setup prod

kustomize/bases/drone/drone-runner-deployment.yaml

@@ -91,6 +91,5 @@ spec:
     app.kubernetes.io/component: runner
   ports:
     - name: http
-      protocol: TCP
       port: 3000
       targetPort: http

kustomize/bases/drone/drone-server-deployment.yaml

@@ -68,6 +68,5 @@ spec:
     app.kubernetes.io/component: server
   ports:
     - name: http
-      protocol: TCP
       port: 80
       targetPort: http

kustomize/bases/gitea/gitea-deployment.yaml

@@ -5,7 +5,9 @@ metadata:
   labels:
     app.kubernetes.io/name: gitea
 spec:
-  replicas: 1 # replica count must be set to 1 in database is sqlite
+  replicas: 1 # gitea doesn't handle HA well
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: gitea
@@ -18,42 +20,22 @@ spec:
         - name: gitea
           image: gitea/gitea
           env:
-            # - name: INSTALL_LOCK
+            - name: GITEA__DEFAULT__APP_NAME
-            #   value: "yes"
-            - name: DISABLE_REGISTRATION
-              value: "yes"
-            - name: APP_NAME
               value: Badjware's code stash
-            - name: RUN_MODE
+            - name: GITEA__SERVICE__DISABLE_REGISTRATION
-              value: prod
+              value: "yes"
-            - name: ROOT_URL
+            - name: GITEA__SERVER__ROOT_URL
               value: https://${GITEA_EXTERNAL_HOST}
-            - name: SSH_DOMAIN
+            - name: GITEA__SERVER__SSH_DOMAIN
               value: ${GITEA_EXTERNAL_HOST}
+            - name: GITEA__SERVER__SSH_PORT
+              value: "30022"
             - name: GITEA__METRICS__ENABLED
               value: "true"
-            # - name: DB_TYPE
+            - name: GITEA__REPOSITORY__DISABLED_REPO_UNITS
-            #   value: postgres
+              value: repo.wiki
-            # - name: DB_HOST
+            - name: GITEA__REPOSITORY__DEFAULT_REPO_UNITS
-            #   valueFrom:
+              value: repo.code,repo.releases
-            #     secretKeyRef:
-            #       name: postgres-credentials-secret
-            #       key: host
-            # - name: DB_NAME
-            #   valueFrom:
-            #     secretKeyRef:
-            #       name: postgres-credentials-secret
-            #       key: database
-            # - name: DB_USER
-            #   valueFrom:
-            #     secretKeyRef:
-            #       name: postgres-credentials-secret
-            #       key: username
-            # - name: DB_PASSWD
-            #   valueFrom:
-            #     secretKeyRef:
-            #       name: postgres-credentials-secret
-            #       key: password
           ports:
             - name: http
               containerPort: 3000
@@ -119,10 +101,20 @@ spec:
     app.kubernetes.io/name: gitea
   ports:
     - name: http
-      protocol: TCP
       port: 80
       targetPort: http
-    - name: ssh
+---
-      protocol: TCP
+apiVersion: v1
-      port: 22
+kind: Service
-      targetPort: ssh
+metadata:
+  name: gitea-ssh
+  labels:
+    app.kubernetes.io/name: gitea
+spec:
+  type: NodePort
+  selector:
+    app.kubernetes.io/name: gitea
+  ports:
+    - port: 22
+      targetPort: ssh
+      nodePort: 30022

kustomize/bases/grafana/grafana-deployment.yaml

@@ -5,6 +5,9 @@ metadata:
   labels:
     app.kubernetes.io/name: grafana
 spec:
+  replicas: 1 # we can only have 1 replica for as long as the database is sqlite
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: grafana
@@ -107,6 +110,5 @@ spec:
     app.kubernetes.io/name: grafana
   ports:
     - name: http
-      protocol: TCP
       port: 3000
       targetPort: http

kustomize/bases/longhorn/kustomization.yaml

@@ -1,2 +1,3 @@
 resources:
-  - https://raw.githubusercontent.com/longhorn/longhorn/v1.2.0/deploy/longhorn.yaml
+  - https://raw.githubusercontent.com/longhorn/longhorn/v1.2.0/deploy/longhorn.yaml
+  - longhorn-ingress.yaml

kustomize/bases/longhorn/longhorn-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: longhorn-frontend
+  namespace: longhorn-system
+  labels:
+    app.kubernetes.io/name: longhorn-ui
+spec:
+  rules:
+  - host: ${LONGHORN_EXTERNAL_HOST}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: longhorn-frontend
+            port:
+              name: http

