Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 gitea-admin
|
270f9c0f06 |
@@ -1,29 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: excalidraw
|
||||
namespace: apps
|
||||
labels:
|
||||
app: excalidraw
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: excalidraw
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: excalidraw
|
||||
spec:
|
||||
containers:
|
||||
- name: excalidraw
|
||||
image: excalidraw/excalidraw:latest
|
||||
ports:
|
||||
- containerPort: 80
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
@@ -1,24 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: excalidraw
|
||||
namespace: apps
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- excalidraw.khalisio.com
|
||||
secretName: excalidraw-tls
|
||||
rules:
|
||||
- host: excalidraw.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: excalidraw
|
||||
port:
|
||||
number: 80
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: excalidraw
|
||||
namespace: apps
|
||||
spec:
|
||||
selector:
|
||||
app: excalidraw
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 80
|
||||
targetPort: 80
|
||||
type: ClusterIP
|
||||
@@ -1,44 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: bazarr
|
||||
namespace: media
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: bazarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: bazarr
|
||||
spec:
|
||||
containers:
|
||||
- name: bazarr
|
||||
image: lscr.io/linuxserver/bazarr:latest
|
||||
ports:
|
||||
- containerPort: 6767
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media
|
||||
mountPath: /media
|
||||
- name: podcasts
|
||||
mountPath: /podcasts
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: bazarr-config
|
||||
- name: media
|
||||
persistentVolumeClaim:
|
||||
claimName: media-data
|
||||
- name: podcasts
|
||||
persistentVolumeClaim:
|
||||
claimName: bazarr-podcasts
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: bazarr
|
||||
namespace: media
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- bazarr.khalisio.com
|
||||
secretName: bazarr-tls
|
||||
rules:
|
||||
- host: bazarr.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: bazarr
|
||||
port:
|
||||
number: 6767
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: bazarr
|
||||
namespace: media
|
||||
spec:
|
||||
selector:
|
||||
app: bazarr
|
||||
ports:
|
||||
- port: 6767
|
||||
targetPort: 6767
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,40 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: emby
|
||||
namespace: media
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: emby
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: emby
|
||||
spec:
|
||||
containers:
|
||||
- name: emby
|
||||
image: lscr.io/linuxserver/emby:latest
|
||||
ports:
|
||||
- containerPort: 8096
|
||||
- containerPort: 8920
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media
|
||||
mountPath: /media
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: emby-config
|
||||
- name: media
|
||||
persistentVolumeClaim:
|
||||
claimName: media-data
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: emby
|
||||
namespace: media
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- emby.khalisio.com
|
||||
secretName: emby-tls
|
||||
rules:
|
||||
- host: emby.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: emby
|
||||
port:
|
||||
number: 8096
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
@@ -1,16 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: emby
|
||||
namespace: media
|
||||
spec:
|
||||
selector:
|
||||
app: emby
|
||||
ports:
|
||||
- port: 8096
|
||||
targetPort: 8096
|
||||
protocol: TCP
|
||||
- port: 8920
|
||||
targetPort: 8920
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,44 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: media
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: lidarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: lidarr
|
||||
spec:
|
||||
containers:
|
||||
- name: lidarr
|
||||
image: lscr.io/linuxserver/lidarr:latest
|
||||
ports:
|
||||
- containerPort: 8686
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media
|
||||
mountPath: /media
|
||||
- name: downloads
|
||||
mountPath: /downloads
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: lidarr-config
|
||||
- name: media
|
||||
persistentVolumeClaim:
|
||||
claimName: media-data
|
||||
- name: downloads
|
||||
persistentVolumeClaim:
|
||||
