1586 lines
45 KiB
YAML
1586 lines
45 KiB
YAML
---
|
|
# Source: self-host/templates/pre-install-secret-keys.yaml
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: bitwarden-self-host-secretkeys
|
|
namespace: bitwarden-helm
|
|
data:
|
|
globalSettings__internalIdentityKey: "TXE5OTIyYmJSNEk2WXJaRk9abFRVV0tiZzRBT1hUWml0VmZOS0huVXd1TTdpNFBrMVJpd3BvdFlhdmUxb0g1Zw=="
|
|
globalSettings__oidcIdentityClientKey: "MENFcHlqQ3BSbVZqb1hibmlscHZkaXNUUXNzN24zWWRaMHI3MGRCZk10ak50blZaY29lREdrMUplU1BDRlJuRQ=="
|
|
globalSettings__duo__aKey: "NFJKMVNvcFhJOGdpd1FSM3d5b0VNQ0V5V21GVjYxZEdDNU4xRDV2UUhudzg1cmJMS0djOWlVWVBUeVhTSlVidA=="
|
|
---
|
|
# Source: self-host/templates/volumes.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
namespace: bitwarden-helm
|
|
name: bitwarden-self-host-dataprotection
|
|
labels:
|
|
app.kubernetes.io/component: dataprotection
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: nfs-storage-intelligent
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
---
|
|
# Source: self-host/templates/volumes.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
namespace: bitwarden-helm
|
|
name: bitwarden-self-host-licenses
|
|
labels:
|
|
app.kubernetes.io/component: licenses
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: nfs-storage-intelligent
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
---
|
|
# Source: self-host/templates/volumes.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
namespace: bitwarden-helm
|
|
name: bitwarden-self-host-attachments
|
|
labels:
|
|
app.kubernetes.io/component: attachments
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: nfs-storage-intelligent
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
---
|
|
# Source: self-host/templates/volumes.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
namespace: bitwarden-helm
|
|
name: bitwarden-self-host-applogs
|
|
labels:
|
|
app.kubernetes.io/component: logs
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: nfs-storage-intelligent
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
|
|
#################
|
|
# MSSQL Volumes #
|
|
#################
|
|
---
|
|
# Source: self-host/templates/volumes.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
namespace: bitwarden-helm
|
|
name: bitwarden-self-host-mssqllog
|
|
labels:
|
|
app.kubernetes.io/component: mssql-log
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: nfs-storage-intelligent
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
# Source: self-host/templates/volumes.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
namespace: bitwarden-helm
|
|
name: bitwarden-self-host-mssqlbackups
|
|
labels:
|
|
app.kubernetes.io/component: mssql-backups
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: nfs-storage-intelligent
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|
|
---
|
|
# Source: self-host/templates/volumes.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
namespace: bitwarden-helm
|
|
name: bitwarden-self-host-mssqldata
|
|
labels:
|
|
app.kubernetes.io/component: mssql-data
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: nfs-storage-intelligent
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
---
|
|
# Source: self-host/templates/admin.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-admin
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: admin
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-admin
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/api.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-api
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: api
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-api
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/attachments.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-attachments
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: attachments
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-attachments
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/events.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-events
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: events
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-events
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/icons.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-icons
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: icons
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-icons
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/identity.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-identity
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: identity
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-identity
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/mssql.yaml
|
|
kind: Service
|
|
apiVersion: v1
|
|
metadata:
|
|
name: bitwarden-self-host-mssql
|
|
labels:
|
|
app.kubernetes.io/component: mssql
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
type: ClusterIP
|
|
ports:
|
|
- name: http-port
|
|
port: 1433
|
|
targetPort: 1433
|
|
selector:
|
|
app: bitwarden-self-host-mssql
|
|
---
|
|
# Source: self-host/templates/notifications.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-notifications
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: notifications
