- Git do Root C3SL

[Git][root/services/dhcp][main] Add zaphod
by Fernando K (＠fmkiotheka) 04 Ago '25

04 Ago '25

Fernando K pushed to branch main at Root / Serviços / DHCP Commits: 95f9f082 by Fernando Monteiro Kiotheka at 2025-08-04T17:00:23-03:00 Add zaphod - - - - - 1 changed file: - kea-dhcp4.conf Changes: ===================================== kea-dhcp4.conf ===================================== @@ -4250,10 +4250,10 @@ "user-context": { "nextbox_ip_address_id": 83 } }, { - "hostname": "gema", - "hw-address": "70:85:C2:08:88:EB", + "hostname": "zaphod", + "hw-address": "60:C7:27:29:28:98", "ip-address": "10.254.221.42", - "user-context": { "nextbox_ip_address_id": 84 } + "user-context": { "nextbox_ip_address_id": 2740 } }, { "hostname": "carate", @@ -4309,6 +4309,12 @@ "ip-address": "10.254.221.51", "user-context": { "nextbox_ip_address_id": 88 } }, + { + "hostname": "gema", + "hw-address": "70:85:C2:08:88:EB", + "ip-address": "10.254.221.52", + "user-context": { "nextbox_ip_address_id": 84 } + }, { "hostname": "brioja", "hw-address": "D0:27:88:C2:31:2A", View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/95f9f082d6b208db91a… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/95f9f082d6b208db91a… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/services/dns][main] Add zaphod
by Fernando K (＠fmkiotheka) 04 Ago '25

04 Ago '25

Fernando K pushed to branch main at Root / Serviços / DNS Commits: 0effeca3 by Fernando Monteiro Kiotheka at 2025-08-04T16:57:30-03:00 Add zaphod - - - - - 2 changed files: - interna-254.10.in-addr.arpa.zone - interna-c3local.zone Changes: ===================================== interna-254.10.in-addr.arpa.zone ===================================== @@ -304,7 +304,7 @@ $TTL 21600 41.223 IN PTR h13.c3local. 41.228 IN PTR b25.c3local. 41.234 IN PTR k41.c3local. -42.221 IN PTR gema.c3local. +42.221 IN PTR zaphod.c3local. 42.223 IN PTR h14.c3local. 42.228 IN PTR b26.c3local. 42.229 IN PTR reino.c3local. @@ -352,6 +352,7 @@ $TTL 21600 51.224 IN PTR i24.c3local. 51.228 IN PTR b35.c3local. 51.229 IN PTR moana.c3local. +52.221 IN PTR gema.c3local. 52.223 IN PTR h24.c3local. 52.224 IN PTR i25.c3local. 52.228 IN PTR b36.c3local. @@ -452,4 +453,4 @@ $TTL 21600 249.227 IN PTR mojito7.c3local. @ IN NS ns2.c3sl.ufpr.br. @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754327829 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754337371 86400 7200 2592000 3600 ===================================== interna-c3local.zone ===================================== @@ -71,7 +71,7 @@ brioja IN A 10.254.221.54 buxfox IN A 10.254.237.8 @ IN NS ns2.c3sl.ufpr.br. @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754327829 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754337371 86400 7200 2592000 3600 caio IN A 10.254.221.1 calvin IN A 10.254.229.6 carate IN A 10.254.221.43 @@ -114,7 +114,7 @@ feio IN A 10.254.229.32 fernando IN A 10.254.232.6 flash IN A 10.254.221.40 friends IN A 10.254.221.8 -gema IN A 10.254.221.42 +gema IN A 10.254.221.52 giovanni IN A 10.254.229.55 giovanni2 IN A 10.254.229.2 gonzo IN A 10.254.221.20 @@ -455,5 +455,6 @@ xsmbilamir IN A 10.254.253.8 xuxa IN A 10.254.229.48 y-m70s IN A 10.254.221.9 yoda IN A 10.254.237.7 +zaphod IN A 10.254.221.42 zappa IN A 10.254.229.26 zaros IN A 10.254.221.22 View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dns/-/commit/0effeca3eb70fba8d1da… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dns/-/commit/0effeca3eb70fba8d1da… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/cli/netboxadm][main] fix(nethuh): device_id for select device interface
by Fernando K (＠fmkiotheka) 04 Ago '25

