more filesHEADmaster

10 files changed, 723 insertions, 0 deletions

diff --git a/src/orchestration/cluster-setup-files/application-ldap.yaml b/src/orchestration/cluster-setup-files/application-ldap.yaml
new file mode 100644
index 0000000..2155f3a
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/application-ldap.yaml
@@ -0,0 +1,69 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: application-svc-edge-eng 
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit 
+subjects:
+  - kind: User 
+    name: SVC-Edge-Eng 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{crd_cluster_role}}-for-app-team 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{crd_cluster_role}}-application 
+subjects:
+  - kind: User 
+    name: SVC-Edge-Eng 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{crd_cluster_role}}-application 
+rules:
+  - apiGroups: ["{{crd_api_group}}"]
+    resources: ["{{crd_api_resources}}"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: crd-rb-app
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-view 
+subjects:
+  - kind: User 
+    name: SVC-Edge-Eng 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vdu-upgrade-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: ["", "apps"]
+    resources: ["configmaps", "services", "secrets", "persistentvolumeclaims", "deployments"]
+    verbs: ["get","list","watch","delete","update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vdu-upgrade-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vdu-upgrade-role
+subjects:
+  - kind: User 
+    name: SVC-Edge-Eng
+---
diff --git a/src/orchestration/cluster-setup-files/application-sa.yaml b/src/orchestration/cluster-setup-files/application-sa.yaml
new file mode 100644
index 0000000..9d87a80
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/application-sa.yaml
@@ -0,0 +1,79 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{application_sa}}
+  namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{application_sa}}-rb 
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit 
+subjects:
+  - kind: ServiceAccount
+    name: {{application_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{crd_cluster_role}}-for-app-team 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ crd_cluster_role }}-application 
+subjects:
+  - kind: ServiceAccount
+    name: {{application_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ crd_cluster_role }}-application 
+rules:
+  - apiGroups: ["{{ crd_api_group }}"]
+    resources: ["{{ crd_api_resources }}"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: crd-rb-app
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-view 
+subjects:
+  - kind: ServiceAccount
+    name: {{ application_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vdu-upgrade-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: ["", "apps"]
+    resources: ["configmaps", "services", "secrets", "persistentvolumeclaims", "deployments"]
+    verbs: ["get","list","watch","delete","update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vdu-upgrade-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vdu-upgrade-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ application_sa }}
+    namespace: default 
+---
diff --git a/src/orchestration/cluster-setup-files/crd-role.yaml b/src/orchestration/cluster-setup-files/crd-role.yaml
new file mode 100644
index 0000000..b500e6d
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/crd-role.yaml
@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ crd_cluster_role }}  
+rules:
+  - apiGroups: ["{{ crd_api_group }}"]
+    resources: ["{{ crd_api_resources }}"]
+    verbs: ["{{ crd_api_verbs }}"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: crd-view
+rules:
+  - apiGroups: ["apiextensions.k8s.io"]
+    resources: ["crds","customresourcedefinitions"]
+    verbs: ["*"]
+---
diff --git a/src/orchestration/cluster-setup-files/helm.yaml b/src/orchestration/cluster-setup-files/helm.yaml
new file mode 100644
index 0000000..f0ec72c
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/helm.yaml
@@ -0,0 +1,75 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app: helm
+    name: tiller
+  name: tiller-deploy
+  namespace: {{ namespace }}  
+spec:
+  replicas: 1
+  selector: {"matchLabels": {"app": "helm", "name": "tiller"}}
+  strategy: {}
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: helm
+        name: tiller
+    spec:
+      automountServiceAccountToken: true
+      containers:
+      - env:
+        - name: TILLER_NAMESPACE
+          value: {{ namespace }}  
+        - name: TILLER_HISTORY_MAX
+          value: "0"
+        image: registry.local:9001/gcr.io/kubernetes-helm/tiller:v2.13.1
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /liveness
+            port: 44135
+          initialDelaySeconds: 1
+          timeoutSeconds: 1
+        name: tiller
+        ports:
+        - containerPort: 44134
+          name: tiller
+        - containerPort: 44135
+          name: http
+        readinessProbe:
+          httpGet:
+            path: /readiness
+            port: 44135
+          initialDelaySeconds: 1
+          timeoutSeconds: 1
+        resources: {}
+      serviceAccountName: vdu-tiller
+status: {}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  creationTimestamp: null
+  labels:
+    app: helm
+    name: tiller
+  name: tiller-deploy
+  namespace: {{ namespace }} 
+spec:
+  ports:
+  - name: tiller
+    port: 44134
+    targetPort: tiller
+  selector:
+    app: helm
+    name: tiller
+  type: ClusterIP
+status:
+  loadBalancer: {}
+
+...
