From 61d19f34136fadf63099a92b3302e059c03ca01e Mon Sep 17 00:00:00 2001 From: Tom Neuber Date: Mon, 7 Oct 2024 08:44:26 +0200 Subject: [PATCH 1/3] Add woodpecker pipeline for yamllint --- .woodpecker/.yamllint.yaml | 6 ++++++ .yamllint | 10 ++++++++++ 2 files changed, 16 insertions(+) create mode 100644 .woodpecker/.yamllint.yaml create mode 100644 .yamllint diff --git a/.woodpecker/.yamllint.yaml b/.woodpecker/.yamllint.yaml new file mode 100644 index 0000000..af15cd1 --- /dev/null +++ b/.woodpecker/.yamllint.yaml @@ -0,0 +1,6 @@ +--- +steps: + - name: linting + image: cytopia/yamllint:latest + commands: + - yamllint -f colored -s . diff --git a/.yamllint b/.yamllint new file mode 100644 index 0000000..76dfcf9 --- /dev/null +++ b/.yamllint @@ -0,0 +1,10 @@ +--- +yaml-files: + - '*.yaml' + - '*.yml' + - '.yamllint' + +extends: default + +rules: + line-length: disable From e00cc2d4dd68307f3166cb454ffc6d7b82b375a5 Mon Sep 17 00:00:00 2001 From: Tom Neuber Date: Mon, 7 Oct 2024 09:19:39 +0200 Subject: [PATCH 2/3] fix typos and file layout for yamllint --- .drone.yml | 159 ++++++------- app-files/apps.yaml | 8 +- app-files/core-deployments.yaml | 114 +++++----- app-files/tests.yaml | 2 +- argo/cm.yaml | 12 +- argo/kustomization.yaml | 1 + argo/secret-generator.yaml | 1 + argo/secret.yaml | 1 + argo/sops-secret.yaml | 1 + argo/values.yaml | 1 + authentik/kustomization.yaml | 1 + authentik/manifest.yaml | 93 ++++---- authentik/secret-generator.yaml | 1 + authentik/secret.yaml | 1 + cert-manager/issuer.yaml | 40 ++-- cert-manager/namespace.yaml | 1 + cert-manager/values.yaml | 1 + cilium/values.yaml | 1 + dashboard/base/dashboard.yaml | 49 ++-- dashboard/base/kustomization.yaml | 3 +- dashboard/overlays/prod/kustomization.yaml | 9 +- dashboard/overlays/staging/kustomization.yaml | 51 +++-- examples/example-deployment.yaml | 46 ++-- ingress/values.yaml | 1 + loki/kustomization.yaml | 1 + loki/namespace.yaml | 1 + loki/secret-generator.yaml | 1 + loki/secret.yaml | 1 + loki/values.yaml | 1 + longhorn/kustomization.yaml | 1 + longhorn/namespace.yaml | 1 + longhorn/recurringjobs.yaml | 1 + longhorn/secret-generator.yaml | 1 + longhorn/secret.yaml | 9 +- longhorn/storageclass.yaml | 3 +- longhorn/values.yaml | 1 + longhorn/volumesnapshotclass.yaml | 3 +- node-labeler/node-labeler.yaml | 3 +- paste/manifest.yaml | 46 ++-- prometheus/alerts.yaml | 214 +++++++++--------- prometheus/kustomization.yaml | 1 + prometheus/namespace.yaml | 1 + prometheus/secret-generator.yaml | 1 + prometheus/secret.yaml | 1 + prometheus/service-monitor-longhorn.yaml | 5 +- prometheus/templates.yaml | 3 +- prometheus/values.yaml | 45 ++-- quota/quotad.yaml | 3 +- tests/test-egress.yaml | 102 ++++----- tests/test-ingress.yaml | 34 +-- tests/test-storage.yaml | 176 +++++++------- thanos/2-objectstore-secret.enc.yaml | 1 + thanos/3-querier.yaml | 26 +-- thanos/kustomization.yaml | 1 + thanos/secret-generator.yaml | 1 + traefik/basicauth.yaml | 3 +- traefik/secondingressclass.yaml | 3 +- traefik/values.yaml | 1 + vcluster/aaron.yaml | 3 +- vcluster/ingress-aaron.yaml | 9 +- vcluster/tom.yaml | 1 + woodpecker/secrets/kustomization.yaml | 1 + woodpecker/secrets/secret-generator.yaml | 1 + woodpecker/secrets/secrets.enc.yaml | 1 + woodpecker/values/values.yaml | 5 +- 65 files changed, 684 insertions(+), 631 deletions(-) diff --git a/.drone.yml b/.drone.yml index efd305b..7f6b89e 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1,88 +1,89 @@ +--- kind: pipeline name: deploy steps: -- name: kustomize build dashboard (prod + staging) - image: git.ar21.de/aaron/kustomize-ci - commands: - - cd /deployment-repo - - git clone https://git.ar21.de/yolokube/core-deployments.git . - - cd /deployment-repo/dashboard/overlays/prod - - kustomize build -o /deployment-repo/dashboard/prod/dashboard.yaml - - cd /deployment-repo/dashboard/overlays/staging - - kustomize build -o /deployment-repo/dashboard/staging/dashboard.yaml - volumes: - - name: deployment-repo - path: /deployment-repo - when: - branch: - - main - event: - - push -- name: kustomize build dashboard (staging) - image: git.ar21.de/aaron/kustomize-ci - commands: - - cd /deployment-repo - - git clone https://git.ar21.de/yolokube/core-deployments.git . - - cd /staging-repo - - git clone -b $DRONE_BRANCH https://git.ar21.de/yolokube/core-deployments.git . - - cd /staging-repo/dashboard/overlays/staging - - kustomize build -o /deployment-repo/dashboard/staging/dashboard.yaml - volumes: - - name: deployment-repo - path: /deployment-repo - - name: staging-repo - path: /staging-repo - when: - branch: - exclude: + - name: kustomize build dashboard (prod + staging) + image: git.ar21.de/aaron/kustomize-ci + commands: + - cd /deployment-repo + - git clone https://git.ar21.de/yolokube/core-deployments.git . + - cd /deployment-repo/dashboard/overlays/prod + - kustomize build -o /deployment-repo/dashboard/prod/dashboard.yaml + - cd /deployment-repo/dashboard/overlays/staging + - kustomize build -o /deployment-repo/dashboard/staging/dashboard.yaml + volumes: + - name: deployment-repo + path: /deployment-repo + when: + branch: - main - event: - - push -- name: kustomize push dashboard changes (prod + staging) - image: appleboy/drone-git-push - settings: - branch: main - remote: ssh://git@git.ar21.de:2222/yolokube/core-deployments.git - path: /deployment-repo - force: false - commit: true - commit_message: "KUSTOMIZE BUILD: rebuild dashboard deployment with kustomize ${DRONE_BUILD_NUMBER} (done automagically via Drone pipeline) [CI SKIP]" - ssh_key: - from_secret: GITEA_SSH_KEY - volumes: - - name: deployment-repo - path: /deployment-repo - when: - branch: - - main - event: - - push -- name: kustomize push dashboard changes (staging) - image: appleboy/drone-git-push - settings: - branch: main - remote: ssh://git@git.ar21.de:2222/yolokube/core-deployments.git - path: /deployment-repo - force: false - commit: true - commit_message: "KUSTOMIZE BUILD STAGING: rebuild dashboard deployment with kustomize ${DRONE_BUILD_NUMBER} [CI SKIP]" - ssh_key: - from_secret: GITEA_SSH_KEY - volumes: - - name: deployment-repo - path: /deployment-repo - when: - branch: - exclude: + event: + - push + - name: kustomize build dashboard (staging) + image: git.ar21.de/aaron/kustomize-ci + commands: + - cd /deployment-repo + - git clone https://git.ar21.de/yolokube/core-deployments.git . + - cd /staging-repo + - git clone -b $DRONE_BRANCH https://git.ar21.de/yolokube/core-deployments.git . + - cd /staging-repo/dashboard/overlays/staging + - kustomize build -o /deployment-repo/dashboard/staging/dashboard.yaml + volumes: + - name: deployment-repo + path: /deployment-repo + - name: staging-repo + path: /staging-repo + when: + branch: + exclude: + - main + event: + - push + - name: kustomize push dashboard changes (prod + staging) + image: appleboy/drone-git-push + settings: + branch: main + remote: ssh://git@git.ar21.de:2222/yolokube/core-deployments.git + path: /deployment-repo + force: false + commit: true + commit_message: "KUSTOMIZE BUILD: rebuild dashboard deployment with kustomize ${DRONE_BUILD_NUMBER} (done automagically via Drone pipeline) [CI SKIP]" + ssh_key: + from_secret: GITEA_SSH_KEY + volumes: + - name: deployment-repo + path: /deployment-repo + when: + branch: - main - event: - - push + event: + - push + - name: kustomize push dashboard changes (staging) + image: appleboy/drone-git-push + settings: + branch: main + remote: ssh://git@git.ar21.de:2222/yolokube/core-deployments.git + path: /deployment-repo + force: false + commit: true + commit_message: "KUSTOMIZE BUILD STAGING: rebuild dashboard deployment with kustomize ${DRONE_BUILD_NUMBER} [CI SKIP]" + ssh_key: + from_secret: GITEA_SSH_KEY + volumes: + - name: deployment-repo + path: /deployment-repo + when: + branch: + exclude: + - main + event: + - push volumes: -- name: deployment-repo - temp: {} -- name: staging-repo - temp: {} + - name: deployment-repo + temp: {} + - name: staging-repo + temp: {} when: event: exclude: - - pull_request \ No newline at end of file + - pull_request diff --git a/app-files/apps.yaml b/app-files/apps.yaml index 1d25110..c7f8047 100644 --- a/app-files/apps.yaml +++ b/app-files/apps.yaml @@ -28,12 +28,12 @@ spec: project: default sources: - chart: woodpecker - repoURL: https://woodpecker-ci.org/ + repoURL: https://woodpecker-ci.org/ targetRevision: 1.6.0 helm: releaseName: woodpecker valueFiles: - - $values/woodpecker/values/values.yaml + - $values/woodpecker/values/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -45,7 +45,7 @@ spec: namespace: woodpecker syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -65,7 +65,7 @@ spec: namespace: paste syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: selfHeal: false prune: false diff --git a/app-files/core-deployments.yaml b/app-files/core-deployments.yaml index 3e71c20..d497169 100644 --- a/app-files/core-deployments.yaml +++ b/app-files/core-deployments.yaml @@ -13,7 +13,7 @@ spec: helm: releaseName: traefik valueFiles: - - $values/traefik/values.yaml + - $values/traefik/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -25,7 +25,7 @@ spec: namespace: traefik syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -43,7 +43,7 @@ spec: helm: releaseName: argo valueFiles: - - $values/argo/values.yaml + - $values/argo/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -55,7 +55,7 @@ spec: namespace: argocd syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: selfHeal: true prune: false @@ -70,11 +70,11 @@ spec: sources: - repoURL: https://charts.longhorn.io chart: longhorn - targetRevision: 1.7.1 # see Infos below, the CSI snapshotter needs to be updated too <-- version association can be found here: https://longhorn.io/docs/latest/snapshots-and-backups/csi-snapshot-support/enable-csi-snapshot-support/ + targetRevision: 1.7.1 # see Infos below, the CSI snapshotter needs to be updated too <-- version association can be found here: https://longhorn.io/docs/latest/snapshots-and-backups/csi-snapshot-support/enable-csi-snapshot-support/ helm: releaseName: longhorn valueFiles: - - $values/longhorn/values.yaml + - $values/longhorn/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -82,17 +82,17 @@ spec: targetRevision: HEAD path: longhorn - repoURL: https://github.com/kubernetes-csi/external-snapshotter.git - targetRevision: v6.3.2 # <-- needs to be updated when longhorn version is changed. Find the correct version here: https://longhorn.io/docs/latest/snapshots-and-backups/csi-snapshot-support/csi-volume-snapshot-associated-with-longhorn-snapshot/ + targetRevision: v6.3.2 # <-- needs to be updated when longhorn version is changed. Find the correct version here: https://longhorn.io/docs/latest/snapshots-and-backups/csi-snapshot-support/csi-volume-snapshot-associated-with-longhorn-snapshot/ path: client/config/crd - repoURL: https://github.com/kubernetes-csi/external-snapshotter.git - targetRevision: v6.3.2 # <-- needs to be updated when longhorn version is changed. Find the correct version here: https://longhorn.io/docs/latest/snapshots-and-backups/csi-snapshot-support/csi-volume-snapshot-associated-with-longhorn-snapshot/ + targetRevision: v6.3.2 # <-- needs to be updated when longhorn version is changed. Find the correct version here: https://longhorn.io/docs/latest/snapshots-and-backups/csi-snapshot-support/csi-volume-snapshot-associated-with-longhorn-snapshot/ path: deploy/kubernetes/snapshot-controller destination: server: https://kubernetes.default.svc namespace: longhorn-system syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -110,7 +110,7 @@ spec: helm: releaseName: prometheus valueFiles: - - $values/prometheus/values.yaml + - $values/prometheus/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -122,30 +122,30 @@ spec: namespace: prometheus syncPolicy: syncOptions: - - CreateNamespace=true - - ServerSideApply=true - - RespectIgnoreDifferences=true + - CreateNamespace=true + - ServerSideApply=true + - RespectIgnoreDifferences=true automated: prune: false ignoreDifferences: - - group: apps - kind: Deployment - jqPathExpressions: - - '.spec.template.spec.initContainers[]?.resources' - - '.spec.template.spec.containers[]?.resources' - - group: apps - kind: DaemonSet - jqPathExpressions: - - '.spec.template.spec.initContainers[]?.resources' - - '.spec.template.spec.containers[]?.resources' - - group: admissionregistration.k8s.io - kind: MutatingWebhookConfiguration - jqPathExpressions: - - '.webhooks[]?.clientConfig.caBundle' - - group: admissionregistration.k8s.io - kind: ValidatingWebhookConfiguration - jqPathExpressions: - - '.webhooks[]?.clientConfig.caBundle' + - group: apps + kind: Deployment + jqPathExpressions: + - '.spec.template.spec.initContainers[]?.resources' + - '.spec.template.spec.containers[]?.resources' + - group: apps + kind: DaemonSet + jqPathExpressions: + - '.spec.template.spec.initContainers[]?.resources' + - '.spec.template.spec.containers[]?.resources' + - group: admissionregistration.k8s.io + kind: MutatingWebhookConfiguration + jqPathExpressions: + - '.webhooks[]?.clientConfig.caBundle' + - group: admissionregistration.k8s.io + kind: ValidatingWebhookConfiguration + jqPathExpressions: + - '.webhooks[]?.clientConfig.caBundle' --- apiVersion: argoproj.io/v1alpha1 kind: Application @@ -161,7 +161,7 @@ spec: helm: releaseName: cilium-cni valueFiles: - - $values/cilium/values.yaml + - $values/cilium/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -173,22 +173,22 @@ spec: namespace: kube-cilium syncPolicy: syncOptions: - - CreateNamespace=true - - ServerSideApply=true - - RespectIgnoreDifferences=true + - CreateNamespace=true + - ServerSideApply=true + - RespectIgnoreDifferences=true automated: prune: false ignoreDifferences: - - group: apps - kind: Deployment - jqPathExpressions: - - '.spec.template.spec.containers[]?.resources' - - group: apps - kind: DaemonSet - jqPathExpressions: - - '.spec.template.spec.initContainers[]?.resources' - - '.spec.template.spec.containers[]?.resources' - - '.spec.template.metadata.annotations' + - group: apps + kind: Deployment + jqPathExpressions: + - '.spec.template.spec.containers[]?.resources' + - group: apps + kind: DaemonSet + jqPathExpressions: + - '.spec.template.spec.initContainers[]?.resources' + - '.spec.template.spec.containers[]?.resources' + - '.spec.template.metadata.annotations' --- apiVersion: argoproj.io/v1alpha1 kind: Application @@ -206,7 +206,7 @@ spec: namespace: node-labeler syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -226,7 +226,7 @@ spec: namespace: quota syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -246,7 +246,7 @@ spec: namespace: dashboard syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -266,7 +266,7 @@ spec: namespace: dashboard-staging syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -284,7 +284,7 @@ spec: helm: releaseName: loki valueFiles: - - $values/loki/values.yaml + - $values/loki/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -296,7 +296,7 @@ spec: namespace: logs syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -318,7 +318,7 @@ spec: namespace: logs syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -348,7 +348,7 @@ spec: namespace: kube-system syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -405,7 +405,7 @@ spec: helm: releaseName: cert-manager valueFiles: - - $values/cert-manager/values.yaml + - $values/cert-manager/values.yaml - repoURL: https://git.ar21.de/yolokube/core-deployments.git targetRevision: HEAD ref: values @@ -417,7 +417,7 @@ spec: namespace: cert-manager syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -437,7 +437,7 @@ spec: namespace: authentik syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false --- @@ -457,6 +457,6 @@ spec: namespace: thanos syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: prune: false diff --git a/app-files/tests.yaml b/app-files/tests.yaml index 4be36af..16d43d9 100644 --- a/app-files/tests.yaml +++ b/app-files/tests.yaml @@ -35,7 +35,7 @@ spec: namespace: test-deployments syncPolicy: syncOptions: - - CreateNamespace=true + - CreateNamespace=true automated: selfHeal: false diff --git a/argo/cm.yaml b/argo/cm.yaml index 6189393..b5fbe16 100644 --- a/argo/cm.yaml +++ b/argo/cm.yaml @@ -18,12 +18,12 @@ data: hs.status = "Healthy" return hs resource.exclusions: | - - apiGroups: - - cilium.io - kinds: - - CiliumIdentity - clusters: - - "*" + - apiGroups: + - cilium.io + kinds: + - CiliumIdentity + clusters: + - "*" url: https://argo.services.yolokube.de oidc.config: | name: aaronID diff --git a/argo/kustomization.yaml b/argo/kustomization.yaml index dd98dfe..2d115cb 100644 --- a/argo/kustomization.yaml +++ b/argo/kustomization.yaml @@ -1,3 +1,4 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: diff --git a/argo/secret-generator.yaml b/argo/secret-generator.yaml index 32c8ea0..552987a 100644 --- a/argo/secret-generator.yaml +++ b/argo/secret-generator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: viaduct.ai/v1 kind: ksops metadata: diff --git a/argo/secret.yaml b/argo/secret.yaml index 40da13a..9f69c62 100644 --- a/argo/secret.yaml +++ b/argo/secret.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: diff --git a/argo/sops-secret.yaml b/argo/sops-secret.yaml index 3cafd8f..1c379bf 100644 --- a/argo/sops-secret.yaml +++ b/argo/sops-secret.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: diff --git a/argo/values.yaml b/argo/values.yaml index 7240092..3f60bf7 100644 --- a/argo/values.yaml +++ b/argo/values.yaml @@ -1,3 +1,4 @@ +--- global: domain: argo.services.yolokube.de configs: diff --git a/authentik/kustomization.yaml b/authentik/kustomization.yaml index b14a91c..5b14a71 100644 --- a/authentik/kustomization.yaml +++ b/authentik/kustomization.yaml @@ -1,3 +1,4 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: diff --git a/authentik/manifest.yaml b/authentik/manifest.yaml index bf3dd05..63bb83b 100644 --- a/authentik/manifest.yaml +++ b/authentik/manifest.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -37,20 +38,20 @@ metadata: namespace: authentik spec: rules: - - host: "sso.services.yolokube.de" - http: - paths: - - pathType: Prefix - path: "/" - backend: - service: - name: authentik-outpost - port: - number: 9000 + - host: "sso.services.yolokube.de" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: authentik-outpost + port: + number: 9000 tls: - - hosts: - - sso.services.yolokube.de - secretName: authentik-tls-key + - hosts: + - sso.services.yolokube.de + secretName: authentik-tls-key --- apiVersion: apps/v1 kind: Deployment @@ -76,21 +77,21 @@ spec: spec: containers: - env: - - name: AUTHENTIK_HOST - valueFrom: - secretKeyRef: - key: authentik_host - name: authentik-outpost-api - - name: AUTHENTIK_TOKEN - valueFrom: - secretKeyRef: - key: token - name: authentik-outpost-api - - name: AUTHENTIK_INSECURE - valueFrom: - secretKeyRef: - key: authentik_host_insecure - name: authentik-outpost-api + - name: AUTHENTIK_HOST + valueFrom: + secretKeyRef: + key: authentik_host + name: authentik-outpost-api + - name: AUTHENTIK_TOKEN + valueFrom: + secretKeyRef: + key: token + name: authentik-outpost-api + - name: AUTHENTIK_INSECURE + valueFrom: + secretKeyRef: + key: authentik_host_insecure + name: authentik-outpost-api image: ghcr.io/goauthentik/proxy:2024.8.3 name: proxy ports: @@ -104,22 +105,22 @@ spec: apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: - name: authentik - namespace: authentik + name: authentik + namespace: authentik spec: - forwardAuth: - address: http://authentik-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik - trustForwardHeader: true - authResponseHeaders: - - X-authentik-username - - X-authentik-groups - - X-authentik-email - - X-authentik-name - - X-authentik-uid - - X-authentik-jwt - - X-authentik-grafana-role - - X-authentik-meta-jwks - - X-authentik-meta-outpost - - X-authentik-meta-provider - - X-authentik-meta-app - - X-authentik-meta-version + forwardAuth: + address: http://authentik-outpost.authentik.svc.cluster.local:9000/outpost.goauthentik.io/auth/traefik + trustForwardHeader: true + authResponseHeaders: + - X-authentik-username + - X-authentik-groups + - X-authentik-email + - X-authentik-name + - X-authentik-uid + - X-authentik-jwt + - X-authentik-grafana-role + - X-authentik-meta-jwks + - X-authentik-meta-outpost + - X-authentik-meta-provider + - X-authentik-meta-app + - X-authentik-meta-version diff --git a/authentik/secret-generator.yaml b/authentik/secret-generator.yaml index 486c4c1..7f9b73e 100644 --- a/authentik/secret-generator.yaml +++ b/authentik/secret-generator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: viaduct.ai/v1 kind: ksops metadata: diff --git a/authentik/secret.yaml b/authentik/secret.yaml index a76c6a3..850643a 100644 --- a/authentik/secret.yaml +++ b/authentik/secret.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: diff --git a/cert-manager/issuer.yaml b/cert-manager/issuer.yaml index 0c7a26d..c31bee5 100644 --- a/cert-manager/issuer.yaml +++ b/cert-manager/issuer.yaml @@ -2,29 +2,29 @@ apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: - name: letsencrypt-prod + name: letsencrypt-prod spec: - acme: - email: letsencrypt@ar21.de - server: https://acme-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-prod-key - solvers: - - http01: - ingress: - class: traefik + acme: + email: letsencrypt@ar21.de + server: https://acme-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-prod-key + solvers: + - http01: + ingress: + class: traefik --- apiVersion: cert-manager.io/v1 kind: ClusterIssuer metadata: - name: letsencrypt-staging + name: letsencrypt-staging spec: - acme: - email: letsencrypt@ar21.de - server: https://acme-staging-v02.api.letsencrypt.org/directory - privateKeySecretRef: - name: letsencrypt-staging-key - solvers: - - http01: - ingress: - class: traefik + acme: + email: letsencrypt@ar21.de + server: https://acme-staging-v02.api.letsencrypt.org/directory + privateKeySecretRef: + name: letsencrypt-staging-key + solvers: + - http01: + ingress: + class: traefik diff --git a/cert-manager/namespace.yaml b/cert-manager/namespace.yaml index 16fc9b8..72ec2c4 100644 --- a/cert-manager/namespace.yaml +++ b/cert-manager/namespace.