04 Ago '25

Fernando K pushed to branch main at Root / CLI / Netboxadm Commits: 07167e2b by Fernando Monteiro Kiotheka at 2025-08-04T16:56:17-03:00 fix(nethuh): device_id for select device interface - - - - - 1 changed file: - internal/nethuh/prompts.go Changes: ===================================== internal/nethuh/prompts.go ===================================== @@ -503,7 +503,7 @@ func SelectVirtualMachine(client *rest.Client) (*models.VirtualMachine, error) { } func SelectDeviceInterface(client *rest.Client, devID int) (*models.Interface, error) { - query := rest.NewQuery().Filter("id", rest.EX, strconv.Itoa(devID)) + query := rest.NewQuery().Filter("device_id", rest.EX, strconv.Itoa(devID)) res, err := rest.GET[models.Interface](client, route.Interfaces, query) if err != nil { View it on GitLab: https://gitlab.c3sl.ufpr.br/root/cli/netboxadm/-/commit/07167e2b3fc3fc61a8f… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/cli/netboxadm/-/commit/07167e2b3fc3fc61a8f… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/services/dns][main] Add wrk1-k8sprod to dfs
by yyvf22 (＠yyvf22) 04 Ago '25

04 Ago '25

yyvf22 pushed to branch main at Root / Serviços / DNS Commits: 2e4a5acc by yyvf at 2025-08-04T16:45:51-03:00 Add wrk1-k8sprod to dfs - - - - - 2 changed files: - interna-119.17.10.in-addr.arpa.zone - interna-dfs.zone Changes: ===================================== interna-119.17.10.in-addr.arpa.zone ===================================== @@ -8,6 +8,7 @@ $TTL 21600 2 IN PTR wrk5-k8sstage.dfs. 3 IN PTR urquell.dfs. 4 IN PTR wrk6-k8sstage.dfs. +5 IN PTR wrk1-k8sprod.dfs. 11 IN PTR barril1.dfs. 12 IN PTR barril2.dfs. 13 IN PTR barril3.dfs. @@ -19,4 +20,4 @@ $TTL 21600 118 IN PTR forsyn.dfs. @ IN NS ns2.c3sl.ufpr.br. @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754318388 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754336539 86400 7200 2592000 3600 ===================================== interna-dfs.zone ===================================== @@ -15,13 +15,14 @@ barril2 IN A 10.17.119.12 barril3 IN A 10.17.119.13 barril4 IN A 10.17.119.14 @ IN NS ns.c3sl.ufpr.br. -@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754318388 86400 7200 2592000 3600 +@ 21600 IN SOA ns.c3sl.ufpr.br. root.c3sl.ufpr.br. 1754336539 86400 7200 2592000 3600 forsyn IN A 10.17.119.118 monitoramento IN CNAME forsyn torneira8 IN A 10.17.119.28 torneira9 IN A 10.17.119.29 torneira12 IN A 10.17.119.32 urquell IN A 10.17.119.3 +wrk1-k8sprod IN A 10.17.119.5 wrk4-k8sstage IN A 10.17.119.1 wrk5-k8sstage IN A 10.17.119.2 wrk6-k8sstage IN A 10.17.119.4 View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dns/-/commit/2e4a5accc9535535566c… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dns/-/commit/2e4a5accc9535535566c… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/services/dhcp][main] Add wrk1-k8sprod to dfs
by yyvf22 (＠yyvf22) 04 Ago '25

04 Ago '25

yyvf22 pushed to branch main at Root / Serviços / DHCP Commits: 3c18b476 by yyvf at 2025-08-04T16:42:46-03:00 Add wrk1-k8sprod to dfs - - - - - 1 changed file: - kea-dhcp4.conf Changes: ===================================== kea-dhcp4.conf ===================================== @@ -1457,6 +1457,12 @@ "ip-address": "10.17.119.4", "user-context": { "nextbox_ip_address_id": 2734 } }, + { + "hostname": "wrk1-k8sprod", + "hw-address": "00:16:CC:E8:DD:0E", + "ip-address": "10.17.119.5", + "user-context": { "nextbox_ip_address_id": 2739 } + }, { "hostname": "abbey", "hw-address": "B8:59:9F:8D:83:20", View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/3c18b4762abc871504d… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/services/dhcp/-/commit/3c18b4762abc871504d… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] refactor(cert-manager): change cluster issuer name to letsencrypt-dns01
by yyvf22 (＠yyvf22) 04 Ago '25

