Add TPk8s Opinionated

Add TPk8s Opinionated Add TPk8s Opinionated
mhoshi-vm · Dec 10, 2024 · 908a3f5 · 908a3f5
1 parent 9bd48f6
commit 908a3f5
Show file tree

Hide file tree

Showing 15 changed files with 1,143 additions and 0 deletions.
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/certmanager/certmanager.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/certmanager/certmanager.yaml
@@ -0,0 +1,61 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:overlay", "overlay")
+#@ load("@ytt:base64", "base64")
+#@ load("@ytt:yaml", "yaml")
+
+#@ if data.values.certmanager.enabled:
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: certmanager-install
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kapp-sa
+  namespace: certmanager-install
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: certmanager-kapp-role-binding
+  namespace: certmanager-install
+subjects:
+- kind: ServiceAccount
+  name: kapp-sa
+  namespace: certmanager-install
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+#@ if data.values.certmanager.package_repo.install:
+---
+apiVersion: packaging.carvel.dev/v1alpha1
+kind: PackageRepository
+metadata:
+  name: tds-pack
+  namespace: certmanager-install
+  annotations:
+    kapp.k14s.io/change-group: "pkgr"
+spec:
+  fetch:
+    imgpkgBundle:
+      image: #@ data.values.certmanager.package_repo.repo + ":" + data.values.certmanager.package_repo.version
+#@ end
+#@ if data.values.certmanager.package.install:
+---
+apiVersion: packaging.carvel.dev/v1alpha1
+kind: PackageInstall
+metadata:
+  name: cert-manager
+  namespace: certmanager-install
+  annotations:
+    kapp.k14s.io/change-group: "pkg-cert"
+spec:
+  packageRef:
+    refName: cert-manager.tanzu.vmware.com
+    versionSelection:
+      constraints: ">0.0.0"
+  serviceAccountName: kapp-sa
+#@ end
+#@ end
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/add-limit-to-clickhouse.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/add-limit-to-clickhouse.yaml
@@ -0,0 +1,34 @@
+#@ load("@ytt:data", "data")
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: add-limit-to-clickhouse
+  namespace: #@ data.values.tp.namespace
+stringData:
+  add-limit-to-clickhouse.yaml: |
+    #@ load("@ytt:overlay", "overlay")
+    #@ load("@ytt:base64", "base64")
+    #@ load("@ytt:yaml", "yaml")
+    
+    #@overlay/match-child-defaults missing_ok=True
+    ---
+    #@ def reduce_size():
+    #@overlay/match missing_ok=True
+    resources:
+      requests:
+        cpu: 0.5
+        memory: 1Gi
+      #@overlay/match missing_ok=True
+      limits:
+        #@overlay/match missing_ok=True
+        cpu: 1
+        #@overlay/match missing_ok=True
+        memory: 2Gi
+    #@ end
+    
+    #@overlay/match by=overlay.subset({"kind":"Secret", "metadata": {"name": "clickhouse-values"}})
+    ---
+    data:
+      #@overlay/replace via=lambda orig, _: yaml.encode(overlay.apply(yaml.decode(base64.decode(orig)),reduce_size()))
+      values.yaml:
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/make-tmc-xmall.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/make-tmc-xmall.yaml
@@ -0,0 +1,23 @@
+#@ load("@ytt:data", "data")
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: make-tmc-xsmall
+  namespace: #@ data.values.tp.namespace
+stringData:
+  make-tmc-xsmall.yaml: |
+    #@ load("@ytt:overlay", "overlay")
+    #@ load("@ytt:base64", "base64")
+    #@ load("@ytt:yaml", "yaml")
+    
+    #@ def xsmall():
+    #@overlay/match missing_ok=True
+    size: xsmall
+    #@ end
+    
+    #@overlay/match by=overlay.subset({"kind":"Secret", "metadata": {"name": "tmc-values"}})
+    ---
+    data:
+      #@overlay/replace via=lambda orig, _: base64.encode(yaml.encode(overlay.apply(yaml.decode(base64.decode(orig)),xsmall())))
+      values.yaml:
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/reduce-kafka-replica.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/reduce-kafka-replica.yaml
@@ -0,0 +1,25 @@
+#@ load("@ytt:data", "data")
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: reduce-kafka-replica
+  namespace: #@ data.values.tp.namespace
+stringData:
+  reduce-kafka-replica.yaml: |
+    #@ load("@ytt:overlay", "overlay")
+    #@ load("@ytt:base64", "base64")
+    #@ load("@ytt:yaml", "yaml")
+    
+    #@ def reduce_replica():
+    #@overlay/match missing_ok=True
+    replicas: 1
+    replicationFactor: 1
+    insyncReplicas: 1
+    #@ end
+    
+    #@overlay/match by=overlay.subset({"kind":"Secret", "metadata": {"name": "ops-kafka-values"}})
+    ---
+    data:
+      #@overlay/replace via=lambda orig, _: base64.encode(yaml.encode(overlay.apply(yaml.decode(base64.decode(orig)),reduce_replica())))
