forked from linode/apl-core
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcore.yaml
416 lines (414 loc) · 10.6 KB
/
core.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
# NOTE: This file is merged with other values in ./helmfile.d/snippets/env.gotmpl
k8s:
namespaces:
- name: argocd
app: argocd
- name: cert-manager
disableIstioInjection: true
- name: cnpg-system
app: cloudnative-pg
disableIstioInjection: true
disablePolicyChecks: true
- name: default
disableIstioInjection: true
disablePolicyChecks: true
- name: drone
- name: drone-pipelines
disableIstioInjection: true
disablePolicyChecks: true
- name: external-dns
disableIstioInjection: true
- name: external-secrets
disableIstioInjection: true
- name: falco
disableIstioInjection: true
disablePolicyChecks: true
- name: harbor
app: harbor
- name: gatekeeper-system
app: gatekeeper
disableIstioInjection: true
- name: gitea
- name: grafana
app: grafana
- name: istio-system
disableIstioInjection: true
- name: istio-operator
istio-operator-managed: Reconcile
istio-injection: disabled
- name: httpbin
app: httpbin
- name: ingress
# disabling istio sidecar as it does not preserve client ip (yet)
# TODO: enable once it does
disableIstioInjection: true
- name: jaeger
app: jaeger
- name: jaeger-operator
app: jaeger
disableIstioInjection: true
- name: keycloak
- name: kiali
app: kiali
- name: kiali-operator
app: kiali
disableIstioInjection: true
- name: knative-serving
app: knative
disablePolicyChecks: true
disableIstioInjection: true
- name: kubeapps
app: kubeapps
disableIstioInjection: true
disablePolicyChecks: true
- name: kured
app: kured
disableIstioInjection: true
- name: kubeclarity
app: kubeclarity
disableIstioInjection: true
- name: tekton
app: tekton
disableIstioInjection: true
disablePolicyChecks: true
- name: maintenance
disableIstioInjection: true
- name: minio
app: minio
disableIstioInjection: true
disablePolicyChecks: true
- name: monitoring
disableIstioInjection: true
- name: olm
disableIstioInjection: true
disablePolicyChecks: true
- name: opa-exporter
disableIstioInjection: true
disablePolicyChecks: true
- name: operators
disableIstioInjection: true
disablePolicyChecks: true
- name: opencost
disableIstioInjection: true
disablePolicyChecks: true
- name: otomi
- name: cluster-overprovisioner
app: cluster-overprovisioner
disableIstioInjection: true
- name: redis
app: prometheus
disableIstioInjection: true
- name: team-admin
- name: tigera-operator
disableIstioInjection: true
disablePolicyChecks: true
- name: trivy-operator
app: trivy
disableIstioInjection: true
disablePolicyChecks: true
- name: vault
app: vault
- name: velero
app: velero
adminApps:
- name: alertmanager
tags: [alerting, observability]
deps: [prometheus]
ingress:
- svc: po-alertmanager
namespace: monitoring
# namespace: alertmanager
port: 9093
type: public
auth: true
- name: argocd
tags: [cicd, gitops]
isShared: true
ownHost: true
ingress:
- svc: argocd-server
namespace: argocd
type: public
auth: true
# removeRequestHeaders:
# - authorization
- name: cert-manager
tags: [ingress, security, tls]
- name: drone
tags: [cicd, deployment, pipeline]
isShared: true
ownHost: true
ingress:
- svc: drone
namespace: drone
type: public
auth: true
removeRequestHeaders:
- authorization
- svc: drone
namespace: drone
type: public
paths: [/hook, /api/user, /api/repo]
forwardPath: true
removeRequestHeaders:
- authorization
- name: external-dns
tags: [ingress, security, tls]
- name: external-secrets
tags: [secrets, security, tls]
- name: falco
tags: [security]
deps: [prometheus]
isShared: true
ownHost: true
ingress:
- namespace: falco
svc: falco-falcosidekick-ui
port: 2802
type: public
auth: true
- name: gatekeeper
tags: [security, policies, observability]
- name: gitea
tags: [git]
isShared: true
ownHost: true
ingress:
- namespace: gitea
svc: gitea-http
port: 3000
type: public
- name: grafana
tags: [tracing, telemetry, observability]
deps: [prometheus]
ownHost: true
ingress:
- svc: po-grafana
namespace: grafana
removeRequestHeaders:
- authorization
type: public
auth: true
shortcuts:
- title: NGINX
description: NGINX ingress controller metrics
path: /d/nginx/nginx-ingress-controller?orgId=1&refresh=5s
- name: harbor
tags: [security]
isShared: true
ownHost: true
ingress:
- svc: harbor-portal
namespace: harbor
type: public
auth: true
- svc: harbor-core
namespace: harbor
paths: [/api/, /c/]
forwardPath: true
type: public
auth: true
- svc: harbor-core
namespace: harbor
paths: [/chartrepo/, /service/, /v1/, /v2/]
forwardPath: true
type: public
- name: hello
hide: true
tags: [demo]
- name: httpbin
tags: [dev, testing, debugging]
isShared: true
ownHost: true
ingress:
- namespace: httpbin
svc: httpbin
type: public
auth: true
- name: ingress-nginx
tags: [ingress, auth]
- name: istio
tags: [ingress, egress, routing, security, tls, observability, policies]
- name: jaeger
tags: [ingress, telemetry, observability]
deps: [istio]
isShared: true
ingress:
- svc: jaeger-operator-jaeger-query
port: 16686
forwardPath: true
namespace: jaeger
type: public
auth: true
- name: keycloak
tags: [auth, sso]
# isShared: true
ownHost: true
ingress:
- namespace: keycloak
svc: keycloak-http
type: public
shortcuts:
- title: Account
description: Edit your account settings.
