refactor(gitops): simplify environments and services layout
This commit is contained in:
Haitao Pan
parent
76bbda3c3d
commit
2cef976fb4
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@ -1,332 +0,0 @@
|
||||
{
|
||||
"__inputs": [
|
||||
{
|
||||
"name": "DS_LOKI",
|
||||
"label": "Loki",
|
||||
"description": "",
|
||||
"type": "datasource",
|
||||
"pluginId": "loki",
|
||||
"pluginName": "Loki"
|
||||
}
|
||||
],
|
||||
"annotations": {
|
||||
"list": [
|
||||
{
|
||||
"builtIn": 1,
|
||||
"datasource": "-- Grafana --",
|
||||
"enable": true,
|
||||
"hide": true,
|
||||
"iconColor": "rgba(0, 211, 255, 1)",
|
||||
"name": "Annotations & Alerts",
|
||||
"target": {
|
||||
"limit": 100,
|
||||
"matchAny": false,
|
||||
"tags": [],
|
||||
"type": "dashboard"
|
||||
},
|
||||
"type": "dashboard"
|
||||
},
|
||||
{
|
||||
"datasource": {
|
||||
"type": "datasource",
|
||||
"uid": "grafana"
|
||||
},
|
||||
"enable": true,
|
||||
"iconColor": "red",
|
||||
"name": "flux events",
|
||||
"target": {
|
||||
"limit": 100,
|
||||
"matchAny": false,
|
||||
"tags": [
|
||||
"flux"
|
||||
],
|
||||
"type": "tags"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"description": "Flux logs collected from Kubernetes, stored in Loki",
|
||||
"editable": true,
|
||||
"gnetId": null,
|
||||
"graphTooltip": 0,
|
||||
"id": 29,
|
||||
"iteration": 1653748775696,
|
||||
"links": [],
|
||||
"liveNow": false,
|
||||
"panels": [
|
||||
{
|
||||
"datasource": "${DS_LOKI}",
|
||||
"description": "",
|
||||
"fieldConfig": {
|
||||
"defaults": {
|
||||
"color": {
|
||||
"mode": "palette-classic"
|
||||
},
|
||||
"custom": {
|
||||
"axisLabel": "",
|
||||
"axisPlacement": "auto",
|
||||
"barAlignment": 0,
|
||||
"drawStyle": "bars",
|
||||
"fillOpacity": 0,
|
||||
"gradientMode": "none",
|
||||
"hideFrom": {
|
||||
"legend": false,
|
||||
"tooltip": false,
|
||||
"viz": false
|
||||
},
|
||||
"lineInterpolation": "linear",
|
||||
"lineWidth": 1,
|
||||
"pointSize": 5,
|
||||
"scaleDistribution": {
|
||||
"type": "linear"
|
||||
},
|
||||
"showPoints": "auto",
|
||||
"spanNulls": false,
|
||||
"stacking": {
|
||||
"group": "A",
|
||||
"mode": "none"
|
||||
},
|
||||
"thresholdsStyle": {
|
||||
"mode": "off"
|
||||
}
|
||||
},
|
||||
"mappings": [],
|
||||
"thresholds": {
|
||||
"mode": "absolute",
|
||||
"steps": [
|
||||
{
|
||||
"color": "green",
|
||||
"value": null
|
||||
},
|
||||
{
|
||||
"color": "red",
|
||||
"value": 80
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"overrides": []
|
||||
},
|
||||
"gridPos": {
|
||||
"h": 4,
|
||||
"w": 24,
|
||||
"x": 0,
|
||||
"y": 0
|
||||
},
|
||||
"id": 4,
|
||||
"options": {
|
||||
"legend": {
|
||||
"calcs": [],
|
||||
"displayMode": "hidden",
|
||||
"placement": "bottom"
|
||||
},
|
||||
"tooltip": {
|
||||
"mode": "single",
|
||||
"sort": "none"
|
||||
}
|
||||
},
|
||||
"targets": [
|
||||
{
|
||||
"datasource": "${DS_LOKI}",
|
||||
"expr": "sum(count_over_time({namespace=~\"$namespace\", stream=~\"$stream\", app =~\"$controller\"} | json | __error__!=\"JSONParserErr\" | level=~\"$level\" |= \"$query\" [$__interval]))",
|
||||
"instant": false,
|
||||
"legendFormat": "Log count",
|
||||
"range": true,
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"type": "timeseries"
|
||||
},
|
||||
{
|
||||
"datasource": "${DS_LOKI}",
|
||||
"description": "Logs from services running in Kubernetes",
|
||||
"gridPos": {
|
||||
"h": 25,
|
||||
"w": 24,
|
||||
"x": 0,
|
||||
"y": 4
|
||||
},
|
||||
"id": 2,
|
||||
"options": {
|
||||
"dedupStrategy": "numbers",
|
||||
"enableLogDetails": false,
|
||||
"prettifyLogMessage": true,
|
||||
"showCommonLabels": false,
|
||||
"showLabels": false,
|
||||
"showTime": false,
|
||||
"sortOrder": "Descending",
|
||||
"wrapLogMessage": false
|
||||
},
|
||||
"targets": [
|
||||
{
|
||||
"datasource": "${DS_LOKI}",
|
||||
"expr": "{namespace=~\"$namespace\", stream=~\"$stream\", app =~\"$controller\"} | json | __error__!=\"JSONParserErr\" | level=~\"$level\" |= \"$query\"",
|
||||
"refId": "A"
|
||||
}
|
||||
],
|
||||
"type": "logs"
|
||||
}
|
||||
],
|
||||
"refresh": "10s",
|
||||
"schemaVersion": 36,
|
||||
"style": "light",
|
||||
"tags": [
|
||||
"flux"
|
||||
],
|
||||
"templating": {
|
||||
"list": [
|
||||
{
|
||||
"current": {
|
||||
"selected": false,
|
||||
"text": "",
|
||||
"value": ""
|
||||
},
|
||||
"description": "String to search for",
|
||||
"hide": 0,
|
||||
"label": "Search Query",
|
||||
"name": "query",
|
||||
"options": [
|
||||
{
|
||||
"selected": true,
|
||||
"text": "",
|
||||
"value": ""
|
||||
}
|
||||
],
|
||||
"query": "",
|
||||
"skipUrlSync": false,
|
||||
"type": "textbox"
|
||||
},
|
||||
{
|
||||
"allValue": "info|error",
|
||||
"current": {
|
||||
"selected": false,
|
||||
"text": "All",
|
||||
"value": "$__all"
|
||||
},
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"multi": false,
|
||||
"name": "level",
|
||||
"options": [
|
||||
{
|
||||
"selected": true,
|
||||
"text": "All",
|
||||
"value": "$__all"
|
||||
},
|
||||
{
|
||||
"selected": false,
|
||||
"text": "info",
|
||||
"value": "info"
|
||||
},
|
||||
{
|
||||
"selected": false,
|
||||
"text": "error",
|
||||
"value": "error"
|
||||
}
|
||||
],
|
||||
"query": "info,error",
|
||||
"queryValue": "",
|
||||
"skipUrlSync": false,
|
||||
"type": "custom"
|
||||
},
|
||||
{
|
||||
"allValue": ".+",
|
||||
"current": {
|
||||
"selected": true,
|
||||
"text": [
|
||||
"All"
|
||||
],
|
||||
"value": [
|
||||
"$__all"
|
||||
]
|
||||
},
|
||||
"datasource": "${DS_LOKI}",
|
||||
"definition": "label_values(app)",
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"multi": true,
|
||||
"name": "controller",
|
||||
"options": [],
|
||||
"query": "label_values(app)",
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"sort": 0,
|
||||
"type": "query"
|
||||
},
|
||||
{
|
||||
"allValue": ".+",
|
||||
"current": {
|
||||
"selected": true,
|
||||
"text": [
|
||||
"flux-system"
|
||||
],
|
||||
"value": [
|
||||
"flux-system"
|
||||
]
|
||||
},
|
||||
"datasource": "${DS_LOKI}",
|
||||
"definition": "label_values(namespace)",
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"multi": true,
|
||||
"name": "namespace",
|
||||
"options": [],
|
||||
"query": "label_values(namespace)",
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"sort": 0,
|
||||
"type": "query"
|
||||
},
|
||||
{
|
||||
"allValue": ".+",
|
||||
"current": {
|
||||
"selected": false,
|
||||
"text": "All",
|
||||
"value": "$__all"
|
||||
},
|
||||
"datasource": "${DS_LOKI}",
|
||||
"definition": "label_values(stream)",
|
||||
"hide": 0,
|
||||
"includeAll": true,
|
||||
"multi": true,
|
||||
"name": "stream",
|
||||
"options": [],
|
||||
"query": "label_values(stream)",
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"sort": 0,
|
||||
"type": "query"
|
||||
},
|
||||
{
|
||||
