feat(volsync): setup in kube-nas

[tyriis]

No description provided.

[tyriis-automation]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ EDITORCONFIG	editorconfig-checker	11		0	0.02s
✅ REPOSITORY	gitleaks	yes		no	3.99s
✅ YAML	prettier	11		0	0.66s
✅ YAML	yamllint	11		0	0.49s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security

[tyriis-automation]

--- HelmRelease: kube-system/snapshot-controller ServiceAccount: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ServiceAccount: kube-system/snapshot-controller

@@ -1,10 +0,0 @@

----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: snapshot-controller
-  labels:
-    app.kubernetes.io/name: snapshot-controller
-    app.kubernetes.io/instance: snapshot-controller
-    app.kubernetes.io/managed-by: Helm
-
--- HelmRelease: kube-system/snapshot-controller ClusterRole: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ClusterRole: kube-system/snapshot-controller

@@ -1,122 +0,0 @@

----
-kind: ClusterRole
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: snapshot-controller
-rules:
-- apiGroups:
-  - ''
-  resources:
-  - persistentvolumes
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - ''
-  resources:
-  - persistentvolumeclaims
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-- apiGroups:
-  - ''
-  resources:
-  - events
-  verbs:
-  - list
-  - watch
-  - create
-  - update
-  - patch
-- apiGroups:
-  - snapshot.storage.k8s.io
-  resources:
-  - volumesnapshotclasses
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - snapshot.storage.k8s.io
-  resources:
-  - volumesnapshotcontents
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - delete
-  - patch
-- apiGroups:
-  - snapshot.storage.k8s.io
-  resources:
-  - volumesnapshotcontents/status
-  verbs:
-  - patch
-- apiGroups:
-  - snapshot.storage.k8s.io
-  resources:
-  - volumesnapshots
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - patch
-  - delete
-- apiGroups:
-  - snapshot.storage.k8s.io
-  resources:
-  - volumesnapshots/status
-  verbs:
-  - update
-  - patch
-- apiGroups:
-  - groupsnapshot.storage.k8s.io
-  resources:
-  - volumegroupsnapshotclasses
-  verbs:
-  - get
-  - list
-  - watch
-- apiGroups:
-  - groupsnapshot.storage.k8s.io
-  resources:
-  - volumegroupsnapshotcontents
-  verbs:
-  - create
-  - get
-  - list
-  - watch
-  - update
-  - delete
-  - patch
-- apiGroups:
-  - groupsnapshot.storage.k8s.io
-  resources:
-  - volumegroupsnapshotcontents/status
-  verbs:
-  - patch
-- apiGroups:
-  - groupsnapshot.storage.k8s.io
-  resources:
-  - volumegroupsnapshots
-  verbs:
-  - get
-  - list
-  - watch
-  - update
-  - patch
-- apiGroups:
-  - groupsnapshot.storage.k8s.io
-  resources:
-  - volumegroupsnapshots/status
-  verbs:
-  - update
-  - patch
-
--- HelmRelease: kube-system/snapshot-controller ClusterRoleBinding: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ClusterRoleBinding: kube-system/snapshot-controller

@@ -1,14 +0,0 @@

----
-kind: ClusterRoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: snapshot-controller
-subjects:
-- kind: ServiceAccount
-  name: snapshot-controller
-  namespace: kube-system
-roleRef:
-  kind: ClusterRole
-  name: snapshot-controller
-  apiGroup: rbac.authorization.k8s.io
-
--- HelmRelease: kube-system/snapshot-controller Role: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller Role: kube-system/snapshot-controller

@@ -1,18 +0,0 @@

----
-kind: Role
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: snapshot-controller
-rules:
-- apiGroups:
-  - coordination.k8s.io
-  resources:
-  - leases
-  verbs:
-  - get
-  - watch
-  - list
-  - delete
-  - update
-  - create
-
--- HelmRelease: kube-system/snapshot-controller RoleBinding: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller RoleBinding: kube-system/snapshot-controller

