alexandre.pires
aee57a8b89
- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand. - Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters. - Removed unused gitea-auth script from playbook_gitea.yml. - Updated systools_version in playbook_systools.yml to 0.4.5. - Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS. - Added a new script test_imaps for IMAP testing. - Updated Terraform configurations for various applications, including: - Added a backup script for MariaDB with retention policy. - Changed Gitea version to 1.24-rootless and adjusted SSH settings. - Updated Nginx configurations to log errors and access to stderr/stdout. - Refactored services to use ClusterIP type and adjusted security contexts for deployments. - Added temporary storage for applications using empty_dir. - Enhanced backup.sh scripts for better error handling and logging.
162 lines
2.9 KiB
Terraform
162 lines
2.9 KiB
Terraform
resource "kubernetes_namespace" "app" {
|
|
metadata {
|
|
name = "app"
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_service_account" "app" {
|
|
|
|
metadata {
|
|
name = "app-sa"
|
|
namespace = kubernetes_namespace.app.metadata[0].name
|
|
}
|
|
|
|
automount_service_account_token = false
|
|
}
|
|
|
|
resource "kubernetes_config_map" "app_config" {
|
|
metadata {
|
|
name = "app-config"
|
|
namespace = kubernetes_namespace.app.metadata[0].name
|
|
}
|
|
|
|
data = {}
|
|
}
|
|
|
|
resource "kubernetes_secret" "app_secrets" {
|
|
metadata {
|
|
name = "app-keys"
|
|
namespace = kubernetes_namespace.app.metadata[0].name
|
|
}
|
|
|
|
data = {}
|
|
}
|
|
|
|
resource "kubernetes_deployment" "app" {
|
|
metadata {
|
|
name = "app"
|
|
namespace = kubernetes_namespace.app.metadata[0].name
|
|
labels = {
|
|
app = "app"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
replicas = 1
|
|
|
|
selector {
|
|
match_labels = {
|
|
app = "app"
|
|
}
|
|
}
|
|
|
|
strategy {
|
|
type = "Recreate"
|
|
}
|
|
|
|
template {
|
|
metadata {
|
|
labels = {
|
|
app = "app"
|
|
}
|
|
}
|
|
|
|
spec {
|
|
service_account_name = kubernetes_service_account.app.metadata[0].name
|
|
automount_service_account_token = false
|
|
|
|
container {
|
|
name = "app-container"
|
|
image = "app/app-server-s6:${local.app_version}"
|
|
|
|
env_from {
|
|
config_map_ref {
|
|
name = kubernetes_config_map.app_config.metadata[0].name
|
|
}
|
|
}
|
|
|
|
security_context {
|
|
allow_privilege_escalation = false
|
|
}
|
|
|
|
port {
|
|
name = "app-port-1"
|
|
container_port = 21115
|
|
host_port = 21115
|
|
protocol = "TCP"
|
|
}
|
|
|
|
|
|
volume_mount {
|
|
name = "app-data"
|
|
mount_path = "/data"
|
|
}
|
|
|
|
volume_mount {
|
|
name = "app-secrets"
|
|
mount_path = "/data/secrets"
|
|
read_only = true
|
|
}
|
|
|
|
volume_mount {
|
|
name = "app-config"
|
|
mount_path = "/data/config"
|
|
read_only = true
|
|
}
|
|
}
|
|
|
|
volume {
|
|
name = "app-data"
|
|
host_path {
|
|
path = local.app_path
|
|
}
|
|
}
|
|
|
|
volume {
|
|
name = "app-secrets"
|
|
secret {
|
|
secret_name = kubernetes_secret.app_secrets.metadata[0].name
|
|
}
|
|
}
|
|
|
|
volume {
|
|
name = "app-config"
|
|
config_map {
|
|
name = kubernetes_config_map.app_config.metadata[0].name
|
|
}
|
|
}
|
|
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "kubernetes_service" "app" {
|
|
metadata {
|
|
name = "app-ports"
|
|
namespace = kubernetes_namespace.app.metadata[0].name
|
|
}
|
|
|
|
spec {
|
|
selector = {
|
|
app = "app"
|
|
}
|
|
|
|
port {
|
|
name = "app-port-1"
|
|
port = 21115
|
|
target_port = 21115
|
|
}
|
|
|
|
type = "ClusterIP"
|
|
cluster_ip = "None"
|
|
}
|
|
|
|
lifecycle {
|
|
ignore_changes = [
|
|
metadata[0].annotations
|
|
]
|
|
}
|
|
|
|
}
|