ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
9 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
vendor/platform/versitygw/certificate.yaml vendored Normal file
View file

@ -0,0 +1,20 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: s3
namespace: versitygw
spec:
secretName: versitygw-s3-tls
issuerRef:
name: vault-internal
kind: ClusterIssuer
commonName: s3.quorate.internal
dnsNames:
- s3.quorate.internal
- s3-ui.quorate.internal
duration: 2160h
renewBefore: 360h
privateKey:
algorithm: ECDSA
size: 256
rotationPolicy: Always

110
vendor/platform/versitygw/helm-release.yaml vendored Normal file
View file

@ -0,0 +1,110 @@
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: versitygw
namespace: versitygw
spec:
interval: 15m
releaseName: versitygw
targetNamespace: versitygw
chart:
spec:
chart: versitygw
version: 0.4.7
sourceRef:
kind: HelmRepository
name: versitygw
namespace: flux-system
install:
remediation:
retries: 3
upgrade:
remediation:
retries: 3
postRenderers:
- kustomize:
patches:
- target:
kind: Deployment
name: versitygw
patch: |
apiVersion: apps/v1
kind: Deployment
metadata:
name: versitygw
spec:
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 0
maxUnavailable: 1
template:
spec:
containers:
- name: versitygw
readinessProbe:
httpGet:
scheme: HTTPS
- target:
kind: PersistentVolumeClaim
name: versitygw-data
patch: |
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: versitygw-data
annotations:
helm.sh/resource-policy: keep
values:
replicaCount: 1
image:
tag: v1.10.0@sha256:89cad13cc981986ee284cbafea4613f9533ce6fd5f37a2c96c4c4fb8adb3a316
serviceAccount:
create: false
name: versitygw
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
auth:
existingSecret: versitygw-root
gateway:
backend:
type: posix
args: /mnt/data
region: us-east-1
corsAllowOrigin: https://s3-ui.quorate.internal
admin:
enabled: true
webui:
enabled: true
apiGateways:
- https://s3.quorate.internal
adminGateways:
- https://s3-admin.quorate.internal
iam:
enabled: true
type: internal
persistence:
enabled: true
create: true
size: 200Gi
storageClassName: openebs-zfspv-1m-zstd
accessMode: ReadWriteOnce
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
memory: 1Gi
nodeSelector:
has-zfs: "true"
tls:
enabled: true
certificate:
secretName: versitygw-s3-tls

11
vendor/platform/versitygw/kustomization.yaml vendored Normal file
View file

@ -0,0 +1,11 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- namespace.yaml
- certificate.yaml
- vso.yaml
- helm-release.yaml
- service-direct.yaml
- service-webui-direct.yaml
- network-policies.yaml
- route.yaml

13
vendor/platform/versitygw/namespace.yaml vendored Normal file
View file

@ -0,0 +1,13 @@
---
apiVersion: v1
kind: Namespace
metadata:
labels:
gateway.quorate.internal/allow-internal: "true"
name: versitygw
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: versitygw
namespace: versitygw

207
vendor/platform/versitygw/network-policies.yaml vendored Normal file
View file

@ -0,0 +1,207 @@
---
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: versitygw
namespace: versitygw
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
ingress:
# Kubelet probes and local port-forwarding.
- fromEntities:
- host
toPorts:
- ports:
- port: "7070"
protocol: TCP
- port: "7071"
protocol: TCP
- port: "8080"
protocol: TCP
# Gateway I Envoy proxy: outbound connections use reserved:ingress identity.
- fromEntities:
- ingress
toPorts:
- ports:
- port: "7071"
protocol: TCP
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
gateway.networking.k8s.io/gateway-name: gateway-internal
toPorts:
- ports:
- port: "7071"
protocol: TCP
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: frigate
app.kubernetes.io/name: frigate
app.kubernetes.io/instance: frigate
toPorts:
- ports:
- port: "7070"
protocol: TCP
# Quay uses VersityGW directly inside the cluster for registry object storage.
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: quay
toPorts:
- ports:
- port: "7070"
protocol: TCP
# Forgejo uses VersityGW directly inside the cluster for attachments and avatars.
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: forgejo
toPorts:
- ports:
- port: "7070"
protocol: TCP
- fromEndpoints:
- matchExpressions:
- key: k8s:io.kubernetes.pod.namespace
operator: In
values:
- forgejo-public
- key: app.kubernetes.io/name
operator: In
values:
- forgejo
- key: app.kubernetes.io/instance
operator: In
values:
- forge-code
- forge-git
toPorts:
- ports:
- port: "7070"
protocol: TCP
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: postgres
cnpg.io/cluster: main
toPorts:
- ports:
- port: "7070"
protocol: TCP
# Argo Workflows executor/workflow pods for artifact upload/download.
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: argo
app.kubernetes.io/name: argo-workflow
toPorts:
- ports:
- port: "7070"
protocol: TCP
- fromEndpoints:
- matchExpressions:
- key: k8s:io.kubernetes.pod.namespace
operator: In
values:
- stalwart
- key: app.kubernetes.io/name
operator: In
values:
- stalwart
- stalwart-bootstrap
- key: app.kubernetes.io/instance
operator: In
values:
- stalwart
toPorts:
- ports:
- port: "7070"
protocol: TCP
# Cross-node kubelet blob pulls arrive with Cilium's remote-node identity.
- fromEntities:
- remote-node
toPorts:
- ports:
- port: "7070"
protocol: TCP
# Direct LAN/WireGuard clients reach S3 through versitygw-direct LoadBalancer.
- fromCIDR:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
toPorts:
- ports:
- port: "7070"
protocol: TCP
- port: "8080"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: gateway-internal-egress-versitygw
spec:
endpointSelector:
matchLabels:
"reserved:ingress": ""
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- port: "7071"
protocol: TCP
---
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-egress-versitygw
spec:
nodeSelector: {}
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- port: "7070"
protocol: TCP
- port: "7071"
protocol: TCP
- port: "8080"
protocol: TCP
---
# Same-node Gateway backend selections can return to node-local ephemeral
# source ports via the host path.
apiVersion: cilium.io/v2
kind: CiliumClusterwideNetworkPolicy
metadata:
name: host-ingress-versitygw-replies
spec:
nodeSelector: {}
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- port: "32768"
endPort: 60999
protocol: TCP

18
vendor/platform/versitygw/route.yaml vendored Normal file
View file

@ -0,0 +1,18 @@
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: versitygw-admin
namespace: versitygw
spec:
parentRefs:
- name: gateway-internal
namespace: kube-system
sectionName: https
hostnames:
- s3-admin.quorate.internal
rules:
- backendRefs:
- name: versitygw
port: 7071

27
vendor/platform/versitygw/service-direct.yaml vendored Normal file
View file

@ -0,0 +1,27 @@
apiVersion: v1
kind: Service
metadata:
name: versitygw-direct
namespace: versitygw
labels:
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
io.cilium/bgp-announce: "true"
annotations:
lbipam.cilium.io/ips: "10.66.127.81"
spec:
type: LoadBalancer
externalTrafficPolicy: Local
loadBalancerSourceRanges:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
selector:
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
ports:
- name: https
port: 443
targetPort: s3-api
protocol: TCP
appProtocol: https

27
vendor/platform/versitygw/service-webui-direct.yaml vendored Normal file
View file

@ -0,0 +1,27 @@
apiVersion: v1
kind: Service
metadata:
name: versitygw-webui-direct
namespace: versitygw
labels:
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
io.cilium/bgp-announce: "true"
annotations:
lbipam.cilium.io/ips: "10.59.91.218"
spec:
type: LoadBalancer
externalTrafficPolicy: Local
loadBalancerSourceRanges:
- 10.115.187.218/24
- 10.63.81.107/24
- 10.162.8.60/24
selector:
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
ports:
- name: https
port: 443
targetPort: webui
protocol: TCP
appProtocol: https

28
vendor/platform/versitygw/vso.yaml vendored Normal file
View file

@ -0,0 +1,28 @@
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
name: default
namespace: versitygw
spec:
method: kubernetes
mount: kubernetes
kubernetes:
role: versitygw
serviceAccount: versitygw
vaultConnectionRef: vault/vault
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: versitygw-root
namespace: versitygw
spec:
type: kv-v2
mount: secret
path: versitygw/root
destination:
name: versitygw-root
create: true
refreshAfter: 1h
vaultAuthRef: default