kustomize/bases/nextcloud/nextcloud-deployment.yaml

@@ -94,6 +94,5 @@ spec:
     app.kubernetes.io/name: nextcloud
   ports:
     - name: http
-      protocol: TCP
       port: 80
       targetPort: http

kustomize/bases/node-exporter/node-exporter-daemonset.yaml

@@ -63,5 +63,4 @@ spec:
   ports:
   - name: http-metrics
     port: 9100
-    protocol: TCP
     targetPort: http-metrics

kustomize/overlays/prod-cluster/kustomization.yaml

@@ -7,3 +7,6 @@ bases:
 # allow "kubectl apply -l managed-by=cluster --prune ..."
 commonlabels:
   managed-by: kustomize-cluster
+
+transformers:
+  - transformers/placeholders.yaml

kustomize/overlays/prod-cluster/placeholders.txt

@@ -0,0 +1 @@
+LONGHORN_EXTERNAL_HOST=longhorn.badjnet.local

kustomize/overlays/prod-cluster/transformers/placeholders.yaml

@@ -0,0 +1,5 @@
+apiVersion: badjware/v1
+kind: PlaceholderTransformer
+metadata:
+  name: placeholders
+placeholdersFile: placeholders.txt

kustomize/overlays/prod-cluster/transformers/ssm-secrets.yaml

@@ -0,0 +1,6 @@
+apiVersion: badjware/v1
+kind: SSMParameterPlaceholderTransformer
+metadata:
+  name: ssm-parameter
+resourceSelectors:
+  - kind: Secret

kustomize/overlays/prod/kustomization.yaml

@@ -1,40 +1,40 @@
-# bases:
+bases:
-#   - ../../namespaces/kubernetes-dashboard
+  - ../../namespaces/kubernetes-dashboard
-#   - ../../namespaces/gitea
+  - ../../namespaces/gitea
-#   - ../../namespaces/grafana
+  - ../../namespaces/grafana
-#   - ../../namespaces/monitoring
+  - ../../namespaces/monitoring
 
-# images:
+images:
-#   - name: gitea/gitea
+  - name: gitea/gitea
-#     newtag: 1.15.0
+    newtag: 1.15.0
-#   - name: grafana
+  - name: grafana
-#     newtag: 8.1.2
+    newtag: 8.1.2
-#   - name: drone/drone
+  - name: drone/drone
-#     newtag: 2.0.6
+    newtag: 2.0.6
-#   - name: drone/drone-runner-kube
+  - name: drone/drone-runner-kube
-#     newtag: 1.0.0-beta.9
+    newtag: 1.0.0-beta.9
 
-# secretGenerator:
+secretGenerator:
-#   - name: drone-secret
+  - name: drone-secret
-#     type: Opaque
+    type: Opaque
-#     namespace: gitea
+    namespace: gitea
-#     behavior: replace
+    behavior: replace
-#     literals:
+    literals:
-#       - rpc_secret=9128146e66f104873df80dad3ef12cf0
+      - rpc_secret=${ssm:/k3s/prod/drone/gitea/rpc_secret}
-#   # https://docs.drone.io/server/provider/gitea/
+  # https://docs.drone.io/server/provider/gitea/
-#   - name: drone-gitea-oauth-secret
+  - name: drone-gitea-oauth-secret
-#     type: Opaque
+    type: Opaque
-#     namespace: gitea
+    namespace: gitea
-#     behavior: replace
+    behavior: replace
-#     literals:
+    literals:
-#       - client_id=6c0c6878-baf1-4648-b0cf-69eeae69e692
+      - client_id=${ssm:/k3s/prod/drone/gitea/client_id}
-#       - client_secret=Q78VsgyfgTzKrvQEmokEMj84g7epKrlBpmDjcbhKXCIh
+      - client_secret=${ssm:/k3s/prod/drone/gitea/client_secret}
 
-# # allow "kubectl apply -l managed-by=kustomize --prune ..."
+# allow "kubectl apply -l managed-by=kustomize --prune ..."
-# commonlabels:
+commonlabels:
-#   managed-by: kustomize
+  managed-by: kustomize
 
-# transformers:
+transformers:
-#   - transformers/placeholders.yaml
+  - transformers/placeholders.yaml
-#   # - transformers/ssm-secrets.yaml
+  - transformers/ssm-secrets.yaml