coreddns update

.gitmodules

@@ -3,7 +3,7 @@
 	url = https://github.com/coreos/kube-prometheus.git
 [submodule "cluster-monitoring"]
 	path = cluster-monitoring
-	url = https://github.com/carlosedp/cluster-monitoring.git
+	url = git@git.lan:chaos/k8s-cluster-monitoring.git
 [submodule "gluster-kubernetes"]
 	path = gluster-kubernetes
 	url = https://github.com/jayflory/gluster-kubernetes.git
@@ -25,9 +25,6 @@
 [submodule "mosquitto/charts"]
 	path = mosquitto/charts
 	url = https://github.com/smizy/charts.git
-[submodule "mosquitto-exporter"]
-	path = mosquitto-exporter
-	url = https://github.com/sapcc/mosquitto-exporter.git
 [submodule "csi-s3/storage-csi-s3"]
 	path = csi-s3/storage-csi-s3
 	url = https://github.com/ctrox/csi-s3.git
@@ -49,3 +46,6 @@
 [submodule "nfs-subdir-external-provisioner"]
 	path = nfs-subdir-external-provisioner
 	url = https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner.git
+[submodule "descheduler"]
+	path = descheduler
+	url = https://github.com/kubernetes-sigs/descheduler.git

.project

@@ -5,6 +5,11 @@
 	<projects>
 	</projects>
 	<buildSpec>
+		<buildCommand>
+			<name>org.eclipse.xtext.ui.shared.xtextBuilder</name>
+			<arguments>
+			</arguments>
+		</buildCommand>
 		<buildCommand>
 			<name>org.python.pydev.PyDevBuilder</name>
 			<arguments>
@@ -13,5 +18,6 @@
 	</buildSpec>
 	<natures>
 		<nature>org.python.pydev.pythonNature</nature>
+		<nature>org.eclipse.xtext.ui.shared.xtextNature</nature>
 	</natures>
 </projectDescription>

TODO.md

@@ -0,0 +1,9 @@
+root@pine01:/etc/kubernetes# kubeadm upgrade apply v1.24.9 --ignore-preflight-errors=CoreDNSUnsupportedPlugins
+[upgrade/config] Making sure the configuration is correct:
+[upgrade/config] Reading configuration from the cluster...
+[upgrade/config] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
+W0112 18:28:48.533830   21616 initconfiguration.go:120] Usage of CRI endpoints without URL scheme is deprecated and can cause kubelet errors in the future. Automatically prepending scheme "unix" to the "criSocket" with value "/run/containerd/containerd.sock". Please update your configuration!
+
+
+CoreDNS                   v1.8.6    v1.9.3
+

_CI-CD/debian-golang/Dockerfile

@@ -1,9 +1,11 @@
-FROM debian:stable-slim
+FROM cr.lan/debian-stable
 
-RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
+RUN apt-get update && apt-get install -y \
-	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
+	golang make git
-	apt-get update && apt-get install -y \
+	
-	golang make git && \
+RUN	apt-get remove -y --purge man-db ;\
-	apt-get clean -y && \ 
+	apt-get autoremove -y --purge ;\ 
-	rm -rf /var/lib/apt/lists/* && \
+	apt-get clean -y ;\ 
-	rm -rf /var/cache/apt/*
+	rm -rf /var/lib/apt/lists/* ;\
+	rm -rf /var/cache/apt/*
+	

_CI-CD/debian-golang/tekton-debian-golang-img.yaml

@@ -1,84 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-debian-golang-stable
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/debian-golang-stable
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-debian-golang
-spec:
-  params:
-    - name: pathToContainerFile
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-golang/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-golang
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToContainerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --skip-tls-verify
-  #workspaces:
-  #  - name: workspace
-  #    mountPath: /workspace
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-debian-golang
-spec:
-  taskRef:
-    name: build-debian-golang
-  params:
-    - name: pathToContainerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-debian-golang-stable
-#  workspaces:
-#  - name: workspace
-#    persistentVolumeClaim:
-#      claimName: tektoncd-workspaces
-#    subPath: workspaces
-          
-          
-          

_CI-CD/debian-golang/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-debian-golang
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: _CI-CD/debian-golang
+    - name: path-to-dockerfile
+      value: _CI-CD/debian-golang/Dockerfile
+    - name: image-name
+      value: cr.lan/debian-stable-golang
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/debian-stable-golang

_CI-CD/debian-stable-build-essential/Dockerfile

@@ -1,13 +1,15 @@
-FROM debian:stable-slim
+FROM cr.lan/debian-stable
 
-RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
+RUN apt-get update && apt-get install -y \
-	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
-	apt-get update && apt-get install -y \
 	dnsutils procps nmap bash iputils-ping bash \
 			build-essential make ccache distcc-pump distcc g++ \
-			libncursesw5-dev && \
+			libncursesw5-dev
-	apt-get clean -y && \ 
+
-	rm -rf /var/lib/apt/lists/* && \
+RUN	apt-get remove -y --purge man-db ;\
+	apt-get autoremove -y --purge ;\ 
+	apt-get clean -y ;\ 
+	rm -rf /var/lib/apt/lists/* ;\
 	rm -rf /var/cache/apt/*
+	
 ADD docker-entrypoint.sh /
 ENTRYPOINT ["/docker-entrypoint.sh"]

_CI-CD/debian-stable-build-essential/tekton.yaml

@@ -1,85 +1,23 @@
-apiVersion: tekton.dev/v1alpha1
+apiVersion: tekton.dev/v1beta1
-kind: PipelineResource
+kind: PipelineRun
 metadata:
-  name: chaos-kubernetes-git
+  name: img-debian-stable-build-essential
 spec:
-  type: git
+  pipelineRef:
+    name: kaniko-pipeline
   params:
-    - name: revision
+    - name: git-url
-      value: master
-    - name: url
       value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
+    - name: git-revision
-      value: "false"
+      value: master
----
+    - name: path-to-image-context
-apiVersion: tekton.dev/v1alpha1
+      value: _CI-CD/debian-stable-build-essential
-kind: PipelineResource
+    - name: path-to-dockerfile
-metadata:
+      value: _CI-CD/debian-stable-build-essential/Dockerfile
-  name: img-debian-stable-build-essential
+    - name: image-name
-spec:
-  type: image
-  params:
-    - name: url
       value: cr.lan/debian-stable-build-essential
----
+  workspaces:
-apiVersion: tekton.dev/v1beta1
+      - name: git-source
-kind: Task
+        persistentVolumeClaim:
-metadata:
+          claimName: tektoncd-workspaces
-  name: build-debian-stable-build-essential
+        subPath: tekton/debian-stable-build-essential
-spec:
-  params:
-    - name: pathToContainerFile
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-stable-build-essential/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-stable-build-essential
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToContainerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --snapshotMode=redo
-        - --skip-tls-verify
-  #workspaces:
-  #  - name: workspace
-  #    mountPath: /workspace
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-debian-stable-build-essential
-spec:
-  taskRef:
-    name: build-debian-stable-build-essential
-  params:
-    - name: pathToContainerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-debian-stable-build-essential
-#  workspaces:
-#  - name: workspace
-#    persistentVolumeClaim:
-#      claimName: tektoncd-workspaces
-#    subPath: workspaces
-          
-          
-          

_CI-CD/debian-stable-php-fpm/Dockerfile

@@ -0,0 +1,19 @@
+FROM cr.lan/debian-stable
+
+ENV DEBIAN_FRONTEND noninteractive
+RUN apt-get update && apt-get install -y \
+	dnsutils procps nmap bash iputils-ping bash openssl \
+	php-fpm php-zip php-sqlite3 php-pgsql php-mysqli php-json php-readline \
+	php-xml php-ldap php-imap php-intl php-xmlrpc php-imagick php-gd php-cli php-curl \
+	php-bz2 php-mbstring php-memcache php-redis
+	
+#cleanup
+RUN	apt-get remove -y --purge man-db ;\
+	apt-get autoremove -y --purge ;\ 
+	apt-get clean -y ;\ 
+	rm -rf /var/lib/apt/lists/* ;\
+	rm -rf /var/cache/apt/*
+
+ADD etc_php-fpm/www.conf /etc/php/7.4/fpm/pool.d
+ADD docker-entrypoint.sh /
+ENTRYPOINT ["/docker-entrypoint.sh"]

_CI-CD/debian-stable-php-fpm/docker-entrypoint.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -e
+
+exec "$@"

_CI-CD/debian-stable-php-fpm/etc_php-fpm/www.conf

@@ -0,0 +1,440 @@
+; Start a new pool named 'www'.
+; the variable $pool can be used in any directive and will be replaced by the
+; pool name ('www' here)
+[www]
+
+; Per pool prefix
+; It only applies on the following directives:
+; - 'access.log'
+; - 'slowlog'
+; - 'listen' (unixsocket)
+; - 'chroot'
+; - 'chdir'
+; - 'php_values'
+; - 'php_admin_values'
+; When not set, the global prefix (or /usr) applies instead.
+; Note: This directive can also be relative to the global prefix.
+; Default Value: none
+;prefix = /path/to/pools/$pool
+
+; Unix user/group of processes
+; Note: The user is mandatory. If the group is not set, the default user's group
+;       will be used.
+user = www-data
+group = www-data
+
+; The address on which to accept FastCGI requests.
+; Valid syntaxes are:
+;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific IPv4 address on
+;                            a specific port;
+;   '[ip:6:addr:ess]:port' - to listen on a TCP socket to a specific IPv6 address on
+;                            a specific port;
+;   'port'                 - to listen on a TCP socket to all addresses
+;                            (IPv6 and IPv4-mapped) on a specific port;
+;   '/path/to/unix/socket' - to listen on a unix socket.
+; Note: This value is mandatory.
+; listen = /run/php/php7.4-fpm.sock
+listen = 127.0.0.1:9000
+
+; Set listen(2) backlog.
+; Default Value: 511 (-1 on FreeBSD and OpenBSD)
+;listen.backlog = 511
+
+; Set permissions for unix socket, if one is used. In Linux, read/write
+; permissions must be set in order to allow connections from a web server. Many
+; BSD-derived systems allow connections regardless of permissions. The owner
+; and group can be specified either by name or by their numeric IDs.
+; Default Values: user and group are set as the running user
+;                 mode is set to 0660
+listen.owner = www-data
+listen.group = www-data
+;listen.mode = 0660
+; When POSIX Access Control Lists are supported you can set them using
+; these options, value is a comma separated list of user/group names.
+; When set, listen.owner and listen.group are ignored
+;listen.acl_users =
+;listen.acl_groups =
+
+; List of addresses (IPv4/IPv6) of FastCGI clients which are allowed to connect.
+; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original
+; PHP FCGI (5.2.2+). Makes sense only with a tcp listening socket. Each address
+; must be separated by a comma. If this value is left blank, connections will be
+; accepted from any ip address.
+; Default Value: any
+;listen.allowed_clients = 127.0.0.1
+
+; Specify the nice(2) priority to apply to the pool processes (only if set)
+; The value can vary from -19 (highest priority) to 20 (lower priority)
+; Note: - It will only work if the FPM master process is launched as root
+;       - The pool processes will inherit the master process priority
+;         unless it specified otherwise
+; Default Value: no set
+; process.priority = -19
+
+; Set the process dumpable flag (PR_SET_DUMPABLE prctl) even if the process user
+; or group is differrent than the master process user. It allows to create process
+; core dump and ptrace the process for the pool user.
+; Default Value: no
+; process.dumpable = yes
+
+; Choose how the process manager will control the number of child processes.
+; Possible Values:
+;   static  - a fixed number (pm.max_children) of child processes;
+;   dynamic - the number of child processes are set dynamically based on the
+;             following directives. With this process management, there will be
+;             always at least 1 children.
+;             pm.max_children      - the maximum number of children that can
+;                                    be alive at the same time.
+;             pm.start_servers     - the number of children created on startup.
+;             pm.min_spare_servers - the minimum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is less than this
+;                                    number then some children will be created.
+;             pm.max_spare_servers - the maximum number of children in 'idle'
+;                                    state (waiting to process). If the number
+;                                    of 'idle' processes is greater than this
+;                                    number then some children will be killed.
+;  ondemand - no children are created at startup. Children will be forked when
+;             new requests will connect. The following parameter are used:
+;             pm.max_children           - the maximum number of children that
+;                                         can be alive at the same time.
+;             pm.process_idle_timeout   - The number of seconds after which
+;                                         an idle process will be killed.
+; Note: This value is mandatory.
+pm = dynamic
+
+; The number of child processes to be created when pm is set to 'static' and the
+; maximum number of child processes when pm is set to 'dynamic' or 'ondemand'.
+; This value sets the limit on the number of simultaneous requests that will be
+; served. Equivalent to the ApacheMaxClients directive with mpm_prefork.
+; Equivalent to the PHP_FCGI_CHILDREN environment variable in the original PHP
+; CGI. The below defaults are based on a server without much resources. Don't
+; forget to tweak pm.* to fit your needs.
+; Note: Used when pm is set to 'static', 'dynamic' or 'ondemand'
+; Note: This value is mandatory.
+pm.max_children = 5
+
+; The number of child processes created on startup.
+; Note: Used only when pm is set to 'dynamic'
+; Default Value: (min_spare_servers + max_spare_servers) / 2
+pm.start_servers = 2
+
+; The desired minimum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.min_spare_servers = 1
+
+; The desired maximum number of idle server processes.
+; Note: Used only when pm is set to 'dynamic'
+; Note: Mandatory when pm is set to 'dynamic'
+pm.max_spare_servers = 3
+
+; The number of seconds after which an idle process will be killed.
+; Note: Used only when pm is set to 'ondemand'
+; Default Value: 10s
+;pm.process_idle_timeout = 10s;
+
+; The number of requests each child process should execute before respawning.
+; This can be useful to work around memory leaks in 3rd party libraries. For
+; endless request processing specify '0'. Equivalent to PHP_FCGI_MAX_REQUESTS.
+; Default Value: 0
+;pm.max_requests = 500
+
+; The URI to view the FPM status page. If this value is not set, no URI will be
+; recognized as a status page. It shows the following informations:
+;   pool                 - the name of the pool;
+;   process manager      - static, dynamic or ondemand;
+;   start time           - the date and time FPM has started;
+;   start since          - number of seconds since FPM has started;
+;   accepted conn        - the number of request accepted by the pool;
+;   listen queue         - the number of request in the queue of pending
+;                          connections (see backlog in listen(2));
+;   max listen queue     - the maximum number of requests in the queue
+;                          of pending connections since FPM has started;
+;   listen queue len     - the size of the socket queue of pending connections;
+;   idle processes       - the number of idle processes;
+;   active processes     - the number of active processes;
+;   total processes      - the number of idle + active processes;
+;   max active processes - the maximum number of active processes since FPM
+;                          has started;
+;   max children reached - number of times, the process limit has been reached,
+;                          when pm tries to start more children (works only for
+;                          pm 'dynamic' and 'ondemand');
+; Value are updated in real time.
+; Example output:
+;   pool:                 www
+;   process manager:      static
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          62636
+;   accepted conn:        190460
+;   listen queue:         0
+;   max listen queue:     1
+;   listen queue len:     42
+;   idle processes:       4
+;   active processes:     11
+;   total processes:      15
+;   max active processes: 12
+;   max children reached: 0
+;
+; By default the status page output is formatted as text/plain. Passing either
+; 'html', 'xml' or 'json' in the query string will return the corresponding
+; output syntax. Example:
+;   http://www.foo.bar/status
+;   http://www.foo.bar/status?json
+;   http://www.foo.bar/status?html
+;   http://www.foo.bar/status?xml
+;
+; By default the status page only outputs short status. Passing 'full' in the
+; query string will also return status for each pool process.
+; Example:
+;   http://www.foo.bar/status?full
+;   http://www.foo.bar/status?json&full
+;   http://www.foo.bar/status?html&full
+;   http://www.foo.bar/status?xml&full
+; The Full status returns for each process:
+;   pid                  - the PID of the process;
+;   state                - the state of the process (Idle, Running, ...);
+;   start time           - the date and time the process has started;
+;   start since          - the number of seconds since the process has started;
+;   requests             - the number of requests the process has served;
+;   request duration     - the duration in µs of the requests;
+;   request method       - the request method (GET, POST, ...);
+;   request URI          - the request URI with the query string;
+;   content length       - the content length of the request (only with POST);
+;   user                 - the user (PHP_AUTH_USER) (or '-' if not set);
+;   script               - the main script called (or '-' if not set);
+;   last request cpu     - the %cpu the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because CPU calculation is done when the request
+;                          processing has terminated;
+;   last request memory  - the max amount of memory the last request consumed
+;                          it's always 0 if the process is not in Idle state
+;                          because memory calculation is done when the request
+;                          processing has terminated;
+; If the process is in Idle state, then informations are related to the
+; last request the process has served. Otherwise informations are related to
+; the current request being served.
+; Example output:
+;   ************************
+;   pid:                  31330
+;   state:                Running
+;   start time:           01/Jul/2011:17:53:49 +0200
+;   start since:          63087
+;   requests:             12808
+;   request duration:     1250261
+;   request method:       GET
+;   request URI:          /test_mem.php?N=10000
+;   content length:       0
+;   user:                 -
+;   script:               /home/fat/web/docs/php/test_mem.php
+;   last request cpu:     0.00
+;   last request memory:  0
+;
+; Note: There is a real-time FPM status monitoring sample web page available
+;       It's available in: /usr/share/php/7.4/fpm/status.html
+;
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;pm.status_path = /status
+
+; The ping URI to call the monitoring page of FPM. If this value is not set, no
+; URI will be recognized as a ping page. This could be used to test from outside
+; that FPM is alive and responding, or to
+; - create a graph of FPM availability (rrd or such);
+; - remove a server from a group if it is not responding (load balancing);
+; - trigger alerts for the operating team (24/7).
+; Note: The value must start with a leading slash (/). The value can be
+;       anything, but it may not be a good idea to use the .php extension or it
+;       may conflict with a real PHP file.
+; Default Value: not set
+;ping.path = /ping
+
+; This directive may be used to customize the response of a ping request. The
+; response is formatted as text/plain with a 200 response code.
+; Default Value: pong
+;ping.response = pong
+
+; The access log file
+; Default: not set
+;access.log = log/$pool.access.log
+
+; The access log format.
+; The following syntax is allowed
+;  %%: the '%' character
+;  %C: %CPU used by the request
+;      it can accept the following format:
+;      - %{user}C for user CPU only
+;      - %{system}C for system CPU only
+;      - %{total}C  for user + system CPU (default)
+;  %d: time taken to serve the request
+;      it can accept the following format:
+;      - %{seconds}d (default)
+;      - %{miliseconds}d
+;      - %{mili}d
+;      - %{microseconds}d
+;      - %{micro}d
+;  %e: an environment variable (same as $_ENV or $_SERVER)
+;      it must be associated with embraces to specify the name of the env
+;      variable. Some exemples:
+;      - server specifics like: %{REQUEST_METHOD}e or %{SERVER_PROTOCOL}e
+;      - HTTP headers like: %{HTTP_HOST}e or %{HTTP_USER_AGENT}e
+;  %f: script filename
+;  %l: content-length of the request (for POST request only)
+;  %m: request method
+;  %M: peak of memory allocated by PHP
+;      it can accept the following format:
+;      - %{bytes}M (default)
+;      - %{kilobytes}M
+;      - %{kilo}M
+;      - %{megabytes}M
+;      - %{mega}M
+;  %n: pool name
+;  %o: output header
+;      it must be associated with embraces to specify the name of the header:
+;      - %{Content-Type}o
+;      - %{X-Powered-By}o
+;      - %{Transfert-Encoding}o
+;      - ....
+;  %p: PID of the child that serviced the request
+;  %P: PID of the parent of the child that serviced the request
+;  %q: the query string
+;  %Q: the '?' character if query string exists
+;  %r: the request URI (without the query string, see %q and %Q)
+;  %R: remote IP address
+;  %s: status (response code)
+;  %t: server time the request was received
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %T: time the log has been written (the request has finished)
+;      it can accept a strftime(3) format:
+;      %d/%b/%Y:%H:%M:%S %z (default)
+;      The strftime(3) format must be encapsuled in a %{<strftime_format>}t tag
+;      e.g. for a ISO8601 formatted timestring, use: %{%Y-%m-%dT%H:%M:%S%z}t
+;  %u: remote user
+;
+; Default: "%R - %u %t \"%m %r\" %s"
+;access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
+
+; The log file for slow requests
+; Default Value: not set
+; Note: slowlog is mandatory if request_slowlog_timeout is set
+;slowlog = log/$pool.log.slow
+
+; The timeout for serving a single request after which a PHP backtrace will be
+; dumped to the 'slowlog' file. A value of '0s' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_slowlog_timeout = 0
+
+; Depth of slow log stack trace.
+; Default Value: 20
+;request_slowlog_trace_depth = 20
+
+; The timeout for serving a single request after which the worker process will
+; be killed. This option should be used when the 'max_execution_time' ini option
+; does not stop script execution for some reason. A value of '0' means 'off'.
+; Available units: s(econds)(default), m(inutes), h(ours), or d(ays)
+; Default Value: 0
+;request_terminate_timeout = 0
+
+; The timeout set by 'request_terminate_timeout' ini option is not engaged after
+; application calls 'fastcgi_finish_request' or when application has finished and
+; shutdown functions are being called (registered via register_shutdown_function).
+; This option will enable timeout limit to be applied unconditionally
+; even in such cases.
+; Default Value: no
+;request_terminate_timeout_track_finished = no
+
+; Set open file descriptor rlimit.
+; Default Value: system defined value
+;rlimit_files = 1024
+
+; Set max core size rlimit.
+; Possible Values: 'unlimited' or an integer greater or equal to 0
+; Default Value: system defined value
+;rlimit_core = 0
+
+; Chroot to this directory at the start. This value must be defined as an
+; absolute path. When this value is not set, chroot is not used.
+; Note: you can prefix with '$prefix' to chroot to the pool prefix or one
+; of its subdirectories. If the pool prefix is not set, the global prefix
+; will be used instead.
+; Note: chrooting is a great security feature and should be used whenever
+;       possible. However, all PHP paths will be relative to the chroot
+;       (error_log, sessions.save_path, ...).
+; Default Value: not set
+;chroot =
+
+; Chdir to this directory at the start.
+; Note: relative path can be used.
+; Default Value: current directory or / when chroot
+;chdir = /var/www
+
+; Redirect worker stdout and stderr into main error log. If not set, stdout and
+; stderr will be redirected to /dev/null according to FastCGI specs.
+; Note: on highloaded environement, this can cause some delay in the page
+; process time (several ms).
+; Default Value: no
+;catch_workers_output = yes
+
+; Decorate worker output with prefix and suffix containing information about
+; the child that writes to the log and if stdout or stderr is used as well as
+; log level and time. This options is used only if catch_workers_output is yes.
+; Settings to "no" will output data as written to the stdout or stderr.
+; Default value: yes
+;decorate_workers_output = no
+
+; Clear environment in FPM workers
+; Prevents arbitrary environment variables from reaching FPM worker processes
+; by clearing the environment in workers before env vars specified in this
+; pool configuration are added.
+; Setting to "no" will make all environment variables available to PHP code
+; via getenv(), $_ENV and $_SERVER.
+; Default Value: yes
+;clear_env = no
+
+; Limits the extensions of the main script FPM will allow to parse. This can
+; prevent configuration mistakes on the web server side. You should only limit
+; FPM to .php extensions to prevent malicious users to use other extensions to
+; execute php code.
+; Note: set an empty value to allow all extensions.
+; Default Value: .php
+;security.limit_extensions = .php .php3 .php4 .php5 .php7
+
+; Pass environment variables like LD_LIBRARY_PATH. All $VARIABLEs are taken from
+; the current environment.
+; Default Value: clean env
+;env[HOSTNAME] = $HOSTNAME
+;env[PATH] = /usr/local/bin:/usr/bin:/bin
+;env[TMP] = /tmp
+;env[TMPDIR] = /tmp
+;env[TEMP] = /tmp
+
+; Additional php.ini defines, specific to this pool of workers. These settings
+; overwrite the values previously defined in the php.ini. The directives are the
+; same as the PHP SAPI:
+;   php_value/php_flag             - you can set classic ini defines which can
+;                                    be overwritten from PHP call 'ini_set'.
+;   php_admin_value/php_admin_flag - these directives won't be overwritten by
+;                                     PHP call 'ini_set'
+; For php_*flag, valid values are on, off, 1, 0, true, false, yes or no.
+
+; Defining 'extension' will load the corresponding shared extension from
+; extension_dir. Defining 'disable_functions' or 'disable_classes' will not
+; overwrite previously defined php.ini values, but will append the new value
+; instead.
+
+; Note: path INI options can be relative and will be expanded with the prefix
+; (pool, global or /usr)
+
+; Default Value: nothing is defined by default except the values in php.ini and
+;                specified at startup with the -d argument
+;php_admin_value[sendmail_path] = /usr/sbin/sendmail -t -i -f www@my.domain.com
+;php_flag[display_errors] = off
+;php_admin_value[error_log] = /var/log/fpm-php.www.log
+;php_admin_flag[log_errors] = on
+;php_admin_value[memory_limit] = 32M

_CI-CD/debian-stable-php-fpm/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-debian-stable-php-fpm
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: _CI-CD/debian-stable-php-fpm
+    - name: path-to-dockerfile
+      value: _CI-CD/debian-stable-php-fpm/Dockerfile
+    - name: image-name
+      value: cr.lan/debian-stable-php-fpm
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/debian-stable-php-fpm

_CI-CD/debian-stable/Dockerfile

@@ -4,8 +4,11 @@ RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.li
 	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
 	apt-get update && apt-get install -y \
 	dnsutils procps nmap bash iputils-ping bash && \
-	apt-get clean -y && \ 
+
-	rm -rf /var/lib/apt/lists/* && \
+RUN	apt-get remove -y --purge man-db ;\
+	apt-get autoremove -y --purge ;\ 
+	apt-get clean -y ;\ 
+	rm -rf /var/lib/apt/lists/* ;\
 	rm -rf /var/cache/apt/*
 ADD docker-entrypoint.sh /
 ENTRYPOINT ["/docker-entrypoint.sh"]

_CI-CD/debian-stable/tekton-debian-stable.yaml

@@ -1,85 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-debian-stable
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/debian-stable
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-debian-stable
-spec:
-  params:
-    - name: pathToContainerFile
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-stable/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-stable
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToContainerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --snapshotMode=redo
-        - --skip-tls-verify
-  #workspaces:
-  #  - name: workspace
-  #    mountPath: /workspace
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-debian-stable
-spec:
-  taskRef:
-    name: build-debian-stable
-  params:
-    - name: pathToContainerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-debian-stable
-#  workspaces:
-#  - name: workspace
-#    persistentVolumeClaim:
-#      claimName: tektoncd-workspaces
-#    subPath: workspaces
-          
-          
-          

_CI-CD/debian-stable/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-debian-stable
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: _CI-CD/debian-stable
+    - name: path-to-dockerfile
+      value: _CI-CD/debian-stable/Dockerfile
+    - name: image-name
+      value: cr.lan/debian-stable
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/debian-stable

_CI-CD/debian-testing/Dockerfile

@@ -3,9 +3,13 @@ FROM debian:testing-slim
 RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
 	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
 	apt-get update && apt-get install -y \
-	dnsutils procps nmap bash iputils-ping bash && \
+	dnsutils procps nmap bash iputils-ping bash
-	apt-get clean -y && \ 
+
-	rm -rf /var/lib/apt/lists/* && \
+RUN	apt-get remove -y --purge man-db ;\
+	apt-get autoremove -y --purge ;\ 
+	apt-get clean -y ;\ 
+	rm -rf /var/lib/apt/lists/* ;\
 	rm -rf /var/cache/apt/*
+	
 ADD docker-entrypoint.sh /
 ENTRYPOINT ["/docker-entrypoint.sh"]

_CI-CD/debian-testing/tekton-debian-testing.yaml

@@ -1,85 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-debian-testing
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/debian-testing
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-debian-testing
-spec:
-  params:
-    - name: pathToContainerFile
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-testing/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/_CI-CD/debian-testing
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToContainerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --snapshotMode=redo
-        - --skip-tls-verify
-  #workspaces:
-  #  - name: workspace
-  #    mountPath: /workspace
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-debian-testing
-spec:
-  taskRef:
-    name: build-debian-testing
-  params:
-    - name: pathToContainerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-debian-testing
-#  workspaces:
-#  - name: workspace
-#    persistentVolumeClaim:
-#      claimName: tektoncd-workspaces
-#    subPath: workspaces
-          
-          
-          

_CI-CD/debian-testing/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-debian-testing
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: _CI-CD/debian-testing
+    - name: path-to-dockerfile
+      value: _CI-CD/debian-testing/Dockerfile
+    - name: image-name
+      value: cr.lan/debian-testing
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/debian-testing

_CI-CD/distcc/Dockerfile

@@ -1,18 +1,19 @@
-FROM debian:stable-slim
+FROM cr.lan/debian-stable-build-essential
 
-RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
+RUN apt-get update && \
-	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
-	apt-get update && \
   	apt-get install -y \
     gcc-arm-linux-gnueabihf g++-arm-linux-gnueabihf \
-    multiarch-support dpkg-dev distcc ccache \
+    dpkg-dev distcc ccache \
-    build-essential gcc cpp g++ clang llvm && \
+    build-essential gcc cpp g++ clang llvm 
-	apt-get clean -y && \ 
-	rm -rf /var/lib/apt/lists/*; \
-	rm -rf /var/cache/apt/*; \
-	#removing distcc conf, no zeroconf
-	rm -fv /etc/distcc/hosts
 	
+	
+	
+RUN	apt-get remove -y --purge man-db ;\
+	apt-get autoremove -y --purge ;\ 
+	apt-get clean -y ;\ 
+	rm -rf /var/lib/apt/lists/* ;\
+	rm -rf /var/cache/apt/*
+		
 # Op port
 EXPOSE 3632
 # Stats port

_CI-CD/distcc/tekton-image-build.yaml

@@ -1,76 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-distcc
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/distcc
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-distcc
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/distcc/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/distcc
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-distcc
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-distcc
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-distcc
-          
-          

_CI-CD/distcc/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-distcc
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: _CI-CD/distcc
+    - name: path-to-dockerfile
+      value: _CI-CD/distcc/Dockerfile
+    - name: image-name
+      value: cr.lan/distcc
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/distcc

_CI-CD/tekton-pvc.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: tektoncd-workspaces
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 40Gi
+  storageClassName: nfs-ssd-ebin02
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: tektoncd-workspaces 
+spec:
+  storageClassName: "nfs-ssd-ebin02"
+  nfs:
+    path: /data/raid1-ssd/k8s-data/tektoncd-workspaces
+    server: ebin02
+  capacity:
+    storage: 40Gi
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    kind: PersistentVolumeClaim
+    name: tektoncd-workspaces
+    namespace: default

_CI-CD/tektoncd-git-clone-task.yaml

@@ -0,0 +1,101 @@
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: git-clone
+spec:
+  workspaces:
+    - name: output
+      description: The git repo will be cloned onto the volume backing this workspace
+  params:
+    - name: url
+      description: git url to clone
+      type: string
+      default: http://git-ui.lan/chaos/kubernetes.git
+    - name: revision
+      description: git revision to checkout (branch, tag, sha, ref…)
+      type: string
+      default: master
+    - name: refspec
+      description: (optional) git refspec to fetch before checking out revision
+      default: ""
+    - name: submodules
+      description: defines if the resource should initialize and fetch the submodules
+      type: string
+      default: "true"
+    - name: depth
+      description: performs a shallow clone where only the most recent commit(s) will be fetched
+      type: string
+      default: "1"
+    - name: sslVerify
+      description: defines if http.sslVerify should be set to true or false in the global git config
+      type: string
+      default: "true"
+    - name: subdirectory
+      description: subdirectory inside the "output" workspace to clone the git repo into
+      type: string
+      default: ""
+    - name: deleteExisting
+      description: clean out the contents of the repo's destination directory (if it already exists) before trying to clone the repo there
+      type: string
+      default: "true"
+    - name: httpProxy
+      description: git HTTP proxy server for non-SSL requests
+      type: string
+      default: ""
+    - name: httpsProxy
+      description: git HTTPS proxy server for SSL requests
+      type: string
+      default: ""
+    - name: noProxy
+      description: git no proxy - opt out of proxying HTTP/HTTPS requests
+      type: string
+      default: ""
+  results:
+    - name: commit
+      description: The precise commit SHA that was fetched by this Task
+  steps:
+    - name: clone
+      image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.30.2
+      script: |
+        CHECKOUT_DIR="$(workspaces.output.path)/$(params.subdirectory)"
+
+        cleandir() {
+          # Delete any existing contents of the repo directory if it exists.
+          #
+          # We don't just "rm -rf $CHECKOUT_DIR" because $CHECKOUT_DIR might be "/"
+          # or the root of a mounted volume.
+          if [[ -d "$CHECKOUT_DIR" ]] ; then
+            # Delete non-hidden files and directories
+            rm -rf "$CHECKOUT_DIR"/*
+            # Delete files and directories starting with . but excluding ..
+            rm -rf "$CHECKOUT_DIR"/.[!.]*
+            # Delete files and directories starting with .. plus any other character
+            rm -rf "$CHECKOUT_DIR"/..?*
+          fi
+        }
+
+        if [[ "$(params.deleteExisting)" == "true" ]] ; then
+          cleandir
+        fi
+
+        test -z "$(params.httpProxy)" || export HTTP_PROXY=$(params.httpProxy)
+        test -z "$(params.httpsProxy)" || export HTTPS_PROXY=$(params.httpsProxy)
+        test -z "$(params.noProxy)" || export NO_PROXY=$(params.noProxy)
+
+        /ko-app/git-init \
+          -url "$(params.url)" \
+          -revision "$(params.revision)" \
+          -refspec "$(params.refspec)" \
+          -path "$CHECKOUT_DIR" \
+          -sslVerify="$(params.sslVerify)" \
+          -submodules="$(params.submodules)" \
+          -depth "$(params.depth)"
+        cd "$CHECKOUT_DIR"
+        RESULT_SHA="$(git rev-parse HEAD | tr -d '\n')"
+        EXIT_CODE="$?"
+        if [ "$EXIT_CODE" != 0 ]
+        then
+          exit $EXIT_CODE
+        fi
+        # Make sure we don't add a trailing newline to the result!
+        echo -n "$RESULT_SHA" > $(results.commit.path)

_CI-CD/tektoncd-kaniko-pipeline.yaml

@@ -0,0 +1,45 @@
+apiVersion: tekton.dev/v1beta1
+kind: Pipeline
+metadata:
+  name: kaniko
+spec:
+  params:
+    - name: git-url
+    - name: git-revision
+    - name: image-name
+    - name: path-to-image-context
+    - name: path-to-dockerfile
+  workspaces:
+    - name: git-source
+  tasks:
+    - name: fetch-from-git
+      taskRef:
+        name: git-clone
+      params:
+        - name: url
+          value: $(params.git-url)
+        - name: revision
+          value: $(params.git-revision)
+        - name: submodules
+          value: false
+        - subdirectory:
+          value: "source"
+      workspaces:
+        - name: source
+          workspace: git-source
+    - name: build-image
+      taskRef:
+        name: kaniko
+      params:
+        - name: IMAGE
+          value: $(params.image-name)
+        - name: CONTEXT
+          value: $(params.path-to-image-context)
+        - name: DOCKERFILE
+          value: $(params.path-to-dockerfile)
+      workspaces:
+        - name: source
+          workspace: git-source
+  # If you want you can add a Task that uses the IMAGE_DIGEST from the kaniko task
+  # via $(tasks.build-image.results.IMAGE_DIGEST) - this was a feature we hadn't been
+  # able to fully deliver with the Image PipelineResource!

