Merge pull request #62 from ropable/master

Kustomize resource definitions
dbca-wa · Oct 18, 2023 · dd09178 · dd09178
2 parents 4cd9ecc + 6b68527
commit dd09178
Show file tree

Hide file tree

Showing 14 changed files with 318 additions and 0 deletions.
diff --git a/kustomize/README.md b/kustomize/README.md
@@ -0,0 +1,29 @@
+# CSW Kubernetes Kustomize overlay configuration
+
+Declarative management of CSW Kubernetes resources using Kustomize.
+
+# How to use
+
+Within an overlay directory, create a `.env` file to contain required secret
+values in the format KEY=value (i.e. `overlays/uat/.env`). Required values:
+
+    DATABASE_URL=value
+    SECRET_KEY=value
+
+Review the built resource output using `kustomize`:
+
+```bash
+kustomize build kustomize/overlays/uat/ | less
+```
+
+Run `kubectl` with the `-k` flag to generate resources for a given overlay:
+
+```bash
+kubectl apply -k kustomize/overlays/uat --namespace sss --dry-run=client
+```
+
+# References:
+
+* https://kubernetes.io/docs/tasks/manage-kubernetes-objects/kustomization/
+* https://github.com/kubernetes-sigs/kustomize
+* https://github.com/kubernetes-sigs/kustomize/tree/master/examples
diff --git a/kustomize/base/deployment.yaml b/kustomize/base/deployment.yaml
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: csw-deployment
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+  template:
+    spec:
+      containers:
+      - name: csw
+        env:
+        - name: ALLOWED_DOMAINS
+          value: ".dbca.wa.gov.au"
+        - name: CSRF_COOKIE_SECURE
+          value: "True"
+        - name: SESSION_COOKIE_SECURE
+          value: "True"
+        - name: TZ
+          value: "Australia/Perth"
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "25m"
+          limits:
+            memory: "4096Mi"
+            cpu: "1000m"
+        livenessProbe:
+          httpGet:
+            path: /liveness
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 3
+          periodSeconds: 3
+          failureThreshold: 3
+          timeoutSeconds: 2
+        readinessProbe:
+          httpGet:
+            path: /readiness
+            port: 8080
+            scheme: HTTP
+          initialDelaySeconds: 3
+          periodSeconds: 3
+          failureThreshold: 3
+          timeoutSeconds: 2
+        securityContext:
+          runAsNonRoot: true
+          privileged: false
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          readOnlyRootFilesystem: false
+      restartPolicy: Always
diff --git a/kustomize/base/kustomization.yaml b/kustomize/base/kustomization.yaml
@@ -0,0 +1,3 @@
+resources:
+- deployment.yaml
+- service.yaml
diff --git a/kustomize/base/service.yaml b/kustomize/base/service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: csw-clusterip
+spec:
+  type: ClusterIP
+  ports:
+  - name: wsgi
+    port: 8080
+    protocol: TCP
+    targetPort: 8080
diff --git a/kustomize/overlays/prod/deployment_patch.yaml b/kustomize/overlays/prod/deployment_patch.yaml
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: csw-deployment
+  labels:
+    app: csw-prod
+spec:
+  selector:
+    matchLabels:
+      app: csw-prod
+  template:
+    metadata:
+      labels:
+        app: csw-prod
+    spec:
+      containers:
+      - name: csw
+        image: ghcr.io/dbca-wa/csw:1.3.8
+        imagePullPolicy: IfNotPresent
+        env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-prod
+              key: DATABASE_URL
+        - name: SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-prod
+              key: SECRET_KEY
+        - name: BASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-prod
+              key: BASE_URL
+        - name: CORS_URL
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-prod
+              key: CORS_URL
+        - name: AZURE_ACCOUNT_NAME
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-prod
+              key: AZURE_ACCOUNT_NAME
+        - name: AZURE_ACCOUNT_KEY
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-prod
+              key: AZURE_ACCOUNT_KEY
+        - name: AZURE_CONTAINER
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-prod
+              key: AZURE_CONTAINER
diff --git a/kustomize/overlays/prod/ingress.yaml b/kustomize/overlays/prod/ingress.yaml
@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: csw-ingress
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: csw.dbca.wa.gov.au
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: csw-clusterip-prod
+            port:
+              number: 8080
diff --git a/kustomize/overlays/prod/kustomization.yaml b/kustomize/overlays/prod/kustomization.yaml
@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+nameSuffix: -prod
+secretGenerator:
+- name: csw-env
+  type: Opaque
+  envs:
+  - .env
+resources:
+- ../../base
+- ingress.yaml
+- pdb.yaml
+labels:
+- includeSelectors: true
+  pairs:
+    variant: prod
+patches:
+- path: deployment_patch.yaml
+- path: service_patch.yaml
diff --git a/kustomize/overlays/prod/pdb.yaml b/kustomize/overlays/prod/pdb.yaml
@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: csw-pdb
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: csw-prod
+      variant: prod
diff --git a/kustomize/overlays/prod/service_patch.yaml b/kustomize/overlays/prod/service_patch.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: csw-clusterip
+spec:
+  type: ClusterIP
+  selector:
+    app: csw-prod
+    variant: prod
diff --git a/kustomize/overlays/uat/deployment_patch.yaml b/kustomize/overlays/uat/deployment_patch.yaml
@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: csw-deployment
+  labels:
+    app: csw-uat
+spec:
+  selector:
+    matchLabels:
+      app: csw-uat
+  template:
+    metadata:
+      labels:
+        app: csw-uat
+    spec:
+      containers:
+      - name: csw
+        image: ghcr.io/dbca-wa/csw
+        imagePullPolicy: Always
+        env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-uat
+              key: DATABASE_URL
+        - name: SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-uat
+              key: SECRET_KEY
+        - name: BASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-uat
+              key: BASE_URL
+        - name: CORS_URL
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-uat
+              key: CORS_URL
+        - name: AZURE_ACCOUNT_NAME
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-uat
+              key: AZURE_ACCOUNT_NAME
+        - name: AZURE_ACCOUNT_KEY
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-uat
+              key: AZURE_ACCOUNT_KEY
+        - name: AZURE_CONTAINER
+          valueFrom:
+            secretKeyRef:
+              name: csw-env-uat
+              key: AZURE_CONTAINER
diff --git a/kustomize/overlays/uat/ingress.yaml b/kustomize/overlays/uat/ingress.yaml
@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: csw-ingress
+spec:
+  ingressClassName: nginx
+  rules:
+  - host: csw-uat.dbca.wa.gov.au
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: csw-clusterip-uat
+            port:
+              number: 8080
diff --git a/kustomize/overlays/uat/kustomization.yaml b/kustomize/overlays/uat/kustomization.yaml
@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+nameSuffix: -uat
+secretGenerator:
+- name: csw-env
+  type: Opaque
+  envs:
+  - .env
+resources:
+- ../../base
+- ingress.yaml
+- pdb.yaml
+labels:
+- includeSelectors: true
+  pairs:
+    variant: uat
+patches:
+- path: deployment_patch.yaml
+- path: service_patch.yaml
diff --git a/kustomize/overlays/uat/pdb.yaml b/kustomize/overlays/uat/pdb.yaml
@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: csw-pdb
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: csw-uat
+      variant: uat
diff --git a/kustomize/overlays/uat/service_patch.yaml b/kustomize/overlays/uat/service_patch.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: csw-clusterip
+spec:
+  type: ClusterIP
+  selector:
+    app: csw-uat
+    variant: uat