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: diff --git a/cert-manager/values.yaml b/cert-manager/values.yaml index e3e0b47..79b69c5 100644 --- a/cert-manager/values.yaml +++ b/cert-manager/values.yaml @@ -1,3 +1,4 @@ +--- namespace: cert-manager replicaCount: 3 podDisruptionBudget: diff --git a/cilium/values.yaml b/cilium/values.yaml index ee5f233..1fe969d 100644 --- a/cilium/values.yaml +++ b/cilium/values.yaml @@ -1,3 +1,4 @@ +--- encryption: enabled: false ipam: diff --git a/dashboard/base/dashboard.yaml b/dashboard/base/dashboard.yaml index 2656ea2..7095b57 100644 --- a/dashboard/base/dashboard.yaml +++ b/dashboard/base/dashboard.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -21,17 +22,17 @@ spec: app: dashboard spec: containers: - - name: dashboard - image: git.ar21.de/yolokube/dashboard:latest - imagePullPolicy: Always - ports: - - containerPort: 8080 - livenessProbe: - httpGet: - path: / - port: 8080 - initialDelaySeconds: 4 - periodSeconds: 3 + - name: dashboard + image: git.ar21.de/yolokube/dashboard:latest + imagePullPolicy: Always + ports: + - containerPort: 8080 + livenessProbe: + httpGet: + path: / + port: 8080 + initialDelaySeconds: 4 + periodSeconds: 3 --- apiVersion: v1 kind: Service @@ -55,17 +56,17 @@ metadata: namespace: dashboard spec: rules: - - host: "dashboard.services.yolokube.de" - http: - paths: - - pathType: Prefix - path: "/" - backend: - service: - name: dashboard-service - port: - number: 80 + - host: "dashboard.services.yolokube.de" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: dashboard-service + port: + number: 80 tls: - - hosts: - - dashboard.services.yolokube.de - secretName: dashboard-tls-key + - hosts: + - dashboard.services.yolokube.de + secretName: dashboard-tls-key diff --git a/dashboard/base/kustomization.yaml b/dashboard/base/kustomization.yaml index 0ffad88..26e2f2c 100644 --- a/dashboard/base/kustomization.yaml +++ b/dashboard/base/kustomization.yaml @@ -1,4 +1,5 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- dashboard.yaml \ No newline at end of file + - dashboard.yaml diff --git a/dashboard/overlays/prod/kustomization.yaml b/dashboard/overlays/prod/kustomization.yaml index 2b3fb31..48e0f4b 100644 --- a/dashboard/overlays/prod/kustomization.yaml +++ b/dashboard/overlays/prod/kustomization.yaml @@ -1,9 +1,10 @@ +--- resources: -- ../../base + - ../../base apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization images: -- name: git.ar21.de/yolokube/dashboard - newName: git.ar21.de/yolokube/dashboard - newTag: "96" + - name: git.ar21.de/yolokube/dashboard + newName: git.ar21.de/yolokube/dashboard + newTag: "96" namespace: dashboard diff --git a/dashboard/overlays/staging/kustomization.yaml b/dashboard/overlays/staging/kustomization.yaml index 4868413..e0291ab 100644 --- a/dashboard/overlays/staging/kustomization.yaml +++ b/dashboard/overlays/staging/kustomization.yaml @@ -1,31 +1,32 @@ +--- resources: -- ../../base + - ../../base apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization images: -- name: git.ar21.de/yolokube/dashboard - newName: git.ar21.de/yolokube/dashboard - newTag: staging-95 + - name: git.ar21.de/yolokube/dashboard + newName: git.ar21.de/yolokube/dashboard + newTag: staging-95 namespace: dashboard-staging patches: -- patch: |- - - op: replace - path: /spec/rules/0/host - value: "dashboard-staging.services.yolokube.de" - target: - kind: Ingress - name: dashboard-ingress -- patch: |- - - op: replace - path: /spec/tls/0/hosts/0 - value: "dashboard-staging.services.yolokube.de" - target: - kind: Ingress - name: dashboard-ingress -- patch: |- - - op: replace - path: /spec/replicas - value: 1 - target: - kind: Deployment - name: dashboard-deployment + - patch: |- + - op: replace + path: /spec/rules/0/host + value: "dashboard-staging.services.yolokube.de" + target: + kind: Ingress + name: dashboard-ingress + - patch: |- + - op: replace + path: /spec/tls/0/hosts/0 + value: "dashboard-staging.services.yolokube.de" + target: + kind: Ingress + name: dashboard-ingress + - patch: |- + - op: replace + path: /spec/replicas + value: 1 + target: + kind: Deployment + name: dashboard-deployment diff --git a/examples/example-deployment.yaml b/examples/example-deployment.yaml index 3cf0995..4473340 100644 --- a/examples/example-deployment.yaml +++ b/examples/example-deployment.yaml @@ -37,17 +37,17 @@ spec: app: example spec: containers: - - name: example - image: testcontainers/helloworld - ports: - - containerPort: 8080 - volumeMounts: - - mountPath: "/var/www/html" - name: example-volume + - name: example + image: testcontainers/helloworld + ports: + - containerPort: 8080 + volumeMounts: + - mountPath: "/var/www/html" + name: example-volume volumes: - - name: example-volume - persistentVolumeClaim: - claimName: example-pvc + - name: example-volume + persistentVolumeClaim: + claimName: example-pvc --- apiVersion: v1 kind: Service @@ -75,17 +75,17 @@ metadata: namespace: example spec: rules: - - host: "example.apps.yolokube.de" - http: - paths: - - pathType: Prefix - path: "/" - backend: - service: - name: example-service - port: - number: 80 + - host: "example.apps.yolokube.de" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: example-service + port: + number: 80 tls: - - hosts: - - example.apps.yolokube.de - secretName: example-tls-key + - hosts: + - example.apps.yolokube.de + secretName: example-tls-key diff --git a/ingress/values.yaml b/ingress/values.yaml index a8011f0..6745572 100644 --- a/ingress/values.yaml +++ b/ingress/values.yaml @@ -1,3 +1,4 @@ +--- controller: enableSnippets: true hostNetwork: true diff --git a/loki/kustomization.yaml b/loki/kustomization.yaml index c04c4da..4127167 100644 --- a/loki/kustomization.yaml +++ b/loki/kustomization.yaml @@ -1,3 +1,4 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: diff --git a/loki/namespace.yaml b/loki/namespace.yaml index 6762d8b..7883093 100644 --- a/loki/namespace.yaml +++ b/loki/namespace.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: diff --git a/loki/secret-generator.yaml b/loki/secret-generator.yaml index 486c4c1..7f9b73e 100644 --- a/loki/secret-generator.yaml +++ b/loki/secret-generator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: viaduct.ai/v1 kind: ksops metadata: diff --git a/loki/secret.yaml b/loki/secret.yaml index 8ea6ad1..f1e180a 100644 --- a/loki/secret.yaml +++ b/loki/secret.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: diff --git a/loki/values.yaml b/loki/values.yaml index 61a42d4..c55acc6 100644 --- a/loki/values.yaml +++ b/loki/values.yaml @@ -1,3 +1,4 @@ +--- loki: auth_enabled: false persistence: diff --git a/longhorn/kustomization.yaml b/longhorn/kustomization.yaml index 589339e..164aea3 100644 --- a/longhorn/kustomization.yaml +++ b/longhorn/kustomization.yaml @@ -1,3 +1,4 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: diff --git a/longhorn/namespace.yaml b/longhorn/namespace.yaml index 824ec10..092c93f 100644 --- a/longhorn/namespace.yaml +++ b/longhorn/namespace.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: diff --git a/longhorn/recurringjobs.yaml b/longhorn/recurringjobs.yaml index 1c07053..ac2f051 100644 --- a/longhorn/recurringjobs.yaml +++ b/longhorn/recurringjobs.yaml @@ -1,3 +1,4 @@ +--- apiVersion: longhorn.io/v1beta1 kind: RecurringJob metadata: diff --git a/longhorn/secret-generator.yaml b/longhorn/secret-generator.yaml index 486c4c1..7f9b73e 100644 --- a/longhorn/secret-generator.yaml +++ b/longhorn/secret-generator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: viaduct.ai/v1 kind: ksops metadata: diff --git a/longhorn/secret.yaml b/longhorn/secret.yaml index 69c0fcd..6b0475a 100644 --- a/longhorn/secret.yaml +++ b/longhorn/secret.