continuous deploy - service account and gitea workflow
This commit is contained in:
Márcio Fernandes
3
deploy/app/.env.d/.gitignore
vendored
Normal file
3
deploy/app/.env.d/.gitignore
vendored
Normal file
@@ -0,0 +1,3 @@
|
||||
**
|
||||
!.gitignore
|
||||
!**.example
|
||||
4
deploy/app/.env.d/nextcloud-mariadb.env.example
Normal file
4
deploy/app/.env.d/nextcloud-mariadb.env.example
Normal file
@@ -0,0 +1,4 @@
|
||||
MARIADB_USER=????
|
||||
MARIADB_PASSWORD=????
|
||||
MARIADB_ROOT_PASSWORD=???
|
||||
MARIADB_DATABASE=???
|
||||
3
deploy/app/.env.d/nextcloud.secrets.env.example
Normal file
3
deploy/app/.env.d/nextcloud.secrets.env.example
Normal file
@@ -0,0 +1,3 @@
|
||||
NEXTCLOUD_HOST=????
|
||||
NEXTCLOUD_USERNAME=????
|
||||
NEXTCLOUD_PASSWORD=???
|
||||
3
deploy/app/.env.d/pbs.env.example
Normal file
3
deploy/app/.env.d/pbs.env.example
Normal file
@@ -0,0 +1,3 @@
|
||||
PBS_REPOSITORY=????
|
||||
PBS_PASSWORD=????
|
||||
PBS_FINGERPRINT=???
|
||||
2
deploy/app/.gitignore
vendored
Normal file
2
deploy/app/.gitignore
vendored
Normal file
@@ -0,0 +1,2 @@
|
||||
**.local.**
|
||||
**.private.**
|
||||
@@ -6,10 +6,51 @@ image:
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
livenessProbe:
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 6
|
||||
|
||||
readinessProbe:
|
||||
initialDelaySeconds: 60
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 12
|
||||
|
||||
# ------------------------------------------------------------------------------
|
||||
# Nextcloud maintenance mode & Kubernetes probes
|
||||
# ------------------------------------------------------------------------------
|
||||
# When performing upgrades or running `occ upgrade`, Nextcloud may return 503
|
||||
# on /status.php until the database migration is complete. During this period,
|
||||
# Kubernetes will repeatedly kill the pod because the readiness/liveness probes
|
||||
# fail before the upgrade finishes.
|
||||
#
|
||||
# To prevent Kubernetes from terminating the pod during maintenance or upgrades,
|
||||
# temporarily disable both probes. This allows the container to stay alive long
|
||||
# enough for you to exec into it and run:
|
||||
#
|
||||
# php occ upgrade
|
||||
#
|
||||
# After the upgrade completes, re‑enable the probes.
|
||||
#
|
||||
# Example:
|
||||
#
|
||||
# livenessProbe:
|
||||
# enabled: false
|
||||
#
|
||||
# readinessProbe:
|
||||
# enabled: false
|
||||
# ------------------------------------------------------------------------------
|
||||
|
||||
|
||||
|
||||
internalDatabase:
|
||||
enabled: false
|
||||
|
||||
mariadb:
|
||||
enabled: false
|
||||
|
||||
externalDatabase:
|
||||
enabled: true
|
||||
type: mysql
|
||||
@@ -19,27 +60,15 @@ externalDatabase:
|
||||
database: "???"