claimName: lidarr-downloads
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: media
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- lidarr.khalisio.com
|
||||
secretName: lidarr-tls
|
||||
rules:
|
||||
- host: lidarr.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: lidarr
|
||||
port:
|
||||
number: 8686
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: lidarr
|
||||
namespace: media
|
||||
spec:
|
||||
selector:
|
||||
app: lidarr
|
||||
ports:
|
||||
- port: 8686
|
||||
targetPort: 8686
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,12 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: media-data
|
||||
namespace: media
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
requests:
|
||||
storage: 500Gi
|
||||
storageClassName: longhorn
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: media
|
||||
labels:
|
||||
app.kubernetes.io/managed-by: orion
|
||||
@@ -1,34 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: prowlarr
|
||||
namespace: media
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: prowlarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: prowlarr
|
||||
spec:
|
||||
containers:
|
||||
- name: prowlarr
|
||||
image: lscr.io/linuxserver/prowlarr:latest
|
||||
ports:
|
||||
- containerPort: 9696
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: prowlarr-config
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: prowlarr
|
||||
namespace: media
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- prowlarr.khalisio.com
|
||||
secretName: prowlarr-tls
|
||||
rules:
|
||||
- host: prowlarr.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: prowlarr
|
||||
port:
|
||||
number: 9696
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: prowlarr
|
||||
namespace: media
|
||||
spec:
|
||||
selector:
|
||||
app: prowlarr
|
||||
ports:
|
||||
- port: 9696
|
||||
targetPort: 9696
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,44 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: radarr
|
||||
namespace: media
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: radarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: radarr
|
||||
spec:
|
||||
containers:
|
||||
- name: radarr
|
||||
image: lscr.io/linuxserver/radarr:latest
|
||||
ports:
|
||||
- containerPort: 7878
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media
|
||||
mountPath: /media
|
||||
- name: downloads
|
||||
mountPath: /downloads
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: radarr-config
|
||||
- name: media
|
||||
persistentVolumeClaim:
|
||||
claimName: media-data
|
||||
- name: downloads
|
||||
persistentVolumeClaim:
|
||||
claimName: radarr-downloads
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: radarr
|
||||
namespace: media
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- radarr.khalisio.com
|
||||
secretName: radarr-tls
|
||||
rules:
|
||||
- host: radarr.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: radarr
|
||||
port:
|
||||
number: 7878
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: radarr
|
||||
namespace: media
|
||||
spec:
|
||||
selector:
|
||||
app: radarr
|
||||
ports:
|
||||
- port: 7878
|
||||
targetPort: 7878
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,44 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: readarr
|
||||
namespace: media
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: readarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: readarr
|
||||
spec:
|
||||
containers:
|
||||
- name: readarr
|
||||
image: lscr.io/linuxserver/readarr:develop
|
||||
ports:
|
||||
- containerPort: 8787
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: books
|
||||
mountPath: /books
|
||||
- name: downloads
|
||||
mountPath: /downloads
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: readarr-config
|
||||
- name: books
|
||||
persistentVolumeClaim:
|
||||
claimName: readarr-books
|
||||
- name: downloads
|
||||
persistentVolumeClaim:
|
||||
claimName: readarr-downloads
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: readarr
|
||||
namespace: media
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- readarr.khalisio.com
|
||||
secretName: readarr-tls
|
||||
rules:
|
||||
- host: readarr.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: readarr
|
||||
port:
|
||||
number: 8787
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: readarr
|
||||
namespace: media
|
||||
spec:
|
||||
selector:
|
||||
app: readarr
