502 lines
15 KiB
YAML
502 lines
15 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: nuthatch-testbed
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: postgres-init
|
|
namespace: nuthatch-testbed
|
|
data:
|
|
01-keycloak.sql: |
|
|
CREATE USER keycloak WITH PASSWORD 'synthetic-keycloak-db';
|
|
CREATE DATABASE keycloak OWNER keycloak;
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: postgres
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@POSTGRES_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: postgres}
|
|
template:
|
|
metadata:
|
|
labels: {app: postgres}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: postgres
|
|
image: @@POSTGRES_IMAGE@@
|
|
imagePullPolicy: Never
|
|
env:
|
|
- {name: POSTGRES_DB, value: nuthatch}
|
|
- {name: POSTGRES_USER, value: nuthatch}
|
|
- {name: POSTGRES_PASSWORD, value: synthetic-postgres}
|
|
ports:
|
|
- {name: postgres, containerPort: 5432}
|
|
readinessProbe:
|
|
exec:
|
|
command: [pg_isready, -U, nuthatch, -d, nuthatch]
|
|
periodSeconds: 2
|
|
resources:
|
|
requests: {cpu: 100m, memory: 256Mi}
|
|
limits: {cpu: "2", memory: 1Gi}
|
|
volumeMounts:
|
|
- {name: data, mountPath: /var/lib/postgresql}
|
|
- {name: init, mountPath: /docker-entrypoint-initdb.d}
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
- name: init
|
|
configMap: {name: postgres-init}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: postgres
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
selector: {app: postgres}
|
|
ports:
|
|
- {name: postgres, port: 5432, targetPort: postgres}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: redis
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@REDIS_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: redis}
|
|
template:
|
|
metadata:
|
|
labels: {app: redis}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: redis
|
|
image: @@REDIS_IMAGE@@
|
|
imagePullPolicy: Never
|
|
args: [redis-server, --save, "", --appendonly, "no"]
|
|
ports:
|
|
- {name: redis, containerPort: 6379}
|
|
readinessProbe:
|
|
exec:
|
|
command: [redis-cli, ping]
|
|
periodSeconds: 2
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: "1", memory: 256Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: redis
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
selector: {app: redis}
|
|
ports:
|
|
- {name: redis, port: 6379, targetPort: redis}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: dragonfly
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@DRAGONFLY_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: dragonfly}
|
|
template:
|
|
metadata:
|
|
labels: {app: dragonfly}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: dragonfly
|
|
image: @@DRAGONFLY_IMAGE@@
|
|
imagePullPolicy: Never
|
|
args: [--proactor_threads=1, --maxmemory=256mb]
|
|
ports:
|
|
- {name: redis, containerPort: 6379}
|
|
readinessProbe:
|
|
tcpSocket: {port: redis}
|
|
periodSeconds: 2
|
|
resources:
|
|
requests: {cpu: 100m, memory: 64Mi}
|
|
limits: {cpu: "2", memory: 384Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: dragonfly
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
selector: {app: dragonfly}
|
|
ports:
|
|
- {name: redis, port: 6379, targetPort: redis}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: keycloak
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@KEYCLOAK_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: keycloak}
|
|
template:
|
|
metadata:
|
|
labels: {app: keycloak}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: keycloak
|
|
image: @@KEYCLOAK_IMAGE@@
|
|
imagePullPolicy: Never
|
|
args: [start-dev, --hostname=http://keycloak.nuthatch.test:8080]
|
|
env:
|
|
- {name: KC_BOOTSTRAP_ADMIN_USERNAME, value: nuthatch-admin}
|
|
- {name: KC_BOOTSTRAP_ADMIN_PASSWORD, value: synthetic-keycloak}
|
|
- {name: KC_DB, value: postgres}
|
|
- {name: KC_DB_URL, value: jdbc:postgresql://postgres:5432/keycloak}
|
|
- {name: KC_DB_USERNAME, value: keycloak}
|
|
- {name: KC_DB_PASSWORD, value: synthetic-keycloak-db}
|
|
- {name: JAVA_OPTS_KC_HEAP, value: "-XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=30 -XX:MaxRAMPercentage=65"}
|
|
ports:
|
|
- {name: http, containerPort: 8080}
|
|
readinessProbe:
|
|
httpGet: {path: /realms/master, port: http}
|
|
periodSeconds: 3
|
|
failureThreshold: 60
|
|
resources:
|
|
requests: {cpu: 200m, memory: 512Mi}
|
|
limits: {cpu: "2", memory: 1Gi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: keycloak
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
clusterIP: 10.96.0.55
|
|
selector: {app: keycloak}
|
|
ports:
|
|