"current": {
|
||||
"selected": false,
|
||||
"text": "Loki",
|
||||
"value": "Loki"
|
||||
},
|
||||
"hide": 0,
|
||||
"includeAll": false,
|
||||
"label": "Datasource",
|
||||
"multi": false,
|
||||
"name": "DS_LOKI",
|
||||
"options": [],
|
||||
"query": "loki",
|
||||
"refresh": 1,
|
||||
"regex": "",
|
||||
"skipUrlSync": false,
|
||||
"type": "datasource"
|
||||
}
|
||||
]
|
||||
},
|
||||
"time": {
|
||||
"from": "now-6h",
|
||||
"to": "now"
|
||||
},
|
||||
"timepicker": {},
|
||||
"timezone": "",
|
||||
"title": "Flux Logs",
|
||||
"uid": "flux-logs",
|
||||
"version": 2
|
||||
}
|
||||
@ -1,16 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- podmonitor.yaml
|
||||
configMapGenerator:
|
||||
- name: flux-grafana-dashboards
|
||||
files:
|
||||
- dashboards/control-plane.json
|
||||
- dashboards/cluster.json
|
||||
- dashboards/logs.json
|
||||
options:
|
||||
labels:
|
||||
grafana_dashboard: "1"
|
||||
app.kubernetes.io/part-of: flux
|
||||
app.kubernetes.io/component: monitoring
|
||||
@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
||||
kind: Kustomization
|
||||
metadata:
|
||||
name: pre-stack
|
||||
namespace: flux-system
|
||||
spec:
|
||||
interval: 5m0s
|
||||
prune: true
|
||||
wait: true
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: platform-config
|
||||
path: ./apps/clusters/pre
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
@ -1,16 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: flaggerloadtester
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
version: "0.30.0"
|
||||
chart: flagger-loadtester
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: flaggerload
|
||||
namespace: monitoring
|
||||
interval: 1m
|
||||
@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: flaggerload
|
||||
namespace: monitoring
|
||||
spec:
|
||||
interval: 1m0s
|
||||
url: https://flagger.app
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: ingress
|
||||
resources:
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
@ -1,24 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: flagger
|
||||
namespace: ingress
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
version: "1.35.0"
|
||||
chart: flagger
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: flagger
|
||||
namespace: ingress
|
||||
interval: 1m
|
||||
values:
|
||||
prometheus:
|
||||
install: false
|
||||
meshProvider: nginx
|
||||
metricsServer: "https://prometheus.svc-dev.ink"
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
namespace: monitoring
|
||||
@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: flagger
|
||||
namespace: ingress
|
||||
spec:
|
||||
interval: 1m0s
|
||||
url: https://flagger.app
|
||||
@ -1,275 +0,0 @@
|
||||
kube-state-metrics:
|
||||
# For kube-prometheus-stacks that are already installed and configured with
|
||||
# custom collectors, commenting out the collectors and extraArgs below will
|
||||
# retain any existing kube-state-metrics configuration.
|
||||
collectors: [ ]
|
||||
extraArgs:
|
||||
- --custom-resource-state-only=true
|
||||
rbac:
|
||||
extraRules:
|
||||
- apiGroups:
|
||||
- source.toolkit.fluxcd.io
|
||||
- kustomize.toolkit.fluxcd.io
|
||||
- helm.toolkit.fluxcd.io
|
||||
- notification.toolkit.fluxcd.io
|
||||
- image.toolkit.fluxcd.io
|
||||
resources:
|
||||
- gitrepositories
|
||||
- buckets
|
||||
- helmrepositories
|
||||
- helmcharts
|
||||
- ocirepositories
|
||||
- kustomizations
|
||||
- helmreleases
|
||||
- alerts
|
||||
- providers
|
||||
- receivers
|
||||
- imagerepositories
|
||||
- imagepolicies
|
||||
- imageupdateautomations
|
||||
verbs: [ "list", "watch" ]
|
||||
customResourceState:
|
||||
enabled: true
|
||||
config:
|
||||
spec:
|
||||
resources:
|
||||
- groupVersionKind:
|
||||
group: kustomize.toolkit.fluxcd.io
|
||||
version: v1
|
||||
kind: Kustomization
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
revision: [ status, lastAppliedRevision ]
|
||||
source_name: [ spec, sourceRef, name ]
|
||||
- groupVersionKind:
|
||||
group: helm.toolkit.fluxcd.io
|
||||
version: v2beta2
|
||||
kind: HelmRelease
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
revision: [ status, lastAppliedRevision ]
|
||||
chart_name: [ spec, chart, spec, chart ]
|
||||
chart_source_name: [ spec, chart, spec, sourceRef, name ]
|
||||
- groupVersionKind:
|
||||
group: source.toolkit.fluxcd.io
|
||||
version: v1
|
||||
kind: GitRepository
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
revision: [ status, artifact, revision ]
|
||||
url: [ spec, url ]
|
||||
- groupVersionKind:
|
||||
group: source.toolkit.fluxcd.io
|
||||
version: v1beta2
|
||||
kind: Bucket
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
revision: [ status, artifact, revision ]
|
||||
endpoint: [ spec, endpoint ]
|
||||
bucket_name: [ spec, bucketName ]
|
||||
- groupVersionKind:
|
||||
group: source.toolkit.fluxcd.io
|
||||
version: v1beta2
|
||||
kind: HelmRepository
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
revision: [ status, artifact, revision ]
|
||||
url: [ spec, url ]
|
||||
- groupVersionKind:
|
||||
group: source.toolkit.fluxcd.io
|
||||
version: v1beta2
|
||||
kind: HelmChart
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
revision: [ status, artifact, revision ]
|
||||
chart_name: [ spec, chart ]
|
||||
chart_version: [ spec, version ]
|
||||
- groupVersionKind:
|
||||
group: source.toolkit.fluxcd.io
|
||||
version: v1beta2
|
||||
kind: OCIRepository
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
revision: [ status, artifact, revision ]
|
||||
url: [ spec, url ]
|
||||
- groupVersionKind:
|
||||
group: notification.toolkit.fluxcd.io
|
||||
version: v1beta3
|
||||
kind: Alert
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
suspended: [ spec, suspend ]
|
||||
- groupVersionKind:
|
||||
group: notification.toolkit.fluxcd.io
|
||||
version: v1beta3
|
||||
kind: Provider
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
suspended: [ spec, suspend ]
|
||||
- groupVersionKind:
|
||||
group: notification.toolkit.fluxcd.io
|
||||
version: v1
|
||||
kind: Receiver
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
webhook_path: [ status, webhookPath ]
|
||||
- groupVersionKind:
|
||||
group: image.toolkit.fluxcd.io
|
||||
version: v1beta2
|
||||
kind: ImageRepository
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
image: [ spec, image ]
|
||||
- groupVersionKind:
|
||||
group: image.toolkit.fluxcd.io
|
||||
version: v1beta2
|
||||
kind: ImagePolicy
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
source_name: [ spec, imageRepositoryRef, name ]
|
||||
- groupVersionKind:
|
||||
group: image.toolkit.fluxcd.io
|
||||
version: v1beta1
|
||||
kind: ImageUpdateAutomation
|
||||
metricNamePrefix: gotk
|
||||
metrics:
|
||||
- name: "resource_info"
|
||||
help: "The current state of a GitOps Toolkit resource."
