k-space.ee infrastructure

Kubernetes manifests, Ansible playbooks, and documentation for K-SPACE services.

Supporting services

Build Git repositories with Woodpecker.
Passmower: Authz with kind: OIDCMiddlewareClient (or kind: OIDCClient¹).
Traefik²: Expose services with kind: Service + kind: Ingress (TLS and DNS included).

bind: Manage additional DNS records with kind: DNSEndpoint.
Prometheus: Collect metrics with kind: PodMonitor (alerts with kind: PrometheusRule).
Slack bots and Kubernetes CLUSTER.md itself.

KeyDB: kind: KeydbClaim (replaces Redis³)
Dragonfly: kind: Dragonfly (replaces Redis³)
Longhorn: storageClassName: longhorn (filesystem storage)
Mongo⁴: kind: MongoDBCommunity (NAS* inventory-mongodb)
Minio S3: kind: MinioBucketClaim with class: dedicated (NAS*: class: external)
MariaDB*: search for mysql, mariadb⁵ (replaces MySQL)
Postgres*: hardcoded to harbor/application.yml

* External, hosted directly on nas.k-space.ee

This page is referenced by wiki front page as the technical documentation for infra.

Applications should use OpenID Connect (kind: OIDCClient) for authentication, whereever possible. If not possible, use kind: OIDCMiddlewareClient client, which will provide authentication via a Traefik middleware (traefik.ingress.kubernetes.io/router.middlewares: passmower-proxmox@kubernetescrd). Sometimes you might use both for extra security. ↩︎
No nginx annotations! Use kind: Ingress instead. IngressRoute is not used as it doesn't support external-dns out of the box. ↩︎
Redis has been replaced as redis-operatori couldn't handle itself: didn't reconcile after reboots, master URI was empty, and clients complained about missing masters. ArgoCD still hosts its own Redis. ↩︎
Mongo problems: Incompatible with rawfile csi (wiredtiger.wt corrupts), complicated resizing (PVCs from statefulset PVC template). ↩︎
As of 2024-07-30 used by auth, authelia, bitwarden, etherpad, freescout, git, grafana, nextcloud, wiki, woodpecker ↩︎