platform/ksail.yaml at main · devantler-tech/platform · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# Local Talos + Docker development cluster.
# See docs/TEMPLATING.md for the fields a fork of this repo needs to edit.
---
apiVersion: ksail.io/v1alpha1
kind: Cluster
metadata:
  name: local
spec:
  cluster:
    distributionConfig: talos-local
    connection:
      context: admin@local
      timeout: 40m
    distribution: Talos
    provider: Docker
    cni: Cilium
    csi: Enabled
    gitOpsEngine: Flux
    certManager: Enabled
    metricsServer: Enabled
    policyEngine: Kyverno
    controlPlanes: 1
    # A small single-worker cluster: this is a thin manual test-bed for trying a
    # component out before promoting it to prod, not a prod-fidelity stand-in.
    # The core component set has no hard pod anti-affinity, so one worker is
    # enough. Raise this if you opt in a component you want to see spread across
    # nodes (e.g. multi-instance CNPG, Velero node-spread).
    workers: 1
    talos:
      extraPortMappings:
        - containerPort: 80
          hostPort: 80
        - containerPort: 443
          hostPort: 443
  workload:
    sourceDirectory: k8s
    kustomizationFile: clusters/local
    validation:
      # Evaluate semantic authorization controls against authored manifests and
      # the children rendered from every HelmRelease. This catches effective
      # RBAC that kubectl kustomize and the EKS source validator cannot see.
      rules: scripts/tests/production-authorization-rules.yaml
      # Skip CRs whose CRD-catalog schemas kubeconform cannot resolve during
      # `ksail workload validate` (requires ksail >= 7.26.0):
      #   - Coroot (coroot.com/v1): the datreeio catalog schema is stale
      #     (additionalProperties: false, missing newer fields like
      #     nodeAgent/clickhouse), so kubeconform rejects valid manifests.
      #   - MetricTemplate / Canary (flagger.app/v1beta1): the Flagger CRDs are
      #     installed by the flagger HelmRelease at runtime and are not in the
      #     catalog, so the MetricTemplates and the onboarded Canaries (umami,
      #     homepage) can't be schema-checked offline.
      #   - ResourceGraphDefinition (kro.run/v1alpha1): the catalog schema still
      #     predates KRO 0.9.2 and rejects its required `spec.schema.scope`.
      #     scripts/tests/test-rgd-template-static-scan.sh instead pins each
      #     complete RGD spec, requires Namespaced scope, and scans every child.
      #   - Tenant (kro.run/v1alpha1): the CRD is generated at runtime by the
      #     KRO controller from the tenant ResourceGraphDefinition (#1932), so
      #     no static schema exists in any catalog (same class as the Flagger
      #     runtime CRDs).
      skipKinds:
        - Coroot
        - MetricTemplate
        - Canary
        - ResourceGraphDefinition
        - Tenant
      # Consulted before the default CRD catalogue.
      schemaLocations:
        # Generated one-field correction from the pinned Kubescape Rules CRD.
        - schemas/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json