|
||||
ports:
|
||||
- port: 8787
|
||||
targetPort: 8787
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -1,44 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: sonarr
|
||||
namespace: media
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: sonarr
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: sonarr
|
||||
spec:
|
||||
containers:
|
||||
- name: sonarr
|
||||
image: lscr.io/linuxserver/sonarr:develop
|
||||
ports:
|
||||
- containerPort: 8989
|
||||
env:
|
||||
- name: PUID
|
||||
value: "1000"
|
||||
- name: PGID
|
||||
value: "1000"
|
||||
- name: TZ
|
||||
value: "America/New_York"
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
- name: media
|
||||
mountPath: /media
|
||||
- name: downloads
|
||||
mountPath: /downloads
|
||||
volumes:
|
||||
- name: config
|
||||
persistentVolumeClaim:
|
||||
claimName: sonarr-config
|
||||
- name: media
|
||||
persistentVolumeClaim:
|
||||
claimName: media-data
|
||||
- name: downloads
|
||||
persistentVolumeClaim:
|
||||
claimName: sonarr-downloads
|
||||
@@ -1,26 +0,0 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: sonarr
|
||||
namespace: media
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- sonarr.khalisio.com
|
||||
secretName: sonarr-tls
|
||||
rules:
|
||||
- host: sonarr.khalisio.com
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: sonarr
|
||||
port:
|
||||
number: 8989
|
||||
entryPoints:
|
||||
- web
|
||||
- websecure
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: sonarr
|
||||
namespace: media
|
||||
spec:
|
||||
selector:
|
||||
app: sonarr
|
||||
ports:
|
||||
- port: 8989
|
||||
targetPort: 8989
|
||||
protocol: TCP
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,55 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/operator:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http-metrics
|
||||
protocol: TCP
|
||||
env:
|
||||
- name: TS_KUBE_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: tailscale-operator-secret
|
||||
volumeMounts:
|
||||
- name: oauth-config
|
||||
mountPath: /etc/tailscale/oauth
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: oauth-config
|
||||
secret:
|
||||
secretName: tailscale-operator-secret
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
ports:
|
||||
- port: 8080
|
||||
name: http-metrics
|
||||
targetPort: http-metrics
|
||||
selector:
|
||||
app: tailscale-operator
|
||||
@@ -0,0 +1,49 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: tailscale
|
||||
labels:
|
||||
app.kubernetes.io/name: tailscale-operator
|
||||
app.kubernetes.io/part-of: infrastructure
|
||||
management: gitops
|
||||
managed-by: orion
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app.kubernetes.io/name: tailscale-operator
|
||||
app.kubernetes.io/part-of: infrastructure
|
||||
management: gitops
|
||||
managed-by: orion
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: tailscale-operator
|
||||
spec:
|
||||
serviceAccountName: tailscale-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/k8s-operator:1.78.1
|
||||
env:
|
||||
- name: TS_AUTH_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: tailscale-auth
|
||||
key: TS_AUTH_KEY
|
||||
- name: TS_USERSPACE
|
||||
value: "true"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
@@ -0,0 +1,18 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: tailscale-auth
|
||||
namespace: tailscale
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: orion-vault
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: tailscale-auth
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: TS_AUTH_KEY
|
||||
remoteRef:
|
||||
key: Talos Cluster/tailscale
|
||||
property: TS_AUTH_KEY
|
||||
@@ -1,6 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: tailscale
|
||||
labels:
|
||||
kubernetes.io/metadata.name: tailscale
|
||||
@@ -0,0 +1,17 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["secrets", "configmaps", "services", "pods", "endpoints"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets", "daemonsets"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
- apiGroups: ["tailscale.com"]
|
||||
resources: ["*"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
+1
-1
@@ -9,4 +9,4 @@ roleRef:
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
namespace: tailscale
|
||||
@@ -0,0 +1,50 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
