Merge pull request #344 from 3dwardch3ng/infra/prometheus

use recreate strategy for prometheus

kubernetes/apps/adguard-home/adguard-home.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/adguard-home/app
   prune: true
   sourceRef:

kubernetes/apps/capacitor/capacitor.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/capacitor/app
   prune: true
   sourceRef:

kubernetes/apps/code-server/code-server.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: code-server-secrets
-  namespace: code-server
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: code-server-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -40,7 +40,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: code-server-secrets
-      namespace: code-server
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/dokuwiki/dokuwiki.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: dokuwiki-secrets
-  namespace: dokuwiki
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: dokuwiki-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: dokuwiki-secrets
-      namespace: dokuwiki
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/gitea/gitea.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: gitea-secrets
-  namespace: gitea
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: gitea-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: gitea-secrets
-      namespace: gitea
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/homer/homer.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/homer/app
   prune: true
   sourceRef:

kubernetes/apps/kavita/app/development.yaml

@@ -20,7 +20,7 @@ spec:
         app.kubernetes.io/instance: kavita
     spec:
       containers:
-        - image: jvmilazz0/kavita:latest
+        - image: jvmilazz0/kavita:0.8.1
           imagePullPolicy: IfNotPresent
           name: kavita
           ports:

kubernetes/apps/kustomization.yaml

@@ -3,7 +3,6 @@ kind: Kustomization
 resources:
   - ./adguard-home/adguard-home.yaml
   - ./capacitor/capacitor.yaml
-  - ./cert-manager/cert-manager.yaml
   - ./code-server/code-server.yaml
   - ./dokuwiki/dokuwiki.yaml
   - ./gitea/gitea.yaml
@@ -12,7 +11,6 @@ resources:
   - ./kavita/kavita.yaml
   - ./nexus/nexus.yaml
   - ./podinfo/podinfo.yaml
-  - ./postgresql/postgresql.yaml
   - ./qbittorrent/qbittorrent.yaml
   - ./redis/redis.yaml
   - ./snippet-box/snippet-box.yaml

kubernetes/apps/nexus/app/deployment.yaml

@@ -22,7 +22,7 @@ spec:
           resources:
             limits:
               memory: "3Gi"
-              cpu: "500m"
+              cpu: "1"
             requests:
               memory: "2Gi"
               cpu: "500m"

kubernetes/apps/redis/redis.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: redis-secrets
-  namespace: redis
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: redis-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: redis-secrets
-      namespace: redis
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/snippet-box/snippet-box.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/snippet-box/app
   prune: true
   sourceRef:

kubernetes/apps/sonarqube/sonarqube.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: sonarqube-secrets
-  namespace: sonarqube
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -20,7 +20,7 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sonarqube-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -39,7 +39,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: sonarqube-secrets
-      namespace: sonarqube
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/apps/uptime-kuma/app/release.yaml

@@ -9,6 +9,7 @@ spec:
   chart:
     spec:
       chart: uptime-kuma
+      version: 2.18.1
       sourceRef:
         kind: HelmRepository
         name: irsigler

kubernetes/apps/weave-gitops/weave-gitops.yaml

@@ -7,7 +7,6 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  targetNamespace: flux-system
   path: ./kubernetes/apps/weave-gitops/app
   prune: true
   sourceRef:

