chrisfu/prole
1
0
Fork 0
mirror of https://github.com/dredx/prole.git synced 2026-09-23 11:03:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
cf33342500
prole/deploy/opentofu/k3s/manifests/knoe/iscsi-pvs.yaml
chrisfu cf33342500 feat(prole): bootstrap knoe-auth on k3s; tenant onboarding; cluster stabilisation 
knoe-auth (prole.org k3s):
- Fix CNPG manifest drift: remove spec.backup.pluginConfiguration (CNPG 1.28 only),
  switch spec.certificates from serverTLSSecret to serverAltDNSNames
- Apply knoe-auth Round 1 schema + GRANTs manually (postInitSQL had never run on live cluster)
- Fix OIDC signing key generator: base64(DER) not base64(PEM) — OidcTokenService
  does Base64.decode() → PKCS8EncodedKeySpec which requires raw DER bytes
- Add OIDC controllers: authorize, token, userinfo, jwks, discovery
- Add prole Spring profile: cookieDomain, emailDomain, Kerberos config
- Add secret example templates: knoe-db-user, knoe-auth-oidc-signing, knoe-auth-google-prole
- Kong configmap: scope knoe-auth route to /auth prefix only

Tenant onboarding:
- Add etc/onboard_tenant.sh: provision/apply/rotate/status workflow backed by 1Password
  vaults; types: 'enterprise' (own Kerberos + domain) and 'tenant' (hosted, initContainer KDC)
- Provision 'Knoe Tenant - prole.org' vault; apply all 7 k8s secrets to knoe-system
- init_knoe_auth.sh: add explicit GRANT + ALTER DEFAULT PRIVILEGES for knoe role

Cluster stabilisation:
- gitea: roll back 14-day stuck rollout (RWO PVC + maxSurge=100% deadlock);
  patch deployment strategy to Recreate
- supabase: create supabase_admin role, _supabase db, _analytics schema, _realtime schema
  in CNPG — analytics and realtime had never connected since Helm install day 1
- knoe-db barman ObjectStore: add GCS-backed objectstore manifest + scheduled backup

Infrastructure:
- gandalf host_vars: k3s registry config
- pi host_vars: clean up stale entries
- knoe-db schemas: ekosystem.sql, ekosystem_objects.sql
- init_prole_app.sql: prole app DB initialisation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-26 00:50:37 -07:00

312 lines
6.8 KiB
YAML
Raw Blame History

apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d001-data
labels:
synology.storage/role: data
synology.storage/volume: d001
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d001/data
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- myrddin.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d001-wal
labels:
synology.storage/role: wal
synology.storage/volume: d001
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d001/wal
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- myrddin.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d001-garage
labels:
synology.storage/role: garage
synology.storage/volume: d001
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d001/garage
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- myrddin.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d002-data
labels:
synology.storage/role: data
synology.storage/volume: d002
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d002/data
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- merlin.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d002-wal
labels:
synology.storage/role: wal
synology.storage/volume: d002
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d002/wal
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- merlin.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d003-data
labels:
synology.storage/role: data
synology.storage/volume: d003
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d003/data
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- gandalf.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d003-wal
labels:
synology.storage/role: wal
synology.storage/volume: d003
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d003/wal
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- gandalf.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d003-grafana
labels:
synology.storage/role: grafana
synology.storage/volume: d003
spec:
capacity:
storage: 5Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d003/grafana
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- gandalf.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d002-prometheus
labels:
synology.storage/role: prometheus
synology.storage/volume: d002
spec:
capacity:
storage: 20Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d002/prometheus
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- merlin.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d001-openbao
labels:
synology.storage/role: openbao
synology.storage/volume: d001
spec:
capacity:
storage: 5Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d001/openbao
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- myrddin.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d004-data
labels:
synology.storage/role: data
synology.storage/volume: d004
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d004/data
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- gandalf.prole.org
---
apiVersion: v1
kind: PersistentVolume
metadata:
name: synology-iscsi-d004-wal
labels:
synology.storage/role: wal
synology.storage/volume: d004
spec:
capacity:
storage: 29Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
storageClassName: synology-iscsi
persistentVolumeReclaimPolicy: Retain
local:
path: /synology/d004/wal
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- gandalf.prole.org
Reference in New Issue View Git Blame Copy Permalink