feat(snapshot-controller): setup in kube-nas

[tyriis]

No description provided.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[tyriis-automation]

--- kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/snapshot-controller

+++ kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/snapshot-controller

@@ -0,0 +1,29 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: flux-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+    substitution.flux.home.arpa/enabled: 'true'
+  name: snapshot-controller
+  namespace: flux-system
+spec:
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  interval: 10m
+  path: ./kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-ops
+  wait: true
+
--- kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: kube-system/snapshot-controller

+++ kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: kube-system/snapshot-controller

@@ -0,0 +1,35 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: snapshot-controller
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: snapshot-controller
+  namespace: kube-system
+spec:
+  chart:
+    spec:
+      chart: snapshot-controller
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus-charts
+        namespace: flux-system
+      version: 4.0.0
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  interval: 30m
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controller:
+      replicaCount: 1
+      serviceMonitor:
+        create: faLse
+

[tyriis-automation]

--- HelmRelease: kube-system/snapshot-controller ServiceAccount: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ServiceAccount: kube-system/snapshot-controller

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+
--- HelmRelease: kube-system/snapshot-controller ClusterRole: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ClusterRole: kube-system/snapshot-controller

@@ -0,0 +1,122 @@

+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - list
+  - watch
+  - create
+  - update
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotcontents
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - delete
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotcontents/status
+  verbs:
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots/status
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - delete
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents/status
+  verbs:
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshots
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshots/status
+  verbs:
+  - update
+  - patch
+
--- HelmRelease: kube-system/snapshot-controller ClusterRoleBinding: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ClusterRoleBinding: kube-system/snapshot-controller

@@ -0,0 +1,14 @@

+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+subjects:
+- kind: ServiceAccount
+  name: snapshot-controller
+  namespace: kube-system
+roleRef:
+  kind: ClusterRole
+  name: snapshot-controller
+  apiGroup: rbac.authorization.k8s.io
+
--- HelmRelease: kube-system/snapshot-controller Role: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller Role: kube-system/snapshot-controller

@@ -0,0 +1,18 @@

+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - watch
+  - list
+  - delete
+  - update
+  - create
+
--- HelmRelease: kube-system/snapshot-controller RoleBinding: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller RoleBinding: kube-system/snapshot-controller

@@ -0,0 +1,13 @@

+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+subjects:
+- kind: ServiceAccount
+  name: snapshot-controller
+roleRef:
+  kind: Role
+  name: snapshot-controller
+  apiGroup: rbac.authorization.k8s.io
+
--- HelmRelease: kube-system/snapshot-controller Service: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller Service: kube-system/snapshot-controller

@@ -0,0 +1,19 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+spec:
+  clusterIP: None
+  ports:
+  - port: 8080
+    targetPort: 8080
+    name: http
+  selector:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+
--- HelmRelease: kube-system/snapshot-controller Deployment: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller Deployment: kube-system/snapshot-controller

@@ -0,0 +1,62 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snapshot-controller
+      app.kubernetes.io/instance: snapshot-controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: snapshot-controller
+        app.kubernetes.io/instance: snapshot-controller
+    spec:
+      serviceAccountName: snapshot-controller
+      securityContext: {}
+      containers:
+      - name: snapshot-controller
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1000
+        image: registry.k8s.io/sig-storage/snapshot-controller:v8.2.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - --http-endpoint=:8080
+        - --leader-election=true
+        - --leader-election-namespace=$(NAMESPACE)
+        ports:
+        - name: http
+          containerPort: 8080
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            port: http
+            path: /healthz/leader-election
+            scheme: HTTP
+        livenessProbe:
+          httpGet:
+            port: http
+            path: /healthz/leader-election
+            scheme: HTTP
+        env:
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        resources: {}
+      hostNetwork: false
+      dnsPolicy: ClusterFirst
+
--- HelmRelease: kube-system/snapshot-controller ServiceMonitor: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ServiceMonitor: kube-system/snapshot-controller

@@ -0,0 +1,18 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snapshot-controller
+      app.kubernetes.io/instance: snapshot-controller
+  endpoints:
+  - port: http
+    path: /metrics
+