@@ -1,13 +0,0 @@

----
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: snapshot-controller
-subjects:
-- kind: ServiceAccount
-  name: snapshot-controller
-roleRef:
-  kind: Role
-  name: snapshot-controller
-  apiGroup: rbac.authorization.k8s.io
-
--- HelmRelease: kube-system/snapshot-controller Service: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller Service: kube-system/snapshot-controller

@@ -1,19 +0,0 @@

----
-apiVersion: v1
-kind: Service
-metadata:
-  name: snapshot-controller
-  labels:
-    app.kubernetes.io/name: snapshot-controller
-    app.kubernetes.io/instance: snapshot-controller
-    app.kubernetes.io/managed-by: Helm
-spec:
-  clusterIP: None
-  ports:
-  - port: 8080
-    targetPort: 8080
-    name: http
-  selector:
-    app.kubernetes.io/name: snapshot-controller
-    app.kubernetes.io/instance: snapshot-controller
-
--- HelmRelease: kube-system/snapshot-controller Deployment: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller Deployment: kube-system/snapshot-controller

@@ -1,62 +0,0 @@

----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: snapshot-controller
-  labels:
-    app.kubernetes.io/name: snapshot-controller
-    app.kubernetes.io/instance: snapshot-controller
-    app.kubernetes.io/managed-by: Helm
-spec:
-  replicas: 1
-  revisionHistoryLimit: 10
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: snapshot-controller
-      app.kubernetes.io/instance: snapshot-controller
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: snapshot-controller
-        app.kubernetes.io/instance: snapshot-controller
-    spec:
-      serviceAccountName: snapshot-controller
-      securityContext: {}
-      containers:
-      - name: snapshot-controller
-        securityContext:
-          capabilities:
-            drop:
-            - ALL
-          readOnlyRootFilesystem: true
-          runAsNonRoot: true
-          runAsUser: 1000
-        image: registry.k8s.io/sig-storage/snapshot-controller:v8.2.0
-        imagePullPolicy: IfNotPresent
-        args:
-        - --http-endpoint=:8080
-        - --leader-election=true
-        - --leader-election-namespace=$(NAMESPACE)
-        ports:
-        - name: http
-          containerPort: 8080
-          protocol: TCP
-        readinessProbe:
-          httpGet:
-            port: http
-            path: /healthz/leader-election
-            scheme: HTTP
-        livenessProbe:
-          httpGet:
-            port: http
-            path: /healthz/leader-election
-            scheme: HTTP
-        env:
-        - name: NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        resources: {}
-      hostNetwork: false
-      dnsPolicy: ClusterFirst
-
--- HelmRelease: kube-system/snapshot-controller ServiceMonitor: kube-system/snapshot-controller

+++ HelmRelease: kube-system/snapshot-controller ServiceMonitor: kube-system/snapshot-controller

@@ -1,18 +0,0 @@

----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: snapshot-controller
-  labels:
-    app.kubernetes.io/name: snapshot-controller
-    app.kubernetes.io/instance: snapshot-controller
-    app.kubernetes.io/managed-by: Helm
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: snapshot-controller
-      app.kubernetes.io/instance: snapshot-controller
-  endpoints:
-  - port: http
-    path: /metrics
-
--- HelmRelease: backup-system/volsync ServiceAccount: backup-system/volsync

+++ HelmRelease: backup-system/volsync ServiceAccount: backup-system/volsync

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: volsync
+  labels:
+    app.kubernetes.io/name: volsync
+    app.kubernetes.io/instance: volsync
+    app.kubernetes.io/managed-by: Helm
+
--- HelmRelease: backup-system/volsync ClusterRole: backup-system/volsync-manager

+++ HelmRelease: backup-system/volsync ClusterRole: backup-system/volsync-manager