|
||||
each:
|
||||
type: Info
|
||||
info:
|
||||
labelsFromPath:
|
||||
name: [ metadata, name ]
|
||||
labelsFromPath:
|
||||
exported_namespace: [ metadata, namespace ]
|
||||
ready: [ status, conditions, "[type=Ready]", status ]
|
||||
suspended: [ spec, suspend ]
|
||||
source_name: [ spec, sourceRef, name ]
|
||||
@ -1,18 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
- podmonitor-gitops-system.yaml
|
||||
- podmonitor-ingress.yaml
|
||||
configMapGenerator:
|
||||
- name: flux-kube-state-metrics-config
|
||||
files:
|
||||
- kube-state-metrics-config.yaml
|
||||
options:
|
||||
labels:
|
||||
app.kubernetes.io/part-of: flux
|
||||
app.kubernetes.io/component: monitoring
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@ -1,6 +0,0 @@
|
||||
nameReference:
|
||||
- kind: ConfigMap
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- path: spec/valuesFrom/name
|
||||
kind: HelmRelease
|
||||
@ -1,30 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: gitops-system
|
||||
namespace: monitoring
|
||||
labels:
|
||||
app.kubernetes.io/part-of: flux
|
||||
app.kubernetes.io/component: monitoring
|
||||
spec:
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- gitops-system
|
||||
selector:
|
||||
matchExpressions:
|
||||
- key: app
|
||||
operator: In
|
||||
values:
|
||||
- helm-controller
|
||||
- source-controller
|
||||
- kustomize-controller
|
||||
- notification-controller
|
||||
- image-automation-controller
|
||||
- image-reflector-controller
|
||||
podMetricsEndpoints:
|
||||
- port: "8080"
|
||||
relabelings:
|
||||
# https://github.com/prometheus-operator/prometheus-operator/issues/4816
|
||||
- sourceLabels: [__meta_kubernetes_pod_phase]
|
||||
action: keep
|
||||
regex: Running
|
||||
@ -1,18 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PodMonitor
|
||||
metadata:
|
||||
name: nginx-ingress-podmonitor
|
||||
labels:
|
||||
app.kubernetes.io/part-of: nginx
|
||||
app.kubernetes.io/component: monitoring
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/instance: nginx
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- ingress
|
||||
podMetricsEndpoints:
|
||||
- port: "9113"
|
||||
interval: 30s
|
||||
path: /metrics
|
||||
@ -1,60 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: prometheus-agent
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
version: "55.x"
|
||||
chart: kube-prometheus-stack
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: prometheus-community
|
||||
interval: 10m
|
||||
install:
|
||||
crds: Create
|
||||
upgrade:
|
||||
crds: CreateReplace
|
||||
driftDetection:
|
||||
mode: enabled
|
||||
ignore:
|
||||
# Ignore "validated" annotation which is not inserted during install
|
||||
- paths: [ "/metadata/annotations/prometheus-operator-validated" ]
|
||||
target:
|
||||
kind: PrometheusRule
|
||||
valuesFrom:
|
||||
- kind: ConfigMap
|
||||
name: flux-kube-state-metrics-config
|
||||
valuesKey: kube-state-metrics-config.yaml
|
||||
# https://github.com/prometheus-community/helm-charts/blob/main/charts/kube-prometheus-stack/values.yaml
|
||||
values:
|
||||
global:
|
||||
imageRegistry: "artifact.onwalk.net/base"
|
||||
prometheus:
|
||||
agentMode: true
|
||||
prometheusSpec:
|
||||
remoteWrite:
|
||||
- name: remote_prometheus
|
||||
url: 'https://prometheus.svc-dev.ink/api/v1/write'
|
||||
retention: 24h
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 200Mi
|
||||
podMonitorNamespaceSelector: { }
|
||||
podMonitorSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: monitoring
|
||||
defaultRules:
|
||||
create: false
|
||||
grafana:
|
||||
enabled: false
|
||||
prometheus-windows-exporter:
|
||||
enabled: false
|
||||
alertmanager:
|
||||
enabled: false
|
||||
nodeExporter:
|
||||
enabled: true
|
||||
kubeStateMetrics:
|
||||
enabled: true
|
||||
@ -1,8 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: prometheus-community
|
||||
spec:
|
||||
interval: 12h
|
||||
type: oci
|
||||
url: oci://ghcr.io/prometheus-community/charts
|
||||
@ -1,6 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: monitoring
|
||||
resources:
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
@ -1,60 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2beta2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: loki-stack
|
||||
spec:
|
||||
interval: 1m
|
||||
# dependsOn:
|
||||
# - name: kube-prometheus-stack
|
||||
chart:
|
||||
spec:
|
||||
version: "2.x"
|
||||
chart: loki-stack
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: grafana-charts
|
||||
interval: 60m
|
||||
# https://github.com/grafana/helm-charts/blob/main/charts/loki-stack/values.yaml
|
||||
# https://github.com/grafana/loki/blob/main/production/helm/loki/values.yaml
|
||||
values:
|
||||
promtail:
|
||||
enabled: true
|
||||
loki:
|
||||
enabled: true
|
||||
isDefault: false
|
||||
ingress:
|
||||
enabled: true
|
||||
ingressClassName: nginx
|
||||
hosts:
|
||||
- host: loki.svc-dev.ink
|
||||
paths:
|
||||
- "/"
|
||||
tls:
|
||||
- secretName: obs-tls
|
||||
hosts:
|
||||
- loki.svc-dev.ink
|
||||
ruler:
|
||||
storage:
|
||||
type: local
|
||||
local:
|
||||
directory: /rules
|
||||
rule_path: /tmp/scratch
|
||||
alertmanager_url: https://alertmanager.svc-dev.ink
|
||||
ring:
|
||||
kvstore:
|
||||
store: inmemory
|
||||
enable_api: true
|
||||
remote_write:
|
||||
enabled: true
|
||||
client:
|
||||
url: http://prometheus.svc-dev.ink/api/v1/write
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
additionalLabels:
|
||||
app.kubernetes.io/part-of: kube-prometheus-stack
|
||||
config:
|
||||
chunk_store_config:
|
||||
max_look_back_period: 0s
|
||||
table_manager:
|
||||
retention_deletes_enabled: true
|
||||
retention_period: 12h
|
||||
@ -1,7 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1beta2
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: grafana-charts
|
||||
spec:
|
||||
interval: 120m0s
|
||||
url: https://grafana.github.io/helm-charts
|
||||
@ -1,94 +0,0 @@
|
||||
apiVersion: monitoring.coreos.com/v1alpha1
|
||||
kind: PrometheusAgent
|
||||
metadata:
|
||||
annotations:
|
||||
meta.helm.sh/release-name: prometheus-agent
|
||||
meta.helm.sh/release-namespace: monitoring
|
||||
creationTimestamp: "2023-12-27T12:13:56Z"
|
||||
generation: 2
|
||||
labels:
|
||||
app: kube-prometheus-stack-prometheus
|
||||
app.kubernetes.io/instance: prometheus-agent
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
app.kubernetes.io/part-of: kube-prometheus-stack
|
||||
app.kubernetes.io/version: 55.5.0
|
||||
chart: kube-prometheus-stack-55.5.0
|
||||
helm.toolkit.fluxcd.io/name: prometheus-agent
|
||||
helm.toolkit.fluxcd.io/namespace: monitoring
|
||||
heritage: Helm
|
||||
release: prometheus-agent
|
||||
name: prometheus-agent-kube-prom-prometheus
|
||||
namespace: monitoring
|
||||
resourceVersion: "14691"
|
||||
uid: 9bf6429e-2ae1-4568-95ee-0e2dc1a4071f
|
||||
spec:
|
||||
externalUrl: http://prometheus-agent-kube-prom-prometheus.monitoring:9090
|
||||
hostNetwork: false
|
||||
image: artifact.onwalk.net/base/prometheus/prometheus:v2.48.1
|
||||
listenLocal: false
|
||||
logFormat: logfmt
|
||||
logLevel: info
|
||||
paused: false
|
||||
podMonitorNamespaceSelector: {}
|
||||
podMonitorSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/component: monitoring
|
||||
portName: http-web
|
||||
probeNamespaceSelector: {}
|
||||
probeSelector:
|
||||
matchLabels:
|
||||
release: prometheus-agent
|
||||
remoteWrite:
|
||||
- name: remote_prometheus
|
||||
url: https://prometheus.svc-dev.ink/api/v1/write
|
||||
replicas: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 200m
|
||||
memory: 200Mi
|
||||
routePrefix: /
|
||||
scrapeConfigNamespaceSelector: {}
|
||||
scrapeConfigSelector:
|
||||
matchLabels:
|
||||
release: prometheus-agent
|
||||
scrapeInterval: 30s
|
||||
securityContext:
|
||||
fsGroup: 2000
|
||||
runAsGroup: 2000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
serviceAccountName: prometheus-agent-kube-prom-prometheus
|
||||
serviceMonitorNamespaceSelector: {}
|
||||
serviceMonitorSelector:
|
||||
matchLabels:
|
||||
release: prometheus-agent
|
||||
shards: 1
|
||||
version: v2.48.1
|
||||
walCompression: true
|
||||
status:
|
||||
availableReplicas: 1
|
||||
conditions:
|
||||
- lastTransitionTime: "2023-12-27T13:20:17Z"
|
||||
message: ""
|
||||
observedGeneration: 2
|
||||
reason: ""
|
||||
status: "True"
|
||||
type: Available
|
||||
- lastTransitionTime: "2023-12-27T13:20:17Z"
|
||||
message: ""
|
||||
observedGeneration: 2
|
||||
reason: ""
|
||||
status: "True"
|
||||
type: Reconciled
|
||||
paused: false
|
||||
replicas: 1
|
||||
shardStatuses:
|
||||
- availableReplicas: 1
|
||||
replicas: 1
|
||||
shardID: "0"
|
||||
unavailableReplicas: 0
|
||||
updatedReplicas: 1
|
||||
unavailableReplicas: 0
|
||||
updatedReplicas: 1
|
||||
@ -1,72 +0,0 @@
|
||||
# Configuration Layout
|
||||
|
||||
This repository keeps environment-specific infrastructure configuration under the `config/` directory. The layout follows a consistent project → environment → cloud/provider → resource-module hierarchy so that each stack can be managed independently.