_CI-CD/tektoncd-kaniko-task.yaml

@@ -0,0 +1,78 @@
+apiVersion: tekton.dev/v1beta1
+kind: Task
+metadata:
+  name: kaniko
+  labels:
+    app.kubernetes.io/version: "0.5"
+  annotations:
+    tekton.dev/pipelines.minVersion: "0.17.0"
+    tekton.dev/categories: Image Build
+    tekton.dev/tags: image-build
+    tekton.dev/displayName: "Build and upload container image using Kaniko"
+    tekton.dev/platforms: "linux/arm64"
+spec:
+  description: >-
+    This Task builds source into a container image using Google's kaniko tool.
+
+    Kaniko doesn't depend on a Docker daemon and executes each
+    command within a Dockerfile completely in userspace. This enables
+    building container images in environments that can't easily or
+    securely run a Docker daemon, such as a standard Kubernetes cluster.
+
+  params:
+  - name: IMAGE
+    description: Name (reference) of the image to build.
+  - name: DOCKERFILE
+    description: Path to the Dockerfile to build.
+    default: ./Dockerfile
+  - name: CONTEXT
+    description: The build context used by Kaniko.
+    default: ./
+  - name: EXTRA_ARGS
+    type: array
+    default: []
+  - name: BUILDER_IMAGE
+    description: The image on which builds will run (default is v1.5.1)
+    default: gcr.io/kaniko-project/executor:v1.9.1
+  workspaces:
+  - name: source
+    description: Holds the context and docker file
+  - name: dockerconfig
+    description: Includes a docker `config.json`
+    optional: true
+    mountPath: /kaniko/.docker
+  results:
+  - name: IMAGE-DIGEST
+    description: Digest of the image just built.
+
+  steps:
+  - name: debug
+    workingDir: $(workspaces.source.path)
+    image: bash
+    script: |
+      #!/usr/bin/env bash
+      export
+      pwd
+      mount
+      ls -al
+  - name: build-and-push
+    workingDir: $(workspaces.source.path)
+    image: $(params.BUILDER_IMAGE)
+    args:
+    - $(params.EXTRA_ARGS[*])
+    - --dockerfile=$(params.DOCKERFILE)
+    - --context=$(params.CONTEXT)  # The user does not need to care the workspace and the source.
+    - --destination=$(params.IMAGE)
+    - --digest-file=/tekton/results/IMAGE-DIGEST
+    - --snapshotMode=redo
+    - --single-snapshot
+    - --use-new-run
+    - --skip-tls-verify
+    - --cache
+    - --cache-copy-layers
+    - --cache-dir=/workspace/cache
+    # kaniko assumes it is running as root, which means this example fails on platforms
+    # that default to run containers as random uid (like OpenShift). Adding this securityContext
+    # makes it explicit that it needs to run as root.
+    securityContext:
+      runAsUser: 0

_sys/README.md

@@ -1,3 +1,87 @@
+Upgrade:
+
+```
+export KV=1.26.0-00;
+apt-mark unhold kubeadm=$KV kubectl=$KV kubelet=$KV;
+apt install -y kubeadm=$KV;
+```
+
+```
+kubeadm upgrade node #Other pines in the wood
+```
+
+```
+#pine01
+kubeadm upgrade plan --ignore-preflight-errors=CoreDNSUnsupportedPlugins;
+kubeadm config images pull;
+kubeadm upgrade apply ${KV/\-*/} --ignore-preflight-errors=CoreDNSUnsupportedPlugins --certificate-renewal=false; #sometimes true
+```
+
+```
+apt install kubectl=$KV kubelet=$KV;
+systemctl daemon-reload && systemctl restart kubelet;
+apt-mark hold kubeadm=$KV kubectl=$KV kubelet=$KV;
+echo 'You can now uncordon, der Geraet'; 
+```
+
+
+
+# Infos:
+
+```
+$ kubectl -n kube-system get cm kubeadm-config -o yaml
+apiVersion: v1
+data:
+  ClusterConfiguration: |
+    apiServer:
+      extraArgs:
+        authorization-mode: Node,RBAC
+      timeoutForControlPlane: 4m0s
+    apiVersion: kubeadm.k8s.io/v1beta3
+    certificatesDir: /etc/kubernetes/pki
+    clusterName: kubernetes
+    controllerManager: {}
+    dns: {}
+    etcd:
+      local:
+        dataDir: /var/lib/etcd
+    imageRepository: registry.k8s.io
+    kind: ClusterConfiguration
+    kubernetesVersion: v1.23.15
+    networking:
+      dnsDomain: cluster.local
+      podSubnet: 172.23.0.0/16
+      serviceSubnet: 10.96.0.0/12
+    scheduler: {}
+  ClusterStatus: |
+    apiEndpoints:
+      pine01:
+        advertiseAddress: 172.16.23.21
+        bindPort: 6443
+    apiVersion: kubeadm.k8s.io/v1beta2
+    kind: ClusterStatus
+kind: ConfigMap
+metadata:
+  creationTimestamp: "2021-01-20T14:55:12Z"
+  managedFields:
+  - apiVersion: v1
+    fieldsType: FieldsV1
+    fieldsV1:
+      f:data:
+        .: {}
+        f:ClusterConfiguration: {}
+        f:ClusterStatus: {}
+    manager: kubeadm
+    operation: Update
+    time: "2021-01-20T14:55:12Z"
+  name: kubeadm-config
+  namespace: kube-system
+  resourceVersion: "441685033"
+  uid: c70fefd3-02c3-44c8-a37d-7b17ec445455
+```
+
+
+
 Descheduler (reschedule pods)
 # https://github.com/kubernetes-sigs/descheduler
 # kubectl apply -n kube-system -f https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/kubernetes/base/rbac.yaml

_sys/coredns-1.26-x.yaml

@@ -0,0 +1,122 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coredns
+  namespace: kube-system
+  uid: 7bf78c83-68ac-4dee-95f6-52964e38e2d3
+  resourceVersion: '441765420'
+  generation: 37
+  creationTimestamp: '2021-01-20T14:55:14Z'
+  labels:
+    k8s-app: kube-dns
+  annotations:
+    deployment.kubernetes.io/revision: '34'
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      k8s-app: kube-dns
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        k8s-app: kube-dns
+    spec:
+      volumes:
+        - name: config-volume
+          configMap:
+            name: coredns
+            items:
+              - key: Corefile
+                path: Corefile
+            defaultMode: 420
+      containers:
+        - name: coredns
+          image: registry.k8s.io/coredns/coredns:v1.9.3
+          args:
+            - '-conf'
+            - /etc/coredns/Corefile
+          ports:
+            - name: dns
+              containerPort: 53
+              protocol: UDP
+            - name: dns-tcp
+              containerPort: 53
+              protocol: TCP
+            - name: metrics
+              containerPort: 9153
+              protocol: TCP
+          resources:
+            limits:
+              memory: 170Mi
+            requests:
+              cpu: 100m
+              memory: 70Mi
+          volumeMounts:
+            - name: config-volume
+              readOnly: true
+              mountPath: /etc/coredns
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 60
+            timeoutSeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 5
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8181
+              scheme: HTTP
+            timeoutSeconds: 1
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 3
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            capabilities:
+              add:
+                - NET_BIND_SERVICE
+              drop:
+                - all
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 30
+      dnsPolicy: Default
+      nodeSelector:
+        kubernetes.io/os: linux
+      serviceAccountName: coredns
+      serviceAccount: coredns
+      securityContext: {}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchExpressions:
+                    - key: k8s-app
+                      operator: In
+                      values:
+                        - kube-dns
+                topologyKey: kubernetes.io/hostname
+      schedulerName: default-scheduler
+      tolerations:
+        - key: CriticalAddonsOnly
+          operator: Exists
+        - key: node-role.kubernetes.io/control-plane
+          effect: NoSchedule
+      priorityClassName: system-cluster-critical
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 25%
+  revisionHistoryLimit: 10
+  progressDeadlineSeconds: 600

_sys/coredns-deployment.yaml

@@ -0,0 +1,202 @@
+kind: ConfigMap
+metadata:
+  name: coredns
+  namespace: kube-system
+apiVersion: v1
+data:
+  Corefile: |
+    .:53 {
+        errors
+        health {
+           lameduck 5s
+        }
+        ready
+        kubernetes cluster.local in-addr.arpa ip6.arpa {
+           pods insecure
+           fallthrough in-addr.arpa ip6.arpa
+           ttl 30
+        }
+        file /etc/coredns/lan.db lan
+        prometheus :9153
+        forward . /etc/resolv.conf {
+           max_concurrent 1000
+        }
+        cache 30
+        loop
+        reload
+        loadbalance
+    }
+  lan.db: |
+    ;lan. zone file
+    $ORIGIN lan.
+    @    600  IN  SOA   sns.dns.icann.org. noc.dns.icann.org. 2022032201 7200 600 1209600 600
+    3600 IN  NS    172.23.255.252
+    ns            IN  A    172.23.255.252
+    salt          IN  A     192.168.10.2 
+    mqtt          IN  A     172.16.23.1
+    www-proxy     IN  A     172.23.255.1
+    git           IN  A     172.23.255.2
+    postgresql    IN  A     172.23.255.4
+    mariadb       IN  A     172.23.255.5
+    redis         IN  A     172.23.255.6
+    pihole        IN  A     172.23.255.253
+    adm           IN CNAME adm01.wks.
+    
+    prometheus      IN    CNAME www-proxy 
+    alertmanager    IN    CNAME www-proxy
+    stats           IN    CNAME www-proxy
+    cr-ui           IN    CNAME www-proxy
+    apt             IN    CNAME www-proxy
+    apt-cache       IN    CNAME www-proxy
+    nodered         IN    CNAME www-proxy
+    foto            IN    CNAME www-proxy
+    musik           IN    CNAME www-proxy
+    hassio          IN    CNAME www-proxy
+    hassio-conf     IN    CNAME www-proxy  
+    git-ui          IN    CNAME www-proxy
+    grav            IN    CNAME www-proxy
+    tekton          IN    CNAME www-proxy
+    nc              IN    CNAME www-proxy
+    dolibarr        IN    CNAME www-proxy
+    auth            IN    CNAME www-proxy
+    public.auth     IN    CNAME www-proxy 
+    secure.auth     IN    CNAME www-proxy
+    docker-registry IN    CNAME adm
+    cr              IN    CNAME adm
+    dr-mirror       IN    CNAME adm
+    log             IN    CNAME adm
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dns-ext
+  namespace: kube-system
+spec:
+  ports:
+  - name: dns-udp
+    protocol: UDP
+    port: 53
+    targetPort: 53
+  selector:
+    k8s-app: kube-dns
+  type: LoadBalancer
+  loadBalancerIP: 172.23.255.252
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: coredns
+  labels:
+    k8s-app: kube-dns
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: kube-dns
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        k8s-app: kube-dns
+    spec:
+      containers:
+      - args:
+        - -conf
+        - /etc/coredns/Corefile
+        image:  registry.k8s.io/coredns/coredns:v1.9.3
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /health
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 60
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: coredns
+        ports:
+        - containerPort: 53
+          name: dns
+          protocol: UDP
+        - containerPort: 53
+          name: dns-tcp
+          protocol: TCP
+        - containerPort: 9153
+          name: metrics
+          protocol: TCP
+        livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+              scheme: HTTP
+            initialDelaySeconds: 60
+            timeoutSeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 5
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 8181
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            memory: 170Mi
+          requests:
+            cpu: 100m
+            memory: 70Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - all
+          readOnlyRootFilesystem: true
+          allowPrivilegeEscalation: false
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /etc/coredns
+          name: config-volume
+          readOnly: true
+      dnsPolicy: Default
+      nodeSelector:
+        kubernetes.io/os: linux
+      priorityClassName: system-cluster-critical
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      serviceAccount: coredns
+      serviceAccountName: coredns
+      terminationGracePeriodSeconds: 30
+      tolerations:
+      - key: CriticalAddonsOnly
+        operator: Exists
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/master
+      - effect: NoSchedule
+        key: node-role.kubernetes.io/control-plane
+      volumes:
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: Corefile
+            path: Corefile
+          - key: lan.db
+            path: lan.db
+          name: coredns
+        name: config-volume
+        

_sys/descheduler-cronjob.yaml

@@ -1,11 +1,11 @@
 ---
-apiVersion: batch/v1beta1
+apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: descheduler-cronjob
   namespace: kube-system
 spec:
-  schedule: "*/15 * * * *"
+  schedule: "*/50 * * * *"
   concurrencyPolicy: "Forbid"
   jobTemplate:
     spec:
@@ -16,7 +16,7 @@ spec:
           priorityClassName: system-cluster-critical
           containers:
           - name: descheduler
-            image: k8s.gcr.io/descheduler/descheduler:v0.22.0
+            image: k8s.gcr.io/descheduler/descheduler:v0.25.0
             volumeMounts:
             - mountPath: /policy-dir
               name: policy-volume

_sys/descheduler-policy-configmap.yaml

@@ -7,31 +7,28 @@ data:
   policy.yaml: |
     apiVersion: "descheduler/v1alpha1"
     kind: "DeschedulerPolicy"
+    maxNoOfPodsToEvictPerNode: 1
     strategies:
       "RemoveDuplicates":
          enabled: true
       "RemovePodsViolatingInterPodAntiAffinity":
-        enabled: true 
+        enabled: true
-      "HighNodeUtilization":
-         enabled: true
-         params:
-           nodeResourceUtilizationThresholds:
-             thresholds:
-               "cpu" : 20
-               "memory": 20
-               "pods": 8 
       "LowNodeUtilization":
          enabled: true
          params:
            nodeResourceUtilizationThresholds:
              thresholds:
-               "cpu": 50
+               "cpu": 20
-               "memory": 70
+               "memory": 40
-               "pods": 10 
+               "pods": 20 
              targetThresholds:
-               "cpu": 70
+               "cpu": 50
-               "memory": 70
+               "memory": 60
                "pods": 20
-           nodeFit: true
+           #nodeFit: true
+      "RemovePodsViolatingTopologySpreadConstraint":
+         enabled: true
+         params:
+             includeSoftConstraints: false
 
 

_sys/ingress-nginx.yaml

@@ -1,674 +0,0 @@
-
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ingress-nginx
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-
----
-# Source: ingress-nginx/templates/controller-serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx
-  namespace: ingress-nginx
-automountServiceAccountToken: true
----
-# Source: ingress-nginx/templates/controller-configmap.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-data:
----
-# Source: ingress-nginx/templates/clusterrole.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-  name: ingress-nginx
-rules:
-  - apiGroups:
-      - ''
-    resources:
-      - configmaps
-      - endpoints
-      - nodes
-      - pods
-      - secrets
-    verbs:
-      - list
-      - watch
-  - apiGroups:
-      - ''
-    resources:
-      - nodes
-    verbs:
-      - get
-  - apiGroups:
-      - ''
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ''
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
----
-# Source: ingress-nginx/templates/clusterrolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-  name: ingress-nginx
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ingress-nginx
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/controller-role.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx
-  namespace: ingress-nginx
-rules:
-  - apiGroups:
-      - ''
-    resources:
-      - namespaces
-    verbs:
-      - get
-  - apiGroups:
-      - ''
-    resources:
-      - configmaps
-      - pods
-      - secrets
-      - endpoints
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ''
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
-  - apiGroups:
-      - networking.k8s.io
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ''
-    resources:
-      - configmaps
-    resourceNames:
-      - ingress-controller-leader
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - ''
-    resources:
-      - configmaps
-    verbs:
-      - create
-  - apiGroups:
-      - ''
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
----
-# Source: ingress-nginx/templates/controller-rolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx
-  namespace: ingress-nginx
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ingress-nginx
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/controller-service-webhook.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller-admission
-  namespace: ingress-nginx
-spec:
-  type: ClusterIP
-  ports:
-    - name: https-webhook
-      port: 443
-      targetPort: webhook
-      appProtocol: https
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/component: controller
----
-# Source: ingress-nginx/templates/controller-service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-spec:
-  type: LoadBalancer
-  loadBalancerIP: 172.23.255.1
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-      appProtocol: http
-    - name: https
-      port: 443
-      protocol: TCP
-      targetPort: https
-      appProtocol: https
-  selector:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/component: controller
----
-# Source: ingress-nginx/templates/controller-deployment.yaml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: ingress-nginx-controller
-  namespace: ingress-nginx
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: ingress-nginx
-      app.kubernetes.io/component: controller
-  revisionHistoryLimit: 10
-  minReadySeconds: 0
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: ingress-nginx
-        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/component: controller
-    spec:
-      dnsPolicy: ClusterFirst
-      containers:
-        - name: controller
-          image: k8s.gcr.io/ingress-nginx/controller:v1.0.0@sha256:0851b34f69f69352bf168e6ccf30e1e20714a264ab1ecd1933e4d8c0fc3215c6
-          imagePullPolicy: IfNotPresent
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - /wait-shutdown
-          args:
-            - /nginx-ingress-controller
-            - --election-id=ingress-controller-leader
-            - --controller-class=k8s.io/ingress-nginx
-            - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
-            - --validating-webhook=:8443
-            - --validating-webhook-certificate=/usr/local/certificates/cert
-            - --validating-webhook-key=/usr/local/certificates/key
-          securityContext:
-            capabilities:
-              drop:
-                - ALL
-              add:
-                - NET_BIND_SERVICE
-            runAsUser: 101
-            allowPrivilegeEscalation: true
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: LD_PRELOAD
-              value: /usr/local/lib/libmimalloc.so
-          livenessProbe:
-            failureThreshold: 5
-            httpGet:
-              path: /healthz
-              port: 10254
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 1
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: /healthz
-              port: 10254
-              scheme: HTTP
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 1
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-            - name: https
-              containerPort: 443
-              protocol: TCP
-            - name: webhook
-              containerPort: 8443
-              protocol: TCP
-          volumeMounts:
-            - name: webhook-cert
-              mountPath: /usr/local/certificates/
-              readOnly: true
-          resources:
-            requests:
-              cpu: 100m
-              memory: 90Mi
-      nodeSelector:
-        kubernetes.io/os: linux
-      serviceAccountName: ingress-nginx
-      terminationGracePeriodSeconds: 300
-      volumes:
-        - name: webhook-cert
-          secret:
-            secretName: ingress-nginx-admission
----
-# Source: ingress-nginx/templates/controller-ingressclass.yaml
-# We don't support namespaced ingressClass yet
-# So a ClusterRole and a ClusterRoleBinding is required
-apiVersion: networking.k8s.io/v1
-kind: IngressClass
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: controller
-  name: nginx
-  namespace: ingress-nginx
-spec:
-  controller: k8s.io/ingress-nginx
----
-# Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
-# before changing this value, check the required kubernetes version
-# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
-apiVersion: admissionregistration.k8s.io/v1
-kind: ValidatingWebhookConfiguration
-metadata:
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-  name: ingress-nginx-admission
-webhooks:
-  - name: validate.nginx.ingress.kubernetes.io
-    matchPolicy: Equivalent
-    rules:
-      - apiGroups:
-          - networking.k8s.io
-        apiVersions:
-          - v1
-        operations:
-          - CREATE
-          - UPDATE
-        resources:
-          - ingresses
-    failurePolicy: Fail
-    sideEffects: None
-    admissionReviewVersions:
-      - v1
-    clientConfig:
-      service:
-        namespace: ingress-nginx
-        name: ingress-nginx-controller-admission
-        path: /networking/v1/ingresses
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ingress-nginx-admission
-  namespace: ingress-nginx
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: ingress-nginx-admission
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-rules:
-  - apiGroups:
-      - admissionregistration.k8s.io
-    resources:
-      - validatingwebhookconfigurations
-    verbs:
-      - get
-      - update
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: ingress-nginx-admission
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: ingress-nginx-admission
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx-admission
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: ingress-nginx-admission
-  namespace: ingress-nginx
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-rules:
-  - apiGroups:
-      - ''
-    resources:
-      - secrets
-    verbs:
-      - get
-      - create
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: ingress-nginx-admission
-  namespace: ingress-nginx
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: ingress-nginx-admission
-subjects:
-  - kind: ServiceAccount
-    name: ingress-nginx-admission
-    namespace: ingress-nginx
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ingress-nginx-admission-create
-  namespace: ingress-nginx
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-spec:
-  template:
-    metadata:
-      name: ingress-nginx-admission-create
-      labels:
-        helm.sh/chart: ingress-nginx-4.0.1
-        app.kubernetes.io/name: ingress-nginx
-        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: 1.0.0
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: admission-webhook
-    spec:
-      containers:
-        - name: create
-          image: k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.0@sha256:f3b6b39a6062328c095337b4cadcefd1612348fdd5190b1dcbcb9b9e90bd8068
-          imagePullPolicy: IfNotPresent
-          args:
-            - create
-            - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
-            - --namespace=$(POD_NAMESPACE)
-            - --secret-name=ingress-nginx-admission
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-      restartPolicy: OnFailure
-      serviceAccountName: ingress-nginx-admission
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 2000
----
-# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: ingress-nginx-admission-patch
-  namespace: ingress-nginx
-  annotations:
-    helm.sh/hook: post-install,post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    helm.sh/chart: ingress-nginx-4.0.1
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: 1.0.0
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-spec:
-  template:
-    metadata:
-      name: ingress-nginx-admission-patch
-      labels:
-        helm.sh/chart: ingress-nginx-4.0.1
-        app.kubernetes.io/name: ingress-nginx
-        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: 1.0.0
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/component: admission-webhook
-    spec:
-      containers:
-        - name: patch
-          image: k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.0@sha256:f3b6b39a6062328c095337b4cadcefd1612348fdd5190b1dcbcb9b9e90bd8068
-          imagePullPolicy: IfNotPresent
-          args:
-            - patch
-            - --webhook-name=ingress-nginx-admission
-            - --namespace=$(POD_NAMESPACE)
-            - --patch-mutating=false
-            - --secret-name=ingress-nginx-admission
-            - --patch-failure-policy=Fail
-          env:
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-      restartPolicy: OnFailure
-      serviceAccountName: ingress-nginx-admission
-      nodeSelector:
-        kubernetes.io/os: linux
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 2000

_sys/kube-flannel.yml

@@ -1,60 +1,16 @@
 ---
-apiVersion: policy/v1beta1
+kind: Namespace
-kind: PodSecurityPolicy
+apiVersion: v1
 metadata:
-  name: psp.flannel.unprivileged
+  name: kube-flannel
-  annotations:
+  labels:
-    seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default
+    pod-security.kubernetes.io/enforce: privileged
-    seccomp.security.alpha.kubernetes.io/defaultProfileName: docker/default
-    apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-    apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
-spec:
-  privileged: false
-  volumes:
-  - configMap
-  - secret
-  - emptyDir
-  - hostPath
-  allowedHostPaths:
-  - pathPrefix: "/etc/cni/net.d"
-  - pathPrefix: "/etc/kube-flannel"
-  - pathPrefix: "/run/flannel"
-  readOnlyRootFilesystem: false
-  # Users and groups
-  runAsUser:
-    rule: RunAsAny
-  supplementalGroups:
-    rule: RunAsAny
-  fsGroup:
-    rule: RunAsAny
-  # Privilege Escalation
-  allowPrivilegeEscalation: false
-  defaultAllowPrivilegeEscalation: false
-  # Capabilities
-  allowedCapabilities: ['NET_ADMIN', 'NET_RAW']
-  defaultAddCapabilities: []
-  requiredDropCapabilities: []
-  # Host namespaces
-  hostPID: false
-  hostIPC: false
-  hostNetwork: true
-  hostPorts:
-  - min: 0
-    max: 65535
-  # SELinux
-  seLinux:
-    # SELinux is unused in CaaSP
-    rule: 'RunAsAny'
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: flannel
 rules:
-- apiGroups: ['extensions']
-  resources: ['podsecuritypolicies']
-  verbs: ['use']
-  resourceNames: ['psp.flannel.unprivileged']
 - apiGroups:
   - ""
   resources:
@@ -66,6 +22,7 @@ rules:
   resources:
   - nodes
   verbs:
+  - get
   - list
   - watch
 - apiGroups:
@@ -86,19 +43,19 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: flannel
-  namespace: kube-system
+  namespace: kube-flannel
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: flannel
-  namespace: kube-system
+  namespace: kube-flannel
 ---
 kind: ConfigMap
 apiVersion: v1
 metadata:
   name: kube-flannel-cfg
-  namespace: kube-system
+  namespace: kube-flannel
   labels:
     tier: node
     app: flannel
@@ -135,7 +92,7 @@ apiVersion: apps/v1
 kind: DaemonSet
 metadata:
   name: kube-flannel-ds
-  namespace: kube-system
+  namespace: kube-flannel
   labels:
     tier: node
     app: flannel
@@ -165,8 +122,21 @@ spec:
         effect: NoSchedule
       serviceAccountName: flannel
       initContainers:
+      - name: install-cni-plugin
+       #image: flannelcni/flannel-cni-plugin:v1.1.0 for ppc64le and mips64le (dockerhub limitations may apply)
+        image: docker.io/rancher/mirrored-flannelcni-flannel-cni-plugin:v1.1.0
+        command:
+        - cp
+        args:
+        - -f
+        - /flannel
+        - /opt/cni/bin/flannel
+        volumeMounts:
+        - name: cni-plugin
+          mountPath: /opt/cni/bin
       - name: install-cni
-        image: quay.io/coreos/flannel:v0.14.0
+       #image: flannelcni/flannel:v0.20.2 for ppc64le and mips64le (dockerhub limitations may apply)
+        image: docker.io/rancher/mirrored-flannelcni-flannel:v0.20.2
         command:
         - cp
         args:
@@ -180,7 +150,8 @@ spec:
           mountPath: /etc/kube-flannel/
       containers:
       - name: kube-flannel
-        image: quay.io/coreos/flannel:v0.14.0
+       #image: flannelcni/flannel:v0.20.2 for ppc64le and mips64le (dockerhub limitations may apply)
+        image: docker.io/rancher/mirrored-flannelcni-flannel:v0.20.2
         command:
         - /opt/bin/flanneld
         args:
@@ -206,18 +177,29 @@ spec:
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
+        - name: EVENT_QUEUE_DEPTH
+          value: "5000"
         volumeMounts:
         - name: run
           mountPath: /run/flannel
         - name: flannel-cfg
           mountPath: /etc/kube-flannel/
+        - name: xtables-lock
+          mountPath: /run/xtables.lock
       volumes:
       - name: run
         hostPath:
           path: /run/flannel
+      - name: cni-plugin
+        hostPath:
+          path: /opt/cni/bin
       - name: cni
         hostPath:
           path: /etc/cni/net.d
       - name: flannel-cfg
         configMap:
           name: kube-flannel-cfg
+      - name: xtables-lock
+        hostPath:
+          path: /run/xtables.lock
+          type: FileOrCreate

_sys/nfs-provisioners/deployment-arm-deprecated.yaml

@@ -1,39 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nfs-client-provisioner
-  labels:
-    app: nfs-client-provisioner
-  # replace with namespace where provisioner is deployed
-  namespace: default
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: nfs-client-provisioner
-  template:
-    metadata:
-      labels:
-        app: nfs-client-provisioner
-    spec:
-      serviceAccountName: nfs-client-provisioner
-      containers:
-        - name: nfs-client-provisioner
-          image: quay.io/external_storage/nfs-client-provisioner-arm:latest
-          volumeMounts:
-            - name: nfs-client-root
-              mountPath: /persistentvolumes
-          env:
-            - name: PROVISIONER_NAME
-              value: nfs-ssd
-            - name: NFS_SERVER
-              value: ebin01
-            - name: NFS_PATH
-              value: /data/raid1-ssd/k8s-data
-      volumes:
-        - name: nfs-client-root
-          nfs:
-            server: ebin01
-            path: /data/raid1-ssd/k8s-data

_sys/nfs-provisioners/deployment_nfs-hdd-ebin01.yaml

@@ -2,8 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: nfs-hdd-ebin01
+  namespace: live-infra
   labels:
     app: nfs-hdd-ebin01
+    service: nfs
 spec:
   replicas: 1
   strategy:
@@ -19,7 +21,7 @@ spec:
       serviceAccountName: nfs-client-provisioner
       containers:
         - name: nfs-hdd-ebin01
-          image: quay.io/external_storage/nfs-client-provisioner-arm:latest
+          image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2
           volumeMounts:
             - name: nfs-client-root
               mountPath: /persistentvolumes
@@ -29,9 +31,19 @@ spec:
             - name: NFS_SERVER
               value: ebin01
             - name: NFS_PATH
-              value: /data/raid1-hdd/k8s-data
+              value: /data/k8s-data-hdd
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: service
+                operator: In
+                values:
+                - nfs
+            topologyKey: kubernetes.io/hostname
       volumes:
         - name: nfs-client-root
           nfs:
             server: ebin01
-            path: /data/raid1-hdd/k8s-data
+            path: /data/k8s-data-hdd

_sys/nfs-provisioners/deployment_nfs-ssd-ebin01.yaml

@@ -2,8 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: nfs-ssd-ebin01
+  namespace: live-infra
   labels:
     app: nfs-ssd-ebin01
+    service: nfs
 spec:
   replicas: 1
   strategy:
@@ -19,7 +21,7 @@ spec:
       serviceAccountName: nfs-client-provisioner
       containers:
         - name: nfs-ssd-ebin01
-          image: quay.io/external_storage/nfs-client-provisioner-arm:latest
+          image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2
           volumeMounts:
             - name: nfs-client-root
               mountPath: /persistentvolumes
@@ -30,6 +32,16 @@ spec:
               value: ebin01
             - name: NFS_PATH
               value: /data/raid1-ssd/k8s-data
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: service
+                operator: In
+                values:
+                - nfs
+            topologyKey: kubernetes.io/hostname
       volumes:
         - name: nfs-client-root
           nfs:

_sys/nfs-provisioners/deployment_nfs-ssd-ebin02.yaml

@@ -2,8 +2,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: nfs-ssd-ebin02
+  namespace: live-infra
   labels:
     app: nfs-ssd-ebin02
+    service: nfs
 spec:
   replicas: 1
   strategy:
@@ -19,7 +21,7 @@ spec:
       serviceAccountName: nfs-client-provisioner
       containers:
         - name: nfs-ssd-ebin02
-          image: quay.io/external_storage/nfs-client-provisioner-arm:latest
+          image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2
           volumeMounts:
             - name: nfs-client-root
               mountPath: /persistentvolumes
@@ -30,6 +32,16 @@ spec:
               value: ebin02
             - name: NFS_PATH
               value: /data/raid1-ssd/k8s-data
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: service
+                operator: In
+                values:
+                - nfs
+            topologyKey: kubernetes.io/hostname
       volumes:
         - name: nfs-client-root
           nfs:

apps/apt-cacher-ng/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:stable-slim
+FROM cr.lan/debian-stable
 
 RUN apt-get update && apt-get install -y \
 	apt-cacher-ng && \

apps/apt-cacher-ng/live-deployment.yaml

@@ -76,9 +76,30 @@ kind: PersistentVolumeClaim
 metadata:
   name: apt-cacher-volume 
 spec:
-  storageClassName: nfs-ssd 
+  storageClassName: nfs-ssd-ebin02
+  volumeName: apt-cacher-ng
   accessModes:
   - ReadWriteOnce
   resources:
     requests:
       storage: 40Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: apt-cacher-ng
+spec:
+  storageClassName: "nfs-ssd-ebin02"
+  nfs:
+    path: /data/raid1-ssd/k8s-data/apt-cacher-ng
+    server: ebin02
+  capacity:
+    storage: 40Gi
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    kind: PersistentVolumeClaim
+    name: apt-cacher-volume
+    namespace: live-infra

apps/apt-cacher-ng/tekton-image-build.yaml

@@ -1,76 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-apt-cacher-ng
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/apt-cacher-ng
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-apt-cacher-ng
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/apt-cacher-ng/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/apt-cacher-ng
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-apt-cacher-ng
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-apt-cacher-ng
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-apt-cacher-ng
-          
-          

apps/apt-cacher-ng/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-apt-cacher-ng
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/apt-cacher-ng
+    - name: path-to-dockerfile
+      value: apps/apt-cacher-ng/Dockerfile
+    - name: image-name
+      value: cr.lan/apt-cacher-ng
+  workspaces:
+    - name: git-source
+      persistentVolumeClaim:
+        claimName: tektoncd-workspaces
+      subPath: tekton/apt-cacher-ng

apps/apt-cacher-ng/test-deployment.yaml

@@ -1,73 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: apt-cacher-ng-test
-  namespace: test
-  labels:
-    app: apt-cacher-ng-test
-spec:
-  replicas: 1
-  selector:
-      matchLabels:
-          app: apt-cacher-ng-test
-  strategy:
-      type: Recreate
-  template:
-    metadata:
-        labels:
-            app: apt-cacher-ng-test
-    spec:
-      containers:
-        - name: apt-cacher-ng-test
-          image: docker-registry.lan/apt-cacher-ng:arm64
-          imagePullPolicy: Always
-          ports:
-            - containerPort: 3142
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /var/cache/apt-cacher-ng
-              name: data
-          resources:
-             requests: 
-                memory: 64Mi
-                cpu: 50m
-             limits:
-                memory: 128Mi
-                cpu: 100m
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-              claimName: apt-cacher-volume-test
-              #---
-              #apiVersion: v1
-              #kind: Service 
-              #metadata:
-              #  name: apt-cacher-ng
-              #  labels:
-              #    app: apt-cacher-ng
-              #spec:
-              #  type: LoadBalancer
-              #  loadBalancerIP: 172.23.255.1
-              #  ports:
-              #    - name: apt-cacher-ng
-              #      port: 3142
-              #      targetPort: 3142
-              #      protocol: TCP
-              #  selector:
-              #    app: apt-cacher-ng
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: apt-cacher-volume-test 
-  namespace: test
-  #annotations:
-  #  volume.beta.kubernetes.io/storage-class: "managed-nfs-storage"
-spec:
-  storageClassName: csi-s3-slow
-    #storageClassName: fast
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 40Gi

apps/authelia/README.md

@@ -0,0 +1,3 @@
+### Apply new config
+
+$ kubectl -n live-infra create configmap authelia-config --from-file=configMaps/ -o yaml --dry-run |kubectl apply -f -

apps/authelia/configMaps/configuration.yml

@@ -7,14 +7,14 @@
 ## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
 ## the system certificates store.
 ## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
-# certificates_directory: /config/certificates
+certificates_directory: /etc/pki/chain
 
 ## The theme to display: light, dark, grey, auto.
 theme: dark
 
 ## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
 ## set using a secret: https://www.authelia.com/docs/configuration/secrets.html
-jwt_secret: a_very_important_secret2
+jwt_secret: hAnFzapSCusyF2W83JAg6PRqc6v7iQvN7sP3PQ70HAbPBshJzAMz 
 
 ## Default redirection URL
 ##
@@ -60,10 +60,12 @@ server:
   ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
   tls:
     ## The path to the DER base64/PEM format private key.
+    #key: "/etc/pki/private.key"
     key: ""
 
     ## The path to the DER base64/PEM format public certificate.
-    certificate: ""
+    #certificate: "/etc/pki/auth.lan.crt"
+    certificate : ""
 
 ##
 ## Log Configuration
@@ -76,7 +78,7 @@ log:
   format: text
 
   ## File path where the logs will be written. If not set logs are written to stdout.
-  file_path: /config-nfs/authelia.log
+  file_path: "" #/config-nfs/authelia.log
 
   ## Whether to also log to stdout when a log_file_path is defined.
   # keep_stdout: false
@@ -241,12 +243,13 @@ authentication_backend:
   file:
     path: /config-nfs/users_database.yml
     password:
-      algorithm: argon2id
+      algorithm: sha512
-      iterations: 1
-      key_length: 32
       salt_length: 16
-      memory: 1024
+      #algorithm: argon2id
-      parallelism: 8
+      #iterations: 1
+      #key_length: 32
+      #memory: 32
+      #parallelism: 4
 ##
 ## Access Control Configuration
 ##

apps/authelia/deployment.yaml

@@ -24,7 +24,6 @@ spec:
       containers:
         - name: authelia
           image: authelia/authelia:latest
-          imagePullPolicy: IfNotPresent 
           env:
             #- name: AUTHELIA_SERVER_PORT
             #  value: "9091"
@@ -35,6 +34,8 @@ spec:
               mountPath: /config-nfs
             - name: authelia-config
               mountPath: /config
+            - name: pki
+              mountPath: /etc/pki
           ports:
             - name: http
               containerPort: 9091
@@ -65,6 +66,10 @@ spec:
           items:
           - key: configuration.yml
             path: configuration.yml
+      - name: pki
+        hostPath:
+          path: /etc/pki
+          type: Directory
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -112,6 +117,9 @@ spec:
       targetPort: http
       protocol: TCP
       name: http
+    - port: 443
+      targetPort: http
+      name: https
   selector:
       app: authelia
       release: latest
@@ -122,8 +130,8 @@ metadata:
     name: authelia
     annotations:
       kubernetes.io/ingress.class: nginx
-      nginx.ingress.kubernetes.io/auth-url: http://authelia.live-infra.svc.cluster.local/api/verify
+      nginx.ingress.kubernetes.io/auth-url: https://authelia.live-infra.svc.cluster.local/api/verify
-      nginx.ingress.kubernetes.io/auth-signin: http://auth.lan
+      nginx.ingress.kubernetes.io/auth-signin: https://auth.lan
       nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
       nginx.ingress.kubernetes.io/auth-snippet: |
         proxy_set_header X-Forwarded-Method $request_method;

apps/curl/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:stable-slim
+FROM cr.lan/debian-stable
 
 RUN apt-get update && apt-get install -y \
 	curl procps && \

apps/curl/tekton-image-build.yaml

@@ -1,76 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-curl
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/curl
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-curl
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/curl/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/curl
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-curl-taskrun
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-curl
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-curl
-          
-          

apps/curl/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-curl
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/curl
+    - name: path-to-dockerfile
+      value: apps/curl/Dockerfile
+    - name: image-name
+      value: cr.lan/curl
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/curl

apps/docker-registry/docker-registry-ui.yaml

@@ -20,8 +20,7 @@ spec:
     spec:
       containers:
         - name: registry-ui
-          #image: cr.lan/docker-registry-ui:arm64
+          image: docker.io/joxit/docker-registry-ui:latest
-          image: docker.io/joxit/docker-registry-ui:main-debian
           imagePullPolicy: Always
           env:
             - name: NGINX_PROXY_PASS_URL

apps/dolibarr/Dockerfile

@@ -0,0 +1,116 @@
+FROM cr.lan/debian-stable-php-fpm
+
+# see https://wiki.dolibarr.org/index.php/Dependencies_and_external_libraries
+# Prepare folders
+ENV DEBIAN_FRONTEND noninteractive
+RUN set -ex; \
+	apt-get update -q; \
+	apt-get install -y --no-install-recommends \
+		bzip2 \
+		default-mysql-client \
+		cron \
+		rsync \
+		unzip \
+		zip php-soap;\
+	mkdir -p /var/www/documents; \
+	chown -R www-data:root /var/www; \
+	chmod -R g=u /var/www
+
+# CLeanup	
+RUN	apt-get autoremove --purge -y && \
+	apt-get clean -y && \ 
+	rm -rf /var/lib/apt/lists/* && \
+	rm -rf /var/cache/apt/* /tmp/* /var/tmp/* /var/log/*
+	
+	
+VOLUME /var/www/html /var/www/documents /var/www/scripts
+
+# Runtime env var
+ENV DOLI_AUTO_CONFIGURE=1 \
+	DOLI_DB_TYPE=mysqli \
+	DOLI_DB_HOST= \
+	DOLI_DB_PORT=3306 \
+	DOLI_DB_USER=dolibarr \
+	DOLI_DB_PASSWORD='' \
+	DOLI_DB_NAME=dolibarr \
+	DOLI_DB_PREFIX=llx_ \
+	DOLI_DB_CHARACTER_SET=utf8 \
+	DOLI_DB_COLLATION=utf8_unicode_ci \
+	DOLI_DB_ROOT_LOGIN='' \
+	DOLI_DB_ROOT_PASSWORD='' \
+	DOLI_ADMIN_LOGIN=admin \
+	DOLI_MODULES='' \
+	DOLI_URL_ROOT='http://localhost' \
+	DOLI_AUTH=dolibarr \
+	DOLI_LDAP_HOST= \
+	DOLI_LDAP_PORT=389 \
+	DOLI_LDAP_VERSION=3 \
+	DOLI_LDAP_SERVERTYPE=openldap \
+	DOLI_LDAP_LOGIN_ATTRIBUTE=uid \
+	DOLI_LDAP_DN='' \
+	DOLI_LDAP_FILTER='' \
+	DOLI_LDAP_ADMIN_LOGIN='' \
+	DOLI_LDAP_ADMIN_PASS='' \
+	DOLI_LDAP_DEBUG=false \
+	DOLI_HTTPS=0 \
+	DOLI_PROD=0 \
+	DOLI_NO_CSRF_CHECK=0 \
+	WWW_USER_ID=33 \
+	WWW_GROUP_ID=33 \
+	PHP_INI_DATE_TIMEZONE='UTC' \
+	PHP_MEMORY_LIMIT=256M \
+	PHP_MAX_UPLOAD=20M \
+	PHP_MAX_EXECUTION_TIME=300
+
+# Build time env var
+ARG DOLI_VERSION=13.0.4
+
+# Get Dolibarr
+ADD https://github.com/Dolibarr/dolibarr/archive/${DOLI_VERSION}.zip /tmp/dolibarr.zip
+
+# Install Dolibarr from tag archive
+RUN set -ex; \
+	mkdir -p /tmp/dolibarr; \
+	unzip -q /tmp/dolibarr.zip -d /tmp/dolibarr; \
+	rm /tmp/dolibarr.zip; \
+	mkdir -p /usr/src/dolibarr; \
+	cp -r "/tmp/dolibarr/dolibarr-${DOLI_VERSION}"/* /usr/src/dolibarr; \
+	rm -rf /tmp/dolibarr; \
+	chmod +x /usr/src/dolibarr/scripts/*; \
+	echo "${DOLI_VERSION}" > /usr/src/dolibarr/.docker-image-version
+
+COPY entrypoint.sh /
+RUN set -ex; \
+	chmod 755 /entrypoint.sh ;\
+	mkdir -p /run/php
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["php-fpm7.4", "--nodaemonize", "-c", "/etc/php/7.4/fpm/php.ini", "--fpm-config", "/etc/php/7.4/fpm/php-fpm.conf"]
+
+# Arguments to label built container
+ARG VCS_REF
+ARG BUILD_DATE
+
+# Container labels (http://label-schema.org/)
+# Container annotations (https://github.com/opencontainers/image-spec)
+LABEL maintainer="Monogramm maintainers <opensource at monogramm dot io>" \
+	  product="Dolibarr" \
+	  version=${DOLI_VERSION} \
+	  org.label-schema.vcs-ref=${VCS_REF} \
+	  org.label-schema.vcs-url="https://github.com/Monogramm/docker-dolibarr" \
+	  org.label-schema.build-date=${BUILD_DATE} \
+	  org.label-schema.name="Dolibarr" \
+	  org.label-schema.description="Open Source ERP & CRM for Business" \
+	  org.label-schema.url="https://www.dolibarr.org/" \
+	  org.label-schema.vendor="Dolibarr" \
+	  org.label-schema.version=$DOLI_VERSION \
+	  org.label-schema.schema-version="1.0" \
+	  org.opencontainers.image.revision=${VCS_REF} \
+	  org.opencontainers.image.source="https://github.com/Monogramm/docker-dolibarr" \
+	  org.opencontainers.image.created=${BUILD_DATE} \
+	  org.opencontainers.image.title="Dolibarr" \
+	  org.opencontainers.image.description="Open Source ERP & CRM for Business" \
+	  org.opencontainers.image.url="https://www.dolibarr.org/" \
+	  org.opencontainers.image.vendor="Dolibarr" \
+	  org.opencontainers.image.version=${DOLI_VERSION} \
+	  org.opencontainers.image.authors="Monogramm maintainers <opensource at monogramm dot io>"

apps/dolibarr/README.md

@@ -0,0 +1,3 @@
+create nginx configmap
+
+ kubectl -n live-env create configmap dolibarr-nginx-site --from-file=nginx-site.configmap.conf

apps/dolibarr/deployment.yaml

@@ -0,0 +1,104 @@
+#we use postgresql:
+#create database dolibarr;
+#create user dolibarr with encrypted password 'secret';
+#grant all privileges on database dolibarr to dolibarr;
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dolibarr
+  labels:
+    app: dolibarr
+    release: latest
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dolibarr
+      release: latest
+  template:
+    metadata:
+      labels:
+        app: dolibarr
+        release: latest
+    spec:
+      volumes:
+        - name: dolibarr-nginx-site
+          configMap:
+            name: dolibarr-nginx-site
+        - name: www-data
+          emptyDir: {}
+      containers:
+        - name: nginx-proxy
+          image: nginx
+          volumeMounts:
+            - name: dolibarr-nginx-site
+              mountPath: /etc/nginx/conf.d
+            - name: www-data
+              mountPath: /var/www/html
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+        - name: dolibarr
+          image: cr.lan/dolibarr:latest
+          volumeMounts:
+            - name: www-data
+              mountPath: /var/www/html
+          env:
+            - name: TZ
+              value: "Europe/Berlin"
+            - name: DOLI_DB_HOST
+              value: postgres.live-env.svc.cluster.local
+            - name: DOLI_DB_PORT
+              value: "5432"
+            - name: DOLI_DB_NAME
+              value: dolibarr
+            - name: DOLI_DB_USER
+              value: dolibarr
+            - name: DOLI_DB_PASSWORD
+              value: Vb7yHzmE5HIjfU4hjghjghj6AnMdB
+            - name: DOLI_DB_TYPE
+              value: pgsql
+          ports:
+            - name: php-fpm
+              containerPort: 9000
+              protocol: TCP
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "250m"
+            limits:
+              memory: "512Mi"
+              cpu: "3000m"
+         
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dolibarr
+spec:
+  ports:
+  - name: http
+    port: 80
+  selector:
+    app: dolibarr
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+    name: dolibarr
+    annotations:
+      kubernetes.io/ingress.class: nginx
+      ingress.kubernetes.io/whitelist-x-forwarded-for: "true"
+spec:
+    rules:
+    - host: dolibarr.lan
+      http:
+          paths:
+          - backend:
+              service:
+                name: dolibarr
+                port: 
+                  name: http
+            path: / 
+            pathType: Prefix

apps/dolibarr/entrypoint.sh

@@ -0,0 +1,271 @@
+#!/bin/sh
+set -e
+
+log() {
+    echo "[$0] [$(date +%Y-%m-%dT%H:%M:%S)] $*"
+}
+
+# version_greater A B returns whether A > B
+version_greater() {
+	[ "$(printf '%s\n' "$@" | sort -t '.' -n -k1,1 -k2,2 -k3,3 -k4,4 | head -n 1)" != "$1" ]
+}
+
+# return true if specified directory is empty
+directory_empty() {
+	[ -z "$(ls -A "$1/")" ]
+}
+
+run_as() {
+	if [ "$(id -u)" = 0 ]; then
+		su - www-data -s /bin/sh -c "$1"
+	else
+		sh -c "$1"
+	fi
+}
+
+
+if [ ! -f /usr/local/etc/php/php.ini ]; then
+	log "Initializing PHP configuration..."
+	cat <<EOF > /etc/php/7.4/fpm/php.ini
+date.timezone = "${PHP_INI_DATE_TIMEZONE}"
+memory_limit = ${PHP_MEMORY_LIMIT}
+file_uploads = On
+upload_max_filesize = ${PHP_MAX_UPLOAD}
+post_max_size = ${PHP_MAX_UPLOAD}
+max_execution_time = ${PHP_MAX_EXECUTION_TIME}
+sendmail_path = /usr/sbin/sendmail -t -i
+extension = calendar.so
+EOF
+fi
+
+
+if [ ! -d /var/www/documents ]; then
+	log "Initializing Dolibarr documents directory..."
+	mkdir -p /var/www/documents
+fi
+
+log "Updating Dolibarr users and group..."
+usermod -u "$WWW_USER_ID" www-data
+groupmod -g "$WWW_GROUP_ID" www-data
+
+log "Updating Dolibarr folder ownership..."
+chown -R www-data:www-data /var/www
+
+
+if [ ! -d /var/www/html/conf/ ]; then
+	log "Initializing Dolibarr HTML configuration directory..."
+	mkdir -p /var/www/html/conf/
+fi
+
+# Create a default config if autoconfig enabled
+if [ -n "$DOLI_AUTO_CONFIGURE" ] && [ ! -f /var/www/html/conf/conf.php ]; then
+	log "Initializing Dolibarr HTML configuration..."
+	cat <<EOF > /var/www/html/conf/conf.php
+<?php
+// Config file for Dolibarr ${DOLI_VERSION} ($(date +%Y-%m-%dT%H:%M:%S%:z))
+
+// ###################
+// # Main parameters #
+// ###################
+\$dolibarr_main_url_root='${DOLI_URL_ROOT}';
+\$dolibarr_main_document_root='/var/www/html';
+\$dolibarr_main_url_root_alt='/custom';
+\$dolibarr_main_document_root_alt='/var/www/html/custom';
+\$dolibarr_main_data_root='/var/www/documents';
+\$dolibarr_main_db_host='${DOLI_DB_HOST}';
+\$dolibarr_main_db_port='${DOLI_DB_PORT}';
+\$dolibarr_main_db_name='${DOLI_DB_NAME}';
+\$dolibarr_main_db_prefix='${DOLI_DB_PREFIX}';
+\$dolibarr_main_db_user='${DOLI_DB_USER}';
+\$dolibarr_main_db_pass='${DOLI_DB_PASSWORD}';
+\$dolibarr_main_db_type='${DOLI_DB_TYPE}';
+\$dolibarr_main_db_character_set='${DOLI_DB_CHARACTER_SET}';
+\$dolibarr_main_db_collation='${DOLI_DB_COLLATION}';
+
+// ##################
+// # Login          #
+// ##################
+\$dolibarr_main_authentication='${DOLI_AUTH}';
+\$dolibarr_main_auth_ldap_host='${DOLI_LDAP_HOST}';
+\$dolibarr_main_auth_ldap_port='${DOLI_LDAP_PORT}';
+\$dolibarr_main_auth_ldap_version='${DOLI_LDAP_VERSION}';
+\$dolibarr_main_auth_ldap_servertype='${DOLI_LDAP_SERVERTYPE}';
+\$dolibarr_main_auth_ldap_login_attribute='${DOLI_LDAP_LOGIN_ATTRIBUTE}';
+\$dolibarr_main_auth_ldap_dn='${DOLI_LDAP_DN}';
+\$dolibarr_main_auth_ldap_filter ='${DOLI_LDAP_FILTER}';
+\$dolibarr_main_auth_ldap_admin_login='${DOLI_LDAP_ADMIN_LOGIN}';
+\$dolibarr_main_auth_ldap_admin_pass='${DOLI_LDAP_ADMIN_PASS}';
+\$dolibarr_main_auth_ldap_debug='${DOLI_LDAP_DEBUG}';
+
+// ##################
+// # Security       #
+// ##################
+\$dolibarr_main_prod='${DOLI_PROD}';
+\$dolibarr_main_force_https='${DOLI_HTTPS}';
+\$dolibarr_main_restrict_os_commands='mysqldump, mysql, pg_dump, pgrestore';
+\$dolibarr_nocsrfcheck='${DOLI_NO_CSRF_CHECK}';
+\$dolibarr_main_cookie_cryptkey='$(openssl rand -hex 32)';
+\$dolibarr_mailing_limit_sendbyweb='0';
+EOF
+
+	chown www-data:www-data /var/www/html/conf/conf.php
+	chmod 766 /var/www/html/conf/conf.php
+fi
+
+
+# Detect Docker container version (ie. previous installed version)
+installed_version="0.0.0.0"
+if [ -f /var/www/documents/.docker-container-version ]; then
+	# shellcheck disable=SC2016
+	installed_version="$(cat /var/www/documents/.docker-container-version)"
+fi
+if [ -f /var/www/documents/install.version ]; then
+	# shellcheck disable=SC2016
+	installed_version="$(cat /var/www/documents/install.version)"
+	mv \
+		/var/www/documents/install.version \
+		/var/www/documents/.docker-container-version
+fi
+
+# Detect Docker image version (docker specific solution)
+# shellcheck disable=SC2016
+image_version="${DOLI_VERSION}"
+if [ -f /usr/src/dolibarr/.docker-image-version ]; then
+	# shellcheck disable=SC2016
+	image_version="$(cat /usr/src/dolibarr/.docker-image-version)"
+fi
+
+if version_greater "$installed_version" "$image_version"; then
+	log "Can't start Dolibarr because the version of the data ($installed_version) is higher than the docker image version ($image_version) and downgrading is not supported. Are you sure you have pulled the newest image version?"
+	exit 1
+fi
+
+# Initialize image
+if version_greater "$image_version" "$installed_version"; then
+	log "Dolibarr initialization..."
+	if [ "$(id -u)" = 0 ]; then
+		rsync_options="-rvlDog --chown www-data:root"
+	else
+		rsync_options="-rvlD"
+	fi
+
+	mkdir -p /var/www/scripts
+	rsync $rsync_options /usr/src/dolibarr/scripts/ /var/www/scripts/
+	rsync $rsync_options --delete --exclude /conf/ --exclude /custom/ --exclude /theme/ /usr/src/dolibarr/htdocs/ /var/www/html/
+
+	for dir in conf custom; do
+		if [ ! -d "/var/www/html/$dir" ] || directory_empty "/var/www/html/$dir"; then
+			rsync $rsync_options --include "/$dir/" --exclude '/*' /usr/src/dolibarr/htdocs/ /var/www/html/
+		fi
+	done
+
+	# The theme folder contains custom and official themes. We must copy even if folder is not empty, but not delete content either
+	for dir in theme; do
+		rsync $rsync_options --include "/$dir/" --exclude '/*' /usr/src/dolibarr/htdocs/ /var/www/html/
+	done
+
+	if [ "$installed_version" != "0.0.0.0" ]; then
+		# Call upgrade if needed
+		# https://wiki.dolibarr.org/index.php/Installation_-_Upgrade#With_Dolibarr_.28standard_.zip_package.29
+		log "Dolibarr upgrade from $installed_version to $image_version..."
+
+		if [ -f /var/www/documents/install.lock ]; then
+			rm /var/www/documents/install.lock
+		fi
+
+		base_version=$(echo "${installed_version}" | sed -e 's|\(.*\..*\)\..*|\1|g')
+		target_version=$(echo "${image_version}" | sed -e 's|\(.*\..*\)\..*|\1|g')
+
+		run_as "cd /var/www/html/install/ && php upgrade.php ${base_version}.0 ${target_version}.0"
+		run_as "cd /var/www/html/install/ && php upgrade2.php ${base_version}.0 ${target_version}.0"
+		run_as "cd /var/www/html/install/ && php step5.php ${base_version}.0 ${target_version}.0"
+
+		log 'This is a lock file to prevent use of install pages (generated by container entrypoint)' > /var/www/documents/install.lock
+		chown www-data:www-data /var/www/documents/install.lock
+		chmod 400 /var/www/documents/install.lock
+	elif [ -n "$DOLI_AUTO_CONFIGURE" ] && [ ! -f /var/www/documents/install.lock ]; then
+			log "Create forced values for first Dolibarr install..."
+			cat <<EOF > /var/www/html/install/install.forced.php
+<?php
+// Forced install config file for Dolibarr ${DOLI_VERSION} ($(date +%Y-%m-%dT%H:%M:%S%:z))
+
+/** @var bool Hide PHP informations */
+\$force_install_nophpinfo = true;
+
+/** @var int 1 = Lock and hide environment variables, 2 = Lock all set variables */
+\$force_install_noedit = 2;
+
+/** @var string Information message */
+\$force_install_message = 'Dolibarr installation (Docker)';
+
+/** @var string Data root absolute path (documents folder) */
+\$force_install_main_data_root = '/var/www/documents';
+
+/** @var bool Force HTTPS */
+\$force_install_mainforcehttps = !empty('${DOLI_HTTPS}');
+
+/** @var string Database name */
+\$force_install_database = '${DOLI_DB_NAME}';
+
+/** @var string Database driver (mysql|mysqli|pgsql|mssql|sqlite|sqlite3) */
+\$force_install_type = '${DOLI_DB_TYPE}';
+
+/** @var string Database server host */
+\$force_install_dbserver = '${DOLI_DB_HOST}';
+
+/** @var int Database server port */
+\$force_install_port = '${DOLI_DB_PORT}';
+
+/** @var string Database tables prefix */
+\$force_install_prefix = '${DOLI_DB_PREFIX}';
+
+/** @var string Database username */
+\$force_install_databaselogin = '${DOLI_DB_USER}';
+
+/** @var string Database password */
+\$force_install_databasepass = '${DOLI_DB_PASSWORD}';
+
+/** @var bool Force database user creation */
+\$force_install_createuser = false;
+
+/** @var bool Force database creation */
+\$force_install_createdatabase = !empty('${DOLI_DB_ROOT_LOGIN}');
+
+/** @var string Database root username */
+\$force_install_databaserootlogin = '${DOLI_DB_ROOT_LOGIN}';
+
+/** @var string Database root password */
+\$force_install_databaserootpass = '${DOLI_DB_ROOT_PASSWORD}';
+
+/** @var string Dolibarr super-administrator username */
+\$force_install_dolibarrlogin = '${DOLI_ADMIN_LOGIN}';
+
+/** @var bool Force install locking */
+\$force_install_lockinstall = true;
+
+/** @var string Enable module(s) (Comma separated class names list) */
+\$force_install_module = '${DOLI_MODULES}';
+
+EOF
+
+		log "You shall complete Dolibarr install manually at '${DOLI_URL_ROOT}/install'"
+	fi
+fi
+
+if [ ! -d /var/www/htdocs ]; then
+	log "Adding a symlink to /var/www/htdocs..."
+	ln -s /var/www/html /var/www/htdocs
+fi
+
+if [ ! -d /var/www/scripts ]; then
+	log "Initializing Dolibarr scripts directory..."
+	cp /usr/src/dolibarr/scripts /var/www/scripts
+fi
+
+if [ -f /var/www/documents/install.lock ]; then
+	log "Updating Dolibarr installed version..."
+	echo "$image_version" > /var/www/documents/.docker-container-version
+fi
+
+log "Serving Dolibarr...$@"
+exec "$@"

apps/dolibarr/nginx-site.configmap.conf

@@ -0,0 +1,60 @@
+server {
+	listen 80;
+	listen [::]:80;
+
+	add_header Referrer-Policy origin; # make sure outgoing links don't show the URL to the Matomo instance
+	root /var/www/html;
+	index index.php index.html;
+	try_files $uri $uri/ =404;
+
+	## only allow accessing the following php files
+	location ~ \.php$ {
+		# regex to split $uri to $fastcgi_script_name and $fastcgi_path
+		fastcgi_split_path_info ^(.+\.php)(/.+)$;
+		fastcgi_index index.php;
+
+		# Check that the PHP script exists before passing it
+		try_files $fastcgi_script_name =404;
+
+		proxy_connect_timeout       3600;
+		proxy_send_timeout          3600;
+		proxy_read_timeout          3600;
+		send_timeout                3600;
+
+		include fastcgi_params;
+		fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+		fastcgi_param PATH_INFO $fastcgi_path_info;
+		fastcgi_param HTTP_PROXY ""; # prohibit httpoxy: https://httpoxy.org/
+		fastcgi_pass 127.0.0.1:9000;
+	}
+
+	## disable all access to the following directories
+	location ~ /\.ht {
+		deny all;
+		return 403;
+	}
+	location ~ /\.git {
+		deny all;
+	}
+
+	location ~ \.(gif|ico|jpg|png|svg|js|css|htm|html|mp3|mp4|wav|ogg|avi|ttf|eot|woff|woff2|json)$ {
+		allow all;
+		## Cache images,CSS,JS and webfonts for an hour
+		## Increasing the duration may improve the load-time, but may cause old files to show after an Matomo upgrade
+		expires 1h;
+		add_header Pragma public;
+		add_header Cache-Control "public";
+	}
+
+	location ~ /(libs|vendor|plugins|misc/user) {
+		deny all;
+		return 403;
+	}
+
+	## properly display textfiles in root directory
+	location ~/(.*\.md|LEGALNOTICE|LICENSE) {
+		default_type text/plain;
+	}
+}
+
+# vim: filetype=nginx

apps/dolibarr/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-dolibarr
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/dolibarr
+    - name: path-to-dockerfile
+      value: apps/dolibarr/Dockerfile
+    - name: image-name
+      value: cr.lan/dolibarr
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/dolibarr

apps/gitea.yaml

@@ -11,6 +11,8 @@ metadata:
     release: latest
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: gitea
@@ -24,7 +26,6 @@ spec:
       containers:
         - name: gitea
           image: gitea/gitea:latest
-          imagePullPolicy: Always 
           env:
             - name: USER_UID
               value: "1000"
@@ -32,6 +33,8 @@ spec:
               value: "1000"
             - name: TZ
               value: "Europe/Berlin"
+            - name: GITEA__lfs__PATH
+              value: /data/git/lfs
             - name: DB_TYPE
               value: postgres
             - name: DB_HOST
@@ -42,6 +45,26 @@ spec:
               value: gitea
             - name: DB_PASSWD
               value: giteaEu94XSS4gKpheSBoMsIs
+                #- name: GITEA__indexer__ISSUE_INDEXER
+                #value: redis
+                #- name: GITEA__indexer__ISSUE_INDEXER_QUEUE_CONN_STR
+                #value: addrs=redis-standalone.live-env.svc.cluster.local:6379 db=1
+            - name: GITEA__packages__ENABLED
+              value: "true"
+            - name: GITEA__log__LEVEL
+              value: warn 
+            - name: GITEA__log__MODE
+              value: file 
+            - name: GITEA__log__ROUTER
+              value: file 
+            - name: GITEA__log__MACARON
+              value: file 
+                #- name: GITEA__queue__TYPE
+                #value: redis 
+                #- name: GITEA__queue__CONN_STR
+                #value: redis://redis-standalone.live-env.svc.cluster.local:6397/0
+            - name: GITEA__server__ROOT_URL
+              value: http://git-ui.lan/
           volumeMounts:
             - name: gitea
               mountPath: /data
@@ -53,20 +76,24 @@ spec:
               containerPort: 22
               protocol : TCP 
           livenessProbe:
-            httpGet:
+             initialDelaySeconds: 300
-              path: /
+             periodSeconds: 10
-              port: http
+             httpGet:
+               path: /
+               port: http
           readinessProbe:
+            initialDelaySeconds: 300
+            periodSeconds: 10
             httpGet:
               path: /
               port: http
           resources:
             requests:
-              memory: "200Mi"
+              memory: "300Mi"
               cpu: "150m"
             limits:
-              memory: "312Mi"
+              memory: "512Mi"
-              cpu: "500m"
+              cpu: "1000m"
       volumes:
       - name: gitea
         persistentVolumeClaim:
@@ -79,7 +106,8 @@ metadata:
   labels:
     app: gitea
 spec:
-  storageClassName: nfs-ssd
+  storageClassName: nfs-ssd-ebin02
+  volumeName: gitea
   accessModes:
   - ReadWriteOnce
   resources:
@@ -87,6 +115,26 @@ spec:
       storage: 20Gi
 ---
 apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: gitea
+spec:
+  storageClassName: "nfs-ssd-ebin02"
+  nfs:
+    path: /data/raid1-ssd/k8s-data/gitea-data
+    server: ebin02
+  capacity:
+    storage: 20Gi
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    kind: PersistentVolumeClaim
+    name: gitea
+    namespace: live-env
+---
+apiVersion: v1
 kind: Service
 metadata:
   name: gitea

apps/grav/Dockerfile

@@ -1,6 +1,6 @@
-FROM debian:bullseye-slim
+FROM cr.lan/debian-stable-php-fpm
 ENV DEBIAN_FRONTEND noninteractive
-ARG GRAV_VERSION=1.6.28
+ARG GRAV_VERSION=1.7.34
 
 ARG DEV_PKGS="zlib1g-dev libpng-dev libjpeg-dev libfreetype6-dev \
 	libcurl4-gnutls-dev libxml2-dev libonig-dev"

apps/grav/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-grav
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/grav
+    - name: path-to-dockerfile
+      value: apps/grav/Dockerfile
+    - name: image-name
+      value: cr.lan/grav
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/grav

apps/mariadb/mariadb-prometheus/Dockerfile

@@ -1,5 +1,5 @@
 # vim:set ft=dockerfile:
-FROM debian:buster-slim
+FROM cr.lan/debian-stable
 
 RUN set -ex; \
 	apt-get update; \

apps/mariadb/mariadb/Dockerfile

@@ -1,5 +1,5 @@
 # vim:set ft=dockerfile:
-FROM debian:buster-slim
+FROM cr.lan/debian-stable
 