diff --git a/src/orchestration/cluster-setup-files/orchestration-ldap.yaml b/src/orchestration/cluster-setup-files/orchestration-ldap.yaml
new file mode 100644
index 0000000..ee03ba3
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/orchestration-ldap.yaml
@@ -0,0 +1,166 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: orchestration-user-crb 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view 
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: orchestration-user-rb 
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit 
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{crd_cluster_role}}-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ crd_cluster_role }} 
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: configmap-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: configmap-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: configmap-role
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: service-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: service-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: service-role
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: deployment-role 
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: deployment-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: deployment-role
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: secret-role
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pvc-role 
+  namespace: {{ namespace }} 
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pvc-rb 
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pvc 
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: crd-rb-orch 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-view 
+subjects:
+  - kind: User 
+    name: SVC-FE-Atlas 
+---
+
diff --git a/src/orchestration/cluster-setup-files/orchestration-sa.yaml b/src/orchestration/cluster-setup-files/orchestration-sa.yaml
new file mode 100644
index 0000000..5531431
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/orchestration-sa.yaml
@@ -0,0 +1,181 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{orchestration_sa}}
+  namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{orchestration_sa}}-crb 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: view 
+subjects:
+  - kind: ServiceAccount
+    name: {{orchestration_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{orchestration_sa}}-rb 
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit 
+subjects:
+  - kind: ServiceAccount
+    name: {{orchestration_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{crd_cluster_role}}-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ crd_cluster_role }} 
+subjects:
+  - kind: ServiceAccount
+    name: {{orchestration_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: configmap-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: configmap-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: configmap-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: service-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: service-rb
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: service-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: deployment-role 
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: deployment-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: deployment-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-role
+  namespace: {{ namespace }}
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: secret-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: secret-role
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pvc-role 
+  namespace: {{ namespace }} 
+rules:
+  - apiGroups: [""]
+    resources: ["persistentvolumeclaims"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pvc-rb 
+  namespace: {{ namespace }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pvc 
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: crd-rb-orch 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-view 
+subjects:
+  - kind: ServiceAccount
+    name: {{ orchestration_sa }}
+    namespace: default 
+---
+
diff --git a/src/orchestration/cluster-setup-files/rbd.yaml b/src/orchestration/cluster-setup-files/rbd.yaml
new file mode 100644
index 0000000..45d497b
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/rbd.yaml
@@ -0,0 +1,9 @@
+classes:
+- additionalNamespaces: [default, kube-public, {{ namespace }} ]
+  chunk_size: 64
+  crush_rule_name: storage_tier_ruleset
+  name: general
+  pool_name: kube-rbdkube-system
+  replication: 1
+  userId: ceph-pool-kube-rbd
+  userSecretName: ceph-pool-kube-rbd
diff --git a/src/orchestration/cluster-setup-files/samsung-sa.yaml b/src/orchestration/cluster-setup-files/samsung-sa.yaml
new file mode 100644
index 0000000..2525e8b
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/samsung-sa.yaml
@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{application_sa}}
+  namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{application_sa}}-rb 
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit 
+subjects:
+  - kind: ServiceAccount
+    name: {{application_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{crd_cluster_role}}-for-app-team 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ crd_cluster_role }}-application 
+subjects:
+  - kind: ServiceAccount
+    name: {{application_sa}} 
+    namespace: default 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ crd_cluster_role }}-application 
+rules:
+  - apiGroups: ["{{ crd_api_group }}"]
+    resources: ["{{ crd_api_resources }}"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: crd-rb-app
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: crd-view 
+subjects:
+  - kind: ServiceAccount
+    name: {{ application_sa }}
+    namespace: default 
+---
diff --git a/src/orchestration/cluster-setup-files/tiller-sa.yaml b/src/orchestration/cluster-setup-files/tiller-sa.yaml
new file mode 100644
index 0000000..62cc860
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/tiller-sa.yaml
@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vdu-tiller
+  namespace: {{ namespace }} 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vdu-tiller-role
+  namespace: {{ namespace }} 
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vdu-tiller-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vdu-tiller-role
+subjects:
+  - kind: ServiceAccount
+    name: vdu-tiller
+    namespace: {{ namespace }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vdu-tiller-cluster-crd-crb
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{crd_cluster_role}} 
+subjects:
+  - kind: ServiceAccount
+    name: vdu-tiller
+    namespace: {{ namespace }} 
diff --git a/src/orchestration/cluster-setup-files/vdu_tiller_sa.yaml b/src/orchestration/cluster-setup-files/vdu_tiller_sa.yaml
new file mode 100644
index 0000000..3644856
--- /dev/null
+++ b/src/orchestration/cluster-setup-files/vdu_tiller_sa.yaml
@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: vdu-tiller
+  namespace: {{ namespace }} 
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vdu-tiller-role
+  namespace: {{ namespace }} 
+rules:
+  - apiGroups: ["*"]
+    resources: ["*"]
+    verbs: ["*"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vdu-tiller-rb
+  namespace: {{ namespace }} 
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vdu-tiller-role
+subjects:
+  - kind: ServiceAccount
+    name: vdu-tiller
+    namespace: {{ namespace }}