path: /realms/otomi/account/
- name: kiali
tags: [tracing, telemetry, observability]
deps: [istio, prometheus]
path: /api/auth/openid_redirect
ingress:
- svc: kiali
forwardPath: true
removeRequestHeaders:
- authorization
port: 20001
namespace: kiali
type: public
auth: true
- name: knative
tags: [serverless, functions]
deps: [istio]
- name: kubeapps
tags: [dev, apps]
deps: [operator-lifecycle-manager]
isShared: true
ownHost: true
ingress:
- svc: kubeapps
namespace: kubeapps
type: public
# auth: true
- name: kubeclarity
tags: [security]
ownHost: true
isShared: true
ingress:
- svc: kubeclarity
namespace: kubeclarity
port: 8080
type: public
auth: true
- name: kured
tags: [security]
- name: tekton
tags: [buildpacks]
- name: loki
tags: [logging, telemetry, observability]
deps: [grafana, prometheus, minio]
useHost: grafana
path: /explore?orgId=1&left=%5B"now-1h","now","Loki",%7B%7D,%7B"mode":"Logs"%7D,%7B"ui":%5Btrue,true,true,"none"%5D%7D%5D
shortcuts:
- title: Ingress logs
description: All logs generated in the "ingress" namespace
path: /explore?orgId=1&left=%5B"now-1h","now","Loki",%7B"expr":"%7Bnamespace%3D%5C"ingress%5C"%7D","refId":"A"%7D%5D
- title: OWASP violations
description: All OWASP rule violations
path: /explore?orgId=1&left=%5B"now-1h","now","Loki",%7B"expr":"%7Bnamespace%3D%5C"ingress%5C"%7D%20%7C%3D%5C"ModSecurity:%20%5C""%7D%5D
- title: Gatekeeper violations
description: Kube API violations logged by OPA gatekepeer
path: /explore?orgId=1&left=%5B"now-1h","now","Loki",%7B"expr":"%7Bnamespace%3D%5C"gatekeeper-system%5C"%7D%20%7C%3D%5C"Policy:%20%5C""%7D%5D
- name: minio
tags: [storage, backup]
ownHost: true
ingress:
- svc: minio
port: 9001
namespace: minio
type: public
auth: true
removeRequestHeaders:
- authorization
- name: opencost
tags: [finops]
ownHost: true
ingress:
- svc: opencost
port: 9090
namespace: opencost
type: public
auth: true
- name: otomi
hide: true
isShared: true
ownHost: true
ingress:
- svc: otomi-api
namespace: otomi
paths: [/api/]
type: public
auth: true
- svc: otomi-console
namespace: otomi
type: public
auth: true
- name: prometheus
tags: [metrics, observability]
ingress:
- svc: po-prometheus
port: 9090
namespace: monitoring
# namespace: prometheus
type: public
auth: true
- name: thanos
tags: [metrics, observability]
ownHost: true
deps: [prometheus, grafana, minio]
ingress:
- svc: thanos-query-frontend
port: 9090
namespace: monitoring
forwardPath: true
type: public
auth: true
- svc: thanos-receive
port: 19291
namespace: monitoring
paths: [/api/]
forwardPath: true
type: public
- name: trivy
tags: [security]
deps: [prometheus, grafana]
- name: vault
tags: [secrets, security, observability]
deps: [external-secrets]
isShared: true
ownHost: true
path: /ui/vault/auth?redirect_to=%2Fvault%2Fsecrets%2Fsecret%2Flist%2Fteams%2F#NS#%2F&with=oidc
ingress:
- namespace: vault
svc: vault
port: 8200
type: public
auth: true
- name: velero
tags: [backup]
teamApps:
- name: alertmanager
ingress:
- svc: po-alertmanager
hasPrefix: true
port: 9093
type: public
auth: true
- name: grafana
ownHost: true
ingress:
- svc: po-grafana
hasPrefix: true
forwardPath: true
removeRequestHeaders:
- authorization
type: public
auth: true
- name: loki
useHost: grafana
path: /explore?orgId=1&left=%5B%22now-1h%22,%22now%22,%22Loki%22,%7B%22expr%22:%22%7Bnamespace%3D%5C%22#NS#%5C%22%7D%22%7D,%7B%22mode%22:%22Logs%22%7D,%7B%22ui%22:%5Btrue,true,true,%22none%22%5D%7D%5D
- name: prometheus
ingress:
- svc: po-prometheus
hasPrefix: true
port: 9090
type: public
auth: true