145 lines
4.6 KiB
YAML
145 lines
4.6 KiB
YAML
# MasterOne on the prod cluster — Longhorn 3-replica storage.
|
|
# Portal + postgres; public entry via hostPort 443 on workernode03 (only free 443).
|
|
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: masterone
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata: {name: masterone-postgres, namespace: masterone}
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
storageClassName: longhorn
|
|
resources: {requests: {storage: 10Gi}}
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata: {name: masterone-uploads, namespace: masterone}
|
|
spec:
|
|
accessModes: [ReadWriteOnce]
|
|
storageClassName: longhorn
|
|
resources: {requests: {storage: 10Gi}}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata: {name: postgres, namespace: masterone}
|
|
spec:
|
|
replicas: 1
|
|
strategy: {type: Recreate}
|
|
selector: {matchLabels: {app: postgres}}
|
|
template:
|
|
metadata: {labels: {app: postgres}}
|
|
spec:
|
|
containers:
|
|
- name: postgres
|
|
image: postgres:17-alpine
|
|
ports: [{containerPort: 5432}]
|
|
env:
|
|
- {name: POSTGRES_DB, value: masterone_portal}
|
|
- {name: POSTGRES_USER, value: masterone}
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom: {secretKeyRef: {name: masterone-secrets, key: POSTGRES_PASSWORD}}
|
|
volumeMounts: [{name: data, mountPath: /var/lib/postgresql/data, subPath: pgdata}]
|
|
readinessProbe:
|
|
exec: {command: ["pg_isready","-U","masterone","-d","masterone_portal"]}
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim: {claimName: masterone-postgres}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata: {name: postgres, namespace: masterone}
|
|
spec:
|
|
selector: {app: postgres}
|
|
ports: [{port: 5432, targetPort: 5432}]
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata: {name: portal, namespace: masterone}
|
|
spec:
|
|
replicas: 1
|
|
strategy: {type: Recreate}
|
|
selector: {matchLabels: {app: portal}}
|
|
template:
|
|
metadata: {labels: {app: portal}}
|
|
spec:
|
|
containers:
|
|
- name: portal
|
|
image: masterone-portal:k8s2
|
|
imagePullPolicy: IfNotPresent
|
|
ports: [{containerPort: 8095}]
|
|
envFrom: [{secretRef: {name: masterone-secrets}}]
|
|
env:
|
|
- {name: PORTAL_MASTERONE_ROOT, value: /masterone}
|
|
- name: DATABASE_URL
|
|
value: postgresql://masterone:$(POSTGRES_PASSWORD)@postgres.masterone.svc.cluster.local/masterone_portal
|
|
- {name: PORTAL_COOKIE_SECURE, value: "1"}
|
|
volumeMounts: [{name: uploads, mountPath: /app/uploads}]
|
|
readinessProbe: {httpGet: {path: /healthz, port: 8095}, initialDelaySeconds: 15, periodSeconds: 10}
|
|
livenessProbe: {httpGet: {path: /healthz, port: 8095}, initialDelaySeconds: 30, periodSeconds: 30}
|
|
resources:
|
|
requests: {memory: 512Mi, cpu: 100m}
|
|
limits: {memory: 2Gi}
|
|
volumes:
|
|
- name: uploads
|
|
persistentVolumeClaim: {claimName: masterone-uploads}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata: {name: portal, namespace: masterone}
|
|
spec:
|
|
selector: {app: portal}
|
|
ports: [{port: 8095, targetPort: 8095}]
|
|
---
|
|
# Public entry: nginx on node03 hostPort 443 (plain HTTP — TLS terminates at Caddy on the mgmt VPC)
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata: {name: ingress-conf, namespace: masterone}
|
|
data:
|
|
default.conf: |
|
|
server {
|
|
listen 443 ssl;
|
|
ssl_certificate /etc/nginx/tls/tls.crt;
|
|
ssl_certificate_key /etc/nginx/tls/tls.key;
|
|
client_max_body_size 100m;
|
|
location / {
|
|
proxy_pass http://portal.masterone.svc.cluster.local:8095;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto https;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_read_timeout 300s;
|
|
}
|
|
}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata: {name: edge-ingress, namespace: masterone}
|
|
spec:
|
|
replicas: 1
|
|
strategy: {type: Recreate}
|
|
spec:
|
|
replicas: 1
|
|
selector: {matchLabels: {app: edge-ingress}}
|
|
template:
|
|
metadata: {labels: {app: edge-ingress}}
|
|
spec:
|
|
nodeSelector: {kubernetes.io/hostname: workernode03.hopeamulets.com}
|
|
containers:
|
|
- name: nginx
|
|
image: nginx:1.27-alpine
|
|
ports: [{containerPort: 443, hostPort: 443}]
|
|
volumeMounts:
|
|
- {name: conf, mountPath: /etc/nginx/conf.d}
|
|
- {name: tls, mountPath: /etc/nginx/tls}
|
|
volumes:
|
|
- name: conf
|
|
configMap: {name: ingress-conf}
|
|
- name: tls
|
|
secret: {secretName: edge-tls}
|