diff --git a/longhorn/volume-snapshot.yaml b/longhorn/volume-snapshot.yaml index ab81521..809743d 100644 --- a/longhorn/volume-snapshot.yaml +++ b/longhorn/volume-snapshot.yaml @@ -2,6 +2,8 @@ kind: VolumeSnapshotClass apiVersion: snapshot.storage.k8s.io/v1 metadata: name: longhorn-backup-vsc + labels: + velero.io/csi-volumesnapshot-class: "true" driver: driver.longhorn.io deletionPolicy: Delete parameters: diff --git a/minio/helm-minio-operator.yaml b/minio/helm-minio-operator.yaml deleted file mode 100644 index 98d52b7..0000000 --- a/minio/helm-minio-operator.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: minio-operator - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - syncPolicy: - syncOptions: - - CreateNamespace=true - automated: - selfHeal: true - prune: true - project: default - sources: - - chart: operator - repoURL: https://operator.min.io - targetRevision: 6.0.3 - helm: - valueFiles: - - $values/minio/values-operator.yaml - - repoURL: https://github.com/rubenhensen/k8scd.git - targetRevision: HEAD - ref: values - destination: - server: https://kubernetes.default.svc - namespace: minio-operator \ No newline at end of file diff --git a/minio/helm-minio-tenant.yaml b/minio/helm-minio-tenant.yaml deleted file mode 100644 index fa5aa64..0000000 --- a/minio/helm-minio-tenant.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: minio-tenant - namespace: argocd - finalizers: - - resources-finalizer.argocd.argoproj.io -spec: - syncPolicy: - syncOptions: - - CreateNamespace=true - automated: - selfHeal: true - prune: true - project: default - sources: - - chart: tenant - repoURL: https://operator.min.io - targetRevision: 6.0.3 - helm: - valueFiles: - - $values/minio/values-tenant.yaml - - repoURL: https://github.com/rubenhensen/k8scd.git - targetRevision: HEAD - ref: values - destination: - server: https://kubernetes.default.svc - namespace: minio-tenant - - diff --git a/minio/minio-tenant-es.yaml b/minio/minio-tenant-es.yaml deleted file mode 100644 index b4de7b0..0000000 --- a/minio/minio-tenant-es.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: minio-tenant-es - namespace: minio-tenant -spec: - refreshInterval: "15s" - secretStoreRef: - name: vault-backend - kind: ClusterSecretStore - target: - name: minio-env-configuration - - data: - - secretKey: config.env - remoteRef: - key: minio-tenant-root - property: config.env - - # # metadataPolicy to fetch all the labels in JSON format - # - secretKey: tags - # remoteRef: - # metadataPolicy: Fetch - # key: foo - - # # metadataPolicy to fetch a specific label (dev) from the source secret - # - secretKey: developer - # remoteRef: - # metadataPolicy: Fetch - # key: foo - # property: dev \ No newline at end of file diff --git a/minio/values-operator.yaml b/minio/values-operator.yaml deleted file mode 100644 index bb268e4..0000000 --- a/minio/values-operator.yaml +++ /dev/null @@ -1,319 +0,0 @@ -### -# Root key for Operator Helm Chart -operator: - ### - # An array of environment variables to pass to the Operator deployment. - # Pass an empty array to start Operator with defaults. - # - # For example: - # - # .. code-block:: yaml - # - # env: - # - name: MINIO_OPERATOR_DEPLOYMENT_NAME - # valueFrom: - # fieldRef: - # fieldPath: metadata.labels['app.kubernetes.io/name'] - # - name: MINIO_CONSOLE_TLS_ENABLE - # value: "off" - # - name: CLUSTER_DOMAIN - # value: "cluster.domain" - # - name: WATCHED_NAMESPACE - # value: "" - # - name: MINIO_OPERATOR_RUNTIME - # value: "OpenShift" - # - # See `Operator environment variables `__ for a list of all supported values. - env: - - name: OPERATOR_STS_ENABLED - value: "on" - ### - # Specify the Operator container image to use for the deployment. - # ``image.tag`` - # For example, the following sets the image to the ``quay.io/minio/operator`` repo and the v5.0.11 tag. - # The container pulls the image if not already present: - # - # .. code-block:: yaml - # - # image: - # repository: quay.io/minio/operator - # tag: v5.0.11 - # pullPolicy: IfNotPresent - # - # The chart also supports specifying an image based on digest value: - # - # .. code-block:: yaml - # - # image: - # repository: quay.io/minio/operator@sha256 - # digest: 28c80b379c75242c6fe793dfbf212f43c602140a0de5ebe3d9c2a3a7b9f9f983 - # pullPolicy: IfNotPresent - # - image: - repository: quay.io/minio/operator - tag: v5.0.11 - pullPolicy: IfNotPresent - ### - # - # An array of Kubernetes secrets to use for pulling images from a private ``image.repository``. - # Only one array element is supported at this time. - imagePullSecrets: [ ] - ### - # - # The name of a custom `Container Runtime `__ to use for the Operator pods. - runtimeClassName: ~ - ### - # An array of `initContainers `__ to start up before the Operator pods. - # Exercise care as ``initContainer`` failures prevent Operator pods from starting. - # Pass an empty array to start the Operator normally. - initContainers: [ ] - ### - # The number of Operator pods to deploy. - # Higher values increase availability in the event of worker node failures. - # - # The cluster must have sufficient number of available worker nodes to fulfill the request. - # Operator pods deploy with pod anti-affinity by default, preventing Kubernetes from scheduling multiple pods onto a single Worker node. - replicaCount: 1 - ### - # The Kubernetes `SecurityContext `__ to use for deploying Operator resources. - # - # You may need to modify these values to meet your cluster's security and access settings. - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - fsGroup: 1000 - ### - # The Kubernetes `SecurityContext `__ to use for deploying Operator containers. - # You may need to modify these values to meet your cluster's security and access settings. - containerSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - ### - # An array of `Volumes `__ which the Operator can mount to pods. - # - # The volumes must exist *and* be accessible to the Operator pods. - volumes: [ ] - ### - # An array of volume mount points associated to each Operator container. - # - # Specify each item in the array as follows: - # - # .. code-block:: yaml - # - # volumeMounts: - # - name: volumename - # mountPath: /path/to/mount - # - # The ``name`` field must correspond to an entry in the ``volumes`` array. - volumeMounts: [ ] - ### - # Any `Node Selectors `__ to apply to Operator pods. - # - # The Kubernetes scheduler uses these selectors to determine which worker nodes onto which it can deploy Operator pods. - # - # If no worker nodes match the specified selectors, the Operator deployment will fail. - nodeSelector: { } - ### - # - # The `Pod Priority `__ to assign to Operator pods. - priorityClassName: "" - ### - # - # The `affinity `__ or anti-affinity settings to apply to Operator pods. - # - # These settings determine the distribution of pods across worker nodes and can help prevent or allow colocating pods onto the same worker nodes. - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: name - operator: In - values: - - minio-operator - topologyKey: kubernetes.io/hostname - ### - # - # An array of `Toleration labels `__ to associate to Operator pods. - # - # These settings determine the distribution of pods across worker nodes. - tolerations: [ ] - ### - # - # An array of `Topology Spread Constraints `__ to associate to Operator pods. - # - # These settings determine the distribution of pods across worker nodes. - topologySpreadConstraints: [ ] - ### - # - # The `Requests or Limits `__ for resources to associate to Operator pods. - # - # These settings can control the minimum and maximum resources requested for each pod. - # If no worker nodes can meet the specified requests, the Operator may fail to deploy. - resources: - requests: - cpu: 200m - memory: 256Mi - ephemeral-storage: 500Mi - -### -# Root key for Operator Console -console: - ### - # Specify ``false`` to disable the Operator Console. - # - # If the Operator Console is disabled, all management of Operator Tenants must be done through the Kubernetes API. - enabled: true - ### - # Specify the Operator Console container image to use for the deployment. - # ``image.tag`` - # For example, the following sets the image to the ``quay.io/minio/operator`` repo and the v5.0.11 