From f90e1bb0b5839fbf411aed505a9fee303fed8db2 Mon Sep 17 00:00:00 2001 From: Massaki Archambault Date: Thu, 26 Aug 2021 12:42:48 -0400 Subject: [PATCH] setup prod --- .../bases/drone/drone-runner-deployment.yaml | 1 - .../bases/drone/drone-server-deployment.yaml | 1 - kustomize/bases/gitea/gitea-deployment.yaml | 66 ++++++++--------- .../bases/grafana/grafana-deployment.yaml | 4 +- kustomize/bases/longhorn/kustomization.yaml | 3 +- .../bases/longhorn/longhorn-ingress.yaml | 19 +++++ .../bases/nextcloud/nextcloud-deployment.yaml | 1 - .../node-exporter-daemonset.yaml | 1 - .../overlays/prod-cluster/kustomization.yaml | 3 + .../overlays/prod-cluster/placeholders.txt | 1 + .../transformers/placeholders.yaml | 5 ++ .../transformers/ssm-secrets.yaml | 6 ++ kustomize/overlays/prod/kustomization.yaml | 70 +++++++++---------- 13 files changed, 103 insertions(+), 78 deletions(-) create mode 100644 kustomize/bases/longhorn/longhorn-ingress.yaml create mode 100644 kustomize/overlays/prod-cluster/placeholders.txt create mode 100644 kustomize/overlays/prod-cluster/transformers/placeholders.yaml create mode 100644 kustomize/overlays/prod-cluster/transformers/ssm-secrets.yaml diff --git a/kustomize/bases/drone/drone-runner-deployment.yaml b/kustomize/bases/drone/drone-runner-deployment.yaml index 33b40b5..af793e8 100644 --- a/kustomize/bases/drone/drone-runner-deployment.yaml +++ b/kustomize/bases/drone/drone-runner-deployment.yaml @@ -91,6 +91,5 @@ spec: app.kubernetes.io/component: runner ports: - name: http - protocol: TCP port: 3000 targetPort: http \ No newline at end of file diff --git a/kustomize/bases/drone/drone-server-deployment.yaml b/kustomize/bases/drone/drone-server-deployment.yaml index 1c2da85..10b6cd7 100644 --- a/kustomize/bases/drone/drone-server-deployment.yaml +++ b/kustomize/bases/drone/drone-server-deployment.yaml @@ -68,6 +68,5 @@ spec: app.kubernetes.io/component: server ports: - name: http - protocol: TCP port: 80 targetPort: http \ No newline at end of file diff --git a/kustomize/bases/gitea/gitea-deployment.yaml b/kustomize/bases/gitea/gitea-deployment.yaml index 09a78d4..a5ae2fa 100644 --- a/kustomize/bases/gitea/gitea-deployment.yaml +++ b/kustomize/bases/gitea/gitea-deployment.yaml @@ -5,7 +5,9 @@ metadata: labels: app.kubernetes.io/name: gitea spec: - replicas: 1 # replica count must be set to 1 in database is sqlite + replicas: 1 # gitea doesn't handle HA well + strategy: + type: Recreate selector: matchLabels: app.kubernetes.io/name: gitea @@ -18,42 +20,22 @@ spec: - name: gitea image: gitea/gitea env: - # - name: INSTALL_LOCK - # value: "yes" - - name: DISABLE_REGISTRATION - value: "yes" - - name: APP_NAME + - name: GITEA__DEFAULT__APP_NAME value: Badjware's code stash - - name: RUN_MODE - value: prod - - name: ROOT_URL + - name: GITEA__SERVICE__DISABLE_REGISTRATION + value: "yes" + - name: GITEA__SERVER__ROOT_URL value: https://${GITEA_EXTERNAL_HOST} - - name: SSH_DOMAIN + - name: GITEA__SERVER__SSH_DOMAIN value: ${GITEA_EXTERNAL_HOST} + - name: GITEA__SERVER__SSH_PORT + value: "30022" - name: GITEA__METRICS__ENABLED value: "true" - # - name: DB_TYPE - # value: postgres - # - name: DB_HOST - # valueFrom: - # secretKeyRef: - # name: postgres-credentials-secret - # key: host - # - name: DB_NAME - # valueFrom: - # secretKeyRef: - # name: postgres-credentials-secret - # key: database - # - name: DB_USER - # valueFrom: - # secretKeyRef: - # name: postgres-credentials-secret - # key: username - # - name: DB_PASSWD - # valueFrom: - # secretKeyRef: - # name: postgres-credentials-secret - # key: password + - name: GITEA__REPOSITORY__DISABLED_REPO_UNITS + value: repo.wiki + - name: GITEA__REPOSITORY__DEFAULT_REPO_UNITS + value: repo.code,repo.releases ports: - name: http containerPort: 3000 @@ -119,10 +101,20 @@ spec: app.kubernetes.io/name: gitea ports: - name: http - protocol: TCP port: 80 targetPort: http - - name: ssh - protocol: TCP - port: 22 - targetPort: ssh \ No newline at end of file +--- +apiVersion: v1 +kind: Service +metadata: + name: gitea-ssh + labels: + app.kubernetes.io/name: gitea +spec: + type: NodePort + selector: + app.kubernetes.io/name: gitea + ports: + - port: 22 + targetPort: ssh + nodePort: 30022 \ No newline at end of file diff --git a/kustomize/bases/grafana/grafana-deployment.yaml b/kustomize/bases/grafana/grafana-deployment.yaml index 6af296c..cfa39e6 100644 --- a/kustomize/bases/grafana/grafana-deployment.yaml +++ b/kustomize/bases/grafana/grafana-deployment.yaml @@ -5,6 +5,9 @@ metadata: labels: app.kubernetes.io/name: grafana spec: + replicas: 1 # we can only have 1 replica for as long as the database is sqlite + strategy: + type: Recreate selector: matchLabels: app.kubernetes.io/name: grafana @@ -107,6 +110,5 @@ spec: app.kubernetes.io/name: grafana ports: - name: http - protocol: TCP port: 3000 targetPort: http \ No newline at end of file diff --git a/kustomize/bases/longhorn/kustomization.yaml b/kustomize/bases/longhorn/kustomization.yaml index 393ecad..b2a706b 100644 --- a/kustomize/bases/longhorn/kustomization.yaml +++ b/kustomize/bases/longhorn/kustomization.yaml @@ -1,2 +1,3 @@ resources: - - https://raw.githubusercontent.com/longhorn/longhorn/v1.2.0/deploy/longhorn.yaml \ No newline at end of file + - https://raw.githubusercontent.com/longhorn/longhorn/v1.2.0/deploy/longhorn.yaml + - longhorn-ingress.yaml \ No newline at end of file diff --git a/kustomize/bases/longhorn/longhorn-ingress.yaml b/kustomize/bases/longhorn/longhorn-ingress.yaml new file mode 100644 index 0000000..adfa78c --- /dev/null +++ b/kustomize/bases/longhorn/longhorn-ingress.yaml @@ -0,0 +1,19 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: longhorn-frontend + namespace: longhorn-system + labels: + app.kubernetes.io/name: longhorn-ui +spec: + rules: + - host: ${LONGHORN_EXTERNAL_HOST} + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: longhorn-frontend + port: + name: http diff --git a/kustomize/bases/nextcloud/nextcloud-deployment.yaml b/kustomize/bases/nextcloud/nextcloud-deployment.yaml index 28b9de9..bc2bfdf 100644 --- a/kustomize/bases/nextcloud/nextcloud-deployment.yaml +++ b/kustomize/bases/nextcloud/nextcloud-deployment.yaml @@ -94,6 +94,5 @@ spec: app.kubernetes.io/name: nextcloud ports: - name: http - protocol: TCP port: 80 targetPort: http \ No newline at end of file diff --git a/kustomize/bases/node-exporter/node-exporter-daemonset.yaml b/kustomize/bases/node-exporter/node-exporter-daemonset.yaml index 5451e3c..001d783 100644 --- a/kustomize/bases/node-exporter/node-exporter-daemonset.yaml +++ b/kustomize/bases/node-exporter/node-exporter-daemonset.yaml @@ -63,5 +63,4 @@ spec: ports: - name: http-metrics port: 9100 - protocol: TCP targetPort: http-metrics \ No newline at end of file diff --git a/kustomize/overlays/prod-cluster/kustomization.yaml b/kustomize/overlays/prod-cluster/kustomization.yaml index 69f103b..63fb3af 100644 --- a/kustomize/overlays/prod-cluster/kustomization.yaml +++ b/kustomize/overlays/prod-cluster/kustomization.yaml @@ -7,3 +7,6 @@ bases: # allow "kubectl apply -l managed-by=cluster --prune ..." commonlabels: managed-by: kustomize-cluster + +transformers: + - transformers/placeholders.yaml diff --git a/kustomize/overlays/prod-cluster/placeholders.txt b/kustomize/overlays/prod-cluster/placeholders.txt new file mode 100644 index 0000000..5c5dc44 --- /dev/null +++ b/kustomize/overlays/prod-cluster/placeholders.txt @@ -0,0 +1 @@ +LONGHORN_EXTERNAL_HOST=longhorn.badjnet.local \ No newline at end of file diff --git a/kustomize/overlays/prod-cluster/transformers/placeholders.yaml b/kustomize/overlays/prod-cluster/transformers/placeholders.yaml new file mode 100644 index 0000000..e3e18dd --- /dev/null +++ b/kustomize/overlays/prod-cluster/transformers/placeholders.yaml @@ -0,0 +1,5 @@ +apiVersion: badjware/v1 +kind: PlaceholderTransformer +metadata: + name: placeholders +placeholdersFile: placeholders.txt \ No newline at end of file diff --git a/kustomize/overlays/prod-cluster/transformers/ssm-secrets.yaml b/kustomize/overlays/prod-cluster/transformers/ssm-secrets.yaml new file mode 100644 index 0000000..cc35d89 --- /dev/null +++ b/kustomize/overlays/prod-cluster/transformers/ssm-secrets.yaml @@ -0,0 +1,6 @@ +apiVersion: badjware/v1 +kind: SSMParameterPlaceholderTransformer +metadata: + name: ssm-parameter +resourceSelectors: + - kind: Secret \ No newline at end of file diff --git a/kustomize/overlays/prod/kustomization.yaml b/kustomize/overlays/prod/kustomization.yaml index 4c69e70..0fcdc2b 100644 --- a/kustomize/overlays/prod/kustomization.yaml +++ b/kustomize/overlays/prod/kustomization.yaml @@ -1,40 +1,40 @@ -# bases: -# - ../../namespaces/kubernetes-dashboard -# - ../../namespaces/gitea -# - ../../namespaces/grafana -# - ../../namespaces/monitoring +bases: + - ../../namespaces/kubernetes-dashboard + - ../../namespaces/gitea + - ../../namespaces/grafana + - ../../namespaces/monitoring -# images: -# - name: gitea/gitea -# newtag: 1.15.0 -# - name: grafana -# newtag: 8.1.2 -# - name: drone/drone -# newtag: 2.0.6 -# - name: drone/drone-runner-kube -# newtag: 1.0.0-beta.9 +images: + - name: gitea/gitea + newtag: 1.15.0 + - name: grafana + newtag: 8.1.2 + - name: drone/drone + newtag: 2.0.6 + - name: drone/drone-runner-kube + newtag: 1.0.0-beta.9 -# secretGenerator: -# - name: drone-secret -# type: Opaque -# namespace: gitea -# behavior: replace -# literals: -# - rpc_secret=9128146e66f104873df80dad3ef12cf0 -# # https://docs.drone.io/server/provider/gitea/ -# - name: drone-gitea-oauth-secret -# type: Opaque -# namespace: gitea -# behavior: replace -# literals: -# - client_id=6c0c6878-baf1-4648-b0cf-69eeae69e692 -# - client_secret=Q78VsgyfgTzKrvQEmokEMj84g7epKrlBpmDjcbhKXCIh +secretGenerator: + - name: drone-secret + type: Opaque + namespace: gitea + behavior: replace + literals: + - rpc_secret=${ssm:/k3s/prod/drone/gitea/rpc_secret} + # https://docs.drone.io/server/provider/gitea/ + - name: drone-gitea-oauth-secret + type: Opaque + namespace: gitea + behavior: replace + literals: + - client_id=${ssm:/k3s/prod/drone/gitea/client_id} + - client_secret=${ssm:/k3s/prod/drone/gitea/client_secret} -# # allow "kubectl apply -l managed-by=kustomize --prune ..." -# commonlabels: -# managed-by: kustomize +# allow "kubectl apply -l managed-by=kustomize --prune ..." +commonlabels: + managed-by: kustomize -# transformers: -# - transformers/placeholders.yaml -# # - transformers/ssm-secrets.yaml +transformers: + - transformers/placeholders.yaml + - transformers/ssm-secrets.yaml