@@ -0,0 +1,302 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: volsync-manager
+  labels:
+    app.kubernetes.io/name: volsync
+    app.kubernetes.io/instance: volsync
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - jobs
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - update
+- apiGroups:
+  - ''
+  resources:
+  - namespaces
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - nodes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumeclaims/finalizers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumes
+  verbs:
+  - get
+  - list
+  - patch
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - pods/log
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - serviceaccounts
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - services
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - events.k8s.io
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+  - update
+- apiGroups:
+  - populator.storage.k8s.io
+  resources:
+  - volumepopulators
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - rolebindings
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - rbac.authorization.k8s.io
+  resources:
+  - roles
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - security.openshift.io
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - create
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - security.openshift.io
+  resourceNames:
+  - volsync-privileged-mover
+  resources:
+  - securitycontextconstraints
+  verbs:
+  - use
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots
+  verbs:
+  - create
+  - delete
+  - deletecollection
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - storageclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - volsync.backube
+  resources:
+  - replicationdestinations
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - volsync.backube
+  resources:
+  - replicationdestinations/finalizers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - volsync.backube
+  resources:
+  - replicationdestinations/status
+  verbs:
+  - get
+  - patch
+  - update
+- apiGroups:
+  - volsync.backube
+  resources:
+  - replicationsources
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - volsync.backube
+  resources:
+  - replicationsources/finalizers
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - volsync.backube
+  resources:
+  - replicationsources/status
+  verbs:
+  - get
+  - patch
+  - update
+
--- HelmRelease: backup-system/volsync ClusterRoleBinding: backup-system/volsync-manager

+++ HelmRelease: backup-system/volsync ClusterRoleBinding: backup-system/volsync-manager

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: volsync-manager
+  labels:
+    app.kubernetes.io/name: volsync
+    app.kubernetes.io/instance: volsync
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: volsync-manager
+subjects:
+- kind: ServiceAccount
+  name: volsync
+  namespace: backup-system
+
--- HelmRelease: backup-system/volsync Role: backup-system/volsync-leader-election

+++ HelmRelease: backup-system/volsync Role: backup-system/volsync-leader-election

@@ -0,0 +1,42 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: volsync-leader-election
+  labels:
+    app.kubernetes.io/name: volsync
+    app.kubernetes.io/instance: volsync
+    app.kubernetes.io/managed-by: Helm
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - list
+  - watch
+  - create
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+
--- HelmRelease: backup-system/volsync RoleBinding: backup-system/volsync-leader-election

+++ HelmRelease: backup-system/volsync RoleBinding: backup-system/volsync-leader-election

@@ -0,0 +1,18 @@

+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: volsync-leader-election
+  labels:
+    app.kubernetes.io/name: volsync
+    app.kubernetes.io/instance: volsync
+    app.kubernetes.io/managed-by: Helm
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: volsync-leader-election
+subjects:
+- kind: ServiceAccount
+  name: volsync
+  namespace: backup-system
+
--- HelmRelease: backup-system/volsync Service: backup-system/volsync-metrics

+++ HelmRelease: backup-system/volsync Service: backup-system/volsync-metrics

@@ -0,0 +1,18 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: volsync-metrics
+  labels:
+    control-plane: volsync-controller
+    app.kubernetes.io/name: volsync
+    app.kubernetes.io/instance: volsync
+    app.kubernetes.io/managed-by: Helm
+spec:
+  ports:
+  - name: https
+    port: 8443
+    targetPort: https
+  selector:
+    control-plane: volsync-controller
+
--- HelmRelease: backup-system/volsync Deployment: backup-system/volsync

