2026-10-09 02:35:14 +07:00
|
|
|
|
# =============================================================================
|
|
|
|
|
|
# cluster.p1.yml — simulasi "P1": host EXISTING (dikelola pihak lain) + cluster 3 host
|
|
|
|
|
|
# -----------------------------------------------------------------------------
|
|
|
|
|
|
# Skenario P1:
|
|
|
|
|
|
# - Host `existing` menjalankan IAM/storage fase 1–2 SENDIRI (single-host):
|
|
|
|
|
|
# keycloak, openldap, postgres, minio, nessie → port HOST 12xxx dipublikasikan
|
|
|
|
|
|
# (12080 / 12389 / 12900 / 12120 …). TIDAK di-deploy dari berkas ini.
|
|
|
|
|
|
# - Cluster (control/compute/state) menjalankan SISANYA dan memakai keycloak/openldap/
|
|
|
|
|
|
# minio/nessie EXISTING lewat alamat DI ATAS + port yang dipublikasikan.
|
|
|
|
|
|
#
|
2026-10-11 13:59:47 +07:00
|
|
|
|
# Runbook lengkap (teruji): docs/sicabe-p1-existing-runbook.md
|
|
|
|
|
|
#
|
2026-10-09 02:35:14 +07:00
|
|
|
|
# CARA PAKAI
|
|
|
|
|
|
# # di control (sumber .env cluster), TAMBAHKAN ke deploy/.env:
|
|
|
|
|
|
# KEYCLOAK_INTERNAL_PORT=12080 # <-- port HOST keycloak existing (bukan 8080)
|
|
|
|
|
|
# OPENLDAP_INTERNAL_PORT=12389
|
|
|
|
|
|
# MINIO_INTERNAL_PORT=12900
|
|
|
|
|
|
# NESSIE_INTERNAL_PORT=12120
|
|
|
|
|
|
# # POSTGRES_INTERNAL_PORT tetap 5432 (postgres milik cluster di `state`)
|
|
|
|
|
|
#
|
|
|
|
|
|
# # WAJIB: SALIN nilai IAM & storage existing ke .env cluster SEBELUM --generate
|
|
|
|
|
|
# # (bundle MENYALIN .env). Kalau beda → OIDC / LDAP bind / S3 GAGAL:
|
|
|
|
|
|
# LDAP_ADMIN_PASSWORD=... # = password bind di host existing
|
|
|
|
|
|
# TRINO_CLIENT_SECRET=... STARROCKS_CLIENT_SECRET=... AIRFLOW_CLIENT_SECRET=...
|
|
|
|
|
|
# OPENMETADATA_CLIENT_SECRET=... GRAFANA_CLIENT_SECRET=...
|
|
|
|
|
|
# MINIO_ROOT_USER=... MINIO_ROOT_PASSWORD=... # = kredensial MinIO existing (S3)
|
|
|
|
|
|
# # Ambil dari .env host existing (atau ./scripts/print-*.sh di host itu).
|
|
|
|
|
|
# # Diubah SETELAH --generate → ulangi --generate + --sync (bundle embed nilai lama).
|
|
|
|
|
|
#
|
|
|
|
|
|
# ./install.sh --generate --inventory cluster.p1.yml
|
|
|
|
|
|
# ./install.sh --sync
|
|
|
|
|
|
# ./install.sh --host control # dan compute, state
|
|
|
|
|
|
#
|
|
|
|
|
|
# PENTING (host EXISTING): set `KEYCLOAK_SSL_REQUIRED=none` di .env host existing lalu
|
|
|
|
|
|
# jalankan `./bootstrap.sh` (idempoten). Dengan default `external`, HTTP dari alamat
|
|
|
|
|
|
# Tailscale 100.64/10 — dianggap NON-lokal oleh Keycloak — DITOLAK ("HTTPS required"),
|
|
|
|
|
|
# sehingga cluster tak bisa OIDC walau jaringan lancar. Lihat juga
|
|
|
|
|
|
# docs/keycloak-existing-requirements.md §2.
|
|
|
|
|
|
#
|
|
|
|
|
|
# PENTING (host EXISTING) — S3: set `S3_ENDPOINT=http://<alamat-existing>:12900` di .env
|
|
|
|
|
|
# host existing lalu recreate nessie. Sling memakai iceberg-go yang meminta
|
|
|
|
|
|
# `X-Iceberg-Access-Delegation: vended-credentials`; Nessie meng-vend `s3.endpoint` dari
|
|
|
|
|
|
# konfigurasinya (`minio:9000` internal) dan endpoint-vended MENANG atas `s3_endpoint` di
|
|
|
|
|
|
# ~/.sling/env.yaml → klien di host lain menembak `minio:9000` (gagal). Mengarahkan
|
|
|
|
|
|
# S3_ENDPOINT existing ke alamat publik membuat yang di-vend reachable.
|
|
|
|
|
|
#
|
|
|
|
|
|
# CATATAN: host `existing` hanya sebagai PENANDA tempat komponen — JANGAN deploy
|
|
|
|
|
|
# `generated/host-existing/` (itu akan mengarahkan keycloak/nessie-nya ke postgres
|
|
|
|
|
|
# cluster). Host existing tetap instalasi single-host fase 1–2.
|
|
|
|
|
|
# =============================================================================
|
|
|
|
|
|
|
|
|
|
|
|
version: 1
|
|
|
|
|
|
cluster:
|
|
|
|
|
|
name: sicabe-p1
|
|
|
|
|
|
env: simulation
|
|
|
|
|
|
|
|
|
|
|
|
tls:
|
|
|
|
|
|
mode: none
|
|
|
|
|
|
|
|
|
|
|
|
preset: a3
|
|
|
|
|
|
|
|
|
|
|
|
hosts:
|
|
|
|
|
|
# Host EXISTING (pihak lain) — hanya untuk resolusi endpoint & kelengkapan inventory.
|
|
|
|
|
|
existing:
|
|
|
|
|
|
address: 100.93.54.108
|
|
|
|
|
|
tiers: [identity] # keycloak, openldap, nessie
|
|
|
|
|
|
control:
|
|
|
|
|
|
address: 100.112.76.124
|
|
|
|
|
|
tiers: [policy, pipeline, governance]
|
|
|
|
|
|
compute:
|
|
|
|
|
|
address: 100.123.123.71
|
|
|
|
|
|
tiers: [coord, engine]
|
|
|
|
|
|
state:
|
|
|
|
|
|
address: 100.73.229.107
|
|
|
|
|
|
tiers: [state]
|
|
|
|
|
|
|
|
|
|
|
|
components:
|
|
|
|
|
|
minio: { host: existing } # minio ada di host existing (bukan cluster)
|
|
|
|
|
|
dremio: { enabled: false }
|
