mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-09-17 02:12:55 +02:00
Remove unused resources
This commit is contained in:
Ruben Hensen
@@ -0,0 +1,167 @@
|
||||
# apiVersion: argoproj.io/v1alpha1
|
||||
# kind: Application
|
||||
# metadata:
|
||||
# name: mosquitto-helm
|
||||
# namespace: argocd
|
||||
# finalizers:
|
||||
# - resources-finalizer.argocd.argoproj.io
|
||||
# spec:
|
||||
# syncPolicy:
|
||||
# syncOptions:
|
||||
# - CreateNamespace=true
|
||||
# automated:
|
||||
# prune: true
|
||||
# selfHeal: true
|
||||
# project: default
|
||||
# sources:
|
||||
# - chart: mosquitto
|
||||
# repoURL: https://storage.googleapis.com/t3n-helm-charts
|
||||
# targetRevision: v2.4.1 # Replace with the Longhorn version you'd like to install or upgrade to
|
||||
# helm:
|
||||
# values: |
|
||||
# replicaCount: 1
|
||||
# strategyType: Recreate
|
||||
|
||||
# image:
|
||||
# repository: eclipse-mosquitto
|
||||
# tag: 1.6.12
|
||||
# pullPolicy: IfNotPresent
|
||||
|
||||
# imagePullSecrets: []
|
||||
# nameOverride: ""
|
||||
# fullnameOverride: ""
|
||||
|
||||
# serviceAccount:
|
||||
# # Specifies whether a service account should be created
|
||||
# create: true
|
||||
# # The name of the service account to use.
|
||||
# # If not set and create is true, a name is generated using the fullname template
|
||||
# name:
|
||||
|
||||
# service:
|
||||
# type: ClusterIP
|
||||
# externalTrafficPolicy: null
|
||||
# annotations: {}
|
||||
# # metallb.universe.tf/allow-shared-ip: pi-hole
|
||||
|
||||
# ports:
|
||||
# mqtt:
|
||||
# port: 1883
|
||||
# # sets consistent nodePort, required to set service.type=NodePort
|
||||
# # nodePort: 31883
|
||||
# protocol: TCP
|
||||
# websocket:
|
||||
# port: 9090
|
||||
# protocol: TCP
|
||||
|
||||
# persistence:
|
||||
# enabled: true
|
||||
# accessMode: ReadWriteOnce
|
||||
# existingClaim: ""
|
||||
# mountPath: /mosquitto/data
|
||||
# subPath: ""
|
||||
# ## database data Persistent Volume Storage Class
|
||||
# ## If defined, storageClassName: <storageClass>
|
||||
# ## If set to "-", storageClassName: "", which disables dynamic provisioning
|
||||
# ## If undefined (the default) or set to null, no storageClassName spec is
|
||||
# ## set, choosing the default provisioner. (gp2 on AWS, standard on
|
||||
# ## GKE, AWS & OpenStack)
|
||||
# ##
|
||||
# # storageClass: "-"
|
||||
# size: 1Gi
|
||||
|
||||
# resources: {}
|
||||
# # We usually recommend not to specify default resources and to leave this as a conscious
|
||||
# # choice for the user. This also increases chances charts run on environments with little
|
||||
# # resources, such as Minikube. If you do want to specify resources, uncomment the following
|
||||
# # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
|
||||
# # limits:
|
||||
# # cpu: 100m
|
||||
# # memory: 128Mi
|
||||
# # requests:
|
||||
# # cpu: 100m
|
||||
# # memory: 128Mi
|
||||
|
||||
# podSecurityContext: {}
|
||||
# # runAsUser: 1001
|
||||
# # fsGroup: 10000
|
||||
|
||||
# securityContext: {}
|
||||
# # runAsUser: 1001
|
||||
# # fsGroup: 10000
|
||||
|
||||
# nodeSelector: {}
|
||||
|
||||
# tolerations: []
|
||||
|
||||
# affinity: {}
|
||||
|
||||
# authentication:
|
||||
# passwordEntries: ""
|
||||
# # To use authentication with mosquitto, you can set a list of password entries to be used.
|
||||
# # reference https://mosquitto.org/man/mosquitto_passwd-1.html to generate these entries.
|
||||
# # For example:
|
||||
# # passwordEntries: |-
|
||||
# # user1:$6$BKzw0RKerxV4Esbj$Uz5slWGB1TiOtYIEokEl0eR1YSEQAdKpcdRYMsLYbwjktlVzdLyGk41YCPGyMLnBePtdwPhkcm8kjGI0R9s57w==
|
||||
# # user2:$6$b5vYuHrSLj48Ii32$NjlbnatIaUQSsNvxxTpawpav6NPyZ8QhGrdEVGtyU1rgEGjNzVGKlstRg29FV6MFTPs/ugPA8D5I5+qRcIMXSg==
|
||||
# passwordFilePath: "/etc/mosquitto/passwordfile"
|
||||
|
||||
# authorization:
|
||||
# acls: ""
|
||||
# # To use authorizations with mosquitto, you can set a list of per user or pattern-based rules.
|
