alexandre.pires
aee57a8b89
- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand. - Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters. - Removed unused gitea-auth script from playbook_gitea.yml. - Updated systools_version in playbook_systools.yml to 0.4.5. - Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS. - Added a new script test_imaps for IMAP testing. - Updated Terraform configurations for various applications, including: - Added a backup script for MariaDB with retention policy. - Changed Gitea version to 1.24-rootless and adjusted SSH settings. - Updated Nginx configurations to log errors and access to stderr/stdout. - Refactored services to use ClusterIP type and adjusted security contexts for deployments. - Added temporary storage for applications using empty_dir. - Enhanced backup.sh scripts for better error handling and logging.
353 lines
8.9 KiB
Terraform
353 lines
8.9 KiB
Terraform
resource "kubernetes_secret" "root_password" {
|
|
metadata {
|
|
name = "${var.app_name}-root-credentials"
|
|
namespace = var.namespace
|
|
}
|
|
data = {
|
|
username = "root"
|
|
password = var.root_password
|
|
}
|
|
type = "Opaque"
|
|
}
|
|
|
|
resource "kubernetes_manifest" "internal_cert" {
|
|
count = var.tls_enabled ? 1 : 0
|
|
manifest = {
|
|
apiVersion = "cert-manager.io/v1"
|
|
kind = "Certificate"
|
|
metadata = {
|
|
name = "mariadb-cert"
|
|
namespace = var.namespace
|
|
}
|
|
spec = {
|
|
secretName = "mariadb-cert"
|
|
issuerRef = {
|
|
name = var.issuer
|
|
kind = "ClusterIssuer"
|
|
}
|
|
commonName = "${var.app_name}-db-cert"
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_config_map" "ssl_config" {
|
|
count = var.tls_enabled ? 1 : 0
|
|
metadata {
|
|
name = "${var.app_name}-mariadb-config"
|
|
namespace = var.namespace
|
|
}
|
|
data = {
|
|
"tls.cnf" = file("${path.module}/resources/tls.cnf")
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_config_map" "backup_script" {
|
|
metadata {
|
|
name = "${var.app_name}-sql-backup-script"
|
|
namespace = var.namespace
|
|
}
|
|
data = {
|
|
"backup.sh" = file("${path.module}/resources/backup.sh")
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_service_account" "service_account" {
|
|
|
|
metadata {
|
|
name = "${var.app_name}-mariadb-sa"
|
|
namespace = var.namespace
|
|
}
|
|
|
|
automount_service_account_token = false
|
|
}
|
|
|
|
resource "kubernetes_secret" "app_password" {
|
|
metadata {
|
|
name = "${var.app_name}-app-credentials"
|
|
namespace = var.namespace
|
|
}
|
|
data = {
|
|
username = var.app_name
|
|
password = var.app_password
|
|
}
|
|
type = "Opaque"
|
|
}
|
|
|
|
resource "kubernetes_service" "service" {
|
|
metadata {
|
|
name = "mariadb"
|
|
namespace = var.namespace
|
|
}
|
|
spec {
|
|
port {
|
|
port = 3306
|
|
}
|
|
selector = {
|
|
app = "mariadb"
|
|
}
|
|
cluster_ip = "None"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_deployment" "deployment" {
|
|
metadata {
|
|
name = "mariadb"
|
|
namespace = var.namespace
|
|
}
|
|
spec {
|
|
selector {
|
|
match_labels = {
|
|
app = "mariadb"
|
|
}
|
|
}
|
|
strategy {
|
|
type = "Recreate"
|
|
}
|
|
template {
|
|
metadata {
|
|
labels = {
|
|
app = "mariadb"
|
|
}
|
|
}
|
|
spec {
|
|
service_account_name = kubernetes_service_account.service_account.metadata[0].name
|
|
container {
|
|
name = "mariadb"
|
|
image = "mariadb:${var.current_version}"
|
|
|
|
resources {
|
|
requests = {
|
|
memory = "100Mi"
|
|
}
|
|
}
|
|
|
|
liveness_probe {
|
|
exec {
|
|
command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"]
|
|
}
|
|
initial_delay_seconds = 30
|
|
period_seconds = 300
|
|
timeout_seconds = 1
|
|
failure_threshold = 15
|
|
}
|
|
|
|
readiness_probe {
|
|
exec {
|
|
command = ["sh", "-c", "mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"]
|
|
}
|
|
initial_delay_seconds = 30
|
|
period_seconds = 10
|
|
timeout_seconds = 1
|
|
failure_threshold = 15
|
|
}
|
|
|
|
env {
|
|
name = "MARIADB_ROOT_PASSWORD"
|
|
value_from {
|
|
secret_key_ref {
|
|
key = "password"
|
|
