Initial commit

manifests/alaska/alaska.yaml

@@ -0,0 +1,362 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: alaska
+  labels:
+    name: alaska
+    environment: production
+    app.kubernetes.io/name: alaska
+    app.kubernetes.io/managed-by: manuals
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: alaska-config
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: alaska-config
+    app.kubernetes.io/part-of: alaska
+data:
+  NATS_URL: "nats://nats.workolik.com:4222"
+  LOG_LEVEL: "info"
+  ALLOWED_ORIGINS: "http://localhost:3001,http://localhost:3000,https://queue.workolik.com,https://console.nearlexpress.com"
+  EXTERNAL_BASE_URL: "https://jupiter.nearle.app"
+  WORKER_CONCURRENCY: "10"
+  RETRY_ATTEMPTS: "5"
+  RETRY_DELAY_SECONDS: "5"
+  NATS_STREAM: "EVENTS"
+  NATS_SUBJECT: "api.>"
+  NATS_CONSUMER: "worker_consumer"
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: nats-credentials
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: nats-credentials
+    app.kubernetes.io/part-of: alaska
+type: Opaque
+stringData:
+  username: admin
+  password: package@321#
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: external-endpoint-secrets
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: external-endpoint-secrets
+    app.kubernetes.io/part-of: alaska
+type: Opaque
+stringData:
+  api_key: ""  # Add your API key securely
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: deliveries
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: deliveries
+    app.kubernetes.io/instance: deliveries-primary
+    app.kubernetes.io/part-of: alaska
+    app.kubernetes.io/component: backend
+spec:
+  serviceName: "deliveries" # Required for StatefulSet
+  replicas: 4
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: deliveries
+      app.kubernetes.io/instance: deliveries-primary
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: deliveries
+        app.kubernetes.io/instance: deliveries-primary
+        app.kubernetes.io/part-of: alaska
+        app.kubernetes.io/component: backend
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "8000"
+        prometheus.io/path: "/metrics"
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 2000
+      tolerations:
+      - key: dedicated
+        operator: Equal
+        value: apps
+        effect: NoSchedule
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.workolik/app
+                operator: In
+                values:
+                - "true"
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - deliveries
+              topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: deliveries
+      containers:
+      - name: deliveries
+        image: workolik360/alaska:v1.2.0
+        imagePullPolicy: Always
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: false
+          capabilities:
+            drop:
+              - ALL
+        ports:
+        - containerPort: 8000
+          name: http
+        envFrom:
+        - configMapRef:
+            name: alaska-config
+        env:
+        - name: NATS_USER
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: username
+        - name: NATS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: password
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "200m"
+          limits:
+            memory: "1Gi"
+            cpu: "1000m"
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: 8000
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: 8000
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          timeoutSeconds: 3
+          failureThreshold: 3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: deliveries-service
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: deliveries
+    app.kubernetes.io/part-of: alaska
+spec:
+  type: ClusterIP
+  ports:
+  - port: 8000
+    targetPort: 8000
+    protocol: TCP
+    name: http
+  selector:
+    app.kubernetes.io/name: deliveries
+    app.kubernetes.io/instance: deliveries-primary
+  sessionAffinity: None
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: deliveries-loadbalancer
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: deliveries
+    app.kubernetes.io/part-of: alaska
+  annotations:
+    # Service health check port for LoadBalancer
+    # service.kubernetes.io/klipper-lb.healthcheck-port: "8201"
+spec:
+  type: NodePort
+  externalTrafficPolicy: Cluster
+  selector:
+    app.kubernetes.io/name: deliveries
+    app.kubernetes.io/instance: deliveries-primary
+  ports:
+  - name: http
+    port: 8201        # external LB port
+    targetPort: 8000  # API container port
+    nodePort: 30662
+    protocol: TCP
+  - name: https
+    port: 8441        # optional HTTPS passthrough
