From 82adc0d6ae6b73bcc678840997af2db196ead9f5 Mon Sep 17 00:00:00 2001 From: Udo Waechter Date: Tue, 21 Sep 2021 18:53:33 +0200 Subject: [PATCH] migrated Ingresses to nginx 1.0.0 https://blog.hycorve.com/migrating-from-ingress-networking-k8s-io-v1beta1-to-v1/ --- _CI-CD/git.lan-access-token.yaml | 7 + _sys/ingress-nginx.yaml | 164 +++-- apps/apt-cacher-ng/live-deployment.yaml | 14 +- apps/authelia/configMaps/configuration.yml | 675 ++++++++++++++++++ apps/authelia/deployment.yaml | 164 +++++ apps/docker-registry/docker-registry-ui.yaml | 15 +- apps/docker-registry/registry-deployment.yaml | 61 +- apps/gitea.yaml | 15 +- apps/grav/deployment.yaml | 13 +- apps/nextcloud/deployment.yaml | 1 + apps/nodered-deployment.yaml | 11 +- apps/pihole-deployment.yaml | 12 +- apps/piwigo/deployment.yaml | 14 +- apps/rompr/deployment.yaml | 14 +- apps/smarthome/home-assistant.yaml | 24 +- apps/tekton/tekton-dashboard-ingress.yaml | 14 +- 16 files changed, 1067 insertions(+), 151 deletions(-) create mode 100644 _CI-CD/git.lan-access-token.yaml create mode 100644 apps/authelia/configMaps/configuration.yml create mode 100644 apps/authelia/deployment.yaml diff --git a/_CI-CD/git.lan-access-token.yaml b/_CI-CD/git.lan-access-token.yaml new file mode 100644 index 0000000..afbf92e --- /dev/null +++ b/_CI-CD/git.lan-access-token.yaml @@ -0,0 +1,7 @@ +apiVersion: v1 +kind: Secret +metadata: + name: git-secret +type: Opaque +data: + token: Nzk1YTFhMGQxMWQ0MDJiY2FiOGM3MjkyZDk5ODIyMzg2NDNkM2U3OQo= \ No newline at end of file diff --git a/_sys/ingress-nginx.yaml b/_sys/ingress-nginx.yaml index 991df12..d4627fd 100644 --- a/_sys/ingress-nginx.yaml +++ b/_sys/ingress-nginx.yaml @@ -13,24 +13,25 @@ apiVersion: v1 kind: ServiceAccount metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx namespace: ingress-nginx +automountServiceAccountToken: true --- # Source: ingress-nginx/templates/controller-configmap.yaml apiVersion: v1 kind: ConfigMap metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx-controller @@ -42,10 +43,10 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm name: ingress-nginx rules: @@ -75,8 +76,7 @@ rules: - list - watch - apiGroups: - - extensions - - networking.k8s.io # k8s 1.14+ + - networking.k8s.io resources: - ingresses verbs: @@ -91,14 +91,13 @@ rules: - create - patch - apiGroups: - - extensions - - networking.k8s.io # k8s 1.14+ + - networking.k8s.io resources: - ingresses/status verbs: - update - apiGroups: - - networking.k8s.io # k8s 1.14+ + - networking.k8s.io resources: - ingressclasses verbs: @@ -111,10 +110,10 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm name: ingress-nginx roleRef: @@ -131,10 +130,10 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx @@ -166,8 +165,7 @@ rules: - list - watch - apiGroups: - - extensions - - networking.k8s.io # k8s 1.14+ + - networking.k8s.io resources: - ingresses verbs: @@ -175,14 +173,13 @@ rules: - list - watch - apiGroups: - - extensions - - networking.k8s.io # k8s 1.14+ + - networking.k8s.io resources: - ingresses/status verbs: - update - apiGroups: - - networking.k8s.io # k8s 1.14+ + - networking.k8s.io resources: - ingressclasses verbs: @@ -194,7 +191,7 @@ rules: resources: - configmaps resourceNames: - - ingress-controller-leader-nginx + - ingress-controller-leader verbs: - get - update @@ -217,10 +214,10 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx @@ -239,10 +236,10 @@ apiVersion: v1 kind: Service metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx-controller-admission @@ -253,6 +250,7 @@ spec: - name: https-webhook port: 443 targetPort: webhook + appProtocol: https selector: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx @@ -264,10 +262,10 @@ kind: Service metadata: annotations: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx-controller @@ -280,10 +278,12 @@ spec: port: 80 protocol: TCP targetPort: http + appProtocol: http - name: https port: 443 protocol: TCP targetPort: https + appProtocol: https selector: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx @@ -294,10 +294,10 @@ apiVersion: apps/v1 kind: Deployment metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: controller name: ingress-nginx-controller @@ -320,7 +320,7 @@ spec: dnsPolicy: ClusterFirst containers: - name: controller - image: k8s.gcr.io/ingress-nginx/controller:v0.44.0@sha256:3dd0fac48073beaca2d67a78c746c7593f9c575168a17139a9955a82c63c4b9a + image: k8s.gcr.io/ingress-nginx/controller:v1.0.0@sha256:0851b34f69f69352bf168e6ccf30e1e20714a264ab1ecd1933e4d8c0fc3215c6 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -330,12 +330,11 @@ spec: args: - /nginx-ingress-controller - --election-id=ingress-controller-leader - - --ingress-class=nginx + - --controller-class=k8s.io/ingress-nginx - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller - --validating-webhook=:8443 - --validating-webhook-certificate=/usr/local/certificates/cert - --validating-webhook-key=/usr/local/certificates/key - - --enable-ssl-passthrough securityContext: capabilities: drop: @@ -356,25 +355,25 @@ spec: - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so livenessProbe: - httpGet: - path: /healthz - port: 10254 - scheme: HTTP - initialDelaySeconds: 10 - periodSeconds: 10 - timeoutSeconds: 1 - successThreshold: 1 failureThreshold: 5 - readinessProbe: httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 periodSeconds: 10 - timeoutSeconds: 1 successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: failureThreshold: 3 + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 ports: - name: http containerPort: 80 @@ -402,6 +401,24 @@ spec: secret: secretName: ingress-nginx-admission --- +# Source: ingress-nginx/templates/controller-ingressclass.yaml +# We don't support namespaced ingressClass yet +# So a ClusterRole and a ClusterRoleBinding is required +apiVersion: networking.k8s.io/v1 +kind: IngressClass +metadata: + labels: + helm.sh/chart: ingress-nginx-4.0.1 + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/instance: ingress-nginx + app.kubernetes.io/version: 1.0.0 + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/component: controller + name: nginx + namespace: ingress-nginx +spec: + controller: k8s.io/ingress-nginx +--- # Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml # before changing this value, check the required kubernetes version # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites @@ -409,10 +426,10 @@ apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook name: ingress-nginx-admission @@ -423,7 +440,7 @@ webhooks: - apiGroups: - networking.k8s.io apiVersions: - - v1beta1 + - v1 operations: - CREATE - UPDATE @@ -433,29 +450,28 @@ webhooks: sideEffects: None admissionReviewVersions: - v1 - - v1beta1 clientConfig: service: namespace: ingress-nginx name: ingress-nginx-controller-admission - path: /networking/v1beta1/ingresses + path: /networking/v1/ingresses --- # Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: ingress-nginx-admission + namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook - namespace: ingress-nginx --- # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 @@ -466,10 +482,10 @@ metadata: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook rules: @@ -490,10 +506,10 @@ metadata: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook roleRef: @@ -510,17 +526,17 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: ingress-nginx-admission + namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook - namespace: ingress-nginx rules: - apiGroups: - '' @@ -535,17 +551,17 @@ apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: ingress-nginx-admission + namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook - namespace: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io kind: Role @@ -560,32 +576,32 @@ apiVersion: batch/v1 kind: Job metadata: name: ingress-nginx-admission-create + namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook - namespace: ingress-nginx spec: template: metadata: name: ingress-nginx-admission-create labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook spec: containers: - name: create - image: docker.io/jettech/kube-webhook-certgen:v1.5.1 + image: k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.0@sha256:f3b6b39a6062328c095337b4cadcefd1612348fdd5190b1dcbcb9b9e90bd8068 imagePullPolicy: IfNotPresent args: - create @@ -599,6 +615,8 @@ spec: fieldPath: metadata.namespace restartPolicy: OnFailure serviceAccountName: ingress-nginx-admission + nodeSelector: + kubernetes.io/os: linux securityContext: runAsNonRoot: true runAsUser: 2000 @@ -608,32 +626,32 @@ apiVersion: batch/v1 kind: Job metadata: name: ingress-nginx-admission-patch + namespace: ingress-nginx annotations: helm.sh/hook: post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook - namespace: ingress-nginx spec: template: metadata: name: ingress-nginx-admission-patch labels: - helm.sh/chart: ingress-nginx-3.23.0 + helm.sh/chart: ingress-nginx-4.0.1 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx - app.kubernetes.io/version: 0.44.0 + app.kubernetes.io/version: 1.0.0 app.kubernetes.io/managed-by: Helm app.kubernetes.io/component: admission-webhook spec: containers: - name: patch - image: docker.io/jettech/kube-webhook-certgen:v1.5.1 + image: k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.0@sha256:f3b6b39a6062328c095337b4cadcefd1612348fdd5190b1dcbcb9b9e90bd8068 imagePullPolicy: IfNotPresent args: - patch @@ -649,6 +667,8 @@ spec: fieldPath: metadata.namespace restartPolicy: OnFailure serviceAccountName: ingress-nginx-admission + nodeSelector: + kubernetes.io/os: linux securityContext: runAsNonRoot: true runAsUser: 2000 diff --git a/apps/apt-cacher-ng/live-deployment.yaml b/apps/apt-cacher-ng/live-deployment.yaml index 56c9831..55430cb 100644 --- a/apps/apt-cacher-ng/live-deployment.yaml +++ b/apps/apt-cacher-ng/live-deployment.yaml @@ -52,18 +52,24 @@ spec: selector: app: apt-cacher-ng --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: apt-cacher-ng + annotations: + kubernetes.io/ingress.class: nginx spec: rules: - host: apt-cache.lan http: paths: - - backend: - serviceName: apt-cacher-ng - servicePort: 3142 + - path: / + pathType: Prefix + backend: + service: + name: apt-cacher-ng + port: + number: 3142 --- apiVersion: v1 kind: PersistentVolumeClaim diff --git a/apps/authelia/configMaps/configuration.yml b/apps/authelia/configMaps/configuration.yml new file mode 100644 index 0000000..be70478 --- /dev/null +++ b/apps/authelia/configMaps/configuration.yml @@ -0,0 +1,675 @@ +# yamllint disable rule:comments-indentation +--- +############################################################################### +# Authelia Configuration # +############################################################################### + +## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to +## the system certificates store. +## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem. +# certificates_directory: /config/certificates + +## The theme to display: light, dark, grey, auto. +theme: dark + +## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be +## set using a secret: https://www.authelia.com/docs/configuration/secrets.html +jwt_secret: a_very_important_secret2 + +## Default redirection URL +## +## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end +## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use +## in such a case. +## +## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication. +default_redirection_url: http://nc.lan + +## +## Server Configuration +## +server: + + ## The address to listen on. + host: 0.0.0.0 + + ## The port to listen on. + port: 9091 + + ## Set the single level path Authelia listens on. + ## Must be alphanumeric chars and should not contain any slashes. + path: "" + + ## Buffers usually should be configured to be the same value. + ## Explanation at https://www.authelia.com/docs/configuration/server.html + ## Read buffer size adjusts the server's max incoming request size in bytes. + ## Write buffer size does the same for outgoing responses. + read_buffer_size: 4096 + write_buffer_size: 4096 + + ## Enables the pprof endpoint. + enable_pprof: false + + ## Enables the expvars endpoint. + enable_expvars: false + + ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0. + ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist. + disable_healthcheck: false + + ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour. + tls: + ## The path to the DER base64/PEM format private key. + key: "" + + ## The path to the DER base64/PEM format public certificate. + certificate: "" + +## +## Log Configuration +## +log: + ## Level of verbosity for logs: info, debug, trace. + level: debug + + ## Format the logs are written as: json, text. + format: text + + ## File path where the logs will be written. If not set logs are written to stdout. + file_path: /config-nfs/authelia.log + + ## Whether to also log to stdout when a log_file_path is defined. + # keep_stdout: false + +## +## TOTP Configuration +## +## Parameters used for TOTP generation. +totp: + ## The issuer name displayed in the Authenticator application of your choice + ## See: https://github.com/google/google-authenticator/wiki/Key-Uri-Format for more info on issuer names + issuer: auth.lan + ## The period in seconds a one-time password is current for. Changing this will require all users to register + ## their TOTP applications again. Warning: before changing period read the docs link below. + period: 30 + ## The skew controls number of one-time passwords either side of the current one that are valid. + ## Warning: before changing skew read the docs link below. + skew: 1 + ## See: https://www.authelia.com/docs/configuration/one-time-password.html#period-and-skew to read the documentation. + +## +## Duo Push API Configuration +## +## Parameters used to contact the Duo API. Those are generated when you protect an application of type +## "Partner Auth API" in the management panel. +duo_api: + hostname: api.auth.lan + integration_key: AUTHELIA + ## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + secret_key: 8Jp5e822KP + +## +## Authentication Backend Provider Configuration +## +## Used for verifying user passwords and retrieve information such as email address and groups users belong to. +## +## The available providers are: `file`, `ldap`. You must use only one of these providers. +authentication_backend: + ## Disable both the HTML element and the API for reset password functionality. + disable_reset_password: false + + ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation. + ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will + ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP. + ## To force update on every request you can set this to '0' or 'always', this will increase processor demand. + ## See the below documentation for more information. + ## Duration Notation docs: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ## Refresh Interval docs: https://www.authelia.com/docs/configuration/authentication/ldap.html#refresh-interval + refresh_interval: 5m + + ## + ## LDAP (Authentication Provider) + ## + ## This is the recommended Authentication Provider in production + ## because it allows Authelia to offload the stateful operations + ## onto the LDAP service. +# ldap: +# ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password. +# ## Acceptable options are as follows: +# ## - 'activedirectory' - For Microsoft Active Directory. +# ## - 'custom' - For custom specifications of attributes and filters. +# ## This currently defaults to 'custom' to maintain existing behaviour. +# ## +# ## Depending on the option here certain other values in this section have a default value, notably all of the +# ## attribute mappings have a default value that this config overrides, you can read more about these default values +# ## at https://www.authelia.com/docs/configuration/authentication/ldap.html#defaults +# implementation: custom +# +# ## The url to the ldap server. Format: ://
[:]. +# ## Scheme can be ldap or ldaps in the format (port optional). +# url: ldap://127.0.0.1 +# +# ## The dial timeout for LDAP. +# timeout: 5s +# +# ## Use StartTLS with the LDAP connection. +# start_tls: false +# +# tls: +# ## Server Name for certificate validation (in case it's not set correctly in the URL). +# # server_name: ldap.example.com +# +# ## Skip verifying the server certificate (to allow a self-signed certificate). +# ## In preference to setting this we strongly recommend you add the public portion of the certificate to the +# ## certificates directory which is defined by the `certificates_directory` option at the top of the config. +# skip_verify: false +# +# ## Minimum TLS version for either Secure LDAP or LDAP StartTLS. +# minimum_version: TLS1.2 +# +# ## The distinguished name of the container searched for objects in the directory information tree. +# ## See also: additional_users_dn, additional_groups_dn. +# base_dn: dc=example,dc=com +# +# ## The attribute holding the username of the user. This attribute is used to populate the username in the session +# ## information. It was introduced due to #561 to handle case insensitive search queries. For you information, +# ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this +# ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database. +# ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user +# ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also +# ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above +# ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt. +# # username_attribute: uid +# +# ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users. +# ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users. +# additional_users_dn: ou=users +# +# ## The users filter used in search queries to find the user profile based on input filled in login form. +# ## Various placeholders are available in the user filter which you can read about in the documentation which can +# ## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#users-filter-replacements +# ## +# ## Recommended settings are as follows: +# ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user)) +# ## - OpenLDAP: +# ## - (&({username_attribute}={input})(objectClass=person)) +# ## - (&({username_attribute}={input})(objectClass=inetOrgPerson)) +# ## +# ## To allow sign in both with username and email, one can use a filter like +# ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person)) +# users_filter: (&({username_attribute}={input})(objectClass=person)) +# +# ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups. +# ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups. +# additional_groups_dn: ou=groups +# +# ## The groups filter used in search queries to find the groups based on relevant authenticated user. +# ## Various placeholders are available in the groups filter which you can read about in the documentation which can +# ## be found at: https://www.authelia.com/docs/configuration/authentication/ldap.html#groups-filter-replacements +# ## +# ## If your groups use the `groupOfUniqueNames` structure use this instead: +# ## (&(uniqueMember={dn})(objectClass=groupOfUniqueNames)) +# groups_filter: (&(member={dn})(objectClass=groupOfNames)) +# +# ## The attribute holding the name of the group. +# # group_name_attribute: cn +# +# ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the +# ## first one returned by the LDAP server is used. +# # mail_attribute: mail +# +# ## The attribute holding the display name of the user. This will be used to greet an authenticated user. +# # display_name_attribute: displayName +# +# ## The username and password of the admin user. +# user: cn=admin,dc=example,dc=com +# ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html +# password: password +# + ## + ## File (Authentication Provider) + ## + ## With this backend, the users database is stored in a file which is updated when users reset their passwords. + ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia + ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security + ## implications it is highly recommended you leave the default values. Before considering changing these settings + ## please read the docs page below: + ## https://www.authelia.com/docs/configuration/authentication/file.html#password-hash-algorithm-tuning + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + file: + path: /config-nfs/users_database.yml + password: + algorithm: argon2id + iterations: 1 + key_length: 32 + salt_length: 16 + memory: 1024 + parallelism: 8 +## +## Access Control Configuration +## +## Access control is a list of rules defining the authorizations applied for one resource to users or group of users. +## +## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed +## to anyone. Otherwise restrictions follow the rules defined. +## +## Note: One can use the wildcard * to match any subdomain. +## It must stand at the beginning of the pattern. (example: *.mydomain.com) +## +## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct. +## +## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'. +## +## - 'domain' defines which domain or set of domains the rule applies to. +## +## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not +## provided. If provided, the parameter represents either a user or a group. It should be of the form +## 'user:' or 'group:'. +## +## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'. +## +## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter +## is optional and matches any resource if not provided. +## +## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies. +access_control: + ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any + ## resource if there is no policy to be applied to the user. + default_policy: deny + + networks: + - name: internal + networks: + - 10.10.0.0/16 + - 172.23.0.0/16 + - 172.16.23.0/24 + - 192.168.10.0/24 + - name: VPN + networks: 10.14.0.0/27 + + rules: + ## Rules applied to everyone + - domain: public.auth.lan + policy: bypass + + - domain: secure.auth.lan + policy: one_factor + ## Network based rule, if not provided any network matches. + networks: + - internal + - VPN + + - domain: + - secure.auth.lan + - private.auth.lan + policy: two_factor + + - domain: singlefactor.auth.lan + policy: one_factor + + ## Rules applied to 'admins' group + - domain: "mx2.mail.example.com" + subject: "group:admins" + policy: deny + + - domain: "*.auth.lan" + subject: + - "group:admins" + - "group:moderators" + policy: two_factor + + ## Rules applied to 'dev' group + - domain: dev.auth.lan + resources: + - "^/groups/dev/.