imfreedom/k8s-cluster

Move 50-hub.imfreedom.org to kustomize

2021-06-17, Gary Kramlich
20da8b38faa3
Move 50-hub.imfreedom.org to kustomize
# teamcity is a continuous integration system from jetbrains. This manifest
# sets it up as well as a postgres instance.
---
apiVersion: v1
kind: Service
metadata:
namespace: imfreedom
name: ci-postgres
labels:
app: ci
role: db
spec:
ports:
- port: 5432
protocol: TCP
selector:
app: ci
role: db
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
namespace: imfreedom
name: ci-postgres
labels:
app: ci
role: db
spec:
podSelector:
matchLabels:
app: ci
role: db
ingress:
- from:
- podSelector:
matchLabels:
app: ci
role: app
ports:
- port: 5432
protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: imfreedom
name: ci-postgres
labels:
app: ci
role: db
spec:
replicas: 1
selector:
matchLabels:
app: ci
role: db
strategy:
type: Recreate
template:
metadata:
labels:
app: ci
role: db
spec:
containers:
- name: postgres
image: postgres:11
imagePullPolicy: Always
env:
- name: POSTGRES_USER
valueFrom:
secretKeyRef:
name: ci-postgres
key: username
- name: POSTGRES_PASSWORD
valueFrom:
secretKeyRef:
name: ci-postgres
key: password
- name: POSTGRES_DB
valueFrom:
secretKeyRef:
name: ci-postgres
key: db
resources:
limits:
cpu: 200m
memory: 256Mi
requests:
cpu: 100m
memory: 128Mi
ports:
- containerPort: 5432
volumeMounts:
- mountPath: /var/lib/postgresql/data
name: ci-postgres
readOnly: false
subPath: postgresql
volumes:
- name: ci-postgres
persistentVolumeClaim:
claimName: ci-db
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
namespace: imfreedom
name: ci-db
labels:
app: ci
role: db
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
---
apiVersion: gemini.fairwinds.com/v1beta1
kind: SnapshotGroup
metadata:
namespace: imfreedom
name: ci-db
spec:
persistentVolumeClaim:
claimName: ci-db
schedule:
- every: 12 hours
keep: 2
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ci-http
namespace: imfreedom
spec:
entryPoints:
- http
routes:
- match: Host(`ci.imfreedom.org`) || Host(`artifacts.imfreedom.org`)
kind: Rule
services:
- name: ci
port: 8111
middlewares:
- name: https-redirect
---
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
name: ci-body-size
namespace: imfreedom
spec:
buffering:
maxRequestBodyBytes: 16777216
memRequestBodyBytes: 209715
---
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
name: ci
namespace: imfreedom
spec:
entryPoints:
- https
routes:
- match: Host(`ci.imfreedom.org`) || Host(`artifacts.imfreedom.org`)
kind: Rule
services:
- name: ci
port: 8111
middlewares:
# - name: ci-body-size
- name: common-headers
- name: hsts-headers
tls:
secretName: ci-tls
---
apiVersion: cert-manager.io/v1alpha2
kind: Certificate
metadata:
namespace: imfreedom
name: ci-tls
spec:
secretName: ci-tls
issuerRef:
name: letsencrypt
commonName: ci.imfreedom.org
dnsNames:
- ci.imfreedom.org
- artifacts.imfreedom.org
---
apiVersion: v1
kind: Service
metadata:
namespace: imfreedom
labels:
app: ci
role: app
name: ci
spec:
ports:
- port: 8111
protocol: TCP
selector:
app: ci
role: app
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
namespace: imfreedom
name: ci
labels:
app: ci
role: app
spec:
podSelector:
matchLabels:
app: ci
role: app
ingress:
- from:
- namespaceSelector:
matchLabels:
name: kube-public
podSelector:
matchLabels:
app: traefik
role: controller
ports:
- port: 8111
protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
namespace: imfreedom
name: ci
labels:
app: ci
role: app
spec:
replicas: 1
selector:
matchLabels:
app: ci
role: app
strategy:
type: Recreate
template:
metadata:
labels:
app: ci
role: app
spec:
containers:
- name: teamcity
image: docker.io/rwgrim/teamcity-server:latest
imagePullPolicy: Always
env:
- name: TEAMCITY_SERVER_MEM_OPTS
value: -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -Xmx3g -XX:ReservedCodeCacheSize=350m
- name: TEAMCITY_HTTPS_PROXY_ENABLED
value: 'true'
ports:
- containerPort: 8111
resources:
limits:
cpu: 1000m
memory: 3072Mi
requests:
cpu: 500m
memory: 1024Mi
volumeMounts:
- mountPath: /data/teamcity_server/datadir/
name: datadir
readOnly: false
subPath: datadir
- mountPath: /opt/teamcity/logs/
name: hostdir
readOnly: false
subPath: logs
- mountPath: /opt/teamcity/temp/
name: hostdir
readOnly: false
subPath: temp
securityContext:
# fsGroup: 1000
runAsUser: 1000
volumes:
- name: datadir
persistentVolumeClaim:
claimName: ci
- name: hostdir
emptyDir: {}
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
namespace: imfreedom
name: ci
labels:
app: ci
role: app
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 25Gi
---
apiVersion: gemini.fairwinds.com/v1beta1
kind: SnapshotGroup
metadata:
namespace: imfreedom
name: ci
spec:
persistentVolumeClaim:
claimName: ci
schedule:
- every: 12 hours
keep: 2
---