merged

.drone.jsonnet

@@ -0,0 +1,50 @@
+local dirs = ['_CI-CD', 'apps'];
+
+local packages = ['debian-stable', 'debian-stable-build-essential', 'debian-stable-openwrt', 
+                    'debian-golang', 'debian-stable-php-fpm', 'distcc', 'debian-testing'];
+#local packages = ['debian-stable-openwrt'];
+
+local apps = ['rompr', 'apt-cacher-ng', 'curl', 'mosquitto', 'mosquitto-prometheus-exporter'];
+#local apps = ['rompr'];
+
+local build(dir, package) = {
+  name: '%(package)s' % { package: package },
+  image: 'plugins/docker',
+  settings: {
+    context: '%(dir)s/%(package)s' % { dir: dir, package: package },
+    dockerfile: '%(dir)s/%(package)s/Dockerfile' % { dir: dir, package: package },
+    registry: 'http://cr.wks',
+    insecure: 'true',
+    purge: 'false',
+    experimental: 'true',
+    tags: ['latest'],
+    repo: 'cr.wks/%(package)s' % { package: package },
+    cache_from: 'cr.wks/%(package)s:latest' % { package: package },
+  },
+};
+[
+  {
+    kind: 'pipeline',
+    type: 'docker',
+    name: 'Build Changes',
+    platform: {
+      os: 'linux',
+      arch: 'arm64',
+    },
+    steps: [
+      {
+       name: 'git log',
+       image: 'cr.wks/debian-stable',
+       commands: [ 'bin/find_changes.sh' ]
+       },
+     #  [
+     # build('_CI-CD', app)
+     # for app in packages
+     # ],
+     # [
+     #  build('apps', app)
+     # for app in apps
+     # ]
+    ],
+  },
+]

.gitignore

@@ -1 +1 @@
-csi-s3/storage-csi-s3/cmd/s3driver/s3driver
+*.swp

.gitmodules

@@ -1,51 +0,0 @@
-[submodule "kube-prometheus"]
-	path = kube-prometheus
-	url = https://github.com/coreos/kube-prometheus.git
-[submodule "cluster-monitoring"]
-	path = cluster-monitoring
-	url = git@git.lan:chaos/k8s-cluster-monitoring.git
-[submodule "gluster-kubernetes"]
-	path = gluster-kubernetes
-	url = https://github.com/jayflory/gluster-kubernetes.git
-[submodule "kubernetes-ingress"]
-	path = kubernetes-ingress
-	url = https://github.com/haproxytech/kubernetes-ingress.git
-[submodule "pihole-kubernetes"]
-	path = pihole-kubernetes
-	url = https://github.com/MoJo2600/pihole-kubernetes.git
-[submodule "pihole-helm"]
-	path = pihole-helm
-	url = https://github.com/ChrisPhillips-cminion/pihole-helm.git
-[submodule "helm"]
-	path = helm
-	url = https://github.com/helm/helm.git
-[submodule "docker-apt-cacher-ng"]
-	path = docker-apt-cacher-ng
-	url = https://github.com/sameersbn/docker-apt-cacher-ng.git
-[submodule "mosquitto/charts"]
-	path = mosquitto/charts
-	url = https://github.com/smizy/charts.git
-[submodule "csi-s3/storage-csi-s3"]
-	path = csi-s3/storage-csi-s3
-	url = https://github.com/ctrox/csi-s3.git
-[submodule "csi-s3/external-attacher"]
-	path = csi-s3/external-attacher
-	url = https://github.com/kubernetes-csi/external-attacher.git
-[submodule "csi-s3/external-provisioner"]
-	path = csi-s3/external-provisioner
-	url = https://github.com/kubernetes-csi/external-provisioner.git
-[submodule "csi-s3/node-driver-registrar"]
-	path = csi-s3/node-driver-registrar
-	url = https://github.com/kubernetes-csi/node-driver-registrar.git
-[submodule "apps/tekton/dashboard"]
-	path = apps/tekton/dashboard
-	url = https://github.com/tektoncd/dashboard.git
-[submodule "_sys/haproxy-ingress"]
-	path = _sys/haproxy-ingress
-	url = https://github.com/haproxytech/kubernetes-ingress.git
-[submodule "nfs-subdir-external-provisioner"]
-	path = nfs-subdir-external-provisioner
-	url = https://github.com/kubernetes-sigs/nfs-subdir-external-provisioner.git
-[submodule "descheduler"]
-	path = descheduler
-	url = https://github.com/kubernetes-sigs/descheduler.git

.project

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <projectDescription>
-	<name>kubernetes</name>
+	<name>docker-images</name>
 	<comment></comment>
 	<projects>
 	</projects>

TODO.md

@@ -1,9 +0,0 @@
-root@pine01:/etc/kubernetes# kubeadm upgrade apply v1.24.9 --ignore-preflight-errors=CoreDNSUnsupportedPlugins
-[upgrade/config] Making sure the configuration is correct:
-[upgrade/config] Reading configuration from the cluster...
-[upgrade/config] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
-W0112 18:28:48.533830   21616 initconfiguration.go:120] Usage of CRI endpoints without URL scheme is deprecated and can cause kubelet errors in the future. Automatically prepending scheme "unix" to the "criSocket" with value "/run/containerd/containerd.sock". Please update your configuration!
-
-
-CoreDNS                   v1.8.6    v1.9.3
-

_CI-CD/debian-golang/Dockerfile

@@ -1,4 +1,4 @@
-FROM cr.lan/debian-stable
+FROM cr.wks/debian-stable
 
 RUN apt-get update && apt-get install -y \
 	golang make git

_CI-CD/debian-golang/tekton.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  name: img-debian-golang
-spec:
-  pipelineRef:
-    name: kaniko-pipeline
-  params:
-    - name: git-url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: git-revision
-      value: master
-    - name: path-to-image-context
-      value: _CI-CD/debian-golang
-    - name: path-to-dockerfile
-      value: _CI-CD/debian-golang/Dockerfile
-    - name: image-name
-      value: cr.lan/debian-stable-golang
-  workspaces:
-      - name: git-source
-        persistentVolumeClaim:
-          claimName: tektoncd-workspaces
-        subPath: tekton/debian-stable-golang