04 Ago '25

yyvf22 pushed to branch main at Root / Kubernetes / FluxCD Commits: afc9c7fe by yyvf at 2025-08-04T16:08:17-03:00 refactor(cert-manager): change cluster issuer name to letsencrypt-dns01 Issue #7 - - - - - 12 changed files: - apps/base/ademir/ing.yaml - apps/base/codimd/ing.yaml - apps/base/matrix/helmrelease.yaml - apps/base/netbox/helmrelease.yaml - apps/base/nextcloud/helmrelease.yaml - apps/base/rallly/ing.yaml - apps/base/wordpress/ing.yaml - infrastructure/base/cert-manager/clusterissuer.yaml - infrastructure/base/harbor/helmrelease.yaml - infrastructure/base/keycloak/ing.yaml - infrastructure/base/openbao/helmrelease.yaml - monitoring/base/kube-prometheus-stack/helmrelease.yaml Changes: ===================================== apps/base/ademir/ing.yaml ===================================== @@ -4,7 +4,7 @@ metadata: name: ademir namespace: ademir annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 spec: ingressClassName: cilium rules: ===================================== apps/base/codimd/ing.yaml ===================================== @@ -4,7 +4,7 @@ metadata: name: codimd namespace: codimd annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 spec: ingressClassName: cilium rules: ===================================== apps/base/matrix/helmrelease.yaml ===================================== @@ -16,7 +16,7 @@ spec: ingress: className: cilium annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 tlsSecret: matrix-tls postgres: # do not use **internal** postgres db ===================================== apps/base/netbox/helmrelease.yaml ===================================== @@ -98,7 +98,7 @@ spec: enabled: true className: cilium annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 hosts: - host: netbox.k8sstage.c3sl.ufpr.br paths: ===================================== apps/base/nextcloud/helmrelease.yaml ===================================== @@ -18,7 +18,7 @@ spec: enabled: true className: cilium annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 tls: - secretName: nextcloud-tls hosts: ===================================== apps/base/rallly/ing.yaml ===================================== @@ -4,7 +4,7 @@ metadata: name: rallly namespace: rallly annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 spec: ingressClassName: cilium rules: ===================================== apps/base/wordpress/ing.yaml ===================================== @@ -4,7 +4,7 @@ metadata: name: wordpress namespace: wordpress annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 spec: ingressClassName: cilium rules: ===================================== infrastructure/base/cert-manager/clusterissuer.yaml ===================================== @@ -1,13 +1,13 @@ apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: - name: letsencrypt-wildcard + name: letsencrypt-dns01 spec: acme: server: https://acme-v02.api.letsencrypt.org/directory email: root(a)inf.ufpr.br privateKeySecretRef: - name: letsencrypt-wildcard + name: letsencrypt-dns01 solvers: - dns01: rfc2136: ===================================== infrastructure/base/harbor/helmrelease.yaml ===================================== @@ -19,7 +19,7 @@ spec: hosts: core: harbor.c3sl.ufpr.br annotations: - cert-manager.io/cluster-issuer: "letsencrypt-wildcard" + cert-manager.io/cluster-issuer: letsencrypt-dns01 tls: certSource: secret secret: ===================================== infrastructure/base/keycloak/ing.yaml ===================================== @@ -4,7 +4,7 @@ metadata: name: keycloak namespace: keycloak annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 spec: ingressClassName: cilium rules: ===================================== infrastructure/base/openbao/helmrelease.yaml ===================================== @@ -50,7 +50,7 @@ spec: annotations: ingress.cilium.io/loadbalancer-mode: dedicated ingress.cilium.io/service-type: LoadBalancer - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 ingressClassName: cilium pathType: Prefix hosts: ===================================== monitoring/base/kube-prometheus-stack/helmrelease.yaml ===================================== @@ -19,7 +19,7 @@ spec: ingress: enabled: true annotations: - cert-manager.io/cluster-issuer: letsencrypt-wildcard + cert-manager.io/cluster-issuer: letsencrypt-dns01 ingressClassName: cilium hosts: - grafana.k8sstage.c3sl.ufpr.br View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/afc9c7feec2521bcdf9593… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/afc9c7feec2521bcdf9593… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] refactor(fluxcd): #6 move keycloak to infrastructure
by yyvf22 (＠yyvf22) 04 Ago '25

