Compare commits

..

1 commit

27 changed files with 11 additions and 824 deletions

View file

@ -1,18 +0,0 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app fortigate-s3
namespace: ${TENANT_NAMESPACE}
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
path: ./firewall-s3
prune: true
sourceRef:
kind: GitRepository
name: tenant-repos
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m

View file

@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: fortigate-lb-test
namespace: ${TENANT_NAMESPACE}
labels:
app.kubernetes.io/component: fortigate-lb
spec:
type: LoadBalancer
externalTrafficPolicy: Local
ports:
- port: 4500
name: ipsec-nat
targetPort: 4500
protocol: UDP
- port: 500
name: key-management
targetPort: 500
protocol: UDP
#- port: 22
# name: ssh
# targetPort: 22
# protocol: TCP
- port: 443
name: https
targetPort: 443
protocol: TCP
selector:
kubevirt.io/domain: fortigate-ksd

View file

@ -1,20 +0,0 @@
# apiVersion: "k8s.cni.cncf.io/v1"
# kind: NetworkAttachmentDefinition
# metadata:
# name: lan-net
# namespace: ${TENANT_NAMESPACE}
# spec:
# config: '{
# "cniVersion": "0.3.1",
# "type": "bridge",
# "bridge": "br-lan",
# "ipam": {
# "type": "static",
# "addresses": [
# {
# "address": "172.168.100.2/24",
# "gateway": "172.168.100.1"
# }
# ]
# }
# }'

View file

@ -1,20 +0,0 @@
# apiVersion: "k8s.cni.cncf.io/v1"
# kind: NetworkAttachmentDefinition
# metadata:
# name: mgmt-net
# namespace: ${TENANT_NAMESPACE}
# spec:
# config: '{
# "cniVersion": "0.3.1",
# "type": "bridge",
# "bridge": "br-mgmt",
# "ipam": {
# "type": "static",
# "addresses": [
# {
# "address": "192.168.10.100/24",
# "gateway": "192.168.10.1"
# }
# ]
# }
# }'

View file

@ -1,77 +0,0 @@
# apiVersion: kubevirt.io/v1
# kind: VirtualMachine
# metadata:
# name: fortigate-ksd
# namespace: ${TENANT_NAMESPACE}
# spec:
# dataVolumeTemplates:
# - metadata:
# name: fortigate-rootdisk-ksd
# spec:
# source:
# http:
# url: "https://glacier-1.kvant.cloud/ocp-virt-images/sources/fortios_7_6_3.qcow2"
# #secretRef: s3-virt-credentials
# storage:
# resources:
# requests:
# storage: 30Gi
# runStrategy: Always
# template:
# metadata:
# labels:
# kubevirt.io/domain: fortigate-ksd
# spec:
# domain:
# cpu:
# cores: 1
# memory:
# guest: 2Gi
# features:
# acpi: {}
# smm:
# enabled: true
# firmware:
# bootloader:
# efi:
# secureBoot: false
# devices:
# rng: {}
# networkInterfaceMultiqueue: true
# interfaces:
# - name: wan
# masquerade: {}
# ports:
# - port: 4500
# - port: 443
# - port: 22
# - port: 500
# - name: mgmt
# bridge: {}
# - name: lan
# bridge: {}
# disks:
# - disk:
# bus: sata
# name: rootdisk
# resources:
# requests:
# memory: 2Gi
# cpu: 1
# limits:
# memory: 2Gi
# cpu: 1
# networks:
# - name: wan
# pod: {}
# - name: mgmt
# multus:
# networkName: ${TENANT_NAMESPACE}/mgmt-net
# - name: lan
# multus:
# networkName: ${TENANT_NAMESPACE}/lan-net
# terminationGracePeriodSeconds: 180
# volumes:
# - name: rootdisk
# dataVolume:
# name: fortigate-rootdisk-ksd

