infra/home-cluster
2
0 Fork 0
Code Issues Pull Requests 40 Actions Packages Projects Releases Wiki Activity

feat: enabled monitors everywhere and standardize resources a bit (#1281)

Browse Source 
* feat: enabled monitors everywhere and standardize resources a bit

Signed-off-by: Devin Buhl <devin@buhl.casa>

* add raw tags

---------

Signed-off-by: Devin Buhl <devin@buhl.casa>
This commit is contained in:
Devin Buhl authored and GitHub committed 2024-01-31 18:01:47 -05:00
1 parent b24a55e790
commit c59d03c69e
13 files changed
+62 -28
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2
+15 -6
View File
@@ -35,7 +35,7 @@ spec:
repository: docker.io/cloudflare/cloudflared
tag: 2024.1.5
env:
NO_AUTOUPDATE: "true"
NO_AUTOUPDATE: true
TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
TUNNEL_METRICS: 0.0.0.0:8080
TUNNEL_ORIGIN_ENABLE_HTTP2: true
@@ -67,21 +67,30 @@ spec:
readiness: *probes
startup:
enabled: false
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities: { drop: ["ALL"] }
seccompProfile:
type: RuntimeDefault
resources:
requests:
cpu: 5m
memory: 128M
cpu: 10m
limits:
memory: 256M
memory: 256Mi
pod:
securityContext:
runAsUser: 568
runAsGroup: 568
runAsUser: 65534
runAsGroup: 65534
runAsNonRoot: true
service:
main:
ports:
http:
port: *port
serviceMonitor:
main:
enabled: true
persistence:
config:
enabled: true
bootstrap/templates/kubernetes/apps/network/echo-server/app/helmrelease.yaml.j2
+11 -5
View File
@@ -48,16 +48,22 @@ spec:
readiness: *probes
startup:
enabled: false
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities: { drop: ["ALL"] }
seccompProfile:
type: RuntimeDefault
resources:
requests:
cpu: 5m
memory: 10M
cpu: 10m
limits:
memory: 64M
memory: 64Mi
pod:
securityContext:
runAsUser: 568
runAsGroup: 568
runAsNonRoot: true
runAsUser: 65534
runAsGroup: 65534
service:
main:
ports:
bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2
+2
View File
@@ -41,5 +41,7 @@ spec:
txtPrefix: k8s.
txtOwnerId: default
domainFilters: ["${SECRET_DOMAIN}"]
serviceMonitor:
enabled: true
podAnnotations:
secret.reloader.stakater.com/reload: external-dns-secret
bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2
Vendored
+7 -2
View File
@@ -63,6 +63,12 @@ spec:
proxy-body-size: 0
proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2
metrics:
enabled: true
serviceMonitor:
enabled: true
namespaceSelector:
any: true
extraArgs:
{% if cloudflare.acme.production %}
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
@@ -80,8 +86,7 @@ spec:
app.kubernetes.io/component: controller
resources:
requests:
cpu: 10m
memory: 250Mi
cpu: 100m
limits:
memory: 500Mi
defaultBackend:
bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2
+7 -2
View File
@@ -60,6 +60,12 @@ spec:
proxy-body-size: 0
proxy-buffer-size: 16k
ssl-protocols: TLSv1.3 TLSv1.2
metrics:
enabled: true
serviceMonitor:
enabled: true
namespaceSelector:
any: true
extraArgs:
{% if cloudflare.acme.production %}
default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
@@ -77,8 +83,7 @@ spec:
app.kubernetes.io/component: controller
resources:
requests:
cpu: 10m
memory: 250Mi
cpu: 100m
limits:
memory: 500Mi
defaultBackend: