mats/go-otel
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

eval

Browse Source
This commit is contained in:
mats committed 2026-09-27 16:45:10 +02:00
1 parent f5015581a4
commit e046bd86d1
18 files changed
+3020 -46
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

k8s/deployment.yaml
+6 -12
View File
@@ -15,6 +15,9 @@ spec:
metadata:
labels:
app: otel-debug-receiver
annotations:
k8s-helper.io/git-url: "https://git.k6n.net/mats/go-otel"
k8s-helper.io/git-ssh: "git@git.k6n.net:mats/go-otel.git"
spec:
serviceAccountName: otel-debug-receiver
securityContext:
@@ -138,6 +141,9 @@ spec:
# Optional Always-On Display session API.
- name: OTEL_ALERT_AOD_URL
value: ""
# laya shadow verdicts: shown in each notification, never acted on.
- name: OTEL_ALERT_LAYA_URL
value: "https://laya.k6n.net"
- name: OTEL_STORE_WORKERS
value: "4"
# Optional rollout observation. The watcher is read-only and uses the
@@ -236,18 +242,6 @@ spec:
- name: sourcemap-dir
persistentVolumeClaim:
claimName: otel-sourcemaps
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: otel-sourcemaps
namespace: monitoring
spec:
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: 1Gi
---
apiVersion: v1
kind: ServiceAccount
k8s/flux/gitops-dashboard.yaml
+120
View File
@@ -0,0 +1,120 @@
# OIDC Registration in ecommerce namespace
apiVersion: v1
kind: Secret
metadata:
name: flux-dashboard-oidc-client-secret
namespace: ecommerce
type: Opaque
stringData:
secret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
---
apiVersion: auth.k6n.net/v1alpha1
kind: AuthClient
metadata:
name: flux-dashboard
namespace: ecommerce
labels:
auth.k6n.net/server: auth
spec:
clientID: flux-dashboard
displayName: Flux GitOps Dashboard
description: Web UI for Flux CD (Weave GitOps)
redirectURIs:
- https://flux.k6n.net/oauth2/callback
scopes:
- openid
- profile
- email
- groups
secretRef:
name: flux-dashboard-oidc-client-secret
key: secret
---
# Weave GitOps OIDC Secret in flux-system
apiVersion: v1
kind: Secret
metadata:
name: oidc-auth
namespace: flux-system
type: Opaque
stringData:
clientID: "flux-dashboard"
clientSecret: "f9f44c88d9fda647e4abbb4479f1116611ecc14624bd67ec"
issuerURL: "https://users.k6n.net"
redirectURL: "https://flux.k6n.net/oauth2/callback"
claimUsername: "email"
claimGroups: "roles"
---
# Weave GitOps Helm OCI Source and HelmRelease
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: weave-gitops
namespace: flux-system
spec:
type: oci
url: oci://ghcr.io/weaveworks/charts
interval: 1h
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: weave-gitops
namespace: flux-system
spec:
interval: 10m
chart:
spec:
chart: weave-gitops
version: "4.0.36"
sourceRef:
kind: HelmRepository
name: weave-gitops
values:
envVars:
- name: KUBERNETES_SERVICE_HOST
value: "10.10.1.102"
- name: KUBERNETES_SERVICE_PORT
value: "6443"
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: NotIn
values:
- serber
# Use existing oidc-auth secret created above
oidcSecret:
create: false
adminUser:
create: false
ingress:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
hosts:
- host: flux.k6n.net
paths:
- path: /
pathType: ImplementationSpecific
tls:
- hosts:
- flux.k6n.net
secretName: flux-k6n-tls
---
# ClusterRoleBinding so authenticated users can view/manage GitOps resources
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: weave-gitops-admin
subjects:
- kind: Group
name: admin
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io
k8s/flux/sync-go-otel.yaml
+28
View File
@@ -0,0 +1,28 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
name: go-otel
namespace: flux-system
spec:
interval: 1m
url: ssh://git@git.k6n.net/mats/go-otel.git
ref:
branch: main
secretRef:
name: go-otel-auth
---
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: go-otel
namespace: flux-system
spec:
interval: 5m
targetNamespace: monitoring
sourceRef:
kind: GitRepository
name: go-otel
path: "./k8s"
prune: true
wait: true
timeout: 3m
k8s/ingress-catchall.yaml
+173
View File
@@ -0,0 +1,173 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: ingress-catchall