serviceAccountName: tailscale-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/k8s-operator:v1.78.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: TS_CLIENT_ID_FILE
|
||||
value: /etc/tailscale/oauth/client-id
|
||||
- name: TS_CLIENT_SECRET_FILE
|
||||
value: /etc/tailscale/oauth/client-secret
|
||||
volumeMounts:
|
||||
- name: oauth-secret
|
||||
mountPath: /etc/tailscale/oauth
|
||||
readOnly: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
volumes:
|
||||
- name: oauth-secret
|
||||
secret:
|
||||
secretName: tailscale-operator-secret
|
||||
+3
-1
@@ -2,4 +2,6 @@ apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
@@ -0,0 +1,37 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/k8s-operator:latest
|
||||
env:
|
||||
- name: TS_K8S_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: TS_K8S_SECRET
|
||||
value: tailscale-operator-secret
|
||||
- name: TS_CLIENT_ID_FILE
|
||||
value: /etc/tailscale/oauth/client-id
|
||||
- name: TS_CLIENT_SECRET_FILE
|
||||
value: /etc/tailscale/oauth/client-secret
|
||||
volumeMounts:
|
||||
- name: oauth-secret
|
||||
mountPath: /etc/tailscale/oauth
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: oauth-secret
|
||||
secret:
|
||||
secretName: tailscale-operator-secret
|
||||
@@ -1,14 +0,0 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "secrets", "configmaps"]
|
||||
verbs: ["*"]
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "daemonsets", "statefulsets"]
|
||||
verbs: ["*"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["networkpolicies", "ingresses"]
|
||||
verbs: ["*"]
|
||||
@@ -1,31 +0,0 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
serviceAccountName: tailscale-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/operator:v1.70.0
|
||||
env:
|
||||
- name: DEPLOY_TYPE
|
||||
value: k8s
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
volumes:
|
||||
- name: config
|
||||
secret:
|
||||
secretName: tailscale-operator-config
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
spec:
|
||||
refreshInterval: 1h
|
||||
secretStoreRef:
|
||||
name: vault
|
||||
kind: SecretStore
|
||||
target:
|
||||
name: tailscale-operator
|
||||
template:
|
||||
engineVersion: v2
|
||||
data:
|
||||
TS_AUTHKEY: "{{ .TS_AUTHKEY }}"
|
||||
data:
|
||||
- secretKey: TS_AUTHKEY
|
||||
remoteRef:
|
||||
key: secret/data/kubernetes/tailscale-operator
|
||||
property: TS_AUTHKEY
|
||||
@@ -0,0 +1,43 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
serviceAccountName: tailscale-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/k8s-operator:v1.78.3
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: CLIENT_ID_FILE
|
||||
value: /etc/tailscale/operator/client-id
|
||||
- name: CLIENT_SECRET_FILE
|
||||
value: /etc/tailscale/operator/client-secret
|
||||
volumeMounts:
|
||||
- name: operator-secret
|
||||
mountPath: /etc/tailscale/operator
|
||||
readOnly: true
|
||||
resources: {}
|
||||
volumes:
|
||||
- name: operator-secret
|
||||
secret:
|
||||
secretName: tailscale-operator-secret
|
||||
@@ -0,0 +1,42 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
serviceAccountName: tailscale-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/k8s-operator:v1.78.3
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: TS_CLIENT_ID_FILE
|
||||
value: /etc/tailscale/oauth/client-id
|
||||
- name: TS_CLIENT_SECRET_FILE
|
||||
value: /etc/tailscale/oauth/client-secret
|
||||
volumeMounts:
|
||||
- name: oauth-secret
|
||||
mountPath: /etc/tailscale/oauth
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: oauth-secret
|
||||
secret:
|
||||
secretName: tailscale-operator-secret
|
||||
@@ -0,0 +1,42 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: tailscale-operator
|
||||
namespace: tailscale
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: tailscale-operator
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: tailscale-operator
|
||||
spec:
|
||||
serviceAccountName: tailscale-operator
|
||||
containers:
|
||||
- name: operator
|
||||
image: ghcr.io/tailscale/k8s-operator:v1.78.3
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: TS_CLIENT_ID_FILE
|
||||
value: /etc/tailscale/oauth/client-id
|
||||
- name: TS_CLIENT_SECRET_FILE
|
||||
value: /etc/tailscale/oauth/client-secret
|
||||
volumeMounts:
|
||||
- name: oauth-secret
|
||||
mountPath: /etc/tailscale/oauth
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: oauth-secret
|
||||
secret:
|
||||
secretName: tailscale-operator-secret
|
||||
Reference in New Issue
Block a user