mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Opus 4.6
5163403e24
Reduce replicas to 1 for workloads that don't need HA in a homelab: - Prometheus 2→1, Alertmanager 2→1 (~4.4GB RAM saved) - cert-manager 3→1 - GitLab: registry 2→1, kas 2→1, sidekiq 2→1, praefect 2→1, pgbouncer-ro 3→1 - Guacamole + guacd 2→1 - Kiali 2→1, ArgoCD server 2→1 - Kyverno background-controller 2→1 - Scylla operator 2→1 - ext-authz-proxy 2→1, netbird-cluster-router 2→1 Kept multi-replica: coredns, envoy-gateway, kyverno admission, vault, argocd-repo-server, gitlab-webservice, istiod, rook-ceph CSI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
68 lines
1.9 KiB
YAML
68 lines
1.9 KiB
YAML
---
|
|
# ExternalSecret to pull router setup key from Vault
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: netbird-router-setup-key
|
|
namespace: netbird
|
|
spec:
|
|
refreshInterval: "0"
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-backend
|
|
target:
|
|
name: netbird-router-setup-key
|
|
data:
|
|
- secretKey: setup-key
|
|
remoteRef:
|
|
key: netbird-router-setup-key
|
|
property: setup-key
|
|
---
|
|
# Shared cluster-wide NetBird router deployment (2 replicas)
|
|
# Routes traffic for all exposed K8s services through NetBird VPN
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: netbird-cluster-router
|
|
namespace: netbird
|
|
labels:
|
|
app.kubernetes.io/name: netbird-cluster-router
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: netbird-cluster-router
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: netbird-cluster-router
|
|
annotations:
|
|
# Router pods must opt out of ambient mesh — ztunnel iptables rules
|
|
# interfere with WireGuard packet forwarding (DNS and TCP).
|
|
# AuthorizationPolicies use ipBlocks for pod CIDR instead.
|
|
ambient.istio.io/redirection: disabled
|
|
spec:
|
|
containers:
|
|
- name: netbird
|
|
image: netbirdio/netbird:0.66.0
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: NB_SETUP_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: netbird-router-setup-key
|
|
key: setup-key
|
|
- name: NB_MANAGEMENT_URL
|
|
value: "https://netbird.kube.huskypup.net"
|
|
securityContext:
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
resources:
|
|
requests:
|
|
cpu: 25m
|
|
memory: 64Mi
|
|
limits:
|
|
memory: 128Mi
|
|
terminationGracePeriodSeconds: 30
|