ansible | ||
argocd | ||
asterisk | ||
bind | ||
camtiler | ||
cert-manager | ||
cnpg-system | ||
dragonfly-operator-system | ||
elastic-system | ||
etherpad | ||
freescout | ||
gitea | ||
grafana | ||
hackerspace | ||
harbor | ||
kube-system | ||
kubernetes-dashboard | ||
local-path-storage | ||
logging | ||
logmower | ||
longhorn-system | ||
member-site | ||
metallb-system | ||
minio-clusters | ||
mongodb-operator | ||
monitoring | ||
mysql-clusters | ||
nextcloud | ||
nyancat | ||
oidc-gateway | ||
openebs | ||
opensearch-operator | ||
passmower | ||
playground | ||
postgres-clusters | ||
prometheus-operator | ||
redis-clusters | ||
reloader | ||
ripe87 | ||
rosdump | ||
shared | ||
signs | ||
tigera-operator | ||
traefik | ||
whoami-oidc | ||
wiki | ||
wildduck | ||
woodpecker | ||
.drone.yml | ||
.gitignore | ||
ansible.cfg | ||
cluster-role-bindings.yml | ||
CLUSTER.md | ||
CONTRIBUTORS.md | ||
known_hosts | ||
kube-apiserver.j2 | ||
LICENSE.md | ||
README.md | ||
SLACK.md | ||
storage-class.yaml |
k-space.ee infrastructure
Kubernetes manifests, Ansible playbooks, and documentation for K-SPACE services.
- Repo is deployed with ArgoCD. For
kubectl
access, see CLUSTER.md. - Debugging Kubernetes on Wiki
- Need help? →
#kube
Jump to docs: inventory-app / cameras / doors / list of apps // all infra / network / retro / non-infra
Supporting services
- Build Git repositories with Woodpecker.
- Passmower: Authz with
kind: OIDCMiddlewareClient
(orkind: OIDCClient
1). - Traefik2: Expose services with
kind: Service
+kind: Ingress
(TLS and DNS included).
Additional
- bind: Manage additional DNS records with
kind: DNSEndpoint
. - Prometheus: Collect metrics with
kind: PodMonitor
(alerts withkind: PrometheusRule
). - Slack bots and Kubernetes CLUSTER.md itself.
Databases / -stores:
- KeyDB:
kind: KeydbClaim
(replaces Redis3) - Dragonfly:
kind: Dragonfly
(replaces Redis3) - Longhorn:
storageClassName: longhorn
(filesystem storage) - Mongo4:
kind: MongoDBCommunity
(NAS*inventory-mongodb
) - Minio S3:
kind: MinioBucketClaim
withclass: dedicated
(NAS*:class: external
) - MariaDB*: search for
mysql
,mariadb
5 (replaces MySQL) - Postgres*: hardcoded to harbor/application.yml
* External, hosted directly on nas.k-space.ee
This page is referenced by wiki front page as the technical documentation for infra.
-
Applications should use OpenID Connect (
kind: OIDCClient
) for authentication, whereever possible. If not possible, usekind: OIDCMiddlewareClient
client, which will provide authentication via a Traefik middleware (traefik.ingress.kubernetes.io/router.middlewares: passmower-proxmox@kubernetescrd
). Sometimes you might use both for extra security. ↩︎ -
No nginx annotations! Use
kind: Ingress
instead.IngressRoute
is not used as it doesn't supportexternal-dns
out of the box. ↩︎ -
Redis has been replaced as redis-operatori couldn't handle itself: didn't reconcile after reboots, master URI was empty, and clients complained about missing masters. ArgoCD still hosts its own Redis. ↩︎
-
Mongo problems: Incompatible with rawfile csi (wiredtiger.wt corrupts), complicated resizing (PVCs from statefulset PVC template). ↩︎
-
As of 2024-07-30 used by auth, authelia, bitwarden, etherpad, freescout, git, grafana, nextcloud, wiki, woodpecker ↩︎