 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
 RUN groupadd -r mysql && useradd -r -g mysql mysql

apps/mariadb/tekton-image-build-mariadb-prometheus-exporter.yaml

@@ -1,76 +1,23 @@
-apiVersion: tekton.dev/v1alpha1
+apiVersion: tekton.dev/v1beta1
-kind: PipelineResource
+kind: PipelineRun
 metadata:
-  name: chaos-kubernetes-git
+  name: img-mariadb-prometheus-node-exporter
 spec:
-  type: git
+  pipelineRef:
+    name: kaniko-pipeline
   params:
-    - name: revision
+    - name: git-url
-      value: master
-    - name: url
       value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
+    - name: git-revision
-      value: "false"
+      value: master
----
+    - name: path-to-image-context
-apiVersion: tekton.dev/v1alpha1
+      value: apps/mariadb/mariadb-prometheus
-kind: PipelineResource
+    - name: path-to-dockerfile
-metadata:
+      value: apps/mariadb/mariadb-prometheus/Dockerfile
-  name: img-mariadb-prometheus-exporter
+    - name: image-name
-spec:
+      value: cr.lan/mariadb-prometheus-node-exporter
-  type: image
+  workspaces:
-  params:
+      - name: git-source
-    - name: url
+        persistentVolumeClaim:
-      value: cr.lan/mariadb-prometheus-exporter
+          claimName: tektoncd-workspaces
----
+        subPath: tekton/mariadb-prometheus-node-exporter
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-mariadb-prometheus-exporter
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/mariadb/mariadb-prometheus/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/mariadb/mariadb-prometheus
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-mariadb-prometheus-exporter-taskrun
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-mariadb-prometheus-exporter
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-mariadb-prometheus-exporter
-          
-          

apps/mariadb/tekton-image-build-mariadb.yaml

@@ -1,76 +1,23 @@
-apiVersion: tekton.dev/v1alpha1
+apiVersion: tekton.dev/v1beta1
-kind: PipelineResource
+kind: PipelineRun
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
 metadata:
   name: img-mariadb
 spec:
-  type: image
+  pipelineRef:
+    name: kaniko-pipeline
   params:
-    - name: url
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/mariadb/mariadb
+    - name: path-to-dockerfile
+      value: apps/mariadb/mariadb/Dockerfile
+    - name: image-name
       value: cr.lan/mariadb
----
+  workspaces:
-apiVersion: tekton.dev/v1beta1
+      - name: git-source
-kind: Task
+        persistentVolumeClaim:
-metadata:
+          claimName: tektoncd-workspaces
-  name: build-mariadb
+        subPath: tekton/mariadb
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/mariadb/mariadb/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/mariadb/mariadb
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-mariadb-taskrun
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-mariadb
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-mariadb
-          
-          

apps/mosquitto/Dockerfile

@@ -1,8 +1,6 @@
-FROM debian:stable-slim
+FROM cr.lan/debian-stable
 
-RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
+RUN apt-get update && \
-	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
-	apt-get update && \
     apt-get install -y --no-install-recommends \
 	mosquitto procps && \
     apt-get clean -y && \

apps/mosquitto/deployment.yaml

@@ -62,7 +62,8 @@ spec:
           name: mosquitto-data
           subPath: mosquitto/data
       - name: mosquitto-exporter
-        image: cr.lan/mosquitto-exporter
+        image: cr.lan/mosquitto-prometheus-exporter
+        args: ["--endpoint", "tcp://mqtt.lan:1883"]
         imagePullPolicy: Always
         ports:
         - containerPort: 9234

apps/mosquitto/prometheus/Dockerfile

@@ -0,0 +1,10 @@
+FROM cr.lan/debian-golang-stable
+
+ENV GOARCH=arm64
+ENV GOPATH=/usr/src/gopath
+ENV GOCACHE=/usr/src/gocache
+RUN go env
+WORKDIR /usr/src
+RUN go get github.com/sapcc/mosquitto-exporter
+RUN make j4 build CGO_ENABLED=0
+RUN ls -al

apps/mosquitto/tekton-image-build.yaml

@@ -1,77 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-mosquitto
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/mosquitto
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-mosquitto
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/mosquitto/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/mosquitto
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --snapshotMode=redo
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-mosquitto-taskrun
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-mosquitto
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-mosquitto
-          
-          

apps/mosquitto/tekton-prometheus.yaml

@@ -0,0 +1,24 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-mosquitto-prometheus
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/mosquitto/prometheus
+    - name: path-to-dockerfile
+      value: apps/mosquitto/prometheus/Dockerfile
+    - name: image-name
+      value: cr.lan/mosquitto-prometheus-exporter
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/mosquitto-prometheus
+        

apps/mosquitto/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-mosquitto
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/mosquitto
+    - name: path-to-dockerfile
+      value: apps/mosquitto/Dockerfile
+    - name: image-name
+      value: cr.lan/mosquitto
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/mosquitto

apps/nextcloud/Dockerfile

@@ -1,4 +1,4 @@
-FROM nextcloud:21-fpm
+FROM nextcloud:24-fpm
 #needed for some reason
 ENV NEXTCLOUD_UPDATE=1 
 
@@ -6,7 +6,7 @@ ENV NEXTCLOUD_UPDATE=1
 RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
 	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
 	apt-get update && apt-get install -y \
-	procps bash iputils-ping libmagickcore-6.q16-6-extra
+	procps bash iputils-ping libmagickcore-6.q16-6-extra vim-tiny
 	
 RUN apt-get clean -y && \
     rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

apps/nextcloud/config.php

@@ -3,7 +3,7 @@
 // Manually deployed by yourself
 //
 $CONFIG = array(
-    'config_is_read_only' => true,
+    'config_is_read_only' => false,
     'htaccess.RewriteBase' => '/',
     'memcache.local' => '\\OC\\Memcache\\APCu',
     'apps_paths' => array(
@@ -46,7 +46,7 @@ $CONFIG = array(
     ),
     'datadirectory' => '/var/www/html/data',
     'dbtype' => 'pgsql',
-    'version' => '20.0.9.1',
+    'version' => '24.0.0',
     'overwrite.cli.url' => 'http://nc.lan',
     'dbname' => 'nextcloud',
     'dbhost' => 'postgres.live-env.svc.cluster.local:5432',
@@ -57,4 +57,4 @@ $CONFIG = array(
     'installed' => true,
     'default_phone_region' => 'DE',
     'updater.release.channel' => 'stable',
-);
+);

apps/nextcloud/tekton-image-build.yaml

@@ -1,77 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-nextcloud
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/nextcloud
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-nextcloud
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/nextcloud/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/nextcloud
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --snapshotMode=redo
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-nextcloud
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-nextcloud
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-nextcloud
-          
-          

apps/nextcloud/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: img-nextcloud
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/nextcloud
+    - name: path-to-dockerfile
+      value: apps/nextcloud/Dockerfile
+    - name: image-name
+      value: cr.lan/nextcloud
+  workspaces:
+    - name: git-source
+      persistentVolumeClaim:
+        claimName: tektoncd-workspaces
+      subPath: tekton/nextcloud

apps/piwigo/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:stable-slim
+FROM cr.lan/debian-stable
 
 #RUN echo 'Acquire::http::proxy "http://172.23.255.1:3142";' >/etc/apt/apt.conf.d/proxy
 RUN apt-get update && apt-get install -y \

apps/postgresql-deploy.yaml

@@ -41,6 +41,17 @@ spec:
           value: pg2020
         - name: PGDATA
           value: /var/lib/postgresql/data/pgdata
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchExpressions:
+              - key: app
+                operator: In
+                values:
+                - prometheus
+                - loki
+            topologyKey: kubernetes.io/hostname
 #      - name: prometheus-exporter
 #        image: wrouesnel/postgres_exporter
 #        env:

apps/redis.yaml

@@ -0,0 +1,103 @@
+apiVersion: v1
+kind: ConfigMap
+metadata: 
+  name: redis-cm
+  namespace: live-env
+data: 
+  redis.conf: |-
+    bind * -::*
+    appendonly yes
+    maxmemory 5mb
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: redis-standalone
+  namespace: live-env
+spec:
+  serviceName: redis-standalone
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis-standalone
+  template:
+    metadata:
+      labels:
+        app: redis-standalone
+    spec:
+      containers:
+      - name: redis-standalone
+        image: redis
+        command: ["redis-server"]
+        args: ["/usr/local/etc/redis/redis.conf"]
+        resources:
+          limits:
+            memory: "128Mi"
+            cpu: "50m"
+        ports:
+        - containerPort: 6379
+        volumeMounts:
+          - name: redis-standalone-pv 
+            mountPath: /data
+          - name: config
+            mountPath: /usr/local/etc/redis
+      volumes:
+        - name: config
+          configMap: 
+            name: redis-cm
+        - name: redis-standalone-pv
+          persistentVolumeClaim:
+            claimName: redis-standalone-pv
+            
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-standalone
+  labels:
+    app: redis-standalone
+    env: live-env
+spec:
+  selector:
+    env: live-env
+  type: LoadBalancer
+  loadBalancerIP: 172.23.255.6
+  ports:
+  - name: redis-standalone
+    port: 6379
+    targetPort: 6379
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: redis-standalone-pv
+  labels:
+    app: redis-stndalone
+spec:
+  storageClassName: nfs-ssd-ebin02
+  volumeName: redis-standalone-pv
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 100Mi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: redis-standalone-pv
+spec:
+  storageClassName: "nfs-ssd-ebin02"
+  nfs:
+    path: /data/raid1-ssd/k8s-data/redis-standalone-pv
+    server: ebin02
+  capacity:
+    storage: 100Mi
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  persistentVolumeReclaimPolicy: Retain
+  claimRef:
+    kind: PersistentVolumeClaim
+    name: redis-standalone-pv
+    namespace: live-env

apps/rompr/Dockerfile

@@ -1,54 +1,40 @@
-FROM debian:buster-slim
+FROM cr.lan/debian-stable-php-fpm
 
-ARG ROMPR_VERSION=1.58
+ARG ROMPR_VERSION=1.61
 # Install packages
 ENV DEBIAN_FRONTEND noninteractive
-RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
+RUN apt-get update && \
-	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \	 
-	apt-get update && \
   	apt-get -y install \
       nginx \
-      php-fpm \
       curl \
-      php-mysql \
+      unzip
-      php-curl \
-      php-gd \
-      unzip \
-      imagemagick \
-      php-json \
-      php-xml \ 
-      php-mbstring \
-      php-sqlite3 \
-      php-intl
 # CLeanup	
-RUN	apt-get remove -y --purge ${DEV_PKGS} && \
+RUN	apt-get autoremove --purge -y && \
-	apt-get autoremove --purge -y && \
 	apt-get clean -y && \ 
 	rm -rf /var/lib/apt/lists/* && \
 	rm -rf /var/cache/apt/* /tmp/* /var/tmp/* /var/log/*
 	
 RUN curl -k -L -o rompr.zip https://github.com/fatg3erman/RompR/releases/download/${ROMPR_VERSION}/rompr-${ROMPR_VERSION}.zip
-RUN mkdir -p /app
+RUN mkdir -p /app /rompr
 RUN unzip -d /app rompr.zip && rm rompr.zip
-RUN mkdir -p /rompr
+RUN ln -sf /rompr/prefs /app/rompr/prefs; ln -sf /rompr/albumart /app/rompr/albumart;
-RUN ln -sf /rompr/prefs /app/rompr/prefs
-RUN ln -sf /rompr/albumart /app/rompr/albumart
 RUN chown -R www-data:www-data /app/rompr /rompr
-COPY nginx_default /etc/nginx/sites-available/default
+RUN pwd; ls -la .;ls -la /workspace/source;
+ADD files/nginx_default /etc/nginx/sites-available/default
 RUN mkdir -p /run/php/
 #Environment variables to configure php
-RUN sed -ri -e  's/^allow_url_fopen =.*/allow_url_fopen = On/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^allow_url_fopen =.*/allow_url_fopen = On/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^memory_limit =.*/memory_limit = 128M/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^memory_limit =.*/memory_limit = 128M/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^max_execution_time =.*/max_execution_time = 1800/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^max_execution_time =.*/max_execution_time = 1800/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^post_max_size =.*/post_max_size = 256M/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^post_max_size =.*/post_max_size = 256M/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^upload_max_filesize =.*/upload_max_filesize = 8M/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^upload_max_filesize =.*/upload_max_filesize = 8M/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^max_file_uploads =.*/max_file_uploads = 50/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^max_file_uploads =.*/max_file_uploads = 50/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^display_errors =.*/display_errors = On/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^display_errors =.*/display_errors = On/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^display_startup_errors =.*/display_startup_errors = On/g' /etc/php/7.3/fpm/php.ini
+RUN sed -ri -e  's/^display_startup_errors =.*/display_startup_errors = On/g' /etc/php/7.4/fpm/php.ini
 
 RUN echo "<?php phpinfo(); ?>" > /app/rompr/phpinfo.php
-RUN update-rc.d php7.3-fpm defaults
+RUN update-rc.d php7.4-fpm defaults
-COPY run-httpd /usr/local/bin/
+ADD files/run-httpd /usr/local/bin/
 RUN chmod 755 /usr/local/bin/run-httpd
 EXPOSE 80
 VOLUME ["/rompr"]

apps/rompr/files/nginx_default

@@ -20,13 +20,13 @@ server {
            index index.php;
            location ~ \.php {
                 try_files $uri index.php =404;
-                fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
+                fastcgi_pass 127.0.0.1:9000;
                 fastcgi_index index.php;
                 fastcgi_param SCRIPT_FILENAME $request_filename;
                 include /etc/nginx/fastcgi_params;
                 fastcgi_read_timeout 1800;
            }
-           error_page 404 = /404.php;
+           error_page 404 = /rompr/404.php;
            try_files $uri $uri/ =404;
            location ~ /albumart/* {
                   expires -1s;

apps/rompr/files/run-httpd

@@ -0,0 +1,8 @@
+#!/bin/sh
+rm -f /var/run/nginx.pid
+mkdir -p /var/log/nginx
+set -e
+mkdir -p /rompr/albumart /rompr/prefs
+chown www-data:www-data -R /rompr/albumart /rompr/prefs
+/etc/init.d/php7.4-fpm restart
+exec /usr/sbin/nginx -g 'daemon off;'

apps/rompr/run-httpd

@@ -1,7 +0,0 @@
-#!/bin/sh
-rm -f /var/run/nginx.pid
-mkdir -p /var/log/nginx
-set -e
-
-/etc/init.d/php7.3-fpm restart
-exec /usr/sbin/nginx -g 'daemon off;'

apps/rompr/tekton-image-build.yaml

@@ -1,77 +0,0 @@
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: chaos-kubernetes-git
-spec:
-  type: git
-  params:
-    - name: revision
-      value: master
-    - name: url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: submodules
-      value: "false"
----
-apiVersion: tekton.dev/v1alpha1
-kind: PipelineResource
-metadata:
-  name: img-rompr
-spec:
-  type: image
-  params:
-    - name: url
-      value: cr.lan/rompr
----
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: build-rompr
-spec:
-  params:
-    - name: pathToDockerFile
-      type: string
-      default: $(resources.inputs.source.path)/apps/rompr/Dockerfile
-    - name: pathToContext
-      type: string
-      default: $(resources.inputs.source.path)/apps/rompr
-  resources:
-    inputs:
-      - name: source
-        type: git
-    outputs:
-      - name: builtImage
-        type: image
-  steps:
-    - name: build-and-push
-      image: gcr.io/kaniko-project/executor:arm64
-      command:
-        - /kaniko/executor
-      args:
-        - --dockerfile=$(params.pathToDockerFile)
-        - --destination=$(resources.outputs.builtImage.url)
-        - --context=$(params.pathToContext)
-        - --snapshotMode=redo
-        - --skip-tls-verify
----
-apiVersion: tekton.dev/v1beta1
-kind: TaskRun
-metadata:
-  name: img-rompr-taskrun
-spec:
-  #serviceAccountName: dockerhub-service
-  taskRef:
-    name: build-rompr
-  params:
-    - name: pathToDockerFile
-      value: Dockerfile
-  resources:
-    inputs:
-      - name: source
-        resourceRef:
-          name: chaos-kubernetes-git
-    outputs:
-      - name: builtImage
-        resourceRef:
-          name: img-rompr
-          
-          

apps/rompr/tekton.yaml

@@ -0,0 +1,23 @@
+apiVersion: tekton.dev/v1beta1
+kind: PipelineRun
+metadata:
+  name: build-rompr
+spec:
+  pipelineRef:
+    name: kaniko-pipeline
+  params:
+    - name: git-url
+      value: http://git-ui.lan/chaos/kubernetes.git
+    - name: git-revision
+      value: master
+    - name: path-to-image-context
+      value: apps/rompr
+    - name: path-to-dockerfile
+      value: ./Dockerfile
+    - name: image-name
+      value: cr.lan/rompr
+  workspaces:
+      - name: git-source
+        persistentVolumeClaim:
+          claimName: tektoncd-workspaces
+        subPath: tekton/kaniko-pipelines

apps/smarthome/home-assistant.yaml

@@ -45,7 +45,7 @@ spec:
           periodSeconds: 5
         resources:
           requests:
-            memory: "92Mi"
+            memory: "200Mi"
             cpu: "250m"
           limits:
             memory: "256Mi"

apps/tekton/README.md

@@ -1,8 +1,6 @@
 Install:
 