View file

@ -1,73 +0,0 @@
# apiVersion: kubevirt.io/v1
# kind: VirtualMachine
# metadata:
# name: strongswan
# namespace: ${TENANT_NAMESPACE}
# spec:
# running: true
# template:
# metadata:
# labels:
# kubevirt.io/domain: strongswan
# spec:
# domain:
# cpu:
# cores: 2
# resources:
# requests:
# memory: 2Gi
# cpu: 1
# limits:
# memory: 2Gi
# cpu: 2
# memory:
# guest: 2Gi
# devices:
# rng: {}
# networkInterfaceMultiqueue: true
# disks:
# - name: containerdisk
# disk:
# bus: virtio
# - name: cloudinitdisk
# disk:
# bus: virtio
# interfaces:
# - name: wan
# masquerade: {}
# ports:
# - port: 4500
# - port: 443
# - port: 22
# - port: 500
# - name: mgmt
# bridge: {}
# - name: lan
# bridge: {}
# networks:
# - name: wan
# pod: {}
# - name: mgmt
# multus:
# networkName: ${TENANT_NAMESPACE}/mgmt-net
# - name: lan
# multus:
# networkName: ${TENANT_NAMESPACE}/lan-net
# terminationGracePeriodSeconds: 180
# volumes:
# - name: containerdisk
# containerDisk:
# image: quay.io/containerdisks/ubuntu:22.04
# - name: cloudinitdisk
# cloudInitNoCloud:
# userData: |
# #cloud-config
# users:
# - name: testuser
# groups: [sudo]
# sudo: "ALL=(ALL) NOPASSWD:ALL"
# lock_passwd: false
# passwd: "$6$oMZf5uou7t0.oAJ1$825Te06yt7JZwHSSj4MGQMjpd87LflANQpajCwIVPASkKZdOJo4L2bAEDDuK.jtu.fsRNc9bZAsYefmoqdN8O1"
# chpasswd:
# expire: false
# ssh_pwauth: true

View file

@ -1,30 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: fortigate-lb
namespace: ${TENANT_NAMESPACE}
labels:
app.kubernetes.io/component: fortigate-lb
spec:
type: LoadBalancer
externalTrafficPolicy: Local
ports:
- port: 4500
name: ipsec-nat
targetPort: 4500
protocol: UDP
- port: 500
name: key-management
targetPort: 500
protocol: UDP
#- port: 22
# name: ssh
# targetPort: 22
# protocol: TCP
- port: 443
name: https
targetPort: 443
protocol: TCP
selector:
kubevirt.io/domain: fortigate-ksd

View file

@ -1,20 +0,0 @@
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
name: lan-net
namespace: ${TENANT_NAMESPACE}
spec:
config: '{
"cniVersion": "0.3.1",
"type": "bridge",
"bridge": "br-lan",
"ipam": {
"type": "static",
"addresses": [
{
"address": "172.168.100.2/24",
"gateway": "172.168.100.1"
}
]
}
}'

View file

@ -1,20 +0,0 @@
apiVersion: "k8s.cni.cncf.io/v1"
kind: NetworkAttachmentDefinition
metadata:
name: mgmt-net
namespace: ${TENANT_NAMESPACE}
spec:
config: '{
"cniVersion": "0.3.1",
"type": "bridge",
"bridge": "br-mgmt",
"ipam": {
"type": "static",
"addresses": [
{
"address": "192.168.10.100/24",
"gateway": "192.168.10.1"
}
]
}
}'