|
||||
|
||||
## Recommended standard layout
|
||||
|
||||
```
|
||||
config/
|
||||
└── <project>/
|
||||
└── <env>/
|
||||
└── <cloud>/
|
||||
├── base.yaml
|
||||
├── identity.yaml
|
||||
├── network.yaml
|
||||
├── security.yaml
|
||||
├── storage.yaml
|
||||
├── compute.yaml
|
||||
├── observability.yaml
|
||||
└── <feature>.yaml
|
||||
```
|
||||
|
||||
- **Project**: top-level application or platform (for example `modern-container-app`, `cloudneutral-platform`, or `ai-infra-lab`).
|
||||
- **Environment**: fully isolated deployment stages such as `dev`, `sit`, `uat`, and `prod`.
|
||||
- **Cloud/Provider**: clear provider identifiers such as `aws-cloud`, `gcp-cloud`, or `vultr-vps`.
|
||||
- **Resource modules**: YAML slices for base settings, identity, network, security, storage, compute, observability, and feature-specific needs.
|
||||
|
||||
## Applied layout for this repository
|
||||
|
||||
The current repo uses the `xzerolab` project with a `sit` environment. Provider-specific configurations are organized per cloud alongside shared assets for future environments.
|
||||
|
||||
```
|
||||
config/
|
||||
├── bootstrap.yaml
|
||||
└── xzerolab/
|
||||
└── sit/
|
||||
├── aws-cloud/
|
||||
│ ├── accounts/
|
||||
│ │ ├── bootstrap.yaml
|
||||
│ │ ├── dev-landingzone.yaml
|
||||
│ │ └── dev.yaml
|
||||
│ ├── provider_backend.yaml
|
||||
│ └── resources/
|
||||
│ ├── dev-alb/alb.yaml
|
||||
│ ├── dev-kafka/msk.yaml
|
||||
│ ├── dev-nlb/nlb.yaml
|
||||
│ ├── dev-object/bucket.yaml
|
||||
│ ├── dev-rds/rds.yaml
|
||||
│ ├── dev-redis/redis.yaml
|
||||
│ ├── ec2/dev.yaml
|
||||
│ └── vpc/dev.yaml
|
||||
├── gcp-cloud/
|
||||
│ ├── accounts/
|
||||
│ │ ├── bootstrap.yaml
|
||||
│ │ ├── dev-landingzone.yaml
|
||||
│ │ └── dev.yaml
|
||||
│ └── resources/
|
||||
│ ├── dev-alb/alb.yaml
|
||||
│ ├── dev-kafka/msk.yaml
|
||||
│ ├── dev-nlb/nlb.yaml
|
||||
│ ├── dev-object/bucket.yaml
|
||||
│ ├── dev-rds/rds.yaml
|
||||
│ ├── dev-redis/redis.yaml
|
||||
│ ├── ec2/dev.yaml
|
||||
│ └── vpc/dev.yaml
|
||||
└── vultr-vps/
|
||||
├── accounts/
|
||||
│ └── .gitkeep
|
||||
└── resources/
|
||||
└── .gitkeep
|
||||
```
|
||||
|
||||
Use this layout to keep each environment and provider self-contained, making it easy for CI/CD workflows to target the exact configuration needed for a deployment.
|
||||
@ -1,8 +0,0 @@
|
||||
audit:
|
||||
actiontrail:
|
||||
enabled: true
|
||||
name: lz-mvp-actiontrail
|
||||
oss_bucket_ref: lz-mvp-actiontrail-logs
|
||||
oss_key_prefix: actiontrail
|
||||
trail_region: cn-hangzhou
|
||||
event_rw: All
|
||||
@ -1,5 +0,0 @@
|
||||
alicloud:
|
||||
region: cn-hangzhou
|
||||
default_tags:
|
||||
project: landingzone-mvp
|
||||
owner: your-github-handle
|
||||
@ -1,27 +0,0 @@
|
||||
config_service:
|
||||
recorder:
|
||||
name: lz-config-recorder
|
||||
resource_types:
|
||||
- ACS::ECS::Instance
|
||||
- ACS::OSS::Bucket
|
||||
- ACS::VPC::VSwitch
|
||||
delivery_channel:
|
||||
name: lz-config-delivery
|
||||
display_name: LandingZoneBaseline
|
||||
type: OSS
|
||||
target_arn: acs:oss:cn-hangzhou:${AliUid}:lz-mvp-actiontrail-logs
|
||||
assume_role_arn: acs:ram::${AliUid}:role/aliyunconfigdefaultrole
|
||||
description: Deliver baseline compliance evaluations to OSS
|
||||
status: 1
|
||||
rules:
|
||||
- name: lz-required-env-tag
|
||||
description: Ensure env tag exists on core resources
|
||||
source_identifier: ecs-instance-required-tag
|
||||
source_owner: ALIYUN
|
||||
risk_level: 2
|
||||
trigger_types: ConfigurationItemChangeNotification
|
||||
resource_types_scopes:
|
||||
- ACS::ECS::Instance
|
||||
input_parameters:
|
||||
tagKey: env
|
||||
maximum_execution_frequency: TwentyFour_Hours
|
||||
@ -1,28 +0,0 @@
|
||||
identity:
|
||||
users:
|
||||
- name: ops-automation
|
||||
display_name: Landing Zone Automation
|
||||
comments: Dedicated RAM user for IaC pipelines
|
||||
policies:
|
||||
- name: AliyunOSSFullAccess
|
||||
type: System
|
||||
- name: AliyunVPCFullAccess
|
||||
type: System
|
||||
- name: AliyunConfigFullAccess
|
||||
type: System
|
||||
- name: audit-viewer
|
||||
display_name: Landing Zone Auditor
|
||||
comments: Read-only access for monitoring
|
||||
policies:
|
||||
- name: ReadOnlyAccess
|
||||
type: System
|
||||
groups:
|
||||
- name: ops-admins
|
||||
comments: Baseline operations team
|
||||
policies:
|
||||
- name: AliyunConfigFullAccess
|
||||
type: System
|
||||
- name: AliyunVPCFullAccess
|
||||
type: System
|
||||
users:
|
||||
- ops-automation
|
||||
@ -1,18 +0,0 @@
|
||||
network:
|
||||
vpcs:
|
||||
- name: lz-main-vpc
|
||||
cidr_block: 10.10.0.0/16
|
||||
description: Landing zone baseline VPC
|
||||
tags:
|
||||
env: shared
|
||||
vswitches:
|
||||
- name: lz-prod-subnet
|
||||
cidr_block: 10.10.1.0/24
|
||||
zone_id: cn-hangzhou-h
|
||||
tags:
|
||||
env: prod
|
||||
- name: lz-test-subnet
|
||||
cidr_block: 10.10.2.0/24
|
||||
zone_id: cn-hangzhou-h
|
||||
tags:
|
||||
env: test
|
||||
@ -1,18 +0,0 @@
|
||||
security:
|
||||
groups:
|
||||
- name: lz-base-sg
|
||||
vpc: lz-main-vpc
|
||||
description: Baseline security group allowing outbound traffic only
|
||||
tags:
|
||||
env: shared
|
||||
ingress:
|
||||
- protocol: tcp
|
||||
port_range: "22/22"
|
||||
cidr_ip: 0.0.0.0/0
|
||||
description: Temporary SSH access for break-glass
|
||||
policy: accept
|
||||
egress:
|
||||
- protocol: all
|
||||
port_range: "-1/-1"
|
||||
cidr_ip: 0.0.0.0/0
|
||||
policy: accept
|
||||
@ -1,17 +0,0 @@
|
||||
storage:
|
||||
oss_buckets:
|
||||
- name: lz-mvp-actiontrail-logs
|
||||
bucket: lz-mvp-actiontrail-logs
|
||||
storage_class: Standard
|
||||
versioning:
|
||||
status: Enabled
|
||||
lifecycle_rules:
|
||||
- id: archive-audit-logs
|
||||
enabled: true
|
||||
transitions:
|
||||
- storage_class: IA
|
||||
days: 180
|
||||
- storage_class: Archive
|
||||
days: 365
|
||||
tags:
|
||||
env: prod
|
||||
@ -1,6 +0,0 @@
|
||||
aws:
|
||||
region: us-east-1
|
||||
default_tags:
|
||||
project: landingzone-global
|
||||
owner: your-github-handle
|
||||
environment: shared
|
||||
@ -1,27 +0,0 @@
|
||||