04 Ago '25

yyvf22 pushed to branch main at Root / Kubernetes / FluxCD Commits: 80265ef6 by yyvf at 2025-08-04T15:37:59-03:00 refactor(fluxcd): #6 move keycloak to infrastructure - - - - - 10 changed files: - apps/stage/kustomization.yaml - apps/base/keycloak/externalsecret.yaml → infrastructure/base/keycloak/es.yaml - apps/base/keycloak/ing.yaml → infrastructure/base/keycloak/ing.yaml - apps/base/keycloak/kustomization.yaml → infrastructure/base/keycloak/kustomization.yaml - apps/base/keycloak/ns.yaml → infrastructure/base/keycloak/ns.yaml - apps/base/keycloak/sts.yaml → infrastructure/base/keycloak/sts.yaml - apps/base/keycloak/svc.yaml → infrastructure/base/keycloak/svc.yaml - infrastructure/prod/kustomization.yaml - infrastructure/stage/kustomization.yaml - monitoring/prod/kustomization.yaml Changes: ===================================== apps/stage/kustomization.yaml ===================================== @@ -3,7 +3,6 @@ kind: Kustomization resources: - ../base/ademir - ../base/codimd - - ../base/keycloak - ../base/matrix - ../base/nextcloud - ../base/rallly ===================================== apps/base/keycloak/externalsecret.yaml → infrastructure/base/keycloak/es.yaml ===================================== ===================================== apps/base/keycloak/ing.yaml → infrastructure/base/keycloak/ing.yaml ===================================== ===================================== apps/base/keycloak/kustomization.yaml → infrastructure/base/keycloak/kustomization.yaml ===================================== @@ -1,4 +1,4 @@ -apiVersion: +apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization metadata: name: keycloak @@ -7,4 +7,4 @@ resources: - sts.yaml - svc.yaml - ing.yaml - - externalsecret.yaml + - es.yaml ===================================== apps/base/keycloak/ns.yaml → infrastructure/base/keycloak/ns.yaml ===================================== ===================================== apps/base/keycloak/sts.yaml → infrastructure/base/keycloak/sts.yaml ===================================== ===================================== apps/base/keycloak/svc.yaml → infrastructure/base/keycloak/svc.yaml ===================================== ===================================== infrastructure/prod/kustomization.yaml ===================================== @@ -2,6 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base/cilium + - ./ippool.yaml - ../base/ceph-csi - ../base/cert-manager - - ./ippool.yaml ===================================== infrastructure/stage/kustomization.yaml ===================================== @@ -9,4 +9,5 @@ resources: - ../base/external-secrets - ../base/harbor - ../base/gitlab-runner + - ../base/keycloak - ../base/etcd-backup ===================================== monitoring/prod/kustomization.yaml ===================================== @@ -1,2 +1,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization +resources: [] View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/80265ef6853066c6f743db… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/80265ef6853066c6f743db… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] refactor(fluxcd): #6 move openbao to infrastructure
by yyvf22 (＠yyvf22) 04 Ago '25

