Wire Zabbix/Matrix credentials to 1Password-synced secrets, add OnePasswordItem CRDs
- Zabbix: Remove hardcoded zabbix-db-secret and zabbix-admin-secret, reference zabbix-credentials (1Password) for DB-User, DB-Password, and admin password - Matrix: Remove hardcoded matrix-db-secret, reference matrix-credentials for Postgres user/password. Convert ConfigMap homeserver.yaml to template with __DB_PASSWORD__/__DB_USER__ placeholders, inject via busybox init container - Guacamole: Add OnePasswordItem CRD for future use. MySQL DB creds remain in guac-db-secret (1Password item lacks DB-specific fields — gap documented) - All three services now include OnePasswordItem CRD manifests for ArgoCD mgmt
This commit is contained in:
Andrew Stoltz
@@ -1,326 +1,344 @@
|
||||
# Apache Guacamole - Remote Desktop Gateway
|
||||
# MySQL 8 + guacd + guacamole web
|
||||
# ArgoCD managed - BlueJay Lab
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: guacamole
|
||||
labels:
|
||||
app.kubernetes.io/part-of: bluejay-infra
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: guac-db-secret
|
||||
namespace: guacamole
|
||||
type: Opaque
|
||||
stringData:
|
||||
MYSQL_ROOT_PASSWORD: BlueJay-Guac-DB-2026
|
||||
MYSQL_DATABASE: guacamole_db
|
||||
MYSQL_USER: guacamole
|
||||
MYSQL_PASSWORD: BlueJay-Guac-DB-2026
|
||||
---
|
||||
# MySQL 8 StatefulSet
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: guac-mysql
|
||||
namespace: guacamole
|
||||
labels:
|
||||
app: guac-mysql
|
||||
spec:
|
||||
serviceName: guac-mysql
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: guac-mysql
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: guac-mysql
|
||||
spec:
|
||||
containers:
|
||||
- name: mysql
|
||||
image: mysql:8.0
|
||||
ports:
|
||||
- containerPort: 3306
|
||||
name: mysql
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: guac-db-secret
|
||||
volumeMounts:
|
||||
- name: guac-mysql-data
|
||||
mountPath: /var/lib/mysql
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- mysqladmin
|
||||
- ping
|
||||
- -h
|
||||
- localhost
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- mysqladmin
|
||||
- ping
|
||||
- -h
|
||||
- localhost
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: guac-mysql-data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: guac-mysql
|
||||
namespace: guacamole
|
||||
spec:
|
||||
selector:
|
||||
app: guac-mysql
|
||||
ports:
|
||||
- port: 3306
|
||||
targetPort: 3306
|
||||
name: mysql
|
||||
clusterIP: None
|
||||
---
|
||||
# DB schema init Job
|
||||
# Generates the MySQL schema and pipes it into the database
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: guacamole-initdb
|
||||
namespace: guacamole
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 300
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
initContainers:
|
||||
- name: wait-for-mysql
|
||||
image: mysql:8.0
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until mysqladmin ping -h guac-mysql --silent; do
|
||||
echo "Waiting for MySQL..."