identity:
|
||||
users:
|
||||
- name: lz-automation
|
||||
path: /landingzone/
|
||||
tags:
|
||||
role: automation
|
||||
policies:
|
||||
- arn: arn:aws:iam::aws:policy/AdministratorAccess
|
||||
- name: lz-auditor
|
||||
path: /landingzone/
|
||||
tags:
|
||||
role: audit
|
||||
policies:
|
||||
- arn: arn:aws:iam::aws:policy/SecurityAudit
|
||||
groups:
|
||||
- name: lz-operations
|
||||
path: /landingzone/
|
||||
policies:
|
||||
- arn: arn:aws:iam::aws:policy/PowerUserAccess
|
||||
users:
|
||||
- lz-automation
|
||||
- name: lz-audit
|
||||
path: /landingzone/
|
||||
policies:
|
||||
- arn: arn:aws:iam::aws:policy/SecurityAudit
|
||||
users:
|
||||
- lz-auditor
|
||||
@ -1,29 +0,0 @@
|
||||
network:
|
||||
vpcs:
|
||||
- name: lz-global-vpc
|
||||
cidr_block: 10.20.0.0/16
|
||||
tags:
|
||||
env: shared
|
||||
subnets:
|
||||
- name: lz-public-a
|
||||
cidr_block: 10.20.1.0/24
|
||||
availability_zone: us-east-1a
|
||||
type: public
|
||||
tags:
|
||||
tier: ingress
|
||||
- name: lz-private-a
|
||||
cidr_block: 10.20.11.0/24
|
||||
availability_zone: us-east-1a
|
||||
type: private
|
||||
tags:
|
||||
tier: application
|
||||
- name: lz-private-b
|
||||
cidr_block: 10.20.21.0/24
|
||||
availability_zone: us-east-1b
|
||||
type: private
|
||||
tags:
|
||||
tier: application
|
||||
routes:
|
||||
- subnet_type: public
|
||||
destination_cidr_block: 0.0.0.0/0
|
||||
gateway: internet_gateway
|
||||
@ -1,24 +0,0 @@
|
||||
security:
|
||||
groups:
|
||||
- name: lz-base-sg
|
||||
vpc: lz-global-vpc
|
||||
description: Baseline security group allowing outbound traffic and limited inbound access
|
||||
tags:
|
||||
tier: baseline
|
||||
ingress:
|
||||
- protocol: tcp
|
||||
from_port: 22
|
||||
to_port: 22
|
||||
cidr_blocks:
|
||||
- 0.0.0.0/0
|
||||
description: Temporary SSH access for break-glass
|
||||
- protocol: tcp
|
||||
port_range: "443/443"
|
||||
cidr_blocks:
|
||||
- 0.0.0.0/0
|
||||
description: HTTPS access for shared services
|
||||
egress:
|
||||
- protocol: all
|
||||
port_range: "-1/-1"
|
||||
cidr_blocks:
|
||||
- 0.0.0.0/0
|
||||
@ -1,18 +0,0 @@
|
||||
storage:
|
||||
buckets:
|
||||
- name: lz-global-logs
|
||||
acl: private
|
||||
versioning: true
|
||||
force_destroy: false
|
||||
block_public_access: true
|
||||
lifecycle_rules:
|
||||
- id: expire-old-logs
|
||||
enabled: true
|
||||
transitions:
|
||||
- storage_class: GLACIER
|
||||
days: 90
|
||||
expiration_days: 365
|
||||
server_side_encryption:
|
||||
sse_algorithm: AES256
|
||||
tags:
|
||||
purpose: audit-logs
|
||||
@ -1,17 +0,0 @@
|
||||
region: ap-northeast-1
|
||||
environment: bootstrap
|
||||
|
||||
account_name: xzerolab
|
||||
account_id: 950604983695
|
||||
|
||||
state:
|
||||
bucket_name: aws-cloud-iac-state
|
||||
dynamodb_table_name: aws-cloud-iac-state-dynamodb-lock
|
||||
|
||||
iam:
|
||||
role_name: IacDeployRole
|
||||
terraform_user_name: github-ci-runner
|
||||
|
||||
tags:
|
||||
Owner: Platform
|
||||
Project: CloudNeutral
|
||||
@ -1,6 +0,0 @@
|
||||
aws:
|
||||
profile: default
|
||||
region: ap-northeast-1
|
||||
key_pairs:
|
||||
- name: dev_key
|
||||
key_file: ~/.ssh/id_rsa.pub
|
||||
@ -1,37 +0,0 @@
|
||||
firewall_rules:
|
||||
- name: allow-web-inbound
|
||||
enabled: true
|
||||
vpc_name: dev-vpc-1
|
||||
source_ranges: ["0.0.0.0/0"]
|
||||
egress_ranges: ["10.0.0.0/16"]
|
||||
allow:
|
||||
- protocol: tcp
|
||||
ports: ["80", "443"]
|
||||
|
||||
- name: dev-vpc-1-default-inbound
|
||||
enabled: true
|
||||
vpc_name: dev-vpc-1
|
||||
description: Allow ICMP, SSH, and VXLAN from all sources
|
||||
source_ranges: ["0.0.0.0/0"]
|
||||
allow:
|
||||
- protocol: icmp
|
||||
- protocol: tcp
|
||||
ports: ["22"]
|
||||
- protocol: udp
|
||||
ports: ["4789"]
|
||||
- protocol: udp
|
||||
ports: ["51820"]
|
||||
|
||||
- name: dev-vpc-2-default-inbound
|
||||
enabled: true
|
||||
vpc_name: dev-vpc-2
|
||||
description: Allow ICMP, SSH, and VXLAN from all sources
|
||||
source_ranges: ["0.0.0.0/0"]
|
||||
allow:
|
||||
- protocol: icmp
|
||||
- protocol: tcp
|
||||
ports: ["22"]
|
||||
- protocol: udp
|
||||
ports: ["4789"]
|
||||
- protocol: udp
|
||||
ports: ["51820"]
|
||||
@ -1,48 +0,0 @@
|
||||
instances:
|
||||
- name: master-1
|
||||
ami: ubuntu-24.04 # ✅ 可用 ami-xxx 或关键词（如 ubuntu-22.04）
|
||||
type: t3a.xlarge
|
||||
disk_size_gb: 20
|
||||
sg_names: ["dev-vpc-1-default-inbound"]
|
||||
subnet: dev-vpc-1-public-subnet-1
|
||||
lifecycle: spot # 可选: ondemand（默认）或 spot
|
||||
ttl: 1h # 可选: 标记生命周期（不会自动销毁）
|
||||
env: sit # 可选: dev/sit/prod 等环境标签
|
||||
owner: devops # 可选: 资源责任人标签
|
||||
associate_public_ip: true # ✅ 明确配置是否需要公网 IP
|
||||
|
||||
- name: slave-1
|
||||
ami: ubuntu-24.04
|
||||
type: t3.small
|
||||
sg_names: ["dev-vpc-2-default-inbound"]
|
||||
disk_size_gb: 20
|
||||
subnet: dev-vpc-2-public-subnet-1
|
||||
lifecycle: spot
|
||||
ttl: 1h
|
||||
env: sit
|
||||
owner: devops
|
||||
associate_public_ip: true
|
||||
|
||||
- name: agent-1
|
||||
ami: ubuntu-24.04
|
||||
type: t3.micro
|
||||
disk_size_gb: 20
|
||||
subnet: dev-vpc-1-public-subnet-1
|
||||
sg_names: ["dev-vpc-1-default-inbound"]
|
||||
lifecycle: spot
|
||||
ttl: 1h
|
||||
env: sit
|
||||
owner: devops
|
||||
associate_public_ip: true
|
||||
|
||||
- name: agent-2
|
||||
ami: ubuntu-24.04
|
||||
type: t3.micro
|
||||
disk_size_gb: 20
|
||||
subnet: dev-vpc-2-public-subnet-1
|
||||
sg_names: ["dev-vpc-2-default-inbound"]
|
||||
lifecycle: spot
|
||||
ttl: 1h
|
||||
env: sit
|
||||
owner: devops
|
||||
associate_public_ip: true
|
||||
@ -1,44 +0,0 @@
|
||||
vpcs:
|
||||
- name: dev-vpc-1
|
||||
cidr_block: 10.1.0.0/16
|
||||
subnets:
|
||||
- name: dev-vpc-1-public-subnet-1
|
||||
cidr_block: 10.1.1.0/24
|
||||
availability_zone: ap-northeast-1a
|
||||
type: public
|
||||
- name: dev-vpc-1-private-subnet-1
|
||||
cidr_block: 10.1.101.0/24
|
||||
availability_zone: ap-northeast-1c
|
||||
type: private
|
||||
routes:
|
||||
- name: dev-vpc-1-public-route
|
||||
destination_cidr_block: 0.0.0.0/0
|
||||
subnet_type: public
|
||||
gateway: internet_gateway
|
||||
peering:
|