04 Ago '25

yyvf22 pushed to branch main at Root / Kubernetes / FluxCD Commits: 575ab21d by yyvf at 2025-08-04T15:32:05-03:00 refactor(fluxcd): #6 move openbao to infrastructure - - - - - 14 changed files: - − apps/base/gitlab-runner/es.yaml - − apps/base/gitlab-runner/helmrelease.yaml - − apps/base/gitlab-runner/helmrepo.yaml - − apps/base/gitlab-runner/kustomization.yaml - − apps/base/gitlab-runner/ns.yaml - − apps/base/gitlab-runner/pvc.yaml - apps/stage/kustomization.yaml - apps/base/openbao/cj.yaml → infrastructure/base/openbao/cj.yaml - apps/base/openbao/es.yaml → infrastructure/base/openbao/es.yaml - apps/base/openbao/helmrelease.yaml → infrastructure/base/openbao/helmrelease.yaml - apps/base/openbao/helmrepo.yaml → infrastructure/base/openbao/helmrepo.yaml - apps/base/openbao/kustomization.yaml → infrastructure/base/openbao/kustomization.yaml - apps/base/openbao/ns.yaml → infrastructure/base/openbao/ns.yaml - infrastructure/stage/kustomization.yaml Changes: ===================================== apps/base/gitlab-runner/es.yaml deleted ===================================== @@ -1,25 +0,0 @@ -apiVersion: external-secrets.io/v1 -kind: ExternalSecret -metadata: - name: gitlab-runner - namespace: gitlab-runner -spec: - refreshInterval: "15s" - secretStoreRef: - name: openbao - kind: ClusterSecretStore - target: - name: gitlab-runner - data: - - secretKey: tokenUnprivileged - remoteRef: - key: gitlab-runner - property: tokenUnprivileged - - secretKey: tokenPrivilegedRoot - remoteRef: - key: gitlab-runner - property: tokenPrivilegedRoot - - secretKey: tokenPrivilegedC3SL - remoteRef: - key: gitlab-runner - property: tokenPrivilegedC3SL ===================================== apps/base/gitlab-runner/helmrelease.yaml deleted ===================================== @@ -1,195 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: unprivileged - namespace: gitlab-runner -spec: - interval: 1m - chart: - spec: - chart: gitlab-runner - sourceRef: - kind: HelmRepository - name: gitlab-runner - values: - replicas: 1 - gitlabUrl: https://gitlab.c3sl.ufpr.br - rbac: - create: true - serviceAccount: - create: true - runners: - executor: kubernetes - config: | - [[runners]] - shell = "bash" - environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"] - [runners.kubernetes] - image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest" - ephemeral_storage_limit = "5Gi" - helper_ephemeral_storage_limit = "5Gi" - service_ephemeral_storage_limit = "5Gi" - [[runners.kubernetes.volumes.pvc]] - name = "unprivileged-gitlab-runner-cache" - mount_path = "/cache" - [[runners.kubernetes.pod_spec]] - name = "ephemeral-pvc" - patch = ''' - containers: - - name: build - volumeMounts: - - name: builds - mountPath: /builds - - name: helper - volumeMounts: - - name: builds - mountPath: /builds - volumes: - - name: builds - ephemeral: - volumeClaimTemplate: - spec: - storageClassName: csi-rbd-sc - accessModes: [ ReadWriteOnce ] - resources: - requests: - storage: 5Gi - ''' - securityContext: - allowPrivilegeEscalation: false - readOnlyRootFilesystem: false - runAsNonRoot: true - privileged: false - valuesFrom: - - kind: Secret - name: gitlab-runner - valuesKey: tokenUnprivileged - targetPath: runnerToken ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: privileged-root - namespace: gitlab-runner -spec: - interval: 1m - chart: - spec: - chart: gitlab-runner - sourceRef: - kind: HelmRepository - name: gitlab-runner - values: - replicas: 1 - gitlabUrl: https://gitlab.c3sl.ufpr.br - rbac: - create: true - serviceAccount: - create: true - runners: - executor: kubernetes - config: | - [[runners]] - shell = "bash" - environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"] - [runners.kubernetes] - privileged = true - image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest" - ephemeral_storage_limit = "5Gi" - helper_ephemeral_storage_limit = "5Gi" - service_ephemeral_storage_limit = "5Gi" - [[runners.kubernetes.volumes.pvc]] - name = "privileged-root-gitlab-runner-cache" - mount_path = "/cache" - [[runners.kubernetes.pod_spec]] - name = "ephemeral-pvc" - patch = ''' - containers: - - name: build - volumeMounts: - - name: builds - mountPath: /builds - - name: helper - volumeMounts: - - name: builds - mountPath: /builds - volumes: - - name: builds - ephemeral: - volumeClaimTemplate: - spec: - storageClassName: csi-rbd-sc - accessModes: [ ReadWriteOnce ] - resources: - requests: - storage: 5Gi - ''' - valuesFrom: - - kind: Secret - name: gitlab-runner - valuesKey: tokenPrivilegedRoot - targetPath: runnerToken ---- -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: privileged-c3sl - namespace: gitlab-runner -spec: - interval: 1m - chart: - spec: - chart: gitlab-runner - sourceRef: - kind: HelmRepository - name: gitlab-runner - values: - replicas: 1 - gitlabUrl: https://gitlab.c3sl.ufpr.br - rbac: - create: true - serviceAccount: - create: true - runners: - executor: kubernetes - config: | - [[runners]] - shell = "bash" - environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"] - [runners.kubernetes] - privileged = true - image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest" - ephemeral_storage_limit = "5Gi" - helper_ephemeral_storage_limit = "5Gi" - service_ephemeral_storage_limit = "5Gi" - [[runners.kubernetes.volumes.pvc]] - name = "privileged-c3sl-gitlab-runner-cache" - mount_path = "/cache" - [[runners.kubernetes.pod_spec]] - name = "ephemeral-pvc" - patch = ''' - containers: - - name: build - volumeMounts: - - name: builds - mountPath: /builds - - name: helper - volumeMounts: - - name: builds - mountPath: /builds - volumes: - - name: builds - ephemeral: - volumeClaimTemplate: - spec: - storageClassName: csi-rbd-sc - accessModes: [ ReadWriteOnce ] - resources: - requests: - storage: 5Gi - ''' - valuesFrom: - - kind: Secret - name: gitlab-runner - valuesKey: tokenPrivilegedC3SL - targetPath: runnerToken ===================================== apps/base/gitlab-runner/helmrepo.yaml deleted ===================================== @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1 -kind: HelmRepository -metadata: - name: gitlab-runner - namespace: gitlab-runner -spec: - interval: 1m0s - url: https://charts.gitlab.io ===================================== apps/base/gitlab-runner/kustomization.yaml deleted ===================================== @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - ns.yaml - - helmrepo.yaml - - helmrelease.yaml - - es.yaml - - pvc.yaml ===================================== apps/base/gitlab-runner/ns.yaml deleted ===================================== @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - pod-security.kubernetes.io/enforce: privileged - name: gitlab-runner ===================================== apps/base/gitlab-runner/pvc.yaml deleted ===================================== @@ -1,41 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: privileged-root-gitlab-runner-cache - namespace: gitlab-runner - labels: - app: gitlab-runner -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 20Gi ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: privileged-c3sl-gitlab-runner-cache - namespace: gitlab-runner - labels: - app: gitlab-runner -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 20Gi ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: unprivileged-gitlab-runner-cache - namespace: gitlab-runner - labels: - app: gitlab-runner -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 20Gi ===================================== apps/stage/kustomization.yaml ===================================== @@ -1,8 +1,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - - ../base/openbao - # Apps - ../base/ademir - ../base/codimd - ../base/keycloak ===================================== apps/base/openbao/cj.yaml → infrastructure/base/openbao/cj.yaml ===================================== ===================================== apps/base/openbao/es.yaml → infrastructure/base/openbao/es.yaml ===================================== ===================================== apps/base/openbao/helmrelease.yaml → infrastructure/base/openbao/helmrelease.yaml ===================================== ===================================== apps/base/openbao/helmrepo.yaml → infrastructure/base/openbao/helmrepo.yaml ===================================== ===================================== apps/base/openbao/kustomization.yaml → infrastructure/base/openbao/kustomization.yaml ===================================== ===================================== apps/base/openbao/ns.yaml → infrastructure/base/openbao/ns.yaml ===================================== ===================================== infrastructure/stage/kustomization.yaml ===================================== @@ -5,6 +5,7 @@ resources: - ./ippool.yaml - ../base/ceph-csi - ../base/cert-manager + - ../base/openbao - ../base/external-secrets - ../base/harbor - ../base/gitlab-runner View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/575ab21d9b6411c8b048ba… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/575ab21d9b6411c8b048ba… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] refactor(fluxcd): #6 move harbor to infrastructure
by yyvf22 (＠yyvf22) 04 Ago '25