|
||||
sleep 5
|
||||
done
|
||||
containers:
|
||||
- name: initdb
|
||||
image: guacamole/guacamole:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
# Generate schema SQL
|
||||
/opt/guacamole/bin/initdb.sh --mysql > /tmp/initdb.sql
|
||||
# Apply schema (ignore errors if tables already exist)
|
||||
mysql -h guac-mysql -u root -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE" < /tmp/initdb.sql || true
|
||||
env:
|
||||
- name: MYSQL_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_ROOT_PASSWORD
|
||||
- name: MYSQL_DATABASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_DATABASE
|
||||
---
|
||||
# guacd (Guacamole daemon)
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: guacd
|
||||
namespace: guacamole
|
||||
labels:
|
||||
app: guacd
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: guacd
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: guacd
|
||||
spec:
|
||||
containers:
|
||||
- name: guacd
|
||||
image: guacamole/guacd:latest
|
||||
ports:
|
||||
- containerPort: 4822
|
||||
name: guacd
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 4822
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: guacd
|
||||
namespace: guacamole
|
||||
spec:
|
||||
selector:
|
||||
app: guacd
|
||||
ports:
|
||||
- port: 4822
|
||||
targetPort: 4822
|
||||
name: guacd
|
||||
---
|
||||
# Guacamole Web Application
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: guacamole
|
||||
namespace: guacamole
|
||||
labels:
|
||||
app: guacamole
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: guacamole
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: guacamole
|
||||
spec:
|
||||
containers:
|
||||
- name: guacamole
|
||||
image: guacamole/guacamole:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
env:
|
||||
- name: GUACD_HOSTNAME
|
||||
value: guacd
|
||||
- name: GUACD_PORT
|
||||
value: "4822"
|
||||
- name: MYSQL_HOSTNAME
|
||||
value: guac-mysql
|
||||
- name: MYSQL_PORT
|
||||
value: "3306"
|
||||
- name: MYSQL_DATABASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_DATABASE
|
||||
- name: MYSQL_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_USER
|
||||
- name: MYSQL_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_PASSWORD
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /guacamole/
|
||||
port: 8080
|
||||
initialDelaySeconds: 120
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /guacamole/
|
||||
port: 8080
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 5
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: guacamole
|
||||
namespace: guacamole
|
||||
spec:
|
||||
selector:
|
||||
app: guacamole
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
name: http
|
||||
---
|
||||
# Traefik addPrefix middleware
|
||||
# External URL guac.iamworkin.lan/ gets prefix /guacamole added
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: guac-add-prefix
|
||||
namespace: guacamole
|
||||
spec:
|
||||
addPrefix:
|
||||
prefix: /guacamole
|
||||
---
|
||||
# TLS Certificate via cert-manager
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: guacamole-tls
|
||||
namespace: guacamole
|
||||
spec:
|
||||
secretName: guacamole-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- guac.iamworkin.lan
|
||||
---
|
||||
# Traefik IngressRoute
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: guacamole
|
||||
namespace: guacamole
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`guac.iamworkin.lan`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: guac-add-prefix
|
||||
services:
|
||||
- name: guacamole
|
||||
port: 8080
|
||||
tls:
|
||||
secretName: guacamole-tls
|
||||
# Apache Guacamole - Remote Desktop Gateway
|
||||
# MySQL 8 + guacd + guacamole web
|
||||
# ArgoCD managed - BlueJay Lab
|
||||
# DB credentials sourced from 1Password via OnePasswordItem CRD (guacamole-credentials)
|
||||
# Note: guacamole-credentials contains Guacamole admin UI creds (username/password),
|
||||
# not MySQL DB creds. MySQL root/user password is kept in guac-db-secret (still inline)
|
||||
# because 1Password item lacks DB-specific fields. See gap notes below.
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: guacamole
|
||||
labels:
|
||||
app.kubernetes.io/part-of: bluejay-infra
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: guac-db-secret
|
||||
namespace: guacamole
|
||||
type: Opaque
|
||||
stringData:
|
||||
MYSQL_ROOT_PASSWORD: BlueJay-Guac-DB-2026
|
||||
MYSQL_DATABASE: guacamole_db
|
||||
MYSQL_USER: guacamole
|
||||
MYSQL_PASSWORD: BlueJay-Guac-DB-2026
|
||||
---
|
||||
# MySQL 8 StatefulSet
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: guac-mysql
|
||||
namespace: guacamole
|
||||
labels:
|
||||
app: guac-mysql
|
||||
spec:
|
||||
serviceName: guac-mysql
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: guac-mysql
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: guac-mysql
|
||||
spec:
|
||||
containers:
|
||||
- name: mysql
|
||||
image: mysql:8.0
|
||||
ports:
|
||||
- containerPort: 3306
|
||||
name: mysql
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: guac-db-secret
|
||||
volumeMounts:
|
||||
- name: guac-mysql-data
|
||||
mountPath: /var/lib/mysql
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- mysqladmin
|
||||
- ping
|
||||
- -h
|
||||
- localhost
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- mysqladmin
|
||||
- ping
|
||||
- -h
|
||||
- localhost
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: guac-mysql-data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: guac-mysql
|
||||
namespace: guacamole
|
||||
spec:
|
||||
selector:
|
||||
app: guac-mysql
|
||||
ports:
|
||||
- port: 3306
|
||||
targetPort: 3306
|
||||
name: mysql
|
||||
clusterIP: None
|
||||
---
|
||||
# DB schema init Job
|
||||
# Generates the MySQL schema and pipes it into the database
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: guacamole-initdb
|
||||
namespace: guacamole
|
||||
annotations:
|
||||
argocd.argoproj.io/hook: PostSync
|
||||
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
||||
spec:
|
||||
ttlSecondsAfterFinished: 300
|
||||
template:
|
||||
spec:
|
||||
restartPolicy: OnFailure
|
||||
initContainers:
|
||||
- name: wait-for-mysql
|
||||
image: mysql:8.0
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
until mysqladmin ping -h guac-mysql --silent; do
|
||||
echo "Waiting for MySQL..."
|
||||
sleep 5
|
||||
done
|
||||
containers:
|
||||
- name: initdb
|
||||
image: guacamole/guacamole:latest
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- |
|
||||
# Generate schema SQL
|
||||
/opt/guacamole/bin/initdb.sh --mysql > /tmp/initdb.sql
|
||||
# Apply schema (ignore errors if tables already exist)
|
||||
mysql -h guac-mysql -u root -p"$MYSQL_ROOT_PASSWORD" "$MYSQL_DATABASE" < /tmp/initdb.sql || true
|
||||
env:
|
||||
- name: MYSQL_ROOT_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_ROOT_PASSWORD
|
||||
- name: MYSQL_DATABASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_DATABASE
|
||||
---
|
||||
# guacd (Guacamole daemon)
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: guacd
|
||||
namespace: guacamole
|
||||
labels:
|
||||
app: guacd
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: guacd
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: guacd
|
||||
spec:
|
||||
containers:
|
||||
- name: guacd
|
||||
image: guacamole/guacd:latest
|
||||
ports:
|
||||
- containerPort: 4822
|
||||
name: guacd
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 4822
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 10
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: guacd
|
||||
namespace: guacamole
|
