diff --git a/charts/argocd/values.yaml b/charts/argocd/values.yaml index f96e1a6..f9738f3 100644 --- a/charts/argocd/values.yaml +++ b/charts/argocd/values.yaml @@ -8,7 +8,6 @@ route: gatewayName: public-gateway gatewayNamespace: apps hostnames: - - symcrest.com - www.symcrest.com serviceName: argocd-server servicePort: 80 diff --git a/charts/forgejo/values.yaml b/charts/forgejo/values.yaml index 013ba60..6ab72f6 100644 --- a/charts/forgejo/values.yaml +++ b/charts/forgejo/values.yaml @@ -16,7 +16,6 @@ route: gatewayName: public-gateway gatewayNamespace: apps hostnames: - - symcrest.com - www.symcrest.com basePath: /internal/dev/forgejo serviceName: forgejo diff --git a/charts/longhorn/values.yaml b/charts/longhorn/values.yaml index 1a096ea..4e78ed3 100644 --- a/charts/longhorn/values.yaml +++ b/charts/longhorn/values.yaml @@ -9,7 +9,6 @@ route: gatewayName: public-gateway gatewayNamespace: apps hostnames: - - symcrest.com - www.symcrest.com serviceName: longhorn-frontend servicePort: 80 diff --git a/charts/openproject/Chart.yaml b/charts/openproject/Chart.yaml new file mode 100644 index 0000000..8b9e112 --- /dev/null +++ b/charts/openproject/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +name: openproject +description: Symcrest OpenProject wrapper chart +type: application +version: 0.1.0 +appVersion: "17.5.1" diff --git a/charts/openproject/templates/httproute.yaml b/charts/openproject/templates/httproute.yaml new file mode 100644 index 0000000..7f7f688 --- /dev/null +++ b/charts/openproject/templates/httproute.yaml @@ -0,0 +1,24 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: openproject + namespace: {{ .Release.Namespace }} +spec: + parentRefs: + - name: {{ .Values.gateway.name }} + namespace: {{ .Values.gateway.namespace }} + + hostnames: +{{- range .Values.hostnames }} + - {{ . | quote }} +{{- end }} + + rules: + - matches: + - path: + type: PathPrefix + value: {{ .Values.basePath | quote }} + + backendRefs: + - name: {{ .Values.service.name }} + port: {{ .Values.service.port }} diff --git a/charts/openproject/upstream-values.yaml b/charts/openproject/upstream-values.yaml new file mode 100644 index 0000000..c04ceaa --- /dev/null +++ b/charts/openproject/upstream-values.yaml @@ -0,0 +1,48 @@ +openproject: + https: true + host: www.symcrest.com + railsRelativeUrlRoot: /internal/dev/openproject + + extraEnvVarsSecret: openproject-postgres-secret + + useTmpVolumes: true + tmpVolumesStorage: "5Gi" + tmpVolumesStorageClassName: longhorn + tmpVolumesPermissionFix: true + + realtime_collaboration: + enabled: false + + admin_user: + password: "TempPass123" + password_reset: "true" + name: "IT Admin" + mail: "it.admin@symcrest.com" + +hocuspocus: + enabled: false + +ingress: + enabled: false + +nodeSelector: + workload: app + +persistence: + enabled: true + storageClassName: longhorn + accessModes: + - ReadWriteOnce + size: 1Gi + +postgresql: + bundled: false + connection: + host: postgres.database.svc.cluster.local + port: 5432 + auth: + existingSecret: openproject-postgres-secret + secretKeys: + userPasswordKey: password + username: openproject + database: openproject diff --git a/charts/openproject/values.yaml b/charts/openproject/values.yaml new file mode 100644 index 0000000..d567993 --- /dev/null +++ b/charts/openproject/values.yaml @@ -0,0 +1,9 @@ +hostnames: + - www.symcrest.com +basePath: /internal/dev/openproject +gateway: + name: public-gateway + namespace: apps +service: + name: openproject + port: 8080 diff --git a/charts/pgadmin/values.yaml b/charts/pgadmin/values.yaml index c2e7068..c7cc920 100644 --- a/charts/pgadmin/values.yaml +++ b/charts/pgadmin/values.yaml @@ -5,7 +5,7 @@ image: tag: "9.15" auth: - email: arvind.prabhakar@symcrest.com + email: it.admin@symcrest.com secret: postgres-secret storage: @@ -20,7 +20,6 @@ route: gatewayName: public-gateway gatewayNamespace: apps hostnames: - - symcrest.com - www.symcrest.com basePath: /internal/dev/pgadmin serviceName: pgadmin diff --git a/rendered/argocd/argocd-httproute.yaml b/rendered/argocd/argocd-httproute.yaml new file mode 100644 index 0000000..09a4ab2 --- /dev/null +++ b/rendered/argocd/argocd-httproute.yaml @@ -0,0 +1,21 @@ +--- +# Source: argocd-wrapper/templates/httproute.yaml +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: argocd + namespace: argocd +spec: + parentRefs: + - name: public-gateway + namespace: apps + hostnames: + - "www.symcrest.com" + rules: + - matches: + - path: + type: PathPrefix + value: "/internal/ops/argocd" + backendRefs: + - name: argocd-server + port: 80 diff --git a/rendered/argocd/argocd.yaml b/rendered/argocd/argocd.yaml index 1974e1e..09a4ab2 100644 --- a/rendered/argocd/argocd.yaml +++ b/rendered/argocd/argocd.yaml @@ -10,7 +10,6 @@ spec: - name: public-gateway namespace: apps hostnames: - - "symcrest.com" - "www.symcrest.com" rules: - matches: diff --git a/rendered/forgejo/forgejo-httproute.yaml b/rendered/forgejo/forgejo-httproute.yaml new file mode 100644 index 0000000..ec965fd --- /dev/null +++ b/rendered/forgejo/forgejo-httproute.yaml @@ -0,0 +1,123 @@ +--- +# Source: forgejo/templates/pvc.yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: forgejo-data + namespace: forgejo +spec: + accessModes: + - ReadWriteOnce + storageClassName: "longhorn" + resources: + requests: + storage: "20Gi" +--- +# Source: forgejo/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: forgejo + namespace: forgejo +spec: + type: ClusterIP + selector: + app: forgejo + ports: + - name: http + port: 3000 + targetPort: 3000 + - name: ssh + port: 22 + targetPort: 22 +--- +# Source: forgejo/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: forgejo + namespace: forgejo +spec: + replicas: 1 + selector: + matchLabels: + app: forgejo + template: + metadata: + labels: + app: forgejo + spec: + nodeSelector: + workload: app + containers: + - name: forgejo + image: "codeberg.org/forgejo/forgejo:15.0.3" + ports: + - name: http + containerPort: 3000 + - name: ssh + containerPort: 22 + env: + - name: FORGEJO__server__ROOT_URL + value: "https://www.symcrest.com/internal/dev/forgejo/" + - name: FORGEJO__server__HTTP_PORT + value: "3000" + - name: FORGEJO__database__DB_TYPE + value: "postgres" + - name: FORGEJO__database__HOST + value: "postgres.database.svc.cluster.local:5432" + - name: FORGEJO__database__NAME + value: "forgejo" + - name: FORGEJO__database__USER + value: "forgejo" + - name: FORGEJO__database__PASSWD + valueFrom: + secretKeyRef: + name: forgejo-db-secret + key: FORGEJO_DB_PASSWORD + volumeMounts: + - name: forgejo-data + mountPath: /data + volumes: + - name: forgejo-data + persistentVolumeClaim: + claimName: forgejo-data +--- +# Source: forgejo/templates/httproute.yaml +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: forgejo + namespace: forgejo +spec: + parentRefs: + - name: public-gateway + namespace: apps + hostnames: + - "www.symcrest.com" + rules: + - matches: + - path: + type: Exact + value: "/internal/dev/forgejo" + filters: + - type: RequestRedirect + requestRedirect: + path: + type: ReplaceFullPath + replaceFullPath: "/internal/dev/forgejo/" + statusCode: 301 + + - matches: + - path: + type: PathPrefix + value: "/internal/dev/forgejo/" + filters: + - type: URLRewrite + urlRewrite: + path: + type: ReplacePrefixMatch + replacePrefixMatch: / + backendRefs: + - name: forgejo + port: 3000 diff --git a/rendered/forgejo/forgejo.yaml b/rendered/forgejo/forgejo.yaml index 03940ca..ec965fd 100644 --- a/rendered/forgejo/forgejo.yaml +++ b/rendered/forgejo/forgejo.yaml @@ -94,7 +94,6 @@ spec: - name: public-gateway namespace: apps hostnames: - - "symcrest.com" - "www.symcrest.com" rules: - matches: diff --git a/rendered/longhorn/longhorn-httproute.yaml b/rendered/longhorn/longhorn-httproute.yaml new file mode 100644 index 0000000..d6abfd4 --- /dev/null +++ b/rendered/longhorn/longhorn-httproute.yaml @@ -0,0 +1,39 @@ +--- +# Source: longhorn-wrapper/templates/httproute.yaml +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: longhorn + namespace: longhorn-system +spec: + parentRefs: + - name: public-gateway + namespace: apps + hostnames: + - "www.symcrest.com" + rules: + - matches: + - path: + type: Exact + value: "/internal/ops/longhorn" + filters: + - type: RequestRedirect + requestRedirect: + path: + type: ReplaceFullPath + replaceFullPath: "/internal/ops/longhorn/" + statusCode: 301 + + - matches: + - path: + type: PathPrefix + value: "/internal/ops/longhorn/" + filters: + - type: URLRewrite + urlRewrite: + path: + type: ReplacePrefixMatch + replacePrefixMatch: "/" + backendRefs: + - name: longhorn-frontend + port: 80 diff --git a/rendered/longhorn/longhorn.yaml b/rendered/longhorn/longhorn.yaml index 5dcebe3..d6abfd4 100644 --- a/rendered/longhorn/longhorn.yaml +++ b/rendered/longhorn/longhorn.yaml @@ -10,7 +10,6 @@ spec: - name: public-gateway namespace: apps hostnames: - - "symcrest.com" - "www.symcrest.com" rules: - matches: diff --git a/rendered/openproject/openproject-httproute.yaml b/rendered/openproject/openproject-httproute.yaml new file mode 100644 index 0000000..2975ecf --- /dev/null +++ b/rendered/openproject/openproject-httproute.yaml @@ -0,0 +1,24 @@ +--- +# Source: openproject/templates/httproute.yaml +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: openproject + namespace: openproject +spec: + parentRefs: + - name: public-gateway + namespace: apps + + hostnames: + - "www.symcrest.com" + + rules: + - matches: + - path: + type: PathPrefix + value: "/internal/dev/openproject" + + backendRefs: + - name: openproject + port: 8080 diff --git a/rendered/openproject/openproject.yaml b/rendered/openproject/openproject.yaml new file mode 100644 index 0000000..2975ecf --- /dev/null +++ b/rendered/openproject/openproject.yaml @@ -0,0 +1,24 @@ +--- +# Source: openproject/templates/httproute.yaml +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: openproject + namespace: openproject +spec: + parentRefs: + - name: public-gateway + namespace: apps + + hostnames: + - "www.symcrest.com" + + rules: + - matches: + - path: + type: PathPrefix + value: "/internal/dev/openproject" + + backendRefs: + - name: openproject + port: 8080 diff --git a/rendered/openproject/upstream-openproject.yaml b/rendered/openproject/upstream-openproject.yaml new file mode 100644 index 0000000..2f65253 --- /dev/null +++ b/rendered/openproject/upstream-openproject.yaml @@ -0,0 +1,1219 @@ +--- +# Source: openproject/charts/memcached/templates/networkpolicy.yaml +kind: NetworkPolicy +apiVersion: networking.k8s.io/v1 +metadata: + name: openproject-memcached + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: memcached + app.kubernetes.io/version: 1.6.24 + helm.sh/chart: memcached-6.14.0 +spec: + podSelector: + matchLabels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: memcached + app.kubernetes.io/version: 1.6.24 + helm.sh/chart: memcached-6.14.0 + policyTypes: + - Ingress + - Egress + egress: + - {} + ingress: + - ports: + - port: 11211 +--- +# Source: openproject/charts/memcached/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: false +metadata: + name: openproject-memcached + namespace: openproject + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: memcached + app.kubernetes.io/version: 1.6.24 + helm.sh/chart: memcached-6.14.0 +--- +# Source: openproject/templates/serviceaccount.yaml +apiVersion: "v1" +kind: "ServiceAccount" +metadata: + name: openproject + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: openproject +... +--- +# Source: openproject/templates/secret_core.yaml +apiVersion: "v1" +kind: "Secret" +metadata: + name: "openproject-core" + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: openproject +data: # reset data to make sure only keys defined below remain +stringData: + DATABASE_HOST: "postgres.database.svc.cluster.local" + DATABASE_PORT: "5432" + DATABASE_URL: "postgresql://openproject@postgres.database.svc.cluster.local:5432/openproject" + OPENPROJECT_SEED_ADMIN_USER_PASSWORD: "TempPass123" + OPENPROJECT_SEED_ADMIN_USER_PASSWORD_RESET: "true" + OPENPROJECT_SEED_ADMIN_USER_NAME: "IT Admin" + OPENPROJECT_SEED_ADMIN_USER_MAIL: "it.admin@symcrest.com" + OPENPROJECT_HTTPS: "true" + OPENPROJECT_HOST__NAME: "www.symcrest.com" + OPENPROJECT_HSTS: "true" + OPENPROJECT_RAILS__CACHE__STORE: "memcache" + OPENPROJECT_RAILS__RELATIVE__URL__ROOT: "/internal/dev/openproject" + POSTGRES_STATEMENT_TIMEOUT: "120s" +... +--- +# Source: openproject/templates/secret_memcached.yaml +apiVersion: "v1" +kind: "Secret" +metadata: + name: "openproject-memcached" + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: memcached +data: # reset data to make sure only keys defined below remain +stringData: + OPENPROJECT_CACHE__MEMCACHE__SERVER: "openproject-memcached:11211" +... +--- +# Source: openproject/templates/secret_secret_key_base.yaml +apiVersion: "v1" +kind: "Secret" +metadata: + name: secret-key-base-auto-generated + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: openproject + annotations: + # This annotation together with the lookup of the existing secret above ensures that this secret is not + # regenerated during each upgrade, but kept the