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: @@ -7,11 +8,11 @@ type: Opaque data: AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:78iskasj0MX32r8qp4LCmTsf5q8r3W5nCs7BrA==,iv:dQFU/Pm+bQQKWfWKq7c63XTW2+czjOeIZuoL2mrPKbM=,tag:we+rZ+YoMpeiAve7zcH6pg==,type:str] AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:zR3LNrmweWn9ONkpOlgNGfJ0ERJeNgNsurvBcsX7JZox/vyaZRb6lt4VEjdBDMdTZ+dWRvtvHUw=,iv:CCLoHHixnzVaT0SX3uOjyb7SCNyAe5H30acmMEIgubI=,tag:c7nWPRTZQXqgp8jVgtU57g==,type:str] - #ENC[AES256_GCM,data:p1aNW086iJ/xbZGc3A9VFitml4AB0ly8BOyJztOoIBd9I7Ld,iv:5um8w4PL9EfHcCHlfIW0Yr6aqvgs5FVh4Y54RDQDOLY=,tag:17ELSDORVx0aj2hzFDaxUA==,type:comment] + # ENC[AES256_GCM,data:p1aNW086iJ/xbZGc3A9VFitml4AB0ly8BOyJztOoIBd9I7Ld,iv:5um8w4PL9EfHcCHlfIW0Yr6aqvgs5FVh4Y54RDQDOLY=,tag:17ELSDORVx0aj2hzFDaxUA==,type:comment] AWS_ENDPOINTS: ENC[AES256_GCM,data:Cm4ISXx3mosAwVCzFqK5461gFIAqWtSwazvhfe/01blpOLOGpEW7b7S00fnRMviR,iv:Zflw/1JEQjcKarQPOrpBSpCprdL/2Ry6FH74K3/NfFo=,tag:l6idxnQStu2ycr0og2/otw==,type:str] - #ENC[AES256_GCM,data:0QVDgxSYpM+pFAiXf2+xcAnZath1zSzyZDy/zS8L36kZrSQnBSDN91OwAKLYpOb1m+cbex6lWN9OYFRYcIhUjA==,iv:Cm7bwYZS6F4XkRFaqUcBehXUQXmUI/48l+cDBPjlao8=,tag:jBUadTKqWJbPqpljshBoRg==,type:comment] - #ENC[AES256_GCM,data:oxfKvt9xbus8la9hJGLOCVBfyQMCP4wpD4QZcEIw/SFWysMm2NaFzUHtUH39QAG2kCw1C5gKtTQ5EhJ1C2bgxVB6qlC6DUhO5uwlIoXtDqNsfhnsyWuIvJMH5jnPwAfO8Y+plLk2g4dV3aMmYt8Hfg==,iv:Ai/0l0GDbJzTaVy7Xhp1offyaqKD/Ge/oU9YDiGXC28=,tag:wIGYy7TBnCZYrbKDd1y7xQ==,type:comment] - #ENC[AES256_GCM,data:6IieK5gwtUr+u3PjRjOXs5fJafO3N14yLmDCxBdU5VBfgOpIV4P5nX07DJ5jXw9BJgr6nqsQA0tlgeddT0vnO/cQNKJFBeQXVCzjxLHlrNv7JLg6EbtXZoO/eNow0XBGCLyg6Mq+6S83J2p8pix4tEae4YQrwveQ+dD0A15hK7n5gWOdFz50qE5IImbZsm9aR3ymxs1o9fjkZYTNycsneWe069SNCdb2gFtf4Q==,iv:N30tKPf2ajQT2s0/GYZPV8ipy1Qkkfh+dAlJ4pdGm9M=,tag:qtfr6TY8nyAoMykRONC3kQ==,type:comment] + # ENC[AES256_GCM,data:0QVDgxSYpM+pFAiXf2+xcAnZath1zSzyZDy/zS8L36kZrSQnBSDN91OwAKLYpOb1m+cbex6lWN9OYFRYcIhUjA==,iv:Cm7bwYZS6F4XkRFaqUcBehXUQXmUI/48l+cDBPjlao8=,tag:jBUadTKqWJbPqpljshBoRg==,type:comment] + # ENC[AES256_GCM,data:oxfKvt9xbus8la9hJGLOCVBfyQMCP4wpD4QZcEIw/SFWysMm2NaFzUHtUH39QAG2kCw1C5gKtTQ5EhJ1C2bgxVB6qlC6DUhO5uwlIoXtDqNsfhnsyWuIvJMH5jnPwAfO8Y+plLk2g4dV3aMmYt8Hfg==,iv:Ai/0l0GDbJzTaVy7Xhp1offyaqKD/Ge/oU9YDiGXC28=,tag:wIGYy7TBnCZYrbKDd1y7xQ==,type:comment] + # ENC[AES256_GCM,data:6IieK5gwtUr+u3PjRjOXs5fJafO3N14yLmDCxBdU5VBfgOpIV4P5nX07DJ5jXw9BJgr6nqsQA0tlgeddT0vnO/cQNKJFBeQXVCzjxLHlrNv7JLg6EbtXZoO/eNow0XBGCLyg6Mq+6S83J2p8pix4tEae4YQrwveQ+dD0A15hK7n5gWOdFz50qE5IImbZsm9aR3ymxs1o9fjkZYTNycsneWe069SNCdb2gFtf4Q==,iv:N30tKPf2ajQT2s0/GYZPV8ipy1Qkkfh+dAlJ4pdGm9M=,tag:qtfr6TY8nyAoMykRONC3kQ==,type:comment] sops: kms: [] gcp_kms: [] diff --git a/longhorn/storageclass.yaml b/longhorn/storageclass.yaml index 5e45901..79d2c70 100644 --- a/longhorn/storageclass.yaml +++ b/longhorn/storageclass.yaml @@ -1,3 +1,4 @@ +--- # this is the storageclass manifest for the logs and metrics volumes kind: StorageClass apiVersion: storage.k8s.io/v1 @@ -12,4 +13,4 @@ parameters: staleReplicaTimeout: "30" fromBackup: "" fsType: "ext4" - dataLocality: "disabled" \ No newline at end of file + dataLocality: "disabled" diff --git a/longhorn/values.yaml b/longhorn/values.yaml index 9fdce3c..cc4d5c2 100644 --- a/longhorn/values.yaml +++ b/longhorn/values.yaml @@ -1,3 +1,4 @@ +--- persistence: recurringJobSelector: enable: true diff --git a/longhorn/volumesnapshotclass.yaml b/longhorn/volumesnapshotclass.yaml index ce41f7e..b4692d9 100644 --- a/longhorn/volumesnapshotclass.yaml +++ b/longhorn/volumesnapshotclass.yaml @@ -1,3 +1,4 @@ +--- kind: VolumeSnapshotClass apiVersion: snapshot.storage.k8s.io/v1 metadata: @@ -16,4 +17,4 @@ metadata: driver: driver.longhorn.io deletionPolicy: Delete parameters: - type: snap \ No newline at end of file + type: snap diff --git a/node-labeler/node-labeler.yaml b/node-labeler/node-labeler.yaml index a8e389d..e129ee3 100644 --- a/node-labeler/node-labeler.yaml +++ b/node-labeler/node-labeler.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -78,4 +79,4 @@ subjects: roleRef: kind: ClusterRole name: worker-node-labeler-role - apiGroup: rbac.authorization.k8s.io \ No newline at end of file + apiGroup: rbac.authorization.k8s.io diff --git a/paste/manifest.yaml b/paste/manifest.yaml index 3dadd98..1dd17d0 100644 --- a/paste/manifest.yaml +++ b/paste/manifest.yaml @@ -37,17 +37,17 @@ spec: securityContext: fsGroup: 82 containers: - - name: paste - image: privatebin/nginx-fpm-alpine - ports: - - containerPort: 8080 - volumeMounts: - - mountPath: "/srv/data" - name: paste-volume + - name: paste + image: privatebin/nginx-fpm-alpine + ports: + - containerPort: 8080 + volumeMounts: + - mountPath: "/srv/data" + name: paste-volume volumes: - - name: paste-volume - persistentVolumeClaim: - claimName: paste-pvc + - name: paste-volume + persistentVolumeClaim: + claimName: paste-pvc --- apiVersion: v1 kind: Service @@ -71,17 +71,17 @@ metadata: namespace: paste spec: rules: - - host: "paste.apps.yolokube.de" - http: - paths: - - pathType: Prefix - path: "/" - backend: - service: - name: paste-service - port: - number: 80 + - host: "paste.apps.yolokube.de" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: paste-service + port: + number: 80 tls: - - hosts: - - paste.apps.yolokube.de - secretName: paste-tls-key + - hosts: + - paste.apps.yolokube.de + secretName: paste-tls-key diff --git a/prometheus/alerts.yaml b/prometheus/alerts.yaml index 9ce517a..fc892a0 100644 --- a/prometheus/alerts.yaml +++ b/prometheus/alerts.yaml @@ -10,114 +10,114 @@ spec: groups: - name: hardware rules: - - alert: MemoryHigh - expr: round((((node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) / node_memory_MemTotal_bytes) * 100), 0.1) > 80 - for: 5m - labels: - severity: warning - annotations: - summary: "Memory over 80%" - description: "Memory on node {{ $labels.node }} is over 80% for more than 5 minutes. Plox fix. Memory usage: {{ $value }}%" - - alert: DiskspaceLow - expr: round(node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"} * 100, 1) < 5 - for: 1m - labels: - severity: warning - annotations: - summary: "Free disk space at {{ $value }}%" - description: "Disk space on node {{ $labels.node }} is only {{ $value }}%. Plox fix. Partition: {{ $labels.device }}" - - alert: HostMemoryUnderMemoryPressure - expr: rate(node_vmstat_pgmajfault[1m]) > 1000 - for: 2m - labels: - severity: warning - annotations: - summary: Host memory under memory pressure {{ $labels.node }} - description: "The node is under heavy memory pressure. High rate of major page faults\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" - - alert: HostUnusualDiskReadRate - expr: sum by (instance) (rate(node_disk_read_bytes_total[2m])) / 1024 / 1024 > 200 - for: 5m - labels: - severity: warning - annotations: - summary: Host unusual disk read rate {{ $labels.node }} - description: "Disk is probably reading too much data (> 200 MB/s)\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" - - alert: HostUnusualDiskWriteRate - expr: sum by (instance) (rate(node_disk_written_bytes_total[2m])) / 1024 / 1024 > 200 - for: 3m - labels: - severity: warning - annotations: - summary: Host unusual disk write rate {{ $labels.node }} - description: "Disk is probably writing too much data (> 200 MB/s)\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" - - alert: HostCpuStealNoisyNeighbor - expr: avg by(instance) (rate(node_cpu_seconds_total{mode="steal"}[5m])) * 100 > 10 - for: 1m - labels: - severity: warning - annotations: - summary: Host CPU steal noisy neighbor {{ $labels.node }} - description: "CPU steal is > 10%. A noisy neighbor is killing VM performances or a spot instance may be out of credit.