+++ HelmRelease: backup-system/volsync Deployment: backup-system/volsync

@@ -0,0 +1,106 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: volsync
+  labels:
+    control-plane: volsync-controller
+    app.kubernetes.io/name: volsync
+    app.kubernetes.io/instance: volsync
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      control-plane: volsync-controller
+      app.kubernetes.io/name: volsync
+      app.kubernetes.io/instance: volsync
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: manager
+      labels:
+        control-plane: volsync-controller
+        app.kubernetes.io/name: volsync
+        app.kubernetes.io/instance: volsync
+    spec:
+      serviceAccountName: volsync
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+      containers:
+      - name: kube-rbac-proxy
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        image: quay.io/brancz/kube-rbac-proxy:v0.18.0
+        args:
+        - --secure-listen-address=0.0.0.0:8443
+        - --upstream=http://127.0.0.1:8080/
+        - --logtostderr=true
+        - --tls-min-version=VersionTLS12
+        - --v=0
+        - --ignore-paths=/metrics
+        ports:
+        - containerPort: 8443
+          protocol: TCP
+          name: https
+        resources:
+          limits:
+            cpu: 500m
+            memory: 128Mi
+          requests:
+            cpu: 5m
+            memory: 64Mi
+      - name: manager
+        args:
+        - --health-probe-bind-address=:8081
+        - --metrics-bind-address=127.0.0.1:8080
+        - --leader-elect
+        - --rclone-container-image=quay.io/backube/volsync:0.11.0
+        - --restic-container-image=quay.io/backube/volsync:0.11.0
+        - --rsync-container-image=quay.io/backube/volsync:0.11.0
+        - --rsync-tls-container-image=quay.io/backube/volsync:0.11.0
+        - --syncthing-container-image=quay.io/backube/volsync:0.11.0
+        - --scc-name=volsync-privileged-mover
+        command:
+        - /manager
+        image: quay.io/backube/volsync:0.11.0
+        imagePullPolicy: IfNotPresent
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8081
+          initialDelaySeconds: 15
+          periodSeconds: 20
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8081
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        resources:
+          limits:
+            cpu: 1000m
+            memory: 1Gi
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+        volumeMounts:
+        - name: tempdir
+          mountPath: /tmp
+      terminationGracePeriodSeconds: 10
+      volumes:
+      - name: tempdir
+        emptyDir:
+          medium: Memory
+
--- HelmRelease: kube-tools/snapshot-controller ServiceAccount: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller ServiceAccount: kube-tools/snapshot-controller

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+
--- HelmRelease: kube-tools/snapshot-controller ClusterRole: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller ClusterRole: kube-tools/snapshot-controller

@@ -0,0 +1,122 @@

+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumes
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ''
+  resources:
+  - persistentvolumeclaims
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+- apiGroups:
+  - ''
+  resources:
+  - events
+  verbs:
+  - list
+  - watch
+  - create
+  - update
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotcontents
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - delete
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshotcontents/status
+  verbs:
+  - patch
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - patch
+  - delete
+- apiGroups:
+  - snapshot.storage.k8s.io
+  resources:
+  - volumesnapshots/status
+  verbs:
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents
+  verbs:
+  - create
+  - get
+  - list
+  - watch
+  - update
+  - delete
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshotcontents/status
+  verbs:
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshots
+  verbs:
+  - get
+  - list
+  - watch
+  - update
+  - patch
+- apiGroups:
+  - groupsnapshot.storage.k8s.io
+  resources:
+  - volumegroupsnapshots/status
+  verbs:
+  - update
+  - patch
+
--- HelmRelease: kube-tools/snapshot-controller ClusterRoleBinding: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller ClusterRoleBinding: kube-tools/snapshot-controller

@@ -0,0 +1,14 @@

+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+subjects:
+- kind: ServiceAccount
+  name: snapshot-controller
+  namespace: kube-tools
+roleRef:
+  kind: ClusterRole
+  name: snapshot-controller
+  apiGroup: rbac.authorization.k8s.io
+
--- HelmRelease: kube-tools/snapshot-controller Role: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller Role: kube-tools/snapshot-controller

@@ -0,0 +1,18 @@

+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+rules:
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - get
+  - watch
+  - list
+  - delete
+  - update
+  - create
+
--- HelmRelease: kube-tools/snapshot-controller RoleBinding: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller RoleBinding: kube-tools/snapshot-controller