*$" + subject: "group:dev" + policy: two_factor + + ## Rules applied to user 'john' + - domain: dev.auth.lan + resources: + - "^/users/john/.*$" + subject: "user:john" + policy: two_factor + + ## Rules applied to user 'harry' + - domain: dev.auth.lan + resources: + - "^/users/harry/.*$" + subject: "user:harry" + policy: two_factor + + ## Rules applied to user 'bob' + - domain: "*.mail.auth.lan" + subject: "user:bob" + policy: two_factor + - domain: "dev.auth.lan" + resources: + - "^/users/bob/.*$" + subject: "user:bob" + policy: two_factor + +## +## Session Provider Configuration +## +## The session cookies identify the user once logged in. +## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined. +session: + ## The name of the session cookie. + name: authelia_session + + ## The domain to protect. + ## Note: the authenticator must also be in that domain. + ## If empty, the cookie is restricted to the subdomain of the issuer. + domain: lan + + ## Sets the Cookie SameSite value. Possible options are none, lax, or strict. + ## Please read https://www.authelia.com/docs/configuration/session.html#same_site + same_site: lax + + ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel. + ## Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + secret: insecure_session_secret + + ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure + ## because a stolen cookie will last longer giving attackers more time to spy or attack. + + ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected. + expiration: 1h + + ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user + ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time + ## Authelia detected user activity. + inactivity: 5m + + ## The time before the cookie expires and the session is destroyed if remember me IS selected. + ## Value of 0 disables remember me. + remember_me_duration: 1M + + ## + ## Redis Provider + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + #redis: + # host: 127.0.0.1 + # port: 6379 + # ## Use a unix socket instead + # # host: /var/run/redis/redis.sock + # + # ## Username used for redis authentication. This is optional and a new feature in redis 6.0. + # # username: authelia + # + # ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + # password: authelia + # + # ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc). + # database_index: 0 + # + # ## The maximum number of concurrent active connections to Redis. + # maximum_active_connections: 8 + # + # ## The target number of idle connections to have open ready for work. Useful when opening connections is slow. + # minimum_idle_connections: 0 + # + # ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s). + # # tls: + # ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). + # # server_name: myredis.example.com + # + # ## Skip verifying the server certificate (to allow a self-signed certificate). + # ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + # ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + # # skip_verify: false + # + # ## Minimum TLS version for the connection. + # # minimum_version: TLS1.2 + # + # ## The Redis HA configuration options. + # ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name). + # # high_availability: + # ## Sentinel Name / Master Name. + # # sentinel_name: mysentinel + # + # ## Specific password for Redis Sentinel. The node username and password is configured above. + # # sentinel_password: sentinel_specific_pass + # + # ## The additional nodes to pre-seed the redis provider with (for sentinel). + # ## If the host in the above section is defined, it will be combined with this list to connect to sentinel. + # ## For high availability to be used you must have either defined; the host above or at least one node below. + # # nodes: + # # - host: sentinel-node1 + # # port: 6379 + # # - host: sentinel-node2 + # # port: 6379 + # + # ## Choose the host with the lowest latency. + # # route_by_latency: false + # + # ## Choose the host randomly. + # # route_randomly: false + +## +## Regulation Configuration +## +## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made +## in a short period of time. +regulation: + ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation. + max_retries: 3 + + ## The time range during which the user can attempt login before being banned. The user is banned if the + ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + find_time: 2m + + ## The length of time before a banned user can login again. Ban Time accepts duration notation. + ## See: https://www.authelia.com/docs/configuration/index.html#duration-notation-format + ban_time: 5m + +## +## Storage Provider Configuration +## +## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers. +storage: + ## + ## Local (Storage Provider) + ## + ## This stores the data in a SQLite3 Database. + ## This is only recommended for lightweight non-stateful installations. + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + # local: + # path: /config/db.sqlite3 + + ## + ## MySQL / MariaDB (Storage Provider) + ## + #mysql: + # host: 127.0.0.1 + # port: 3306 + # database: authelia + # username: authelia + # ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + # password: mypassword + # timeout: 5s + # + ## + ## PostgreSQL (Storage Provider) + ## + postgres: + host: postgres.live-env.svc.cluster.local + port: 5432 + database: authelia + username: authelia + ## Password can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + password: auth2021 + timeout: 5s + sslmode: disable + +## +## Notification Provider +## +## Notifications are sent to users when they require a password reset, a U2F registration or a TOTP registration. +## The available providers are: filesystem, smtp. You must use only one of these providers. +notifier: + ## You can disable the notifier startup check by setting this to true. + disable_startup_check: false + + ## + ## File System (Notification Provider) + ## + ## Important: Kubernetes (or HA) users must read https://www.authelia.com/docs/features/statelessness.html + ## + filesystem: + filename: /config-nfs/notification.txt + + ## + ## SMTP (Notification Provider) + ## + ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate. + ## [Security] By default Authelia will: + ## - force all SMTP connections over TLS including unauthenticated connections + ## - use the disable_require_tls boolean value to disable this requirement + ## (only works for unauthenticated connections) + ## - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates + ## (configure in tls section) + #smtp: + # ## The SMTP host to connect to. + # host: 127.0.0.1 + # + # ## The port to connect to the SMTP host on. + # port: 1025 + # + # ## The connection timeout. + # timeout: 5s + # + # ## The username used for SMTP authentication. + # username: test + # + # ## The password used for SMTP authentication. + # ## Can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + # password: password + # + # ## The address to send the email FROM. + # sender: admin@example.com + # + # ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost. + # identifier: localhost + # + # ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier. + # subject: "[Authelia] {title}" + # + # ## This address is used during the startup check to verify the email configuration is correct. + # ## It's not important what it is except if your email server only allows local delivery. + # startup_check_address: test@authelia.com + # + # ## By default we require some form of TLS. This disables this check though is not advised. + # disable_require_tls: false + # + # ## Disables sending HTML formatted emails. + # disable_html_emails: false + # + # tls: + # ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option). + # # server_name: smtp.example.com + # + # ## Skip verifying the server certificate (to allow a self-signed certificate). + # ## In preference to setting this we strongly recommend you add the public portion of the certificate to the + # ## certificates directory which is defined by the `certificates_directory` option at the top of the config. + # skip_verify: false + # + # ## Minimum TLS version for either StartTLS or SMTPS. + # minimum_version: TLS1.2 + +## +## Identity Providers +## +# identity_providers: + + ## + ## OpenID Connect (Identity Provider) + ## + ## It's recommended you read the documentation before configuration of this section: + ## https://www.authelia.com/docs/configuration/identity-providers/oidc.html + # oidc: + ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens). + ## HMAC Secret can also be set using a secret: https://www.authelia.com/docs/configuration/secrets.html + # hmac_secret: this_is_a_secret_abc123abc123abc + + ## The issuer_private_key is used to sign the JWT forged by OpenID Connect. + ## Issuer Private Key can also be set using a secret: https://docs.authelia.com/configuration/secrets.html + # issuer_private_key: | + # --- KEY START + # --- KEY END + + ## The lifespans configure the expiration for these token types. + # access_token_lifespan: 1h + # authorize_code_lifespan: 1m + # id_token_lifespan: 1h + # refresh_token_lifespan: 90m + + ## Enables additional debug messages. + # enable_client_debug_messages: false + + ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it below 8 for + ## security reasons. + # minimum_parameter_entropy: 8 + + ## Clients is a list of known clients and their configuration. + # clients: + # - + ## The ID is the OpenID Connect ClientID which is used to link an application to a configuration. + # id: myapp + + ## The description to show to users when they end up on the consent screen. Defaults to the ID above. + # description: My Application + + ## The client secret is a shared secret between Authelia and the consumer of this client. + # secret: this_is_a_secret + + ## Sets the client to public. This should typically not be set, please see the documentation for usage. + # public: false + + ## The policy to require for this client; one_factor or two_factor. + # authorization_policy: two_factor + + ## Audience this client is allowed to request. + # audience: [] + + ## Scopes this client is allowed to request. + # scopes: + # - openid + # - groups + # - email + # - profile + + ## Redirect URI's specifies a list of valid case-sensitive callbacks for this client. + # redirect_uris: + # - https://oidc.example.com:8080/oauth2/callback + + ## Grant Types configures which grants this client can obtain. + ## It's not recommended to define this unless you know what you're doing. + # grant_types: + # - refresh_token + # - authorization_code + + ## Response Types configures which responses this client can be sent. + ## It's not recommended to define this unless you know what you're doing. + # response_types: + # - code + + ## Response Modes configures which response modes this client supports. + # response_modes: + # - form_post + # - query + # - fragment + + ## The algorithm used to sign userinfo endpoint responses for this client, either none or RS256. + # userinfo_signing_algorithm: none +... diff --git a/apps/authelia/deployment.yaml b/apps/authelia/deployment.yaml new file mode 100644 index 0000000..7ae5bbf --- /dev/null +++ b/apps/authelia/deployment.yaml @@ -0,0 +1,164 @@ +#we use postgresql: +#create database authelia; +#create user authelia with encrypted password 'secret'; +#grant all privileges on database authelia to authelia; +apiVersion: apps/v1 +kind: Deployment +metadata: + name: authelia + labels: + app: authelia + release: latest +spec: + replicas: 1 + selector: + matchLabels: + app: authelia + release: latest + template: + metadata: + labels: + app: authelia + release: latest + spec: + containers: + - name: authelia + image: authelia/authelia:latest + imagePullPolicy: IfNotPresent + env: + #- name: AUTHELIA_SERVER_PORT + # value: "9091" + - name: TZ + value: "Europe/Berlin" + volumeMounts: + - name: authelia + mountPath: /config-nfs + - name: authelia-config + mountPath: /config + ports: + - name: http + containerPort: 9091 + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + readinessProbe: + httpGet: + path: / + port: http + resources: + requests: + memory: "256Mi" + cpu: "250m" + limits: + memory: "1000Mi" + cpu: "1500m" + enableServiceLinks: false + volumes: + - name: authelia + persistentVolumeClaim: + claimName: authelia + - name: authelia-config + configMap: + name: authelia-config + items: + - key: configuration.yml + path: configuration.yml +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: authelia + labels: + app: authelia +spec: + storageClassName: nfs-ssd-ebin02 + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100Mi +--- +apiVersion: v1 +kind: PersistentVolume +metadata: + name: authelia +spec: + storageClassName: "nfs-ssd-ebin02" + nfs: + path: /data/raid1-ssd/k8s-data/authelia + server: ebin02 + capacity: + storage: 100Mi + accessModes: + - ReadWriteOnce + volumeMode: Filesystem + persistentVolumeReclaimPolicy: Retain + claimRef: + kind: PersistentVolumeClaim + name: authelia + namespace: live-infra +--- +apiVersion: v1 +kind: Service +metadata: + name: authelia + labels: + app: authelia +spec: + ports: + - port: 80 + targetPort: http + protocol: TCP + name: http + selector: + app: authelia + release: latest +--- +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: authelia + annotations: + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/auth-url: http://authelia.live-infra.svc.cluster.local/api/verify + nginx.ingress.kubernetes.io/auth-signin: http://auth.lan + nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email + nginx.ingress.kubernetes.io/auth-snippet: | + proxy_set_header X-Forwarded-Method $request_method; + nginx.ingress.kubernetes.io/configuration-snippet: | + proxy_set_header X-Forwarded-Method $request_method; +spec: + rules: + - host: auth.lan + http: + paths: + - backend: + service: + name: authelia + port: + name: http + path: / + pathType: Prefix + - host: secure.auth.lan + http: + paths: + - backend: + service: + name: authelia + port: + name: http + path: / + pathType: Prefix + - host: public.auth.lan + http: + paths: + - backend: + service: + name: authelia + port: + name: http + path: / + pathType: Prefix + diff --git a/apps/docker-registry/docker-registry-ui.yaml b/apps/docker-registry/docker-registry-ui.yaml index 8afc051..9872652 100644 --- a/apps/docker-registry/docker-registry-ui.yaml +++ b/apps/docker-registry/docker-registry-ui.yaml @@ -69,11 +69,12 @@ spec: app: registry-ui release: docker-registry-ui --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: docker-registry-ui annotations: + kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/enable-cors: "true" nginx.ingress.kubernetes.io/cors-allow-origin: "*" nginx.ingress.kubernetes.io/cors-expose-headers: "*" @@ -82,7 +83,11 @@ spec: - host: cr-ui.lan http: paths: - - backend: - serviceName: docker-registry-ui - servicePort: http - path: / + - path: / + pathType: Prefix + backend: + service: + name: docker-registry-ui + port: + number: 80 + diff --git a/apps/docker-registry/registry-deployment.yaml b/apps/docker-registry/registry-deployment.yaml index 44378f9..1587e03 100644 --- a/apps/docker-registry/registry-deployment.yaml +++ b/apps/docker-registry/registry-deployment.yaml @@ -1,12 +1,4 @@ apiVersion: v1 -kind: Namespace -metadata: - name: docker-registry -spec: - finalizers: - - kubernetes ---- -apiVersion: v1 kind: PersistentVolumeClaim metadata: name: docker-registry @@ -28,7 +20,7 @@ metadata: name: registry labels: app: registry - namespace: docker-registry + namespace: live-env spec: replicas: 1 selector: @@ -66,7 +58,7 @@ apiVersion: v1 kind: ConfigMap metadata: name: docker-registry-config - namespace: docker-registry + namespace: live-env labels: app: registry data: @@ -97,42 +89,43 @@ kind: Service apiVersion: v1 metadata: name: registry - namespace: docker-registry + namespace: live-env spec: selector: app: registry ports: - port: 5000 targetPort: 5000 +#--- +#apiVersion: v1 +#data: +# proxy-connect-timeout: "30" +# proxy-read-timeout: "1801" +# proxy-send-timeout: "1801" +# proxy-body-size: "0" +# client-max-body-size: "0" +#kind: ConfigMap +#metadata: +# name: ingress-nginx-controller +# namespace: ingress-nginx --- -apiVersion: v1 -data: - proxy-connect-timeout: "30" - proxy-read-timeout: "1801" - proxy-send-timeout: "1801" - proxy-body-size: "0" - client-max-body-size: "0" -kind: ConfigMap -metadata: - name: ingress-nginx-controller - namespace: ingress-nginx ---- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: docker-registry - namespace: docker-registry - #annotations: - # nginx.ingress.kubernetes.io/proxy‑connect‑timeout: 30 - # nginx.ingress.kubernetes.io/proxy‑read‑timeout: 1800 - # nginx.ingress.kubernetes.io/proxy‑send‑timeout: 1800 - # nginx.ingress.kubernetes.io/proxy-body-size: '5g' + namespace: live-env + annotations: + kubernetes.io/ingress.class: nginx spec: rules: - host: docker-registry.lan http: paths: - - backend: - serviceName: registry - servicePort: 5000 - path: / + - path: / + pathType: Prefix + backend: + service: + name: registry + port: + number: 5000 + diff --git a/apps/gitea.yaml b/apps/gitea.yaml index bc30c5d..74d0c17 100644 --- a/apps/gitea.yaml +++ b/apps/gitea.yaml @@ -107,11 +107,12 @@ spec: app: gitea release: latest --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: gitea annotations: + kubernetes.io/ingress.class: nginx ingress.kubernetes.io/whitelist-x-forwarded-for: "true" nginx.ingress.kubernetes.io/proxy-body-size: 512m spec: @@ -119,7 +120,11 @@ spec: - host: git-ui.lan http: paths: - - backend: - serviceName: gitea - servicePort: http - path: / + - path: / + pathType: Prefix + backend: + service: + name: gitea + port: + number: 3000 + diff --git a/apps/grav/deployment.yaml b/apps/grav/deployment.yaml index 9205e11..8bfbe74 100644 --- a/apps/grav/deployment.yaml +++ b/apps/grav/deployment.yaml @@ -77,20 +77,25 @@ spec: selector: app: grav --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: grav annotations: + kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/proxy-body-size: 512m spec: rules: - host: grav.lan http: paths: - - backend: - serviceName: grav - servicePort: http + - path: / + pathType: Prefix + backend: + service: + name: grav + port: + name: http --- apiVersion: v1 kind: PersistentVolumeClaim diff --git a/apps/nextcloud/deployment.yaml b/apps/nextcloud/deployment.yaml index 49a6ee4..f9c9d16 100644 --- a/apps/nextcloud/deployment.yaml +++ b/apps/nextcloud/deployment.yaml @@ -123,6 +123,7 @@ kind: Ingress metadata: name: nextcloud annotations: + kubernetes.io/ingress.class: nginx ingress.kubernetes.io/whitelist-x-forwarded-for: "true" nginx.ingress.kubernetes.io/proxy-body-size: 512m spec: diff --git a/apps/nodered-deployment.yaml b/apps/nodered-deployment.yaml index eb52827..0f54fb5 100644 --- a/apps/nodered-deployment.yaml +++ b/apps/nodered-deployment.yaml @@ -53,11 +53,12 @@ spec: selector: app: node-red --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: node-red annotations: + kubernetes.io/ingress.class: nginx nginx.ingress.kubernetes.io/rewrite-target: / spec: rules: @@ -65,10 +66,12 @@ spec: http: paths: - path: / + pathType: Prefix backend: - serviceName: node-red - servicePort: 1880 - + service: + name: node-red + port: + number: 1880 --- apiVersion: v1 kind: PersistentVolumeClaim diff --git a/apps/pihole-deployment.yaml b/apps/pihole-deployment.yaml index 300f444..904a121 100644 --- a/apps/pihole-deployment.yaml +++ b/apps/pihole-deployment.yaml @@ -125,7 +125,7 @@ spec: name: pihole-custom-dnsmasq name: custom-dnsmasq --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: pihole @@ -134,10 +134,14 @@ spec: - host: pihole.lan http: paths: - - backend: - serviceName: pihole-tcp - servicePort: http + - path: / pathType: ImplementationSpecific + backend: + service: + name: pihole-tcp + port: + name: http + --- apiVersion: v1 kind: PersistentVolumeClaim diff --git a/apps/piwigo/deployment.yaml b/apps/piwigo/deployment.yaml index e2a761a..3074ee9 100644 --- a/apps/piwigo/deployment.yaml +++ b/apps/piwigo/deployment.yaml @@ -73,20 +73,26 @@ spec: selector: app: piwigo --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: piwigo labels: app: piwigo + annotations: + kubernetes.io/ingress.class: nginx spec: rules: - host: foto.lan http: paths: - - backend: - serviceName: piwigo - servicePort: http + - path: / + pathType: Prefix + backend: + service: + name: piwigo + port: + name: http --- apiVersion: batch/v1beta1 kind: CronJob diff --git a/apps/rompr/deployment.yaml b/apps/rompr/deployment.yaml index 7f333c3..8604e64 100644 --- a/apps/rompr/deployment.yaml +++ b/apps/rompr/deployment.yaml @@ -40,18 +40,24 @@ spec: selector: app: rompr --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: rompr + annotations: + kubernetes.io/ingress.class: nginx spec: rules: - host: musik.lan http: paths: - - backend: - serviceName: rompr - servicePort: http + - path: / + pathType: Prefix + backend: + service: + name: rompr + port: + name: http --- apiVersion: v1 kind: PersistentVolumeClaim diff --git a/apps/smarthome/home-assistant.yaml b/apps/smarthome/home-assistant.yaml index 5ca053d..32ee6c3 100644 --- a/apps/smarthome/home-assistant.yaml +++ b/apps/smarthome/home-assistant.yaml @@ -149,21 +149,31 @@ spec: app: hassio release: latest --- -apiVersion: networking.k8s.io/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: hassio + annotations: + kubernetes.io/ingress.class: nginx spec: rules: - host: hassio.lan http: paths: - - backend: - serviceName: hassio - servicePort: http + - path: / + pathType: Prefix + backend: + service: + name: hassio + port: + name: http - host: hassio-conf.lan http: paths: - - backend: - serviceName: hassio-conf - servicePort: adm + - path: / + pathType: Prefix + backend: + service: + name: hassio-conf + port: + name: adm diff --git a/apps/tekton/tekton-dashboard-ingress.yaml b/apps/tekton/tekton-dashboard-ingress.yaml index 545e4da..686ef24 100644 --- a/apps/tekton/tekton-dashboard-ingress.yaml +++ b/apps/tekton/tekton-dashboard-ingress.yaml @@ -1,13 +1,19 @@ -apiVersion: extensions/v1beta1 +apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: tekton-dashboard namespace: tekton-pipelines + annotations: + kubernetes.io/ingress.class: nginx spec: rules: - host: tekton.lan http: paths: - - backend: - serviceName: tekton-dashboard - servicePort: 9097 + - path: / + pathType: Prefix + backend: + service: + name: tekton-dashboard + port: + number: 9097