||||
spec:
|
||||
selector:
|
||||
app: guacd
|
||||
ports:
|
||||
- port: 4822
|
||||
targetPort: 4822
|
||||
name: guacd
|
||||
---
|
||||
# Guacamole Web Application
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: guacamole
|
||||
namespace: guacamole
|
||||
labels:
|
||||
app: guacamole
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: guacamole
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: guacamole
|
||||
spec:
|
||||
containers:
|
||||
- name: guacamole
|
||||
image: guacamole/guacamole:latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
env:
|
||||
- name: GUACD_HOSTNAME
|
||||
value: guacd
|
||||
- name: GUACD_PORT
|
||||
value: "4822"
|
||||
- name: MYSQL_HOSTNAME
|
||||
value: guac-mysql
|
||||
- name: MYSQL_PORT
|
||||
value: "3306"
|
||||
- name: MYSQL_DATABASE
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_DATABASE
|
||||
- name: MYSQL_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_USER
|
||||
- name: MYSQL_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: guac-db-secret
|
||||
key: MYSQL_PASSWORD
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /guacamole/
|
||||
port: 8080
|
||||
initialDelaySeconds: 120
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /guacamole/
|
||||
port: 8080
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 5
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: guacamole
|
||||
namespace: guacamole
|
||||
spec:
|
||||
selector:
|
||||
app: guacamole
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
name: http
|
||||
---
|
||||
# Traefik addPrefix middleware
|
||||
# External URL guac.iamworkin.lan/ gets prefix /guacamole added
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: Middleware
|
||||
metadata:
|
||||
name: guac-add-prefix
|
||||
namespace: guacamole
|
||||
spec:
|
||||
addPrefix:
|
||||
prefix: /guacamole
|
||||
---
|
||||
# TLS Certificate via cert-manager
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: guacamole-tls
|
||||
namespace: guacamole
|
||||
spec:
|
||||
secretName: guacamole-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- guac.iamworkin.lan
|
||||
---
|
||||
# Traefik IngressRoute
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: guacamole
|
||||
namespace: guacamole
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`guac.iamworkin.lan`)
|
||||
kind: Rule
|
||||
middlewares:
|
||||
- name: guac-add-prefix
|
||||
services:
|
||||
- name: guacamole
|
||||
port: 8080
|
||||
tls:
|
||||
secretName: guacamole-tls
|
||||
---
|
||||
# 1Password secret sync — creates guacamole-credentials K8s Secret
|
||||
# Fields: username, password, URL, Note
|
||||
# NOTE: This secret contains Guacamole admin UI credentials only.
|
||||
# MySQL DB credentials (MYSQL_ROOT_PASSWORD, MYSQL_PASSWORD) are NOT in 1Password yet.
|
||||
# To fully externalize: add DB-User, DB-Password, DB-Root-Password fields to the
|
||||
# "Guacamole" 1Password item, then replace guac-db-secret refs with guacamole-credentials.
|
||||
apiVersion: onepassword.com/v1
|
||||
kind: OnePasswordItem
|
||||
metadata:
|
||||
name: guacamole-credentials
|
||||
namespace: guacamole
|
||||
spec:
|
||||
itemPath: vaults/IAmWorkin/items/Guacamole
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
# Matrix Synapse + Element Web
|
||||
# PostgreSQL 16 + Synapse homeserver + Element Web client
|
||||
# ArgoCD managed - BlueJay Lab
|
||||
# DB credentials sourced from 1Password via OnePasswordItem CRD (matrix-credentials)
|
||||
# Synapse homeserver.yaml DB password injected at runtime via init container
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
@@ -9,26 +11,15 @@ metadata:
|
||||
labels:
|
||||
app.kubernetes.io/part-of: bluejay-infra
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: matrix-db-secret
|
||||
namespace: matrix
|
||||
type: Opaque
|
||||
stringData:
|
||||
POSTGRES_USER: synapse
|
||||
POSTGRES_PASSWORD: BlueJay-Matrix-DB-2026
|
||||
POSTGRES_DB: synapse
|
||||
POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
|
||||
---
|
||||
