cd
/
k8s-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add Kanboard. Really bad notes...

This commit is contained in:
James Pace 2023-03-17 22:24:08 -04:00
parent 37c2e479c5
commit 9e62b870a1
7 changed files with 195 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
cluster-v2-design.md
View File

@ -542,12 +542,10 @@ Add to server:
PublicKey = <>
AllowedIPs = 10.100.100.7/32
# j7s k3s node
[Peer]
PublicKey = <>
AllowedIPs = 10.100.100.8/32
sudo systemctl restart wg-quick@wg0
# Add to systemd
sudo systemctl enable wg-quick@wg0.service
sudo systemctl daemon-reload
sudo systemctl start wg-quick@wg0
```
Tried using nm below, moved to wg-quick for consistency.
@ -560,11 +558,6 @@ nmcli con import type wireguard file /etc/wireguard/wg0.conf
sudo cp wg0.conf /etc/wireguard/wg0.conf
sudo chown root:root /etc/wireguard/wg0.conf
wg-quick up wg0
# Add to systemd
sudo systemctl enable wg-quick@wg0.service
sudo systemctl daemon-reload
sudo systemctl start wg-quick@wg0
```
Harbor Login:
@ -586,3 +579,63 @@ configs:
ca_file: /etc/rancher/k3s/harbor_tls.crt
```
Kanboard:
Get PV Name:
```
kubectl describe pvc kanboard-pvc --context k3s
```
Use PV name to locate directory:
```
kubectl describe pv pvc-89a4265c-b39c-4628-9e6b-df091fae4fd8 --context k3s
```
Can tell on `k3s-node1` at `/var/lib/rancher/k3s/storage/pvc-89a4265c-b39c-4628-9e6b-df091fae4fd8_default_kanboard-pvc`
```
ssh jimmy@192.168.1.135
sudo su
cd /var/lib/rancher/k3s/storage/pvc-89a4265c-b39c-4628-9e6b-df091fae4fd8_default_kanboard-pvc
tar cvpzf /home/jimmy/kanboard-pvc.tar.gz .
exit
cd ~
sudo chown jimmy:jimmy kanboard-pvc.tar.gz
exit
scp jimmy@192.168.1.135:~/kanboard-pvc.tar.gz /tmp/kanboard-pvc.tar.gz
```
Apply PVC.
Want: `volumeBindingMode: Immediate`
```
kubectl apply manifests --context infra
<wait til pvc exists>
<delete everyone but pvc>
kubectl describe pvc kanboard-pvc --context infra --namespace kanboard
kubectl describe pv pvc-fe710c38-52ce-495b-bb8d-bea48222a21b --namespace kanboard
```
```
scp /tmp/kanboard-pvc.tar.gz jimmy@192.168.1.112:.
ssh jimmy@192.168.1.112
sudo su
chown root:root ./kanboard-pvc.tar.gz
cd /var/lib/rancher/k3s/storage/pvc-fe710c38-52ce-495b-bb8d-bea48222a21b_kanboard_kanboard-pvc
rm -rf *
tar xpvzf /home/jimmy/kanboard-pvc.tar.gz
exit
exit
kubectl apply -f manifests/
```
Make secret:
```
cat kanboard-cookie.yaml | kubeseal --format yaml > kanboard-cookie-sealed.yaml
```
Where should I proxy to?
