-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat!: build a dubbd skeleton package with custom values and expose SSH for gitlab * Moving dubbd install to a skeleton build with custom values. A * adding gitlab ssh VS and netpols BREAKING: certificates are expected in the configuration now -- no defaults will be loaded BEGIN_COMMIT_OVERRIDE feat!: build dubbd skeleton package feat!: expose ssh for gitlab feat!: certs are expted in uds-config now END_COMMIT_OVERRIDE
- Loading branch information
1 parent
5461e5f
commit 7b019d2
Showing
16 changed files
with
306 additions
and
83 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -31,4 +31,6 @@ on_failure.sh | |
| run/ | ||
|
|
||
| # certs | ||
| *.pem | ||
| *.pem | ||
|
|
||
| scratch/ | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1 @@ | ||
| # DO NOT USE :oops-a-daisy: -- this file is only here to silence a warning | ||
| loki: | ||
| values: | ||
| # Values for Monolith strategy | ||
| singleBinary: | ||
| resources: | ||
| limits: | ||
| cpu: 100m | ||
| memory: 1024Mi | ||
| requests: | ||
| cpu: 100m | ||
| memory: 512Mi | ||
|
|
||
| monitoring: | ||
| values: | ||
| kube-state-metrics: | ||
| resources: | ||
| limits: | ||
| cpu: "500m" | ||
| memory: "1024Mi" | ||
| requests: | ||
| cpu: "10m" | ||
| memory: "512Mi" | ||
| prometheus: | ||
| prometheusSpec: | ||
| resources: | ||
| limits: | ||
| cpu: "600m" | ||
| memory: "6Gi" | ||
| requests: | ||
| cpu: "300m" | ||
| memory: "2Gi" | ||
| # DO NOT USE -- this file is only here to silence a warning |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: ingress-istio-shell | ||
| namespace: gitlab | ||
| spec: | ||
| ingress: | ||
| - from: | ||
| - namespaceSelector: | ||
| matchLabels: | ||
| app.kubernetes.io/name: istio-controlplane | ||
| podSelector: | ||
| matchLabels: | ||
| app: tenant-ingressgateway | ||
| istio: ingressgateway | ||
| ports: | ||
| - port: 2222 | ||
| protocol: TCP | ||
| podSelector: | ||
| matchLabels: | ||
| app: gitlab-shell | ||
| policyTypes: | ||
| - Ingress | ||
| --- | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: NetworkPolicy | ||
| metadata: | ||
| name: egress-shell | ||
| namespace: gitlab | ||
| spec: | ||
| egress: | ||
| - to: | ||
| - namespaceSelector: {} | ||
| - ipBlock: | ||
| cidr: 0.0.0.0/0 | ||
| except: | ||
| - 169.254.169.254/32 | ||
| podSelector: | ||
| matchLabels: | ||
| app: gitlab-shell | ||
| policyTypes: | ||
| - Egress |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| apiVersion: networking.istio.io/v1beta1 | ||
| kind: VirtualService | ||
| metadata: | ||
| annotations: | ||
| meta.helm.sh/release-name: gitlab | ||
| meta.helm.sh/release-namespace: gitlab | ||
| name: gitlab-ssh | ||
| namespace: gitlab | ||
| spec: | ||
| gateways: | ||
| - istio-system/tenant | ||
| hosts: | ||
| - gitlab.mtsi.bigbang.dev | ||
| tcp: | ||
| - match: | ||
| - port: 2022 | ||
| route: | ||
| - destination: | ||
| host: gitlab-gitlab-shell.gitlab.svc.cluster.local | ||
| port: | ||
| number: 22 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| istio: | ||
| values: | ||
| gateways: | ||
| tenant: | ||
| ingressGateway: tenant-ingressgateway | ||
| servers: | ||
| - hosts: | ||
| - "*.###ZARF_VAR_DOMAIN###" | ||
| port: | ||
| name: https | ||
| number: 8443 | ||
| protocol: HTTPS | ||
| tls: | ||
| minProtocolVersion: "TLSV1_3" | ||
| mode: SIMPLE | ||
| credentialName: tenant-cert | ||
| - hosts: | ||
| - "gitlab.###ZARF_VAR_DOMAIN###" | ||
| port: | ||
| name: tcp-ssh | ||
| number: 2022 | ||
| protocol: TCP | ||
| ingressGateways: | ||
| tenant-ingressgateway: | ||
| kubernetesResourceSpec: | ||
| service: | ||
| ports: | ||
| - port: 15021 | ||
| targetPort: 15021 | ||
| name: status-port | ||
| protocol: TCP | ||
| - port: 80 | ||
| targetPort: 8080 | ||
| name: http2 | ||
| protocol: TCP | ||
| - port: 443 | ||
| targetPort: 8443 | ||
| name: https | ||
| protocol: TCP | ||
| - port: 22 | ||
| targetPort: 2022 | ||
| name: tcp-ssh | ||
| protocol: TCP |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| loki: | ||
| values: | ||
| # Values for Monolith strategy | ||
