Initial commit
This commit is contained in:
362
manifests/alaska/alaska.yaml
Normal file
362
manifests/alaska/alaska.yaml
Normal file
@@ -0,0 +1,362 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: alaska
|
||||
labels:
|
||||
name: alaska
|
||||
environment: production
|
||||
app.kubernetes.io/name: alaska
|
||||
app.kubernetes.io/managed-by: manuals
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: alaska-config
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: alaska-config
|
||||
app.kubernetes.io/part-of: alaska
|
||||
data:
|
||||
NATS_URL: "nats://nats.workolik.com:4222"
|
||||
LOG_LEVEL: "info"
|
||||
ALLOWED_ORIGINS: "http://localhost:3001,http://localhost:3000,https://queue.workolik.com,https://console.nearlexpress.com"
|
||||
EXTERNAL_BASE_URL: "https://jupiter.nearle.app"
|
||||
WORKER_CONCURRENCY: "10"
|
||||
RETRY_ATTEMPTS: "5"
|
||||
RETRY_DELAY_SECONDS: "5"
|
||||
NATS_STREAM: "EVENTS"
|
||||
NATS_SUBJECT: "api.>"
|
||||
NATS_CONSUMER: "worker_consumer"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: nats-credentials
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: nats-credentials
|
||||
app.kubernetes.io/part-of: alaska
|
||||
type: Opaque
|
||||
stringData:
|
||||
username: admin
|
||||
password: package@321#
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: external-endpoint-secrets
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: external-endpoint-secrets
|
||||
app.kubernetes.io/part-of: alaska
|
||||
type: Opaque
|
||||
stringData:
|
||||
api_key: "" # Add your API key securely
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
metadata:
|
||||
name: deliveries
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/instance: deliveries-primary
|
||||
app.kubernetes.io/part-of: alaska
|
||||
app.kubernetes.io/component: backend
|
||||
spec:
|
||||
serviceName: "deliveries" # Required for StatefulSet
|
||||
replicas: 4
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/instance: deliveries-primary
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/instance: deliveries-primary
|
||||
app.kubernetes.io/part-of: alaska
|
||||
app.kubernetes.io/component: backend
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "8000"
|
||||
prometheus.io/path: "/metrics"
|
||||
spec:
|
||||
securityContext:
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 2000
|
||||
tolerations:
|
||||
- key: dedicated
|
||||
operator: Equal
|
||||
value: apps
|
||||
effect: NoSchedule
|
||||
affinity:
|
||||
nodeAffinity:
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: node-role.workolik/app
|
||||
operator: In
|
||||
values:
|
||||
- "true"
|
||||
podAntiAffinity:
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 100
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/name
|
||||
operator: In
|
||||
values:
|
||||
- deliveries
|
||||
topologyKey: kubernetes.io/hostname
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: ScheduleAnyway
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
containers:
|
||||
- name: deliveries
|
||||
image: workolik360/alaska:v1.2.0
|
||||
imagePullPolicy: Always
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
ports:
|
||||
- containerPort: 8000
|
||||
name: http
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: alaska-config
|
||||
env:
|
||||
- name: NATS_USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nats-credentials
|
||||
key: username
|
||||
- name: NATS_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: nats-credentials
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
memory: "256Mi"
|
||||
cpu: "200m"
|
||||
limits:
|
||||
memory: "1Gi"
|
||||
cpu: "1000m"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health
|
||||
port: 8000
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: 8000
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 5
|
||||
timeoutSeconds: 3
|
||||
failureThreshold: 3
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: deliveries-service
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/part-of: alaska
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 8000
|
||||
targetPort: 8000
|
||||
protocol: TCP
|
||||
name: http
|
||||
selector:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/instance: deliveries-primary
|
||||
sessionAffinity: None
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: deliveries-loadbalancer
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/part-of: alaska
|
||||
annotations:
|
||||
# Service health check port for LoadBalancer
|
||||
# service.kubernetes.io/klipper-lb.healthcheck-port: "8201"
|
||||
spec:
|
||||
type: NodePort
|
||||
externalTrafficPolicy: Cluster
|
||||
selector:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/instance: deliveries-primary
|
||||
ports:
|
||||
- name: http
|
||||
port: 8201 # external LB port
|
||||
targetPort: 8000 # API container port
|
||||
nodePort: 30662
|
||||
protocol: TCP
|
||||
- name: https
|
||||
port: 8441 # optional HTTPS passthrough
|
||||
targetPort: 8000
|
||||
protocol: TCP
|
||||
---
|
||||
apiVersion: policy/v1
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: deliveries-pdb
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/part-of: alaska
|
||||
spec:
|
||||
minAvailable: 50%
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
---
|
||||
apiVersion: autoscaling/v2
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: deliveries-hpa
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: deliveries
|
||||
app.kubernetes.io/part-of: alaska
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: StatefulSet
|
||||
name: deliveries
|
||||
minReplicas: 4
|
||||
maxReplicas: 20
|
||||
metrics:
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 60
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: 70
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: Gateway
|
||||
metadata:
|
||||
name: gateway
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: gateway
|
||||
app.kubernetes.io/part-of: alaska
|
||||
spec:
|
||||
gatewayClassName: standard
|
||||
listeners:
|
||||
- name: http
|
||||
protocol: HTTP
|
||||
port: 8201
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: All
|
||||
- name: https
|
||||
protocol: HTTPS
|
||||
port: 8441
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: All
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- name: deliveries-tls-cert
|
||||
- name: nearle-http
|
||||
protocol: HTTP
|
||||
port: 8202
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: All
|
||||
- name: nearle-https
|
||||
protocol: HTTPS
|
||||
port: 8442
|
||||
allowedRoutes:
|
||||
namespaces:
|
||||
from: All
|
||||
tls:
|
||||
mode: Terminate
|
||||
certificateRefs:
|
||||
- name: nearle-tls-cert
|
||||
namespace: nearle # Must copy secret to alaska or use ReferenceGrant. For now assume secret is in Alaska or copied.
|
||||
# Actually, simpler: Use 'nearle-tls-cert' but putting secret in alaska namespace is required for cross-namespace ref usually unless ReferenceGrant used.
|
||||
# Let's keep it simple: We will COPY the secret to 'alaska' namespace.
|
||||
---
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: deliveries-route
|
||||
namespace: alaska
|
||||
labels:
|
||||
app.kubernetes.io/name: deliveries-route
|
||||
app.kubernetes.io/part-of: alaska
|
||||
spec:
|
||||
parentRefs:
|
||||
- name: gateway
|
||||
namespace: alaska
|
||||
hostnames:
|
||||
- "queue.workolik.com"
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /live
|
||||
backendRefs:
|
||||
- name: deliveries-service
|
||||
port: 8000
|
||||
weight: 100
|
||||
backendRefs:
|
||||
- name: deliveries-service
|
||||
port: 8000
|
||||
weight: 100
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /live/api/v1/mob/orders
|
||||
backendRefs:
|
||||
- name: fiesta
|
||||
namespace: nearle
|
||||
port: 80
|
||||
weight: 100
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /live/api/v1/web/products
|
||||
backendRefs:
|
||||
- name: fiesta
|
||||
namespace: nearle
|
||||
port: 80
|
||||
weight: 100
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /health
|
||||
backendRefs:
|
||||
- name: deliveries-service
|
||||
port: 8000
|
||||
weight: 100
|
||||
Reference in New Issue
Block a user