ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
10 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
vendor/infrastructure/network-dns/certificate.yaml vendored Normal file
View file

@ -0,0 +1,20 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: coredns-dot
namespace: network-dns
spec:
secretName: coredns-dot-tls
issuerRef:
name: vault-internal
kind: ClusterIssuer
commonName: ns1.quorate.internal
dnsNames:
- ns1.quorate.internal
- dns.quorate.internal
duration: 2160h
renewBefore: 360h
privateKey:
algorithm: ECDSA
size: 256
rotationPolicy: Always

43
vendor/infrastructure/network-dns/config/Corefile vendored Normal file
View file

@ -0,0 +1,43 @@
quorate.internal:53 {
errors
log
prometheus 0.0.0.0:9153
reload 30s
file /zones/db.quorate.internal quorate.internal
}
tls://quorate.internal:853 {
errors
log
tls /tls/tls.crt /tls/tls.key
file /zones/db.quorate.internal quorate.internal
}
quorate.dev:53 {
errors
log
cache 30
prometheus 0.0.0.0:9153
reload 30s
hosts {
10.104.40.127 auth.quorate.dev git.quorate.dev relay-logs.quorate.dev
10.66.153.202 mail.quorate.dev
ttl 30
fallthrough
}
forward . 1.1.1.1 1.0.0.1
}
tls://quorate.dev:853 {
errors
log
cache 30
tls /tls/tls.crt /tls/tls.key
hosts {
10.104.40.127 auth.quorate.dev git.quorate.dev relay-logs.quorate.dev
10.66.153.202 mail.quorate.dev
ttl 30
fallthrough
}
forward . 1.1.1.1 1.0.0.1
}

100
vendor/infrastructure/network-dns/daemonset.yaml vendored Normal file
View file

@ -0,0 +1,100 @@
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: coredns
namespace: network-dns
labels:
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
app.kubernetes.io/component: authoritative-dns
spec:
revisionHistoryLimit: 3
selector:
matchLabels:
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
updateStrategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 1
template:
metadata:
labels:
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
app.kubernetes.io/component: authoritative-dns
spec:
serviceAccountName: coredns
automountServiceAccountToken: false
securityContext:
runAsNonRoot: true
runAsUser: 10001
runAsGroup: 10001
fsGroup: 10001
seccompProfile:
type: RuntimeDefault
containers:
- name: coredns
image: rancher/mirrored-coredns-coredns:1.15.0@sha256:0a9d8c8ddf34347eb59aad9a8784f0710de88d6d112726d11d271f9bc6daca26
imagePullPolicy: IfNotPresent
args:
- -conf
- /etc/coredns/Corefile
readinessProbe:
tcpSocket:
port: dot
periodSeconds: 2
timeoutSeconds: 1
failureThreshold: 1
lifecycle:
preStop:
sleep:
seconds: 3
ports:
- name: dns-udp
containerPort: 53
protocol: UDP
- name: dns-tcp
containerPort: 53
protocol: TCP
- name: dot
containerPort: 853
protocol: TCP
- name: metrics
containerPort: 9153
protocol: TCP
resources:
requests:
cpu: 25m
memory: 64Mi
limits:
memory: 256Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
volumeMounts:
- name: corefile
mountPath: /etc/coredns
readOnly: true
- name: zones
mountPath: /zones
readOnly: true
- name: dot-tls
mountPath: /tls
readOnly: true
volumes:
- name: corefile
configMap:
name: network-dns-corefile
- name: zones
configMap:
name: network-dns-zones
- name: dot-tls
secret:
secretName: coredns-dot-tls

17
vendor/infrastructure/network-dns/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,17 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: network-dns
resources:
- namespace.yaml
- certificate.yaml
- daemonset.yaml
- service.yaml
- pdb.yaml
- network-policies.yaml
configMapGenerator:
- name: network-dns-corefile
files:
- Corefile=config/Corefile
- name: network-dns-zones
files:
- db.quorate.internal=zones/db.quorate.internal

17
vendor/infrastructure/network-dns/namespace.yaml vendored Normal file
View file

@ -0,0 +1,17 @@
apiVersion: v1
kind: Namespace
metadata:
name: network-dns
labels:
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/enforce-version: latest
pod-security.kubernetes.io/audit: restricted
pod-security.kubernetes.io/audit-version: latest
pod-security.kubernetes.io/warn: restricted
pod-security.kubernetes.io/warn-version: latest
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: coredns
namespace: network-dns

61
vendor/infrastructure/network-dns/network-policies.yaml vendored Normal file
View file

@ -0,0 +1,61 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: coredns
namespace: network-dns
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
ingress:
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- port: "853"
protocol: TCP
- fromEntities:
- cluster
- host
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
- port: "853"
protocol: TCP
egress:
- toCIDR:
- 1.1.1.1/32
- 1.0.0.1/32
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-egress-network-dns-probes
spec:
nodeSelector: {}
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: network-dns
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
toPorts:
- ports:
- port: "853"
protocol: TCP

2
vendor/infrastructure/network-dns/opnsense/quorate-network-dns.conf vendored Normal file
View file

@ -0,0 +1,2 @@
server:
infra-cache-max-rtt: 30000

11
vendor/infrastructure/network-dns/pdb.yaml vendored Normal file
View file

@ -0,0 +1,11 @@
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
name: coredns
namespace: network-dns
spec:
minAvailable: 1
selector:
matchLabels:
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns

30
vendor/infrastructure/network-dns/service.yaml vendored Normal file
View file

@ -0,0 +1,30 @@
apiVersion: v1
kind: Service
metadata:
name: coredns
namespace: network-dns
labels:
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
io.cilium/bgp-announce: "true"
annotations:
lbipam.cilium.io/ips: "10.28.147.227"
spec:
type: LoadBalancer
externalTrafficPolicy: Local
selector:
app.kubernetes.io/name: coredns
app.kubernetes.io/instance: network-dns
ports:
- name: dns-udp
port: 53
targetPort: dns-udp
protocol: UDP
- name: dns-tcp
port: 53
targetPort: dns-tcp
protocol: TCP
- name: dot
port: 853
targetPort: dot
protocol: TCP

26
vendor/infrastructure/network-dns/zones/db.quorate.internal vendored Normal file
View file

@ -0,0 +1,26 @@
$ORIGIN quorate.internal.
$TTL 60
@ IN SOA ns1.quorate.internal. hostmaster.quorate.internal. (
2026110701 ; serial
3600 ; refresh
600 ; retry
604800 ; expire
60 ; minimum
)
@ IN NS ns1.quorate.internal.
@ IN A 10.90.141.119
ns1 IN A 10.28.147.227
dns IN A 10.28.147.227
forge-ssh IN A 10.190.165.53
git-ssh IN A 10.47.201.154
zot IN A 172.28.129.182
vault IN A 10.69.181.158
registry IN A 10.108.252.250
layshaft IN A 10.232.82.173
s3 IN A 10.66.127.81
s3-ui IN A 10.59.91.218
postgres-ro IN A 10.157.251.228
postgres-rw IN A 10.234.158.153
* IN A 10.90.141.119