kubernetes/infrastructure/cert-manager/cert-manager.yaml

@@ -8,18 +8,21 @@ spec:
   timeout: 1m30s
   retryInterval: 30s
   targetNamespace: cert-manager
-  path: ./kubernetes/apps/cert-manager/app
+  path: ./kubernetes/infrastructure/cert-manager/app
   prune: true
   sourceRef:
     kind: GitRepository
     namespace: flux-system
     name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: clusterissuer-secrets
-  namespace: cert-manager
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -32,12 +35,14 @@ spec:
     namespace: flux-system
     name: home-cluster-ops-secrets
   dependsOn:
+    - name: namespaces
+      namespace: flux-system
     - name: repositories
       namespace: flux-system
   decryption:
     provider: sops
     secretRef:
-      name: cert-manager-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -49,7 +54,7 @@ spec:
   timeout: 1m30s
   retryInterval: 30s
   targetNamespace: cert-manager
-  path: ./kubernetes/apps/cert-manager/clusterissuer
+  path: ./kubernetes/infrastructure/cert-manager/clusterissuer
   prune: true
   sourceRef:
     kind: GitRepository
@@ -57,7 +62,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: clusterissuer-secrets
-      namespace: cert-manager
+      namespace: flux-system
     - name: cert-manager
       namespace: cert-manager
   postBuild:
@@ -69,7 +74,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: certificate-secrets
-  namespace: cert-manager
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -82,12 +87,14 @@ spec:
     namespace: flux-system
     name: home-cluster-ops-secrets
   dependsOn:
+    - name: namespaces
+      namespace: flux-system
     - name: repositories
       namespace: flux-system
   decryption:
     provider: sops
     secretRef:
-      name: cert-manager-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -99,7 +106,7 @@ spec:
   timeout: 1m30s
   retryInterval: 30s
   targetNamespace: cert-manager
-  path: ./kubernetes/apps/cert-manager/certificates
+  path: ./kubernetes/infrastructure/cert-manager/certificates
   prune: true
   sourceRef:
     kind: GitRepository
@@ -107,7 +114,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: certificate-secrets
-      namespace: cert-manager
+      namespace: flux-system
     - name: cert-manager
       namespace: cert-manager
     - name: clusterissuer

kubernetes/infrastructure/kustomization.yaml

@@ -1,8 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./namespaces/namespaces.yaml
-  - ./repositories/repositories.yaml
-#  - ./cilium/cilium.yaml
-  - ./ingress-nginx/ingress-nginx-config.yaml
+  - ./cert-manager/cert-manager.yaml
+  #  - ./cilium/cilium.yaml
+  - ./minio/minio.yaml
   - ./ingress-nginx/ingress-nginx.yaml
+  - ./ingress-nginx/ingress-nginx-config.yaml
+  - ./namespaces/namespaces.yaml
+  - ./postgresql/postgresql.yaml
+  - ./prometheus/prometheus.yaml
+  - ./repositories/repositories.yaml

kubernetes/infrastructure/minio/app/ingress.yaml

@@ -0,0 +1,51 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio-ingress
+  namespace: minio
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "minio.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19001
+    - host: "api.minio.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19000
+    - host: "minio.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19001
+    - host: "api.minio.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: minio
+                port:
+                  number: 19000

kubernetes/infrastructure/minio/app/release.yaml

@@ -0,0 +1,31 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: minio
+  namespace: minio
+spec:
+  releaseName: minio
+  chart:
+    spec:
+      chart: minio
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  interval: 1h
+  install:
+    remediation:
+      retries: 3
+  values:
+    clusterDomain: minio.cluster.edward.sydney
+    auth:
+      rootUser: ${root_user}
+      rootPassword: ${root_password}
+    nodeSelector:
+      kubernetes.io/hostname: rpi5-cluster-node-3
+    service:
+      ports:
+        api: 19000
+        console: 19001
+    persistence:
+      existingClaim: "minio-pvc"

kubernetes/infrastructure/minio/app/volume.yaml

@@ -0,0 +1,46 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: minio-pv
+  namespace: minio
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 256Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/minio"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: minio-pvc
+    namespace: minio
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/hostname
+              operator: In
+              values:
+                - rpi5-cluster-node-3
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: minio-pvc
+  namespace: minio
+  labels:
+    name: minio-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 256Gi

kubernetes/infrastructure/minio/minio.yaml

@@ -0,0 +1,48 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: minio-secrets
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  targetNamespace: minio
+  path: ./minio
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: home-cluster-ops-secrets
+  dependsOn:
+    - name: repositories
+      namespace: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: minio
+  namespace: minio
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/minio/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system
+    - name: minio-secrets
+      namespace: flux-system
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: minio-secrets

kubernetes/infrastructure/namespaces/namespaces/minio.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: minio

kubernetes/infrastructure/namespaces/namespaces/prometheus.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: prometheus