@@ -0,0 +1,13 @@

+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: snapshot-controller
+subjects:
+- kind: ServiceAccount
+  name: snapshot-controller
+roleRef:
+  kind: Role
+  name: snapshot-controller
+  apiGroup: rbac.authorization.k8s.io
+
--- HelmRelease: kube-tools/snapshot-controller Service: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller Service: kube-tools/snapshot-controller

@@ -0,0 +1,19 @@

+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+spec:
+  clusterIP: None
+  ports:
+  - port: 8080
+    targetPort: 8080
+    name: http
+  selector:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+
--- HelmRelease: kube-tools/snapshot-controller Deployment: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller Deployment: kube-tools/snapshot-controller

@@ -0,0 +1,62 @@

+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snapshot-controller
+      app.kubernetes.io/instance: snapshot-controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: snapshot-controller
+        app.kubernetes.io/instance: snapshot-controller
+    spec:
+      serviceAccountName: snapshot-controller
+      securityContext: {}
+      containers:
+      - name: snapshot-controller
+        securityContext:
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 1000
+        image: registry.k8s.io/sig-storage/snapshot-controller:v8.2.0
+        imagePullPolicy: IfNotPresent
+        args:
+        - --http-endpoint=:8080
+        - --leader-election=true
+        - --leader-election-namespace=$(NAMESPACE)
+        ports:
+        - name: http
+          containerPort: 8080
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            port: http
+            path: /healthz/leader-election
+            scheme: HTTP
+        livenessProbe:
+          httpGet:
+            port: http
+            path: /healthz/leader-election
+            scheme: HTTP
+        env:
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        resources: {}
+      hostNetwork: false
+      dnsPolicy: ClusterFirst
+
--- HelmRelease: kube-tools/snapshot-controller ServiceMonitor: kube-tools/snapshot-controller

+++ HelmRelease: kube-tools/snapshot-controller ServiceMonitor: kube-tools/snapshot-controller

@@ -0,0 +1,18 @@

+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: snapshot-controller
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    app.kubernetes.io/instance: snapshot-controller
+    app.kubernetes.io/managed-by: Helm
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: snapshot-controller
+      app.kubernetes.io/instance: snapshot-controller
+  endpoints:
+  - port: http
+    path: /metrics
+

[tyriis-automation]

--- kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: kube-system/snapshot-controller

+++ kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: kube-system/snapshot-controller

@@ -1,35 +0,0 @@

----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  labels:
-    kustomize.toolkit.fluxcd.io/name: snapshot-controller
-    kustomize.toolkit.fluxcd.io/namespace: flux-system
-  name: snapshot-controller
-  namespace: kube-system
-spec:
-  chart:
-    spec:
-      chart: snapshot-controller
-      sourceRef:
-        kind: HelmRepository
-        name: piraeus-charts
-        namespace: flux-system
-      version: 4.0.0
-  install:
-    crds: CreateReplace
-    remediation:
-      retries: 3
-  interval: 30m
-  upgrade:
-    cleanupOnFail: true
-    crds: CreateReplace
-    remediation:
-      retries: 3
-      strategy: rollback
-  values:
-    controller:
-      replicaCount: 1
-      serviceMonitor:
-        create: faLse
-
--- kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: kube-tools/snapshot-controller

+++ kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app Kustomization: flux-system/snapshot-controller HelmRelease: kube-tools/snapshot-controller

@@ -0,0 +1,36 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: snapshot-controller
+    kustomize.toolkit.fluxcd.io/name: snapshot-controller
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: snapshot-controller
+  namespace: kube-tools
+spec:
+  chart:
+    spec:
+      chart: snapshot-controller
+      sourceRef:
+        kind: HelmRepository
+        name: piraeus-charts
+        namespace: flux-system
+      version: 4.0.0
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  interval: 30m
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+      strategy: rollback
+  values:
+    controller:
+      replicaCount: 1
+      serviceMonitor:
+        create: faLse
+
--- kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/snapshot-controller