||||
enabled: false
|
||||
peer_vpc_id: null
|
||||
peer_region: null
|
||||
auto_accept: false
|
||||
|
||||
- name: dev-vpc-2
|
||||
cidr_block: 10.2.0.0/16
|
||||
subnets:
|
||||
- name: dev-vpc-2-public-subnet-1
|
||||
cidr_block: 10.2.1.0/24
|
||||
availability_zone: ap-northeast-1a
|
||||
type: public
|
||||
- name: dev-vpc-2-private-subnet-1
|
||||
cidr_block: 10.2.101.0/24
|
||||
availability_zone: ap-northeast-1c
|
||||
type: private
|
||||
routes:
|
||||
- name: dev-vpc-2-public-route
|
||||
destination_cidr_block: 0.0.0.0/0
|
||||
subnet_type: public
|
||||
gateway: internet_gateway
|
||||
peering:
|
||||
enabled: false
|
||||
peer_vpc_id: null
|
||||
peer_region: null
|
||||
auto_accept: false
|
||||
@ -1,155 +0,0 @@
|
||||
# 基础网络参数
|
||||
wg_network: 172.30.0.0/16
|
||||
bridge_network: 10.253.0.0/16
|
||||
vxlan_id: 100
|
||||
hub_port: 51820
|
||||
|
||||
# 全局功能开关
|
||||
features:
|
||||
enable_vless: true # 是否通过 VLESS 中转 WG 流量
|
||||
enable_multi_hub: true # 是否支持多 Hub 架构（false 则为单 Hub star 架构）
|
||||
enable_vxlan_between_sits: true # 是否开启 vxlan 桥接（站点接入 Hub）
|
||||
enable_vxlan_between_hubs: true # 是否开启 Hub 之间的 VXLAN Mesh
|
||||
only_wireguard: false # 若为 true，仅使用 WireGuard 点对点，忽略 gretap/vxlan
|
||||
|
||||
# WireGuard Hub 节点配置
|
||||
hubs:
|
||||
- name: cn-hub
|
||||
interface: eth0
|
||||
public_ip: 1.15.155.245
|
||||
pod_cidr: 10.42.0.0/16
|
||||
wireguard_cidr: 172.30.0.0/16
|
||||
wg_ip: 172.30.0.1
|
||||
br_ip: 10.253.253.1
|
||||
local_ip: 172.30.0.1
|
||||
remote_ip: 172.31.0.10
|
||||
xray:
|
||||
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
|
||||
relay_address: "global-proxy.onwalk.net"
|
||||
relay_port: '51820'
|
||||
remote_domain: "global-proxy.onwalk.net"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
wireguard_peer:
|
||||
- master-1
|
||||
- slave-1
|
||||
- agent-1
|
||||
- agent-1
|
||||
|
||||
- name: global-hub
|
||||
interface: ens5
|
||||
public_ip: 1.15.155.245
|
||||
wg_ip: 172.31.0.1
|
||||
br_ip: 10.253.253.2
|
||||
local_ip: 172.31.0.1
|
||||
remote_ip: 172.30.0.1
|
||||
xray:
|
||||
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
relay_address: "cn-proxy.onwalk.net"
|
||||
relay_port: '51820'
|
||||
remote_domain: "cn-proxy.onwalk.net"
|
||||
wireguard_peer:
|
||||
- master-1
|
||||
- slave-1
|
||||
- agent-1
|
||||
- agent-1
|
||||
|
||||
sites:
|
||||
- name: tky-proxy
|
||||
interface: ens5
|
||||
public_ip: 52.196.108.28
|
||||
wg_ip: 172.31.0.2
|
||||
br_ip: 10.253.254.2
|
||||
local_ip: 172.31.0.2
|
||||
remote_ip: 172.31.0.1
|
||||
wireguard_peer:
|
||||
- global-hub
|
||||
allowed_ips: "172.30.0.0/16,172.31.0.0/16"
|
||||
xray:
|
||||
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
relay_address: "global-proxy.onwalk.net"
|
||||
relay_port: '51820'
|
||||
remote_domain: "global-proxy.onwalk.net"
|
||||
|
||||
- name: us-proxy
|
||||
interface: enX0
|
||||
public_ip: 54.183.32.0
|
||||
wg_ip: 172.31.0.3
|
||||
br_ip: 10.253.254.3
|
||||
local_ip: 172.31.0.3
|
||||
remote_ip: 172.31.0.1
|
||||
wireguard_peer:
|
||||
- global-hub
|
||||
allowed_ips: "172.30.0.0/16,172.31.0.0/16"
|
||||
xray:
|
||||
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
|
||||
remote_domain: "global-proxy.onwalk.net"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
|
||||
- name: ca-proxy
|
||||
interface: ens5
|
||||
wg_ip: 172.31.0.4
|
||||
br_ip: 10.253.254.4
|
||||
local_ip: 172.31.0.4
|
||||
remote_ip: 172.31.0.1
|
||||
wireguard_peer:
|
||||
- global-hub
|
||||
allowed_ips: "172.30.0.0/16,172.31.0.0/16"
|
||||
xray:
|
||||
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
|
||||
remote_domain: "global-proxy.onwalk.net"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
|
||||
- name: deepflow-demo
|
||||
interface: wlp0s20f3
|
||||
public_ip: 172.30.0.10
|
||||
wg_ip: 172.30.0.10
|
||||
br_ip: 10.253.253.2
|
||||
local_ip: 172.30.0.10
|
||||
remote_ip: 172.30.0.1
|
||||
wireguard_peer: cn-hub
|
||||
allowed_ips: "172.30.0.0/16"
|
||||
|
||||
- name: icp-aliyun
|
||||
interface: eth0
|
||||
public_ip: 47.120.61.35
|
||||
wg_ip: 172.30.0.11
|
||||
pod_cidr: 10.42.0.0/16
|
||||
wireguard_cidr: 172.30.0.0/16
|
||||
br_ip: 10.253.253.11
|
||||
local_ip: 172.30.0.11
|
||||
remote_ip: 172.30.0.1
|
||||
wireguard_peer: cn-hub
|
||||
allowed_ips: "172.30.0.0/16"
|
||||
xray:
|
||||
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
relay_address: "cn-proxy.onwalk.net"
|
||||
relay_port: '51820'
|
||||
remote_domain: "cn-proxy.onwalk.net"
|
||||
|
||||
- name: icp-huawei
|
||||
interface: eth0
|
||||
public_ip: 139.9.139.22
|
||||
pod_cidr: 10.42.0.0/16
|
||||
wireguard_cidr: 172.30.0.0/16
|
||||
wg_ip: 172.30.0.12
|
||||
br_ip: 10.253.253.12
|
||||
local_ip: 172.30.0.12
|
||||
remote_ip: 172.30.0.1
|
||||
wireguard_peer: cn-hub
|
||||
allowed_ips: "172.30.0.0/16"
|
||||
xray:
|
||||
uuid: "18d270a9-533d-4b13-b3f1-e7f55540a9b2"
|
||||
cert_path: "/etc/ssl/onwalk.net.pem"
|
||||
key_path: "/etc/ssl/onwalk.net.key"
|
||||
relay_address: "cn-proxy.onwalk.net"
|
||||
relay_port: '51820'
|
||||
remote_domain: "cn-proxy.onwalk.net"
|
||||
@ -1,5 +0,0 @@
|
||||
vultr:
|
||||
region: ewr
|
||||
default_tags:
|
||||
environment: baseline
|
||||
project: modern-container-app
|
||||
@ -1,16 +0,0 @@
|
||||
compute:
|
||||
instances:
|
||||
- name: baseline-bastion
|
||||
plan: vc2-1c-1gb
|
||||
region: ewr
|
||||
os_id: 1743
|
||||
hostname: baseline-bastion
|
||||
label: baseline-bastion
|
||||
enable_ipv6: false
|
||||
backups: disabled
|
||||
firewall_group: baseline-fw
|
||||
vpcs:
|
||||
- baseline-vpc
|
||||
tags:
|
||||
- bastion
|
||||
- baseline
|
||||
@ -1,7 +0,0 @@
|
||||
network:
|
||||
vpcs:
|
||||
- name: baseline-vpc
|
||||
description: Baseline landing zone VPC
|
||||
region: ewr
|
||||
v4_subnet: 10.50.0.0
|
||||
v4_subnet_mask: 16
|
||||
@ -1,16 +0,0 @@
|
||||
security:
|
||||
firewall_groups:
|
||||
- name: baseline-fw
|
||||
description: Baseline perimeter firewall rules
|
||||
rules:
|
||||
- name: allow-ssh
|
||||
protocol: tcp
|
||||
ip_type: v4
|
||||
cidr: 0.0.0.0/0
|
||||
port: "22"