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" - - alert: HostPhysicalComponentTooHot - expr: node_hwmon_temp_celsius > 90 - for: 5m - labels: - severity: warning - annotations: - summary: Host physical component too hot {{ $labels.node }} - description: "Physical hardware component too hot\n Sensor = {{ $labels.sensor }}\n Temp = {{ $value }}" - - alert: SMARTbad - expr: smartmon_device_smart_healthy < 1 - for: 0m - labels: - severity: critical - annotations: - summary: SMART check bad of drive {{ $labels.exported_disk }} in node {{ $labels.node }} - description: "SMART check returned bad health of {{ $labels.exported_disk }} in node {{ $labels.node }}. VALUE = {{ $value }}\n LABELS = {{ $labels }}" - - alert: "SMARTcheck too old" - expr: (time() - smartmon_smartctl_run) > 10800 - labels: - severity: warning - annotations: - summary: "SMARTcheck not running" - description: 'The last SMARTcheck on node {{ $labels.node }} was more than 3h ago. Plox fix.' - - alert: "ECC Memory errors" - expr: (node_edac_correctable_errors_total) > 100 - labels: - severity: warning - annotations: - summary: "ECC errors on {{ $labels.node }}" - description: 'The node {{ $labels.node }} accumulated {{ $value }} correctable errors.' - - alert: "ECC Memory uncorrectable errors" - expr: (node_edac_uncorrectable_errors_total) > 0 - labels: - severity: critical - annotations: - summary: "ECC errors on {{ $labels.node }}" - description: 'The node {{ $labels.node }} accumulated {{ $value }} uncorrectable errors.' + - alert: MemoryHigh + expr: round((((node_memory_MemTotal_bytes - node_memory_MemAvailable_bytes) / node_memory_MemTotal_bytes) * 100), 0.1) > 80 + for: 5m + labels: + severity: warning + annotations: + summary: "Memory over 80%" + description: "Memory on node {{ $labels.node }} is over 80% for more than 5 minutes. Plox fix. Memory usage: {{ $value }}%" + - alert: DiskspaceLow + expr: round(node_filesystem_avail_bytes{mountpoint="/"} / node_filesystem_size_bytes{mountpoint="/"} * 100, 1) < 5 + for: 1m + labels: + severity: warning + annotations: + summary: "Free disk space at {{ $value }}%" + description: "Disk space on node {{ $labels.node }} is only {{ $value }}%. Plox fix. Partition: {{ $labels.device }}" + - alert: HostMemoryUnderMemoryPressure + expr: rate(node_vmstat_pgmajfault[1m]) > 1000 + for: 2m + labels: + severity: warning + annotations: + summary: Host memory under memory pressure {{ $labels.node }} + description: "The node is under heavy memory pressure. High rate of major page faults\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" + - alert: HostUnusualDiskReadRate + expr: sum by (instance) (rate(node_disk_read_bytes_total[2m])) / 1024 / 1024 > 200 + for: 5m + labels: + severity: warning + annotations: + summary: Host unusual disk read rate {{ $labels.node }} + description: "Disk is probably reading too much data (> 200 MB/s)\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" + - alert: HostUnusualDiskWriteRate + expr: sum by (instance) (rate(node_disk_written_bytes_total[2m])) / 1024 / 1024 > 200 + for: 3m + labels: + severity: warning + annotations: + summary: Host unusual disk write rate {{ $labels.node }} + description: "Disk is probably writing too much data (> 200 MB/s)\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" + - alert: HostCpuStealNoisyNeighbor + expr: avg by(instance) (rate(node_cpu_seconds_total{mode="steal"}[5m])) * 100 > 10 + for: 1m + labels: + severity: warning + annotations: + summary: Host CPU steal noisy neighbor {{ $labels.node }} + description: "CPU steal is > 10%. A noisy neighbor is killing VM performances or a spot instance may be out of credit.\n VALUE = {{ $value }}\n LABELS = {{ $labels }}" + - alert: HostPhysicalComponentTooHot + expr: node_hwmon_temp_celsius > 90 + for: 5m + labels: + severity: warning + annotations: + summary: Host physical component too hot {{ $labels.node }} + description: "Physical hardware component too hot\n Sensor = {{ $labels.sensor }}\n Temp = {{ $value }}" + - alert: SMARTbad + expr: smartmon_device_smart_healthy < 1 + for: 0m + labels: + severity: critical + annotations: + summary: SMART check bad of drive {{ $labels.exported_disk }} in node {{ $labels.node }} + description: "SMART check returned bad health of {{ $labels.exported_disk }} in node {{ $labels.node }}. VALUE = {{ $value }}\n LABELS = {{ $labels }}" + - alert: "SMARTcheck too old" + expr: (time() - smartmon_smartctl_run) > 10800 + labels: + severity: warning + annotations: + summary: "SMARTcheck not running" + description: 'The last SMARTcheck on node {{ $labels.node }} was more than 3h ago. Plox fix.' + - alert: "ECC Memory errors" + expr: (node_edac_correctable_errors_total) > 100 + labels: + severity: warning + annotations: + summary: "ECC errors on {{ $labels.node }}" + description: 'The node {{ $labels.node }} accumulated {{ $value }} correctable errors.' + - alert: "ECC Memory uncorrectable errors" + expr: (node_edac_uncorrectable_errors_total) > 0 + labels: + severity: critical + annotations: + summary: "ECC errors on {{ $labels.node }}" + description: 'The node {{ $labels.node }} accumulated {{ $value }} uncorrectable errors.' - name: etcdbackup rules: - - alert: "etcdbackup too old" - expr: (time() - etcdbackup_time) > 10800 - labels: - severity: warning - annotations: - summary: "etcd backup not running" - description: 'The last etcd backup on node {{ $labels.node }} was more than 3h ago. Plox fix.' - - alert: "etcdbackup failed" - expr: etcdbackup_result > 0 - labels: - severity: warning - annotations: - summary: "etcdbackup failed" - description: "The backup script for etcd failed on node {{ $labels.node }}. Plox fix." + - alert: "etcdbackup too old" + expr: (time() - etcdbackup_time) > 10800 + labels: + severity: warning + annotations: + summary: "etcd backup not running" + description: 'The last etcd backup on node {{ $labels.node }} was more than 3h ago. Plox fix.' + - alert: "etcdbackup failed" + expr: etcdbackup_result > 0 + labels: + severity: warning + annotations: + summary: "etcdbackup failed" + description: "The backup script for etcd failed on node {{ $labels.node }}. Plox fix." - name: kubernetes rules: - - alert: KubernetesUnhealthyPod - expr: kube_pod_container_status_waiting_reason == 1 - for: 5m - labels: - severity: warning - annotations: - summary: "The Pod {{ $labels.pod }} is {{ $labels.reason }}" - description: "The Pod {{ $labels.pod }} is in the state {{ $labels.reason }} for more than 5m. The Pod is in namespace {{ $labels.namespace }} and on node {{ $labels.node }}." + - alert: KubernetesUnhealthyPod + expr: kube_pod_container_status_waiting_reason == 1 + for: 5m + labels: + severity: warning + annotations: + summary: "The Pod {{ $labels.pod }} is {{ $labels.reason }}" + description: "The Pod {{ $labels.pod }} is in the state {{ $labels.reason }} for more than 5m. The Pod is in namespace {{ $labels.namespace }} and on node {{ $labels.node }}." diff --git a/prometheus/kustomization.yaml b/prometheus/kustomization.yaml index 051c95b..77ff045 100644 --- a/prometheus/kustomization.yaml +++ b/prometheus/kustomization.yaml @@ -1,3 +1,4 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: diff --git a/prometheus/namespace.yaml b/prometheus/namespace.yaml index bc6c6e7..083c839 100644 --- a/prometheus/namespace.yaml +++ b/prometheus/namespace.