ldc-ker-chant/manifest.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-config-map
data:
  APP_NAME: "${APP_APP_NAME}"
  APP_ENV: "${APP_APP_ENV}"
  APP_KEY: "${APP_APP_KEY}"
  APP_DEBUG: "${APP_APP_DEBUG}"
  APP_URL: "https://${APP_DOMAIN}"
  LOG_CHANNEL: "k8s"
  SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}"
  MATOMO_SITE_ID: "${APP_MATOMO_SITE_ID}"
  VITE_APP_NAME: "${APP_APP_NAME}"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-pvc-storage
spec:
  storageClassName: "csi-cinder-classic"
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: $APP_PVC_SIZE
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ${CI_PROJECT_PATH_SLUG}-app
  template:
    metadata:
      labels:
        app: ${CI_PROJECT_PATH_SLUG}-app
    spec:
      securityContext:
        runAsUser: 82
        runAsGroup: 82
        fsGroup: 82
        fsGroupChangePolicy: OnRootMismatch
      volumes:
        - name: apache-run
          emptyDir: {}
        - name: laravel-cache
          emptyDir: {}
        - name: storage
          persistentVolumeClaim:
            claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
      containers:
        - name: ${CI_PROJECT_PATH_SLUG}-container
          image: $IMAGE_TAG
          envFrom:
            - configMapRef:
                name: ${CI_PROJECT_PATH_SLUG}-config-map
          volumeMounts:
            - name: storage
              mountPath: /app/srcs/storage
            - name: apache-run
              mountPath: /var/run
            - name: laravel-cache
              mountPath: /app/srcs/bootstrap/cache
          securityContext:
            runAsUser: 82
            runAsGroup: 82
            # TODO : Faire le lien symbolique au build de l'image
            # readOnlyRootFilesystem: true
            # TODO : a priori incompatible avec PVC
            # allowPrivilegeEscalation: false
          resources:
            limits:
              cpu: "${APP_CI_CPU_LIMIT}"
              memory: "${APP_CI_MEMORY_LIMIT}"
            requests:
              cpu: "${APP_CI_CPU_REQUEST}"
              memory: "${APP_CI_MEMORY_REQUEST}"

        - name: ${CI_PROJECT_PATH_SLUG}-ssr
          image: $SSR_IMAGE_TAG
          ports:
            - containerPort: 13714
          readinessProbe:
            httpGet:
              path: /health
              port: 13714
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /health
              port: 13714
            initialDelaySeconds: 15
            periodSeconds: 20
            timeoutSeconds: 2
            failureThreshold: 3
          startupProbe:
            httpGet:
              path: /health
              port: 13714
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 12
          resources:
            limits:
              cpu: "${APP_CI_CPU_LIMIT}"
              memory: "${APP_CI_MEMORY_LIMIT}"
            requests:
              cpu: "${APP_CI_CPU_REQUEST}"
              memory: "${APP_CI_MEMORY_REQUEST}"
          securityContext:
            allowPrivilegeEscalation: false

      imagePullSecrets:
        - name: docker-registry-credentials
---
apiVersion: v1
kind: Service
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-service
spec:
  selector:
    app: ${CI_PROJECT_PATH_SLUG}-app
  ports:
    - port: 80
      targetPort: 80
---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-ingress-route
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: Host(`${APP_DOMAIN}`) || Host(`www.${APP_DOMAIN}`)
      kind: Rule
      services:
        - name: ${CI_PROJECT_PATH_SLUG}-service
          port: 80
      middlewares:
        - name: redirect-www-to-no-www
  tls:
    secretName: ${CRT_TLS_NAME}
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-cronjob
spec:
  schedule: "* * * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          securityContext:
            runAsUser: 82
            runAsGroup: 82
            fsGroup: 82
            fsGroupChangePolicy: OnRootMismatch
          affinity:
            podAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                - labelSelector:
                    matchExpressions:
                      - key: app
                        operator: In
                        values:
                          - ${CI_PROJECT_PATH_SLUG}-app
                  topologyKey: "kubernetes.io/hostname"
                  namespaces: [ $KUBE_NAMESPACE ]
          containers:
            - name: ${CI_PROJECT_PATH_SLUG}-scheduled
              image: $IMAGE_TAG
              imagePullPolicy: IfNotPresent
              command:
                - "php"
              args:
                - "artisan"
                - "schedule:run"
              envFrom:
                - configMapRef:
                    name: ${CI_PROJECT_PATH_SLUG}-config-map
              volumeMounts:
                - name: storage
                  mountPath: /app/srcs/storage
              securityContext:
                runAsUser: 82
                runAsGroup: 82
                # TODO : valider le POC
                # readOnlyRootFilesystem: true
                # TODO : a priori incompatible avec PVC
                # allowPrivilegeEscalation: false
          imagePullSecrets:
            - name: docker-registry-credentials
          volumes:
            - name: storage
              persistentVolumeClaim:
                claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
          restartPolicy: OnFailure