_CI-CD/debian-stable-build-essential/Dockerfile

@@ -1,4 +1,4 @@
-FROM cr.lan/debian-stable
+FROM cr.wks/debian-stable
 
 RUN apt-get update && apt-get install -y \
 	dnsutils procps nmap bash iputils-ping bash \

_CI-CD/debian-stable-build-essential/tekton.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  name: img-debian-stable-build-essential
-spec:
-  pipelineRef:
-    name: kaniko-pipeline
-  params:
-    - name: git-url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: git-revision
-      value: master
-    - name: path-to-image-context
-      value: _CI-CD/debian-stable-build-essential
-    - name: path-to-dockerfile
-      value: _CI-CD/debian-stable-build-essential/Dockerfile
-    - name: image-name
-      value: cr.lan/debian-stable-build-essential
-  workspaces:
-      - name: git-source
-        persistentVolumeClaim:
-          claimName: tektoncd-workspaces
-        subPath: tekton/debian-stable-build-essential

_CI-CD/debian-stable-openwrt/Dockerfile

@@ -0,0 +1,14 @@
+FROM cr.wks/debian-stable-build-essential
+
+RUN apt update -y; \
+        apt install -y build-essential ccache ecj fastjar file g++ gawk \
+              gettext git java-propose-classpath libelf-dev libncurses5-dev \
+              libncursesw5-dev libssl-dev python3 python3-dev unzip wget \
+              python3-distutils python3-setuptools rsync subversion swig time \
+              xsltproc zlib1g-dev make distcc distcc-pump nfs-common clang flex bison g++ gawk \
+              gcc-multilib-mips-linux-gnu git libncurses-dev libssl-dev  && \
+       apt-get remove --purge -y exim* && \
+	   apt-get autoremove --purge -y && \
+       apt-get clean -y && \                                                                                           
+       rm -rf /var/lib/apt/lists/* && \                                                                                
+       rm -rf /var/cache/apt/*

_CI-CD/debian-stable-php-fpm/Dockerfile

@@ -1,4 +1,4 @@
-FROM cr.lan/debian-stable
+FROM cr.wks/debian-stable
 
 ENV DEBIAN_FRONTEND noninteractive
 RUN apt-get update && apt-get install -y \

_CI-CD/debian-stable-php-fpm/tekton.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  name: img-debian-stable-php-fpm
-spec:
-  pipelineRef:
-    name: kaniko-pipeline
-  params:
-    - name: git-url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: git-revision
-      value: master
-    - name: path-to-image-context
-      value: _CI-CD/debian-stable-php-fpm
-    - name: path-to-dockerfile
-      value: _CI-CD/debian-stable-php-fpm/Dockerfile
-    - name: image-name
-      value: cr.lan/debian-stable-php-fpm
-  workspaces:
-      - name: git-source
-        persistentVolumeClaim:
-          claimName: tektoncd-workspaces
-        subPath: tekton/debian-stable-php-fpm

_CI-CD/debian-stable/Dockerfile

@@ -1,12 +1,13 @@
 FROM debian:stable-slim
 
-RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
-	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
-	apt-get update && apt-get install -y \
-	dnsutils procps nmap bash iputils-ping bash && \
+RUN sed -i 's@deb.debian.org@apt-cache.service.nr5/deb.debian.org@g' /etc/apt/sources.list.d/debian.sources && \
+	sed -i 's@security.debian.org@apt-cache.service.nr5/security.debian.org@g' /etc/apt/sources.list.d/debian.sources
 	
-RUN	apt-get remove -y --purge man-db ;\
-	apt-get autoremove -y --purge ;\ 
+RUN	apt-get update && apt-get install -y \
+	man-db- \
+    dnsutils procps nmap bash iputils-ping bash git
+
+RUN	apt-get autoremove -y --purge ;\ 
 	apt-get clean -y ;\ 
 	rm -rf /var/lib/apt/lists/* ;\
 	rm -rf /var/cache/apt/*

_CI-CD/debian-stable/tekton.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  name: img-debian-stable
-spec:
-  pipelineRef:
-    name: kaniko-pipeline
-  params:
-    - name: git-url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: git-revision
-      value: master
-    - name: path-to-image-context
-      value: _CI-CD/debian-stable
-    - name: path-to-dockerfile
-      value: _CI-CD/debian-stable/Dockerfile
-    - name: image-name
-      value: cr.lan/debian-stable
-  workspaces:
-      - name: git-source
-        persistentVolumeClaim:
-          claimName: tektoncd-workspaces
-        subPath: tekton/debian-stable

_CI-CD/debian-testing/Dockerfile

@@ -1,8 +1,9 @@
 FROM debian:testing-slim
 
-RUN sed -i 's@deb.debian.org@apt-cache.lan/deb.debian.org@g' /etc/apt/sources.list && \
-	sed -i 's@security.debian.org@apt-cache.lan/security.debian.org@g' /etc/apt/sources.list && \
-	apt-get update && apt-get install -y \
+RUN sed -i 's@deb.debian.org@apt-cache.service.nr5/deb.debian.org@g' /etc/apt/sources.list.d/debian.sources && \
+    sed -i 's@security.debian.org@apt-cache.service.nr5/security.debian.org@g' /etc/apt/sources.list.d/debian.sources
+
+RUN	apt-get update && apt-get install -y \
 	dnsutils procps nmap bash iputils-ping bash
 
 RUN	apt-get remove -y --purge man-db ;\

_CI-CD/debian-testing/tekton.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  name: img-debian-testing
-spec:
-  pipelineRef:
-    name: kaniko-pipeline
-  params:
-    - name: git-url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: git-revision
-      value: master
-    - name: path-to-image-context
-      value: _CI-CD/debian-testing
-    - name: path-to-dockerfile
-      value: _CI-CD/debian-testing/Dockerfile
-    - name: image-name
-      value: cr.lan/debian-testing
-  workspaces:
-      - name: git-source
-        persistentVolumeClaim:
-          claimName: tektoncd-workspaces
-        subPath: tekton/debian-testing

_CI-CD/distcc/Dockerfile

@@ -1,4 +1,4 @@
-FROM cr.lan/debian-stable-build-essential
+FROM cr.wks/debian-stable-build-essential
 
 RUN apt-get update && \
   	apt-get install -y \
@@ -6,8 +6,6 @@ RUN apt-get update && \
     dpkg-dev distcc ccache \
     build-essential gcc cpp g++ clang llvm 
 	