namespace: ingress-nginx
data:
nginx.conf: |
worker_processes 1;
pid /tmp/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
client_body_temp_path /tmp/client_temp;
proxy_temp_path /tmp/proxy_temp;
fastcgi_temp_path /tmp/fastcgi_temp;
uwsgi_temp_path /tmp/uwsgi_temp;
scgi_temp_path /tmp/scgi_temp;
server {
listen 8080;
server_name _;
root /usr/share/nginx/html;
error_page 403 =404 /index.html;
# Only GET is intentionally accepted by this catch-all.
# The "if" is safe here because it only performs a return.
# Serve robots.txt directly with Disallow: /
location = /robots.txt {
default_type text/plain;
return 200 "User-agent: *\nDisallow: /\n";
}
# Deliberately trigger an internal 403 so the static error page is
# returned with the externally visible status still set to 404.
location / {
if ($request_method != GET) {
add_header Allow GET always;
return 405;
}
deny all;
}
# Keep the error document internal so /index.html also follows the
# catch-all policy instead of becoming a successful public endpoint.
location = /index.html {
internal;
allow all;
}
}
}
index.html: |
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Not found</title>
<style>
:root { color-scheme: dark; }
* { box-sizing: border-box; }
body {
min-height: 100vh;
margin: 0;
display: grid;
place-items: center;
padding: 2rem;
color: #e8ecf2;
background: #0d1014;
font: 16px/1.5 system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
}
main { width: min(100%, 42rem); }
.code {
margin: 0 0 .75rem;
color: #7b8cff;
font: 700 clamp(4rem, 14vw, 8rem)/.9 ui-monospace, SFMono-Regular, Menlo, monospace;
letter-spacing: -.08em;
}
h1 { margin: 0 0 .75rem; font-size: clamp(1.5rem, 4vw, 2.25rem); }
p { margin: 0; max-width: 34rem; color: #98a3b2; }
code { color: #e8ecf2; }
</style>
</head>
<body>
<main>
<p class="code">404</p>
<h1>There is nothing here.</h1>
<p>The requested resource does not exist on this ingress endpoint.</p>
</main>
</body>
</html>
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: ingress-catchall
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-catchall
app.kubernetes.io/part-of: ingress-nginx
spec:
replicas: 2
selector:
matchLabels:
app.kubernetes.io/name: ingress-catchall
template:
metadata:
labels:
app.kubernetes.io/name: ingress-catchall
app.kubernetes.io/part-of: ingress-nginx
spec:
automountServiceAccountToken: false
securityContext:
seccompProfile:
type: RuntimeDefault
containers:
- name: nginx
image: nginx:1.27-alpine
imagePullPolicy: IfNotPresent
ports:
- name: http
containerPort: 8080
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
runAsNonRoot: true
runAsUser: 101
volumeMounts:
- name: config
mountPath: /etc/nginx/nginx.conf
subPath: nginx.conf
readOnly: true
- name: config
mountPath: /usr/share/nginx/html/index.html
subPath: index.html
readOnly: true
readinessProbe:
tcpSocket:
port: http
periodSeconds: 5
livenessProbe:
tcpSocket:
port: http
initialDelaySeconds: 5
periodSeconds: 10
volumes:
- name: config
configMap:
name: ingress-catchall
---
apiVersion: v1
kind: Service
metadata:
name: ingress-catchall
namespace: ingress-nginx
labels:
app.kubernetes.io/name: ingress-catchall
app.kubernetes.io/part-of: ingress-nginx
spec:
selector:
app.kubernetes.io/name: ingress-catchall
ports:
- name: http
port: 80
targetPort: http
k8s/ingress.yaml
+4
View File
@@ -85,6 +85,10 @@ metadata:
name: otel-debug-ingress
namespace: monitoring
annotations:
k8s-helper.io/name: "Go OTel"
k8s-helper.io/description: "OpenTelemetry debugging dashboard"
k8s-helper.io/group: "Observability"
k8s-helper.io/icon: "activity"
cert-manager.io/cluster-issuer: letsencrypt-prod
# OIDC protection via the platform auth service (users.k6n.net):
# /oauth2/auth resolves the session cookie / bearer token and answers
k8s/kustomization.yaml
+6
View File
@@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml
- ingress.yaml
k8s/otel-sourcemaps-pvc.example.yaml
+10
View File
@@ -0,0 +1,10 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: otel-sourcemaps
namespace: monitoring
spec:
accessModes: ["ReadWriteOnce"]
resources:
requests:
storage: 1Gi