View file

@ -1,77 +0,0 @@
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
name: fortigate-ksd
namespace: ${TENANT_NAMESPACE}
spec:
dataVolumeTemplates:
- metadata:
name: fortigate-rootdisk-ksd
spec:
source:
http:
url: "https://glacier-1.kvant.cloud/ocp-virt-images/sources/fortios_7_6_3.qcow2"
#secretRef: s3-virt-credentials
storage:
resources:
requests:
storage: 30Gi
runStrategy: Always
template:
metadata:
labels:
kubevirt.io/domain: fortigate-ksd
spec:
domain:
cpu:
cores: 1
memory:
guest: 2Gi
features:
acpi: {}
smm:
enabled: true
firmware:
bootloader:
efi:
secureBoot: false
devices:
rng: {}
networkInterfaceMultiqueue: true
interfaces:
- name: wan
masquerade: {}
ports:
- port: 4500
- port: 443
- port: 22
- port: 500
- name: mgmt
bridge: {}
- name: lan
bridge: {}
disks:
- disk:
bus: sata
name: rootdisk
resources:
requests:
memory: 2Gi
cpu: 1
limits:
memory: 2Gi
cpu: 1
networks:
- name: wan
pod: {}
- name: mgmt
multus:
networkName: ${TENANT_NAMESPACE}/mgmt-net
- name: lan
multus:
networkName: ${TENANT_NAMESPACE}/lan-net
terminationGracePeriodSeconds: 180
volumes:
- name: rootdisk
dataVolume:
name: fortigate-rootdisk-ksd

View file

@ -1,73 +0,0 @@
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
name: strongswan
namespace: ${TENANT_NAMESPACE}
spec:
running: true
template:
metadata:
labels:
kubevirt.io/domain: strongswan
spec:
domain:
cpu:
cores: 2
resources:
requests:
memory: 2Gi
cpu: 1
limits:
memory: 2Gi
cpu: 2
memory:
guest: 2Gi
devices:
rng: {}
networkInterfaceMultiqueue: true
disks:
- name: containerdisk
disk:
bus: virtio
- name: cloudinitdisk
disk:
bus: virtio
interfaces:
- name: wan
masquerade: {}
ports:
- port: 4500
- port: 443
- port: 22
- port: 500
- name: mgmt
bridge: {}
- name: lan
bridge: {}
networks:
- name: wan
pod: {}
- name: mgmt
multus:
networkName: ${TENANT_NAMESPACE}/mgmt-net
- name: lan
multus:
networkName: ${TENANT_NAMESPACE}/lan-net
terminationGracePeriodSeconds: 180
volumes:
- name: containerdisk
containerDisk:
image: quay.io/containerdisks/ubuntu:24.04
- name: cloudinitdisk
cloudInitNoCloud:
userData: |
#cloud-config
users:
- name: testuser
groups: [sudo]
sudo: "ALL=(ALL) NOPASSWD:ALL"
lock_passwd: false
passwd: "$6$oMZf5uou7t0.oAJ1$825Te06yt7JZwHSSj4MGQMjpd87LflANQpajCwIVPASkKZdOJo4L2bAEDDuK.jtu.fsRNc9bZAsYefmoqdN8O1"
chpasswd:
expire: false
ssh_pwauth: true

View file

@ -3,14 +3,6 @@ kind: Kustomization
resources: resources:
- vars/ks.yaml - vars/ks.yaml
- repos/ks.yaml - repos/ks.yaml
- network/ks-lb.yaml
- firewall/ks-vm.yaml
- firewall-dev/ks-vm.yaml
- firewall-s3/ks-vm.yaml
- windows-vm-standard/ks-vm.yaml
- windows-vm-standard/ks-pvc.yaml
- windows-vm-standard-dev/ks-vm.yaml
- windows-vm-standard-dev/ks-pvc.yaml
- ubuntu-vm-1/ks.yaml - ubuntu-vm-1/ks.yaml
- ubuntu-vm-2/ks.yaml - ubuntu-vm-2/ks.yaml
- container/ks-debug.yaml - container/ks-debug.yaml

View file

@ -1,18 +0,0 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app lb
namespace: ${TENANT_NAMESPACE}
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
path: ./network/loadbalancers
prune: true
sourceRef:
kind: GitRepository
name: tenant-repos
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m

View file

@ -1,29 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: fortigate-lb
namespace: ${TENANT_NAMESPACE}
labels:
app.kubernetes.io/component: fortigate-lb
spec:
type: LoadBalancer
ports:
- port: 4500
name: ipsec-nat
targetPort: 4500
protocol: UDP
- port: 500
name: key-management
targetPort: 500
protocol: UDP
- port: 22
name: ssh
targetPort: 22
protocol: TCP
- port: 443
name: https
targetPort: 443
protocol: TCP
selector:
kubevirt.io/domain: fortigate-s3