-	
-	
 RUN	apt-get remove -y --purge man-db ;\
 	apt-get autoremove -y --purge ;\ 
 	apt-get clean -y ;\ 

_CI-CD/distcc/tekton.yaml

@@ -1,23 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: PipelineRun
-metadata:
-  name: img-distcc
-spec:
-  pipelineRef:
-    name: kaniko-pipeline
-  params:
-    - name: git-url
-      value: http://git-ui.lan/chaos/kubernetes.git
-    - name: git-revision
-      value: master
-    - name: path-to-image-context
-      value: _CI-CD/distcc
-    - name: path-to-dockerfile
-      value: _CI-CD/distcc/Dockerfile
-    - name: image-name
-      value: cr.lan/distcc
-  workspaces:
-      - name: git-source
-        persistentVolumeClaim:
-          claimName: tektoncd-workspaces
-        subPath: tekton/distcc

_CI-CD/git.lan-access-token.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: git-secret
-type: Opaque
-data:
-  token: Nzk1YTFhMGQxMWQ0MDJiY2FiOGM3MjkyZDk5ODIyMzg2NDNkM2U3OQo=

_CI-CD/tekton-pvc.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: tektoncd-workspaces
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 40Gi
-  storageClassName: nfs-ssd-ebin02
-  volumeMode: Filesystem
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: tektoncd-workspaces 
-spec:
-  storageClassName: "nfs-ssd-ebin02"
-  nfs:
-    path: /data/raid1-ssd/k8s-data/tektoncd-workspaces
-    server: ebin02
-  capacity:
-    storage: 40Gi
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    kind: PersistentVolumeClaim
-    name: tektoncd-workspaces
-    namespace: default

_CI-CD/tektoncd-git-clone-task.yaml

@@ -1,101 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: git-clone
-spec:
-  workspaces:
-    - name: output
-      description: The git repo will be cloned onto the volume backing this workspace
-  params:
-    - name: url
-      description: git url to clone
-      type: string
-      default: http://git-ui.lan/chaos/kubernetes.git
-    - name: revision
-      description: git revision to checkout (branch, tag, sha, ref…)
-      type: string
-      default: master
-    - name: refspec
-      description: (optional) git refspec to fetch before checking out revision
-      default: ""
-    - name: submodules
-      description: defines if the resource should initialize and fetch the submodules
-      type: string
-      default: "true"
-    - name: depth
-      description: performs a shallow clone where only the most recent commit(s) will be fetched
-      type: string
-      default: "1"
-    - name: sslVerify
-      description: defines if http.sslVerify should be set to true or false in the global git config
-      type: string
-      default: "true"
-    - name: subdirectory
-      description: subdirectory inside the "output" workspace to clone the git repo into
-      type: string
-      default: ""
-    - name: deleteExisting
-      description: clean out the contents of the repo's destination directory (if it already exists) before trying to clone the repo there
-      type: string
-      default: "true"
-    - name: httpProxy
-      description: git HTTP proxy server for non-SSL requests
-      type: string
-      default: ""
-    - name: httpsProxy
-      description: git HTTPS proxy server for SSL requests
-      type: string
-      default: ""
-    - name: noProxy
-      description: git no proxy - opt out of proxying HTTP/HTTPS requests
-      type: string
-      default: ""
-  results:
-    - name: commit
-      description: The precise commit SHA that was fetched by this Task
-  steps:
-    - name: clone
-      image: gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.30.2
-      script: |
-        CHECKOUT_DIR="$(workspaces.output.path)/$(params.subdirectory)"
-
-        cleandir() {
-          # Delete any existing contents of the repo directory if it exists.
-          #
-          # We don't just "rm -rf $CHECKOUT_DIR" because $CHECKOUT_DIR might be "/"
-          # or the root of a mounted volume.
-          if [[ -d "$CHECKOUT_DIR" ]] ; then
-            # Delete non-hidden files and directories
-            rm -rf "$CHECKOUT_DIR"/*
-            # Delete files and directories starting with . but excluding ..
-            rm -rf "$CHECKOUT_DIR"/.[!.]*
-            # Delete files and directories starting with .. plus any other character
-            rm -rf "$CHECKOUT_DIR"/..?*
-          fi
-        }
-
-        if [[ "$(params.deleteExisting)" == "true" ]] ; then
-          cleandir
-        fi
-
-        test -z "$(params.httpProxy)" || export HTTP_PROXY=$(params.httpProxy)
-        test -z "$(params.httpsProxy)" || export HTTPS_PROXY=$(params.httpsProxy)
-        test -z "$(params.noProxy)" || export NO_PROXY=$(params.noProxy)
-
-        /ko-app/git-init \
-          -url "$(params.url)" \
-          -revision "$(params.revision)" \
-          -refspec "$(params.refspec)" \
-          -path "$CHECKOUT_DIR" \
-          -sslVerify="$(params.sslVerify)" \
-          -submodules="$(params.submodules)" \
-          -depth "$(params.depth)"
-        cd "$CHECKOUT_DIR"
-        RESULT_SHA="$(git rev-parse HEAD | tr -d '\n')"
-        EXIT_CODE="$?"
-        if [ "$EXIT_CODE" != 0 ]
-        then
-          exit $EXIT_CODE
-        fi
-        # Make sure we don't add a trailing newline to the result!
-        echo -n "$RESULT_SHA" > $(results.commit.path)

_CI-CD/tektoncd-kaniko-pipeline.yaml

@@ -1,45 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Pipeline
-metadata:
-  name: kaniko
-spec:
-  params:
-    - name: git-url
-    - name: git-revision
-    - name: image-name
-    - name: path-to-image-context
-    - name: path-to-dockerfile
-  workspaces:
-    - name: git-source
-  tasks:
-    - name: fetch-from-git
-      taskRef:
-        name: git-clone
-      params:
-        - name: url
-          value: $(params.git-url)
-        - name: revision
-          value: $(params.git-revision)
-        - name: submodules
-          value: false
-        - subdirectory:
-          value: "source"
-      workspaces:
-        - name: source
-          workspace: git-source
-    - name: build-image
-      taskRef:
-        name: kaniko
-      params:
-        - name: IMAGE
-          value: $(params.image-name)
-        - name: CONTEXT
-          value: $(params.path-to-image-context)
-        - name: DOCKERFILE
-          value: $(params.path-to-dockerfile)
-      workspaces:
-        - name: source
-          workspace: git-source
-  # If you want you can add a Task that uses the IMAGE_DIGEST from the kaniko task
-  # via $(tasks.build-image.results.IMAGE_DIGEST) - this was a feature we hadn't been
-  # able to fully deliver with the Image PipelineResource!