|
||||
port: 3306
|
||||
|
||||
|
||||
mariadb:
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 8080
|
||||
loadBalancerIP: ""
|
||||
nodePort:
|
||||
|
||||
persistence:
|
||||
enabled: true
|
||||
accessMode: ReadWriteOnce
|
||||
size: 8Gi
|
||||
|
||||
nextcloudData:
|
||||
enabled: true
|
||||
subPath:
|
||||
annotations: {}
|
||||
accessMode: ReadWriteOnce
|
||||
size: 8Gi
|
||||
|
||||
resources:
|
||||
limits:
|
||||
cpu: "1"
|
||||
@@ -55,27 +84,6 @@ resources:
|
||||
cronjob:
|
||||
enabled: true
|
||||
|
||||
## Cronjob sidecar resource requests and limits
|
||||
## ref: http://kubernetes.io/docs/user-guide/compute-resources/
|
||||
##
|
||||
resources: {}
|
||||
|
||||
# Allow configuration of lifecycle hooks
|
||||
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/attach-handler-lifecycle-event/
|
||||
lifecycle: {}
|
||||
# postStartCommand: []
|
||||
# preStopCommand: []
|
||||
# Set securityContext parameters. For example, you may need to define runAsNonRoot directive
|
||||
securityContext: {}
|
||||
# runAsUser: 33
|
||||
# runAsGroup: 33
|
||||
# runAsNonRoot: true
|
||||
# readOnlyRootFilesystem: true
|
||||
|
||||
# The command the cronjob container executes.
|
||||
command:
|
||||
- /cron.sh
|
||||
|
||||
nextcloud:
|
||||
extraVolumes:
|
||||
- name: mf-documents
|
||||
@@ -139,48 +147,8 @@ nextcloud:
|
||||
$CONFIG = array (
|
||||
'maintenance_window_start' => 1,
|
||||
);
|
||||
# nextcloud:
|
||||
# configs:
|
||||
# logging.config.php: |-
|
||||
# <?php
|
||||
# $CONFIG = array (
|
||||
# 'log_type' => 'file',
|
||||
# 'logfile' => 'nextcloud.log',
|
||||
# 'loglevel' => 0,
|
||||
# 'logdateformat' => 'F d, Y H:i:s'
|
||||
# );
|
||||
|
||||
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: traefik
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure,public-https
|
||||
|
||||
# traefik.public-https.redirect.permanent: 'true'
|
||||
# traefik.public-https.redirect.regex: 'https://(.*)/.well-known/(?:card|cal)dav'
|
||||
# traefik.public-https.redirect.replacement: 'https://$$1/remote.php/dav'
|
||||
# traefik.public-https.headers.STSPreload: 'true'
|
||||
# traefik.public-https.headers.STSSeconds: '15552000'
|
||||
# traefik.public-https.routers.nextcloud.middlewares: 'nextcloudHeader'
|
||||
|
||||
# traefik.web-secure.routers.nextcloud.middlewares: 'nextcloudHeader'
|
||||
# traefik.websecure.headers.STSPreload: 'true'
|
||||
# traefik.websecure.headers.STSSeconds: '15552000'
|
||||
# traefik.websecure.redirect.permanent: 'true'
|
||||
# traefik.websecure.redirect.regex: 'https://(.*)/.well-known/(?:card|cal)dav'
|
||||
# traefik.websecure.redirect.replacement: 'https://$$1/remote.php/dav'
|
||||
# hosts:
|
||||
# - host: cloud.limbosolutions.com
|
||||
# paths:
|
||||
# - path: /
|
||||
# pathType: Prefix
|
||||
tls:
|
||||
- secretName: cloud-limbosolutions-com-secret-tls
|
||||
hosts:
|
||||
- "cloud.limbosolutions.com"
|
||||
enabled: false
|
||||
|
||||
|
||||
|
||||
@@ -4,16 +4,16 @@ kind: Kustomization
|
||||
secretGenerator:
|
||||
- name: nextcloud-mariadb
|
||||
envs:
|
||||
- ./.env.d/nextcloud-mariadb.secrets
|
||||
- ./.env.d/nextcloud-mariadb.env
|
||||
|
||||
- name: backup-secret
|
||||
envs:
|
||||
- ./.env.d/pbs.secrets
|
||||
- ./.env.d/pbs.env
|
||||
|
||||
resources:
|
||||
- ./persistent-volumes-claims.yaml
|
||||
- ./storage-limbosolutions-com/pvc.yaml
|
||||
- ./mariadb-deploy.yaml
|
||||
- ./backup-cronjob.yaml
|
||||
- ./backups/backup-pbs-cronjob.yaml
|
||||
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
@@ -3,7 +3,6 @@ apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: nextcloud-mariadb
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
clusterIP: None
|
||||
selector:
|
||||
|
||||
@@ -3,7 +3,6 @@ apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mf-documents-limbosolutions-com
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
storageClassName: storage-limbosolutions-com
|
||||
volumeName: mf-documents-limbosolutions-com-nextcloud
|
||||
