ldc-volena/manifest.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-config-map
data:
  APP_NAME: "${APP_APP_NAME}"
  APP_ENV: "${APP_APP_ENV}"
  APP_KEY: "${APP_APP_KEY}"
  APP_DEBUG: "${APP_APP_DEBUG}"
  APP_URL: "https://${REDIRECT}${APP_DOMAIN}"
  LOG_CHANNEL: "k8s"
  DB_HOST: "${APP_DB_HOST}"
  DB_DATABASE: "${APP_DB_DATABASE}"
  DB_USERNAME: "${APP_DB_USERNAME}"
  DB_PASSWORD: "${APP_DB_PASSWORD}"
  MAIL_HOST: "${APP_MAIL_HOST}"
  MAIL_PORT: "${APP_MAIL_PORT}"
  MAIL_USERNAME: "${APP_MAIL_USERNAME}"
  MAIL_PASSWORD: "${APP_MAIL_PASSWORD}"
  MAIL_ENCRYPTION: "${APP_MAIL_ENCRYPTION}"
  MAIL_FROM_ADDRESS: "${APP_MAIL_FROM_ADDRESS}"
  MAIL_FROM_NAME: "${APP_APP_NAME}"
  MAIL_CONTACT_REMARK: "${APP_MAIL_CONTACT_REMARK}"
  MAIL_CONTACT_SPONSORING: "${APP_MAIL_CONTACT_SPONSORING}"
  MAIL_CONTACT_SERVICE: "${APP_MAIL_CONTACT_SERVICE}"
  MAIL_CONTACT_OTHER: "${APP_MAIL_CONTACT_OTHER}"
  GOOGLE_RECAPTCHA_PRIVATE: "${APP_GOOGLE_RECAPTCHA_PRIVATE}"
  GOOGLE_RECAPTCHA_PUBLIC: "${APP_GOOGLE_RECAPTCHA_PUBLIC}"
  GOOGLE_RECAPTCHA_VERSION: "${APP_GOOGLE_RECAPTCHA_VERSION}"
  SENTRY_LARAVEL_DSN: "${APP_SENTRY_LARAVEL_DSN}"
  MATOMO_SITE_ID: "${APP_MATOMO_SITE_ID}"
  SAML2_SP_CERT_x509: "${APP_SAML2_SP_CERT_x509}"
  SAML2_SP_CERT_PRIVATEKEY: "${APP_SAML2_SP_CERT_PRIVATEKEY}"
  SAML2_CONTACT_TECHNICAL_EMAIL: "${APP_SAML2_CONTACT_TECHNICAL_EMAIL}"
  SAML2_CONTACT_SUPPORT_EMAIL: "${APP_SAML2_CONTACT_SUPPORT_EMAIL}"
  SAML2_DEFAULT_TENANT_UUID: "${APP_SAML2_DEFAULT_TENANT_UUID}"
  UWIL_ADMIN_SECURE_CIDR_LIST: "${APP_GLOBAL_UWIL_ADMIN_SECURE_CIDR_LIST}"
  UWIL_ADMIN_SECURE_CIDR_PROJECT_ALLOWED_LIST: "${APP_UWIL_ADMIN_SECURE_CIDR_PROJECT_ALLOWED_LIST}"

---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-pvc-storage
spec:
  storageClassName: "csi-cinder-classic"
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: $APP_PVC_SIZE

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ${CI_PROJECT_PATH_SLUG}-app
  template:
    metadata:
      labels:
        app: ${CI_PROJECT_PATH_SLUG}-app
    spec:
      containers:
        - name: ${CI_PROJECT_PATH_SLUG}-container
          image: $IMAGE_TAG
          envFrom:
            - configMapRef:
                name: ${CI_PROJECT_PATH_SLUG}-config-map
          resources:
            limits:
              cpu: "${APP_CI_CPU_LIMIT}"
              memory: "${APP_CI_MEMORY_LIMIT}"
            requests:
              cpu: "${APP_CI_CPU_REQUEST}"
              memory: "${APP_CI_MEMORY_REQUEST}"
          volumeMounts:
            - name: storage
              mountPath: /app/srcs/storage
      imagePullSecrets:
        - name: docker-registry-credentials
      securityContext:
        runAsUser: 33
        runAsGroup: 33
        fsGroup: 33
        fsGroupChangePolicy: "OnRootMismatch"
      volumes:
        - name: storage
          persistentVolumeClaim:
            claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage

---
apiVersion: v1
kind: Service
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-service
spec:
  selector:
    app: ${CI_PROJECT_PATH_SLUG}-app
  ports:
    - port: 80
      targetPort: 80

---
apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-ingress-route
spec:
  entryPoints:
    - web
    - websecure
  routes:
    - match: Host(`${APP_DOMAIN}`) || Host(`www.${APP_DOMAIN}`)
      kind: Rule
      services:
        - name: ${CI_PROJECT_PATH_SLUG}-service
          port: 80
      middlewares:
        - name: redirect-no-www-to-www
  tls:
    secretName: ${CRT_TLS_NAME}

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: ${CI_PROJECT_PATH_SLUG}-cronjob
spec:
  schedule: "* * * * *"
  successfulJobsHistoryLimit: 1
  failedJobsHistoryLimit: 1
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      template:
        spec:
          affinity:
            podAffinity:
              requiredDuringSchedulingIgnoredDuringExecution:
                - labelSelector:
                    matchExpressions:
                      - key: app
                        operator: In
                        values:
                          - ${CI_PROJECT_PATH_SLUG}-app
                  topologyKey: "kubernetes.io/hostname"
                  namespaces: [$KUBE_NAMESPACE]
          containers:
            - name: ${CI_PROJECT_PATH_SLUG}-scheduled
              image: $IMAGE_TAG
              imagePullPolicy: IfNotPresent
              command:
                - "php"
              args:
                - "artisan"
                - "schedule:run"
              envFrom:
                - configMapRef:
                    name: ${CI_PROJECT_PATH_SLUG}-config-map
              volumeMounts:
                - name: storage
                  mountPath: /app/srcs/storage
          imagePullSecrets:
            - name: docker-registry-credentials
          volumes:
            - name: storage
              persistentVolumeClaim:
                claimName: ${CI_PROJECT_PATH_SLUG}-pvc-storage
          securityContext:
            runAsUser: 33
            runAsGroup: 33
            fsGroup: 33
            fsGroupChangePolicy: "OnRootMismatch"
          restartPolicy: OnFailure