_CI-CD/tektoncd-kaniko-task.yaml

@@ -1,78 +0,0 @@
-apiVersion: tekton.dev/v1beta1
-kind: Task
-metadata:
-  name: kaniko
-  labels:
-    app.kubernetes.io/version: "0.5"
-  annotations:
-    tekton.dev/pipelines.minVersion: "0.17.0"
-    tekton.dev/categories: Image Build
-    tekton.dev/tags: image-build
-    tekton.dev/displayName: "Build and upload container image using Kaniko"
-    tekton.dev/platforms: "linux/arm64"
-spec:
-  description: >-
-    This Task builds source into a container image using Google's kaniko tool.
-
-    Kaniko doesn't depend on a Docker daemon and executes each
-    command within a Dockerfile completely in userspace. This enables
-    building container images in environments that can't easily or
-    securely run a Docker daemon, such as a standard Kubernetes cluster.
-
-  params:
-  - name: IMAGE
-    description: Name (reference) of the image to build.
-  - name: DOCKERFILE
-    description: Path to the Dockerfile to build.
-    default: ./Dockerfile
-  - name: CONTEXT
-    description: The build context used by Kaniko.
-    default: ./
-  - name: EXTRA_ARGS
-    type: array
-    default: []
-  - name: BUILDER_IMAGE
-    description: The image on which builds will run (default is v1.5.1)
-    default: gcr.io/kaniko-project/executor:v1.9.1
-  workspaces:
-  - name: source
-    description: Holds the context and docker file
-  - name: dockerconfig
-    description: Includes a docker `config.json`
-    optional: true
-    mountPath: /kaniko/.docker
-  results:
-  - name: IMAGE-DIGEST
-    description: Digest of the image just built.
-
-  steps:
-  - name: debug
-    workingDir: $(workspaces.source.path)
-    image: bash
-    script: |
-      #!/usr/bin/env bash
-      export
-      pwd
-      mount
-      ls -al
-  - name: build-and-push
-    workingDir: $(workspaces.source.path)
-    image: $(params.BUILDER_IMAGE)
-    args:
-    - $(params.EXTRA_ARGS[*])
-    - --dockerfile=$(params.DOCKERFILE)
-    - --context=$(params.CONTEXT)  # The user does not need to care the workspace and the source.
-    - --destination=$(params.IMAGE)
-    - --digest-file=/tekton/results/IMAGE-DIGEST
-    - --snapshotMode=redo
-    - --single-snapshot
-    - --use-new-run
-    - --skip-tls-verify
-    - --cache
-    - --cache-copy-layers
-    - --cache-dir=/workspace/cache
-    # kaniko assumes it is running as root, which means this example fails on platforms
-    # that default to run containers as random uid (like OpenShift). Adding this securityContext
-    # makes it explicit that it needs to run as root.
-    securityContext:
-      runAsUser: 0

_apps/almond-cloud/Dockerfile

@@ -1,4 +1,4 @@
-FROM debian:bullseye
+FROM debian:stable
 ENV DEBIAN_FRONTEND noninteractive
 ARG DEVPKGS="git make cmake gcc g++ python-dev libsqlcipher-dev"
 

_apps/apt-cacher-ng/Dockerfile

@@ -1,4 +1,4 @@
-FROM cr.lan/debian-stable
+FROM cr.wks/debian-stable
 
 RUN apt-get update && apt-get install -y \
 	apt-cacher-ng && \

_apps/curl/Dockerfile

@@ -1,5 +1,4 @@
-FROM cr.lan/debian-stable
-
+FROM cr.wks/debian-stable
 RUN apt-get update && apt-get install -y \
 	curl procps && \
 	apt-get clean -y && \ 

_apps/mosquitto-prometheus-exporter/Dockerfile

@@ -0,0 +1,19 @@
+FROM cr.wks/debian-golang AS build
+
+ENV GOARCH=arm64
+ENV GOPATH=/usr/src/gopath
+ENV GOCACHE=/usr/src/gocache
+RUN go env
+WORKDIR /usr/src
+RUN go install github.com/sapcc/mosquitto-exporter@latest
+#RUN go mod download
+
+FROM cr.wks/debian-stable
+LABEL source_repository="https://github.com/sapcc/mosquitto-exporter"
+
+COPY --from=build /usr/src/gopath/bin/mosquitto-exporter /mosquitto-exporter
+RUN chmod 0755 /mosquitto-exporter
+
+EXPOSE 9234
+
+ENTRYPOINT [ "/mosquitto-exporter" ]

_apps/mosquitto/Dockerfile

@@ -1,4 +1,4 @@
-FROM cr.lan/debian-stable
+FROM cr.wks/debian-stable
 
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \

_apps/rompr/Dockerfile

@@ -1,8 +1,8 @@
-FROM cr.lan/debian-stable-php-fpm
+FROM cr.wks/debian-stable-php-fpm
 