| singleBinary: | ||
| resources: | ||
| limits: | ||
| cpu: 100m | ||
| memory: 1024Mi | ||
| requests: | ||
| cpu: 100m | ||
| memory: 512Mi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| monitoring: | ||
| values: | ||
| kube-state-metrics: | ||
| resources: | ||
| limits: | ||
| cpu: "500m" | ||
| memory: "1024Mi" | ||
| requests: | ||
| cpu: "10m" | ||
| memory: "512Mi" | ||
| prometheus: | ||
| prometheusSpec: | ||
| resources: | ||
| limits: | ||
| cpu: "600m" | ||
| memory: "6Gi" | ||
| requests: | ||
| cpu: "300m" | ||
| memory: "2Gi" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| # PLACEHOLDER |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| package: | ||
| create: | ||
| max_package_size: "1000000000" | ||
| set: | ||
| # renovate: datasource=gitlab-tags depName=big-bang/bigbang versioning=semver registryUrl=https://repo1.dso.mil | ||
| bigbang_version: "2.16.0" | ||
| # should line up with the flux version in the BB release, see https://repo1.dso.mil/big-bang/bigbang/-/blob/master/base/flux/gotk-components.yaml#L3 | ||
| flux_version: "2.1.2" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| # yaml-language-server: $schema=https://raw.githubusercontent.com/defenseunicorns/zarf/v0.31.4/zarf.schema.json | ||
| kind: ZarfPackageConfig | ||
| metadata: | ||
| name: dubbd-rke2-nutanix | ||
| description: "RKE2 DUBBD configuration tweaked for swf-nutanix" | ||
| architecture: "amd64" | ||
| version: "0.15.0-n1" | ||
|
|
||
| x-dubbd-oci: &dubbd_oci "oci://ghcr.io/defenseunicorns/packages/dubbd-rke2:0.15.0-skeleton" | ||
|
|
||
| variables: | ||
| # domains and certs | ||
| - name: DOMAIN | ||
| - name: ADMIN_DOMAIN | ||
| - name: TENANT_CERT | ||
| description: "RSA Cert to be served by the tenant gateway" | ||
| sensitive: true | ||
| autoIndent: true | ||
| # default: "Intentionally left blank" | ||
| - name: TENANT_KEY | ||
| description: "RSA cert private key to be loaded by the tenant gateway" | ||
| sensitive: true | ||
| autoIndent: true | ||
| # default: "Intentionally left blank" | ||
| - name: ADMIN_CERT | ||
| description: "RSA cert to be served by the admin gateway" | ||
| sensitive: true | ||
| autoIndent: true | ||
| # default: "Intentionally left blank" | ||
| - name: ADMIN_KEY | ||
| description: "RSA cert private key to be loaded by the admin gateway" | ||
| sensitive: true | ||
| autoIndent: true | ||
| # default: "Intentionally left blank" | ||
|
|
||
| components: | ||
| - name: set-zarf-vars | ||
| required: true | ||
| import: | ||
| name: set-zarf-vars | ||
| url: *dubbd_oci | ||
|
|
||
| - name: preflight | ||
| required: true | ||
| import: | ||
| name: preflight | ||
| url: *dubbd_oci | ||
|
|
||
| # NOTE -- This DUBBD package assumes certs are provided directly via variable configuration. No certs will be loaded from files by default. | ||
|
|
||
| - name: generate-credentials | ||
| required: true | ||
| import: | ||
| name: generate-credentials | ||
| url: *dubbd_oci | ||
|
|
||
| - name: download-flux | ||
| required: true | ||
| import: | ||
| name: download-flux | ||
| url: *dubbd_oci | ||
|
|
||
| - name: storage-class | ||
| required: true | ||
| import: | ||
| name: storage-class | ||
| url: *dubbd_oci | ||
|
|
||
| - name: dubbd-pre-upgrade | ||
| required: true | ||
| import: | ||
| name: dubbd-pre-upgrade | ||
| url: *dubbd_oci | ||
|
|
||
| - name: bigbang | ||
| required: true | ||
| import: | ||
| name: bigbang | ||
| url: *dubbd_oci | ||
| extensions: | ||
| bigbang: | ||
| version: "###ZARF_PKG_TMPL_BIGBANG_VERSION###" | ||
| valuesFiles: | ||
| - values/istio.yaml | ||
| - values/loki.yaml | ||
| - values/monitoring.yaml | ||
| - values/velero.yaml | ||
|
|
||
| - name: dubbd-post-upgrade | ||
| required: true | ||
| import: | ||
| name: dubbd-post-upgrade | ||
| url: *dubbd_oci | ||
|
|
||
| - name: gitlab-ssh | ||
| required: true | ||
| manifests: | ||
| - name: gitlab-ssh-virtualservice | ||
| namespace: gitlab | ||
| files: | ||
| - manifests/gitlab-ssh-virtualservice.yaml | ||
| - manifests/gitlab-ssh-networkpolicies.yaml |
Oops, something went wrong.