diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ca91d2a --- /dev/null +++ b/.gitignore @@ -0,0 +1,58 @@ +# Python +__pycache__/ +*.py[cod] +*$py.class +*.so +.Python +build/ +develop-eggs/ +dist/ +downloads/ +eggs/ +.eggs/ +lib/ +lib64/ +parts/ +sdist/ +var/ +wheels/ +*.egg-info/ +.installed.cfg +*.egg + +# Virtual Environment +venv/ +ENV/ +env/ +.env/ + +# IDE +.idea/ +.vscode/ +*.swp +*.swo +.DS_Store + +# Kubernetes +kubeconfig +*.kubeconfig + +# Logs and databases +*.log +*.sqlite3 +*.db + +# Local development +.env +.env.local +.env.*.local + +# Coverage reports +htmlcov/ +.coverage +.coverage.* +coverage.xml +*.cover + +# macos +.DS_Store diff --git a/kustomize/sd3/api/base/deployment.yaml b/kustomize/sd3/api/base/deployment.yaml new file mode 100644 index 0000000..62115a7 --- /dev/null +++ b/kustomize/sd3/api/base/deployment.yaml @@ -0,0 +1,87 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: sd3-api + labels: + app: sd3-api +spec: + replicas: 1 + selector: + matchLabels: + app: sd3-api + template: + metadata: + labels: + app: sd3-api + spec: + serviceAccount: sd3 + containers: + - name: sd3-api + image: sd3-api + command: + ["/bin/sh", "-c"] + args: + ['source /secrets/sd3-api-env && "/usr/src/app/app"'] + ports: + - containerPort: 8000 + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 500m + memory: 512Mi + # livenessProbe: + # httpGet: + # path: /v1/component_status + # port: 8000 + # initialDelaySeconds: 30 + # periodSeconds: 10 + # readinessProbe: + # httpGet: + # path: /v1/component_status + # port: 8000 + # initialDelaySeconds: 5 + # periodSeconds: 5 + volumeMounts: + - mountPath: "/secrets" + name: "secrets" + initContainers: + - name: "vault-agent" + command: + - "sh" + - "-c" + - "vault agent -config=/etc/vault/vault-agent.hcl -exit-after-auth=true" + env: + - name: "VAULT_ADDR" + value: "https://vault-lb.eco.tsi-dev.otc-service.com:8200" + image: "hashicorp/vault" + resources: + limits: + cpu: "300m" + memory: "300Mi" + requests: + cpu: "50m" + memory: "50Mi" + volumeMounts: + - mountPath: "/etc/vault" + name: "vault-agent-config" + - mountPath: "/secrets" + name: "secrets" + - mountPath: "/var/run/secrets/tokens" + name: "k8-tokens" + readOnly: true + volumes: + - name: vault-agent-config + configMap: + defaultMode: 420 + name: sd3-vault-config + - name: secrets + emptyDir: {} + - name: "k8-tokens" + projected: + defaultMode: 420 + sources: + - serviceAccountToken: + expirationSeconds: 7200 + path: "vault-token" diff --git a/kustomize/sd3/api/base/ingress.yaml b/kustomize/sd3/api/base/ingress.yaml new file mode 100644 index 0000000..c98abbb --- /dev/null +++ b/kustomize/sd3/api/base/ingress.yaml @@ -0,0 +1,21 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: sd3-api-ingress + labels: + app: sd3-api + annotations: + cert-manager.io/cluster-issuer: "letsencrypt-prod" +spec: + ingressClassName: nginx + rules: + - host: api.status.otc-service.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: sd3-api + port: + number: 8000 diff --git a/kustomize/sd3/api/base/kustomization.yaml b/kustomize/sd3/api/base/kustomization.yaml new file mode 100644 index 0000000..c25f87f --- /dev/null +++ b/kustomize/sd3/api/base/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - service.yaml + - deployment.yaml + - ingress.yaml + - sa.yaml diff --git a/kustomize/sd3/api/base/sa.yaml b/kustomize/sd3/api/base/sa.yaml new file mode 100644 index 0000000..7166688 --- /dev/null +++ b/kustomize/sd3/api/base/sa.yaml @@ -0,0 +1,19 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: sd3 + labels: + app: sd3-api +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: sd3-api-role-tokenreview-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: +- kind: ServiceAccount + name: sd3 + namespace: sd3-test diff --git a/kustomize/sd3/api/base/service.yaml b/kustomize/sd3/api/base/service.yaml new file mode 100644 index 0000000..0da50ee --- /dev/null +++ b/kustomize/sd3/api/base/service.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Service +metadata: + name: sd3-api + labels: + app: sd3-api +spec: + ports: + - port: 8000 + targetPort: 8000 + protocol: TCP + name: http + selector: + app: sd3-api diff --git a/kustomize/sd3/api/overlays/test/kustomization.yaml b/kustomize/sd3/api/overlays/test/kustomization.yaml new file mode 100644 index 0000000..839de47 --- /dev/null +++ b/kustomize/sd3/api/overlays/test/kustomization.yaml @@ -0,0 +1,40 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +namespace: sd3-test + +resources: + - ../../base + +images: + - name: sd3-api + newName: quay.io/stackmon/status-dashboard-v3 + newTag: sha-bc924ae + +configMapGenerator: + - name: sd3-vault-config + files: + - vault-agent.hcl + +patchesStrategicMerge: + - |- + apiVersion: networking.k8s.io/v1 + kind: Ingress + metadata: + name: sd3-api-ingress + spec: + rules: + - host: api.test.status.otc-service.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: sd3-api + port: + number: 8000 + tls: + - hosts: + - api.test.status.otc-service.com + secretName: sd3-cert-test diff --git a/kustomize/sd3/api/overlays/test/vault-agent.hcl b/kustomize/sd3/api/overlays/test/vault-agent.hcl new file mode 100644 index 0000000..add512c --- /dev/null +++ b/kustomize/sd3/api/overlays/test/vault-agent.hcl @@ -0,0 +1,35 @@ +pid_file = "/home/vault/pidfile" + +auto_auth { + method "kubernetes" { + mount_path = "auth/kubernetes_otcinfra2" + config = { + role = "sd3" + token_path = "/var/run/secrets/tokens/vault-token" + } + } + sink "file" { + config = { + path = "/home/vault/.vault-token" + } + } +} + +template { + destination = "/secrets/sd3-api-env" + contents = <