netflux-kubernetes/deploy/prod/kustomization.yaml

147 lines
3.6 KiB
YAML

namePrefix: prod-
resources:
- ../base
- svc-db.yaml
- svc-netflux.yaml
- cm-ingress-nginx-tcp-services.yaml
configMapGenerator:
- name: prometheus-server
behavior: merge
files:
- prometheus.yml=prometheus.yaml
- name: grafana
behavior: merge
files:
- grafana.ini=secrets/grafana-config.ini
- datasources.yaml=grafana-datasources.yaml
- name: invidious-config
files:
- config.yml=invidious-config.yaml
options:
labels:
app: invidious
- name: element-config
files:
- config.json=element-config.json
options:
labels:
app: element
- name: drone-config
literals:
- gitea-server=https://git.netflux.io
- server-host=drone.netflux.io
- server-proto=https
- rpc-host=drone.netflux.io
- rpc-proto=https
- logs-debug=false
options:
labels:
app: drone
- name: radicale-config
files:
- config.toml=secrets/radicale-config.toml
- users=secrets/radicale-users
options:
labels:
app: radicale
secretGenerator:
- name: prometheus-credentials
files:
- secrets/exporter-password
- name: grafana-credentials
files:
- admin-user=secrets/grafana-admin-user
- admin-password=secrets/grafana-admin-password
- name: invidious-credentials
literals:
# Individual keys required by init-invidious-db:
- database-host=prod-db
- database-port=5432
- database-name=invidious
- database-user=kemal
files:
- database-url=secrets/invidious-database-url
- database-password=secrets/invidious-database-password
options:
labels:
app: invidious
- name: gitea-config
files:
- admin-username=secrets/gitea-admin-username
- admin-password=secrets/gitea-admin-password
- admin-email=secrets/gitea-admin-email
- config.ini=secrets/gitea-config.ini
options:
labels:
app: gitea
- name: drone-credentials
files:
- database-url=secrets/drone-database-url
- gitea-client-id=secrets/drone-gitea-client-id
- gitea-client-secret=secrets/drone-gitea-client-secret
- rpc-secret=secrets/drone-rpc-secret
options:
labels:
app: drone
- name: synapse-config
files:
- homeserver.yaml=secrets/synapse-homeserver.yaml
- signing.key=secrets/synapse-signing.key
- log.config=secrets/synapse-log.config
options:
labels:
app: synapse
patches:
# Patch the ingress-nginx deployment to allow it to use a service with a
# namePrefix. See https://github.com/kubernetes/ingress-nginx/issues/2599#issuecomment-601170289.
- target:
kind: Deployment
name: ingress-nginx-controller
path: deploy-ingress-nginx.yaml
# Patch the ingress-nginx-admission-create job to reference its webhook with a
# namePrefix.
- target:
kind: Job
name: ingress-nginx-admission-create
path: job-ingress-nginx-admission-create.yaml
# Patch the ingress-nginx-admission-patch job to reference its webhook with a
# namePrefix.
- target:
kind: Job
name: ingress-nginx-admission-patch
path: job-ingress-nginx-admission-patch.yaml
# Patch the ingress resource with stage-specific hostnames:
- target:
kind: Ingress
name: ingress
path: ingress.yaml
# Patch prometheus-server pod to mount the secrets volume.
- target:
kind: Deployment
name: prometheus-server
patch: |-
- op: add
path: /spec/template/spec/volumes/-
value:
secret:
secretName: prod-prometheus-credentials
name: secrets-volume
- op: add
path: /spec/template/spec/containers/1/volumeMounts/-
value:
mountPath: /etc/secrets
name: secrets-volume
readOnly: true
# Patch Grafana deployment to inject PostgreSQL credentials:
- target:
kind: Deployment
name: grafana
path: deploy-grafana.yaml