View file

@ -1,29 +0,0 @@
---
apiVersion: v1
kind: Service
metadata:
name: windows-lb
namespace: ${TENANT_NAMESPACE}
labels:
app.kubernetes.io/component: windows-lb
spec:
type: LoadBalancer
ports:
- port: 8080
name: http
targetPort: 8080
protocol: TCP
- port: 443
name: https
targetPort: 443
protocol: TCP
- port: 65022
name: ssh
targetPort: 22
protocol: TCP
- port: 3389
name: rdp
targetPort: 3389
protocol: TCP
selector:
kubevirt.io/domain: windows-vm-standard

View file

@ -17,10 +17,11 @@ spec:
values: values:
service: service:
type: ClusterIP type: ClusterIP
ports:
http: 8080
ingress: ingress:
enabled: true enabled: true
hostname: nginx.${TENANT_DOMAIN} hostname: nginx.${TENANT_DOMAIN}.apps.ai-2.kvant.cloud
ingressClassName: external
extraVolumes: extraVolumes:
- name: ${TENANT_NAMESPACE}-image-storage - name: ${TENANT_NAMESPACE}-image-storage
persistentVolumeClaim: persistentVolumeClaim:

View file

@ -77,7 +77,7 @@ objects:
spec: spec:
source: source:
http: http:
url: http://nginx.demo.svc.cluster.local:8080/windows-server-2022-uefi-ns.qcow2 url: http://nginx.demo.svc.cluster.local:8080/win2022.qcow2
pvc: pvc:
accessModes: accessModes:
- ReadWriteOnce - ReadWriteOnce

View file

@ -38,13 +38,11 @@ spec:
cloudInitNoCloud: cloudInitNoCloud:
userData: | userData: |
#cloud-config #cloud-config
hostname: ubuntu-vm-1
ssh_pwauth: True
users: users:
- name: testuser - name: ubuntu
groups: [sudo] ssh-authorized-keys:
sudo: "ALL=(ALL) NOPASSWD:ALL" - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPqlhZW/pPLK8zENt3o6tgl0QVinhGAF1sHvajqq3UvI ubuntu
lock_passwd: false sudo: ['ALL=(ALL) NOPASSWD:ALL']
passwd: "$6$oMZf5uou7t0.oAJ1$825Te06yt7JZwHSSj4MGQMjpd87LflANQpajCwIVPASkKZdOJo4L2bAEDDuK.jtu.fsRNc9bZAsYefmoqdN8O1" shell: /bin/bash
chpasswd:
expire: false
ssh_pwauth: true

View file

@ -1,9 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: s3-virt-credentials
namespace: ${TENANT_NAMESPACE}
type: Opaque
data:
accessKeyId: WWozQTdUdHgzbjNOa3NsS2VodzM=
secretKey: SUZJRWtSbnJnWDRPcnlNWmtSSjlheG41UlpnSTZhMjBvVW82Tm1lRA==

View file

@ -1,18 +0,0 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app windows-pvc-dev
namespace: ${TENANT_NAMESPACE}
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
path: ./windows-vm-standard-dev/pvc
prune: true
sourceRef:
kind: GitRepository
name: tenant-repos
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m

View file

@ -1,18 +0,0 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app windows-vm-standard-dev
namespace: ${TENANT_NAMESPACE}
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
path: ./windows-vm-standard-dev/vm
prune: true
sourceRef:
kind: GitRepository
name: tenant-repos
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m

View file

@ -1,12 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: windows-vm-datadisk-dev
spec:
storageClassName: ibm-spectrum-scale-fileset
volumeMode: Filesystem
accessModes:
- ReadWriteMany
resources:
requests:
storage: 200Gi