same. + "helm.sh/resource-policy": "keep" +data: # reset data to make sure only keys defined below remain +stringData: + secret-key-base: dNM2C8uej7qGsjJHjKMRAxncbVREhzBOysrk7iVCVr6MHEibFCgDwbRSqB8Qe9WK +... +--- +# Source: openproject/templates/persistentvolumeclaim.yaml +apiVersion: "v1" +kind: "PersistentVolumeClaim" +metadata: + name: openproject + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: openproject +spec: + accessModes: [ReadWriteOnce] + storageClassName: longhorn + resources: + requests: + storage: "1Gi" +... +--- +# Source: openproject/charts/memcached/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: openproject-memcached + namespace: openproject + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: memcached + app.kubernetes.io/version: 1.6.24 + helm.sh/chart: memcached-6.14.0 +spec: + type: ClusterIP + ports: + - name: memcache + port: 11211 + targetPort: memcache + nodePort: null + selector: + app.kubernetes.io/instance: openproject + app.kubernetes.io/name: memcached +--- +# Source: openproject/templates/service.yaml +apiVersion: "v1" +kind: "Service" +metadata: + name: openproject + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: openproject +spec: + type: ClusterIP + ports: + - port: 8080 + targetPort: http + protocol: TCP + name: http + selector: + app.kubernetes.io/name: openproject + app.kubernetes.io/instance: openproject + openproject/process: web +... +--- +# Source: openproject/charts/memcached/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openproject-memcached + namespace: openproject + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: memcached + app.kubernetes.io/version: 1.6.24 + helm.sh/chart: memcached-6.14.0 +spec: + selector: + matchLabels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/name: memcached + replicas: 1 + strategy: + rollingUpdate: {} + type: RollingUpdate + template: + metadata: + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: memcached + app.kubernetes.io/version: 1.6.24 + helm.sh/chart: memcached-6.14.0 + annotations: + spec: + + automountServiceAccountToken: false + affinity: + podAffinity: + + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/name: memcached + topologyKey: kubernetes.io/hostname + weight: 1 + nodeAffinity: + + securityContext: + fsGroup: 1001 + fsGroupChangePolicy: Always + supplementalGroups: [] + sysctls: [] + serviceAccountName: openproject-memcached + containers: + - name: memcached + image: docker.io/bitnamilegacy/memcached:1.6.24-debian-12-r0 + imagePullPolicy: "IfNotPresent" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + readOnlyRootFilesystem: false + runAsGroup: 1001 + runAsNonRoot: true + runAsUser: 1001 + seLinuxOptions: null + seccompProfile: + type: RuntimeDefault + env: + - name: BITNAMI_DEBUG + value: "false" + - name: MEMCACHED_PORT_NUMBER + value: "11211" + ports: + - name: memcache + containerPort: 11211 + livenessProbe: + failureThreshold: 6 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + tcpSocket: + port: memcache + readinessProbe: + failureThreshold: 6 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 3 + tcpSocket: + port: memcache + volumeMounts: + - name: empty-dir + mountPath: /opt/bitnami/memcached/conf + subPath: app-conf-dir + - name: empty-dir + mountPath: /tmp + subPath: tmp-dir + volumes: + - name: empty-dir + emptyDir: {} +--- +# Source: openproject/templates/cron-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openproject-cron + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + openproject/process: cron + app.kubernetes.io/component: cron +spec: + replicas: 0 + strategy: + type: "Recreate" + selector: + matchLabels: + app.kubernetes.io/name: openproject + app.kubernetes.io/instance: openproject + openproject/process: cron + template: + metadata: + annotations: + + # annotate pods with env value checksums so changes trigger re-deployments + + checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78 + checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d + checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/env-cron-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + openproject/process: cron + app.kubernetes.io/component: cron + spec: + nodeSelector: + workload: app + securityContext: + fsGroup: 1000 + serviceAccountName: openproject + volumes: + - name: tmp + # we can't use emptyDir due to the sticky bit issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: app-tmp + # we can't use emptyDir due to the sticky bit / world writable issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: "data" + persistentVolumeClaim: + claimName: openproject + initContainers: + - name: prepare-tmpdir + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + command: + - sh + - -c + - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby + resources: + limits: + memory: 1024Mi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: wait-for-db + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + - secretRef: + name: openproject-cron-environment + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + args: + - bash + - /app/docker/prod/wait-for-db + resources: + limits: + memory: 1024Mi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + containers: + - name: "cron" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + - secretRef: + name: openproject-cron-environment + args: + - bash + - /app/docker/prod/cron + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: "data" + mountPath: "/var/openproject/assets" + resources: + limits: + cpu: "1" + memory: 1Gi + requests: + cpu: 250m + memory: 256Mi +--- +# Source: openproject/templates/web-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openproject-web + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + openproject/process: web + app.kubernetes.io/component: web +spec: + replicas: 1 + strategy: + + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: openproject + app.kubernetes.io/instance: openproject + openproject/process: web + template: + metadata: + annotations: + + # annotate pods with env value checksums so changes trigger re-deployments + + checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78 + checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d + checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + openproject/process: web + app.kubernetes.io/component: web + spec: + nodeSelector: + workload: app + securityContext: + fsGroup: 1000 + serviceAccountName: openproject + volumes: + - name: tmp + # we can't use emptyDir due to the sticky bit issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: app-tmp + # we can't use emptyDir due to the sticky bit / world writable issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: "data" + persistentVolumeClaim: + claimName: openproject + initContainers: + - name: prepare-tmpdir + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + command: + - sh + - -c + - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby + resources: + limits: + memory: 1024Mi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: wait-for-db + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + args: + - /app/docker/prod/wait-for-db + resources: + limits: + memory: 1024Mi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + containers: + - name: "openproject" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + args: + - /app/docker/prod/web + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: "data" + mountPath: "/var/openproject/assets" + ports: + - name: http + containerPort: 8080 + protocol: TCP + livenessProbe: + httpGet: + path: "/internal/dev/openproject/health_checks/default" + port: 8080 + httpHeaders: + # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants + - name: Host + value: localhost + initialDelaySeconds: 0 + timeoutSeconds: 5 + periodSeconds: 15 + failureThreshold: 3 + successThreshold: 1 + readinessProbe: + httpGet: + path: "/internal/dev/openproject/health_checks/default" + port: 8080 + httpHeaders: + # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants + - name: Host + value: localhost + initialDelaySeconds: 0 + timeoutSeconds: 5 + periodSeconds: 10 + failureThreshold: 3 + successThreshold: 1 + startupProbe: + httpGet: + path: "/internal/dev/openproject/health_checks/default" + port: 8080 + httpHeaders: + # required otherwise health check will return 404 because health check is done using the Pod IP, which may cause issues with downstream variants + - name: Host + value: localhost + initialDelaySeconds: 60 + timeoutSeconds: 5 + periodSeconds: 15 + failureThreshold: 10 + successThreshold: 1 + resources: + limits: + cpu: "4" + memory: 4Gi + requests: + cpu: 250m + memory: 512Mi +--- +# Source: openproject/templates/worker-deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openproject-worker-default + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + openproject/process: worker-default + app.kubernetes.io/component: worker-default +spec: + replicas: 1 + strategy: + + type: Recreate + selector: + matchLabels: + app.kubernetes.io/name: openproject + app.kubernetes.io/instance: openproject + openproject/process: worker-default + template: + metadata: + annotations: + + # annotate pods with env value checksums so changes trigger re-deployments + + checksum/env-core: d595adde5a7e1007834c68766ac51f7652c1246a63b976431b0ee5a6c9870a78 + checksum/env-memcached: fd1a022eb3ba9e1437809d0177660fdab3ae79b4fcfbee2f8ec1264ee0aa944d + checksum/env-oidc: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/env-s3: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + checksum/env-environment: 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + openproject/process: worker-default + app.kubernetes.io/component: worker-default + spec: + nodeSelector: + workload: app + securityContext: + fsGroup: 1000 + serviceAccountName: openproject + volumes: + - name: tmp + # we can't use emptyDir due to the sticky bit issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: app-tmp + # we can't use emptyDir due to the sticky bit / world writable issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: "data" + persistentVolumeClaim: + claimName: openproject + initContainers: + - name: prepare-tmpdir + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + command: + - sh + - -c + - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby + resources: + limits: + memory: 1024Mi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: wait-for-db + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + args: + - bash + - /app/docker/prod/wait-for-db + resources: + limits: + memory: 1024Mi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + containers: + - name: "openproject" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + args: + - bash + - /app/docker/prod/worker + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + - name: "OPENPROJECT_GOOD_JOB_QUEUES" + value: "" + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: "data" + mountPath: "/var/openproject/assets" + resources: + limits: + cpu: "4" + memory: 4Gi + requests: + cpu: 250m + memory: 512Mi +--- +# Source: openproject/templates/seeder-job.yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: openproject-seeder-1 + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: seeder +spec: + ttlSecondsAfterFinished: 86400 + template: + metadata: + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + openproject/process: seeder + app.kubernetes.io/component: seeder + spec: + serviceAccountName: openproject + securityContext: + fsGroup: 1000 + nodeSelector: + workload: app + volumes: + - name: tmp + # we can't use emptyDir due to the sticky bit issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: app-tmp + # we can't use emptyDir due to the sticky bit / world writable issue + # see: https://github.com/kubernetes/kubernetes/issues/110835 + ephemeral: + volumeClaimTemplate: + metadata: + creationTimestamp: null + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: longhorn + resources: + requests: + storage: 5Gi + - name: "data" + persistentVolumeClaim: + claimName: openproject + initContainers: + - name: prepare-tmpdir + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + image: docker.io/openproject/openproject:17.5.1-slim + imagePullPolicy: Always + command: + - sh + - -c + - mkdir -p /tmp/ruby && chmod 1777 /tmp/ruby + resources: + limits: + memory: 1024Mi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: check-db-ready + image: "docker.io/postgres:16" + imagePullPolicy: Always + command: [ + 'sh', + '-c', + 'until pg_isready -h $DATABASE_HOST -p $DATABASE_PORT -U openproject; do echo "waiting for database $DATABASE_HOST:$DATABASE_PORT"; sleep 2; done;' + ] + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + resources: + limits: + memory: 200Mi + requests: + memory: 200Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + containers: + - name: seeder + image: "docker.io/openproject/openproject:17.5.1-slim" + imagePullPolicy: Always + args: + - bash + - /app/docker/prod/seeder + envFrom: + - secretRef: + name: openproject-core + - secretRef: + name: openproject-memcached + - secretRef: + name: openproject-postgres-secret + env: + + - name: TMPDIR + value: /tmp/ruby + - name: OPENPROJECT_DB_PASSWORD + valueFrom: + secretKeyRef: + name: openproject-postgres-secret + key: password + - name: SECRET_KEY_BASE + valueFrom: + secretKeyRef: + name: secret-key-base-auto-generated + key: secret-key-base + resources: + limits: + memory: 1Gi + requests: + memory: 512Mi + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /app/tmp + name: app-tmp + - name: "data" + mountPath: "/var/openproject/assets" + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 1000 + runAsNonRoot: true + runAsUser: 1000 + seccompProfile: + type: RuntimeDefault + restartPolicy: OnFailure +--- +# Source: openproject/templates/secret_hocuspocus.yaml +# Only generate this secret if +# a) the included hocuspocus deployment is enabled +# b) no existing secret is configured for the openproject realtime collaboration +# c) no existing secret is configured for the included hocuspocus deployment +# and if +# d) this automatically generated secret does not exist yet. +--- +# Source: openproject/templates/secret_secret_key_base.yaml +# Only generate this secret if +# a) no existing secret is configured for SECRET_KEY_BASE +# and if +# b) SECRET_KEY_BASE is not provided via the environment values +# and if +# c) this automatically generated secret does not exist yet. +--- +# Source: openproject/templates/tests/test-connection.yaml +apiVersion: "v1" +kind: "Pod" +metadata: + name: "openproject-test-connection" + namespace: "openproject" + labels: + app.kubernetes.io/instance: openproject + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: openproject + app.kubernetes.io/version: 17.5.1 + helm.sh/chart: openproject-13.8.1 + app.kubernetes.io/component: test-connection + annotations: + "helm.sh/hook": test +spec: + serviceAccountName: openproject + containers: + - name: "wget" + image: "busybox" + imagePullPolicy: Always + command: ['wget'] + args: + - '--no-verbose' + - '--tries=1' + - '--spider' + - 'openproject:8080/health_check' + restartPolicy: "Never" +... diff --git a/rendered/pgadmin/pgadmin-httproute.yaml b/rendered/pgadmin/pgadmin-httproute.yaml new file mode 100644 index 0000000..00400bf --- /dev/null +++ b/rendered/pgadmin/pgadmin-httproute.yaml @@ -0,0 +1,106 @@ +--- +# Source: pgadmin/templates/pvc.yaml +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: pgadmin-data + namespace: pgadmin +spec: + accessModes: + - ReadWriteOnce + storageClassName: "longhorn" + resources: + requests: + storage: "5Gi" +--- +# Source: pgadmin/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + name: pgadmin + namespace: pgadmin +spec: + type: ClusterIP + selector: + app: pgadmin + ports: + - name: http + port: 80 + targetPort: 80 +--- +# Source: pgadmin/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: pgadmin + namespace: pgadmin +spec: + replicas: 1 + selector: + matchLabels: + app: pgadmin + template: + metadata: + labels: + app: pgadmin + spec: + nodeSelector: + workload: app + securityContext: + fsGroup: 5050 + fsGroupChangePolicy: "OnRootMismatch" + containers: + - name: pgadmin + image: "dpage/pgadmin4:9.15" + securityContext: + runAsUser: 5050 + runAsGroup: 5050 + ports: + - containerPort: 80 + name: http + envFrom: + - secretRef: + name: pgadmin-secret + env: + - name: SCRIPT_NAME + value: "/internal/dev/pgadmin" + volumeMounts: + - name: pgadmin-data + mountPath: /var/lib/pgadmin + volumes: + - name: pgadmin-data + persistentVolumeClaim: + claimName: pgadmin-data +--- +# Source: pgadmin/templates/httproute.yaml +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: pgadmin + namespace: pgadmin +spec: + parentRefs: + - name: public-gateway + namespace: apps + hostnames: + - "www.symcrest.com" + rules: + - matches: + - path: + type: Exact + value: "/internal/dev/pgadmin" + filters: + - type: RequestRedirect + requestRedirect: + path: + type: ReplaceFullPath + replaceFullPath: "/internal/dev/pgadmin/" + statusCode: 301 + + - matches: + - path: + type: PathPrefix + value: "/internal/dev/pgadmin/" + backendRefs: + - name: pgadmin + port: 80 diff --git a/rendered/pgadmin/pgadmin.yaml b/rendered/pgadmin/pgadmin.yaml index ae87a21..00400bf 100644 --- a/rendered/pgadmin/pgadmin.yaml +++ b/rendered/pgadmin/pgadmin.yaml @@ -83,7 +83,6 @@ spec: - name: public-gateway namespace: apps hostnames: - - "symcrest.com" - "www.symcrest.com" rules: - matches: