K3S-HOME/storage
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
169 Commits 1 Branch 0 Tags
3088cde155f3bbd59956ac27bc259bb7d7dced41
Commit Graph

29 Commits

Author SHA1 Message Date
Mayne0213
3088cde155 PERF(storage): remove CPU limits for stability 
- Remove CPU limits from storage components
- Prevents CPU throttling issues
 2026-01-12 02:17:00 +09:00
Mayne0213
46bb39ed9e PERF(storage): optimize resources via VPA 
- cnpg: CPU 15m/15m, memory 100Mi/100Mi
- minio: CPU 48m/104m, memory 126Mi/183Mi
- pgweb: CPU 15m/15m, memory 100Mi/100Mi
- velero: CPU 10m/14m, memory 50Mi/50Mi
- velero-node-agent: CPU 15m/15m, memory 100Mi/100Mi
- zot: CPU 15m/15m, memory 100Mi/248Mi
 2026-01-12 01:08:45 +09:00
Mayne0213
38cf6abc0b refactor: update Vault secret paths to new categorized structure 
- minio: minio → storage/minio, minio-s3-credentials → storage/minio-s3-credentials
- pgweb: pgweb → storage/pgweb
- postgresql: postgresql → storage/postgresql
- velero: minio → storage/minio, velero → storage/velero
- zot: zot → storage/zot