tag. - # The container pulls the image if not already present: - # - # .. code-block:: yaml - # - # image: - # repository: quay.io/minio/operator - # tag: v5.0.11 - # pullPolicy: IfNotPresent - # - # The chart also supports specifying an image based on digest value: - # - # .. code-block:: yaml - # - # image: - # repository: quay.io/minio/operator@sha256 - # digest: 28c80b379c75242c6fe793dfbf212f43c602140a0de5ebe3d9c2a3a7b9f9f983 - # pullPolicy: IfNotPresent - # - # The specified values should match that of ``operator.image`` to ensure predictable operations. - image: - repository: quay.io/minio/operator - tag: v5.0.11 - pullPolicy: IfNotPresent - ### - # An array of environment variables to pass to the Operator Console deployment. - # Pass an empty array to start Operator Console with defaults. - env: [ ] - ### - # - # An array of Kubernetes secrets to use for pulling images from a private ``image.repository``. - imagePullSecrets: [ ] - ### - # - # The name of a custom `Container Runtime `__ to use for the Operator Console pods. - runtimeClassName: ~ - ### - # An array of `initContainers `__ to start up before the Operator Console pods. - # Exercise care as ``initContainer`` failures prevent Console pods from starting. - # Pass an empty array to start the Console normally. - initContainers: [ ] - ### - # The number of Operator Console pods to deploy. - # Higher values increase availability in the event of worker node failures. - # - # The cluster must have sufficient number of available worker nodes to fulfill the request. - # Console pods deploy with pod anti-affinity by default, preventing Kubernetes from scheduling multiple pods onto a single Worker node. - replicaCount: 1 - ### - # Any `Node Selectors `__ to apply to Operator Console pods. - # - # The Kubernetes scheduler uses these selectors to determine which worker nodes onto which it can deploy Console pods. - # - # If no worker nodes match the specified selectors, the Console deployment will fail. - nodeSelector: { } - ### - # - # The `affinity `__ or anti-affinity settings to apply to Operator Console pods. - # - # These settings determine the distribution of pods across worker nodes and can help prevent or allow colocating pods onto the same worker nodes. - affinity: - podAntiAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: name - operator: In - values: - - minio-operator - topologyKey: kubernetes.io/hostname - ### - # - # An array of `Toleration labels `__ to associate to Operator Console pods. - # - # These settings determine the distribution of pods across worker nodes. - tolerations: [ ] - ### - # - # An array of `Topology Spread Constraints `__ to associate to Operator Console pods. - # - # These settings determine the distribution of pods across worker nodes. - topologySpreadConstraints: [ ] - ### - # - # The `Requests or Limits `__ for resources to associate to Operator Console pods. - # - # These settings can control the minimum and maximum resources requested for each pod. - # If no worker nodes can meet the specified requests, the Console may fail to deploy. - resources: - requests: - cpu: 0.25 - memory: 512Mi - ### - # The Kubernetes `SecurityContext `__ to use for deploying Operator Console resources. - # - # You may need to modify these values to meet your cluster's security and access settings. - securityContext: - runAsUser: 1000 - runAsNonRoot: true - ### - # The Kubernetes `SecurityContext `__ to use for deploying Operator Console containers. - # You may need to modify these values to meet your cluster's security and access settings. - containerSecurityContext: - runAsUser: 1000 - runAsNonRoot: true - ### - # Configures `Ingress `__ for the Operator Console. - # - # Set the keys to conform to the Ingress controller and configuration of your choice. - # ingress: - # enabled: true - # ingressClassName: nginx - # labels: { } - # annotations: - # cert-manager.io/cluster-issuer: prod-cluster-issuer - # # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # tls: - # # TLS secretName used on ClusterIssuer - # - secretName: letsencrypt-prod - # hosts: - # - minio-console.hensen.io - # host: minio-console.hensen.io - # path: / - # pathType: Prefix - ### - # An array of `Volumes `__ which the Operator Console can mount to pods. - # - # The volumes must exist *and* be accessible to the Console pods. - volumes: - - name: tmp - emptyDir: {} - ### - # An array of volume mount points associated to each Operator Console container. - # - # Specify each item in the array as follows: - # - # .. code-block:: yaml - # - # volumeMounts: - # - name: volumename - # mountPath: /path/to/mount - # - # The ``name`` field must correspond to an entry in the ``volumes`` array. - volumeMounts: - - name: tmp - readOnly: false - mountPath: /tmp/certs/CAs diff --git a/minio/values-tenant.yaml b/minio/values-tenant.yaml deleted file mode 100644 index 2d79f1d..0000000 --- a/minio/values-tenant.yaml +++ /dev/null @@ -1,120 +0,0 @@ -tenant: - name: myminio - image: - repository: quay.io/minio/minio - tag: RELEASE.2024-08-17T01-24-54Z - pullPolicy: IfNotPresent - imagePullSecret: { } - scheduler: { } - configuration: - name: minio-env-configuration - - configSecret: - existingSecret: true - - pools: - - servers: 1 - name: pool-0 - volumesPerServer: 1 - size: 10Gi - storageAnnotations: { } - annotations: { } - labels: { } - tolerations: [ ] - nodeSelector: { } - affinity: { } - resources: { } - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - fsGroupChangePolicy: "OnRootMismatch" - runAsNonRoot: true - containerSecurityContext: - runAsUser: 1000 - runAsGroup: 1000 - runAsNonRoot: true - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - topologySpreadConstraints: [ ] - mountPath: /export - subPath: /data - metrics: - enabled: false - port: 9000 - protocol: http - - certificate: - externalCaCertSecret: [ ] - externalCertSecret: [ ] - requestAutoCert: true - certConfig: { } - features: - bucketDNS: false - domains: { } - enableSFTP: false - buckets: [ ] - users: [ ] - podManagementPolicy: Parallel - liveness: { } - readiness: { } - startup: { } - lifecycle: { } - exposeServices: { } - serviceAccountName: "" - prometheusOperator: false - logging: { } - serviceMetadata: { } - env: [ ] - priorityClassName: "" - additionalVolumes: [ ] - additionalVolumeMounts: [ ] - -ingress: - api: - enabled: true - ingressClassName: nginx - # labels: { } - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/ssl-passthrough: "true" - nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - tls: - - secretName: letsencrypt-prod - hosts: - - minio.hensen.io - host: minio.hensen.io - path: / - pathType: Prefix - console: - enabled: true - ingressClassName: nginx - # labels: { } - annotations: - cert-manager.io/cluster-issuer: prod-cluster-issuer - nginx.ingress.kubernetes.io/ssl-passthrough: "true" - nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - tls: - - secretName: letsencrypt-prod-2 - hosts: - - minio-console.hensen.io - host: minio-console.hensen.io - path: / - pathType: Prefix - - - - - - - - - - - - - diff --git a/velero/backup-schedule.yaml b/velero/backup-schedule.yaml index 255452c..26a6301 100644 --- a/velero/backup-schedule.yaml +++ b/velero/backup-schedule.yaml @@ -6,11 +6,11 @@ metadata: spec: schedule: "0 1 * * *" # Daily at 1 AM template: - includedNamespaces: - - immich - - nextcloud - - home-assistant - - ttrss + # includedNamespaces: + # - immich + # - nextcloud + # - home-assistant + # - ttrss ttl: 720h # 30 days --- apiVersion: velero.io/v1 @@ -21,9 +21,9 @@ metadata: spec: schedule: "0 0 * * 0" # Weekly on Sunday at midnight template: - includedNamespaces: - - immich - - nextcloud - - home-assistant - - ttrss + # includedNamespaces: + # - immich + # - nextcloud + # - home-assistant + # - ttrss ttl: 2160h # 90 days \ No newline at end of file diff --git a/whishper/translate-deployment.yaml b/whishper/translate-deployment.yaml index 8f950f2..18c25a2 100644 --- a/whishper/translate-deployment.yaml +++ b/whishper/translate-deployment.yaml @@ -66,6 +66,9 @@ spec: - containerPort: 5000 protocol: TCP tty: true + securityContext: + runAsUser: 1032 + runAsGroup: 1032 volumeMounts: - mountPath: /home/libretranslate/.local/share name: translate-claim0