+    targetPort: 8000
+    protocol: TCP
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: deliveries-pdb
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: deliveries
+    app.kubernetes.io/part-of: alaska
+spec:
+  minAvailable: 50%
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: deliveries
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: deliveries-hpa
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: deliveries
+    app.kubernetes.io/part-of: alaska
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: StatefulSet
+    name: deliveries
+  minReplicas: 4
+  maxReplicas: 20
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 60
+  - type: Resource
+    resource:
+      name: memory
+      target:
+        type: Utilization
+        averageUtilization: 70
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: gateway
+    app.kubernetes.io/part-of: alaska
+spec:
+  gatewayClassName: standard
+  listeners:
+  - name: http
+    protocol: HTTP
+    port: 8201
+    allowedRoutes:
+      namespaces:
+        from: All
+  - name: https
+    protocol: HTTPS
+    port: 8441
+    allowedRoutes:
+      namespaces:
+        from: All
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - name: deliveries-tls-cert
+  - name: nearle-http
+    protocol: HTTP
+    port: 8202
+    allowedRoutes:
+      namespaces:
+        from: All
+  - name: nearle-https
+    protocol: HTTPS
+    port: 8442
+    allowedRoutes:
+      namespaces:
+        from: All
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - name: nearle-tls-cert
+        namespace: nearle # Must copy secret to alaska or use ReferenceGrant. For now assume secret is in Alaska or copied.
+        # Actually, simpler: Use 'nearle-tls-cert' but putting secret in alaska namespace is required for cross-namespace ref usually unless ReferenceGrant used.
+        # Let's keep it simple: We will COPY the secret to 'alaska' namespace.
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: deliveries-route
+  namespace: alaska
+  labels:
+    app.kubernetes.io/name: deliveries-route
+    app.kubernetes.io/part-of: alaska
+spec:
+  parentRefs:
+  - name: gateway
+    namespace: alaska
+  hostnames:
+  - "queue.workolik.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /live
+    backendRefs:
+    - name: deliveries-service
+      port: 8000
+      weight: 100
+    backendRefs:
+    - name: deliveries-service
+      port: 8000
+      weight: 100
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /live/api/v1/mob/orders
+    backendRefs:
+    - name: fiesta
+      namespace: nearle
+      port: 80
+      weight: 100
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /live/api/v1/web/products
+    backendRefs:
+    - name: fiesta
+      namespace: nearle
+      port: 80
+      weight: 100
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /health
+    backendRefs:
+    - name: deliveries-service
+      port: 8000
+      weight: 100

manifests/alaska/k8s-dashboard.yaml

@@ -0,0 +1,328 @@
+# Kubernetes Dashboard - Official Web UI
+# Deploy with: kubectl apply -f manifests/alaska/k8s-dashboard.yaml
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubernetes-dashboard
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: admin-user
+  namespace: kubernetes-dashboard
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: admin-user
+  namespace: kubernetes-dashboard
+  annotations:
+    kubernetes.io/service-account.name: "admin-user"
+type: kubernetes.io/service-account-token
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-dashboard-admin
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+  labels:
+    k8s-app: kubernetes-dashboard
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: kubernetes-dashboard
+  template:
+    metadata:
+      labels:
+        k8s-app: kubernetes-dashboard
+    spec:
+      containers:
+      - name: kubernetes-dashboard
+        image: kubernetesui/dashboard:v2.7.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - containerPort: 8443
+          protocol: TCP
+        args:
+          - --auto-generate-certificates
+          - --namespace=kubernetes-dashboard
+          - --enable-skip-login
+          - --enable-insecure-login
+          - --insecure-port=9090
+        volumeMounts:
+        - name: kubernetes-dashboard-certs
+          mountPath: /certs
+        - name: tmp-volume
+          mountPath: /tmp
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsUser: 1001
+          runAsGroup: 2001
+        livenessProbe:
+          httpGet:
+            scheme: HTTPS
+            path: /
+            port: 8443
+          initialDelaySeconds: 30
