jakman85andClaude Opus 4.8
41d696e9fe
With the config PVC now writable (fsGroup), semaphore got past config write and pinged its PostgreSQL successfully, then crashed on: panic: value of field 'Port' is not valid: tcp://<svcIP>:3000 Because the Service is named `semaphore`, the kubelet injects the Docker-link-style SEMAPHORE_PORT=tcp://<clusterIP>:3000, which collides with Semaphore's OWN SEMAPHORE_PORT (its HTTP listen port). Add an explicit SEMAPHORE_PORT=":3000" env entry — user-defined env takes precedence over service-link vars — pinning the listen port back to :3000 (matches containerPort/Service). Uses the existing env field; only apps/semaphore.yaml changes, all others byte-identical. Co-Authored-By: Claude Opus 4.8 <[email protected]>
123 lines
6.8 KiB
YAML
123 lines
6.8 KiB
YAML
# ServiceDefinition: semaphore
|
|
# Source of truth: spec docs/13-service-catalog.md row 10; docs/15-identity-and-access.md; docs/04.
|
|
# internal Ansible UI | egress internet | config on Longhorn + external PostgreSQL | auth oidc.
|
|
#
|
|
# Semaphore (semaphoreui/semaphore) is a web UI for running Ansible/Terraform. It is a stateless
|
|
# app over (a) its /etc/semaphore config PVC on Longhorn and (b) an external PostgreSQL — the
|
|
# SECOND CNPG-DB app, reusing the pattern nextcloud established (apps/nextcloud-db.yaml). Its DB is
|
|
# a CloudNativePG Cluster in a dedicated namespace (apps/semaphore-db.yaml).
|
|
#
|
|
# DB WIRING (schema >=1.2.0 env): the app reaches its PostgreSQL cross-namespace at
|
|
# semaphore-db-rw.semaphore-db:5432 (the CNPG read-write Service). Its owner credentials are the
|
|
# SAME password held in two SOPS secrets — semaphore-db-app (basic-auth, ns semaphore-db; consumed
|
|
# by the CNPG Cluster's initdb) and semaphore-bootstrap (ns semaphore; consumed here as db-password).
|
|
# A Pod can only read Secrets in its OWN namespace, so the shared password is duplicated across the
|
|
# two encrypted files rather than replicated cross-namespace (documented in apps/semaphore-db.yaml).
|
|
#
|
|
# PERSISTENT ENCRYPTION KEY: SEMAPHORE_ACCESS_KEY_ENCRYPTION is a base64 32-byte AES key Semaphore
|
|
# uses to encrypt the SSH keys / access credentials it stores in the DB. It MUST be FIXED and stable
|
|
# across restarts — if it changes, every stored credential becomes undecryptable. It is pinned via
|
|
# the semaphore-bootstrap SOPS secret (like gitea's SECRET_KEY), never regenerated per boot.
|
|
# Validates against schemas/servicedefinition.schema.json.
|
|
name: semaphore
|
|
kind: container
|
|
source:
|
|
image: semaphoreui/semaphore:v2.19.10 # pinned recent stable tag (R-UPD-01); update.range governs advancement
|
|
env:
|
|
# --- PostgreSQL connection (the CNPG-DB pattern). DIALECT/HOST/PORT/DB/USER are literals; PASS is
|
|
# sourced from the in-namespace SOPS secret (the CNPG -app secret lives in ns semaphore-db,
|
|
# unreachable by a Pod secretKeyRef, so the same value is mirrored into semaphore-bootstrap). ---
|
|
- name: SEMAPHORE_DB_DIALECT
|
|
value: postgres
|
|
- name: SEMAPHORE_DB_HOST
|
|
value: semaphore-db-rw.semaphore-db.svc.cluster.local
|
|
- name: SEMAPHORE_DB_PORT
|
|
value: "5432"
|
|
- name: SEMAPHORE_DB
|
|
value: semaphore
|
|
- name: SEMAPHORE_DB_USER
|
|
value: semaphore
|
|
- name: SEMAPHORE_DB_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: semaphore-bootstrap
|
|
key: db-password
|
|
# --- Break-glass local admin (docs/15 availability caveat): created on first-boot so the operator
|
|
# is never locked out by an IdP outage. Username/password sourced from the SOPS secret; the
|
|
# display name + email are non-sensitive literals. ---
|
|
- name: SEMAPHORE_ADMIN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: semaphore-bootstrap
|
|
key: admin-username
|
|
- name: SEMAPHORE_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: semaphore-bootstrap
|
|
key: admin-password
|
|
- name: SEMAPHORE_ADMIN_NAME
|
|
value: Semaphore Admin
|
|
- name: SEMAPHORE_ADMIN_EMAIL
|
|
value: [email protected]