name = kubernetes_secret.root_password.metadata[0].name
|
|
}
|
|
}
|
|
}
|
|
env {
|
|
name = "MARIADB_ROOT_HOST"
|
|
value = "10.%"
|
|
}
|
|
env {
|
|
name = "MARIADB_USER"
|
|
value_from {
|
|
secret_key_ref {
|
|
key = "username"
|
|
name = kubernetes_secret.app_password.metadata[0].name
|
|
}
|
|
}
|
|
}
|
|
env {
|
|
name = "MARIADB_PASSWORD"
|
|
value_from {
|
|
secret_key_ref {
|
|
key = "password"
|
|
name = kubernetes_secret.app_password.metadata[0].name
|
|
}
|
|
}
|
|
}
|
|
env {
|
|
name = "MARIADB_DATABASE"
|
|
value = var.app_name
|
|
}
|
|
port {
|
|
container_port = 3306
|
|
name = "mariadb"
|
|
}
|
|
volume_mount {
|
|
mount_path = "/var/lib/mysql"
|
|
name = "persistent-storage"
|
|
}
|
|
volume_mount {
|
|
mount_path = "/docker-entrypoint-initdb.d"
|
|
name = "initdb-storage"
|
|
}
|
|
dynamic "volume_mount" {
|
|
for_each = var.tls_enabled ? [1] : []
|
|
content {
|
|
mount_path = "/etc/ssl/certs/private"
|
|
name = "mariadb-cert"
|
|
read_only = true
|
|
}
|
|
}
|
|
dynamic "volume_mount" {
|
|
for_each = var.tls_enabled ? [1] : []
|
|
content {
|
|
mount_path = "/etc/mysql/conf.d/tls.cnf"
|
|
name = "ssl-config"
|
|
sub_path = "tls.cnf"
|
|
read_only = true
|
|
}
|
|
}
|
|
}
|
|
volume {
|
|
name = "persistent-storage"
|
|
host_path {
|
|
path = "${var.database_folder}/${var.app_name}.data"
|
|
}
|
|
}
|
|
volume {
|
|
name = "initdb-storage"
|
|
host_path {
|
|
path = "${var.database_folder}/${var.app_name}.initdb.d"
|
|
}
|
|
}
|
|
dynamic "volume" {
|
|
for_each = var.tls_enabled ? [1] : []
|
|
content {
|
|
name = "mariadb-cert"
|
|
secret {
|
|
secret_name = kubernetes_manifest.internal_cert[0].manifest["metadata"]["name"]
|
|
items {
|
|
key = "tls.crt"
|
|
path = "tls.crt"
|
|
}
|
|
items {
|
|
key = "tls.key"
|
|
path = "tls.key"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
dynamic "volume" {
|
|
for_each = var.tls_enabled ? [1] : []
|
|
content {
|
|
name = "ssl-config"
|
|
config_map {
|
|
name = kubernetes_config_map.ssl_config[0].metadata[0].name
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_cron_job_v1" "backup_data_cron" {
|
|
metadata {
|
|
name = "mariadb-backup-job"
|
|
namespace = var.namespace
|
|
}
|
|
spec {
|
|
concurrency_policy = "Forbid"
|
|
schedule = var.cron_schedule
|
|
failed_jobs_history_limit = 2
|
|
successful_jobs_history_limit = 2
|
|
job_template {
|
|
metadata {
|
|
labels = {
|
|
app = "mariadb"
|
|
}
|
|
}
|
|
spec {
|
|
backoff_limit = 1
|
|
parallelism = 1
|
|
completions = 1
|
|
active_deadline_seconds = 1800
|
|
template {
|
|
metadata {}
|
|
spec {
|
|
container {
|
|
name = "sql-cron-job"
|
|
image = "mariadb:${var.current_version}"
|
|
env {
|
|
name = "MARIADB_USER"
|
|
value_from {
|
|
secret_key_ref {
|
|
key = "username"
|
|
name = kubernetes_secret.app_password.metadata[0].name
|
|
}
|
|
}
|
|
}
|
|
env {
|
|
name = "MARIADB_PASSWORD"
|
|
value_from {
|
|
secret_key_ref {
|
|
key = "password"
|
|
name = kubernetes_secret.app_password.metadata[0].name
|
|
}
|
|
}
|
|
}
|
|
env {
|
|
name = "MARIADB_DATABASE"
|
|
value = var.app_name
|
|
}
|
|
env {
|
|
name = "APP_NAME"
|
|
value = var.app_name
|
|
}
|
|
env {
|
|
name = "BACKUP_RETENTION"
|
|
value = var.retention_days
|
|
}
|
|
security_context {
|
|
allow_privilege_escalation = false
|
|
}
|
|
command = ["/bin/sh", "-c"]
|
|
args = ["/tmp/scripts/backup.sh"]
|
|
volume_mount {
|
|
mount_path = "/backup"
|
|
name = "backup-storage"
|
|
}
|
|
volume_mount {
|
|
name = "backup-script"
|
|
mount_path = "/tmp/scripts"
|
|
read_only = true
|
|
}
|
|
volume_mount {
|
|
name = "tmp"
|
|
mount_path = "/tmp"
|
|
}
|
|
}
|
|
volume {
|
|
name = "backup-storage"
|
|
host_path {
|
|
path = var.backup_folder
|
|
}
|
|
}
|
|
volume {
|
|
name = "backup-script"
|
|
config_map {
|
|
name = kubernetes_config_map.backup_script.metadata[0].name
|
|
default_mode = "0755"
|
|
}
|
|
}
|
|
volume {
|
|
name = "tmp"
|
|
empty_dir {}
|
|
}
|
|
restart_policy = "Never"
|
|
termination_grace_period_seconds = 30
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|