From b34e2f672a7263b214ee75fb23d173506d8a2d1a Mon Sep 17 00:00:00 2001 From: Vincent BRIDIER Date: Tue, 16 Jul 2024 15:40:58 +0200 Subject: [PATCH] Update manifest --- manifest.yaml | 154 +++++++++++++++++--------------------- production-resources.yaml | 13 ++++ 2 files changed, 82 insertions(+), 85 deletions(-) create mode 100644 production-resources.yaml diff --git a/manifest.yaml b/manifest.yaml index 8af09e81..c30f01b7 100644 --- a/manifest.yaml +++ b/manifest.yaml @@ -1,26 +1,25 @@ ---- apiVersion: v1 kind: ConfigMap metadata: name: ${CI_PROJECT_PATH_SLUG}-config-map data: - APP_NAME: "${APP_1_LRVL_APP_NAME}" - APP_ENV: "${APP_1_LRVL_APP_ENV}" - APP_KEY: "${APP_1_LRVL_APP_KEY}" - APP_DEBUG: "${APP_1_LRVL_APP_DEBUG}" - APP_URL: "https://www.${APP_1_LRVL_DOMAIN}" + APP_NAME: "${APP_APP_NAME}" + APP_ENV: "${APP_APP_ENV}" + APP_KEY: "${APP_APP_KEY}" + APP_DEBUG: "${APP_APP_DEBUG}" + APP_URL: "https://${REDIRECT}${APP_DOMAIN}" LOG_CHANNEL: "k8s" - DB_HOST: "mariadb-service.common-services" - DB_DATABASE: "${APP_1_LRVL_DB_DATABASE}" - DB_USERNAME: "${APP_1_LRVL_DB_USERNAME}" - DB_PASSWORD: "${APP_1_LRVL_DB_PASSWORD}" - MAIL_HOST: "${APP_1_LRVL_MAIL_HOST}" - MAIL_PORT: "${APP_1_LRVL_MAIL_PORT}" - MAIL_USERNAME: "${APP_1_LRVL_MAIL_USERNAME}" - MAIL_PASSWORD: "${APP_1_LRVL_MAIL_PASSWORD}" - MAIL_ENCRYPTION: "${APP_1_LRVL_MAIL_ENCRYPTION}" - MAIL_FROM_ADDRESS: "${APP_1_LRVL_MAIL_FROM_ADDRESS}" - MAIL_FROM_NAME: "${APP_1_LRVLAPP_NAME}" + DB_HOST: "mariadb.common-services" + DB_DATABASE: "${APP_DB_DATABASE}" + DB_USERNAME: "${APP_DB_USERNAME}" + DB_PASSWORD: "${APP_DB_PASSWORD}" + MAIL_HOST: "${APP_MAIL_HOST}" + MAIL_PORT: "${APP_MAIL_PORT}" + MAIL_USERNAME: "${APP_MAIL_USERNAME}" + MAIL_PASSWORD: "${APP_MAIL_PASSWORD}" + MAIL_ENCRYPTION: "${APP_MAIL_ENCRYPTION}" + MAIL_FROM_ADDRESS: "${APP_MAIL_FROM_ADDRESS}" + MAIL_FROM_NAME: "${APP_NAME}" MATOMO_SITE_ID: "${APP_MATOMO_SITE_ID}" SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}" @@ -32,7 +31,7 @@ metadata: spec: storageClassName: "csi-cinder-classic" accessModes: - - ReadWriteOnce + - ReadWriteOnce resources: requests: storage: $APP_PVC_SIZE @@ -53,25 +52,25 @@ spec: app: ${CI_PROJECT_PATH_SLUG}-app spec: containers: - - name: ${CI_PROJECT_PATH_SLUG}-container - image: $IMAGE_TAG - envFrom: - - configMapRef: - name: ${CI_PROJECT_PATH_SLUG}-config-map - volumeMounts: - - name: storage - mountPath: /app/srcs/storage + - name: ${CI_PROJECT_PATH_SLUG}-container + image: $IMAGE_TAG + envFrom: + - configMapRef: + name: ${CI_PROJECT_PATH_SLUG}-config-map + volumeMounts: + - name: storage + mountPath: /app/srcs/storage imagePullSecrets: - - name: docker-registry-credentials + - name: docker-registry-credentials securityContext: runAsUser: 33 runAsGroup: 33 fsGroup: 33 fsGroupChangePolicy: "OnRootMismatch" volumes: - - name: storage - persistentVolumeClaim: - claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage + - name: storage + persistentVolumeClaim: + claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage --- apiVersion: v1 @@ -82,43 +81,28 @@ spec: selector: app: ${CI_PROJECT_PATH_SLUG}-app ports: - - port: 80 - targetPort: 443 + - port: 80 + targetPort: 443 --- -apiVersion: traefik.containo.us/v1alpha1 +apiVersion: traefik.io/v1alpha1 kind: IngressRoute metadata: name: ${CI_PROJECT_PATH_SLUG}-ingress-route spec: entryPoints: - - web - - websecure + - web + - websecure routes: - - match: Host(`${APP_1_LRVL_DOMAIN}`, `www.${APP_1_LRVL_DOMAIN}`) - kind: Rule - services: - - name: ${CI_PROJECT_PATH_SLUG}-service - port: 80 - middlewares: - - name: redirect-no-www-to-www - namespace: common-services + - match: Host(`${APP_DOMAIN}`) || Host(`www.${APP_DOMAIN}`) + kind: Rule + services: + - name: ${CI_PROJECT_PATH_SLUG}-service + port: 80 + middlewares: + - name: redirect-no-www-to-www tls: - secretName: $APP_1_LRVL_DOMAIN - ---- -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: $APP_1_LRVL_DOMAIN -spec: - dnsNames: - - $APP_1_LRVL_DOMAIN - - www.${APP_1_LRVL_DOMAIN} - secretName: $APP_1_LRVL_DOMAIN - issuerRef: - name: $APP_1_LRVL_CERT_ISSUER - kind: ClusterIssuer + secretName: ${CRT_TLS_NAME} --- apiVersion: batch/v1 @@ -134,35 +118,35 @@ spec: affinity: podAffinity: requiredDuringSchedulingIgnoredDuringExecution: - - labelSelector: - matchExpressions: - - key: app - operator: In - values: - - ${CI_PROJECT_PATH_SLUG}-app - topologyKey: "kubernetes.io/hostname" - namespaces: [$KUBE_NAMESPACE] + - labelSelector: + matchExpressions: + - key: app + operator: In + values: + - ${CI_PROJECT_PATH_SLUG}-app + topologyKey: "kubernetes.io/hostname" + namespaces: [$KUBE_NAMESPACE] containers: - - name: ${CI_PROJECT_PATH_SLUG}-scheduled - image: $IMAGE_TAG - imagePullPolicy: IfNotPresent - command: - - "php" - args: - - "artisan" - - "schedule:run" - envFrom: - - configMapRef: - name: ${CI_PROJECT_PATH_SLUG}-config-map - volumeMounts: - - name: storage - mountPath: /app/srcs/storage - imagePullSecrets: - - name: docker-registry-credentials - volumes: + - name: ${CI_PROJECT_PATH_SLUG}-scheduled + image: $IMAGE_TAG + imagePullPolicy: IfNotPresent + command: + - "php" + args: + - "artisan" + - "schedule:run" + envFrom: + - configMapRef: + name: ${CI_PROJECT_PATH_SLUG}-config-map + volumeMounts: - name: storage - persistentVolumeClaim: - claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage + mountPath: /app/srcs/storage + imagePullSecrets: + - name: docker-registry-credentials + volumes: + - name: storage + persistentVolumeClaim: + claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage securityContext: runAsUser: 33 runAsGroup: 33 diff --git a/production-resources.yaml b/production-resources.yaml new file mode 100644 index 00000000..c297d728 --- /dev/null +++ b/production-resources.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: $APP_DOMAIN +spec: + dnsNames: + - $APP_DOMAIN + - www.${APP_DOMAIN} + secretName: $APP_DOMAIN + issuerRef: + name: $APP_CERT_ISSUER + kind: ClusterIssuer