-ARG ROMPR_VERSION=1.61
+ARG ROMPR_VERSION=2.14
 # Install packages
-ENV DEBIAN_FRONTEND noninteractive
+ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update && \
   	apt-get -y install \
       nginx \
@@ -19,21 +19,21 @@ RUN mkdir -p /app /rompr
 RUN unzip -d /app rompr.zip && rm rompr.zip
 RUN ln -sf /rompr/prefs /app/rompr/prefs; ln -sf /rompr/albumart /app/rompr/albumart;
 RUN chown -R www-data:www-data /app/rompr /rompr
-RUN pwd; ls -la .;ls -la /workspace/source;
+RUN pwd; ls -la .;ls -la /etc/php/*/fpm
 ADD files/nginx_default /etc/nginx/sites-available/default
 RUN mkdir -p /run/php/
 #Environment variables to configure php
-RUN sed -ri -e  's/^allow_url_fopen =.*/allow_url_fopen = On/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^memory_limit =.*/memory_limit = 128M/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^max_execution_time =.*/max_execution_time = 1800/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^post_max_size =.*/post_max_size = 256M/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^upload_max_filesize =.*/upload_max_filesize = 8M/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^max_file_uploads =.*/max_file_uploads = 50/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^display_errors =.*/display_errors = On/g' /etc/php/7.4/fpm/php.ini
-RUN sed -ri -e  's/^display_startup_errors =.*/display_startup_errors = On/g' /etc/php/7.4/fpm/php.ini
+RUN sed -ri -e  's/^allow_url_fopen =.*/allow_url_fopen = On/g' /etc/php/8.2/fpm/php.ini && \
+    sed -ri -e  's/^memory_limit =.*/memory_limit = 128M/g' /etc/php/8.2/fpm/php.ini && \
+    sed -ri -e  's/^max_execution_time =.*/max_execution_time = 1800/g' /etc/php/8.2/fpm/php.ini && \
+    sed -ri -e  's/^post_max_size =.*/post_max_size = 256M/g' /etc/php/8.2/fpm/php.ini && \
+    sed -ri -e  's/^upload_max_filesize =.*/upload_max_filesize = 8M/g' /etc/php/8.2/fpm/php.ini && \
+    sed -ri -e  's/^max_file_uploads =.*/max_file_uploads = 50/g' /etc/php/8.2/fpm/php.ini && \
+    sed -ri -e  's/^display_errors =.*/display_errors = On/g' /etc/php/8.2/fpm/php.ini && \
+    sed -ri -e  's/^display_startup_errors =.*/display_startup_errors = On/g' /etc/php/8.2/fpm/php.ini
 
 RUN echo "<?php phpinfo(); ?>" > /app/rompr/phpinfo.php
-RUN update-rc.d php7.4-fpm defaults
+RUN update-rc.d php8.2-fpm defaults
 ADD files/run-httpd /usr/local/bin/
 RUN chmod 755 /usr/local/bin/run-httpd
 EXPOSE 80

_apps/rompr/README.md

@@ -0,0 +1,5 @@
+Run with:
+
+```podman run --pull=always -d --replace -p 127.0.0.1:8081:80 \
+           --mount=type=bind,source=/var/lib/rompr,destination=/rompr \
+           --tz=Europe/Berlin --name=rompr cr.wks/rompr:latest```

_apps/rompr/files/nginx_default

@@ -20,7 +20,7 @@ server {
            index index.php;
            location ~ \.php {
                 try_files $uri index.php =404;
-                fastcgi_pass 127.0.0.1:9000;
+                fastcgi_pass unix:/run/php/php8.2-fpm.sock;
                 fastcgi_index index.php;
                 fastcgi_param SCRIPT_FILENAME $request_filename;
                 include /etc/nginx/fastcgi_params;

_apps/rompr/files/run-httpd

@@ -4,5 +4,5 @@ mkdir -p /var/log/nginx
 set -e
 mkdir -p /rompr/albumart /rompr/prefs
 chown www-data:www-data -R /rompr/albumart /rompr/prefs
-/etc/init.d/php7.4-fpm restart
+/etc/init.d/php8.2-fpm restart
 exec /usr/sbin/nginx -g 'daemon off;'

_scripts/get_resources.py

@@ -1,73 +0,0 @@
-#!/usr/bin/python3
-import kubernetes as k8s
-
-from pint        import UnitRegistry
-from collections import defaultdict
-
-__all__ = ["compute_allocated_resources"]
-
-
-def compute_allocated_resources():
-    ureg = UnitRegistry()
-    ureg.load_definitions('kubernetes_units.txt')
-
-    Q_ = ureg.Quantity
-    data = {}
-
-    # doing this computation within a k8s cluster
-    k8s.config.load_kube_config()
-    core_v1 = k8s.client.CoreV1Api()
-    
-#     print("Listing pods with their IPs:")
-#     ret = core_v1.list_pod_for_all_namespaces(watch=False)
-#     for i in ret.items:
-#         print("%s\t%s\t%s" % (i.status.pod_ip, i.metadata.namespace, i.metadata.name))
-
-    for node in core_v1.list_node().items:
-        
-        stats = {}
-        node_name = node.metadata.name
-        allocatable = node.status.allocatable
-        max_pods = int(int(allocatable["pods"]) * 1.5)
-#         print("{} ALLOC: {} MAX_PODS: {}".format(node_name,allocatable,max_pods))
-        field_selector = ("status.phase!=Succeeded,status.phase!=Failed," + 
-                          "spec.nodeName=" + node_name)
-
-        stats["cpu_alloc"] = Q_(allocatable["cpu"])
-        stats["mem_alloc"] = Q_(allocatable["memory"])
-
-        pods = core_v1.list_pod_for_all_namespaces(limit=max_pods,
-                                                   field_selector=field_selector).items
-
-        # compute the allocated resources
-        cpureqs, cpulmts, memreqs, memlmts = [], [], [], []
-        for pod in pods:
-            for container in pod.spec.containers:
-                res = container.resources
-                reqs = defaultdict(lambda: 0, res.requests or {})
-                lmts = defaultdict(lambda: 0, res.limits or {})
-                cpureqs.append(Q_(reqs["cpu"]))
-                memreqs.append(Q_(reqs["memory"]))
-                cpulmts.append(Q_(lmts["cpu"]))
-                memlmts.append(Q_(lmts["memory"]))
-
-        stats["cpu_req"] = sum(cpureqs)
-        stats["cpu_lmt"] = sum(cpulmts)
-        stats["cpu_req_per"] = (stats["cpu_req"] / stats["cpu_alloc"] * 100)
-        stats["cpu_lmt_per"] = (stats["cpu_lmt"] / stats["cpu_alloc"] * 100)
-
-        stats["mem_req"] = sum(memreqs)
-        stats["mem_lmt"] = sum(memlmts)
-        stats["mem_req_per"] = (stats["mem_req"] / stats["mem_alloc"] * 100)
-        stats["mem_lmt_per"] = (stats["mem_lmt"] / stats["mem_alloc"] * 100)
-
-        data[node_name] = stats
-
-    return data
-
-if __name__ == "__main__":
-    # execute only if run as a script
-    print(compute_allocated_resources())
-    
-    
-    