- {name: http, port: 8080, targetPort: http}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: zitadel
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@ZITADEL_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: zitadel}
|
|
template:
|
|
metadata:
|
|
labels: {app: zitadel}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
volumes:
|
|
- name: bootstrap
|
|
emptyDir: {}
|
|
containers:
|
|
- name: zitadel
|
|
image: @@ZITADEL_IMAGE@@
|
|
imagePullPolicy: Never
|
|
args: [start-from-init, --masterkeyFromEnv, --tlsMode, disabled]
|
|
env:
|
|
- {name: ZITADEL_MASTERKEY, value: synthetic-masterkey-32-character}
|
|
- {name: ZITADEL_DATABASE_POSTGRES_DSN, value: "postgresql://nuthatch:synthetic-postgres@postgres:5432/postgres?sslmode=disable"}
|
|
- {name: ZITADEL_EXTERNALSECURE, value: "false"}
|
|
- {name: ZITADEL_EXTERNALDOMAIN, value: zitadel.nuthatch.test}
|
|
- {name: ZITADEL_EXTERNALPORT, value: "8080"}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_USERNAME, value: nuthatch-admin}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD, value: Synthetic-Zitadel-1!}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORDCHANGEREQUIRED, value: "false"}
|
|
- {name: ZITADEL_FIRSTINSTANCE_PATPATH, value: /bootstrap/admin.pat}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_USERNAME, value: nuthatch-provisioner}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME, value: Nuthatch Provisioner}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE, value: "2036-01-01T00:00:00Z"}
|
|
- {name: ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH, value: /bootstrap/login-client.pat}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_USERNAME, value: nuthatch-login-client}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_MACHINE_NAME, value: Nuthatch Login Client}
|
|
- {name: ZITADEL_FIRSTINSTANCE_ORG_LOGINCLIENT_PAT_EXPIRATIONDATE, value: "2036-01-01T00:00:00Z"}
|
|
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_ACCESSTOKENLIFETIME, value: 5m}
|
|
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_IDTOKENLIFETIME, value: 5m}
|
|
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_REFRESHTOKENIDLEEXPIRATION, value: 1h}
|
|
- {name: ZITADEL_DEFAULTINSTANCE_OIDCSETTINGS_REFRESHTOKENEXPIRATION, value: 2h}
|
|
volumeMounts:
|
|
- {name: bootstrap, mountPath: /bootstrap}
|
|
ports:
|
|
- {name: http, containerPort: 8080}
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /.well-known/openid-configuration
|
|
port: http
|
|
httpHeaders:
|
|
- {name: Host, value: zitadel.nuthatch.test}
|
|
periodSeconds: 3
|
|
failureThreshold: 80
|
|
resources:
|
|
requests: {cpu: 200m, memory: 512Mi}
|
|
limits: {cpu: "2", memory: 1Gi}
|
|
- name: oidc-provisioner
|
|
image: @@CURL_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
while [ ! -s /bootstrap/admin.pat ] || [ ! -s /bootstrap/login-client.pat ]; do
|
|
sleep 1
|
|
done
|
|
exec sleep 2147483647
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: ["ALL"]}
|
|
runAsUser: 0
|
|
volumeMounts:
|
|
- {name: bootstrap, mountPath: /bootstrap, readOnly: true}
|
|
resources:
|
|
requests: {cpu: 10m, memory: 16Mi}
|
|
limits: {cpu: 100m, memory: 32Mi}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: zitadel
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
clusterIP: 10.96.0.56
|
|
selector: {app: zitadel}
|
|
ports:
|
|
- {name: http, port: 8080, targetPort: http}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: garage-config
|
|
namespace: nuthatch-testbed
|
|
data:
|
|
garage.toml: |
|
|
metadata_dir = "/data/meta"
|
|
data_dir = "/data/data"
|
|
db_engine = "sqlite"
|
|
replication_factor = 1
|
|
rpc_bind_addr = "[::]:3901"
|
|
rpc_public_addr = "127.0.0.1:3901"
|
|
rpc_secret = "0000000000000000000000000000000000000000000000000000000000000000"
|
|
[s3_api]
|
|
s3_region = "garage"
|
|
api_bind_addr = "[::]:3900"
|
|
root_domain = ".s3.garage.nuthatch.test"
|
|
[admin]
|
|
api_bind_addr = "[::]:3903"
|
|
admin_token = "synthetic-garage-admin"
|
|
metrics_token = "synthetic-garage-metrics"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: garage
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@GARAGE_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: garage}
|
|
template:
|
|
metadata:
|
|
labels: {app: garage}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: garage
|
|
image: @@GARAGE_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/garage]
|
|
args: [server, --single-node, --default-bucket]
|
|
env:
|
|
- {name: GARAGE_DEFAULT_ACCESS_KEY, value: GK00000000000000000000000000000000}
|
|