kubernetes/infrastructure/postgresql/postgresql.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: postgresql-secrets
-  namespace: postgresql
+  namespace: flux-system
 spec:
   interval: 10m
   timeout: 1m30s
@@ -15,12 +15,14 @@ spec:
     namespace: flux-system
     name: home-cluster-ops-secrets
   dependsOn:
+    - name: namespaces
+      namespace: flux-system
     - name: repositories
       namespace: flux-system
   decryption:
     provider: sops
     secretRef:
-      name: postgresql-sops-age
+      name: sops-age
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
@@ -31,7 +33,7 @@ spec:
   interval: 10m
   timeout: 1m30s
   retryInterval: 30s
-  path: ./kubernetes/apps/postgresql/app
+  path: ./kubernetes/infrastructure/postgresql/app
   prune: true
   sourceRef:
     kind: GitRepository
@@ -39,7 +41,7 @@ spec:
     name: flux-system
   dependsOn:
     - name: postgresql-secrets
-      namespace: postgresql
+      namespace: flux-system
   postBuild:
     substituteFrom:
       - kind: Secret

kubernetes/infrastructure/prometheus/app/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: prometheus
+  namespace: prometheus
+  labels:
+    app: prometheus
+spec:
+  strategy:
+    rollingUpdate: null
+    type: Recreate
+  selector:
+    matchLabels:
+      app: prometheus
+  template:
+    metadata:
+      labels:
+        app: prometheus
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: prometheus
+          image: prom/prometheus:v2.53.0
+          args:
+            - "--storage.tsdb.retention.time=12h"
+            - "--config.file=/etc/prometheus/prometheus.yaml"
+            - "--storage.tsdb.path=/prometheus/"
+          ports:
+            - containerPort: 9090
+          resources:
+            requests:
+              cpu: 500m
+              memory: 500M
+            limits:
+              cpu: "1"
+              memory: 2Gi
+          volumeMounts:
+            - name: prometheus-config-volume
+              mountPath: /etc/prometheus/
+            - name: prometheus-storage-volume
+              mountPath: /prometheus/
+      volumes:
+        - name: prometheus-config-volume
+          hostPath:
+            path: /mnt/nfs/AppData/prometheus/conf
+            type: Directory
+        - name: prometheus-storage-volume
+          hostPath:
+            path: /mnt/nfs/AppData/prometheus/storage
+            type: Directory

kubernetes/infrastructure/prometheus/app/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: prometheus-ingress
+  namespace: prometheus
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "prometheus.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: prometheus
+                port:
+                  number: 9999
+    - host: "prometheus.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: prometheus
+                port:
+                  number: 9999

kubernetes/infrastructure/prometheus/app/role.yaml

@@ -0,0 +1,33 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: prometheus
+rules:
+  - apiGroups: [""]
+    resources:
+      - nodes
+      - nodes/proxy
+      - services
+      - endpoints
+      - pods
+    verbs: ["get", "list", "watch"]
+  - apiGroups:
+      - extensions
+    resources:
+      - ingresses
+    verbs: ["get", "list", "watch"]
+  - nonResourceURLs: ["/metrics"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus
+subjects:
+  - kind: ServiceAccount
+    name: prometheus
+    namespace: prometheus

kubernetes/infrastructure/prometheus/app/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: prometheus
+  namespace: prometheus
+  annotations:
+    prometheus.io/scrape: 'true'
+    prometheus.io/port:   '9999'
+spec:
+  selector:
+    app: prometheus
+  type: ClusterIP
+  ports:
+    - port: 9999
+      targetPort: 9090
+      protocol: TCP
+      name: http

kubernetes/infrastructure/prometheus/prometheus.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: prometheus
+  namespace: prometheus
+spec:
+  interval: 10m
+  timeout: 1m30s
+  retryInterval: 30s
+  path: ./kubernetes/infrastructure/prometheus/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    namespace: flux-system
+    name: flux-system
+  dependsOn:
+    - name: namespaces
+      namespace: flux-system

kubernetes/infrastructure/repositories/repos/bjw-s.yaml

@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: bjw-s
-  namespace: flux-system
-spec:
-  interval: 6h
-  type: oci
-  url: oci://ghcr.io/bjw-s/helm

kubernetes/infrastructure/repositories/repos/external-dns.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: external-dns
-  namespace: flux-system
-spec:
-  interval: 6h
-  url: https://kubernetes-sigs.github.io/external-dns/

kubernetes/infrastructure/repositories/repos/gabe565.yaml

@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gabe565
-  namespace: flux-system
-spec:
-  interval: 6h
-  type: oci
-  url: oci://ghcr.io/gabe565/charts