whyredfire/gitops
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: whyredfire/gitops:ebb0c6bd399f771498b4e444311bfc0101110f6d
Branches Tags
whyredfire/gitops:main whyredfire/gitops:feat/sync-waves
...
compare: whyredfire/gitops:7467e34b4ca8060814df241d1483da579f33e639
Branches Tags
whyredfire/gitops:main whyredfire/gitops:feat/sync-waves
3 Commits
ebb0c6bd39 ... 7467e34b4c
Author SHA1 Message Date
whyredfire 7467e34b4c chore(apps): Add network policies to standalone apps 2026-10-28 15:12:22 +05:30
whyredfire 6e1f53ed3f chore: Set resource requests and limits on every workload 2026-10-28 14:53:44 +05:30
whyredfire 9888eb99fb chore(monitoring): Raise Grafana memory limit to 768Mi 2026-10-28 14:49:37 +05:30
23 changed files with 383 additions and 1 deletions
Expand all files Collapse all files
add-ons/postgres/cluster.yaml
+1
View File
@@ -40,6 +40,7 @@ spec:
- host all all all reject
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 100m
apps/bentopdf/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- deployment.yaml
- service.yaml
- httproute.yaml
- networkpolicy.yaml
apps/bentopdf/networkpolicy.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: bentopdf
namespace: bentopdf
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: bentopdf
policyTypes:
- Ingress
- Egress
apps/garage-ui/kustomization.yaml
+1
View File
@@ -4,3 +4,4 @@ resources:
- sealed-secret.yaml
- middleware.yaml
- httproute.yaml
- networkpolicy.yaml
apps/garage-ui/networkpolicy.yaml
+40
View File
@@ -0,0 +1,40 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: garage-ui
namespace: garage
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- ports:
- port: 3903
protocol: TCP
to:
- podSelector:
matchLabels:
app.kubernetes.io/name: garage
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: garage-ui
policyTypes:
- Ingress
- Egress
apps/qbit/deployment.yaml
+14
View File
@@ -38,6 +38,13 @@ spec:
ports:
- containerPort: 8080
name: http
resources:
limits:
cpu: 1000m
memory: 2Gi
requests:
cpu: 50m
memory: 128Mi
volumeMounts:
- mountPath: /config
name: config
@@ -104,6 +111,13 @@ spec:
periodSeconds: 30
timeoutSeconds: 10
name: gluetun
resources:
limits:
cpu: 500m
memory: 256Mi
requests:
cpu: 10m
memory: 96Mi
restartPolicy: Always
securityContext:
capabilities:
apps/qbit/kustomization.yaml
+1
View File
@@ -7,3 +7,4 @@ resources:
- service.yaml
- middleware.yaml
- httproute.yaml
- networkpolicy.yaml
apps/qbit/networkpolicy.yaml
+28
View File
@@ -0,0 +1,28 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: qbittorrent
namespace: qbit
spec:
egress:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 8080
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: qbittorrent
policyTypes:
- Ingress
- Egress
apps/rustbin/kustomization.yaml
+1
View File
@@ -5,3 +5,4 @@ resources:
- deployment.yaml
- service.yaml
- httproute.yaml
- networkpolicy.yaml
apps/rustbin/networkpolicy.yaml
+21
View File
@@ -0,0 +1,21 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: rustbin
namespace: rustbin
spec:
egress: []
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 3000
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: rustbin
policyTypes:
- Ingress
- Egress
apps/wireguard/deployment.yaml
+7
View File
@@ -71,6 +71,13 @@ spec:
protocol: UDP
- containerPort: 51821
name: http
resources:
limits:
cpu: 500m
memory: 512Mi
requests:
cpu: 10m
memory: 192Mi
securityContext:
capabilities:
add:
apps/wireguard/kustomization.yaml
+1
View File
@@ -7,3 +7,4 @@ resources:
- service.yaml
- service-admin.yaml
- httproute.yaml
- networkpolicy.yaml
apps/wireguard/networkpolicy.yaml
+48
View File
@@ -0,0 +1,48 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: wireguard
namespace: wireguard
spec:
egress:
- ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
podSelector:
matchLabels:
k8s-app: kube-dns
- to:
- ipBlock:
cidr: 192.168.2.0/24
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ingress:
- from:
- ipBlock:
cidr: 0.0.0.0/0
ports:
- port: 27299
protocol: UDP
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
ports:
- port: 51821
protocol: TCP
podSelector:
matchLabels:
app.kubernetes.io/name: wireguard
policyTypes:
- Ingress
- Egress
argocd-apps/add-ons/authentik.yaml
+2
View File
@@ -39,6 +39,7 @@ spec:
server:
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 100m
@@ -46,6 +47,7 @@ spec:
worker:
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 50m
argocd-apps/add-ons/cert-manager.yaml
+23
View File
@@ -22,6 +22,29 @@ spec:
kind: ControllerConfiguration
featureGates:
ExperimentalGatewayAPISupport: true
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
cainjector:
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
webhook:
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
repoURL: https://charts.jetstack.io
targetRevision: v1.21.2
- path: add-ons/cert-manager
argocd-apps/add-ons/cnpg.yaml
+7
View File
@@ -18,6 +18,13 @@ spec:
replicaCount: 1
config:
clusterWide: true
resources:
limits:
cpu: 500m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
repoURL: https://cloudnative-pg.github.io/charts
targetRevision: 0.29.1
syncPolicy:
argocd-apps/add-ons/kube-prometheus-stack.yaml
+1 -1
View File
@@ -170,7 +170,7 @@ spec:
resources:
limits:
cpu: 500m
memory: 512Mi
memory: 768Mi
requests:
cpu: 50m
memory: 256Mi
argocd-apps/add-ons/sealed-secrets.yaml
+7
View File
@@ -16,6 +16,13 @@ spec:
helm:
values: |
keyrenewperiod: "0"
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
repoURL: https://bitnami.github.io/sealed-secrets
targetRevision: 2.20.0
syncPolicy:
argocd-apps/add-ons/traefik.yaml
+7
View File
@@ -61,6 +61,13 @@ spec:
- kind: Secret
name: wildcard-whyredfire-dpdns-org
group: ""
resources:
limits:
cpu: 1000m
memory: 256Mi
requests:
cpu: 50m
memory: 64Mi
repoURL: https://traefik.github.io/charts
targetRevision: 41.7.1
- path: add-ons/traefik
argocd-apps/apps/garage.yaml
+1
View File
@@ -78,6 +78,7 @@ spec:
cpu: 100m
memory: 256Mi
limits:
cpu: 1000m
memory: 1Gi
- path: apps/garage
repoURL: https://gitea.whyredfire.dev/whyredfire/gitops.git
argocd-apps/apps/jellyfin.yaml
+29
View File
@@ -30,6 +30,35 @@ spec:
enabled: true
type: hostPath
hostPath: /srv/media
# Metadata, artwork, and subtitles come from the internet; the
# cluster and the LAN stay off limits
networkPolicy:
enabled: true
ingress:
allowExternal: false
namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: traefik
egress:
allowAllEgress: false
restrictedEgress:
allowMetadata: false
allowInCluster: false
customRules:
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
resources:
limits:
cpu: 3000m
memory: 2Gi
requests:
cpu: 50m
memory: 512Mi
repoURL: https://jellyfin.github.io/jellyfin-helm
targetRevision: 3.2.0
- path: apps/jellyfin
bootstrap/argocd-resources-patch.yaml
+120
View File
@@ -0,0 +1,120 @@
# Sized from about five days of usage: requests near the average, limits
# with headroom over the peak
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: argocd-application-controller
spec:
template:
spec:
containers:
- name: argocd-application-controller
resources:
limits:
cpu: 1000m
memory: 1Gi
requests:
cpu: 50m
memory: 384Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: argocd-applicationset-controller
spec:
template:
spec:
containers:
- name: argocd-applicationset-controller
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: argocd-dex-server
spec:
template:
spec:
containers:
- name: dex
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: argocd-notifications-controller
spec:
template:
spec:
containers:
- name: argocd-notifications-controller
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 10m
memory: 32Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: argocd-redis
spec:
template:
spec:
containers:
- name: redis
resources:
limits:
cpu: 200m
memory: 128Mi
requests:
cpu: 10m
memory: 16Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: argocd-repo-server
spec:
template:
spec:
containers:
- name: argocd-repo-server
resources:
limits:
cpu: 1000m
memory: 512Mi
requests:
cpu: 10m
memory: 128Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: argocd-server
spec:
template:
spec:
containers:
- name: argocd-server
resources:
limits:
cpu: 500m
memory: 256Mi
requests:
cpu: 10m
memory: 64Mi
bootstrap/kustomization.yaml
+1
View File
@@ -37,3 +37,4 @@ patches:
kind: ConfigMap
name: argocd-cmd-params-cm
path: argocd-cmd-params-cm-server-insecure-patch.yaml
- path: argocd-resources-patch.yaml