mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Opus 4.6
af573c647f
bitnami/kubectl has removed all version tags from Docker Hub, leaving only :latest which is blocked by Kyverno disallow-latest-tag policy. Switch to alpine/k8s:1.32.13 which has kubectl, bash, jq, and uses proper version tags. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: crowdsec-presync
|
|
namespace: crowdsec
|
|
annotations:
|
|
argocd.argoproj.io/hook: PreSync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
serviceAccountName: argocd-hook-sa
|
|
containers:
|
|
- name: presync
|
|
image: alpine/k8s:1.32.13
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- |
|
|
set -euo pipefail
|
|
echo "=== CrowdSec PreSync ==="
|
|
|
|
# Set PodSecurity to privileged (firewall bouncer needs host access)
|
|
kubectl label namespace crowdsec pod-security.kubernetes.io/enforce=privileged --overwrite 2>/dev/null || true
|
|
|
|
# Wait for CNPG cluster
|
|
echo "Waiting for CrowdSec PostgreSQL cluster..."
|
|
for i in $(seq 1 60); do
|
|
PHASE=$(kubectl -n crowdsec get clusters.postgresql.cnpg.io pg-crowdsec -o jsonpath='{.status.phase}' 2>/dev/null || echo "")
|
|
if [ "$PHASE" = "Cluster in healthy state" ] || [ "$PHASE" = "Healthy" ]; then
|
|
echo " CrowdSec PostgreSQL cluster ready"
|
|
break
|
|
fi
|
|
echo " waiting for pg-crowdsec... (attempt $i/60, phase=$PHASE)"
|
|
sleep 5
|
|
done
|
|
|
|
echo "=== CrowdSec PreSync Complete ==="
|
|
restartPolicy: Never
|