Skip to content

Commit 6345d66

Browse files
ubergesundheitubergesundheit
committed
New repository structure
0 parents  commit 6345d66

28 files changed

+782
-0
lines changed

‎.github/workflows/test-on-pr.yaml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: 'check manifests'
2+
on: pull_request
3+
4+
jobs:
5+
lint:
6+
name: "Lint kustomization"
7+
runs-on: ubuntu-latest
8+
steps:
9+
- name: 'checkout'
10+
uses: actions/checkout@v4
11+
12+
- name: Build and validate kustomization
13+
uses: ubergesundheit/kube-check-action@main
14+
with:
15+
kustomize_build_input: sync
16+
kube-linter_flags: "--config .kube-linter.yaml"
17+
kubeconform_flags: "-strict -kubernetes-version 1.28.9 -schema-location 'https://raw.githubusercontent.com/ubergesundheit/kube-check-action/main/kubeconform-schemas/{{.ResourceKind}}.json' -schema-location 'https://raw.githubusercontent.com/datreeio/CRDs-catalog/main/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json' -schema-location default"

‎.gitignore

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
secrets/
2+
terraform/scaleway-config.tfvars
3+
DEVNOTES.md
4+
temp/
5+
*.key

‎.kube-linter.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
checks:
2+
exclude:
3+
- unset-cpu-requirements
4+
- unset-memory-requirements

‎.sops.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
creation_rules:
2+
- encrypted_regex: ^(data|stringData)$
3+
path_regex: apps/*/*
4+
age: >-
5+
age1nzqaqzm7wfz04ld5esukhkghmayzt8xmnrjlau0rdcycjlu53pesgew089

‎LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Deployment on Kubernetes
2+
3+
License: [MIT](LICENSE)
4+
5+
## Old master
6+
7+
Old master branch has been preserved in [`old-master`](https://github.com/codeformuenster/kubernetes-deployment/tree/old-master) branch.
8+
9+
## Encrypted secrets
10+
11+
Secrets in this repository should be encrypted using [SOPS](https://github.com/mozilla/sops) and [age](https://github.com/FiloSottile/age).
12+
13+
```
14+
# decrypt
15+
SOPS_AGE_KEY_FILE=/path/to/your/key.txt sops --output path/to/file --decrypt path/to/sops-secret.file
16+
17+
# edit ...
18+
19+
# encrypt again (public age key comes from the .sops.yaml)
20+
sops --output path/to/sops-secret.file -e path/to/file
21+
```

‎addons/clusterissuer.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: ClusterIssuer
3+
metadata:
4+
name: letsencrypt-c4m
5+
spec:
6+
acme:
7+
email: [email protected]
8+
server: https://acme-v02.api.letsencrypt.org/directory
9+
privateKeySecretRef:
10+
name: letsencrypt-c4m-issuer-account-key
11+
solvers:
12+
- http01:
13+
ingress:
14+
class: changeme

‎addons/kustomization.yaml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- ./clusterissuer.yaml

‎apps/crashes/kustomization.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
namespace: c4m-crashes
5+
6+
resources:
7+
- ../../base/namespace-pss-restricted
8+
- ./postgis.yaml
9+
- ./shiny.yaml
10+
11+
labels:
12+
- includeSelectors: true
13+
pairs:
14+
app.kubernetes.io/part-of: crashfals

‎apps/crashes/postgis.yaml

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: postgis
5+
labels:
6+
app.kubernetes.io/name: postgis
7+
app.kubernetes.io/component: database
8+
spec:
9+
ports:
10+
- name: postgres
11+
port: 5432
12+
protocol: TCP
13+
selector:
14+
app.kubernetes.io/name: postgis
15+
app.kubernetes.io/component: database
16+
17+
---
18+
apiVersion: v1
19+
kind: ServiceAccount
20+
metadata:
21+
name: postgis-crashes
22+
automountServiceAccountToken: false
23+
24+
---
25+
apiVersion: apps/v1
26+
kind: Deployment
27+
metadata:
28+
name: postgis
29+
annotations:
30+
"ignore-check.kube-linter.io/no-read-only-root-fs": "writable fs is required"
31+
labels:
32+
app.kubernetes.io/name: postgis
33+
app.kubernetes.io/component: database
34+
spec:
35+
selector:
36+
matchLabels:
37+
app.kubernetes.io/name: postgis
38+
app.kubernetes.io/component: database
39+
replicas: 1
40+
strategy:
41+
type: Recreate
42+
template:
43+
metadata:
44+
labels:
45+
app.kubernetes.io/name: postgis
46+
app.kubernetes.io/component: database
47+
spec:
48+
terminationGracePeriodSeconds: 10
49+
automountServiceAccountToken: false
50+
serviceAccountName: postgis-crashes
51+
containers:
52+
- name: postgis
53+
image: quay.io/codeformuenster/verkehrsunfaelle:2019-11-15
54+
ports:
55+
- name: postgres
56+
containerPort: 5432
57+
resources:
58+
requests:
59+
memory: "360Mi"
60+
cpu: "100m"
61+
securityContext:
62+
allowPrivilegeEscalation: false
63+
capabilities:
64+
drop:
65+
- ALL
66+
runAsGroup: 70
67+
runAsNonRoot: true
68+
runAsUser: 70
69+
seccompProfile:
70+
type: RuntimeDefault
71+
# limits:
72+
# cpu: "5000m"

