180 lines
5 KiB
YAML
180 lines
5 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: ${CI_PROJECT_PATH_SLUG}-config-map
|
|
data:
|
|
APP_NAME: "${APP_APP_NAME}"
|
|
APP_ENV: "${APP_APP_ENV}"
|
|
APP_KEY: "${APP_APP_KEY}"
|
|
APP_DEBUG: "${APP_APP_DEBUG}"
|
|
APP_URL: "https://${REDIRECT}${APP_DOMAIN}"
|
|
LOG_CHANNEL: "k8s"
|
|
LOG_LEVEL: "${APP_LOG_LEVEL}"
|
|
DB_HOST: "mariadb.common-services"
|
|
DB_DATABASE: "${APP_DB_DATABASE}"
|
|
DB_USERNAME: "${APP_DB_USERNAME}"
|
|
DB_PASSWORD: "${APP_DB_PASSWORD}"
|
|
MAIL_HOST: "${APP_MAIL_HOST}"
|
|
MAIL_PORT: "${APP_MAIL_PORT}"
|
|
MAIL_USERNAME: "${APP_MAIL_USERNAME}"
|
|
MAIL_PASSWORD: "${APP_MAIL_PASSWORD}"
|
|
MAIL_ENCRYPTION: "${APP_MAIL_ENCRYPTION}"
|
|
MAIL_FROM_ADDRESS: "${APP_MAIL_FROM_ADDRESS}"
|
|
MAIL_FROM_NAME: "${APP_APP_NAME}"
|
|
SAML2_SP_CERT_x509: "${APP_SAML2_SP_CERT_x509}"
|
|
SAML2_SP_CERT_PRIVATEKEY: "${APP_SAML2_SP_CERT_PRIVATEKEY}"
|
|
SAML2_CONTACT_TECHNICAL_EMAIL: "${APP_SAML2_CONTACT_TECHNICAL_EMAIL}"
|
|
SAML2_CONTACT_SUPPORT_EMAIL: "${APP_SAML2_CONTACT_SUPPORT_EMAIL}"
|
|
SAML2_DEFAULT_TENANT_UUID: "${APP_SAML2_DEFAULT_TENANT_UUID}"
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: ${CI_PROJECT_PATH_SLUG}-pvc-storage
|
|
spec:
|
|
storageClassName: "csi-cinder-classic"
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: $APP_PVC_SIZE
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: ${CI_PROJECT_PATH_SLUG}-deployment
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: ${CI_PROJECT_PATH_SLUG}-app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: ${CI_PROJECT_PATH_SLUG}-app
|
|
spec:
|
|
containers:
|
|
- name: ${CI_PROJECT_PATH_SLUG}-container
|
|
image: $IMAGE_TAG
|
|
envFrom:
|
|
- configMapRef:
|
|
name: ${CI_PROJECT_PATH_SLUG}-config-map
|
|
volumeMounts:
|
|
- name: storage
|
|
mountPath: /app/srcs/storage
|
|
- name: ${CI_PROJECT_PATH_SLUG}-queue-worker
|
|
image: $IMAGE_TAG
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command:
|
|
[
|
|
"/bin/sh",
|
|
"-c",
|
|
"kill -s TERM 1; while test $(ps ax | grep -v grep | grep bash | wc -l) -gt 0; do sleep 2s; done",
|
|
]
|
|
resources:
|
|
limits:
|
|
memory: 512Mi
|
|
cpu: "1"
|
|
command:
|
|
- "bash"
|
|
args:
|
|
- "k8s-queues.sh"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: ${CI_PROJECT_PATH_SLUG}-config-map
|
|
volumeMounts:
|
|
- name: storage
|
|
mountPath: /app/srcs/storage
|
|
imagePullSecrets:
|
|
- name: docker-registry-credentials
|
|
securityContext:
|
|
runAsUser: 33
|
|
runAsGroup: 33
|
|
fsGroup: 33
|
|
fsGroupChangePolicy: "OnRootMismatch"
|
|
volumes:
|
|
- name: storage
|
|
persistentVolumeClaim:
|
|
claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: ${CI_PROJECT_PATH_SLUG}-service
|
|
spec:
|
|
selector:
|
|
app: ${CI_PROJECT_PATH_SLUG}-app
|
|
ports:
|
|
- port: 80
|
|
targetPort: 443
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: ${CI_PROJECT_PATH_SLUG}-ingress-route
|
|
spec:
|
|
entryPoints:
|
|
- web
|
|
- websecure
|
|
routes:
|
|
- match: Host(`${APP_DOMAIN}`) || Host(`www.${APP_DOMAIN}`)
|
|
kind: Rule
|
|
services:
|
|
- name: ${CI_PROJECT_PATH_SLUG}-service
|
|
port: 80
|
|
middlewares:
|
|
- name: redirect-no-www-to-www
|
|
tls:
|
|
secretName: ${CRT_TLS_NAME}
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: ${CI_PROJECT_PATH_SLUG}-cronjob
|
|
spec:
|
|
schedule: "* * * * *"
|
|
concurrencyPolicy: Forbid
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
affinity:
|
|
podAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchExpressions:
|
|
- key: app
|
|
operator: In
|
|
values:
|
|
- ${CI_PROJECT_PATH_SLUG}-app
|
|
topologyKey: "kubernetes.io/hostname"
|
|
namespaces: [$KUBE_NAMESPACE]
|
|
containers:
|
|
- name: ${CI_PROJECT_PATH_SLUG}-scheduled
|
|
image: $IMAGE_TAG
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- "php"
|
|
args:
|
|
- "artisan"
|
|
- "schedule:run"
|
|
envFrom:
|
|
- configMapRef:
|
|
name: ${CI_PROJECT_PATH_SLUG}-config-map
|
|
volumeMounts:
|
|
- name: storage
|
|
mountPath: /app/srcs/storage
|
|
imagePullSecrets:
|
|
- name: docker-registry-credentials
|
|
volumes:
|
|
- name: storage
|
|
persistentVolumeClaim:
|
|
claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
|
|
securityContext:
|
|
runAsUser: 33
|
|
runAsGroup: 33
|
|
fsGroup: 33
|
|
fsGroupChangePolicy: "OnRootMismatch"
|
|
restartPolicy: OnFailure
|