399 lines
11 KiB
JSON
399 lines
11 KiB
JSON
{
|
|
"cicd_mode": {
|
|
"authentication": {
|
|
"auth_type": "token",
|
|
"ssh_key_storage": "kms",
|
|
"token_config": {
|
|
"expiry_seconds": 3600,
|
|
"refresh_enabled": false,
|
|
"token_format": "jwt",
|
|
"token_path": "/var/run/secrets/provisioning/token"
|
|
}
|
|
},
|
|
"description": "CI/CD pipeline automated execution",
|
|
"extensions": {
|
|
"oci_registry": {
|
|
"auth_token_path": "/var/run/secrets/provisioning/oci-token",
|
|
"cache_dir": "/tmp/provisioning-oci-cache",
|
|
"enabled": true,
|
|
"endpoint": "registry.cicd.local",
|
|
"namespace": "cicd-extensions",
|
|
"tls_enabled": true,
|
|
"verify_ssl": true
|
|
},
|
|
"source": "oci"
|
|
},
|
|
"mode_name": "cicd",
|
|
"resource_limits": {
|
|
"max_cpu_cores_per_user": 16,
|
|
"max_memory_gb_per_user": 64,
|
|
"max_servers_per_user": 5,
|
|
"max_storage_gb_per_user": 200
|
|
},
|
|
"security": {
|
|
"audit_log_path": "/var/log/provisioning/cicd-audit.log",
|
|
"audit_logging": true,
|
|
"dns_modification": "coredns",
|
|
"encryption_at_rest": true,
|
|
"encryption_in_transit": true,
|
|
"network_isolation": true,
|
|
"secret_provider": {
|
|
"provider": "vault"
|
|
}
|
|
},
|
|
"services": {
|
|
"control_center": {
|
|
"deployment": "disabled"
|
|
},
|
|
"coredns": {
|
|
"deployment": "remote",
|
|
"remote_config": {
|
|
"endpoint": "dns.cicd.local",
|
|
"port": 53
|
|
}
|
|
},
|
|
"gitea": {
|
|
"deployment": "remote",
|
|
"remote_config": {
|
|
"endpoint": "git.cicd.local",
|
|
"port": 443,
|
|
"tls_enabled": true
|
|
}
|
|
},
|
|
"oci_registry": {
|
|
"auth_required": true,
|
|
"deployment": "remote",
|
|
"endpoint": "registry.cicd.local",
|
|
"namespaces": {
|
|
"extensions": "cicd-extensions",
|
|
"kcl_packages": "cicd-kcl",
|
|
"platform_images": "cicd-platform",
|
|
"test_images": "cicd-test"
|
|
},
|
|
"remote": {
|
|
"retries": 5,
|
|
"timeout": 60,
|
|
"verify_ssl": true
|
|
},
|
|
"tls_enabled": true,
|
|
"type": "harbor"
|
|
},
|
|
"orchestrator": {
|
|
"deployment": "remote",
|
|
"remote_config": {
|
|
"endpoint": "orchestrator.cicd.local",
|
|
"port": 8080,
|
|
"retries": 5,
|
|
"timeout": 60,
|
|
"tls_enabled": true,
|
|
"verify_ssl": true
|
|
}
|
|
}
|
|
},
|
|
"workspaces": {
|
|
"git_integration": "required",
|
|
"isolation": "strict",
|
|
"locking": "disabled",
|
|
"max_workspaces_per_user": 1
|
|
}
|
|
},
|
|
"enterprise_mode": {
|
|
"authentication": {
|
|
"auth_type": "mtls",
|
|
"mtls_config": {
|
|
"ca_cert_path": "/etc/provisioning/certs/ca.crt",
|
|
"client_cert_path": "/etc/provisioning/certs/client.crt",
|
|
"client_key_path": "/etc/provisioning/certs/client.key",
|
|
"verify_server": true
|
|
},
|
|
"ssh_key_storage": "kms"
|
|
},
|
|
"description": "Production enterprise deployment with full security",
|
|
"extensions": {
|
|
"oci_registry": {
|
|
"auth_token_path": "/etc/provisioning/tokens/oci",
|
|
"cache_dir": "/var/cache/provisioning/oci",
|
|
"enabled": true,
|
|
"endpoint": "harbor.enterprise.local",
|
|
"namespace": "prod-extensions",
|
|
"tls_enabled": true,
|
|
"verify_ssl": true
|
|
},
|
|
"source": "oci"
|
|
},
|
|
"mode_name": "enterprise",
|
|
"resource_limits": {
|
|
"max_cpu_cores_per_user": 64,
|
|
"max_memory_gb_per_user": 256,
|
|
"max_servers_per_user": 20,
|
|
