From 8c14178bd954170687c18479db4397c551a9fa30 Mon Sep 17 00:00:00 2001 From: hermes-agent Date: Wed, 16 Sep 2026 21:17:09 +0000 Subject: [PATCH] feat(storage,security): openebs localpv (default StorageClass) + vault --- kubernetes/apps/security/kustomization.yaml | 11 +++ kubernetes/apps/security/namespace.yaml | 7 ++ .../apps/security/vault/app/helmrelease.yaml | 75 +++++++++++++++++++ .../security/vault/app/helmrepository.yaml | 8 ++ .../apps/security/vault/app/httproute.yaml | 25 +++++++ .../security/vault/app/kustomization.yaml | 7 ++ kubernetes/apps/security/vault/ks.yaml | 23 ++++++ kubernetes/apps/storage/kustomization.yaml | 11 +++ .../localpv-provisioner/app/helmrelease.yaml | 33 ++++++++ .../app/helmrepository.yaml | 8 ++ .../app/kustomization.yaml | 6 ++ .../apps/storage/localpv-provisioner/ks.yaml | 20 +++++ kubernetes/apps/storage/namespace.yaml | 7 ++ 13 files changed, 241 insertions(+) create mode 100644 kubernetes/apps/security/kustomization.yaml create mode 100644 kubernetes/apps/security/namespace.yaml create mode 100644 kubernetes/apps/security/vault/app/helmrelease.yaml create mode 100644 kubernetes/apps/security/vault/app/helmrepository.yaml create mode 100644 kubernetes/apps/security/vault/app/httproute.yaml create mode 100644 kubernetes/apps/security/vault/app/kustomization.yaml create mode 100644 kubernetes/apps/security/vault/ks.yaml create mode 100644 kubernetes/apps/storage/kustomization.yaml create mode 100644 kubernetes/apps/storage/localpv-provisioner/app/helmrelease.yaml create mode 100644 kubernetes/apps/storage/localpv-provisioner/app/helmrepository.yaml create mode 100644 kubernetes/apps/storage/localpv-provisioner/app/kustomization.yaml create mode 100644 kubernetes/apps/storage/localpv-provisioner/ks.yaml create mode 100644 kubernetes/apps/storage/namespace.yaml diff --git a/kubernetes/apps/security/kustomization.yaml b/kubernetes/apps/security/kustomization.yaml new file mode 100644 index 0000000..0942720 --- /dev/null +++ b/kubernetes/apps/security/kustomization.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: security + +components: + - ../../components/sops + +resources: + - ./namespace.yaml + - ./vault/ks.yaml diff --git a/kubernetes/apps/security/namespace.yaml b/kubernetes/apps/security/namespace.yaml new file mode 100644 index 0000000..1d48e62 --- /dev/null +++ b/kubernetes/apps/security/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: security + annotations: + kustomize.toolkit.fluxcd.io/prune: disabled diff --git a/kubernetes/apps/security/vault/app/helmrelease.yaml b/kubernetes/apps/security/vault/app/helmrelease.yaml new file mode 100644 index 0000000..31b3c61 --- /dev/null +++ b/kubernetes/apps/security/vault/app/helmrelease.yaml @@ -0,0 +1,75 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: vault +spec: + chart: + spec: + chart: vault + version: 0.34.1 + sourceRef: + kind: HelmRepository + name: hashicorp + interval: 1h + maxHistory: 3 + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + cleanupOnFail: true + remediation: + retries: 3 + values: + global: + enabled: true + tlsDisable: true + injector: + enabled: false + csi: + enabled: false + server: + # standalone + integrated storage (raft) на PVC. После рестарта пода Vault + # остаётся запечатанным (sealed) — распечатывается вручную ключами из + # Shamir-схемы (key-shares=5, key-threshold=3). + # authDelegator нужен для auth-метода kubernetes, через который + # external-secrets получает токен (TokenReview). + authDelegator: + enabled: true + standalone: + enabled: true + config: | + ui = true + + listener "tcp" { + address = "[::]:8200" + cluster_address = "[::]:8201" + tls_disable = 1 + } + + storage "raft" { + path = "/vault/data" + } + + service_registration "kubernetes" {} + dataStorage: + enabled: true + size: 5Gi + storageClass: openebs-hostpath + accessMode: ReadWriteOnce + service: + enabled: true + type: ClusterIP + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 512Mi + ui: + enabled: true + serviceType: ClusterIP + externalPort: 8200 + targetPort: 8200 diff --git a/kubernetes/apps/security/vault/app/helmrepository.yaml b/kubernetes/apps/security/vault/app/helmrepository.yaml new file mode 100644 index 0000000..478c43c --- /dev/null +++ b/kubernetes/apps/security/vault/app/helmrepository.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: hashicorp +spec: + interval: 12h + url: https://helm.releases.hashicorp.com diff --git a/kubernetes/apps/security/vault/app/httproute.yaml b/kubernetes/apps/security/vault/app/httproute.yaml new file mode 100644 index 0000000..a8bbc55 --- /dev/null +++ b/kubernetes/apps/security/vault/app/httproute.yaml @@ -0,0 +1,25 @@ +--- +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: vault +spec: + hostnames: + - vault.