mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Scooby HuskyandClaude Opus 4.6
5163403e24
Reduce replicas to 1 for workloads that don't need HA in a homelab: - Prometheus 2→1, Alertmanager 2→1 (~4.4GB RAM saved) - cert-manager 3→1 - GitLab: registry 2→1, kas 2→1, sidekiq 2→1, praefect 2→1, pgbouncer-ro 3→1 - Guacamole + guacd 2→1 - Kiali 2→1, ArgoCD server 2→1 - Kyverno background-controller 2→1 - Scylla operator 2→1 - ext-authz-proxy 2→1, netbird-cluster-router 2→1 Kept multi-replica: coredns, envoy-gateway, kyverno admission, vault, argocd-repo-server, gitlab-webservice, istiod, rook-ceph CSI. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
129 lines
2.7 KiB
YAML
129 lines
2.7 KiB
YAML
# Kyverno Policy Engine - Zero Trust Configuration
|
|
# All policies start in Audit mode to avoid breaking existing workloads
|
|
|
|
admissionController:
|
|
replicas: 3
|
|
resources:
|
|
limits:
|
|
memory: 384Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
backgroundController:
|
|
replicas: 1
|
|
resources:
|
|
limits:
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
cleanupController:
|
|
replicas: 1
|
|
resources:
|
|
limits:
|
|
memory: 128Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
reportsController:
|
|
replicas: 1
|
|
resources:
|
|
limits:
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
serviceMonitor:
|
|
enabled: true
|
|
|
|
# Enable metrics for Prometheus
|
|
metricsConfig:
|
|
metricsExposure:
|
|
enabled: true
|
|
|
|
# Exclude system namespaces from webhook
|
|
config:
|
|
webhooks:
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: NotIn
|
|
values:
|
|
- kube-system
|
|
- kube-public
|
|
- kube-node-lease
|
|
- cattle-system
|
|
- cattle-fleet-system
|
|
- cattle-fleet-local-system
|
|
- cattle-capi-system
|
|
- cattle-turtles-system
|
|
- cattle-ui-plugin-system
|
|
- cattle-impersonation-system
|
|
- cattle-global-data
|
|
- cattle-local-user-passwords
|
|
- cattle-fleet-clusters-system
|
|
- fleet-default
|
|
- fleet-local
|
|
- local
|
|
excludeGroups:
|
|
- system:serviceaccounts:kube-system
|
|
- system:nodes
|
|
resourceFiltersExcludeNamespaces:
|
|
# Core Kubernetes
|
|
- kube-system
|
|
- kube-public
|
|
- kube-node-lease
|
|
- kyverno
|
|
# Rancher (exact names)
|
|
- cattle-system
|
|
- cattle-fleet-system
|
|
- cattle-fleet-local-system
|
|
- cattle-capi-system
|
|
- cattle-turtles-system
|
|
- cattle-ui-plugin-system
|
|
- cattle-impersonation-system
|
|
- cattle-global-data
|
|
- cattle-local-user-passwords
|
|
- cattle-fleet-clusters-system
|
|
- fleet-default
|
|
- fleet-local
|
|
- local
|
|
# Rancher dynamic namespaces (wildcard)
|
|
- c-*
|
|
- p-*
|
|
- u-*
|
|
- user-*
|
|
- cluster-fleet-*
|
|
# Infrastructure operators and system namespaces
|
|
- rook-ceph
|
|
- cnpg-system
|
|
- redis-operator
|
|
- mariadb-system
|
|
- cert-manager
|
|
- istio-system
|
|
- external-secrets
|
|
- scylla-operator
|
|
- scylla-manager
|
|
- kiali-operator
|
|
- envoy-gateway-system
|
|
- reloader
|
|
- tetragon
|
|
- cilium-secrets
|
|
- vault
|
|
- prometheus
|
|
- netbird-operator
|
|
|
|
features:
|
|
policyExceptions:
|
|
enabled: true
|
|
namespace: kyverno
|