mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 06:24:42 +02:00
alkatrazz
edf4a6294d
- k8s/apps/authentik : IdP OIDC (auth.lab.local), namespace auth — server + worker 2026.5.3, Redis in-cluster, PG sur storage-01, PVC media - k8s/apps/guacamole : portail consoles SSH web s01/g01 (portail.lab.local) — guacd + webapp 1.6.0, SSO OIDC vers Authentik, Job initdb idempotent - ansible : rôle console_user (user sans sudo pour les consoles, s01 + g01), bases PG authentik/guacamole, secrets vault (mdp PG + clé SSH console) - doc : admin/k8s/auth-portal.md (déploiement, config initiale, pièges) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
68 lines
2.1 KiB
YAML
68 lines
2.1 KiB
YAML
# Pose le schéma Guacamole dans la base « guacamole » (storage-01) si absent.
|
|
# Hook ArgoCD : recréé à chaque sync, mais le garde-fou (table guacamole_user)
|
|
# le rend idempotent — il ne rejoue jamais le schéma sur une base déjà peuplée.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: guacamole-initdb
|
|
namespace: auth
|
|
annotations:
|
|
argocd.argoproj.io/hook: Sync
|
|
argocd.argoproj.io/hook-delete-policy: BeforeHookCreation
|
|
spec:
|
|
backoffLimit: 3
|
|
template:
|
|
spec:
|
|
restartPolicy: Never
|
|
initContainers:
|
|
- name: generate-schema
|
|
image: guacamole/guacamole:1.6.0
|
|
command: ["sh", "-c", "/opt/guacamole/bin/initdb.sh --postgresql > /work/initdb.sql"]
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|
|
containers:
|
|
- name: apply-schema
|
|
image: postgres:16-alpine
|
|
command:
|
|
- sh
|
|
- -c
|
|
- |
|
|
if psql -tAc "SELECT 1 FROM information_schema.tables WHERE table_name='guacamole_user'" | grep -q 1; then
|
|
echo "Schéma déjà présent — rien à faire"
|
|
else
|
|
psql -v ON_ERROR_STOP=1 -f /work/initdb.sql
|
|
echo "Schéma Guacamole appliqué"
|
|
fi
|
|
env:
|
|
- name: PGHOST
|
|
value: "192.168.10.1"
|
|
- name: PGDATABASE
|
|
value: "guacamole"
|
|
- name: PGUSER
|
|
value: "guacamole"
|
|
- name: PGPASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: guacamole-secret
|
|
key: pg-password
|
|
volumeMounts:
|
|
- name: work
|
|
mountPath: /work
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 250m
|
|
memory: 128Mi
|
|
volumes:
|
|
- name: work
|
|
emptyDir: {}
|