feat: enabled monitors everywhere and standardize resources a bit (#1281)
* feat: enabled monitors everywhere and standardize resources a bit Signed-off-by: Devin Buhl <devin@buhl.casa> * add raw tags --------- Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed
1 parent
b24a55e790
commit
c59d03c69e
13 files changed
+62
-28
No files matched your search
+6
-3
@@ -24,11 +24,14 @@ spec:
|
||||
keepHistory: false
|
||||
values:
|
||||
installCRDs: true
|
||||
extraArgs:
|
||||
- --dns01-recursive-nameservers=1.1.1.1:53,9.9.9.9:53
|
||||
- --dns01-recursive-nameservers-only
|
||||
dns01RecursiveNameservers: 1.1.1.1:53,9.9.9.9:53
|
||||
dns01RecursiveNameserversOnly: true
|
||||
podDnsPolicy: None
|
||||
podDnsConfig:
|
||||
nameservers:
|
||||
- "1.1.1.1"
|
||||
- "9.9.9.9"
|
||||
prometheus:
|
||||
enabled: true
|
||||
podMonitor:
|
||||
enabled: true
|
||||
+4
@@ -26,3 +26,7 @@ spec:
|
||||
{% filter indent(width=4, first=True) %}
|
||||
{% include 'partials/kubelet-csr-approver-values.partial.yaml.j2' %}
|
||||
{% endfilter %}
|
||||
metrics:
|
||||
enable: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
@@ -28,3 +28,7 @@ spec:
|
||||
- --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
|
||||
- --kubelet-use-node-status-port
|
||||
- --metric-resolution=15s
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
@@ -26,3 +26,6 @@ spec:
|
||||
fullnameOverride: reloader
|
||||
reloader:
|
||||
readOnlyRootFileSystem: true
|
||||
podMonitor:
|
||||
enabled: true
|
||||
namespace: "{% raw %}{{ .Release.Namespace }}{% endraw %}"
|
||||
@@ -34,3 +34,5 @@ spec:
|
||||
service:
|
||||
registry:
|
||||
hostPort: 29999
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
@@ -35,7 +35,7 @@ spec:
|
||||
repository: docker.io/cloudflare/cloudflared
|
||||
tag: 2024.1.5
|
||||
env:
|
||||
NO_AUTOUPDATE: "true"
|
||||
NO_AUTOUPDATE: true
|
||||
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
|
||||
TUNNEL_METRICS: 0.0.0.0:8080
|
||||
TUNNEL_ORIGIN_ENABLE_HTTP2: true
|
||||
@@ -67,21 +67,30 @@ spec:
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: ["ALL"] }
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 128M
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 256M
|
||||
memory: 256Mi
|
||||
pod:
|
||||
securityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
runAsUser: 65534
|
||||
runAsGroup: 65534
|
||||
runAsNonRoot: true
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
http:
|
||||
port: *port
|
||||
serviceMonitor:
|
||||
main:
|
||||
enabled: true
|
||||
persistence:
|
||||
config:
|
||||
enabled: true
|
||||
|
||||
@@ -48,16 +48,22 @@ spec:
|
||||
readiness: *probes
|
||||
startup:
|
||||
enabled: false
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities: { drop: ["ALL"] }
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 10M
|
||||
cpu: 10m
|
||||
limits:
|
||||
memory: 64M
|
||||
memory: 64Mi
|
||||
pod:
|
||||
securityContext:
|
||||
runAsUser: 568
|
||||
runAsGroup: 568
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65534
|
||||
runAsGroup: 65534
|
||||
service:
|
||||
main:
|
||||
ports:
|
||||
|
||||
@@ -41,5 +41,7 @@ spec:
|
||||
txtPrefix: k8s.
|
||||
txtOwnerId: default
|
||||
domainFilters: ["${SECRET_DOMAIN}"]
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
podAnnotations:
|
||||
secret.reloader.stakater.com/reload: external-dns-secret
|
||||
+7
-2
@@ -63,6 +63,12 @@ spec:
|
||||
proxy-body-size: 0
|
||||
proxy-buffer-size: 16k
|
||||
ssl-protocols: TLSv1.3 TLSv1.2
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
namespaceSelector:
|
||||
any: true
|
||||
extraArgs:
|
||||
{% if cloudflare.acme.production %}
|
||||
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
|
||||
@@ -80,8 +86,7 @@ spec:
|
||||
app.kubernetes.io/component: controller
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 250Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 500Mi
|
||||
defaultBackend:
|
||||
|
||||
+7
-2
@@ -60,6 +60,12 @@ spec:
|
||||
proxy-body-size: 0
|
||||
proxy-buffer-size: 16k
|
||||
ssl-protocols: TLSv1.3 TLSv1.2
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
namespaceSelector:
|
||||
any: true
|
||||
extraArgs:
|
||||
{% if cloudflare.acme.production %}
|
||||
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
|
||||
@@ -77,8 +83,7 @@ spec:
|
||||
app.kubernetes.io/component: controller
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 250Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 500Mi
|
||||
defaultBackend:
|
||||
|
||||
+1
-6
@@ -48,14 +48,9 @@ spec:
|
||||
fieldPath: metadata.namespace
|
||||
pod:
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65534
|
||||
runAsGroup: 65534
|
||||
allowPrivilegeEscalation: false
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
runAsNonRoot: true
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
autoDirectNodeRoutes: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
bgp:
|
||||
enabled: false
|
||||
cluster:
|
||||
name: home-kubernetes
|
||||
id: 1
|
||||
|
||||
@@ -1,8 +1,6 @@
|
||||
autoDirectNodeRoutes: true
|
||||
bpf:
|
||||
masquerade: true
|
||||
bgp:
|
||||
enabled: false
|
||||
cluster:
|
||||
name: home-kubernetes
|
||||
id: 1
|
||||
|
||||
Reference in new issue
Block a user