04 Ago '25

yyvf22 pushed to branch main at Root / Kubernetes / FluxCD Commits: 747c4001 by yyvf at 2025-08-04T15:27:07-03:00 refactor(fluxcd): #6 move harbor to infrastructure - - - - - 7 changed files: - apps/stage/kustomization.yaml - apps/base/harbor/external-secret.yaml → infrastructure/base/harbor/es.yaml - apps/base/harbor/helmrelease.yaml → infrastructure/base/harbor/helmrelease.yaml - apps/base/harbor/helmrepo.yaml → infrastructure/base/harbor/helmrepo.yaml - apps/base/harbor/kustomization.yaml → infrastructure/base/harbor/kustomization.yaml - apps/base/harbor/ns.yaml → infrastructure/base/harbor/ns.yaml - infrastructure/stage/kustomization.yaml Changes: ===================================== apps/stage/kustomization.yaml ===================================== @@ -5,7 +5,6 @@ resources: # Apps - ../base/ademir - ../base/codimd - - ../base/harbor - ../base/keycloak - ../base/matrix - ../base/nextcloud ===================================== apps/base/harbor/external-secret.yaml → infrastructure/base/harbor/es.yaml ===================================== ===================================== apps/base/harbor/helmrelease.yaml → infrastructure/base/harbor/helmrelease.yaml ===================================== ===================================== apps/base/harbor/helmrepo.yaml → infrastructure/base/harbor/helmrepo.yaml ===================================== ===================================== apps/base/harbor/kustomization.yaml → infrastructure/base/harbor/kustomization.yaml ===================================== @@ -4,4 +4,4 @@ resources: - ns.yaml - helmrepo.yaml - helmrelease.yaml - - external-secret.yaml + - es.yaml ===================================== apps/base/harbor/ns.yaml → infrastructure/base/harbor/ns.yaml ===================================== ===================================== infrastructure/stage/kustomization.yaml ===================================== @@ -6,5 +6,6 @@ resources: - ../base/ceph-csi - ../base/cert-manager - ../base/external-secrets + - ../base/harbor - ../base/gitlab-runner - ../base/etcd-backup View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/747c4001c611822f4e781c… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/747c4001c611822f4e781c… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0