+          timeoutSeconds: 30
+          periodSeconds: 10
+          failureThreshold: 3
+        resources:
+          limits:
+            cpu: 200m
+            memory: 256Mi
+          requests:
+            cpu: 100m
+            memory: 128Mi
+      volumes:
+      - name: kubernetes-dashboard-certs
+        secret:
+          secretName: kubernetes-dashboard-certs
+      - name: tmp-volume
+        emptyDir: {}
+      serviceAccountName: kubernetes-dashboard
+      nodeSelector:
+        "kubernetes.io/os": linux
+      tolerations:
+      - key: node-role.kubernetes.io/master
+        operator: Exists
+        effect: NoSchedule
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+  labels:
+    k8s-app: kubernetes-dashboard
+spec:
+  type: ClusterIP
+  ports:
+  - port: 443
+    targetPort: 8443
+    protocol: TCP
+    name: https
+  - port: 9090
+    targetPort: 9090
+    protocol: TCP
+    name: http
+  selector:
+    k8s-app: kubernetes-dashboard
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubernetes-dashboard
+rules:
+- apiGroups: [""]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["apps"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["networking.k8s.io"]
+  resources: ["*"]
+  verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-dashboard
+subjects:
+- kind: ServiceAccount
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: kubernetes-dashboard-secrets
+  namespace: kubernetes-dashboard
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "update", "create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: kubernetes-dashboard-secrets
+  namespace: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubernetes-dashboard-secrets
+subjects:
+- kind: ServiceAccount
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kubernetes-dashboard-certs
+  namespace: kubernetes-dashboard
+type: Opaque
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: kubernetes-dashboard-csrf
+  namespace: kubernetes-dashboard
+type: Opaque
+data:
+  csrf: ""  # Will be auto-generated by dashboard
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dashboard-proxy-config
+  namespace: kubernetes-dashboard
+data:
+  nginx.conf: |
+    events {
+        worker_connections 1024;
+    }
+    http {
+        upstream k8s_dashboard {
+            server kubernetes-dashboard:443;
+        }
+        server {
+            listen 8083;
+            server_name _;
+            location / {
+                proxy_pass https://k8s_dashboard;
+                proxy_ssl_verify off;
+                proxy_set_header Host $host;
+                proxy_set_header X-Real-IP $remote_addr;
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+                proxy_http_version 1.1;
+                proxy_set_header Upgrade $http_upgrade;
+                proxy_set_header Connection "upgrade";
+                proxy_connect_timeout 60s;
+                proxy_send_timeout 60s;
+                proxy_read_timeout 60s;
+            }
+        }
+    }
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: dashboard-proxy
+  namespace: kubernetes-dashboard
+  labels:
+    app.kubernetes.io/name: dashboard-proxy
+    app.kubernetes.io/part-of: kubernetes-dashboard
+spec:
+  serviceName: "dashboard-proxy"
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: dashboard-proxy
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: dashboard-proxy
+        app.kubernetes.io/part-of: kubernetes-dashboard
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:alpine
+        ports:
+        - containerPort: 8083
+        volumeMounts:
+        - name: nginx-config
+          mountPath: /etc/nginx/nginx.conf
+          subPath: nginx.conf
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "50m"
+          limits:
+            memory: "128Mi"
+            cpu: "100m"
+      volumes:
+      - name: nginx-config
+        configMap:
+          name: dashboard-proxy-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard-proxy
+  namespace: kubernetes-dashboard
+  labels:
+    app.kubernetes.io/name: dashboard-proxy
+spec:
+  type: NodePort
+  selector:
+    app.kubernetes.io/name: dashboard-proxy
+  ports:
+  - port: 8083
+    targetPort: 8083
+    nodePort: 30826
+    protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dashboard-loadbalancer
+  namespace: kubernetes-dashboard
+  labels:
+    app.kubernetes.io/name: kubernetes-dashboard
+    app.kubernetes.io/component: loadbalancer
+spec:
+  type: NodePort
+  selector:
+    k8s-app: kubernetes-dashboard
+  ports:
+  - name: http
+    port: 9090
+    targetPort: 9090  # Dashboard HTTP port
+    nodePort: 30827   # Fixed NodePort for nginx proxy
+    protocol: TCP