‎apps/crashes/shiny.yaml

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
apiVersion: v1
2+
kind: Service
3+
metadata:
4+
name: shiny
5+
labels:
6+
app.kubernetes.io/name: shiny
7+
app.kubernetes.io/component: webserver
8+
spec:
9+
ports:
10+
- port: 3838
11+
selector:
12+
app.kubernetes.io/name: shiny
13+
app.kubernetes.io/component: webserver
14+
15+
---
16+
apiVersion: v1
17+
kind: ServiceAccount
18+
metadata:
19+
name: shiny-crashes
20+
automountServiceAccountToken: false
21+
22+
---
23+
apiVersion: networking.k8s.io/v1
24+
kind: Ingress
25+
metadata:
26+
name: shiny
27+
annotations:
28+
cert-manager.io/cluster-issuer: letsencrypt-c4m
29+
labels:
30+
app.kubernetes.io/name: shiny
31+
app.kubernetes.io/component: webserver
32+
spec:
33+
rules:
34+
- host: crashes.codeformuenster.org
35+
http:
36+
paths:
37+
- path: /
38+
pathType: Prefix
39+
backend:
40+
service:
41+
name: shiny
42+
port:
43+
number: 3838
44+
tls:
45+
- hosts:
46+
- crashes.codeformuenster.org
47+
secretName: crashes-tls
48+
49+
---
50+
apiVersion: apps/v1
51+
kind: Deployment
52+
metadata:
53+
name: shiny
54+
labels:
55+
app.kubernetes.io/name: shiny
56+
app.kubernetes.io/component: webserver
57+
spec:
58+
replicas: 1
59+
selector:
60+
matchLabels:
61+
app.kubernetes.io/name: shiny
62+
app.kubernetes.io/component: webserver
63+
template:
64+
metadata:
65+
labels:
66+
app.kubernetes.io/name: shiny
67+
app.kubernetes.io/component: webserver
68+
spec:
69+
automountServiceAccountToken: false
70+
serviceAccountName: shiny-crashes
71+
securityContext:
72+
fsGroup: 998
73+
containers:
74+
- name: shiny
75+
image: quay.io/codeformuenster/crashes-shiny:v6.7.2
76+
resources:
77+
requests:
78+
memory: "350Mi"
79+
cpu: "640m"
80+
ports:
81+
- containerPort: 3838
82+
env:
83+
- name: TMPDIR
84+
value: /tmp/shiny
85+
securityContext:
86+
allowPrivilegeEscalation: false
87+
capabilities:
88+
drop:
89+
- ALL
90+
readOnlyRootFilesystem: true
91+
runAsGroup: 998
92+
runAsNonRoot: true
93+
runAsUser: 998
94+
seccompProfile:
95+
type: RuntimeDefault
96+
volumeMounts:
97+
- name: renviron-file
98+
mountPath: /srv/shiny-server/.Renviron
99+
subPath: .Renviron
100+
- name: shiny-tmp
101+
mountPath: /var/log/shiny-server
102+
subPath: log
103+
- name: shiny-tmp
104+
mountPath: /var/lib/shiny-server
105+
subPath: lib
106+
- name: shiny-tmp
107+
mountPath: /tmp
108+
subPath: tmp
109+
volumes:
110+
- name: renviron-file
111+
configMap:
112+
name: renviron
113+
- name: shiny-tmp
114+
emptyDir:
115+
medium: Memory
116+
sizeLimit: 100Mi
117+
---
118+
apiVersion: v1
119+
kind: ConfigMap
120+
metadata:
121+
name: renviron
122+
labels:
123+
app.kubernetes.io/name: shiny
124+
app.kubernetes.io/component: webserver
125+
data:
126+
.Renviron: |
127+
POSTGRES_HOST=postgis

‎apps/kustomization.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
4+
resources:
5+
- ./crashes
6+
- ./traffics
7+
- ./muenster-update

‎apps/muenster-update/gitrepo.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: source.toolkit.fluxcd.io/v1
2+
kind: GitRepository
3+
metadata:
4+
name: codeformuenster-muenster-jetzt
5+
namespace: flux-system
6+
spec:
7+
interval: 1h
8+
url: https://github.com/codeformuenster/muenster-jetzt.git
9+
ref:
10+
branch: master
11+
ignore: |
12+
# exclude all
13+
/*
14+
# include deployment dir
15+
!/deployment/base

0 commit comments

Comments
 (0)