+      values.yaml:
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/reduce-redis-replica.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/hacks/reduce-redis-replica.yaml
@@ -0,0 +1,29 @@
+#@ load("@ytt:data", "data")
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: reduce-redis-replica
+  namespace: #@ data.values.tp.namespace
+stringData:
+  reduce-redis-replica.yaml: |
+    #@ load("@ytt:overlay", "overlay")
+    #@ load("@ytt:base64", "base64")
+    #@ load("@ytt:yaml", "yaml")
+    
+    #@overlay/match-child-defaults missing_ok=True
+    ---
+    #@ def reduce_replica():
+    #@overlay/match missing_ok=True
+    architecture: standalone
+    #@overlay/match missing_ok=True
+    replica:
+      #@overlay/match missing_ok=True
+      replicaCount: 1
+    #@ end
+    
+    #@overlay/match by=overlay.subset({"kind":"Secret", "metadata": {"name": "redis-values"}})
+    ---
+    data:
+      #@overlay/replace via=lambda orig, _: base64.encode(yaml.encode(overlay.apply(yaml.decode(base64.decode(orig)),reduce_replica())))
+      values.yaml:
diff --git a/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/openldap/openldap.yaml b/manifests/tpk8s-opinionated.tanzu.japan.com/10.0.0/openldap/openldap.yaml
@@ -0,0 +1,165 @@
+#@ load("@ytt:data", "data")
+#@ load("@ytt:base64", "base64")
+
+#@ port = 636 if data.values.openldap.ssl else 389
+#@ containerPort = port + 1000
+#@ if data.values.openldap.enabled:
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openldap
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: openldap
+  name: openldap
+  namespace: openldap
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: openldap
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: openldap
+    spec:
+      volumes:
+        - name: openldap-ldif
+          secret:
+            secretName: openldap-ldif
+        #@ if data.values.openldap.ssl:
+        - name: certifcate
+          secret:
+            secretName: openldap-cert
+        #@ end
+      containers:
+      - env:
+        - name: LDAP_ROOT
+          value: #@ data.values.openldap.rootdn
+        - name: LDAP_ADMIN_USERNAME
+          value: admin
+        - name: LDAP_ADMIN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              key: adminpassword
+              name: openldap
+        #@ if data.values.openldap.ssl:
+        - name: LDAP_ENABLE_TLS
+          value: "yes"
+        - name: LDAP_TLS_CERT_FILE
+          value: /tls/tls.crt
+        - name: LDAP_TLS_KEY_FILE
+          value: /tls/tls.key
+        - name: LDAP_TLS_CA_FILE
+          value: /tls/ca.crt
+        #@ end
+        image: index.docker.io/bitnami/openldap@sha256:8e3f28db7a8c05d7db99ec688b8ca1044f0deaf8f98ea5b1f71c42276e3c1583
+        imagePullPolicy: Always
+        name: openldap
+        ports:
+        - containerPort: #@ containerPort
+          name: tcp-ldap
+        resources:
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        volumeMounts:
+          - mountPath: "/ldifs"
+            name: openldap-ldif
+            readOnly: true
+          #@ if data.values.openldap.ssl:
+          - mountPath: "/tls"
+            name: certifcate
+            readOnly: true
+          #@ end
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: openldap
+  name: openldap
+  namespace: openldap
+spec:
+  ports:
+  - name: tcp-ldap
+    port: #@ port
+    targetPort: tcp-ldap
+  selector:
+    app.kubernetes.io/name: openldap
+  type: ClusterIP
+---
+apiVersion: v1
+data:
+  adminpassword: #@ base64.encode(data.values.openldap.adminpassword)
+kind: Secret
+metadata:
+  name: openldap
+  namespace: openldap
+---
+apiVersion: v1
+data:
+  custom.ldif: #@ base64.encode(data.values.openldap.ldif)
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: openldap-ldif
+  namespace: openldap
+
+#@ if data.values.openldap.ssl:
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+ name: openldap-root-issuer
+ namespace: openldap
+spec:
+ selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: openldap-rootca
+ namespace: openldap
+spec:
+  isCA: true
+  commonName: openldap-rootca
+  secretName: openldap-rootca
+  issuerRef:
+    name: openldap-root-issuer
+    kind: Issuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: openldap-ca-issuer
+  namespace: openldap
+spec:
+  ca:
+    secretName: openldap-rootca
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: openldap-cert
+  namespace: openldap
+spec:
+  secretName: openldap-cert
+  isCA: false
+  usages:
+    - server auth
+    - client auth
+  dnsNames:
+  - #@ "openldap.openldap.svc.cluster.local"
+  - "openldap"
+  issuerRef:
+    name: openldap-ca-issuer
+#@ end
+#@ end