_scripts/kubernetes_units.txt

@@ -1,20 +0,0 @@
-# memory units
-
-kmemunits = 1 = [kmemunits]
-Ki = 1024 * kmemunits
-Mi = Ki^2
-Gi = Ki^3
-Ti = Ki^4
-Pi = Ki^5
-Ei = Ki^6
-
-# cpu units
-
-kcpuunits = 1 = [kcpuunits]
-m = 1/1000 * kcpuunits
-k = 1000 * kcpuunits
-M = k^2
-G = k^3
-T = k^4
-P = k^5
-E = k^6

_sys/README.md

@@ -1,90 +0,0 @@
-Upgrade:
-
-```
-export KV=1.26.0-00;
-apt-mark unhold kubeadm=$KV kubectl=$KV kubelet=$KV;
-apt install -y kubeadm=$KV;
-```
-
-```
-kubeadm upgrade node #Other pines in the wood
-```
-
-```
-#pine01
-kubeadm upgrade plan --ignore-preflight-errors=CoreDNSUnsupportedPlugins;
-kubeadm config images pull;
-kubeadm upgrade apply ${KV/\-*/} --ignore-preflight-errors=CoreDNSUnsupportedPlugins --certificate-renewal=false; #sometimes true
-```
-
-```
-apt install kubectl=$KV kubelet=$KV;
-systemctl daemon-reload && systemctl restart kubelet;
-apt-mark hold kubeadm=$KV kubectl=$KV kubelet=$KV;
-echo 'You can now uncordon, der Geraet'; 
-```
-
-
-
-# Infos:
-
-```
-$ kubectl -n kube-system get cm kubeadm-config -o yaml
-apiVersion: v1
-data:
-  ClusterConfiguration: |
-    apiServer:
-      extraArgs:
-        authorization-mode: Node,RBAC
-      timeoutForControlPlane: 4m0s
-    apiVersion: kubeadm.k8s.io/v1beta3
-    certificatesDir: /etc/kubernetes/pki
-    clusterName: kubernetes
-    controllerManager: {}
-    dns: {}
-    etcd:
-      local:
-        dataDir: /var/lib/etcd
-    imageRepository: registry.k8s.io
-    kind: ClusterConfiguration
-    kubernetesVersion: v1.23.15
-    networking:
-      dnsDomain: cluster.local
-      podSubnet: 172.23.0.0/16
-      serviceSubnet: 10.96.0.0/12
-    scheduler: {}
-  ClusterStatus: |
-    apiEndpoints:
-      pine01:
-        advertiseAddress: 172.16.23.21
-        bindPort: 6443
-    apiVersion: kubeadm.k8s.io/v1beta2
-    kind: ClusterStatus
-kind: ConfigMap
-metadata:
-  creationTimestamp: "2021-01-20T14:55:12Z"
-  managedFields:
-  - apiVersion: v1
-    fieldsType: FieldsV1
-    fieldsV1:
-      f:data:
-        .: {}
-        f:ClusterConfiguration: {}
-        f:ClusterStatus: {}
-    manager: kubeadm
-    operation: Update
-    time: "2021-01-20T14:55:12Z"
-  name: kubeadm-config
-  namespace: kube-system
-  resourceVersion: "441685033"
-  uid: c70fefd3-02c3-44c8-a37d-7b17ec445455
-```
-
-
-
-Descheduler (reschedule pods)
-# https://github.com/kubernetes-sigs/descheduler
-# kubectl apply -n kube-system -f https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/kubernetes/base/rbac.yaml
-# kubectl apply -n kube-system -f https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/kubernetes/base/configmap.yaml
-# kubectl apply -n kube-system -f https://raw.githubusercontent.com/kubernetes-sigs/descheduler/master/kubernetes/job/job.yaml
-

_sys/coredns-1.26-x.yaml

@@ -1,122 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coredns
-  namespace: kube-system
-  uid: 7bf78c83-68ac-4dee-95f6-52964e38e2d3
-  resourceVersion: '441765420'
-  generation: 37
-  creationTimestamp: '2021-01-20T14:55:14Z'
-  labels:
-    k8s-app: kube-dns
-  annotations:
-    deployment.kubernetes.io/revision: '34'
-spec:
-  replicas: 2
-  selector:
-    matchLabels:
-      k8s-app: kube-dns
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        k8s-app: kube-dns
-    spec:
-      volumes:
-        - name: config-volume
-          configMap:
-            name: coredns
-            items:
-              - key: Corefile
-                path: Corefile
-            defaultMode: 420
-      containers:
-        - name: coredns
-          image: registry.k8s.io/coredns/coredns:v1.9.3
-          args:
-            - '-conf'
-            - /etc/coredns/Corefile
-          ports:
-            - name: dns
-              containerPort: 53
-              protocol: UDP
-            - name: dns-tcp
-              containerPort: 53
-              protocol: TCP
-            - name: metrics
-              containerPort: 9153
-              protocol: TCP
-          resources:
-            limits:
-              memory: 170Mi
-            requests:
-              cpu: 100m
-              memory: 70Mi
-          volumeMounts:
-            - name: config-volume
-              readOnly: true
-              mountPath: /etc/coredns
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-              scheme: HTTP
-            initialDelaySeconds: 60
-            timeoutSeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            failureThreshold: 5
-          readinessProbe:
-            httpGet:
-              path: /ready
-              port: 8181
-              scheme: HTTP
-            timeoutSeconds: 1
-            periodSeconds: 10
-            successThreshold: 1
-            failureThreshold: 3
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            capabilities:
-              add:
-                - NET_BIND_SERVICE
-              drop:
-                - all
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 30
-      dnsPolicy: Default
-      nodeSelector:
-        kubernetes.io/os: linux
-      serviceAccountName: coredns
-      serviceAccount: coredns
-      securityContext: {}
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchExpressions:
-                    - key: k8s-app
-                      operator: In
-                      values:
-                        - kube-dns
-                topologyKey: kubernetes.io/hostname
-      schedulerName: default-scheduler
-      tolerations:
-        - key: CriticalAddonsOnly
-          operator: Exists
-        - key: node-role.kubernetes.io/control-plane
-          effect: NoSchedule
-      priorityClassName: system-cluster-critical
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 25%
-  revisionHistoryLimit: 10
-  progressDeadlineSeconds: 600

