💥 add all the files

Gitlab-webserver.kube.yaml

@@ -0,0 +1,87 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitlab
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitlab-webserver
+  namespace: gitlab
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitlab-webserver
+  template:
+    metadata:
+      labels:
+        app: gitlab-webserver
+    spec:
+      containers:
+      - name: gitlab-webserver
+        image: gitlab/gitlab-ee:latest
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 80
+          name: gitlab-http
+        - containerPort: 443
+          name: gitlab-https
+        - containerPort: 22
+          name: gitlab-ssh
+        env:
+          - name: GITLAB_OMNIBUS_CONFIG
+            value: |
+              external_url 'https://gitlab.tryton.geeraert.eu'
+#              gitlab_ssh_host 'localhost:30627'
+        volumeMounts:
+        - name: gitlab-webserver-config
+          mountPath: /etc/gitlab
+        - name: gitlab-webserver-logs
+          mountPath: /var/log/gitlab
+        - name: gitlab-webserver-data
+          mountPath: /var/opt/gitlab
+        resources:
+            requests:
+              cpu: 300m
+              memory: 2.5G
+
+
+      volumes:
+      - name: gitlab-webserver-config
+        persistentVolumeClaim:
+          claimName: gitlab-webserver-config
+      - name: gitlab-webserver-logs
+        persistentVolumeClaim:
+          claimName: gitlab-webserver-logs
+      - name: gitlab-webserver-data
+        persistentVolumeClaim:
+          claimName: gitlab-webserver-data
+
+      securityContext:
+        fsGroup: 33
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: webserver
+  namespace: gitlab
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: gitlab-http
+      protocol: TCP
+    - name: https
+      targetPort: gitlab-https
+      port: 443
+      protocol: TCP
+    - name: "22"
+      port: 22
+      targetPort: gitlab-ssh
+      protocol: TCP
+      nodePort: 30627
+  type: NodePort
+  selector:
+    app: gitlab-webserver

gitlab_agent.yml

@@ -0,0 +1,256 @@
+---
+# Source: gitlab-agent/templates/ocs/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: release-name-gitlab-agent-ocs-scanning-pod-sa
+  namespace: gitlab
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: gitlab-agent/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: release-name-gitlab-agent
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+---
+# Source: gitlab-agent/templates/ocs/clusterrole.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: gitlab:release-name-gitlab-agent:ocs
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  - jobs
+  verbs:
+  - list
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - replicationcontrollers
+  - serviceaccounts
+  - namespaces
+  verbs:
+  - list
+  - get
+- apiGroups:
+  - "apps"
+  resources:
+  - replicasets
+  - daemonsets
+  - statefulsets
+  - deployments
+  verbs:
+  - list
+  - get
+---
+# Source: gitlab-agent/templates/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitlab:release-name-gitlab-agent-cluster-admin
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: release-name-gitlab-agent
+  namespace: gitlab
+---
+# Source: gitlab-agent/templates/ocs/clusterrolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: gitlab:release-name-gitlab-agent:ocs
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: gitlab:release-name-gitlab-agent:ocs
+subjects:
+- kind: ServiceAccount
+  name: release-name-gitlab-agent-ocs-scanning-pod-sa
+  namespace: gitlab
+---
+# Source: gitlab-agent/templates/ocs/role.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: release-name-gitlab-agent:ocs
+  namespace: gitlab
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+---
+# Source: gitlab-agent/templates/ocs/rolebinding.yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: release-name-gitlab-agent:ocs
+  namespace: gitlab
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: release-name-gitlab-agent:ocs
+subjects:
+- kind: ServiceAccount
+  name: release-name-gitlab-agent-ocs-scanning-pod-sa
+  namespace: gitlab
+---
+# Source: gitlab-agent/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  # NOTE: the `-v1` suffix was introduced as an epoch version to be able
+  # to gracefully recreate the deployment in case there is no upgrade
+  # path otherwise, e.g. when changing an immutable field.
+  # see https://gitlab.com/gitlab-org/charts/gitlab-agent/-/issues/38 for ctx
+  name: release-name-gitlab-agent-v2
+  labels:
+    helm.sh/chart: gitlab-agent-2.2.0
+    app.kubernetes.io/name: gitlab-agent
+    app.kubernetes.io/instance: release-name
+    app.kubernetes.io/version: "v17.0.1"
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 2
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gitlab-agent
+      app.kubernetes.io/instance: release-name
+  template:
+    metadata:
+      annotations:        
+        prometheus.io/path: /metrics
+        prometheus.io/port: "8080"
+        prometheus.io/scrape: "true"
+      labels:
+        helm.sh/chart: gitlab-agent-2.2.0
+        app.kubernetes.io/name: gitlab-agent
+        app.kubernetes.io/instance: release-name
+        app.kubernetes.io/version: "v17.0.1"
+        app.kubernetes.io/managed-by: Helm
+    spec:
+      automountServiceAccountToken: false
+      serviceAccountName: release-name-gitlab-agent
+      securityContext:
+        {}
+      containers:
+        - name: gitlab-agent
+          securityContext:
+            {}
+          image: registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk:v17.0.1
+          imagePullPolicy: IfNotPresent
+          terminationMessagePolicy: FallbackToLogsOnError
+          args:
+            - --token-file=/etc/agentk/secrets/token
+            - --kas-address=wss://kas.gitlab.com
+          ports:
+            - name: observability
+              containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /liveness
+              port: 8080
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /readiness
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            {}
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+               fieldRef:
+                 fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: SERVICE_ACCOUNT_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.serviceAccountName
+            - name: OCS_ENABLED
+              value: "true"
+            - name: OCS_SERVICE_ACCOUNT_NAME
+              value: release-name-gitlab-agent-ocs-scanning-pod-sa
+          volumeMounts:
+            - name: service-account-token-volume
+              mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+              readOnly: true
+      volumes:
+        - name: service-account-token-volume
+          projected:
+            defaultMode: 0444
+            sources:
+            - configMap:
+                name: kube-root-ca.crt
+            - downwardAPI:
+                items:
+                - fieldRef:
+                    apiVersion: v1
+                    fieldPath: metadata.namespace
+                  path: namespace
+            - serviceAccountToken:
+                expirationSeconds: 3600
+                path: token

pvc.claim.yaml

@@ -0,0 +1,39 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: gitlab-webserver-config
+  namespace: gitlab
+spec:
+  storageClassName: nfs-storage-intelligent
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 2Gi
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: gitlab-webserver-logs
+  namespace: gitlab
+spec:
+  storageClassName: nfs-storage-intelligent
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 2Gi
+
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: gitlab-webserver-data
+  namespace: gitlab
+spec:
+  storageClassName: nfs-storage-intelligent
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 2Gi