[Git][root/k8s/fluxcd][main] refactor(fluxcd): move gitlab-runner to infrastructure
by yyvf22 (＠yyvf22) 04 Ago '25

04 Ago '25

yyvf22 pushed to branch main at Root / Kubernetes / FluxCD Commits: dd9a7fd2 by yyvf at 2025-08-04T15:20:26-03:00 refactor(fluxcd): move gitlab-runner to infrastructure - - - - - 8 changed files: - apps/stage/kustomization.yaml - + infrastructure/base/gitlab-runner/es.yaml - + infrastructure/base/gitlab-runner/helmrelease.yaml - + infrastructure/base/gitlab-runner/helmrepo.yaml - + infrastructure/base/gitlab-runner/kustomization.yaml - + infrastructure/base/gitlab-runner/ns.yaml - + infrastructure/base/gitlab-runner/pvc.yaml - infrastructure/stage/kustomization.yaml Changes: ===================================== apps/stage/kustomization.yaml ===================================== @@ -5,7 +5,6 @@ resources: # Apps - ../base/ademir - ../base/codimd - - ../base/gitlab-runner - ../base/harbor - ../base/keycloak - ../base/matrix ===================================== infrastructure/base/gitlab-runner/es.yaml ===================================== @@ -0,0 +1,25 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: gitlab-runner + namespace: gitlab-runner +spec: + refreshInterval: "15s" + secretStoreRef: + name: openbao + kind: ClusterSecretStore + target: + name: gitlab-runner + data: + - secretKey: tokenUnprivileged + remoteRef: + key: gitlab-runner + property: tokenUnprivileged + - secretKey: tokenPrivilegedRoot + remoteRef: + key: gitlab-runner + property: tokenPrivilegedRoot + - secretKey: tokenPrivilegedC3SL + remoteRef: + key: gitlab-runner + property: tokenPrivilegedC3SL ===================================== infrastructure/base/gitlab-runner/helmrelease.yaml ===================================== @@ -0,0 +1,195 @@ +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: unprivileged + namespace: gitlab-runner +spec: + interval: 1m + chart: + spec: + chart: gitlab-runner + sourceRef: + kind: HelmRepository + name: gitlab-runner + values: + replicas: 1 + gitlabUrl: https://gitlab.c3sl.ufpr.br + rbac: + create: true + serviceAccount: + create: true + runners: + executor: kubernetes + config: | + [[runners]] + shell = "bash" + environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"] + [runners.kubernetes] + image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest" + ephemeral_storage_limit = "5Gi" + helper_ephemeral_storage_limit = "5Gi" + service_ephemeral_storage_limit = "5Gi" + [[runners.kubernetes.volumes.pvc]] + name = "unprivileged-gitlab-runner-cache" + mount_path = "/cache" + [[runners.kubernetes.pod_spec]] + name = "ephemeral-pvc" + patch = ''' + containers: + - name: build + volumeMounts: + - name: builds + mountPath: /builds + - name: helper + volumeMounts: + - name: builds + mountPath: /builds + volumes: + - name: builds + ephemeral: + volumeClaimTemplate: + spec: + storageClassName: csi-rbd-sc + accessModes: [ ReadWriteOnce ] + resources: + requests: + storage: 5Gi + ''' + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: false + runAsNonRoot: true + privileged: false + valuesFrom: + - kind: Secret + name: gitlab-runner + valuesKey: tokenUnprivileged + targetPath: runnerToken +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: privileged-root + namespace: gitlab-runner +spec: + interval: 1m + chart: + spec: + chart: gitlab-runner + sourceRef: + kind: HelmRepository + name: gitlab-runner + values: + replicas: 1 + gitlabUrl: https://gitlab.c3sl.ufpr.br + rbac: + create: true + serviceAccount: + create: true + runners: + executor: kubernetes + config: | + [[runners]] + shell = "bash" + environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"] + [runners.kubernetes] + privileged = true + image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest" + ephemeral_storage_limit = "5Gi" + helper_ephemeral_storage_limit = "5Gi" + service_ephemeral_storage_limit = "5Gi" + [[runners.kubernetes.volumes.pvc]] + name = "privileged-root-gitlab-runner-cache" + mount_path = "/cache" + [[runners.kubernetes.pod_spec]] + name = "ephemeral-pvc" + patch = ''' + containers: + - name: build + volumeMounts: + - name: builds + mountPath: /builds + - name: helper + volumeMounts: + - name: builds + mountPath: /builds + volumes: + - name: builds + ephemeral: + volumeClaimTemplate: + spec: + storageClassName: csi-rbd-sc + accessModes: [ ReadWriteOnce ] + resources: + requests: + storage: 5Gi + ''' + valuesFrom: + - kind: Secret + name: gitlab-runner + valuesKey: tokenPrivilegedRoot + targetPath: runnerToken +--- +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: privileged-c3sl + namespace: gitlab-runner +spec: + interval: 1m + chart: + spec: + chart: gitlab-runner + sourceRef: + kind: HelmRepository + name: gitlab-runner + values: + replicas: 1 + gitlabUrl: https://gitlab.c3sl.ufpr.br + rbac: + create: true + serviceAccount: + create: true + runners: + executor: kubernetes + config: | + [[runners]] + shell = "bash" + environment = ["FF_USE_ADVANCED_POD_SPEC_CONFIGURATION=true"] + [runners.kubernetes] + privileged = true + image = "harbor.c3sl.ufpr.br/root/gitlab-runner-base:latest" + ephemeral_storage_limit = "5Gi" + helper_ephemeral_storage_limit = "5Gi" + service_ephemeral_storage_limit = "5Gi" + [[runners.kubernetes.volumes.pvc]] + name = "privileged-c3sl-gitlab-runner-cache" + mount_path = "/cache" + [[runners.kubernetes.pod_spec]] + name = "ephemeral-pvc" + patch = ''' + containers: + - name: build + volumeMounts: + - name: builds + mountPath: /builds + - name: helper + volumeMounts: + - name: builds + mountPath: /builds + volumes: + - name: builds + ephemeral: + volumeClaimTemplate: + spec: + storageClassName: csi-rbd-sc + accessModes: [ ReadWriteOnce ] + resources: + requests: + storage: 5Gi + ''' + valuesFrom: + - kind: Secret + name: gitlab-runner + valuesKey: tokenPrivilegedC3SL + targetPath: runnerToken ===================================== infrastructure/base/gitlab-runner/helmrepo.yaml ===================================== @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: gitlab-runner + namespace: gitlab-runner +spec: + interval: 1m0s + url: https://charts.gitlab.io ===================================== infrastructure/base/gitlab-runner/kustomization.yaml ===================================== @@ -0,0 +1,8 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ns.yaml + - helmrepo.yaml + - helmrelease.yaml + - es.yaml + - pvc.yaml ===================================== infrastructure/base/gitlab-runner/ns.yaml ===================================== @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + pod-security.kubernetes.io/enforce: privileged + name: gitlab-runner ===================================== infrastructure/base/gitlab-runner/pvc.yaml ===================================== @@ -0,0 +1,41 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: privileged-root-gitlab-runner-cache + namespace: gitlab-runner + labels: + app: gitlab-runner +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: privileged-c3sl-gitlab-runner-cache + namespace: gitlab-runner + labels: + app: gitlab-runner +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: unprivileged-gitlab-runner-cache + namespace: gitlab-runner + labels: + app: gitlab-runner +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Gi ===================================== infrastructure/stage/kustomization.yaml ===================================== @@ -2,8 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - ../base/cilium + - ./ippool.yaml - ../base/ceph-csi - ../base/cert-manager - ../base/external-secrets + - ../base/gitlab-runner - ../base/etcd-backup - - ./ippool.yaml View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/dd9a7fd214ab3377eb2688… -- View it on GitLab: https://gitlab.c3sl.ufpr.br/root/k8s/fluxcd/-/commit/dd9a7fd214ab3377eb2688… You're receiving this email because of your account on gitlab.c3sl.ufpr.br.

1 0