|
||||
notes: Allow SSH for operations
|
||||
- name: allow-icmp
|
||||
protocol: icmp
|
||||
ip_type: v4
|
||||
cidr: 0.0.0.0/0
|
||||
notes: Allow ICMP diagnostics
|
||||
@ -1,19 +0,0 @@
|
||||
account_id: 950604983695
|
||||
name: dev
|
||||
environment: dev
|
||||
|
||||
region: ap-northeast-1
|
||||
|
||||
role_to_assume: "arn:aws:iam::950604983695:role/IacDeployRole"
|
||||
logging_bucket: org-dev-logs
|
||||
shared_vpc_account: "950604983695" # 单账号，所以保持一致
|
||||
|
||||
tags:
|
||||
Environment: dev
|
||||
Owner: Platform
|
||||
CostCenter: "DEV"
|
||||
Project: CloudNeutral
|
||||
|
||||
backend:
|
||||
bucket: aws-cloud-iac-state
|
||||
dynamodb_table: aws-cloud-iac-state-dynamodb-lock
|
||||
@ -1,17 +0,0 @@
|
||||
region: ap-northeast-1
|
||||
environment: bootstrap
|
||||
|
||||
account_name: xzerolab
|
||||
account_id: 950604983695
|
||||
|
||||
state:
|
||||
bucket_name: aws-cloud-iac-state
|
||||
dynamodb_table_name: aws-cloud-iac-state-dynamodb-lock
|
||||
|
||||
iam:
|
||||
role_name: IacDeployRole
|
||||
terraform_user_name: github-ci-runner
|
||||
|
||||
tags:
|
||||
Owner: Platform
|
||||
Project: CloudNeutral
|
||||
@ -1,9 +0,0 @@
|
||||
region: "ap-northeast-1"
|
||||
account_id: "950604983695"
|
||||
|
||||
landingzone:
|
||||
console_mode: "readonly" # 可选：deny / readonly
|
||||
enable_risp_controls: true # 限制 RI/SP 购买
|
||||
enable_root_limited: true # 限制 root API
|
||||
enable_mfa_enforce: true # 强制 MFA
|
||||
|
||||
@ -1,19 +0,0 @@
|
||||
name_prefix: "alb"
|
||||
|
||||
vpc_id: "vpc-0d0d8d822fa215104"
|
||||
|
||||
subnet_ids:
|
||||
- "subnet-0c370f7ff7311388e"
|
||||
- "subnet-0b609b5773fe957fa"
|
||||
|
||||
listeners:
|
||||
- port: 80
|
||||
protocol: "HTTP"
|
||||
target_group_port: 80
|
||||
target_group_protocol: "HTTP"
|
||||
|
||||
- port: 443
|
||||
protocol: "HTTPS"
|
||||
certificate_arn: "arn:aws:acm:ap-northeast-1:xxxx:certificate/xxxx-xxxx"
|
||||
target_group_port: 443
|
||||
target_group_protocol: "HTTP"
|
||||
@ -1,26 +0,0 @@
|
||||
name_prefix: "dev-ec2"
|
||||
|
||||
vpc_id: "vpc-06e1d6dab47b1d35f"
|
||||
subnet_id: "subnet-06859ec23046f4556"
|
||||
|
||||
instance:
|
||||
type: "t3.micro"
|
||||
ami: "ubuntu-2204"
|
||||
|
||||
keypair:
|
||||
name: "dev-key"
|
||||
public_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDEsuS135lzjVvlH2iNrKz23lDFr7b686xs4d2HINP2glFPmgkgx1D6Dqwisb1UbhWHZmUUzRxXeNlE8fiaO0TXN/C0dsdUxgopnQRyakcA+gfJqqb38Syx8eqdC7mQy9ygOf763dWm6d/SYZ8WgNWLldk4QF9DiZOW9K22DMtY4/1Cqe/YE/WGpOMVr9T9BwvmOjarjWp2OPbx6RVlSOd735Mze5X+cJ9QqdLaisCiSoJ3j9S6dulcxm+7ghPfATvxlJyZWSrRrVqnmV45lPbeuUHlIEyuK1PK2MS6NtUP03ZhdRYJQKZLECpR5xAO/BliOtDdRornvHV1gutYD8/n3IS8sRVzYPvN9DuOhzBnBQUgciu2++R8zMfdVoH7mSbsE8u++vMcBk3UJ1Op0Ct+trl2bsnue96cAnoiII08JKwAaczD5uZIGhdkGV8zKnChNCjzCxP0i4PV/MYW04eWmH+E8G81zq4ZsvrvPYmilBbRrkwHvvbPba3SSb2F2As= shenlan@shenlandeMacBook-Air-2.local"
|
||||
|
||||
security_group:
|
||||
name: "dev-ec2-sg"
|
||||
ssh_cidr: "0.0.0.0/0"
|
||||
additional_ingress:
|
||||
- port: 80
|
||||
protocol: tcp
|
||||
cidr: "0.0.0.0/0"
|
||||
- port: 443
|
||||
protocol: tcp
|
||||
cidr: "0.0.0.0/0"
|
||||
- port: 1443
|
||||
protocol: tcp
|
||||
cidr: "0.0.0.0/0"
|
||||
@ -1,16 +0,0 @@
|
||||
name_prefix: "dev-kafka"
|
||||
|
||||
kafka_version: "3.6.0"
|
||||
|
||||
brokers:
|
||||
instance_type: "kafka.t3.small"
|
||||
number_of_broker_nodes: 2
|
||||
|
||||
ebs:
|
||||
volume_size: 50
|
||||
|
||||
vpc_id: "vpc-0d0d8d822fa215104"
|
||||
|
||||
subnet_ids:
|
||||
- "subnet-0c370f7ff7311388e"
|
||||
- "subnet-0b609b5773fe957fa"
|
||||
@ -1,13 +0,0 @@
|
||||
name_prefix: "dev-nlb"
|
||||
|
||||
vpc_id: "vpc-0d0d8d822fa215104"
|
||||
|
||||
subnet_ids:
|
||||
- "subnet-0c370f7ff7311388e"
|
||||
- "subnet-0b609b5773fe957fa"
|
||||
|
||||
listeners:
|
||||
- port: 80
|
||||
protocol: "TCP"
|
||||
target_group_port: 80
|
||||
target_group_protocol: "TCP"
|
||||
@ -1,33 +0,0 @@
|
||||
name_prefix: "dev-rds"
|
||||
|
||||
engine: "postgres"
|
||||
engine_version: "16.1"
|
||||
instance_class: "db.t3.micro"
|
||||
|
||||
username: "admin"
|
||||
password: "StrongPassword123"
|
||||
|
||||
allocated_storage: 20
|
||||
max_allocated_storage: 100
|
||||
|
||||
multi_az: false
|
||||
|
||||
publicly_accessible: false
|
||||
|
||||
subnet_ids:
|
||||
- "subnet-0996ad2f8e8f96445"
|
||||
- "subnet-0eaa450d1bb6f65be"
|
||||
|
||||
vpc_security_group_ids:
|
||||
- "sg-0ebfd69a09f87af4d"
|
||||
|
||||
parameters:
|
||||
- name: "log_min_duration_statement"
|
||||
value: "1000"
|
||||
- name: "log_statement"
|
||||
value: "ddl"
|
||||
|
||||
tags:
|
||||
Environment: "dev"
|
||||
Owner: "Platform"
|
||||
|
||||
@ -1,13 +0,0 @@
|
||||
name_prefix: "dev-redis"
|
||||
|
||||
engine_version: "7.0"
|
||||
node_type: "cache.t3.micro"
|
||||
num_cache_nodes: 1
|
||||
|
||||
subnet_ids:
|
||||
- "subnet-xxxxxx"
|
||||
- "subnet-yyyyyy"
|
||||
|
||||
security_group_ids:
|
||||
- "sg-xxxxxx"
|
||||
|
||||
@ -1,10 +0,0 @@
|
||||
bucket_name: "svc-plus-dev-objects"
|
||||
|
||||
# 是否开启版本管理（默认建议开启）
|
||||
enable_versioning: true
|
||||
|
||||
# 是否启用加密，之后如果你想加 KMS 可以扩展
|
||||
enable_encryption: false
|
||||
|
||||
# Public Access Block（通常建议保持 true）
|
||||
block_public_access: true
|
||||
@ -1,19 +0,0 @@
|
||||
name_prefix: "dev-vpc"
|
||||
|
||||
vpc_cidr: "10.0.0.0/16"
|
||||
|
||||
public_subnets:
|
||||
- cidr: "10.0.1.0/24"
|
||||
az: "ap-northeast-1a"
|
||||
name: "dev-public-1"
|
||||
- cidr: "10.0.2.0/24"
|
||||
az: "ap-northeast-1c"
|
||||
name: "dev-public-2"
|
||||
|
||||
private_subnets:
|
||||
- cidr: "10.0.11.0/24"
|
||||
az: "ap-northeast-1a"
|
||||
name: "dev-private-1"
|
||||
- cidr: "10.0.12.0/24"
|
||||
az: "ap-northeast-1c"
|
||||
name: "dev-private-2"
|
||||
@ -1,20 +0,0 @@
|
||||
project_id: xzerolab-480008
|
||||
environment: bootstrap
|
||||
|
||||
state:
|
||||
bucket_name: gcp-cloud-iac-state
|
||||
bucket_location: US
|
||||
firestore_location: us-central1
|
||||
|
||||
iam:
|
||||
deployer_identity: github-ci-runner # 对应 AWS 的 IAM User：github-ci-runner
|
||||
deploy_role_name: IacDeployRole # 对应 AWS 的 IAM Role：TerraformDeployRole
