k8s: phase in first version

Signed-off-by: Nico Schottelius <nico@nico-notebook.schottelius.org>

k8s/.helmignore

@@ -0,0 +1,24 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
+.#*

k8s/Chart.yaml

@@ -0,0 +1,7 @@
+apiVersion: v2
+name: uncloud
+description: ungleich managed uncloud
+
+type: application
+version: 0.3.0
+appVersion: "0.8-96-g7782aeb"

k8s/README.md

@@ -0,0 +1,14 @@
+## uncloud as a helm chart
+
+## Static files
+
+* Need to collectstatic && expose the files
+
+## App server
+
+* uswgi?
+* unicorn?
+
+ASGI
+
+* [Hypercorn](https://pgjones.gitlab.io/hypercorn/)

k8s/nginx/default.conf

@@ -0,0 +1,38 @@
+server {
+    listen 443      ssl http2;
+    listen [::]:443 ssl http2;
+    server_name {{ tpl .Values.fqdn . }};
+
+    # Use Mozilla's guidelines for SSL/TLS settings
+    # https://mozilla.github.io/server-side-tls/ssl-config-generator/
+    ssl_certificate      /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/fullchain.pem;
+    ssl_certificate_key  /etc/letsencrypt/live/{{ tpl .Values.fqdn . }}/privkey.pem;
+
+
+    location = /robots.txt {
+        allow all;
+        log_not_found off;
+        access_log off;
+    }
+    error_log /dev/stdout info;
+    access_log /dev/stdout;
+
+    root /opt/zammad/public;
+
+    location / {
+        # proxy_set_header Host $http_host;
+        # proxy_set_header CLIENT_IP $remote_addr;
+        # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        # proxy_set_header X-Forwarded-Proto $scheme;
+
+        # # Change this line in an SSO setup
+        # proxy_set_header X-Forwarded-User "";
+
+        # proxy_read_timeout 300;
+        proxy_pass http://localhost:8000;
+
+        # gzip on;
+        # gzip_types text/plain text/xml text/css image/svg+xml application/javascript application/x-javascript application/json application/xml;
+        # gzip_proxied any;
+    }
+}

k8s/templates/deployment.yaml

@@ -0,0 +1,181 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-postgres
+spec:
+  selector:
+    matchLabels:
+      instance: {{ .Release.Name }}-postgres
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: postgres
+        instance: {{ .Release.Name }}-postgres
+        hosting: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:14
+          ports:
+            - containerPort: 5432
+          envFrom:
+          - secretRef:
+              name: {{ .Release.Name }}-postgres-config
+          volumeMounts:
+            - name: postgres-data
+              mountPath: "/var/lib/postgresql/data"
+              subPath: postgres
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "100m"
+            limits:
+              memory: "256Mi"
+              cpu: "400m"
+      volumes:
+        - name: postgres-data
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-postgres-data
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-postgres
+  labels:
+    instance: {{ .Release.Name }}-postgres
+    app: postgres
+    hosting: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  ports:
+   - port: 5432
+     name: postgres
+  selector:
+   instance: {{ .Release.Name }}-postgres
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-uncloud
+spec:
+  selector:
+    matchLabels:
+      app: {{ .Release.Name }}-uncloud
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: {{ .Release.Name }}-uncloud
+        use-as-service: {{ .Release.Name }}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/nginxconf.yaml") . | sha256sum }}
+    spec:
+      containers:
+        - name: nginx
+          image: ungleich/ungleich-certbot:0.3.2
+          ports:
+            - containerPort: 443
+              name: https
+            - containerPort: 80
+              name: http
+          env:
+            - name: DOMAIN
+              value: "{{ tpl .Values.fqdn . }}"
+            - name: EMAIL
+              value: "{{ .Values.email }}"
+            - name: NGINX
+              value: "yes"
+            {{ if eq .Values.letsencryptStaging "no" }}
+            - name: STAGING
+              value: "no"
+            {{ end }}
+          volumeMounts:
+            - name: nginx-config
+              mountPath: "/etc/nginx/conf.d/"
+            - name: etcletsencrypt
+              mountPath: "/etc/letsencrypt"
+        - name: uncloud
+          image: harbor.ungleich.svc.p10.k8s.ooo/ungleich-public/uncloud:{{ .Chart.AppVersion }}
+          ports:
+            - containerPort: 3000
+          securityContext:
+            capabilities:
+              add:
+                - SYS_CHROOT
+          env:
+            - name: USER_UID
+              value: "1000"
+            - name: USER_GID
+              value: "1000"
+            - name: UNCLOUD__server__DOMAIN
+              value: "{{ tpl .Values.fqdn . }}"
+            # Require, otherwise the port :3000 is included
+            - name: UNCLOUD__server__ROOT_URL
+              value: "https://{{ tpl .Values.fqdn . }}"
+            - name: UNCLOUD__database__DB_TYPE
+              value: "postgres"
+            - name: UNCLOUD__database__HOST
+              value: {{ .Release.Name }}-postgres
+            - name: UNCLOUD__database__NAME
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgres-config
+                  key: POSTGRES_DB
+            - name: UNCLOUD__database__USER
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgres-config
+                  key: POSTGRES_USER
+            - name: UNCLOUD__database__PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgres-config
+                  key: POSTGRES_PASSWORD
+          volumeMounts:
+            - name: data
+              mountPath: "/data"
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-data
+        - name: etcletsencrypt
+          persistentVolumeClaim:
+            claimName: {{ .Release.Name }}-letsencrypt-certs
+        - name: nginx-config
+          configMap:
+            name: {{ .Release.Name }}-nginx-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}
+  labels:
+    app: {{ .Release.Name }}
+spec:
+  type: ClusterIP
+  ports:
+   - port: 22
+     name: ssh
+   - port: 80
+     name: http
+   - port: 443
+     name: https
+  selector:
+   use-as-service: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Release.Name }}-postgres-config
+  annotations:
+    secret-generator.v1.mittwald.de/autogenerate: POSTGRES_PASSWORD
+    hosting: {{ .Release.Name }}
+stringData:
+  POSTGRES_USER: "uncloud"
+  POSTGRES_DB: "uncloud"

k8s/templates/nginxconf.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ .Release.Name }}-nginx-config
+data:
+{{ tpl (.Files.Glob "nginx/*").AsConfig . | indent 2 }}

k8s/templates/pvc.yaml

@@ -0,0 +1,36 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.data.size }}
+  storageClassName: {{ .Values.storage.data.storageClass }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-postgres-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.db.size }}
+  storageClassName: {{ .Values.storage.db.storageClass }}
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ .Release.Name }}-letsencrypt-certs
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .Values.storage.letsencrypt.size }}
+  storageClassName: {{ .Values.storage.letsencrypt.storageClass }}

k8s/values.yaml

@@ -0,0 +1,15 @@
+clusterDomain: c2.k8s.ooo
+email: technik@ungleich.ch
+letsencryptStaging: "yes"
+fqdn: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}"
+
+storage:
+  data:
+    size: 20Gi
+    storageClass: rook-ceph-block-hdd
+  db:
+    size: 10Gi
+    storageClass: rook-ceph-block-ssd
+  letsencrypt:
+    size: 50Mi
+    storageClass: rook-ceph-block-hdd