78 lines
3.5 KiB
YAML
78 lines
3.5 KiB
YAML
# =============================================================================
|
||
# cluster.p1.yml — simulasi "P1": host EXISTING (dikelola pihak lain) + cluster 3 host
|
||
# -----------------------------------------------------------------------------
|
||
# Skenario P1:
|
||
# - Host `existing` menjalankan IAM/storage fase 1–2 SENDIRI (single-host):
|
||
# keycloak, openldap, postgres, minio, nessie → port HOST 12xxx dipublikasikan
|
||
# (12080 / 12389 / 12900 / 12120 …). TIDAK di-deploy dari berkas ini.
|
||
# - Cluster (control/compute/state) menjalankan SISANYA dan memakai keycloak/openldap/
|
||
# minio/nessie EXISTING lewat alamat DI ATAS + port yang dipublikasikan.
|
||
#
|
||
# CARA PAKAI
|
||
# # di control (sumber .env cluster), TAMBAHKAN ke deploy/.env:
|
||
# KEYCLOAK_INTERNAL_PORT=12080 # <-- port HOST keycloak existing (bukan 8080)
|
||
# OPENLDAP_INTERNAL_PORT=12389
|
||
# MINIO_INTERNAL_PORT=12900
|
||
# NESSIE_INTERNAL_PORT=12120
|
||
# # POSTGRES_INTERNAL_PORT tetap 5432 (postgres milik cluster di `state`)
|
||
#
|
||
# # WAJIB: SALIN nilai IAM & storage existing ke .env cluster SEBELUM --generate
|
||
# # (bundle MENYALIN .env). Kalau beda → OIDC / LDAP bind / S3 GAGAL:
|
||
# LDAP_ADMIN_PASSWORD=... # = password bind di host existing
|
||
# TRINO_CLIENT_SECRET=... STARROCKS_CLIENT_SECRET=... AIRFLOW_CLIENT_SECRET=...
|
||
# OPENMETADATA_CLIENT_SECRET=... GRAFANA_CLIENT_SECRET=...
|
||
# MINIO_ROOT_USER=... MINIO_ROOT_PASSWORD=... # = kredensial MinIO existing (S3)
|
||
# # Ambil dari .env host existing (atau ./scripts/print-*.sh di host itu).
|
||
# # Diubah SETELAH --generate → ulangi --generate + --sync (bundle embed nilai lama).
|
||
#
|
||
# ./install.sh --generate --inventory cluster.p1.yml
|
||
# ./install.sh --sync
|
||
# ./install.sh --host control # dan compute, state
|
||
#
|
||
# PENTING (host EXISTING): set `KEYCLOAK_SSL_REQUIRED=none` di .env host existing lalu
|
||
# jalankan `./bootstrap.sh` (idempoten). Dengan default `external`, HTTP dari alamat
|
||
# Tailscale 100.64/10 — dianggap NON-lokal oleh Keycloak — DITOLAK ("HTTPS required"),
|
||
# sehingga cluster tak bisa OIDC walau jaringan lancar. Lihat juga
|
||
# docs/keycloak-existing-requirements.md §2.
|
||
#
|
||
# PENTING (host EXISTING) — S3: set `S3_ENDPOINT=http://<alamat-existing>:12900` di .env
|
||
# host existing lalu recreate nessie. Sling memakai iceberg-go yang meminta
|
||
# `X-Iceberg-Access-Delegation: vended-credentials`; Nessie meng-vend `s3.endpoint` dari
|
||
# konfigurasinya (`minio:9000` internal) dan endpoint-vended MENANG atas `s3_endpoint` di
|
||
# ~/.sling/env.yaml → klien di host lain menembak `minio:9000` (gagal). Mengarahkan
|
||
# S3_ENDPOINT existing ke alamat publik membuat yang di-vend reachable.
|
||
#
|
||
# CATATAN: host `existing` hanya sebagai PENANDA tempat komponen — JANGAN deploy
|
||
# `generated/host-existing/` (itu akan mengarahkan keycloak/nessie-nya ke postgres
|
||
# cluster). Host existing tetap instalasi single-host fase 1–2.
|
||
# =============================================================================
|
||
|
||
version: 1
|
||
cluster:
|
||
name: sicabe-p1
|
||
env: simulation
|
||
|
||
tls:
|
||
mode: none
|
||
|
||
preset: a3
|
||
|
||
hosts:
|
||
# Host EXISTING (pihak lain) — hanya untuk resolusi endpoint & kelengkapan inventory.
|
||
existing:
|
||
address: 100.93.54.108
|
||
tiers: [identity] # keycloak, openldap, nessie
|
||
control:
|
||
address: 100.112.76.124
|
||
tiers: [policy, pipeline, governance]
|
||
compute:
|
||
address: 100.123.123.71
|
||
tiers: [coord, engine]
|
||
state:
|
||
address: 100.73.229.107
|
||
tiers: [state]
|
||
|
||
components:
|
||
minio: { host: existing } # minio ada di host existing (bukan cluster)
|
||
dremio: { enabled: false }
|