test rsync container with filebrowser

Author: brettinternet

.envrc

@@ -1,7 +1,6 @@
 #shellcheck disable=SC2148,SC2155
 export KUBECONFIG="$(expand_path ./kubeconfig)"
 export SOPS_AGE_KEY_FILE=$(expand_path ~/.config/sops/age/keys.txt)
-
 export LOCAL_ANSIBLE_PYTHON_INTERPRETER=$(which python)
 PATH_add "$(expand_path ./.venv/bin)"
 export VIRTUAL_ENV="$(expand_path ./.venv)"

.taskfiles/flux.yaml

@@ -95,6 +95,16 @@ tasks:
     requires:
       vars: ["cluster"]
 
+  # https://github.com/fluxcd/helm-controller/issues/454#issuecomment-962208864
+  retry:
+    desc: Restart specific helmrelease
+    cmds:
+      - flux --context {{.cluster}} suspend hr {{.hr}} -n {{.ns}}
+      - sleep 2
+      - flux --context {{.cluster}} resume hr {{.hr}} -n {{.ns}}
+    requires:
+      vars: ["cluster", "ns", "hr"]
+
   delete-tunnel:
     desc: |
       Force delete cloudflared tunnel release to stop external ingress

kubernetes/main/apps/default/filebrowser/app/helmrelease.yaml

@@ -60,6 +60,19 @@ spec:
                 cpu: 100m
               limits:
                 memory: 2Gi
+          # # 1. Disable `runAsNonRoot` for rsync container
+          # # 2. Add service on port 22
+          # rsync:
+          #   image:
+          #     repository: docker.io/axiom/rsync-server
+          #     tag: latest
+          #   env:
+          #     USERNAME: root
+          #     PASSWORD: asdf
+          #     AUTHORIZED_KEYS: ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDPaYZO7t/sFHOXXf/GJZz2mmoR91jHZtA8Zp0FlgXvBXJ1JJx/0MQa3iFzssdKe9pSSA/rNduDl38EFdye2r66LdD/0z0Id3xIhZ2noD/rNr7kslkzmZTdCfnY7mWIYjdZfXdTqicJTSms0RkC9mJoLQqhUMIIgXe5ZvQJPuPFaVWDUMTou6kdUUBcVJ/Y19BbGu86dc1QXM+qThzZRLr5tjLLR6Edy7Du+bckBHmoGhfMa+hSOaJklucpvzeB4GeEwQnilGuFzkRjUQv0d/P0Ytuamu1IJiqmUCZEkuQlifNQZp/b6+mfN3RHhKV8qwRpXN3bPTWBBAcNpdRVXtP575fiQfa7/soglz9GH9u7E8r/jabECu+rcwOgX1b1TQ0ZxIQJwyj6T0A5RKsoDAdKOSKIYGmFw75k2Lft4tn2cFLC/OvbMYaDpum3VmFSMn6DjSbxjWZ3BpMVJzmXzW8h363GANL6CEWlnf/rXO3M2EcMmOFr00ekAL0HAYIbQbk=
+          #   securityContext:
+          #     allowPrivilegeEscalation: false
+          #     runAsUser: 0
     defaultPodOptions:
       securityContext:
         runAsNonRoot: true
@@ -75,6 +88,15 @@ spec:
         ports:
           http:
             port: *port
+      # rsync:
+      #   controller: filebrowser
+      #   type: LoadBalancer
+      #   annotations:
+      #     io.cilium/lb-ipam-ips: "${LB_SSH_SERVER_ADDR}"
+      #   ports:
+      #     rsync:
+      #       port: 22
+      #       protocol: TCP
     ingress:
       app:
         className: internal

kubernetes/main/apps/default/ssh-server/app/helmrelease.yaml

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Usage:  create WIP commit
 #         push to current branch