|
|
# --- Persistent access-key encryption key (see header): FIXED base64 32-byte key from SOPS so the
|
|
# SSH keys / credentials Semaphore stores in the DB stay decryptable across restarts. ---
|
|
- name: SEMAPHORE_ACCESS_KEY_ENCRYPTION
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: semaphore-bootstrap
|
|
key: access-key-encryption
|
|
# Because the Service is named `semaphore`, the kubelet injects a Docker-link-style
|
|
# SEMAPHORE_PORT=tcp://<svcIP>:3000 env var, which COLLIDES with Semaphore's OWN SEMAPHORE_PORT
|
|
# (its HTTP listen port) and crashes config validation ("field 'Port' is not valid: tcp://..."). An
|
|
# explicit env entry shadows the injected one (the kubelet gives user-defined env precedence over
|
|
# service links), pinning the listen port back to :3000 (matches containerPort/Service).
|
|
- name: SEMAPHORE_PORT
|
|
value: ":3000"
|
|
# The semaphoreui/semaphore image runs as the non-root user UID 1001 / GID 0 (tini -> server-wrapper),
|
|
# and on boot the wrapper writes its generated config.json into the config dir. A mounted Longhorn PVC
|
|
# is root:root, so UID 1001 cannot write it -> the pod panics ("permission denied"). fsGroup=1001 makes
|
|
# the kubelet group-own the mounted PVC to 1001 and add it as a supplemental group so the process can
|
|
# write; runAsUser/runAsGroup pin the image's own identity, runAsNonRoot asserts it (R-STATE-01/02).
|
|
podSecurityContext:
|
|
runAsUser: 1001
|
|
runAsGroup: 0
|
|
runAsNonRoot: true
|
|
fsGroup: 1001
|
|
exposure: internal # LAN-only (internal DNS + Gateway on LAN); not edge-forwarded (docs/09; R-DNS/R-NET)
|
|
egress: internet # normal WAN egress (docs/03; R-NET-05) — clones repos, installs Galaxy roles
|
|
storage:
|
|
- name: config
|
|
size: 1Gi
|
|
class: longhorn # config (generated config.json, tmp inventories) on the 3-replica tier
|
|
mountPath: /etc/semaphore # Semaphore reads/writes its config under /etc/semaphore (R-STATE-02)
|
|
dependencies:
|
|
- to: semaphore-db # explicit allow: Semaphore -> its PostgreSQL (docs/13 graph; R-NET-02).
|
|
port: 5432 # Renders the egress half; the DB namespace mirrors keycloak-db (no
|
|
protocol: tcp # default-deny), so Cilium's default-allow accepts the reciprocal ingress.
|
|
ingressRoutes:
|
|
- host: semaphore.home.keithjackson.dev
|
|
port: 3000 # Semaphore HTTP web/API; wildcard TLS terminates at the shared Gateway (docs/08/09)
|
|
auth:
|
|
mode: oidc # native Keycloak OIDC client (docs/13 SSO row, docs/15 "Native OIDC"; R-IDP-02)
|
|
groups:
|
|
- platform-admins # access scoped to an authorized group (R-IDP-06)
|
|
# NOTE (OIDC follow-up + break-glass): like Gitea/Nextcloud (docs/15 "Availability caveat"),
|
|
# Semaphore keeps a LOCAL admin as the break-glass path so an IdP outage never locks the operator
|
|
# out. At initial deploy it comes up on that local admin (SEMAPHORE_ADMIN* env above). The Keycloak
|
|
# `semaphore` realm client + Semaphore's OIDC provider config (config.json `oidc_providers`) is a
|
|
# DEFERRED follow-up: wiring it means editing the reconciled realm import in platform-config (a
|
|
# malformed edit fails the whole platform-config apply / can leave the realm import PENDING) — so it
|
|
# is deferred rather than risking the running Keycloak realm / Flux source. This records the target
|
|
# integration; it embeds no secret.
|
|
update:
|
|
channel: stable # R-UPD-01
|
|
range: ">=2.19.0 <3.0.0" # stay on the 2.x stable line
|
|
cadence: "0 4 * * *"
|
|
autoRollbackOnFailedHealth: true # R-UPD-03
|
|
observability:
|
|
metrics: true
|
|
slis:
|
|
- up # automation UI down is a critical alert (docs/10; R-OBS-01)
|
|
backup:
|
|
policy: daily-offcluster # DR-critical: its DB holds automation credentials, backed up off-cluster (docs/13, docs/04; R-STATE-03)
|