 # Pipelines: @kubectl apply --filename https://storage.googleapis.com/tekton-releases/pipeline/latest/release.yaml@
-# Triggers: @kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml@ #https://github.com/tektoncd/triggers/blob/master/docs/install.md
+# Triggers: @kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/release.yaml@
-# Dashboard:
+            @kubectl apply --filename https://storage.googleapis.com/tekton-releases/triggers/latest/interceptors.yaml@ #https://github.com/tektoncd/triggers/blob/master/docs/install.md
-## update submodule in ./dashboard
+# Dashboard: @kubectl apply --filename https://storage.googleapis.com/tekton-releases/dashboard/latest/tekton-dashboard-release.yaml@
-## Build: @docker build -t tekton-dashboard:arm64 -t docker-registry.lan/tekton-dashboard:arm64 --platform linux/arm64 --build-arg GOARCH=arm64 .@
-## apply deployment.yaml

apps/tekton/tekton-dashboard-release.yaml

@@ -1,526 +0,0 @@
-apiVersion: apiextensions.k8s.io/v1beta1
-kind: CustomResourceDefinition
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: extensions.dashboard.tekton.dev
-spec:
-  additionalPrinterColumns:
-    - JSONPath: .spec.apiVersion
-      name: API version
-      type: string
-    - JSONPath: .spec.name
-      name: Kind
-      type: string
-    - JSONPath: .spec.displayname
-      name: Display name
-      type: string
-    - JSONPath: .metadata.creationTimestamp
-      name: Age
-      type: date
-  group: dashboard.tekton.dev
-  names:
-    categories:
-      - tekton
-      - tekton-dashboard
-    kind: Extension
-    plural: extensions
-    shortNames:
-      - ext
-      - exts
-  preserveUnknownFields: false
-  scope: Namespaced
-  subresources:
-    status: {}
-  validation:
-    openAPIV3Schema:
-      type: object
-      x-kubernetes-preserve-unknown-fields: true
-  versions:
-    - name: v1alpha1
-      served: true
-      storage: true
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard
-  namespace: tekton-pipelines
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-backend
-rules:
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - get
-      - list
-  - apiGroups:
-      - security.openshift.io
-    resources:
-      - securitycontextconstraints
-    verbs:
-      - use
-  - apiGroups:
-      - tekton.dev
-    resources:
-      - clustertasks
-      - clustertasks/status
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - triggers.tekton.dev
-    resources:
-      - clustertriggerbindings
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - dashboard.tekton.dev
-    resources:
-      - extensions
-    verbs:
-      - create
-      - update
-      - delete
-      - patch
-  - apiGroups:
-      - tekton.dev
-    resources:
-      - clustertasks
-      - clustertasks/status
-    verbs:
-      - create
-      - update
-      - delete
-      - patch
-  - apiGroups:
-      - triggers.tekton.dev
-    resources:
-      - clustertriggerbindings
-    verbs:
-      - create
-      - update
-      - delete
-      - patch
-      - add
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-dashboard
-rules:
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    verbs:
-      - list
----
-aggregationRule:
-  clusterRoleSelectors:
-    - matchLabels:
-        rbac.dashboard.tekton.dev/aggregate-to-dashboard: "true"
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-extensions
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-pipelines
-rules:
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    verbs:
-      - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-tenant
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - dashboard.tekton.dev
-    resources:
-      - extensions
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - serviceaccounts
-      - pods/log
-      - namespaces
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - tekton.dev
-    resources:
-      - tasks
-      - taskruns
-      - pipelines
-      - pipelineruns
-      - pipelineresources
-      - conditions
-      - tasks/status
-      - taskruns/status
-      - pipelines/status
-      - pipelineruns/status
-      - taskruns/finalizers
-      - pipelineruns/finalizers
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - triggers.tekton.dev
-    resources:
-      - eventlisteners
-      - triggerbindings
-      - triggertemplates
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - serviceaccounts
-    verbs:
-      - update
-      - patch
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-    verbs:
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - delete
-  - apiGroups:
-      - tekton.dev
-    resources:
-      - tasks
-      - taskruns
-      - pipelines
-      - pipelineruns
-      - pipelineresources
-      - conditions
-      - taskruns/finalizers
-      - pipelineruns/finalizers
-      - tasks/status
-      - taskruns/status
-      - pipelines/status
-      - pipelineruns/status
-    verbs:
-      - create
-      - update
-      - delete
-      - patch
-  - apiGroups:
-      - triggers.tekton.dev
-    resources:
-      - eventlisteners
-      - triggerbindings
-      - triggertemplates
-    verbs:
-      - create
-      - update
-      - delete
-      - patch
-      - add
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-triggers
-rules:
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    verbs:
-      - list
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-backend
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-dashboard-backend
-subjects:
-  - kind: ServiceAccount
-    name: tekton-dashboard
-    namespace: tekton-pipelines
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: tekton-dashboard
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/name: dashboard
-    app.kubernetes.io/part-of: tekton-dashboard
-    app.kubernetes.io/version: v0.11.1
-    dashboard.tekton.dev/release: v0.11.1
-    version: v0.11.1
-  name: tekton-dashboard
-  namespace: tekton-pipelines
-spec:
-  ports:
-    - name: http
-      port: 9097
-      protocol: TCP
-      targetPort: 9097
-  selector:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/name: dashboard
-    app.kubernetes.io/part-of: tekton-dashboard
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: tekton-dashboard
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/name: dashboard
-    app.kubernetes.io/part-of: tekton-dashboard
-    app.kubernetes.io/version: v0.11.1
-    dashboard.tekton.dev/release: v0.11.1
-    version: v0.11.1
-  name: tekton-dashboard
-  namespace: tekton-pipelines
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/component: dashboard
-      app.kubernetes.io/instance: default
-      app.kubernetes.io/name: dashboard
-      app.kubernetes.io/part-of: tekton-dashboard
-  template:
-    metadata:
-      labels:
-        app: tekton-dashboard
-        app.kubernetes.io/component: dashboard
-        app.kubernetes.io/instance: default
-        app.kubernetes.io/name: dashboard
-        app.kubernetes.io/part-of: tekton-dashboard
-        app.kubernetes.io/version: v0.11.1
-      name: tekton-dashboard
-    spec:
-      containers:
-        - args:
-            - --port=9097
-            - --logout-url=
-            - --pipelines-namespace=tekton-pipelines
-            - --triggers-namespace=tekton-pipelines
-            - --read-only=false
-            - --csrf-secure-cookie=false
-            - --log-level=info
-            - --log-format=json
-            - --namespace=
-            - --openshift=false
-            - --stream-logs=false
-            - --external-logs=
-          env:
-            - name: INSTALLED_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: WEB_RESOURCES_DIR
-              value: /go/src/github.com/tektoncd/dashboard/web
-            - name: TEKTON_PIPELINES_WEB_RESOURCES_DIR
-              value: /go/src/github.com/tektoncd/dashboard/web
-          #image: gcr.io/tekton-releases/github.com/tektoncd/dashboard/cmd/dashboard@sha256:744eb92d7d0365bbfb2405df4ba4d2a66c01edc26028c362bd5675e2bc1b9626
-          image: docker-registry.lan/tekton-dashboard:arm64
-          imagePullPolicy: Always
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 9097
-          name: tekton-dashboard
-          ports:
-            - containerPort: 9097
-          readinessProbe:
-            httpGet:
-              path: /readiness
-              port: 9097
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-      serviceAccountName: tekton-dashboard
-      volumes: []
-
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-pipelines
-  namespace: tekton-pipelines
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-dashboard-pipelines
-subjects:
-  - kind: ServiceAccount
-    name: tekton-dashboard
-    namespace: tekton-pipelines
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-dashboard
-  namespace: tekton-pipelines
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-dashboard-dashboard
-subjects:
-  - kind: ServiceAccount
-    name: tekton-dashboard
-    namespace: tekton-pipelines
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-triggers
-  namespace: tekton-pipelines
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-dashboard-triggers
-subjects:
-  - kind: ServiceAccount
-    name: tekton-dashboard
-    namespace: tekton-pipelines
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-tenant
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-dashboard-tenant
-subjects:
-  - kind: ServiceAccount
-    name: tekton-dashboard
-    namespace: tekton-pipelines
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  labels:
-    app.kubernetes.io/component: dashboard
-    app.kubernetes.io/instance: default
-    app.kubernetes.io/part-of: tekton-dashboard
-  name: tekton-dashboard-extensions
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tekton-dashboard-extensions
-subjects:
-  - kind: ServiceAccount
-    name: tekton-dashboard
-    namespace: tekton-pipelines
----
-apiVersion: networking.k8s.io/v1beta1
-kind: Ingress
-metadata:
-    name: tekton-dashboard
-    namespace: tekton-pipelines
-    labels:
-      app.kubernetes.io/component: dashboard
-      app.kubernetes.io/instance: default
-      app.kubernetes.io/part-of: tekton-dashboard
-spec:
-    rules:
-    - host: tekton.lan
-      http:
-          paths:
-          - backend:
-              serviceName: tekton-dashboard
-              servicePort: 9097
-

cluster-monitoring-local/additional-scrape-configs.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 data:
-  prometheus-additional.yaml: LSBqb2JfbmFtZTogZ2l0ZWEKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGdpdC11aS5sYW4KLSBqb2JfbmFtZTogbXlzcWxkCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBtYXJpYWRiLmxhbjo5MTA0Ci0gam9iX25hbWU6IG1xdHQubW9zcXVpdHRvCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBtcXR0Lmxhbjo5MjM0Ci0gam9iX25hbWU6IGhhcHJveHkKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGFkbTAxLndrczo5MTAxCiAgICAtIGRydWNraS53a3M6OTEwMQogICAgLSBhdXRvMDIuY2hhb3M6OTEwMQotIGpvYl9uYW1lOiBrbGlwcGVyCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBkcnVja2kud2tzOjM5MDMKLSBqb2JfbmFtZTogb2N0b3ByaW50CiAgbWV0cmljc19wYXRoOiAvcGx1Z2luL3Byb21ldGhldXNfZXhwb3J0ZXIvbWV0cmljcwogIHBhcmFtczoKICAgIGFwaWtleToKICAgIC0gMzBFOEIwMUJGRDY3NEU1QkJENDQ2RDA4QzQ3MzBERjQKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGRydWNraS53a3M6ODAKLSBqb2JfbmFtZTogaGFzc2lvCiAgbWV0cmljc19wYXRoOiAvYXBpL3Byb21ldGhldXMKICBiZWFyZXJfdG9rZW46ICdleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKcGMzTWlPaUpoTXpCbVlqVTFaamN5WkdFMFl6YzJZbVUyTm1ZME5qbGpOVEF5TWpkalpDSXNJbWxoZENJNk1UWXhNamc0TXpJNU55d2laWGh3SWpveE9USTRNalF6TWprM2ZRLjFJQ3NIbGlVWFIwQ0c0SDh2UVJZSjVqVnFGd21xS1NCMGZTY1NpdEMtUTQnCiAgc3RhdGljX2NvbmZpZ3M6CiAgICAtIHRhcmdldHM6CiAgICAgIC0gaGFzc2lvLmxhbjo4MAotIGpvYl9uYW1lOiBoYXNzaW9fcmluZzg2CiAgbWV0cmljc19wYXRoOiAvYXBpL3Byb21ldGhldXMKICBiZWFyZXJfdG9rZW46ICdleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpJVXpJMU5pSjkuZXlKcGMzTWlPaUkwT0dGalpUSmlObVEzT1RnME1qYzNZV0ZtTW1ObVptVTFZemM0TlRFME5DSXNJbWxoZENJNk1UWXhNakU1TWprME1Dd2laWGh3SWpveE9USTNOVFV5T1RRd2ZRLkJiSUFYbTlScTBqYjZvdXFnVkhOZDZLZWV6M05QM3loLTd3eWZ1b0I4WWsnCiAgc3RhdGljX2NvbmZpZ3M6CiAgICAtIHRhcmdldHM6CiAgICAgIC0gYXV0by5jaGFvczo4MAotIGpvYl9uYW1lOiBwb3N0Z3JlcwogIHN0YXRpY19jb25maWdzOgogICAgLSB0YXJnZXRzOgogICAgICAtIHBvc3RncmVzLmxpdmUtZW52LnN2Yy5jbHVzdGVyLmxvY2FsOjkxODcKLSBqb2JfbmFtZTogbm9kZQogIHN0YXRpY19jb25maWdzOgogIC0gdGFyZ2V0czoKICAgIC0gYWRtMDEud2tzOjkxMDAKICAgIC0gZHVtb250LXdrcy53a3M6OTEwMAogICAgLSBkcnVja2kud2tzOjkxMDAKICAgIC0gZWJpbjAxLndrczo5MTAwCiAgICAtIGViaW4wMi53a3M6OTEwMAogICAgLSBvc21jLndrczo5MTAwCiAgICAtIHJpb3QwMS53a3M6OTEwMAogICAgLSB0cnVoZS5jaGFvczo5MTAwCiAgICAtIGF1dG8wMS5jaGFvczo5MTAwCiAgICAtIGF1dG8wMi5jaGFvczo5MTAwCiAgICAtIGR1bW9udC5jaGFvczo5MTAwCiAgICAtIHR1bW9yLmNoYW9zOjkxMDAKICAgIC0gd29obnouY2hhb3M6OTEwMAo=
+  prometheus-additional.yaml: LSBqb2JfbmFtZTogZ2l0ZWEKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGdpdC11aS5sYW4KLSBqb2JfbmFtZTogbXlzcWxkCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBtYXJpYWRiLmxhbjo5MTA0Ci0gam9iX25hbWU6IG1xdHQubW9zcXVpdHRvCiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBtcXR0Lmxhbjo5MjM0CiAgICAtIG1xdHQuY2hhb3M6OTIzNAotIGpvYl9uYW1lOiBoYXByb3h5CiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBhZG0wMS53a3M6OTEwMQogICAgLSBkcnVja2kud2tzOjkxMDEKICAgIC0gYXV0bzAyLmNoYW9zOjkxMDEKLSBqb2JfbmFtZToga2xpcHBlcgogIHN0YXRpY19jb25maWdzOgogIC0gdGFyZ2V0czoKICAgIC0gZHJ1Y2tpLndrczozOTAzCi0gam9iX25hbWU6IG9jdG9wcmludAogIG1ldHJpY3NfcGF0aDogL3BsdWdpbi9wcm9tZXRoZXVzX2V4cG9ydGVyL21ldHJpY3MKICBwYXJhbXM6CiAgICBhcGlrZXk6CiAgICAtIDMwRThCMDFCRkQ2NzRFNUJCRDQ0NkQwOEM0NzMwREY0CiAgc3RhdGljX2NvbmZpZ3M6CiAgLSB0YXJnZXRzOgogICAgLSBkcnVja2kud2tzOjgwCi0gam9iX25hbWU6IGhhc3NpbwogIG1ldHJpY3NfcGF0aDogL2FwaS9wcm9tZXRoZXVzCiAgYmVhcmVyX3Rva2VuOiAnZXlKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKSVV6STFOaUo5LmV5SnBjM01pT2lKaE16Qm1ZalUxWmpjeVpHRTBZemMyWW1VMk5tWTBOamxqTlRBeU1qZGpaQ0lzSW1saGRDSTZNVFl4TWpnNE16STVOeXdpWlhod0lqb3hPVEk0TWpRek1qazNmUS4xSUNzSGxpVVhSMENHNEg4dlFSWUo1alZxRndtcUtTQjBmU2NTaXRDLVE0JwogIHN0YXRpY19jb25maWdzOgogICAgLSB0YXJnZXRzOgogICAgICAtIGhhc3Npby5sYW46ODAKLSBqb2JfbmFtZTogaGFzc2lvX3Jpbmc4NgogIG1ldHJpY3NfcGF0aDogL2FwaS9wcm9tZXRoZXVzCiAgYmVhcmVyX3Rva2VuOiAnZXlKMGVYQWlPaUpLVjFRaUxDSmhiR2NpT2lKSVV6STFOaUo5LmV5SnBjM01pT2lJME9HRmpaVEppTm1RM09UZzBNamMzWVdGbU1tTm1abVUxWXpjNE5URTBOQ0lzSW1saGRDSTZNVFl4TWpFNU1qazBNQ3dpWlhod0lqb3hPVEkzTlRVeU9UUXdmUS5CYklBWG05UnEwamI2b3VxZ1ZITmQ2S2VlejNOUDN5aC03d3lmdW9COFlrJwogIHN0YXRpY19jb25maWdzOgogICAgLSB0YXJnZXRzOgogICAgICAtIGF1dG8uY2hhb3M6ODAKLSBqb2JfbmFtZTogcG9zdGdyZXMKICBzdGF0aWNfY29uZmlnczoKICAgIC0gdGFyZ2V0czoKICAgICAgLSBwb3N0Z3Jlcy5saXZlLWVudi5zdmMuY2x1c3Rlci5sb2NhbDo5MTg3Ci0gam9iX25hbWU6IG5vZGUKICBzdGF0aWNfY29uZmlnczoKICAtIHRhcmdldHM6CiAgICAtIGFkbTAxLndrczo5MTAwCiAgICAtIGR1bW9udC13a3Mud2tzOjkxMDAKICAgIC0gZHJ1Y2tpLndrczo5MTAwCiAgICAtIGViaW4wMS53a3M6OTEwMAogICAgLSBlYmluMDIud2tzOjkxMDAKICAgIC0gb3NtYy53a3M6OTEwMAogICAgLSByaW90MDEud2tzOjkxMDAKICAgIC0gdHJ1aGUuY2hhb3M6OTEwMAogICAgLSBhdXRvMDIuY2hhb3M6OTEwMAogICAgLSBkdW1vbnQuY2hhb3M6OTEwMAogICAgLSB0dW1vcjAxLmNoYW9zOjkxMDAKICAgIC0gd29obnouY2hhb3M6OTEwMAogICAgLSB5b3JpLmNoYW9zOjkxMDAK
 kind: Secret
 metadata:
   creationTimestamp: null

cluster-monitoring-local/prometheus-additional.yaml

@@ -10,6 +10,7 @@
   static_configs:
   - targets:
     - mqtt.lan:9234
+    - mqtt.chaos:9234
 - job_name: haproxy
   static_configs:
   - targets:
@@ -55,8 +56,8 @@
     - osmc.wks:9100
     - riot01.wks:9100
     - truhe.chaos:9100
-    - auto01.chaos:9100
     - auto02.chaos:9100
     - dumont.chaos:9100
-    - tumor.chaos:9100
+    - tumor01.chaos:9100
     - wohnz.chaos:9100
+    - yori.chaos:9100