From 2599df64084d81464df2eaac8b10dd4908d0b81b Mon Sep 17 00:00:00 2001 From: Nico Schottelius Date: Sun, 19 Dec 2021 23:18:50 +0100 Subject: [PATCH] k8s: phase in first version Signed-off-by: Nico Schottelius --- k8s/.helmignore | 24 +++++ k8s/Chart.yaml | 7 ++ k8s/README.md | 14 +++ k8s/nginx/default.conf | 38 +++++++ k8s/templates/deployment.yaml | 181 ++++++++++++++++++++++++++++++++++ k8s/templates/nginxconf.yaml | 7 ++ k8s/templates/pvc.yaml | 36 +++++++ k8s/values.yaml | 15 +++ 8 files changed, 322 insertions(+) create mode 100644 k8s/.helmignore create mode 100644 k8s/Chart.yaml create mode 100644 k8s/README.md create mode 100644 k8s/nginx/default.conf create mode 100644 k8s/templates/deployment.yaml create mode 100644 k8s/templates/nginxconf.yaml create mode 100644 k8s/templates/pvc.yaml create mode 100644 k8s/values.yaml diff --git a/k8s/.helmignore b/k8s/.helmignore new file mode 100644 index 0000000..8ecf230 --- /dev/null +++ b/k8s/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +.#* diff --git a/k8s/Chart.yaml b/k8s/Chart.yaml new file mode 100644 index 0000000..f1dda07 --- /dev/null +++ b/k8s/Chart.yaml @@ -0,0 +1,7 @@ +apiVersion: v2 +name: uncloud +description: ungleich managed uncloud + +type: application +version: 0.3.0 +appVersion: "0.8-96-g7782aeb" diff --git a/k8s/README.md b/k8s/README.md new file mode 100644 index 0000000..725998e --- /dev/null +++ b/k8s/README.md @@ -0,0 +1,14 @@ +## uncloud as a helm chart + +## Static files + +* Need to collectstatic && expose the files + +## App server + +* uswgi? +* unicorn? + +ASGI + +* [Hypercorn](https://pgjones.gitlab.io/hypercorn/) diff --git a/k8s/nginx/default.conf b/k8s/nginx/default.conf new file mode 100644 index 0000000..e03a576 --- /dev/null +++ b/k8s/nginx/default.conf @@ -0,0 +1,38 @@ +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name {{ tpl .Values.fqdn . }}; + + # Use Mozilla's guidelines for SSL/TLS settings + # https://mozilla.github.io/server-side-tls/ssl-config-generator/ + ssl_certificate /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem; + + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + error_log /dev/stdout info; + access_log /dev/stdout; + + root /opt/zammad/public; + + location / { + # proxy_set_header Host $http_host; + # proxy_set_header CLIENT_IP $remote_addr; + # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + # proxy_set_header X-Forwarded-Proto $scheme; + + # # Change this line in an SSO setup + # proxy_set_header X-Forwarded-User ""; + + # proxy_read_timeout 300; + proxy_pass http://localhost:8000; + + # gzip on; + # gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml; + # gzip_proxied any; + } +} diff --git a/k8s/templates/deployment.yaml b/k8s/templates/deployment.yaml new file mode 100644 index 0000000..11b98ef --- /dev/null +++ b/k8s/templates/deployment.yaml @@ -0,0 +1,181 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-postgres +spec: + selector: + matchLabels: + instance: {{ .Release.Name }}-postgres + replicas: 1 + strategy: + type: Recreate + template: + metadata: + labels: + app: postgres + instance: {{ .Release.Name }}-postgres + hosting: {{ .Release.Name }} + spec: + containers: + - name: postgres + image: postgres:14 + ports: + - containerPort: 5432 + envFrom: + - secretRef: + name: {{ .Release.Name }}-postgres-config + volumeMounts: + - name: postgres-data + mountPath: "/var/lib/postgresql/data" + subPath: postgres + resources: + requests: + memory: "64Mi" + cpu: "100m" + limits: + memory: "256Mi" + cpu: "400m" + volumes: + - name: postgres-data + persistentVolumeClaim: + claimName: {{ .Release.Name }}-postgres-data +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }}-postgres + labels: + instance: {{ .Release.Name }}-postgres + app: postgres + hosting: {{ .Release.Name }} +spec: + type: ClusterIP + ports: + - port: 5432 + name: postgres + selector: + instance: {{ .Release.Name }}-postgres +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ .Release.Name }}-uncloud +spec: + selector: + matchLabels: + app: {{ .Release.Name }}-uncloud + replicas: 1 + strategy: + type: Recreate + template: + metadata: + labels: + app: {{ .Release.Name }}-uncloud + use-as-service: {{ .Release.Name }} + annotations: + checksum/config: {{ include (print $.Template.BasePath "/nginxconf.yaml") . | sha256sum }} + spec: + containers: + - name: nginx + image: ungleich/ungleich-certbot:0.3.2 + ports: + - containerPort: 443 + name: https + - containerPort: 80 + name: http + env: + - name: DOMAIN + value: "{{ tpl .Values.fqdn . }}" + - name: EMAIL + value: "{{ .Values.email }}" + - name: NGINX + value: "yes" + {{ if eq .Values.letsencryptStaging "no" }} + - name: STAGING + value: "no" + {{ end }} + volumeMounts: + - name: nginx-config + mountPath: "/etc/nginx/conf.d/" + - name: etcletsencrypt + mountPath: "/etc/letsencrypt" + - name: uncloud + image: harbor.ungleich.svc.p10.k8s.ooo/ungleich-public/uncloud:{{ .Chart.AppVersion }} + ports: + - containerPort: 3000 + securityContext: + capabilities: + add: + - SYS_CHROOT + env: + - name: USER_UID + value: "1000" + - name: USER_GID + value: "1000" + - name: UNCLOUD__server__DOMAIN + value: "{{ tpl .Values.fqdn . }}" + # Require, otherwise the port :3000 is included + - name: UNCLOUD__server__ROOT_URL + value: "https://{{ tpl .Values.fqdn . }}" + - name: UNCLOUD__database__DB_TYPE + value: "postgres" + - name: UNCLOUD__database__HOST + value: {{ .Release.Name }}-postgres + - name: UNCLOUD__database__NAME + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-postgres-config + key: POSTGRES_DB + - name: UNCLOUD__database__USER + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-postgres-config + key: POSTGRES_USER + - name: UNCLOUD__database__PASSWD + valueFrom: + secretKeyRef: + name: {{ .Release.Name }}-postgres-config + key: POSTGRES_PASSWORD + volumeMounts: + - name: data + mountPath: "/data" + volumes: + - name: data + persistentVolumeClaim: + claimName: {{ .Release.Name }}-data + - name: etcletsencrypt + persistentVolumeClaim: + claimName: {{ .Release.Name }}-letsencrypt-certs + - name: nginx-config + configMap: + name: {{ .Release.Name }}-nginx-config +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ .Release.Name }} + labels: + app: {{ .Release.Name }} +spec: + type: ClusterIP + ports: + - port: 22 + name: ssh + - port: 80 + name: http + - port: 443 + name: https + selector: + use-as-service: {{ .Release.Name }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ .Release.Name }}-postgres-config + annotations: + secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD + hosting: {{ .Release.Name }} +stringData: + POSTGRES_USER: "uncloud" + POSTGRES_DB: "uncloud" diff --git a/k8s/templates/nginxconf.yaml b/k8s/templates/nginxconf.yaml new file mode 100644 index 0000000..49f9969 --- /dev/null +++ b/k8s/templates/nginxconf.yaml @@ -0,0 +1,7 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ .Release.Name }}-nginx-config +data: +{{ tpl (.Files.Glob "nginx/*").AsConfig . | indent 2 }} diff --git a/k8s/templates/pvc.yaml b/k8s/templates/pvc.yaml new file mode 100644 index 0000000..cac24f4 --- /dev/null +++ b/k8s/templates/pvc.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ .Release.Name }}-data +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ .Values.storage.data.size }} + storageClassName: {{ .Values.storage.data.storageClass }} +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ .Release.Name }}-postgres-data +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ .Values.storage.db.size }} + storageClassName: {{ .Values.storage.db.storageClass }} +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: {{ .Release.Name }}-letsencrypt-certs +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: {{ .Values.storage.letsencrypt.size }} + storageClassName: {{ .Values.storage.letsencrypt.storageClass }} diff --git a/k8s/values.yaml b/k8s/values.yaml new file mode 100644 index 0000000..9190260 --- /dev/null +++ b/k8s/values.yaml @@ -0,0 +1,15 @@ +clusterDomain: c2.k8s.ooo +email: technik@ungleich.ch +letsencryptStaging: "yes" +fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + +storage: + data: + size: 20Gi + storageClass: rook-ceph-block-hdd + db: + size: 10Gi + storageClass: rook-ceph-block-ssd + letsencrypt: + size: 50Mi + storageClass: rook-ceph-block-hdd