"max_storage_gb_per_user": 1000,
|
|
"max_total_cpu_cores": 2000,
|
|
"max_total_memory_gb": 8192,
|
|
"max_total_servers": 500
|
|
},
|
|
"security": {
|
|
"audit_log_path": "/var/log/provisioning/enterprise-audit.log",
|
|
"audit_logging": true,
|
|
"dns_modification": "system",
|
|
"encryption_at_rest": true,
|
|
"encryption_in_transit": true,
|
|
"network_isolation": true,
|
|
"secret_provider": {
|
|
"provider": "vault"
|
|
}
|
|
},
|
|
"services": {
|
|
"control_center": {
|
|
"deployment": "k8s",
|
|
"k8s_config": {
|
|
"deployment_name": "control-center",
|
|
"image": "harbor.enterprise.local/provisioning/control-center:latest",
|
|
"namespace": "provisioning-system",
|
|
"replicas": 2,
|
|
"service_name": "control-center-svc"
|
|
}
|
|
},
|
|
"coredns": {
|
|
"deployment": "k8s",
|
|
"k8s_config": {
|
|
"deployment_name": "coredns",
|
|
"image": "registry.k8s.io/coredns/coredns:latest",
|
|
"namespace": "kube-system",
|
|
"replicas": 2,
|
|
"service_name": "kube-dns"
|
|
}
|
|
},
|
|
"gitea": {
|
|
"deployment": "k8s",
|
|
"k8s_config": {
|
|
"deployment_name": "gitea",
|
|
"image": "gitea/gitea:latest",
|
|
"namespace": "provisioning-system",
|
|
"replicas": 2,
|
|
"service_name": "gitea-svc"
|
|
}
|
|
},
|
|
"oci_registry": {
|
|
"auth_required": true,
|
|
"deployment": "remote",
|
|
"endpoint": "harbor.enterprise.local",
|
|
"namespaces": {
|
|
"extensions": "prod-extensions",
|
|
"kcl_packages": "prod-kcl",
|
|
"platform_images": "prod-platform",
|
|
"test_images": "test-images"
|
|
},
|
|
"remote": {
|
|
"retries": 5,
|
|
"timeout": 60,
|
|
"verify_ssl": true
|
|
},
|
|
"tls_enabled": true,
|
|
"type": "harbor"
|
|
},
|
|
"orchestrator": {
|
|
"deployment": "k8s",
|
|
"k8s_config": {
|
|
"deployment_name": "orchestrator",
|
|
"image": "harbor.enterprise.local/provisioning/orchestrator:latest",
|
|
"namespace": "provisioning-system",
|
|
"replicas": 3,
|
|
"resources": {
|
|
"cpu_limit": "2000m",
|
|
"cpu_request": "500m",
|
|
"memory_limit": "4Gi",
|
|
"memory_request": "1Gi"
|
|
},
|
|
"service_name": "orchestrator-svc"
|
|
}
|
|
}
|
|
},
|
|
"workspaces": {
|
|
"git_integration": "required",
|
|
"isolation": "strict",
|
|
"lock_provider": "etcd",
|
|
"locking": "required",
|
|
"max_workspaces_per_user": 3
|
|
}
|
|
},
|
|
"multiuser_mode": {
|
|
"authentication": {
|
|
"auth_type": "token",
|
|
"ssh_key_storage": "local",
|
|
"token_config": {
|
|
"expiry_seconds": 86400,
|
|
"refresh_enabled": true,
|
|
"token_format": "jwt",
|
|
"token_path": "~/.provisioning/tokens/auth"
|
|
}
|
|
},
|
|
"description": "Team collaboration with shared services",
|
|
"extensions": {
|
|
"oci_registry": {
|
|
"auth_token_path": "~/.provisioning/tokens/oci",
|
|
"cache_dir": "~/.provisioning/oci-cache",
|
|
"enabled": true,
|
|
"endpoint": "harbor.company.local",
|
|
"namespace": "provisioning-extensions",
|
|
"tls_enabled": true,
|
|
"verify_ssl": true
|
|
},
|
|
"source": "oci"
|
|
},
|
|
"mode_name": "multi_user",
|
|
"resource_limits": {
|
|
"max_cpu_cores_per_user": 32,
|
|
"max_memory_gb_per_user": 128,
|
|
"max_servers_per_user": 10,
|
|
"max_storage_gb_per_user": 500,
|
|
"max_total_cpu_cores": 320,
|
|
"max_total_memory_gb": 1024,
|
|
"max_total_servers": 100
|
|
},
|
|
"security": {
|
|
"audit_log_path": "/var/log/provisioning/audit.log",
|
|