${SECRET_DOMAIN} + parentRefs: + # Внимание: http-листенер envoy-internal принимает маршруты только из + # namespace network (allowedRoutes.namespaces.from: Same), поэтому маршруты + # из других namespace цепляются к https-листенеру (from: All). Сертификат + # grachevko-ru-production-tls подписан ClusterIssuer internal-ca, то есть + # самоподписанным CA — его нужно импортировать в доверенные на клиенте. + - name: envoy-internal + namespace: network + sectionName: https + rules: + - backendRefs: + - name: vault-ui + port: 8200 + matches: + - path: + type: PathPrefix + value: / diff --git a/kubernetes/apps/security/vault/app/kustomization.yaml b/kubernetes/apps/security/vault/app/kustomization.yaml new file mode 100644 index 0000000..cbdfdcf --- /dev/null +++ b/kubernetes/apps/security/vault/app/kustomization.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./helmrepository.yaml + - ./helmrelease.yaml + - ./httproute.yaml diff --git a/kubernetes/apps/security/vault/ks.yaml b/kubernetes/apps/security/vault/ks.yaml new file mode 100644 index 0000000..e1e0598 --- /dev/null +++ b/kubernetes/apps/security/vault/ks.yaml @@ -0,0 +1,23 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: vault +spec: + dependsOn: + - name: localpv-provisioner + namespace: storage + interval: 1h + path: ./kubernetes/apps/security/vault/app + prune: true + sourceRef: + kind: GitRepository + name: flux-system + namespace: flux-system + targetNamespace: security + wait: true + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + name: vault + namespace: security diff --git a/kubernetes/apps/storage/kustomization.yaml b/kubernetes/apps/storage/kustomization.yaml new file mode 100644 index 0000000..14f4484 --- /dev/null +++ b/kubernetes/apps/storage/kustomization.yaml @@ -0,0 +1,11 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: storage + +components: + - ../../components/sops + +resources: + - ./namespace.yaml + - ./localpv-provisioner/ks.yaml diff --git a/kubernetes/apps/storage/localpv-provisioner/app/helmrelease.yaml b/kubernetes/apps/storage/localpv-provisioner/app/helmrelease.yaml new file mode 100644 index 0000000..e819218 --- /dev/null +++ b/kubernetes/apps/storage/localpv-provisioner/app/helmrelease.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: localpv-provisioner +spec: + chart: + spec: + chart: localpv-provisioner + version: 4.6.0 + sourceRef: + kind: HelmRepository + name: openebs + interval: 1h + maxHistory: 3 + install: + crds: CreateReplace + remediation: + retries: 3 + upgrade: + crds: CreateReplace + cleanupOnFail: true + remediation: + retries: 3 + values: + analytics: + enabled: false + # openebs-hostpath объявляется StorageClass по умолчанию: PVC без явного + # storageClassName биндятся в /var/openebs/local на ноде, где оказался под. + hostpathClass: + isDefaultClass: true + localpv: + basePath: /var/openebs/local diff --git a/kubernetes/apps/storage/localpv-provisioner/app/helmrepository.yaml b/kubernetes/apps/storage/localpv-provisioner/app/helmrepository.yaml new file mode 100644 index 0000000..f6f5d69 --- /dev/null +++ b/kubernetes/apps/storage/localpv-provisioner/app/helmrepository.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: openebs +spec: + interval: 12h + url: https://openebs.github.io/dynamic-localpv-provisioner diff --git a/kubernetes/apps/storage/localpv-provisioner/app/kustomization.yaml b/kubernetes/apps/storage/localpv-provisioner/app/kustomization.yaml new file mode 100644 index 0000000..008b69e --- /dev/null +++ b/kubernetes/apps/storage/localpv-provisioner/app/kustomization.yaml @@ -0,0 +1,6 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - ./helmrepository.yaml + - ./helmrelease.yaml diff --git a/kubernetes/apps/storage/localpv-provisioner/ks.yaml b/kubernetes/apps/storage/localpv-provisioner/ks.yaml new file mode 100644 index 0000000..c3cb8a5 --- /dev/null +++ b/kubernetes/apps/storage/localpv-provisioner/ks.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: localpv-provisioner +spec: + interval: 1h + path: ./kubernetes/apps/storage/localpv-provisioner/app + prune: true + sourceRef: + kind: GitRepository + name: flux-system + namespace: flux-system + targetNamespace: storage + wait: true + healthChecks: + - apiVersion: helm.toolkit.fluxcd.io/v2 + kind: HelmRelease + name: localpv-provisioner + namespace: storage diff --git a/kubernetes/apps/storage/namespace.yaml b/kubernetes/apps/storage/namespace.yaml new file mode 100644 index 0000000..8942805 --- /dev/null +++ b/kubernetes/apps/storage/namespace.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: storage + annotations: + kustomize.toolkit.fluxcd.io/prune: disabled