- {name: GARAGE_DEFAULT_SECRET_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
|
|
- {name: GARAGE_DEFAULT_BUCKET, value: nuthatch-fixture}
|
|
ports:
|
|
- {name: s3, containerPort: 3900}
|
|
resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "2", memory: 512Mi}
|
|
volumeMounts:
|
|
- {name: config, mountPath: /etc/garage.toml, subPath: garage.toml}
|
|
- {name: data, mountPath: /data}
|
|
- name: s3-readiness
|
|
image: @@AWS_CLI_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args: ["while :; do sleep 3600; done"]
|
|
env:
|
|
- {name: AWS_ACCESS_KEY_ID, value: GK00000000000000000000000000000000}
|
|
- {name: AWS_SECRET_ACCESS_KEY, value: "0000000000000000000000000000000000000000000000000000000000000000"}
|
|
- {name: AWS_DEFAULT_REGION, value: garage}
|
|
readinessProbe:
|
|
exec:
|
|
command: [aws, --endpoint-url, "http://127.0.0.1:3900", s3api, head-bucket, --bucket, nuthatch-fixture]
|
|
periodSeconds: 2
|
|
failureThreshold: 60
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: "1", memory: 256Mi}
|
|
volumes:
|
|
- name: config
|
|
configMap: {name: garage-config}
|
|
- name: data
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: garage
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
selector: {app: garage}
|
|
ports:
|
|
- {name: s3, port: 3900, targetPort: s3}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: versitygw
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@VERSITYGW_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: versitygw}
|
|
template:
|
|
metadata:
|
|
labels: {app: versitygw}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: versitygw
|
|
image: @@VERSITYGW_IMAGE@@
|
|
imagePullPolicy: Never
|
|
args: [--port, ":10000", --admin-port, "127.0.0.1:10001", --iam-dir, /data, posix, --versioning-dir, /versions, /data]
|
|
env:
|
|
- {name: ROOT_ACCESS_KEY, value: synthetic-s3-access}
|
|
- {name: ROOT_SECRET_KEY, value: synthetic-s3-secret}
|
|
- {name: ADMIN_ACCESS_KEY_ID, value: synthetic-s3-access}
|
|
- {name: ADMIN_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
|
|
ports:
|
|
- {name: s3, containerPort: 10000}
|
|
resources:
|
|
requests: {cpu: 100m, memory: 64Mi}
|
|
limits: {cpu: "2", memory: 512Mi}
|
|
volumeMounts:
|
|
- {name: data, mountPath: /data}
|
|
- {name: versions, mountPath: /versions}
|
|
- name: s3-readiness
|
|
image: @@AWS_CLI_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args: ["while :; do sleep 3600; done"]
|
|
env:
|
|
- {name: AWS_ACCESS_KEY_ID, value: synthetic-s3-access}
|
|
- {name: AWS_SECRET_ACCESS_KEY, value: synthetic-s3-secret}
|
|
- {name: AWS_DEFAULT_REGION, value: us-east-1}
|
|
readinessProbe:
|
|
exec:
|
|
command: [aws, --endpoint-url, "http://127.0.0.1:10000", s3api, list-buckets]
|
|
periodSeconds: 2
|
|
failureThreshold: 60
|
|
resources:
|
|
requests: {cpu: 25m, memory: 64Mi}
|
|
limits: {cpu: "1", memory: 256Mi}
|
|
volumes:
|
|
- name: data
|
|
emptyDir: {}
|
|
- name: versions
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: versitygw
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
selector: {app: versitygw}
|
|
ports:
|
|
- {name: s3, port: 10000, targetPort: s3}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: controlled-dns
|
|
namespace: nuthatch-testbed
|
|
data:
|
|
Corefile: |
|
|
.:53 {
|
|
errors
|
|
hosts {
|
|
10.96.0.55 keycloak.nuthatch.test
|
|
10.96.0.56 zitadel.nuthatch.test
|
|
fallthrough
|
|
}
|
|
forward . 10.96.0.10
|
|
}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: controlled-dns
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: @@COREDNS_REPLICAS@@
|
|
selector:
|
|
matchLabels: {app: controlled-dns}
|
|
template:
|
|
metadata:
|
|
labels: {app: controlled-dns}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
containers:
|
|
- name: coredns
|
|
image: @@COREDNS_IMAGE@@
|
|
imagePullPolicy: Never
|
|
args: [-conf, /etc/coredns/Corefile]
|
|
ports:
|
|
- {name: dns-udp, containerPort: 53, protocol: UDP}
|
|
- {name: dns-tcp, containerPort: 53, protocol: TCP}
|
|
readinessProbe:
|
|
tcpSocket: {port: dns-tcp}
|
|
periodSeconds: 2
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: "1", memory: 128Mi}
|
|
volumeMounts:
|
|
- {name: config, mountPath: /etc/coredns}
|
|
volumes:
|
|
- name: config
|
|
configMap: {name: controlled-dns}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: controlled-dns
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
clusterIP: 10.96.0.53
|
|
selector: {app: controlled-dns}
|
|
ports:
|
|
- {name: dns-udp, port: 53, targetPort: dns-udp, protocol: UDP}
|
|
- {name: dns-tcp, port: 53, targetPort: dns-tcp, protocol: TCP}
|