mirror of
https://github.com/allaunthefox/SilverSight.git
synced 2026-07-30 17:16:16 +00:00
allaun
781578001d
- Add .sops.yaml (workstation + cluster age keys) - Add infra/secrets/homarr-values.enc.yaml (SOPS encrypted) - Add infra/secrets/authentik-values.enc.yaml (SOPS encrypted) - Add infra/secrets/webhook-secret.enc.yaml (SOPS encrypted) - Add infra/webhook/hooks.yaml (adnanh/webhook config) - Add infra/webhook/deploy.sh (SOPS decrypt + helm upgrade) - Add infra/webhook/deployment.yaml (k3s Deployment + RBAC) age keys: workstation: age17nzzwaftrkcuerlt4vq2eh98fdfxnv3eqykdxf5c3hqa0pvc2uhq26dxeq cluster: age1s6t5qpt0h7xlj98zkza0e7pjzj686k38xdu7jrz0nsreaw092drq4v7h02 Cluster private key stored only in k8s secret sops-age (namespace: infra).
115 lines
2.5 KiB
YAML
115 lines
2.5 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: infra
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: webhook
|
|
namespace: infra
|
|
labels:
|
|
app: webhook
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: webhook
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: webhook
|
|
spec:
|
|
serviceAccountName: webhook-deployer
|
|
containers:
|
|
- name: webhook
|
|
image: ghcr.io/adnanh/webhook:latest
|
|
args:
|
|
- -hooks=/config/hooks.yaml
|
|
- -verbose
|
|
- -port=9000
|
|
ports:
|
|
- containerPort: 9000
|
|
name: http
|
|
env:
|
|
- name: WEBHOOK_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: webhook-secret
|
|
key: webhook-secret
|
|
- name: SOPS_AGE_KEY_FILE
|
|
value: /secrets/age.agekey
|
|
- name: KUBECONFIG
|
|
value: /etc/rancher/k3s/k3s.yaml
|
|
volumeMounts:
|
|
- name: hooks-config
|
|
mountPath: /config
|
|
- name: scripts
|
|
mountPath: /scripts
|
|
- name: sops-age
|
|
mountPath: /secrets
|
|
readOnly: true
|
|
- name: repos
|
|
mountPath: /repos
|
|
- name: k3s-config
|
|
mountPath: /etc/rancher/k3s
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 200m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: hooks-config
|
|
configMap:
|
|
name: webhook-hooks
|
|
- name: scripts
|
|
configMap:
|
|
name: webhook-scripts
|
|
defaultMode: 0755
|
|
- name: sops-age
|
|
secret:
|
|
secretName: sops-age
|
|
- name: repos
|
|
hostPath:
|
|
path: /opt/repos
|
|
type: DirectoryOrCreate
|
|
- name: k3s-config
|
|
hostPath:
|
|
path: /etc/rancher/k3s
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: webhook-deployer
|
|
namespace: infra
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: webhook-deployer
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: cluster-admin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: webhook-deployer
|
|
namespace: infra
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: webhook
|
|
namespace: infra
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
app: webhook
|
|
ports:
|
|
- port: 9000
|
|
targetPort: 9000
|
|
nodePort: 31900
|
|
name: http
|