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-notifications
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/sso.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-sso
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: sso
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-sso
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/web.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: bitwarden-self-host-web
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: web
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
selector:
|
|
app: bitwarden-self-host-web
|
|
ports:
|
|
- port: 5000
|
|
targetPort: 5000
|
|
---
|
|
# Source: self-host/templates/admin.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-admin
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app.kubernetes.io/component: admin
|
|
app: bitwarden-self-host-admin
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-admin
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: admin
|
|
app: bitwarden-self-host-admin
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
initContainers:
|
|
- name: create-mount-subdir
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
mkdir -p /logs/admin
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /logs
|
|
containers:
|
|
- name: bitwarden-self-host-admin
|
|
image: "bitwarden/admin:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: dataprotection
|
|
mountPath: /etc/bitwarden/core/aspnet-dataprotection
|
|
- name: licenses
|
|
mountPath: /etc/bitwarden/core/licenses
|
|
- name: applogs
|
|
mountPath: /etc/bitwarden/logs
|
|
subPath: admin
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: dataprotection
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-dataprotection
|
|
- name: licenses
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-licenses
|
|
- name: applogs
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-applogs
|
|
---
|
|
# Source: self-host/templates/api.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-api
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-api
|
|
app.kubernetes.io/component: api
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-api
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-api
|
|
app.kubernetes.io/component: api
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
initContainers:
|
|
- name: create-mount-subdir
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
mkdir -p /logs/api
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /logs
|
|
containers:
|
|
- name: bitwarden-self-host-api
|
|
# image: "bitwarden/api:2024.5.0"
|
|
image: "bitwarden/api:2024.4.2"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
volumeMounts:
|
|
- name: attachments
|
|
mountPath: /etc/bitwarden/core/attachments
|
|
- name: dataprotection
|
|
mountPath: /etc/bitwarden/core/aspnet-dataprotection
|
|
- name: licenses
|
|
mountPath: /etc/bitwarden/core/licenses
|
|
- name: applogs
|
|
mountPath: /etc/bitwarden/logs
|
|
subPath: api
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: dataprotection
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-dataprotection
|
|
- name: attachments
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-attachments
|
|
- name: licenses
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-licenses
|
|
- name: applogs
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-applogs
|
|
---
|
|
# Source: self-host/templates/attachments.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-attachments
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-attachments
|
|
app.kubernetes.io/component: attachments
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-attachments
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-attachments
|
|
app.kubernetes.io/component: attachments
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
containers:
|
|
- name: bitwarden-self-host-attachments
|
|
image: "bitwarden/attachments:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: attachments
|
|
mountPath: /etc/bitwarden/core/attachments
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: attachments
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-attachments
|
|
---
|
|
# Source: self-host/templates/events.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-events
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-events
|
|
app.kubernetes.io/component: events
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-events
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-events
|
|
app.kubernetes.io/component: events
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
initContainers:
|
|
- name: create-mount-subdir
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
mkdir -p /logs/events
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /logs
|
|
containers:
|
|
- name: bitwarden-self-host-events
|
|
image: "bitwarden/events:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /etc/bitwarden/logs
|
|
subPath: events
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: applogs
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-applogs
|
|
---
|
|
# Source: self-host/templates/icons.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-icons
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-icons
|
|
app.kubernetes.io/component: icons
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-icons
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-icons
|
|
app.kubernetes.io/component: icons
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
initContainers:
|
|
- name: create-mount-subdir
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
mkdir -p /logs/icons
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /logs
|
|
containers:
|
|
- name: bitwarden-self-host-icons
|
|
image: "bitwarden/icons:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /etc/bitwarden/logs
|
|
subPath: icons
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: applogs
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-applogs
|
|
---
|
|
# Source: self-host/templates/identity.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-identity
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-identity
|
|
app.kubernetes.io/component: identity
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-identity
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-identity
|
|
app.kubernetes.io/component: identity
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
initContainers:
|
|
- name: create-mount-subdir
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
mkdir -p /logs/identity
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /logs
|
|
containers:
|
|
- name: bitwarden-self-host-identity
|
|
image: "bitwarden/identity:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
- secretRef:
|
|
name: bitwarden-identity-cert-password
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
volumeMounts:
|
|
- name: identity
|
|
mountPath: /etc/bitwarden/identity
|
|
- name: dataprotection
|
|
mountPath: /etc/bitwarden/core/aspnet-dataprotection
|
|
- name: licenses
|
|
mountPath: /etc/bitwarden/core/licenses
|
|
- name: applogs
|
|
mountPath: /etc/bitwarden/logs
|
|
subPath: identity
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: identity
|
|
secret:
|
|
secretName: bitwarden-identity-cert
|
|
- name: dataprotection
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-dataprotection
|
|
- name: licenses
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-licenses
|
|
- name: applogs
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-applogs
|
|
---
|
|
# Source: self-host/templates/notifications.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-notifications
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-notifications
|
|
app.kubernetes.io/component: notifications
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-notifications
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-notifications
|
|
app.kubernetes.io/component: notifications
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
initContainers:
|
|
- name: create-mount-subdir
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
mkdir -p /logs/notifications
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /logs
|
|
containers:
|
|
- name: bitwarden-self-host-notifications
|
|
image: "bitwarden/notifications:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /etc/bitwarden/logs
|
|
subPath: notifications
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: applogs
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-applogs
|
|
---
|
|
# Source: self-host/templates/sso.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-sso
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-sso
|
|
app.kubernetes.io/component: sso
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-sso
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-sso
|
|
app.kubernetes.io/component: sso
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
initContainers:
|
|
- name: create-mount-subdir
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
mkdir -p /logs/sso
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: applogs
|
|
mountPath: /logs
|
|
containers:
|
|
- name: bitwarden-self-host-sso
|
|
image: "bitwarden/sso:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-identity-cert-password
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /alive
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: identity
|
|
mountPath: /etc/bitwarden/identity
|
|
- name: dataprotection
|
|
mountPath: /etc/bitwarden/core/aspnet-dataprotection
|
|
- name: licenses
|
|
mountPath: /etc/bitwarden/core/licenses
|
|
- name: applogs
|
|
mountPath: /etc/bitwarden/logs
|
|
subPath: sso
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: identity
|
|
secret:
|
|
secretName: bitwarden-identity-cert
|
|
- name: dataprotection
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-dataprotection
|
|
- name: licenses
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-licenses
|
|
- name: applogs
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-applogs
|
|
---
|
|
# Source: self-host/templates/web.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: bitwarden-self-host-web
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-web
|
|
app.kubernetes.io/component: web
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: "RollingUpdate"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-web
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-web
|
|
app.kubernetes.io/component: web
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
containers:
|
|
- name: bitwarden-self-host-web
|
|
image: "bitwarden/web:2024.5.0"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-self-host-secretkeys
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
env:
|
|
- name: ASPNETCORE_URLS
|
|
value: http://+:5000
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: 5000
|
|
initialDelaySeconds: 180
|
|
ports:
|
|
- containerPort: 5000
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
volumeMounts:
|
|
- name: web
|
|
mountPath: /etc/bitwarden/web
|
|
securityContext:
|
|
null
|
|
volumes:
|
|
- name: web
|
|
configMap:
|
|
name: bitwarden-config-map-web
|
|
---
|
|
# Source: self-host/templates/mssql.yaml
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: bitwarden-self-host-mssql
|
|
namespace: bitwarden-helm
|
|
labels:
|
|
app: bitwarden-self-host-mssql
|
|
app.kubernetes.io/component: mssql
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
serviceName: bitwarden-self-host-mssql
|
|
replicas: 1
|
|
updateStrategy:
|
|
type: "OnDelete"
|
|
selector:
|
|
matchLabels:
|
|
app: bitwarden-self-host-mssql
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: bitwarden-self-host-mssql
|
|
app.kubernetes.io/component: mssql
|
|
app.kubernetes.io/name: self-host
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/instance: bitwarden
|
|
helm.sh/chart: self-host-2024.5.0
|
|
spec:
|
|
containers:
|
|
- name: bitwarden-self-host-mssql
|
|
image: "mcr.microsoft.com/mssql/server:2022-CU11-ubuntu-22.04"
|
|
imagePullPolicy: Always
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 2G
|
|
requests:
|
|
cpu: 100m
|
|
memory: 2G
|
|
envFrom:
|
|
- configMapRef:
|
|
name: bitwarden-config-map
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
- secretRef:
|
|
name: bitwarden-sql-connection-string
|
|
ports:
|
|
- name: mssql
|
|
containerPort: 1433
|
|
volumeMounts:
|
|
- name: mssql-data
|
|
mountPath: /var/opt/mssql/data
|
|
- name: mssql-log
|
|
mountPath: /var/opt/mssql/log
|
|
- name: mssql-backups
|
|
mountPath: /var/opt/mssql/backups
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: mssql
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: mssql
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 2
|
|
timeoutSeconds: 1
|
|
startupProbe:
|
|
exec:
|
|
command:
|
|
- '/bin/sh'
|
|
- '-c'
|
|
- '/opt/mssql-tools/bin/sqlcmd -S localhost -U sa -P ${SA_PASSWORD} -Q "SELECT 1" || exit 1'
|
|
initialDelaySeconds: 120
|
|
periodSeconds: 10
|
|
timeoutSeconds: 3
|
|
enableServiceLinks: false
|
|
volumes:
|
|
- name: mssql-data
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-mssqldata
|
|
- name: mssql-log
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-mssqllog
|
|
- name: mssql-backups
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-mssqlbackups
|
|
---
|
|
# Source: self-host/templates/pre-install-service-acc.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: service-account
|
|
namespace: bitwarden-helm
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "0"
|
|
---
|
|
# Source: self-host/templates/pre-install-hook-configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: bitwarden-config-map
|
|
namespace: bitwarden-helm
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "1"
|
|
data:
|
|
ACCEPT_EULA: "Y"
|
|
MSSQL_PID: "Express"
|
|
ASPNETCORE_ENVIRONMENT: "Production"
|
|
globalSettings__selfHosted: "true"
|
|
globalSettings__baseServiceUri__vault: "https://bitwarden.tryton.geeraert.eu"
|
|
globalSettings__baseServiceUri__api: "https://bitwarden.tryton.geeraert.eu/api"
|
|
globalSettings__baseServiceUri__identity: "https://bitwarden.tryton.geeraert.eu/identity"
|
|
globalSettings__baseServiceUri__admin: "https://bitwarden.tryton.geeraert.eu/admin"
|
|
globalSettings__baseServiceUri__notifications: "https://bitwarden.tryton.geeraert.eu/notifications"
|
|
globalSettings__baseServiceUri__sso: "https://bitwarden.tryton.geeraert.eu/sso"
|
|
globalSettings__baseServiceUri__internalNotifications: "http://bitwarden-self-host-notifications:5000"
|
|
globalSettings__baseServiceUri__internalAdmin: "http://bitwarden-self-host-admin:5000"
|
|
globalSettings__baseServiceUri__internalIdentity: "http://bitwarden-self-host-identity:5000"
|
|
globalSettings__baseServiceUri__internalApi: "http://bitwarden-self-host-api:5000"
|
|
globalSettings__baseServiceUri__internalVault: "http://bitwarden-self-host-web:5000"
|
|
globalSettings__baseServiceUri__internalSso: "http://bitwarden-self-host-sso:5000"
|
|
globalSettings__baseServiceUri__internalScim: "http://bitwarden-self-host-scim:5000"
|
|
globalSettings__attachment__baseDirectory: "/etc/bitwarden/core/attachments"
|
|
globalSettings__attachment__baseUrl: "https://bitwarden.tryton.geeraert.eu/attachments"
|
|
globalSettings__send__baseDirectory: "/etc/bitwarden/core/attachments/sendfiles"
|
|
globalSettings__send__baseUrl: "https://bitwarden.tryton.geeraert.eu/attachments/sendfiles"
|
|
globalSettings__mail__replyToEmail: "no-reply@bitwarden.tryton.geeraert.eu"
|
|
globalSettings__mail__smtp__host: "smtp.gmail.com"
|
|
globalSettings__mail__smtp__port: "587"
|
|
globalSettings__mail__smtp__ssl: "false"
|
|
globalSettings__logRollBySizeLimit: ""
|
|
globalSettings__syslog__destination: ""
|
|
globalSettings__dataProtection__directory: "/etc/bitwarden/core/aspnet-dataprotection"
|
|
globalSettings__licenseDirectory: "/etc/bitwarden/core/licenses"
|
|
globalSettings__disableUserRegistration: "false"
|
|
globalSettings__enableCloudCommunication: "false"
|
|
globalSettings__baseServiceUri__cloudRegion: EU
|
|
globalSettings__installation__identityUri: "https://identity.bitwarden.eu"
|
|
globalSettings__installation__apiUri: "https://api.bitwarden.eu"
|
|
globalSettings__pushRelayBaseUri: "https://push.bitwarden.eu"
|
|
adminSettings__admins: "pierre@geeraert.eu,franckrobbin6@gmail.com"
|
|
LOCAL_UID: "1000"
|
|
LOCAL_GID: "1000"
|
|
---
|
|
# Source: self-host/templates/pre-install-hook-configmap.yaml
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: bitwarden-config-map-web
|
|
namespace: bitwarden-helm
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "1"
|
|
data:
|
|
app-id.json: |-
|
|
{
|
|
"trustedFacets": [
|
|
{
|
|
"version": {
|
|
"major": 1,
|
|
"minor": 0
|
|
},
|
|
"ids": [
|
|
"https://bitwarden.tryton.geeraert.eu",
|
|
"ios:bundle-id:com.8bit.bitwarden",
|
|
"android:apk-key-hash:dUGFzUzf3lmHSLBDBIv+WaFyZMI"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
---
|
|
# Source: self-host/templates/pre-install-service-acc.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: role:service-acc
|
|
namespace: bitwarden-helm
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "0"
|
|
rules: # Authorization rules for this role
|
|
- apiGroups: [""]
|
|
resources: ["secrets"]
|
|
verbs: ["create","update","patch","delete"]
|
|
---
|
|
# Source: self-host/templates/pre-install-service-acc.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: role:service-acc-pods
|
|
namespace: bitwarden-helm
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "0"
|
|
rules: # Authorization rules for this role
|
|
- apiGroups: [""]
|
|
resources: ["pods"]
|
|
verbs: ["get","list","watch"]
|
|
---
|
|
# Source: self-host/templates/pre-install-service-acc.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rolebinding:service-acc
|
|
namespace: bitwarden-helm
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "0"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: role:service-acc
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: service-account
|
|
namespace: bitwarden-helm
|
|
---
|
|
# Source: self-host/templates/pre-install-service-acc.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: rolebinding:service-acc-pods
|
|
namespace: bitwarden-helm
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-weight": "0"
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: role:service-acc-pods
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: service-account
|
|
namespace: bitwarden-helm
|
|
---
|
|
# Source: self-host/templates/post-delete-hook.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: "bitwarden-cleanup"
|
|
labels:
|
|
app.kubernetes.io/component: post-delete-hook
|
|
annotations:
|
|
"helm.sh/hook": post-delete
|
|
"helm.sh/hook-weight": "0"
|
|
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: "bitwarden-cleanup"
|
|
labels:
|
|
app.kubernetes.io/component: post-delete-hook
|
|
spec:
|
|
serviceAccountName: "service-account"
|
|
containers:
|
|
- name: delete-resources
|
|
command: [
|
|
"/bin/sh", "-c"
|
|
]
|
|
args: ['
|
|
kubectl delete configmap bitwarden-config-map -n bitwarden-helm;
|
|
kubectl delete configmap bitwarden-config-map-web -n bitwarden-helm;
|
|
kubectl delete secret "bitwarden-sql-connection-string" -n bitwarden-helm;
|
|
kubectl delete secret bitwarden-identity-cert -n bitwarden-helm;
|
|
kubectl delete secret bitwarden-identity-cert-password -n bitwarden-helm;
|
|
kubectl delete job bitwarden-setup;
|
|
kubectl delete job bitwarden-migrator;
|
|
echo "Done"
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
restartPolicy: Never
|
|
---
|
|
# Source: self-host/templates/post-install-db-migrator-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: "bitwarden-migrator"
|
|
labels:
|
|
app.kubernetes.io/component: post-install-db-migrator-job
|
|
annotations:
|
|
"helm.sh/hook": post-install,post-upgrade
|
|
"helm.sh/hook-weight": "0"
|
|
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: "bitwarden-migrator"
|
|
labels:
|
|
app.kubernetes.io/component: post-install-db-migrator-job
|
|
spec:
|
|
serviceAccountName: "service-account"
|
|
initContainers:
|
|
- name: wait-for-db
|
|
command:
|
|
- "/bin/bash"
|
|
- "-c"
|
|
args: ['
|
|
while [[ $(kubectl get pods -n bitwarden-helm -l app=bitwarden-self-host-mssql -o jsonpath="{.items[*].status.containerStatuses[*].ready}") != "true" ]]; do sleep 1; done
|
|
|
|
echo "SQL Ready!"
|
|
|
|
while [[ $(kubectl get pods -n bitwarden-helm -l app=bitwarden-self-host-admin -o jsonpath="{.items[*].status.containerStatuses[*].ready}") != "true" ]]; do sleep 1; done
|
|
|
|
echo "Admin Ready!"
|
|
|
|
while [ ! -f /db/vault.mdf ]; do sleep 1; done
|
|
|
|
echo "DB Ready!"
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: mssql-data
|
|
mountPath: /db
|
|
containers:
|
|
- name: migrate-db
|
|
env:
|
|
- name: MSSQL_CONN_STRING
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-sql-connection-string
|
|
key: globalSettings__sqlServer__connectionString
|
|
image: "bitwarden/mssqlmigratorutility:2024.5.0"
|
|
volumeMounts:
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: mssql-data
|
|
persistentVolumeClaim:
|
|
claimName: bitwarden-self-host-mssqldata
|
|
---
|
|
# Source: self-host/templates/pre-install-db-migrator-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: "bitwarden-db-pre-upgrade"
|
|
labels:
|
|
app.kubernetes.io/component: pre-install-db-migrator-job
|
|
annotations:
|
|
"helm.sh/hook": pre-upgrade
|
|
"helm.sh/hook-weight": "4"
|
|
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: "bitwarden-db-pre-upgrade"
|
|
labels:
|
|
app.kubernetes.io/component: pre-install-db-migrator-job
|
|
spec:
|
|
serviceAccountName: "service-account"
|
|
containers:
|
|
- name: migrate-db
|
|
env:
|
|
- name: MSSQL_CONN_STRING
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: bitwarden-sql-connection-string
|
|
key: globalSettings__sqlServer__connectionString
|
|
image: "bitwarden/mssqlmigratorutility:2024.5.0"
|
|
volumeMounts:
|
|
restartPolicy: Never
|
|
volumes:
|
|
---
|
|
# Source: self-host/templates/pre-install-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: "bitwarden-setup"
|
|
labels:
|
|
app.kubernetes.io/component: pre-install-hook
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "2"
|
|
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: "bitwarden-setup"
|
|
labels:
|
|
app.kubernetes.io/component: pre-install-hook
|
|
spec:
|
|
serviceAccountName: "service-account"
|
|
initContainers:
|
|
- name: generate-identity-cert
|
|
command:
|
|
- "/bin/sh"
|
|
- "-c"
|
|
args: ['
|
|
openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout /bitwarden/identity.key -out /bitwarden/identity.crt -subj "/CN=Bitwarden IdentityServer" -days 36500;
|
|
openssl pkcs12 -export -out /bitwarden/identity.pfx -inkey /bitwarden/identity.key -in /bitwarden/identity.crt -passout pass:map[];
|
|
chmod 777 /bitwarden/identity.pfx;
|
|
echo Done;
|
|
']
|
|
image: "docker.io/nginx:1.25.3"
|
|
volumeMounts:
|
|
- name: temp
|
|
mountPath: "/bitwarden"
|
|
containers:
|
|
- name: create-resources
|
|
command:
|
|
- "/bin/sh"
|
|
- "-c"
|
|
args: ['
|
|
ls -atlh /bitwarden;
|
|
kubectl create secret generic bitwarden-identity-cert --from-file=/bitwarden/identity.pfx -n bitwarden-helm ;
|
|
kubectl create secret generic bitwarden-identity-cert-password -n bitwarden-helm
|
|
--from-literal=globalSettings__identityServer__certificatePassword="map[]";
|
|
echo "Done"
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
volumeMounts:
|
|
- name: temp
|
|
mountPath: "/bitwarden"
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: temp
|
|
emptyDir:
|
|
medium: Memory
|
|
---
|
|
# Source: self-host/templates/pre-install-secret-sql.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: "bitwarden-secret-sql"
|
|
labels:
|
|
app.kubernetes.io/component: pre-install-hook
|
|
annotations:
|
|
"helm.sh/hook": pre-install
|
|
"helm.sh/hook-weight": "3"
|
|
"helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: "bitwarden-secret-sql"
|
|
labels:
|
|
app.kubernetes.io/component: pre-install-hook
|
|
spec:
|
|
serviceAccountName: "service-account"
|
|
containers:
|
|
- name: create-resources
|
|
command:
|
|
- "/bin/sh"
|
|
- "-c"
|
|
args: ['
|
|
kubectl create secret generic bitwarden-sql-connection-string -n bitwarden-helm
|
|
--from-literal=globalSettings__sqlServer__connectionString="Data Source=tcp:bitwarden-self-host-mssql,1433;Initial Catalog=vault;Persist Security Info=False;User ID=sa;Password=$SA_PASSWORD;MultipleActiveResultSets=False;Connect Timeout=30;Encrypt=True;TrustServerCertificate=True"
|
|
|
|
echo "Done"
|
|
']
|
|
image: "bitnami/kubectl:1.21"
|
|
envFrom:
|
|
- secretRef:
|
|
name: "custom-secret"
|
|
volumeMounts:
|
|
- name: temp
|
|
mountPath: "/bitwarden"
|
|
restartPolicy: Never
|
|
volumes:
|
|
- name: temp
|
|
emptyDir:
|
|
medium: Memory
|