||||
# # reference https://mosquitto.org/man/mosquitto-conf-5.html for further information.
|
||||
# # For example:
|
||||
# # acls: |-
|
||||
# # zigbee2mqtt ACLs
|
||||
# # user zigbee2mqtt
|
||||
# # topic readwrite zigbee2mqtt/#
|
||||
# # topic readwrite homeassistant/#
|
||||
# # Tasmota-compatible ACLs
|
||||
# # pattern read cmnd/%u/#
|
||||
# # pattern write stat/%u/#
|
||||
# # pattern write tele/%u/#
|
||||
# aclfilePath: "/etc/mosquitto/aclfile"
|
||||
|
||||
# existingConfigMap: ""
|
||||
# config: |
|
||||
# persistence true
|
||||
# persistence_location /mosquitto/data/
|
||||
# log_dest stdout
|
||||
# listener 1883
|
||||
# listener 9090
|
||||
# protocol websockets
|
||||
|
||||
# ## Additional volumes.
|
||||
# extraVolumes: []
|
||||
# # - name: tls
|
||||
# # secret:
|
||||
# # secretName: mosquitto-certs
|
||||
|
||||
# ## Additional volumeMounts to the main container.
|
||||
# extraVolumeMounts: []
|
||||
# # - name: tls
|
||||
# # mountPath: /certs
|
||||
# # subPath: cafile
|
||||
|
||||
# monitoring:
|
||||
# podMonitor:
|
||||
# enabled: false
|
||||
# sidecar:
|
||||
# enabled: false
|
||||
# port: 9234
|
||||
# # nodePort: 32234
|
||||
# image:
|
||||
# repository: nolte/mosquitto-exporter
|
||||
# tag: v0.6.3
|
||||
# pullPolicy: IfNotPresent
|
||||
# resources:
|
||||
# limits:
|
||||
# cpu: 300m
|
||||
# memory: 128Mi
|
||||
# requests:
|
||||
# cpu: 100m
|
||||
# memory: 64Mi
|
||||
|
||||
# destination:
|
||||
# server: https://kubernetes.default.svc
|
||||
# namespace: owntracks
|
||||
@@ -0,0 +1,279 @@
|
||||
---
|
||||
# PersistentVolumeClaim for OwnTracks Recorder
|
||||
# apiVersion: v1
|
||||
# kind: PersistentVolumeClaim
|
||||
# metadata:
|
||||
# name: otrecorder-config-pvc
|
||||
# spec:
|
||||
# accessModes:
|
||||
# - ReadWriteOnce
|
||||
# resources:
|
||||
# requests:
|
||||
# storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: otrecorder-store-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
# PersistentVolumeClaim for Mosquitto
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mosquitto-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mosquitto-logs-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
---
|
||||
# ExternalSecret for OwnTracks Recorder password
|
||||
# apiVersion: external-secrets.io/v1beta1
|
||||
# kind: ExternalSecret
|
||||
# metadata:
|
||||
# name: owntracks-mqtt-credentials
|
||||
# spec:
|
||||
# refreshInterval: "15m"
|
||||
# secretStoreRef:
|
||||
# name: vault-backend
|
||||
# kind: ClusterSecretStore
|
||||
# target:
|
||||
# name: owntracks-mqtt-password
|
||||
# creationPolicy: Owner
|
||||
# data:
|
||||
# - secretKey: password
|
||||
# remoteRef:
|
||||
# key: kv/mqtt
|
||||
# property: password
|
||||
|
||||
---
|
||||
# Deployment for OwnTracks Recorder
|
||||
# apiVersion: apps/v1
|
||||
# kind: Deployment
|
||||
# metadata:
|
||||
# name: otrecorder
|
||||
# spec:
|
||||
# replicas: 1
|
||||
# selector:
|
||||
# matchLabels:
|
||||
# app: otrecorder
|
||||
# template:
|
||||
# metadata:
|
||||
# labels:
|
||||
# app: otrecorder
|
||||
# spec:
|
||||
# containers:
|
||||
# - name: otrecorder
|
||||
# image: owntracks/recorder
|
||||
# ports:
|
||||
# - containerPort: 8083
|
||||
# env:
|
||||
# - name: OTR_HOST
|
||||
# value: "mqtt"
|
||||
# - name: OTR_PORT
|
||||
# value: "8883"
|
||||
# - name: OTR_USER
|
||||
# value: "ruben"
|
||||
# # - name: TZ
|
||||
# # value: "Europe/Berlin"
|
||||
# # - name: VIRTUAL_HOST
|
||||
# # value: "owntracks.hensen.io"
|
||||
# # - name: VIRTUAL_PORT
|
||||
# # value: 8883
|
||||
# # - name: OTR_CLIENTID
|
||||
# # value: ""
|
||||
# - name: OTR_PASS
|
||||
# valueFrom:
|
||||
# secretKeyRef:
|
||||
# name: owntracks-mqtt-password
|
||||
# key: password
|
||||
# volumeMounts:
|
||||
# - name: store
|
||||
# mountPath: /store
|
||||
# volumes:
|
||||
# - name: store
|
