diff options
Diffstat (limited to 'src/orchestration/cluster-setup-files')
10 files changed, 723 insertions, 0 deletions
diff --git a/src/orchestration/cluster-setup-files/application-ldap.yaml b/src/orchestration/cluster-setup-files/application-ldap.yaml new file mode 100644 index 0000000..2155f3a --- /dev/null +++ b/src/orchestration/cluster-setup-files/application-ldap.yaml @@ -0,0 +1,69 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: application-svc-edge-eng + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: + - kind: User + name: SVC-Edge-Eng +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{crd_cluster_role}}-for-app-team +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{crd_cluster_role}}-application +subjects: + - kind: User + name: SVC-Edge-Eng +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{crd_cluster_role}}-application +rules: + - apiGroups: ["{{crd_api_group}}"] + resources: ["{{crd_api_resources}}"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crd-rb-app +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-view +subjects: + - kind: User + name: SVC-Edge-Eng +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: vdu-upgrade-role + namespace: {{ namespace }} +rules: + - apiGroups: ["", "apps"] + resources: ["configmaps", "services", "secrets", "persistentvolumeclaims", "deployments"] + verbs: ["get","list","watch","delete","update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: vdu-upgrade-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: vdu-upgrade-role +subjects: + - kind: User + name: SVC-Edge-Eng +--- diff --git a/src/orchestration/cluster-setup-files/application-sa.yaml b/src/orchestration/cluster-setup-files/application-sa.yaml new file mode 100644 index 0000000..9d87a80 --- /dev/null +++ b/src/orchestration/cluster-setup-files/application-sa.yaml @@ -0,0 +1,79 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{application_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{application_sa}}-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: + - kind: ServiceAccount + name: {{application_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{crd_cluster_role}}-for-app-team +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ crd_cluster_role }}-application +subjects: + - kind: ServiceAccount + name: {{application_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ crd_cluster_role }}-application +rules: + - apiGroups: ["{{ crd_api_group }}"] + resources: ["{{ crd_api_resources }}"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crd-rb-app +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-view +subjects: + - kind: ServiceAccount + name: {{ application_sa }} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: vdu-upgrade-role + namespace: {{ namespace }} +rules: + - apiGroups: ["", "apps"] + resources: ["configmaps", "services", "secrets", "persistentvolumeclaims", "deployments"] + verbs: ["get","list","watch","delete","update"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: vdu-upgrade-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: vdu-upgrade-role +subjects: + - kind: ServiceAccount + name: {{ application_sa }} + namespace: default +--- diff --git a/src/orchestration/cluster-setup-files/crd-role.yaml b/src/orchestration/cluster-setup-files/crd-role.yaml new file mode 100644 index 0000000..b500e6d --- /dev/null +++ b/src/orchestration/cluster-setup-files/crd-role.yaml @@ -0,0 +1,18 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ crd_cluster_role }} +rules: + - apiGroups: ["{{ crd_api_group }}"] + resources: ["{{ crd_api_resources }}"] + verbs: ["{{ crd_api_verbs }}"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: crd-view +rules: + - apiGroups: ["apiextensions.k8s.io"] + resources: ["crds","customresourcedefinitions"] + verbs: ["*"] +--- diff --git a/src/orchestration/cluster-setup-files/helm.yaml b/src/orchestration/cluster-setup-files/helm.yaml new file mode 100644 index 0000000..f0ec72c --- /dev/null +++ b/src/orchestration/cluster-setup-files/helm.yaml @@ -0,0 +1,75 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + creationTimestamp: null + labels: + app: helm + name: tiller + name: tiller-deploy + namespace: {{ namespace }} +spec: + replicas: 1 + selector: {"matchLabels": {"app": "helm", "name": "tiller"}} + strategy: {} + template: + metadata: + creationTimestamp: null + labels: + app: helm + name: tiller + spec: + automountServiceAccountToken: true + containers: + - env: + - name: TILLER_NAMESPACE + value: {{ namespace }} + - name: TILLER_HISTORY_MAX + value: "0" + image: registry.local:9001/gcr.io/kubernetes-helm/tiller:v2.13.1 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /liveness + port: 44135 + initialDelaySeconds: 1 + timeoutSeconds: 1 + name: tiller + ports: + - containerPort: 44134 + name: tiller + - containerPort: 44135 + name: http + readinessProbe: + httpGet: + path: /readiness + port: 44135 + initialDelaySeconds: 1 + timeoutSeconds: 1 + resources: {} + serviceAccountName: vdu-tiller +status: {} + +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: null + labels: + app: helm + name: tiller + name: tiller-deploy + namespace: {{ namespace }} +spec: + ports: + - name: tiller + port: 44134 + targetPort: tiller + selector: + app: helm + name: tiller + type: ClusterIP +status: + loadBalancer: {} + +... diff --git a/src/orchestration/cluster-setup-files/orchestration-ldap.yaml b/src/orchestration/cluster-setup-files/orchestration-ldap.yaml new file mode 100644 index 0000000..ee03ba3 --- /dev/null +++ b/src/orchestration/cluster-setup-files/orchestration-ldap.yaml @@ -0,0 +1,166 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: orchestration-user-crb +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: orchestration-user-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{crd_cluster_role}}-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ crd_cluster_role }} +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: configmap-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: configmap-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: configmap-role +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: service-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["services"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: service-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: service-role +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: deployment-role + namespace: {{ namespace }} +rules: + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: deployment-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: deployment-role +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: secret-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: secret-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: secret-role +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: pvc-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: pvc-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: pvc +subjects: + - kind: User + name: SVC-FE-Atlas +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crd-rb-orch +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-view +subjects: + - kind: User + name: SVC-FE-Atlas +--- + diff --git a/src/orchestration/cluster-setup-files/orchestration-sa.yaml b/src/orchestration/cluster-setup-files/orchestration-sa.yaml new file mode 100644 index 0000000..5531431 --- /dev/null +++ b/src/orchestration/cluster-setup-files/orchestration-sa.yaml @@ -0,0 +1,181 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{orchestration_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{orchestration_sa}}-crb +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: view +subjects: + - kind: ServiceAccount + name: {{orchestration_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{orchestration_sa}}-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: + - kind: ServiceAccount + name: {{orchestration_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{crd_cluster_role}}-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ crd_cluster_role }} +subjects: + - kind: ServiceAccount + name: {{orchestration_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: configmap-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["configmaps"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: configmap-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: configmap-role +subjects: + - kind: ServiceAccount + name: {{ orchestration_sa }} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: service-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["services"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: service-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: service-role +subjects: + - kind: ServiceAccount + name: {{ orchestration_sa }} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: deployment-role + namespace: {{ namespace }} +rules: + - apiGroups: ["apps"] + resources: ["deployments"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: deployment-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: deployment-role +subjects: + - kind: ServiceAccount + name: {{ orchestration_sa }} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: secret-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: secret-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: secret-role +subjects: + - kind: ServiceAccount + name: {{ orchestration_sa }} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: pvc-role + namespace: {{ namespace }} +rules: + - apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: pvc-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: pvc +subjects: + - kind: ServiceAccount + name: {{ orchestration_sa }} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crd-rb-orch +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-view +subjects: + - kind: ServiceAccount + name: {{ orchestration_sa }} + namespace: default +--- + diff --git a/src/orchestration/cluster-setup-files/rbd.yaml b/src/orchestration/cluster-setup-files/rbd.yaml new file mode 100644 index 0000000..45d497b --- /dev/null +++ b/src/orchestration/cluster-setup-files/rbd.yaml @@ -0,0 +1,9 @@ +classes: +- additionalNamespaces: [default, kube-public, {{ namespace }} ] + chunk_size: 64 + crush_rule_name: storage_tier_ruleset + name: general + pool_name: kube-rbdkube-system + replication: 1 + userId: ceph-pool-kube-rbd + userSecretName: ceph-pool-kube-rbd diff --git a/src/orchestration/cluster-setup-files/samsung-sa.yaml b/src/orchestration/cluster-setup-files/samsung-sa.yaml new file mode 100644 index 0000000..2525e8b --- /dev/null +++ b/src/orchestration/cluster-setup-files/samsung-sa.yaml @@ -0,0 +1,55 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{application_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{application_sa}}-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: edit +subjects: + - kind: ServiceAccount + name: {{application_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{crd_cluster_role}}-for-app-team +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ crd_cluster_role }}-application +subjects: + - kind: ServiceAccount + name: {{application_sa}} + namespace: default +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ crd_cluster_role }}-application +rules: + - apiGroups: ["{{ crd_api_group }}"] + resources: ["{{ crd_api_resources }}"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: crd-rb-app +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-view +subjects: + - kind: ServiceAccount + name: {{ application_sa }} + namespace: default +--- diff --git a/src/orchestration/cluster-setup-files/tiller-sa.yaml b/src/orchestration/cluster-setup-files/tiller-sa.yaml new file mode 100644 index 0000000..62cc860 --- /dev/null +++ b/src/orchestration/cluster-setup-files/tiller-sa.yaml @@ -0,0 +1,42 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vdu-tiller + namespace: {{ namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: vdu-tiller-role + namespace: {{ namespace }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: vdu-tiller-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: vdu-tiller-role +subjects: + - kind: ServiceAccount + name: vdu-tiller + namespace: {{ namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: vdu-tiller-cluster-crd-crb +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{crd_cluster_role}} +subjects: + - kind: ServiceAccount + name: vdu-tiller + namespace: {{ namespace }} diff --git a/src/orchestration/cluster-setup-files/vdu_tiller_sa.yaml b/src/orchestration/cluster-setup-files/vdu_tiller_sa.yaml new file mode 100644 index 0000000..3644856 --- /dev/null +++ b/src/orchestration/cluster-setup-files/vdu_tiller_sa.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: vdu-tiller + namespace: {{ namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: vdu-tiller-role + namespace: {{ namespace }} +rules: + - apiGroups: ["*"] + resources: ["*"] + verbs: ["*"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: vdu-tiller-rb + namespace: {{ namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: vdu-tiller-role +subjects: + - kind: ServiceAccount + name: vdu-tiller + namespace: {{ namespace }} |