+++ kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/snapshot-controller

@@ -6,12 +6,15 @@

     kustomize.toolkit.fluxcd.io/name: flux-apps
     kustomize.toolkit.fluxcd.io/namespace: flux-system
     substitution.flux.home.arpa/enabled: 'true'
   name: snapshot-controller
   namespace: flux-system
 spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: snapshot-controller
   decryption:
     provider: sops
     secretRef:
       name: sops-age
   interval: 10m
   path: ./kubernetes/kube-nas/apps/kube-tools/snapshot-controller/app
@@ -22,8 +25,9 @@

     - kind: Secret
       name: cluster-secrets
   prune: true
   sourceRef:
     kind: GitRepository
     name: home-ops
+  targetNamespace: kube-tools
   wait: true
 
--- kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Namespace: flux-system/backup-system

+++ kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Namespace: flux-system/backup-system

@@ -0,0 +1,10 @@

+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: flux-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+    kustomize.toolkit.fluxcd.io/prune: disabled
+  name: backup-system
+
--- kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/volsync

+++ kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/volsync

@@ -0,0 +1,36 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: flux-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+    substitution.flux.home.arpa/enabled: 'true'
+  name: volsync
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: volsync
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: snapshot-controller
+  interval: 10m
+  path: ./kubernetes/kube-nas/apps/backup-system/volsync/app
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-ops
+  targetNamespace: backup-system
+  timeout: 3m
+  wait: true
+
--- kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/openebs-volume-snapshot-class

+++ kubernetes/kube-nas/apps Kustomization: flux-system/flux-apps Kustomization: flux-system/openebs-volume-snapshot-class

@@ -0,0 +1,37 @@

+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  labels:
+    kustomize.toolkit.fluxcd.io/name: flux-apps
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: openebs-volume-snapshot-class
+  namespace: flux-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: openebs-volume-snapshot-class
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+  - name: openebs
+  - name: snapshot-controller
+  interval: 10m
+  path: ./kubernetes/kube-nas/apps/openebs-system/openebs/volume-snapshot-class
+  postBuild:
+    substituteFrom:
+    - kind: ConfigMap
+      name: cluster-settings
+    - kind: Secret
+      name: cluster-secrets
+  prune: false
+  retryInterval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: home-ops
+  targetNamespace: openebs-system
+  timeout: 5m
+  wait: true
+
--- kubernetes/kube-nas/apps/openebs-system/openebs/volume-snapshot-class Kustomization: flux-system/openebs-volume-snapshot-class VolumeSnapshotClass: openebs-system/openebs-snapshot-class

+++ kubernetes/kube-nas/apps/openebs-system/openebs/volume-snapshot-class Kustomization: flux-system/openebs-volume-snapshot-class VolumeSnapshotClass: openebs-system/openebs-snapshot-class

@@ -0,0 +1,13 @@

+---
+apiVersion: snapshot.storage.k8s.io/v1
+deletionPolicy: Delete
+driver: openebs.io/local
+kind: VolumeSnapshotClass
+metadata:
+  labels:
+    app.kubernetes.io/name: openebs-volume-snapshot-class
+    kustomize.toolkit.fluxcd.io/name: openebs-volume-snapshot-class
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: openebs-snapshot-class
+  namespace: openebs-system
+
--- kubernetes/kube-nas/apps/backup-system/volsync/app Kustomization: flux-system/volsync HelmRelease: backup-system/volsync

+++ kubernetes/kube-nas/apps/backup-system/volsync/app Kustomization: flux-system/volsync HelmRelease: backup-system/volsync

@@ -0,0 +1,36 @@

+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  labels:
+    app.kubernetes.io/name: volsync
+    kustomize.toolkit.fluxcd.io/name: volsync
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: volsync
+  namespace: backup-system
+spec:
+  chart:
+    spec:
+      chart: volsync
+      sourceRef:
+        kind: HelmRepository
+        name: backube-charts
+        namespace: flux-system
+      version: 0.11.0
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  interval: 15m
+  maxHistory: 15
+  uninstall:
+    keepHistory: false
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    manageCRDs: true
+    metrics:
+      disableAuth: true
+

[tyriis]

#4287

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud