apl-core/core.yaml at main · linode/apl-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
# NOTE: This file is merged with other values in ./helmfile.d/snippets/env.gotmpl
k8s:
  namespaces:
    - name: argocd
      app: argocd
      disableIstioInjection: true
    - name: cert-manager
      disableIstioInjection: true
    - name: cnpg-system
      app: cnpg
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: default
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: external-dns
      disableIstioInjection: true
    - name: harbor
      app: harbor
    - name: apl-harbor-operator
      disableIstioInjection: true
    - name: git-server
    - name: gitea
    - name: apl-gitea-operator
      disableIstioInjection: true
    - name: apl-operator
      disableIstioInjection: true
    - name: grafana
      app: grafana
    - name: istio-system
      disableIstioInjection: true
    - name: keycloak
    - name: apl-keycloak-operator
      disableIstioInjection: true
    - name: knative-serving
      app: knative
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: kserve
      app: kserve
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: knative-operator
      app: knative
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: kfp
      app: kubeflow-pipelines
      disablePolicyChecks: true
      disableIstioInjection: true
    - name: kyverno
      app: kyverno
      disableIstioInjection: true
    - name: tekton-dashboard
      app: tekton-pipelines
    - name: tekton-pipelines
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: tekton-triggers
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: otel
      app: otel
      disableIstioInjection: true
    - name: maintenance
      disableIstioInjection: true
    - name: monitoring
      disableIstioInjection: true
    - name: otomi
    - name: otomi-operator
      disableIstioInjection: true
    - name: rabbitmq
      app: rabbitmq
      disableIstioInjection: true
    - name: redis
      app: prometheus
      disableIstioInjection: true
    - name: team-admin
    - name: trivy-operator
      app: trivy
      disableIstioInjection: true
      disablePolicyChecks: true
    - name: sealed-secrets
      app: sealed-secrets
    - name: external-secrets
      app: external-secrets
      disableIstioInjection: true
    - name: apl-secrets
      disableIstioInjection: true
    - name: policy-reporter
      app: policy-reporter
      disablePolicyChecks: true
      disableIstioInjection: true

adminApps:
  - name: alertmanager
    tags: [alerting, observability]
    deps: [prometheus]
    ownHost: true
  - name: argocd
    tags: [cicd, gitops]
    isShared: true
    ownHost: true
  - name: cert-manager
    tags: [ingress, security, tls]
  - name: cnpg
    tags: [database]
  - name: tty
    tags: [tty]
    isShared: true
    ownHost: true
  - name: external-dns
    tags: [ingress, security, tls]
  - name: gitea
    tags: [git]
    isShared: true
    ownHost: true
    path: /user/oauth2/otomi-idp
  - name: grafana
    tags: [tracing, telemetry, observability]
    deps: [prometheus]
    path: /dashboards
    ownHost: true
  - name: harbor
    tags: [security]
    isShared: true
    ownHost: true
  - name: hello
    hide: true
    tags: [demo]
  - name: istio
    tags: [ingress, egress, routing, security, tls, observability, policies]
  - name: keycloak
    path: /admin/otomi/console/
    tags: [auth, sso]
    ownHost: true
  - name: knative
    tags: [serverless, functions]
    deps: [istio]
  - name: kubeflow-pipelines
    tags: [ai, ml]
    ownHost: true
    isShared: true
  - name: kserve
    tags: [ai]
  - name: tekton
    tags: [buildpacks, ci, pipelines]
    ownHost: true
    path: /#/namespaces/team-admin/pipelineruns
  - name: loki
    tags: [logging, telemetry, observability]
    deps: [grafana, prometheus, otel]
    useHost: grafana
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A"%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
  - name: console
    hide: true
    isShared: true
    ownHost: true
  - name: api # Used by any client that do not support cookies
    hide: true
    isShared: true
    ownHost: true
  - name: prometheus
    tags: [metrics, observability]
    ownHost: true
  - name: sealed-secrets
    tags: [secrets, security, observability]
  - name: otel
    tags: [logging, tracing]
  - name: trivy
    tags: [security]
    deps: [prometheus, grafana]
  - name: kyverno
    tags: [security]
  - name: rabbitmq
    tags: [messaging]

teamApps:
  - name: alertmanager
    ownHost: true
    path: /#/alerts?silenced=false&inhibited=false&active=true&filter=%7Bnamespace%3D"team-#TEAM#"%7D
  - name: grafana
    ownHost: true
    path: /dashboards
  - name: loki
    useHost: grafana
    path: /explore?orgId=1&left=%7B"datasource":"loki","queries":%5B%7B"refId":"A","expr":"","queryType":"range","datasource":%7B"type":"loki","uid":"loki"%7D%7D%5D,"range":%7B"from":"now-1h","to":"now"%7D%7D
  - name: tekton
    ownHost: true