"audit_logging": true,
|
|
"dns_modification": "coredns",
|
|
"encryption_at_rest": false,
|
|
"encryption_in_transit": true,
|
|
"network_isolation": false,
|
|
"secret_provider": {
|
|
"provider": "sops"
|
|
}
|
|
},
|
|
"services": {
|
|
"control_center": {
|
|
"deployment": "remote",
|
|
"remote_config": {
|
|
"endpoint": "control.company.local",
|
|
"port": 8081,
|
|
"tls_enabled": true
|
|
}
|
|
},
|
|
"coredns": {
|
|
"deployment": "remote",
|
|
"remote_config": {
|
|
"endpoint": "dns.company.local",
|
|
"port": 53,
|
|
"tls_enabled": false
|
|
}
|
|
},
|
|
"gitea": {
|
|
"deployment": "remote",
|
|
"remote_config": {
|
|
"endpoint": "git.company.local",
|
|
"port": 443,
|
|
"tls_enabled": true
|
|
}
|
|
},
|
|
"oci_registry": {
|
|
"auth_required": true,
|
|
"deployment": "remote",
|
|
"endpoint": "harbor.company.local",
|
|
"namespaces": {
|
|
"extensions": "provisioning-extensions",
|
|
"kcl_packages": "provisioning-kcl",
|
|
"platform_images": "provisioning-platform",
|
|
"test_images": "provisioning-test"
|
|
},
|
|
"remote": {
|
|
"retries": 3,
|
|
"timeout": 30,
|
|
"verify_ssl": true
|
|
},
|
|
"tls_enabled": true,
|
|
"type": "harbor"
|
|
},
|
|
"orchestrator": {
|
|
"deployment": "remote",
|
|
"remote_config": {
|
|
"endpoint": "orchestrator.company.local",
|
|
"port": 8080,
|
|
"retries": 3,
|
|
"timeout": 30,
|
|
"tls_enabled": true,
|
|
"verify_ssl": true
|
|
}
|
|
}
|
|
},
|
|
"workspaces": {
|
|
"git_integration": "required",
|
|
"isolation": "user",
|
|
"lock_provider": "gitea",
|
|
"locking": "enabled",
|
|
"max_workspaces_per_user": 5
|
|
}
|
|
},
|
|
"solo_mode": {
|
|
"authentication": {
|
|
"auth_type": "none",
|
|
"ssh_key_storage": "local"
|
|
},
|
|
"description": "Single developer local development mode",
|
|
"extensions": {
|
|
"allow_mixed": true,
|
|
"local_path": "./provisioning/extensions",
|
|
"source": "local"
|
|
},
|
|
"mode_name": "solo",
|
|
"resource_limits": {
|
|
"max_cpu_cores_per_user": 32,
|
|
"max_memory_gb_per_user": 128,
|
|
"max_servers_per_user": 10,
|
|
"max_storage_gb_per_user": 500
|
|
},
|
|
"security": {
|
|
"audit_logging": false,
|
|
"dns_modification": "none",
|
|
"encryption_at_rest": false,
|
|
"encryption_in_transit": false,
|
|
"network_isolation": false,
|
|
"secret_provider": {
|
|
"provider": "sops"
|
|
}
|
|
},
|
|
"services": {
|
|
"control_center": {
|
|
"deployment": "disabled"
|
|
},
|
|
"coredns": {
|
|
"deployment": "disabled"
|
|
},
|
|
"gitea": {
|
|
"deployment": "disabled"
|
|
},
|
|
"oci_registry": {
|
|
"auth_required": false,
|
|
"deployment": "local",
|
|
"endpoint": "localhost",
|
|
"local": {
|
|
"auto_start": false,
|
|
"config_path": "~/.provisioning/oci-registry/config.json",
|
|
"data_dir": "~/.provisioning/oci-registry"
|
|
},
|
|
"namespaces": {
|
|
"extensions": "dev-extensions",
|
|
"kcl_packages": "dev-kcl",
|
|
"platform_images": "dev-platform",
|
|
"test_images": "dev-test"
|
|
},
|
|
"port": 5000,
|
|
"tls_enabled": false,
|
|
"type": "zot"
|
|
},
|
|
"orchestrator": {
|
|
"auto_start": true,
|
|
"deployment": "local",
|
|
"local_config": {
|
|
"data_dir": "~/.provisioning/orchestrator",
|
|
"port": 8080
|
|
}
|
|
}
|
|
},
|
|
"workspaces": {
|
|
"git_integration": "optional",
|
|
"isolation": "none",
|
|
"locking": "disabled"
|
|
}
|
|
}
|
|
}
|