_sys/coredns-deployment.yaml

@@ -1,202 +0,0 @@
-kind: ConfigMap
-metadata:
-  name: coredns
-  namespace: kube-system
-apiVersion: v1
-data:
-  Corefile: |
-    .:53 {
-        errors
-        health {
-           lameduck 5s
-        }
-        ready
-        kubernetes cluster.local in-addr.arpa ip6.arpa {
-           pods insecure
-           fallthrough in-addr.arpa ip6.arpa
-           ttl 30
-        }
-        file /etc/coredns/lan.db lan
-        prometheus :9153
-        forward . /etc/resolv.conf {
-           max_concurrent 1000
-        }
-        cache 30
-        loop
-        reload
-        loadbalance
-    }
-  lan.db: |
-    ;lan. zone file
-    $ORIGIN lan.
-    @    600  IN  SOA   sns.dns.icann.org. noc.dns.icann.org. 2022032201 7200 600 1209600 600
-    3600 IN  NS    172.23.255.252
-    ns            IN  A    172.23.255.252
-    salt          IN  A     192.168.10.2 
-    mqtt          IN  A     172.16.23.1
-    www-proxy     IN  A     172.23.255.1
-    git           IN  A     172.23.255.2
-    postgresql    IN  A     172.23.255.4
-    mariadb       IN  A     172.23.255.5
-    redis         IN  A     172.23.255.6
-    pihole        IN  A     172.23.255.253
-    adm           IN CNAME adm01.wks.
-    
-    prometheus      IN    CNAME www-proxy 
-    alertmanager    IN    CNAME www-proxy
-    stats           IN    CNAME www-proxy
-    cr-ui           IN    CNAME www-proxy
-    apt             IN    CNAME www-proxy
-    apt-cache       IN    CNAME www-proxy
-    nodered         IN    CNAME www-proxy
-    foto            IN    CNAME www-proxy
-    musik           IN    CNAME www-proxy
-    hassio          IN    CNAME www-proxy
-    hassio-conf     IN    CNAME www-proxy  
-    git-ui          IN    CNAME www-proxy
-    grav            IN    CNAME www-proxy
-    tekton          IN    CNAME www-proxy
-    nc              IN    CNAME www-proxy
-    dolibarr        IN    CNAME www-proxy
-    auth            IN    CNAME www-proxy
-    public.auth     IN    CNAME www-proxy 
-    secure.auth     IN    CNAME www-proxy
-    docker-registry IN    CNAME adm
-    cr              IN    CNAME adm
-    dr-mirror       IN    CNAME adm
-    log             IN    CNAME adm
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: dns-ext
-  namespace: kube-system
-spec:
-  ports:
-  - name: dns-udp
-    protocol: UDP
-    port: 53
-    targetPort: 53
-  selector:
-    k8s-app: kube-dns
-  type: LoadBalancer
-  loadBalancerIP: 172.23.255.252
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: coredns
-  labels:
-    k8s-app: kube-dns
-spec:
-  progressDeadlineSeconds: 600
-  replicas: 2
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      k8s-app: kube-dns
-  strategy:
-    rollingUpdate:
-      maxSurge: 25%
-      maxUnavailable: 1
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        k8s-app: kube-dns
-    spec:
-      containers:
-      - args:
-        - -conf
-        - /etc/coredns/Corefile
-        image:  registry.k8s.io/coredns/coredns:v1.9.3
-        imagePullPolicy: IfNotPresent
-        livenessProbe:
-          failureThreshold: 5
-          httpGet:
-            path: /health
-            port: 8080
-            scheme: HTTP
-          initialDelaySeconds: 60
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 5
-        name: coredns
-        ports:
-        - containerPort: 53
-          name: dns
-          protocol: UDP
-        - containerPort: 53
-          name: dns-tcp
-          protocol: TCP
-        - containerPort: 9153
-          name: metrics
-          protocol: TCP
-        livenessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-              scheme: HTTP
-            initialDelaySeconds: 60
-            timeoutSeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            failureThreshold: 5
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /ready
-            port: 8181
-            scheme: HTTP
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        resources:
-          limits:
-            memory: 170Mi
-          requests:
-            cpu: 100m
-            memory: 70Mi
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            add:
-            - NET_BIND_SERVICE
-            drop:
-            - all
-          readOnlyRootFilesystem: true
-          allowPrivilegeEscalation: false
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-        volumeMounts:
-        - mountPath: /etc/coredns
-          name: config-volume
-          readOnly: true
-      dnsPolicy: Default
-      nodeSelector:
-        kubernetes.io/os: linux
-      priorityClassName: system-cluster-critical
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      serviceAccount: coredns
-      serviceAccountName: coredns
-      terminationGracePeriodSeconds: 30
-      tolerations:
-      - key: CriticalAddonsOnly
-        operator: Exists
-      - effect: NoSchedule
-        key: node-role.kubernetes.io/master
-      - effect: NoSchedule
-        key: node-role.kubernetes.io/control-plane
-      volumes:
-      - configMap:
-          defaultMode: 420
-          items:
-          - key: Corefile
-            path: Corefile
-          - key: lan.db
-            path: lan.db
-          name: coredns
-        name: config-volume
-        

_sys/descheduler-cronjob.yaml

@@ -1,47 +0,0 @@
----
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: descheduler-cronjob
-  namespace: kube-system
-spec:
-  schedule: "*/50 * * * *"
-  concurrencyPolicy: "Forbid"
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          name: descheduler-pod
-        spec:
-          priorityClassName: system-cluster-critical
-          containers:
-          - name: descheduler
-            image: k8s.gcr.io/descheduler/descheduler:v0.25.0
-            volumeMounts:
-            - mountPath: /policy-dir
-              name: policy-volume
-            command:
-              - "/bin/descheduler"
-            args:
-              - "--policy-config-file"
-              - "/policy-dir/policy.yaml"
-              - "--v"
-              - "3"
-            resources:
-              requests:
-                cpu: "500m"
-                memory: "256Mi"
-            securityContext:
-              allowPrivilegeEscalation: false
-              capabilities:
-                drop:
-                  - ALL
-              privileged: false
-              readOnlyRootFilesystem: true
-              runAsNonRoot: false 
-          restartPolicy: "Never"
-          serviceAccountName: descheduler-sa
-          volumes:
-          - name: policy-volume
-            configMap:
-              name: descheduler-policy-configmap