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-11 22:36:38 +09:00
Mayne0213
e9b509d15f PERF(zot): increase memory to 256Mi 
- Double memory request from 121Mi to 256Mi
- Double memory limit from 121Mi to 256Mi
- Fix OOM during image push operations
 2026-01-11 22:12:51 +09:00
Mayne0213
d38634bbb7 migrate: change repoURLs from GitHub to Gitea 
Update all ArgoCD Application references to use Gitea (github0213.com)
instead of GitHub for K3S-HOME/storage repository.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
 2026-01-10 20:43:32 +09:00
Mayne0213
485b588a7e PERF(storage): adjust resources based on VPA 
- Update minio memory 263Mi→175Mi
- Update cnpg memory 128Mi→121Mi
- Update zot memory 128Mi→121Mi
- Update velero memory 128Mi→75Mi
- Update velero nodeAgent memory 256Mi→100Mi
 2026-01-10 14:34:29 +09:00
Mayne0213
e92e05b98f PERF(zot): scale down to single replica 
- Reduce replicas from 2 to 1
- Remove Redis session driver (no longer needed)
- Remove podAntiAffinity configuration
 2026-01-10 03:21:16 +09:00
Mayne0213
1fa6ff5edd FIX: Use sessionKeysFile for Zot OIDC session encryption 
- Change from hashKeyFile/blockKeyFile inside sessionDriver to
  sessionKeysFile at auth config level
- Update ExternalSecret to generate session-keys.json with both
  hashKey and encryptKey in correct JSON format
- Fix securecookie validation error during OIDC callback
 2026-01-10 03:09:28 +09:00
Mayne0213
b7eb527782 FIX(zot): add session keys for consistent cookie handling 
- Add ExternalSecret for session hashKey and blockKey
- Mount session keys from Vault
- Configure sessionDriver with key files
- Fix securecookie validation error in multi-replica setup
 2026-01-10 03:00:53 +09:00
Mayne0213
f16a9e9c6c FIX(zot): use generic oidc provider name 
- Change provider key from 'authelia' to 'oidc'
- Zot only supports: github, google, gitlab, oidc
 2026-01-10 01:20:17 +09:00
Mayne0213
c6a51cfaf5 FEAT(zot): add Authelia OIDC authentication 
- Add OpenID provider configuration for Authelia
- Create ExternalSecret for OIDC credentials
- Mount credentials file at /etc/zot/oidc-credentials.json
 2026-01-10 01:20:17 +09:00
Mayne0213
9167b1a14d FIX(zot): correct sessionDriver config key name 
- Fix configuration key for Redis session driver
- Ensure proper session storage configuration
 2026-01-10 01:20:16 +09:00
Mayne0213
65002c29ef FEAT(zot): add Redis session store for multi-replica support 
- Use Authelia Redis for session storage
- Fixes login redirect loop with replicas > 1
 2026-01-10 01:20:09 +09:00
Mayne0213
f3240e72aa REVERT(zot): remove non-working rawResources middleware 
- Remove Traefik middleware configuration
- Restore default CSP headers
 2026-01-10 01:20:02 +09:00
Mayne0213
06c35588e3 FIX(zot): add Traefik middleware to fix CSP header for UI 
- Add blob: to script-src directive
- Add unsafe-eval for UI functionality
- Fix Content Security Policy for proper UI rendering
 2026-01-10 01:19:56 +09:00
Mayne0213
228b0c06c4 FIX(zot): add externalUrl for proper session cookie handling 
- Configure external URL for proper session management
- Fix cookie handling for proxy setup
 2026-01-10 01:19:49 +09:00
Mayne0213
ff5574c840 REVERT(zot): remove accessControl, restore original auth config 
- Revert accessControl configuration
- Restore original authentication setup
 2026-01-10 01:19:43 +09:00
Mayne0213
37bbfbb5d2 FIX(zot): revert invalid anonymousPolicy at root level 
- Remove invalid root-level anonymousPolicy
- Fix configuration validation error
 2026-01-10 01:19:37 +09:00
Mayne0213
32b0a11178 FIX(zot): add global anonymousPolicy for UI access 
- Add global anonymous read policy
- Allow UI to load without authentication
 2026-01-10 01:19:31 +09:00
Mayne0213
3587a8c826 FIX(zot): correct accessControl format with repositories wrapper 
- Add repositories wrapper around repo configurations
- Fix configuration schema validation error
 2026-01-10 01:19:24 +09:00
Mayne0213
72c1399f99 FEAT(zot): enable anonymous read access for UI 
- Add accessControl with anonymousPolicy for read operations
- Keep authentication required for push (create/update/delete)
- Fixes UI login redirect loop issue
 2026-01-10 01:19:18 +09:00
Mayne0213
6cc795c3ef CHORE(resources): set memory limits equal to memory requests 
Align memory limits with memory requests for guaranteed QoS class.
- velero: main, nodeAgent
- postgresql: cluster
- minio: console
- zot, cnpg, pgweb
 2026-01-09 21:46:58 +09:00
Mayne0213
669dfcfb67 REFACTOR(zot): remove control-plane toleration 
- Zot is a container registry, no need to run on master
- Already distributed across worker nodes via anti-affinity
 2026-01-09 21:46:40 +09:00
Mayne0213
613ef5984e REFACTOR(repo): standardize taint to control-plane 
- Change node-role.kubernetes.io/master to control-plane
- Update velero, zot, postgresql, minio tolerations
- Change effect from NoExecute to NoSchedule (K3s standard)
 2026-01-09 21:46:40 +09:00
Mayne0213
c0e4bfeb66 PERF(zot): add HA with 2 replicas 
- Increase replicas from 1 to 2 for high availability
- Add soft pod anti-affinity to distribute across nodes
 2026-01-08 17:46:44 +09:00
Mayne0213
381b7cda3f FEAT(minio): add ClusterExternalSecret for S3 credentials 
- Add minio-s3-credentials ClusterExternalSecret
- Auto-create secret in namespaces with minio-s3: enabled label
- Add minio-s3 label to zot namespace via managedNamespaceMetadata
- Credentials stored in Vault at secret/minio-s3-credentials
 2026-01-08 17:15:50 +09:00
Mayne0213
cbbd7fc20f FEAT(zot): migrate storage from local PVC to S3 (MinIO) 
- Change from StatefulSet to Deployment (no PVC needed)
- Add S3 storageDriver configuration for MinIO backend
- Use minio-s3-credentials secret for AWS credentials
- Remove 50Gi local-path PVC
- Increase memory limit to 256Mi
 2026-01-08 17:09:45 +09:00
Mayne0213
35df7aa64e PERF(resources): remove CPU limits - keep memory limits only 
- CPU throttling prevents app startup, not crashes
- Memory OOM is the real cascading failure cause
- CPU request ensures fair scheduling
 2026-01-07 23:48:47 +09:00
Mayne0213
03f17000e9 FEAT(zot): add Zot container registry 
- ARM64 image (ghcr.io/project-zot/zot-linux-arm64:v2.1.13)
- htpasswd authentication via Vault ExternalSecret
- Ingress at zot0213.kro.kr with Let's Encrypt TLS
- local-path storage (50Gi)
- Prometheus metrics enabled
 2026-01-07 14:31:04 +09:00