View file

@ -1,83 +0,0 @@
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
name: windows-vm-standard-dev
namespace: ${TENANT_NAMESPACE}
spec:
dataVolumeTemplates:
- metadata:
name: windows-rootdisk-dev
spec:
source:
http:
url: http://nginx.demo.svc.cluster.local:8080/windows-server-2022-uefi-ns.qcow2
storage:
resources:
requests:
storage: 80Gi
sourceRef:
kind: DataSource
name: win2k22
namespace: kubevirt-os-images
runStrategy: Always
template:
metadata:
labels:
kubevirt.io/domain: windows-vm-standard-dev
spec:
domain:
cpu:
cores: 4
memory:
guest: 8Gi
features:
acpi: {}
smm:
enabled: true
firmware:
bootloader:
efi:
secureBoot: true
devices:
rng: {}
networkInterfaceMultiqueue: true
interfaces:
- name: default
masquerade: {}
ports:
- port: 8080
- port: 443
- port: 22
- port: 3389
disks:
- disk:
bus: sata
name: rootdisk-dev
- disk:
bus: sata
name: datadisk-dev
# - disk:
# bus: scsi
# name: cloudinitdisk
resources:
requests:
memory: 8Gi
cpu: 4
limits:
memory: 8Gi
cpu: 4
networks:
- name: default
pod: {}
terminationGracePeriodSeconds: 180
volumes:
- name: rootdisk-dev
dataVolume:
name: windows-rootdisk-dev
- name: datadisk-dev
persistentVolumeClaim:
claimName: windows-vm-datadisk-dev
#- name: cloudinitdisk
# cloudInitNoCloud:
# secretRef:
# name: windows-cloud-init

View file

@ -1,18 +0,0 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app windows-pvc
namespace: ${TENANT_NAMESPACE}
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
path: ./windows-vm-standard/pvc
prune: true
sourceRef:
kind: GitRepository
name: tenant-repos
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m

View file

@ -1,18 +0,0 @@
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: &app windows-vm-standard
namespace: ${TENANT_NAMESPACE}
spec:
commonMetadata:
labels:
app.kubernetes.io/name: *app
path: ./windows-vm-standard/vm
prune: true
sourceRef:
kind: GitRepository
name: tenant-repos
wait: false
interval: 30m
retryInterval: 1m
timeout: 5m

View file

@ -1,12 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: windows-vm-datadisk
spec:
storageClassName: ibm-spectrum-scale-fileset
volumeMode: Filesystem
accessModes:
- ReadWriteMany
resources:
requests:
storage: 200Gi

View file

@ -1,82 +0,0 @@
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
name: windows-vm-standard
namespace: ${TENANT_NAMESPACE}
spec:
dataVolumeTemplates:
- metadata:
name: windows-rootdisk
spec:
source:
http:
url: http://nginx.demo.svc.cluster.local:8080/windows-server-2022-uefi-ns.qcow2
storage:
resources:
requests:
storage: 80Gi
sourceRef:
kind: DataSource
name: win2k22
namespace: kubevirt-os-images
runStrategy: Always
template:
metadata:
labels:
kubevirt.io/domain: windows-vm-standard
spec:
domain:
cpu:
cores: 4
memory:
guest: 8Gi
features:
acpi: {}
smm:
enabled: true
firmware:
bootloader:
efi: {}
devices:
rng: {}
networkInterfaceMultiqueue: true
interfaces:
- name: default
masquerade: {}
ports:
- port: 8080
- port: 443
- port: 22
- port: 3389
disks:
- disk:
bus: sata
name: rootdisk
- disk:
bus: sata
name: datadisk
# - disk:
# bus: scsi
# name: cloudinitdisk
resources:
requests:
memory: 8Gi
cpu: 4
limits:
memory: 8Gi
cpu: 4
networks:
- name: default
pod: {}
terminationGracePeriodSeconds: 180
volumes:
- name: rootdisk
dataVolume:
name: windows-rootdisk
- name: datadisk
persistentVolumeClaim:
claimName: windows-vm-datadisk
#- name: cloudinitdisk
# cloudInitNoCloud:
# secretRef:
# name: windows-cloud-init