# Synapse homeserver.yaml ConfigMap
|
||||
# Synapse homeserver.yaml template ConfigMap
|
||||
# DB password placeholder __DB_PASSWORD__ is replaced at pod startup by init container
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: synapse-config
|
||||
namespace: matrix
|
||||
data:
|
||||
homeserver.yaml: |
|
||||
homeserver.yaml.template: |
|
||||
server_name: "iamworkin.lan"
|
||||
pid_file: /data/homeserver.pid
|
||||
public_baseurl: "https://matrix.iamworkin.lan/"
|
||||
@@ -44,8 +35,8 @@ data:
|
||||
database:
|
||||
name: psycopg2
|
||||
args:
|
||||
user: synapse
|
||||
password: BlueJay-Matrix-DB-2026
|
||||
user: __DB_USER__
|
||||
password: __DB_PASSWORD__
|
||||
database: synapse
|
||||
host: matrix-postgres
|
||||
port: 5432
|
||||
@@ -80,6 +71,7 @@ data:
|
||||
disable_existing_loggers: false
|
||||
---
|
||||
# PostgreSQL 16 StatefulSet
|
||||
# Credentials from 1Password-synced matrix-credentials secret
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
@@ -104,9 +96,21 @@ spec:
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: matrix-db-secret
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-User
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-Password
|
||||
- name: POSTGRES_DB
|
||||
value: synapse
|
||||
- name: POSTGRES_INITDB_ARGS
|
||||
value: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
|
||||
volumeMounts:
|
||||
- name: matrix-postgres-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
@@ -163,7 +167,8 @@ spec:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
---
|
||||
# Synapse init job: generate signing key if missing
|
||||
# Synapse Deployment
|
||||
# Init container injects DB credentials from 1Password secret into homeserver.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
@@ -192,7 +197,13 @@ spec:
|
||||
args:
|
||||
- |
|
||||
if [ \! -f /data/signing.key ]; then
|
||||
python -m synapse.app.homeserver --generate-keys --config-path /config/homeserver.yaml
|
||||
python -m synapse.app.homeserver --generate-keys --config-path /config-template/homeserver.yaml.template 2>/dev/null || true
|
||||
# If key generation fails with template, create a minimal config for key gen
|
||||
if [ \! -f /data/signing.key ]; then
|
||||
echo server_name: iamworkin.lan > /tmp/minimal.yaml
|
||||
echo signing_key_path: /data/signing.key >> /tmp/minimal.yaml
|
||||
python -c "from signedjson.key import generate_signing_key, write_signing_keys; import sys; key = generate_signing_key(a_auto); write_signing_keys(open(/data/signing.key,w), [key])" 2>/dev/null || true
|
||||
fi
|
||||
fi
|
||||
chown 991:991 /data/signing.key 2>/dev/null || true
|
||||
chmod 644 /data/signing.key 2>/dev/null || true
|
||||
@@ -201,7 +212,34 @@ spec:
|
||||
volumeMounts:
|
||||
- name: synapse-data
|
||||
mountPath: /data
|
||||
- name: synapse-config
|
||||
- name: synapse-config-template
|
||||
mountPath: /config-template
|
||||
- name: inject-credentials
|
||||
image: busybox:latest
|
||||
command: ["sh", "-c"]
|
||||
args:
|
||||
- |
|
||||
# Copy template and substitute DB credentials from 1Password secret
|
||||
cp /config-template/log.config /config/log.config
|
||||
sed -e "s/__DB_PASSWORD__/${DB_PASSWORD}/g" \
|
||||
-e "s/__DB_USER__/${DB_USER}/g" \
|
||||
/config-template/homeserver.yaml.template > /config/homeserver.yaml
|
||||
echo "Credentials injected into homeserver.yaml"
|
||||
env:
|
||||
- name: DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-Password
|
||||
- name: DB_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: matrix-credentials
|
||||
key: DB-User
|
||||
volumeMounts:
|
||||
- name: synapse-config-template
|
||||
mountPath: /config-template
|
||||
- name: synapse-config-rendered
|
||||
mountPath: /config
|
||||
containers:
|
||||
- name: synapse
|
||||
@@ -217,7 +255,7 @@ spec:
|
||||
volumeMounts:
|
||||
- name: synapse-data
|
||||
mountPath: /data
|
||||
- name: synapse-config
|
||||
- name: synapse-config-rendered
|
||||
mountPath: /config
|
||||
resources:
|
||||
requests:
|
||||
@@ -242,9 +280,11 @@ spec:
|
||||
- name: synapse-data
|
||||
persistentVolumeClaim:
|
||||
claimName: synapse-data
|
||||
- name: synapse-config
|
||||
- name: synapse-config-template
|
||||
configMap:
|
||||
name: synapse-config
|
||||
- name: synapse-config-rendered
|
||||
emptyDir: {}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -407,3 +447,13 @@ spec:
|
||||
port: 80
|
||||
tls:
|
||||
secretName: element-tls
|
||||
---
|
||||
# 1Password secret sync — creates matrix-credentials K8s Secret
|
||||
# Fields: DB-User, DB-Password, Registration-Secret, username, password, URL
|
||||
apiVersion: onepassword.com/v1
|
||||
kind: OnePasswordItem
|
||||
metadata:
|
||||
name: matrix-credentials
|
||||
namespace: matrix
|
||||
spec:
|
||||
itemPath: vaults/IAmWorkin/items/Matrix Synapse
|
||||
|
||||
@@ -1,320 +1,315 @@
|
||||
# Zabbix 7.2 Monitoring Stack
|
||||
# PostgreSQL 16 + Zabbix Server + Zabbix Web (nginx)
|
||||
# ArgoCD managed - BlueJay Lab
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: zabbix
|
||||
labels:
|
||||
app.kubernetes.io/part-of: bluejay-infra
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: zabbix-db-secret
|
||||
namespace: zabbix
|
||||
type: Opaque
|
||||
stringData:
|
||||
POSTGRES_USER: zabbix
|
||||
POSTGRES_PASSWORD: BlueJay-ZabbixDB-2026
|
||||
POSTGRES_DB: zabbix
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: zabbix-admin-secret
|
||||
namespace: zabbix
|
||||
type: Opaque
|
||||
stringData:
|
||||
ZBX_ADMIN_PASSWORD: BlueJay-NOC-2026
|
||||
---
|
||||
# PostgreSQL 16 StatefulSet
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: zabbix-postgres
|
||||
namespace: zabbix
|
||||
labels:
|
||||
app: zabbix-postgres
|
||||
spec:
|
||||
serviceName: zabbix-postgres
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: zabbix-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: zabbix-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: postgres:16-alpine
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: zabbix-db-secret
|
||||
volumeMounts:
|
||||
- name: zabbix-postgres-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
subPath: pgdata
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- zabbix
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- zabbix
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: zabbix-postgres-data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-postgres
|
||||
namespace: zabbix
|
||||
spec:
|
||||
selector:
|
||||
app: zabbix-postgres
|
||||
ports:
|
||||
- port: 5432
|
||||
targetPort: 5432
|
||||
name: postgres
|
||||
clusterIP: None
|
||||
---
|
||||
# Zabbix Server
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: zabbix-server
|
||||
namespace: zabbix
|
||||
labels:
|
||||
app: zabbix-server
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: zabbix-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: zabbix-server
|
||||
spec:
|
||||
containers:
|
||||
- name: zabbix-server
|
||||
image: zabbix/zabbix-server-pgsql:7.2-alpine-latest
|
||||
ports:
|
||||
- containerPort: 10051
|
||||
name: trapper
|
||||
env:
|
||||
- name: DB_SERVER_HOST
|
||||
value: zabbix-postgres
|
||||
- name: DB_SERVER_PORT
|
||||
value: "5432"
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-db-secret
|
||||
key: POSTGRES_USER
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-db-secret
|
||||
key: POSTGRES_PASSWORD
|
||||
- name: POSTGRES_DB
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-db-secret
|
||||
key: POSTGRES_DB
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: "1"
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 10051
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 10051
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-server
|
||||
namespace: zabbix
|
||||
spec:
|
||||
selector:
|
||||
app: zabbix-server
|
||||
ports:
|
||||
- port: 10051
|
||||
targetPort: 10051
|
||||
name: trapper
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-trapper
|
||||
namespace: zabbix
|
||||
annotations:
|
||||
metallb.universe.tf/loadBalancerIPs: 10.0.56.203
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: zabbix-server
|
||||
ports:
|
||||
- port: 10051
|
||||
targetPort: 10051
|
||||
name: trapper
|
||||
protocol: TCP
|
||||
---
|
||||
# Zabbix Web (nginx + PostgreSQL)
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: zabbix-web
|
||||
namespace: zabbix
|
||||
labels:
|
||||
app: zabbix-web
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: zabbix-web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: zabbix-web
|
||||
spec:
|
||||
containers:
|
||||
- name: zabbix-web
|
||||
image: zabbix/zabbix-web-nginx-pgsql:7.2-alpine-latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
env:
|
||||
- name: ZBX_SERVER_HOST
|
||||
value: zabbix-server
|
||||
- name: ZBX_SERVER_NAME
|
||||
value: "BlueJay NOC"
|
||||
- name: PHP_TZ
|
||||
value: America/Chicago
|
||||
- name: DB_SERVER_HOST
|
||||
value: zabbix-postgres
|
||||
- name: DB_SERVER_PORT
|
||||
value: "5432"
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-db-secret
|
||||
key: POSTGRES_USER
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-db-secret
|
||||
key: POSTGRES_PASSWORD
|
||||
- name: POSTGRES_DB
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-db-secret
|
||||
key: POSTGRES_DB
|
||||
- name: ZBX_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-admin-secret
|
||||
key: ZBX_ADMIN_PASSWORD
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 50m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-web
|
||||
namespace: zabbix
|
||||
spec:
|
||||
selector:
|
||||
app: zabbix-web
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
name: http
|
||||
---
|
||||
# TLS Certificate via cert-manager
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: zabbix-tls
|
||||
namespace: zabbix
|
||||
spec:
|
||||
secretName: zabbix-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- zabbix.iamworkin.lan
|
||||
---
|
||||
# Traefik IngressRoute
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: zabbix-web
|
||||
namespace: zabbix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`zabbix.iamworkin.lan`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: zabbix-web
|
||||
port: 8080
|
||||
tls:
|
||||
secretName: zabbix-tls
|
||||
# Zabbix 7.2 Monitoring Stack
|
||||
# PostgreSQL 16 + Zabbix Server + Zabbix Web (nginx)
|
||||
# ArgoCD managed - BlueJay Lab
|
||||
# Credentials sourced from 1Password via OnePasswordItem CRD (zabbix-credentials)
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: zabbix
|
||||
labels:
|
||||
app.kubernetes.io/part-of: bluejay-infra
|
||||
---
|
||||
# PostgreSQL 16 StatefulSet
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: zabbix-postgres
|
||||
namespace: zabbix
|
||||
labels:
|
||||
app: zabbix-postgres
|
||||
spec:
|
||||
serviceName: zabbix-postgres
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: zabbix-postgres
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: zabbix-postgres
|
||||
spec:
|
||||
containers:
|
||||
- name: postgres
|
||||
image: postgres:16-alpine
|
||||
ports:
|
||||
- containerPort: 5432
|
||||
name: postgres
|
||||
env:
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-credentials
|
||||
key: DB-User
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-credentials
|
||||
key: DB-Password
|
||||
- name: POSTGRES_DB
|
||||
value: zabbix
|
||||
volumeMounts:
|
||||
- name: zabbix-postgres-data
|
||||
mountPath: /var/lib/postgresql/data
|
||||
subPath: pgdata
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- zabbix
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pg_isready
|
||||
- -U
|
||||
- zabbix
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: zabbix-postgres-data
|
||||
spec:
|
||||
accessModes: [ReadWriteOnce]
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-postgres
|
||||
namespace: zabbix
|
||||
spec:
|
||||
selector:
|
||||
app: zabbix-postgres
|
||||
ports:
|
||||
- port: 5432
|
||||
targetPort: 5432
|
||||
name: postgres
|
||||
clusterIP: None
|
||||
---
|
||||
# Zabbix Server
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: zabbix-server
|
||||
namespace: zabbix
|
||||
labels:
|
||||
app: zabbix-server
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: zabbix-server
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: zabbix-server
|
||||
spec:
|
||||
containers:
|
||||
- name: zabbix-server
|
||||
image: zabbix/zabbix-server-pgsql:7.2-alpine-latest
|
||||
ports:
|
||||
- containerPort: 10051
|
||||
name: trapper
|
||||
env:
|
||||
- name: DB_SERVER_HOST
|
||||
value: zabbix-postgres
|
||||
- name: DB_SERVER_PORT
|
||||
value: "5432"
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-credentials
|
||||
key: DB-User
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-credentials
|
||||
key: DB-Password
|
||||
- name: POSTGRES_DB
|
||||
value: zabbix
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 1Gi
|
||||
cpu: "1"
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: 10051
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
tcpSocket:
|
||||
port: 10051
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-server
|
||||
namespace: zabbix
|
||||
spec:
|
||||
selector:
|
||||
app: zabbix-server
|
||||
ports:
|
||||
- port: 10051
|
||||
targetPort: 10051
|
||||
name: trapper
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-trapper
|
||||
namespace: zabbix
|
||||
annotations:
|
||||
metallb.universe.tf/loadBalancerIPs: 10.0.56.203
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
selector:
|
||||
app: zabbix-server
|
||||
ports:
|
||||
- port: 10051
|
||||
targetPort: 10051
|
||||
name: trapper
|
||||
protocol: TCP
|
||||
---
|
||||
# Zabbix Web (nginx + PostgreSQL)
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: zabbix-web
|
||||
namespace: zabbix
|
||||
labels:
|
||||
app: zabbix-web
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: zabbix-web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: zabbix-web
|
||||
spec:
|
||||
containers:
|
||||
- name: zabbix-web
|
||||
image: zabbix/zabbix-web-nginx-pgsql:7.2-alpine-latest
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
name: http
|
||||
env:
|
||||
- name: ZBX_SERVER_HOST
|
||||
value: zabbix-server
|
||||
- name: ZBX_SERVER_NAME
|
||||
value: "BlueJay NOC"
|
||||
- name: PHP_TZ
|
||||
value: America/Chicago
|
||||
- name: DB_SERVER_HOST
|
||||
value: zabbix-postgres
|
||||
- name: DB_SERVER_PORT
|
||||
value: "5432"
|
||||
- name: POSTGRES_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-credentials
|
||||
key: DB-User
|
||||
- name: POSTGRES_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-credentials
|
||||
key: DB-Password
|
||||
- name: POSTGRES_DB
|
||||
value: zabbix
|
||||
- name: ZBX_ADMIN_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: zabbix-credentials
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 50m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /
|
||||
port: 8080
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: zabbix-web
|
||||
namespace: zabbix
|
||||
spec:
|
||||
selector:
|
||||
app: zabbix-web
|
||||
ports:
|
||||
- port: 8080
|
||||
targetPort: 8080
|
||||
name: http
|
||||
---
|
||||
# TLS Certificate via cert-manager
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: zabbix-tls
|
||||
namespace: zabbix
|
||||
spec:
|
||||
secretName: zabbix-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- zabbix.iamworkin.lan
|
||||
---
|
||||
# Traefik IngressRoute
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: zabbix-web
|
||||
namespace: zabbix
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`zabbix.iamworkin.lan`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: zabbix-web
|
||||
port: 8080
|
||||
tls:
|
||||
secretName: zabbix-tls
|
||||
---
|
||||
# 1Password secret sync — creates zabbix-credentials K8s Secret
|
||||
# Fields: DB-User, DB-Password, username, password, URL
|
||||
apiVersion: onepassword.com/v1
|
||||
kind: OnePasswordItem
|
||||
metadata:
|
||||
name: zabbix-credentials
|
||||
namespace: zabbix
|
||||
spec:
|
||||
itemPath: vaults/IAmWorkin/items/Zabbix Admin
|
||||
|
||||
Reference in New Issue
Block a user