '*'
- apiGroups:
- gateway.networking.k8s.io
resources:
- httproutes
verbs:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: ontime-operator-metrics-auth-role
rules:
- apiGroups:
- authentication.k8s.io
resources:
- tokenreviews
verbs:
- create
- apiGroups:
- authorization.k8s.io
resources:
- subjectaccessreviews
verbs:
- create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: ontime-operator-metrics-reader
rules:
- nonResourceURLs:
- /metrics
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
name: ontime-operator-stage-admin-role
rules:
- apiGroups:
- cloud.getontime.no
resources:
- stages
verbs:
- '*'
- apiGroups:
- cloud.getontime.no
resources:
- stages/status
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
name: ontime-operator-stage-editor-role
rules:
- apiGroups:
- cloud.getontime.no
resources:
- stages
verbs:
- create
- delete
- get
- list
- patch
- update
- watch
- apiGroups:
- cloud.getontime.no
resources:
- stages/status
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
name: ontime-operator-stage-viewer-role
rules:
- apiGroups:
- cloud.getontime.no
resources:
- stages
verbs:
- get
- list
- watch
- apiGroups:
- cloud.getontime.no
resources:
- stages/status
verbs:
- get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
name: ontime-operator-leader-election-rolebinding
namespace: ontime-operator
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ontime-operator-leader-election-role
subjects:
- kind: ServiceAccount
name: ontime-operator-controller-manager
namespace: ontime-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
name: ontime-operator-manager-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: ontime-operator-manager-role
subjects:
- kind: ServiceAccount
name: ontime-operator-controller-manager
namespace: ontime-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: ontime-operator-metrics-auth-rolebinding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: ontime-operator-metrics-auth-role
subjects:
- kind: ServiceAccount
name: ontime-operator-controller-manager
namespace: ontime-operator
---
apiVersion: v1
kind: Service
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
control-plane: controller-manager
name: ontime-operator-controller-manager-metrics-service
namespace: ontime-operator
spec:
ports:
- name: https
port: 8443
protocol: TCP
targetPort: 8443
selector:
app.kubernetes.io/name: ontime-operator
control-plane: controller-manager
---
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app.kubernetes.io/managed-by: kustomize
app.kubernetes.io/name: ontime-operator
control-plane: controller-manager
name: ontime-operator-controller-manager
namespace: ontime-operator
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: ontime-operator
control-plane: controller-manager
template:
metadata:
annotations:
kubectl.kubernetes.io/default-container: manager
labels:
app.kubernetes.io/name: ontime-operator
control-plane: controller-manager
spec:
containers:
- args:
- --metrics-require-rbac
- --metrics-secure
- --metrics-bind-address=:8443
- --leader-elect
- --leader-election-id=ontime-operator
- --health-probe-bind-address=:8081
image: git.jwetzell.com/jwetzell/ontime-operator:v1.7.2
livenessProbe:
httpGet:
path: /healthz
port: 8081
initialDelaySeconds: 15
periodSeconds: 20
name: manager
ports: []
readinessProbe:
httpGet:
path: /readyz
port: 8081
initialDelaySeconds: 5
periodSeconds: 10
resources:
limits:
cpu: 500m
memory: 128Mi
requests:
cpu: 10m
memory: 64Mi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
volumeMounts: []
securityContext:
runAsNonRoot: true
seccompProfile:
type: RuntimeDefault
serviceAccountName: ontime-operator-controller-manager
terminationGracePeriodSeconds: 10
volumes: []

7
infrastructure/ontime-jwetzell/ontime-operator/kustomization.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ./cluster-role-binding.yaml
- ./deploy.yaml
- ./namespace-prefix-policy.yaml
- ./service-account.yaml

98
infrastructure/ontime-jwetzell/ontime-operator/namespace-prefix-policy.yaml Normal file
View File

@@ -0,0 +1,98 @@
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: "force-ns-prefix-for-stage-editor"
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups: [""]
apiVersions: ["v1"]
operations: ["CREATE", "UPDATE"]
resources: ["namespaces"]
matchConditions:
- name: 'only-stage-editor'
expression: "request.userInfo.username == 'system:serviceaccount:ontime-operator:stage-editor'"
validations:
- expression: "object.metadata.name.startsWith('team-')"
message: "All namespaces managed by stage-editor must start with 'team-'"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: "force-ns-prefix-for-stage-editor-binding"
spec:
policyName: "force-ns-prefix-for-stage-editor"
validationActions: [Deny]
matchResources:
resourceRules:
- apiGroups: [""]
apiVersions: ["v1"]
operations: ["CREATE", "UPDATE"]
resources: ["namespaces"]
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: "force-ns-prefix-for-stage-create-update"
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups: ["cloud.getontime.no"]
apiVersions: ["v1"]
operations: ["CREATE", "UPDATE"]
resources: ["stages"]
matchConditions:
- name: 'only-stage-editor'
expression: "request.userInfo.username == 'system:serviceaccount:ontime-operator:stage-editor'"
validations:
- expression: "object.metadata.namespace.startsWith('team-')"
message: "Stages must be managed in namespaces starting with 'team-'"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: "force-ns-prefix-for-stage-create-update-binding"
spec:
policyName: "force-ns-prefix-for-stage-create-update"
validationActions: [Deny]
matchResources:
resourceRules:
- apiGroups: ["cloud.getontime.no"]
apiVersions: ["v1"]
operations: ["CREATE", "UPDATE"]
resources: ["stages"]
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: "force-ns-prefix-for-stage-editor-delete"
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups: ["cloud.getontime.no"]
apiVersions: ["v1"]
operations: ["DELETE"]
resources: ["stages"]
matchConditions:
- name: 'only-stage-editor'
expression: "request.userInfo.username == 'system:serviceaccount:ontime-operator:stage-editor'"
validations:
- expression: "request.namespace.startsWith('team-')"
message: "Stages must be managed in namespaces starting with 'team-'"
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: "force-ns-prefix-for-stage-editor-delete-binding"
spec:
policyName: "force-ns-prefix-for-stage-editor-delete"
validationActions: [Deny]
matchResources:
resourceRules:
- apiGroups: ["cloud.getontime.no"]
apiVersions: ["v1"]
operations: ["DELETE"]
resources: ["stages"]

5
infrastructure/ontime-jwetzell/ontime-operator/service-account.yaml Normal file
View File

@@ -0,0 +1,5 @@
apiVersion: v1
kind: ServiceAccount
metadata:
name: stage-editor
namespace: ontime-operator