|
||||
|
||||
deploy_role_bindings:
|
||||
- roles/resourcemanager.projectIamAdmin
|
||||
- roles/storage.admin
|
||||
- roles/compute.admin
|
||||
|
||||
tags:
|
||||
Owner: Platform
|
||||
Project: CloudNeutral
|
||||
@ -1,13 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
region: "us-central1"
|
||||
|
||||
landingzone:
|
||||
enable_default_network_cleanup: true
|
||||
enable_oslogin_enforce: true
|
||||
enable_audit_logging: true
|
||||
enabled_services:
|
||||
- compute.googleapis.com
|
||||
- iam.googleapis.com
|
||||
- cloudresourcemanager.googleapis.com
|
||||
- logging.googleapis.com
|
||||
- servicemanagement.googleapis.com
|
||||
@ -1,18 +0,0 @@
|
||||
project_id: "xzerolab-480008"
|
||||
project_number: "123456789012"
|
||||
name: dev
|
||||
environment: dev
|
||||
|
||||
region: "us-central1"
|
||||
impersonate_service_account: "terraform-deployer@modern-app-dev.iam.gserviceaccount.com"
|
||||
logging_bucket: "org-dev-logs"
|
||||
shared_vpc_project: "modern-shared-vpc-dev"
|
||||
|
||||
labels:
|
||||
environment: dev
|
||||
owner: Platform
|
||||
costcenter: "DEV"
|
||||
Project: CloudNeutral
|
||||
|
||||
backend:
|
||||
bucket: gcp-cloud-iac-state
|
||||
@ -1,7 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
name: "dev-alb"
|
||||
bucket_name: "dev-alb-static-site"
|
||||
|
||||
backend:
|
||||
cache_enabled: true
|
||||
bucket_location: "US"
|
||||
@ -1,6 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
topic: "dev-orders"
|
||||
subscription: "dev-orders-sub"
|
||||
|
||||
message_retention_days: 7
|
||||
push_endpoint: "https://example.dev.internal/events"
|
||||
@ -1,7 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
name: "dev-nlb"
|
||||
network: "projects/modern-app-dev/global/networks/dev-vpc"
|
||||
subnet: "projects/modern-app-dev/regions/us-central1/subnetworks/dev-public-1"
|
||||
|
||||
port: 443
|
||||
zone: "us-central1-a"
|
||||
@ -1,7 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
name: "dev-app-artifacts"
|
||||
location: "US"
|
||||
storage_class: "STANDARD"
|
||||
|
||||
versioning: true
|
||||
retention_days: 30
|
||||
@ -1,9 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
name: "dev-orders-db"
|
||||
database_version: "POSTGRES_15"
|
||||
tier: "db-g1-small"
|
||||
region: "us-central1"
|
||||
|
||||
backup_configuration:
|
||||
enabled: true
|
||||
point_in_time_recovery: true
|
||||
@ -1,9 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
name: "dev-cache"
|
||||
region: "us-central1"
|
||||
tier: "STANDARD_HA"
|
||||
memory_size_gb: 2
|
||||
|
||||
persistence_config:
|
||||
mode: "RDB"
|
||||
rdb_snapshot_period: "SIX_HOURS"
|
||||
@ -1,35 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
name_prefix: "dev-compute"
|
||||
zone: "us-central1-a"
|
||||
machine_type: "e2-medium"
|
||||
image: "ubuntu-2204-lts"
|
||||
|
||||
network_self_link: "projects/modern-app-dev/global/networks/dev-vpc"
|
||||
subnet_self_link: "projects/modern-app-dev/regions/us-central1/subnetworks/dev-private-1"
|
||||
|
||||
metadata:
|
||||
ssh_keys:
|
||||
- "devops:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCquf7APpVdazv1xC5loENKQyWrOOI+yeP13jsMoPTFr/7A1za2cdHVv75D4f0ZePuvxi+3S4Nf5eCn5xsnzuvnvV3rxJ7bC3SbgsVA4STpdkElWJxz/TcgE7kMWSyGfNa5+07Ljjq2+g7fqFfEGP7x3+NFuTIvdy7OOhHPK29m8OIgHtO+X7NWDzSIe4lmxOfo9hQLU5qkWWmY+FXuDLO06mu5a1ruSlG4/lKQ77lr6E5k6I7dpFIlzPzCYcLOQDZ80GLk6e2ukgIFzOxplnnmnIBm9saKzNhxZ9V0sbOYu4lWuxpkzrQJBSyiR7+A8mE4xboz85vPX5dHRXc5bBLF6oVT/GH1+8eMqNygwdqbSKBzR5V1Z1LvJfHpJQmmH8T0U/ax7Rz1tfJbdSWJ9sFvVOuNKs1oo0WM6E/j1MMmwzZg1JYwl6GDaFpyUp92wjSyFcJTNfn1Fx5t8o0HpcQNVdLMeOHlqlPRkYfED1x4hlEZJu0fD/8IvcaUsdluyMFSxhE= devops@example.com"
|
||||
|
||||
boot_disk_gb: 30
|
||||
tags:
|
||||
- dev-ssh
|
||||
- dev-web
|
||||
|
||||
firewall_rules:
|
||||
- name: "dev-ssh"
|
||||
direction: ingress
|
||||
ranges:
|
||||
- "0.0.0.0/0"
|
||||
protocols:
|
||||
tcp: [22]
|
||||
target_tags:
|
||||
- dev-ssh
|
||||
- name: "dev-web"
|
||||
direction: ingress
|
||||
ranges:
|
||||
- "0.0.0.0/0"
|
||||
protocols:
|
||||
tcp: [80, 443]
|
||||
target_tags:
|
||||
- dev-web
|
||||
@ -1,14 +0,0 @@
|
||||
project_id: "modern-app-dev"
|
||||
network_name: "dev-vpc"
|
||||
|
||||
subnets:
|
||||
- name: "dev-public-1"
|
||||
ip_cidr_range: "10.0.1.0/24"
|
||||
region: "us-central1"
|
||||
- name: "dev-private-1"
|
||||
ip_cidr_range: "10.0.11.0/24"
|
||||
region: "us-central1"
|
||||
|
||||
firewall_tags:
|
||||
ssh: "dev-ssh"
|
||||
web: "dev-web"
|
||||
@ -10,6 +10,6 @@ spec:
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: platform-config
|
||||
path: ./apps/core/accounts/pre
|
||||
path: ./services/accounts/pre
|
||||
dependsOn:
|
||||
- name: stunnel-client-pre
|
||||
@ -10,6 +10,6 @@ spec:
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: platform-config
|
||||
path: ./apps/core/console/pre
|
||||
path: ./services/console/pre
|
||||
dependsOn:
|
||||
- name: accounts-pre
|
||||
@ -10,6 +10,6 @@ spec:
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: platform-config
|
||||
path: ./apps/core/accounts/prod
|
||||
path: ./services/accounts/prod
|
||||
dependsOn:
|
||||
- name: stunnel-client-prod
|
||||
@ -10,6 +10,6 @@ spec:
|
||||
sourceRef:
|
||||
kind: GitRepository
|
||||
name: platform-config
|
||||
path: ./apps/core/console/prod
|
||||
path: ./services/console/prod
|
||||
dependsOn:
|
||||
- name: accounts-prod
|
||||
@ -8,6 +8,5 @@ resources:
|
||||
- console-prod-kustomization.yaml
|
||||
- accounts-prod-kustomization.yaml
|
||||
- observability-kustomization.yaml
|
||||
- pre-kustomization.yaml
|
||||
|
||||
# Sync marker for Flux reconciliation on jp-k3s-vultr.svc.plus.
|
||||
@ -21,4 +21,3 @@ spec:
|
||||
name: accounts
|
||||
port:
|
||||
number: 80
|
||||
|
||||
@ -21,4 +21,3 @@ spec:
|
||||
name: accounts
|
||||
port:
|
||||
number: 80
|
||||
|
||||
@ -21,4 +21,3 @@ spec:
|
||||
name: console
|
||||
port:
|
||||
number: 80
|
||||
|
||||
@ -21,4 +21,3 @@ spec:
|
||||
name: console
|
||||
port:
|
||||
number: 80
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user