_sys/descheduler-policy-configmap.yaml

@@ -1,34 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: descheduler-policy-configmap
-  namespace: kube-system
-data:
-  policy.yaml: |
-    apiVersion: "descheduler/v1alpha1"
-    kind: "DeschedulerPolicy"
-    maxNoOfPodsToEvictPerNode: 1
-    strategies:
-      "RemoveDuplicates":
-         enabled: true
-      "RemovePodsViolatingInterPodAntiAffinity":
-        enabled: true
-      "LowNodeUtilization":
-         enabled: true
-         params:
-           nodeResourceUtilizationThresholds:
-             thresholds:
-               "cpu": 20
-               "memory": 40
-               "pods": 20 
-             targetThresholds:
-               "cpu": 50
-               "memory": 60
-               "pods": 20
-           #nodeFit: true
-      "RemovePodsViolatingTopologySpreadConstraint":
-         enabled: true
-         params:
-             includeSoftConstraints: false
-
-

_sys/ingress-nginx-configmap.yaml

@@ -1,10 +0,0 @@
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: nginx-config
-    #namespace: nginx-ingress
-  namespace: default
-data:
-  proxy-connect-timeout: "10s"
-  proxy-read-timeout: "10s"
-  client-max-body-size: "0"

_sys/kube-flannel.yml

@@ -1,205 +0,0 @@
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: kube-flannel
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: flannel
-rules:
-- apiGroups:
-  - ""
-  resources:
-  - pods
-  verbs:
-  - get
-- apiGroups:
-  - ""
-  resources:
-  - nodes
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ""
-  resources:
-  - nodes/status
-  verbs:
-  - patch
----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: flannel
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: flannel
-subjects:
-- kind: ServiceAccount
-  name: flannel
-  namespace: kube-flannel
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: flannel
-  namespace: kube-flannel
----
-kind: ConfigMap
-apiVersion: v1
-metadata:
-  name: kube-flannel-cfg
-  namespace: kube-flannel
-  labels:
-    tier: node
-    app: flannel
-data:
-  cni-conf.json: |
-    {
-      "name": "cbr0",
-      "cniVersion": "0.3.1",
-      "plugins": [
-        {
-          "type": "flannel",
-          "delegate": {
-            "hairpinMode": true,
-            "isDefaultGateway": true
-          }
-        },
-        {
-          "type": "portmap",
-          "capabilities": {
-            "portMappings": true
-          }
-        }
-      ]
-    }
-  net-conf.json: |
-    {
-      "Network": "172.23.0.0/16",
-      "Backend": {
-        "Type": "vxlan"
-      }
-    }
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: kube-flannel-ds
-  namespace: kube-flannel
-  labels:
-    tier: node
-    app: flannel
-spec:
-  selector:
-    matchLabels:
-      app: flannel
-  template:
-    metadata:
-      labels:
-        tier: node
-        app: flannel
-    spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/os
-                operator: In
-                values:
-                - linux
-      hostNetwork: true
-      priorityClassName: system-node-critical
-      tolerations:
-      - operator: Exists
-        effect: NoSchedule
-      serviceAccountName: flannel
-      initContainers:
-      - name: install-cni-plugin
-       #image: flannelcni/flannel-cni-plugin:v1.1.0 for ppc64le and mips64le (dockerhub limitations may apply)
-        image: docker.io/rancher/mirrored-flannelcni-flannel-cni-plugin:v1.1.0
-        command:
-        - cp
-        args:
-        - -f
-        - /flannel
-        - /opt/cni/bin/flannel
-        volumeMounts:
-        - name: cni-plugin
-          mountPath: /opt/cni/bin
-      - name: install-cni
-       #image: flannelcni/flannel:v0.20.2 for ppc64le and mips64le (dockerhub limitations may apply)
-        image: docker.io/rancher/mirrored-flannelcni-flannel:v0.20.2
-        command:
-        - cp
-        args:
-        - -f
-        - /etc/kube-flannel/cni-conf.json
-        - /etc/cni/net.d/10-flannel.conflist
-        volumeMounts:
-        - name: cni
-          mountPath: /etc/cni/net.d
-        - name: flannel-cfg
-          mountPath: /etc/kube-flannel/
-      containers:
-      - name: kube-flannel
-       #image: flannelcni/flannel:v0.20.2 for ppc64le and mips64le (dockerhub limitations may apply)
-        image: docker.io/rancher/mirrored-flannelcni-flannel:v0.20.2
-        command:
-        - /opt/bin/flanneld
-        args:
-        - --ip-masq
-        - --kube-subnet-mgr
-        resources:
-          requests:
-            cpu: "100m"
-            memory: "50Mi"
-          limits:
-            cpu: "100m"
-            memory: "50Mi"
-        securityContext:
-          privileged: false
-          capabilities:
-            add: ["NET_ADMIN", "NET_RAW"]
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: EVENT_QUEUE_DEPTH
-          value: "5000"
-        volumeMounts:
-        - name: run
-          mountPath: /run/flannel
-        - name: flannel-cfg
-          mountPath: /etc/kube-flannel/
-        - name: xtables-lock
-          mountPath: /run/xtables.lock
-      volumes:
-      - name: run
-        hostPath:
-          path: /run/flannel
-      - name: cni-plugin
-        hostPath:
-          path: /opt/cni/bin
-      - name: cni
-        hostPath:
-          path: /etc/cni/net.d
-      - name: flannel-cfg
-        configMap:
-          name: kube-flannel-cfg
-      - name: xtables-lock
-        hostPath:
-          path: /run/xtables.lock
-          type: FileOrCreate

_sys/loki-persistent-volume.yaml

@@ -1,21 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: loki-data
-spec:
-  storageClassName: "nfs-ssd-ebin02"
-  nfs:
-    path: /data/raid1-ssd/k8s-data/loki-data
-    server: ebin02
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    kind: PersistentVolumeClaim
-    name: storage-loki-0 
-    namespace: monitoring
-

_sys/metallb-address-pool.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-        namespace: metallb-system
-        name: config
-data:
-        config: |
-          address-pools:
-          - name: default
-            protocol: layer2
-            addresses:
-            - 172.23.255.1-172.23.255.254 

_sys/metallb.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-        namespace: metallb-system
-        name: config
-data:
-        config: |
-          address-pools:
-          - name: default
-            protocol: layer2
-            addresses:
-            - 172.23.255.1-172.23.255.254