```
kubectl -n ingress-nginx get svc
ngress-nginx-controller LoadBalancer 10.45.94.103 192.168.1.112 80:31566/TCP,443:32594/TCP 23d
```
> 10.100.100.7:31566

63
infra-cluster/kanboard/manifests/deployment.yaml Normal file
View File

@ -0,0 +1,63 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: kanboard-deployment
namespace: kanboard
labels:
app: kanboard
spec:
replicas: 1
selector:
matchLabels:
app: kanboard
template:
metadata:
labels:
app: kanboard
spec:
containers:
- name: oauth-proxy
image: quay.io/oauth2-proxy/oauth2-proxy:v7.4.0
args:
- --cookie-secret=`$COOKIE_SECRET`
- --cookie-secure=false
- --email-domain=*
- --provider=keycloak-oidc
- --client-id=kanboard
- --client-secret=oT6dMBS87jc385utLumMoffJ9MqLEGRY
- --redirect-url=https://kanboard.jpace121.net
- --oidc-issuer-url=https://auth.jpace121.net/realms/jpace121-main
- --reverse-proxy=true
- --upstream=http://localhost:80/
- --http-address=0.0.0.0:8080
ports:
- containerPort: 8080
env:
- name: COOKIE_SECRET
valueFrom:
secretKeyRef:
name: kanboard-cookie
key: cookie-secret
- name: kanboard-app
image: harbor.internal.jpace121.net/k8s/kanboard:latest
ports:
- containerPort: 80
- containerPort: 443
env:
- name: DATABASE_URL
value: "postgres://postgres:jdsjkksksklw@localhost/kanboard"
- name: kanboard-db
image: docker.io/library/postgres:bullseye
env:
- name: POSTGRES_DB
value: "kanboard"
- name: POSTGRES_PASSWORD
value: "jdsjkksksklw"
volumeMounts:
- name: db-storage
mountPath: "/var/lib/postgresql/data"
volumes:
- name: db-storage
persistentVolumeClaim:
claimName: kanboard-pvc

21
infra-cluster/kanboard/manifests/ingress.yaml Normal file
View File

@ -0,0 +1,21 @@
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: kanboard-ingress
namespace: kanboard
annotations:
nginx.ingress.kubernetes.io/proxy-buffering: "on"
nginx.ingress.kubernetes.io/proxy-buffer-size: "512k"
spec:
rules:
- host: kanboard.jpace121.net
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: kanboard-service
port:
number: 80

12
infra-cluster/kanboard/manifests/pvc.yaml Normal file
View File

@ -0,0 +1,12 @@
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: kanboard-pvc
namespace: kanboard
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi

13
infra-cluster/kanboard/manifests/service.yaml Normal file
View File

@ -0,0 +1,13 @@
---
apiVersion: v1
kind: Service
metadata:
name: kanboard-service
namespace: kanboard
spec:
selector:
app: kanboard
ports:
- protocol: TCP
targetPort: 8080
port: 80

4
infra-cluster/kanboard/namespaces/kanboard.yaml Normal file
View File

@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: kanboard

16
infra-cluster/kanboard/secrets/kanboard-cookie-sealed.yaml Normal file
View File

@ -0,0 +1,16 @@
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
creationTimestamp: null
name: kanboard-cookie
namespace: kanboard
spec:
encryptedData:
cookie-secret: AgAV5rJbI4+pdtEBSOXZOI77dov8AZH0ejLbP+3FZt0B4ebYcpytB5oLYpHL7n9d/cvUdIn1MmM44CQ4Fc7nlrspIdFm9P2U9t1ElIt6LeqcE1A65lRm2xHvKQ+HIBSRE8uhwJZQqX+4i88/zhc1z+jTjr9bBwxpm402sFRND4a/3X8UWtcj2/dQUMPGe84Q23SjzGg9pYFEphWZ4Pt6dVBpKy7pPenHKk/F2zhHpVy+4GfC61Ho8enbj7avBVWpj5zoW0R1bphRClbYTRKyHyIqEvgqgW2N8Wo9AVvQ0GzZw5nyIFW3vIkivNzVTjufXIQV5RdPECaCJfnK06WIe3STMTHsJ1m+igacAXNSui6L6g37dO0DpMTcMQCBWL4c0cCgOfBhhIQy6zCcpI/MJBcWOI55c1E1zrxMDJxlskQjh9A01wwWGQfT5qm2PXO5j1hARe1aUmBJvhzzQnoVJB+2RxFnZjJTzdCOXkr1a4gQB03xXOZlrxGy3HpIPDFQCOWfxEn8pKjzl1dufkhpH14pyKfyWheSpufQNtjcZ9WrcDQvifmaIjCLkDZ4QiuQXCKlPuNLHoYVeTR7et8RO3DFm292t2PXQ115wIZ57vR+PqInOu0X33cK3kr7bSyTbJsZSJRWj7UkiHhGKs5L69ohfFfam539jtlU69XVKvTW05oeDDh2CtIYGbCDUvLIzAUAY5BJYTueAaBTp6o4KczQVbWW7AZSJy6XqaTZte3CDRh+7SOaJa/eNIEkJQ==
template:
metadata:
creationTimestamp: null
name: kanboard-cookie
namespace: kanboard
type: Opaque