@@ -18,7 +17,6 @@ apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: media-music-limbosolutions-com
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
storageClassName: storage-limbosolutions-com
|
||||
volumeName: media-music-limbosolutions-com-nextcloud
|
||||
@@ -34,7 +32,6 @@ apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: media-videos-limbosolutions-com
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
storageClassName: storage-limbosolutions-com
|
||||
volumeName: media-videos-limbosolutions-com-nextcloud
|
||||
@@ -50,7 +47,6 @@ apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: media-gaming-limbosolutions-com
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
storageClassName: storage-limbosolutions-com
|
||||
volumeName: media-gaming-limbosolutions-com-nextcloud
|
||||
@@ -66,7 +62,6 @@ apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: it-storage-limbosolutions-com
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
storageClassName: storage-limbosolutions-com
|
||||
volumeName: it-storage-limbosolutions-com-nextcloud
|
||||
@@ -81,10 +76,11 @@ apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mf-gallery-limbosolutions-com
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
storageClassName: storage-limbosolutions-com
|
||||
volumeName: mf-gallery-limbosolutions-com-nextcloud
|
||||
|
||||
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
resources:
|
||||
@@ -97,7 +93,6 @@ apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: mf-nextcloud-limbosolutions-com
|
||||
namespace: cloud-limbosolutions-com
|
||||
spec:
|
||||
storageClassName: storage-limbosolutions-com
|
||||
volumeName: mf-nextcloud-limbosolutions-com-nextcloud
|
||||
1
deploy/helm/.gitignore
vendored
1
deploy/helm/.gitignore
vendored
@@ -1 +0,0 @@
|
||||
**.local**.yaml
|
||||
50
deploy/infra/cd-serviceaccount.yaml
Normal file
50
deploy/infra/cd-serviceaccount.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: continuous-deploy
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "services", "secrets", "configmaps", "persistentvolumeclaims"]
|
||||
verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
|
||||
|
||||
- apiGroups: ["apps"]
|
||||
resources: ["deployments", "statefulsets"]
|
||||
verbs: ["get", "watch", "list", "create", "update", "patch", "delete"]
|
||||
|
||||
- apiGroups: ["batch"]
|
||||
resources: ["cronjobs", "jobs"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: continuous-deploy
|
||||
|
||||
---
|
||||
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: continuous-deploy
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: continuous-deploy
|
||||
type: kubernetes.io/service-account-token
|
||||
|
||||
---
|
||||
|
||||
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: continuous-deploy
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: continuous-deploy
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: continuous-deploy
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
||||
26
deploy/infra/ingress.yaml
Normal file
26
deploy/infra/ingress.yaml
Normal file
@@ -0,0 +1,26 @@
|
||||
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: cloud-limbosolutions-com
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: letsencrypt-prod
|
||||
kubernetes.io/ingress.class: traefik
|
||||
traefik.ingress.kubernetes.io/router.entrypoints: websecure, public-https
|
||||
spec:
|
||||
ingressClassName: traefik
|
||||
rules:
|
||||
- host: cloud.limbosolutions.com
|
||||
http:
|
||||
paths:
|
||||
- backend:
|
||||
service:
|
||||
name: nextcloud
|
||||
port:
|
||||
number: 8080
|
||||
path: /
|
||||
pathType: Prefix
|
||||
tls:
|
||||
- secretName: cloud-limbosolutions-com-secret-tls
|
||||
hosts:
|
||||
- cloud.limbosolutions.com
|
||||
@@ -2,6 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
resources:
|
||||
- namespace.yaml
|
||||
|
||||
- cd-serviceaccount.yaml
|
||||
- ingress.yaml
|
||||
- storage-limbosolutions-com/pv.yaml
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
Reference in New Issue
Block a user