||||
# persistentVolumeClaim:
|
||||
# claimName: otrecorder-store-pvc
|
||||
---
|
||||
# Service for OwnTracks Recorder
|
||||
# apiVersion: v1
|
||||
# kind: Service
|
||||
# metadata:
|
||||
# name: otrecorder
|
||||
# spec:
|
||||
# selector:
|
||||
# app: otrecorder
|
||||
# ports:
|
||||
# - port: 8083
|
||||
# targetPort: 8083
|
||||
# type: ClusterIP
|
||||
---
|
||||
# ExternalSecret to fetch MQTT password file from Vault
|
||||
apiVersion: external-secrets.io/v1beta1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: mqtt-password-file
|
||||
spec:
|
||||
refreshInterval: "15m"
|
||||
secretStoreRef:
|
||||
name: vault-backend
|
||||
kind: ClusterSecretStore
|
||||
target:
|
||||
name: mqtt-password-secret
|
||||
creationPolicy: Owner
|
||||
data:
|
||||
- secretKey: password_file
|
||||
remoteRef:
|
||||
key: kv/mqtt
|
||||
property: secret
|
||||
|
||||
---
|
||||
# ConfigMap for MQTT configuration
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: mqtt-config
|
||||
data:
|
||||
mosquitto.conf: |
|
||||
listener 8883
|
||||
allow_anonymous false
|
||||
password_file /mosquitto/config/password_file
|
||||
# Add other MQTT configuration options here
|
||||
listener 8083
|
||||
protocol websockets
|
||||
---
|
||||
# MQTT Deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: mqtt
|
||||
labels:
|
||||
app: mqtt
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: mqtt
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: mqtt
|
||||
spec:
|
||||
containers:
|
||||
- name: mqtt
|
||||
image: eclipse-mosquitto:latest
|
||||
ports:
|
||||
- containerPort: 8883
|
||||
name: mqtt
|
||||
- containerPort: 8083
|
||||
name: websocket
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /mosquitto/config/mosquitto.conf
|
||||
subPath: mosquitto.conf
|
||||
- name: password-file
|
||||
mountPath: /mosquitto/config/password_file
|
||||
subPath: password_file
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: mqtt-config
|
||||
- name: password-file
|
||||
secret:
|
||||
secretName: mqtt-password-secret
|
||||
|
||||
---
|
||||
# MQTT Service
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: mqtt
|
||||
spec:
|
||||
selector:
|
||||
app: mqtt
|
||||
ports:
|
||||
- port: 8883
|
||||
targetPort: 8883
|
||||
name: mqtt
|
||||
- port: 8083
|
||||
targetPort: 8083
|
||||
name: websocket
|
||||
---
|
||||
# External access with Ingress for OwnTracks Recorder
|
||||
# apiVersion: networking.k8s.io/v1
|
||||
# kind: Ingress
|
||||
# metadata:
|
||||
# name: otrecorder-ingress
|
||||
# annotations:
|
||||
# nginx.ingress.kubernetes.io/rewrite-target: /
|
||||
# cert-manager.io/cluster-issuer: prod-cluster-issuer
|
||||
# spec:
|
||||
# ingressClassName: nginx
|
||||
# tls:
|
||||
# - hosts:
|
||||
# - owntracks.hensen.io
|
||||
# secretName: owntracks-tls-secret
|
||||
# rules:
|
||||
# - host: owntracks.hensen.io
|
||||
# http:
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: otrecorder
|
||||
# port:
|
||||
# number: 8083
|
||||
---
|
||||
# Corrected MQTT Ingress:
|
||||
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: mqtt-ingress
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: prod-cluster-issuer
|
||||
# Add NGINX TCP passthrough annotations
|
||||
nginx.ingress.kubernetes.io/ssl-passthrough: "false"
|
||||
nginx.ingress.kubernetes.io/backend-protocol: "TCP"
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- hosts:
|
||||
- mqtt.hensen.io
|
||||
secretName: mqtt-tls-secret
|
||||
rules:
|
||||
- host: mqtt.hensen.io
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: mqtt
|
||||
port:
|
||||
number: 8083
|
||||
|
||||
# Note: For proper MQTT over TLS, consider these alternatives:
|
||||
# 1. Use a TCP Load Balancer instead of an Ingress
|
||||
# 2. Configure the MQTT broker to use TLS directly (port 8883)
|
||||
# 3. Use NGINX TCP ingress controller configuration
|
||||
Reference in New Issue
Block a user