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: diff --git a/prometheus/secret-generator.yaml b/prometheus/secret-generator.yaml index 486c4c1..7f9b73e 100644 --- a/prometheus/secret-generator.yaml +++ b/prometheus/secret-generator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: viaduct.ai/v1 kind: ksops metadata: diff --git a/prometheus/secret.yaml b/prometheus/secret.yaml index f3a9602..96a0883 100644 --- a/prometheus/secret.yaml +++ b/prometheus/secret.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: diff --git a/prometheus/service-monitor-longhorn.yaml b/prometheus/service-monitor-longhorn.yaml index 745c977..0f26048 100644 --- a/prometheus/service-monitor-longhorn.yaml +++ b/prometheus/service-monitor-longhorn.yaml @@ -1,3 +1,4 @@ +--- apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: @@ -11,6 +12,6 @@ spec: app: longhorn-manager namespaceSelector: matchNames: - - longhorn-system + - longhorn-system endpoints: - - port: manager + - port: manager diff --git a/prometheus/templates.yaml b/prometheus/templates.yaml index 6c8c408..fc8da4c 100644 --- a/prometheus/templates.yaml +++ b/prometheus/templates.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: ConfigMap metadata: @@ -12,4 +13,4 @@ data: {{ .Annotations.description }} {{ end }} - {{ end }} \ No newline at end of file + {{ end }} diff --git a/prometheus/values.yaml b/prometheus/values.yaml index f64a7ff..cdd7157 100644 --- a/prometheus/values.yaml +++ b/prometheus/values.yaml @@ -1,3 +1,4 @@ +--- alertmanager: alertmanagerSpec: podAntiAffinity: "hard" @@ -8,11 +9,11 @@ alertmanager: - "templates" storage: volumeClaimTemplate: - spec: - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: 5Gi + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 5Gi useExistingSecret: false config: global: @@ -27,20 +28,20 @@ alertmanager: receiver: 'tg1' routes: - matchers: - - severity=warning + - severity=warning receiver: 'tg1' - matchers: - - severity=critical + - severity=critical receiver: 'tg1' receivers: - - name: tg1 - telegram_configs: - - bot_token_file: '/etc/alertmanager/secrets/telegram-api/api_key' - chat_id: -995270884 - api_url: "https://api.telegram.org" - send_resolved: true - parse_mode: "HTML" - message: '{{ template "telegram.aaron" .}}' + - name: tg1 + telegram_configs: + - bot_token_file: '/etc/alertmanager/secrets/telegram-api/api_key' + chat_id: -995270884 + api_url: "https://api.telegram.org" + send_resolved: true + parse_mode: "HTML" + message: '{{ template "telegram.aaron" .}}' inhibit_rules: - source_matchers: - severity = critical @@ -97,7 +98,7 @@ grafana: persistence: enabled: true accessModes: - - ReadWriteMany + - ReadWriteMany grafana.ini: auth: disable_login_form: true @@ -168,12 +169,12 @@ prometheus: replicas: 2 storageSpec: volumeClaimTemplate: - spec: - storageClassName: longhorn - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: 10Gi + spec: + storageClassName: longhorn + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: 10Gi serviceMonitorNamespaceSelector: matchLabels: prometheus: yolokube diff --git a/quota/quotad.yaml b/quota/quotad.yaml index 4eeee78..db034d5 100644 --- a/quota/quotad.yaml +++ b/quota/quotad.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Namespace metadata: @@ -109,4 +110,4 @@ subjects: roleRef: kind: ClusterRole name: quotad-role - apiGroup: rbac.authorization.k8s.io \ No newline at end of file + apiGroup: rbac.authorization.k8s.io diff --git a/tests/test-egress.yaml b/tests/test-egress.yaml index 299cc5f..0c6da2e 100644 --- a/tests/test-egress.yaml +++ b/tests/test-egress.yaml @@ -1,51 +1,51 @@ -#--- -#apiVersion: v1 -#kind: Namespace -#metadata: -# name: egress -#--- -#apiVersion: apps/v1 -#kind: Deployment -#metadata: -# name: egress-deployment -# namespace: egress -# labels: -# app: egress -#spec: -# replicas: 3 -# selector: -# matchLabels: -# app: egress -# template: -# metadata: -# labels: -# app: egress -# spec: -# containers: -# - name: egress -# image: curlimages/curl -# command: ['/usr/bin/curl'] -# args: ['-s', '-L', '-4', 'ip.hetzner.com'] -#--- -#apiVersion: apps/v1 -#kind: Deployment -#metadata: -# name: egress6-deployment -# namespace: egress -# labels: -# app: egress6 -#spec: -# replicas: 3 -# selector: -# matchLabels: -# app: egress6 -# template: -# metadata: -# labels: -# app: egress6 -# spec: -# containers: -# - name: egress6 -# image: curlimages/curl -# command: ['/usr/bin/curl'] -# args: ['-s', '-L', '-6', 'ip.hetzner.com'] \ No newline at end of file +# --- +# apiVersion: v1 +# kind: Namespace +# metadata: +# name: egress +# --- +# apiVersion: apps/v1 +# kind: Deployment +# metadata: +# name: egress-deployment +# namespace: egress +# labels: +# app: egress +# spec: +# replicas: 3 +# selector: +# matchLabels: +# app: egress +# template: +# metadata: +# labels: +# app: egress +# spec: +# containers: +# - name: egress +# image: curlimages/curl +# command: ['/usr/bin/curl'] +# args: ['-s', '-L', '-4', 'ip.hetzner.com'] +# --- +# apiVersion: apps/v1 +# kind: Deployment +# metadata: +# name: egress6-deployment +# namespace: egress +# labels: +# app: egress6 +# spec: +# replicas: 3 +# selector: +# matchLabels: +# app: egress6 +# template: +# metadata: +# labels: +# app: egress6 +# spec: +# containers: +# - name: egress6 +# image: curlimages/curl +# command: ['/usr/bin/curl'] +# args: ['-s', '-L', '-6', 'ip.hetzner.com'] diff --git a/tests/test-ingress.yaml b/tests/test-ingress.yaml index 5e4805c..beab63e 100644 --- a/tests/test-ingress.yaml +++ b/tests/test-ingress.yaml @@ -23,10 +23,10 @@ spec: app: test1 spec: containers: - - name: test1 - image: containous/whoami - ports: - - containerPort: 80 + - name: test1 + image: containous/whoami + ports: + - containerPort: 80 --- apiVersion: v1 kind: Service @@ -51,17 +51,17 @@ metadata: namespace: aaron-test spec: rules: - - host: "test.services.yolokube.de" - http: - paths: - - pathType: Prefix - path: "/" - backend: - service: - name: test1-service - port: - number: 80 + - host: "test.services.yolokube.de" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: test1-service + port: + number: 80 tls: - - hosts: - - test.services.yolokube.de - secretName: test2-tls-key + - hosts: + - test.services.yolokube.de + secretName: test2-tls-key diff --git a/tests/test-storage.yaml b/tests/test-storage.yaml index b86e250..00a48f8 100644 --- a/tests/test-storage.yaml +++ b/tests/test-storage.yaml @@ -1,88 +1,88 @@ -### example app "privatebin" to test storage -#--- -#apiVersion: v1 -#kind: Namespace -#metadata: -# name: paste -#--- -#apiVersion: v1 -#kind: PersistentVolumeClaim -#metadata: -# name: paste-pvc -# namespace: paste -#spec: -# accessModes: -# - ReadWriteOnce -# volumeMode: Filesystem -# resources: -# requests: -# storage: 8Gi -#--- -#apiVersion: apps/v1 -#kind: Deployment -#metadata: -# name: paste-deployment -# namespace: paste -# labels: -# app: paste -#spec: -# replicas: 1 -# selector: -# matchLabels: -# app: paste -# template: -# metadata: -# labels: -# app: paste -# spec: -# securityContext: -# fsGroup: 82 -# containers: -# - name: paste -# image: privatebin/nginx-fpm-alpine -# ports: -# - containerPort: 8080 -# volumeMounts: -# - mountPath: "/srv/data" -# name: paste-volume -# volumes: -# - name: paste-volume -# persistentVolumeClaim: -# claimName: paste-pvc -#--- -#apiVersion: v1 -#kind: Service -#metadata: -# name: paste-service -# namespace: paste -#spec: -# selector: -# app: paste -# ports: -# - protocol: TCP -# port: 80 -# targetPort: 8080 -#--- -#apiVersion: networking.k8s.io/v1 -#kind: Ingress -#metadata: -# annotations: -# kubernetes.io/tls-acme: "true" -# name: paste-ingress -# namespace: paste -#spec: -# rules: -# - host: "paste.apps.yolokube.de" -# http: -# paths: -# - pathType: Prefix -# path: "/" -# backend: -# service: -# name: paste-service -# port: -# number: 80 -# tls: -# - hosts: -# - paste.apps.yolokube.de -# secretName: paste-tls-key +# ## example app "privatebin" to test storage +# --- +# apiVersion: v1 +# kind: Namespace +# metadata: +# name: paste +# --- +# apiVersion: v1 +# kind: PersistentVolumeClaim +# metadata: +# name: paste-pvc +# namespace: paste +# spec: +# accessModes: +# - ReadWriteOnce +# volumeMode: Filesystem +# resources: +# requests: +# storage: 8Gi +# --- +# apiVersion: apps/v1 +# kind: Deployment +# metadata: +# name: paste-deployment +# namespace: paste +# labels: +# app: paste +# spec: +# replicas: 1 +# selector: +# matchLabels: +# app: paste +# template: +# metadata: +# labels: +# app: paste +# spec: +# securityContext: +# fsGroup: 82 +# containers: +# - name: paste +# image: privatebin/nginx-fpm-alpine +# ports: +# - containerPort: 8080 +# volumeMounts: +# - mountPath: "/srv/data" +# name: paste-volume +# volumes: +# - name: paste-volume +# persistentVolumeClaim: +# claimName: paste-pvc +# --- +# apiVersion: v1 +# kind: Service +# metadata: +# name: paste-service +# namespace: paste +# spec: +# selector: +# app: paste +# ports: +# - protocol: TCP +# port: 80 +# targetPort: 8080 +# --- +# apiVersion: networking.k8s.io/v1 +# kind: Ingress +# metadata: +# annotations: +# kubernetes.io/tls-acme: "true" +# name: paste-ingress +# namespace: paste +# spec: +# rules: +# - host: "paste.apps.yolokube.de" +# http: +# paths: +# - pathType: Prefix +# path: "/" +# backend: +# service: +# name: paste-service +# port: +# number: 80 +# tls: +# - hosts: +# - paste.apps.yolokube.de +# secretName: paste-tls-key diff --git a/thanos/2-objectstore-secret.enc.yaml b/thanos/2-objectstore-secret.enc.yaml index 9c62e4c..798271f 100644 --- a/thanos/2-objectstore-secret.enc.yaml +++ b/thanos/2-objectstore-secret.enc.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: diff --git a/thanos/3-querier.yaml b/thanos/3-querier.yaml index cededff..10120bd 100644 --- a/thanos/3-querier.yaml +++ b/thanos/3-querier.yaml @@ -95,17 +95,17 @@ metadata: namespace: thanos spec: rules: - - host: "thanos.services.yolokube.de" - http: - paths: - - pathType: Prefix - path: "/" - backend: - service: - name: querier - port: - name: http + - host: "thanos.services.yolokube.de" + http: + paths: + - pathType: Prefix + path: "/" + backend: + service: + name: querier + port: + name: http tls: - - hosts: - - thanos.services.yolokube.de - secretName: thanos-tls-key + - hosts: + - thanos.services.yolokube.de + secretName: thanos-tls-key diff --git a/thanos/kustomization.yaml b/thanos/kustomization.yaml index 0bf99cb..17cc57e 100644 --- a/thanos/kustomization.yaml +++ b/thanos/kustomization.yaml @@ -1,3 +1,4 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: diff --git a/thanos/secret-generator.yaml b/thanos/secret-generator.yaml index 67bbbfe..6acf7af 100644 --- a/thanos/secret-generator.yaml +++ b/thanos/secret-generator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: viaduct.ai/v1 kind: ksops metadata: diff --git a/traefik/basicauth.yaml b/traefik/basicauth.yaml index 6b68db5..6714f0a 100644 --- a/traefik/basicauth.yaml +++ b/traefik/basicauth.yaml @@ -1,3 +1,4 @@ +--- apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: @@ -17,4 +18,4 @@ data: YWFyb246JDJ5JDA1JEIyLlEuOS9lNFZFWHNub2UueXBqWU9raXlrbXJGMmhwQXBFN0NZYzJEUEly MHBGSWRETzFPCnRvbTokMnkkMDUkQnNNN2Z2bWYzR3B1em5hazVPU2dyZTB4ODFLNC52eFVRTy9h S1c1Y1k0Z21RT3p2c3NQTE8KYmFzdGk6JCRhcHIxJCRYYUdERnByYiQkTzlZMW9SaFROWTdVNWFh - NUxqM3dhMQo= \ No newline at end of file + NUxqM3dhMQo= diff --git a/traefik/secondingressclass.yaml b/traefik/secondingressclass.yaml index 9931d8c..776d346 100644 --- a/traefik/secondingressclass.yaml +++ b/traefik/secondingressclass.yaml @@ -1,6 +1,7 @@ +--- apiVersion: networking.k8s.io/v1 kind: IngressClass metadata: name: nginx spec: - controller: traefik.io/ingress-controller \ No newline at end of file + controller: traefik.io/ingress-controller diff --git a/traefik/values.yaml b/traefik/values.yaml index aac896a..4e8181a 100644 --- a/traefik/values.yaml +++ b/traefik/values.yaml @@ -1,3 +1,4 @@ +--- deployment: kind: DaemonSet minReadySeconds: 120 diff --git a/vcluster/aaron.yaml b/vcluster/aaron.yaml index a734d9e..e959fff 100644 --- a/vcluster/aaron.yaml +++ b/vcluster/aaron.yaml @@ -1,3 +1,4 @@ +--- controlPlane: distro: k8s: @@ -18,7 +19,7 @@ controlPlane: replicas: 3 proxy: extraSANs: - - vcluster.k8s.ar21.de + - vcluster.k8s.ar21.de exportKubeConfig: server: https://vcluster.k8s.ar21.de:443 sync: diff --git a/vcluster/ingress-aaron.yaml b/vcluster/ingress-aaron.yaml index d07c8e4..0269767 100644 --- a/vcluster/ingress-aaron.yaml +++ b/vcluster/ingress-aaron.yaml @@ -1,3 +1,4 @@ +--- apiVersion: traefik.io/v1alpha1 kind: IngressRouteTCP metadata: @@ -7,9 +8,9 @@ spec: entryPoints: - websecure routes: - - match: HostSNI(`vcluster.k8s.ar21.de`) - services: - - name: ar - port: 443 + - match: HostSNI(`vcluster.k8s.ar21.de`) + services: + - name: ar + port: 443 tls: passthrough: true diff --git a/vcluster/tom.yaml b/vcluster/tom.yaml index 395e617..33bf339 100644 --- a/vcluster/tom.yaml +++ b/vcluster/tom.yaml @@ -1,3 +1,4 @@ +--- controlPlane: distro: k8s: diff --git a/woodpecker/secrets/kustomization.yaml b/woodpecker/secrets/kustomization.yaml index 073e908..d840c3c 100644 --- a/woodpecker/secrets/kustomization.yaml +++ b/woodpecker/secrets/kustomization.yaml @@ -1,3 +1,4 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: diff --git a/woodpecker/secrets/secret-generator.yaml b/woodpecker/secrets/secret-generator.yaml index b0e550d..a591479 100644 --- a/woodpecker/secrets/secret-generator.yaml +++ b/woodpecker/secrets/secret-generator.yaml @@ -1,3 +1,4 @@ +--- apiVersion: viaduct.ai/v1 kind: ksops metadata: diff --git a/woodpecker/secrets/secrets.enc.yaml b/woodpecker/secrets/secrets.enc.yaml index 86ab261..178c675 100644 --- a/woodpecker/secrets/secrets.enc.yaml +++ b/woodpecker/secrets/secrets.enc.yaml @@ -1,3 +1,4 @@ +--- apiVersion: v1 kind: Secret metadata: diff --git a/woodpecker/values/values.yaml b/woodpecker/values/values.yaml index 822f9d3..66f2329 100644 --- a/woodpecker/values/values.yaml +++ b/woodpecker/values/values.yaml @@ -1,10 +1,11 @@ +--- server: ingress: # -- Enable the ingress for the server component enabled: true # -- Add annotations to the ingress annotations: - # kubernetes.io/ingress.class: nginx + # kubernetes.io/ingress.class: nginx kubernetes.io/tls-acme: "true" hosts: - host: woodpecker.ar21.de @@ -15,7 +16,7 @@ server: servicePort: 80 tls: - hosts: - - woodpecker.ar21.de + - woodpecker.ar21.de secretName: woodpecker-tls-key statefulSet: replicaCount: 1 From 842355bbe0f9e56a111d233239d1277d6ffe5f6c Mon Sep 17 00:00:00 2001 From: Tom Neuber Date: Mon, 7 Oct 2024 09:22:27 +0200 Subject: [PATCH 3/3] .woodpecker/.yamllint.yaml: only run pipeline on "push" event --- .woodpecker/.yamllint.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.woodpecker/.yamllint.yaml b/.woodpecker/.yamllint.yaml index af15cd1..286e520 100644 --- a/.woodpecker/.yamllint.yaml +++ b/.woodpecker/.yamllint.yaml @@ -4,3 +4,5 @@ steps: image: cytopia/yamllint:latest commands: - yamllint -f colored -s . +when: + - event: push