gitea_admin/k8s-and-chill
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity
27 commits 1 branch 0 tags 1.7 MiB
Commit graph

5 commits

Author SHA1 Message Date
Felix Wolf 33c52be1c5 feat(pss): drop 5 namespaces from PSS privileged to restricted 
argocd, cert-manager, cloudnative-pg already compliant — label flip only.
ocis: add overlay injecting seccompProfile=RuntimeDefault, drop ALL caps,
allowPrivilegeEscalation=false across all chart Deployments/CronJobs;
patch idm initContainer; harden custom precheck Job; refactor s3-backup
to rclone/rclone image (avoids apk-add-as-root).
victoria-metrics-single: overlay sets full restricted SC on the StatefulSet
that ships with empty securityContext: {}.

forgejo, traefik, kube-system stay privileged (hostPort / CSI driver).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-03 01:24:59 +02:00
Felix Wolf d1eae1546e fix(victoriametrics): Remove nodeselector for old node 
The node ubuntu-4gb-nbg1-1 was drained and exchanged with a new x86 C33 machine. So the nodeselctor needs to be removed.
 2026-04-12 17:30:26 +02:00
Felix Wolf aa55722803 feat: Add node selector for Victoria Metrics server 
Configures the Victoria Metrics single server to be scheduled on a specific host, `ubuntu-4gb-nbg1-1`. This ensures being scheduled on the same node as the pvc is bound ot since it uses local-path volume
 2026-04-04 15:35:56 +02:00
Felix Wolf 09ecd5ba78 feat: Add kubelet and cAdvisor scrape jobs 
Enables direct scraping of kubelet and cAdvisor metrics from Kubernetes nodes.
This provides more granular insights into node health and container resource utilization.
Configures secure HTTPS scraping using Kubernetes node service discovery.
 2026-04-04 15:15:06 +02:00
Felix Wolf a92c5d8dc2 feat: Add VictoriaMetrics monitoring stack 
Adds victoria-metrics-single, grafana, kube-state-metrics, and
node-exporter to the cluster. Enables metrics endpoints on traefik,
argocd, and cert-manager for scraping. Grafana available at
grafana.tr1ceracop.de with VictoriaMetrics as default datasource.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-31 00:20:23 +02:00