Last active
June 21, 2019 21:14
-
-
Save wilsonianb/0b09086821f55b46e3bfb0e83b042b8e to your computer and use it in GitHub Desktop.
Codius host kubernetes manifests
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: extensions/v1beta1 | |
| kind: Ingress | |
| metadata: | |
| name: acme-dns | |
| namespace: acme-dns | |
| annotations: | |
| kubernetes.io/ingress.class: "traefik" | |
| spec: | |
| rules: | |
| - host: "acme.codius.example.com" | |
| http: | |
| paths: | |
| - path: /update | |
| backend: | |
| serviceName: acme-dns-service | |
| servicePort: 80 | |
| https: | |
| paths: | |
| - path: /update | |
| backend: | |
| serviceName: acme-dns | |
| servicePort: 443 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kind: ConfigMap | |
| apiVersion: v1 | |
| metadata: | |
| name: tcp-services | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| data: | |
| 53: "default/acme-dns-service:53" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kind: ConfigMap | |
| apiVersion: v1 | |
| metadata: | |
| name: udp-services | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| data: | |
| 53: "default/acme-dns-service:53" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: v1 | |
| kind: Namespace | |
| metadata: | |
| name: acme-dns | |
| --- | |
| apiVersion: v1 | |
| kind: PersistentVolumeClaim | |
| metadata: | |
| name: acme-dns-pvc | |
| namespace: acme-dns | |
| spec: | |
| accessModes: | |
| - ReadWriteOnce | |
| storageClassName: local-path | |
| resources: | |
| requests: | |
| storage: 50Mi | |
| --- | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: acme-dns | |
| namespace: acme-dns | |
| spec: | |
| selector: | |
| app: acme-dns | |
| ports: | |
| - name: https | |
| protocol: TCP | |
| port: 443 | |
| targetPort: 443 | |
| - name: http | |
| protocol: TCP | |
| port: 80 | |
| targetPort: 80 | |
| - name: dns-tcp | |
| protocol: TCP | |
| port: 53 | |
| targetPort: 53 | |
| - name: dns-udp | |
| protocol: UDP | |
| port: 53 | |
| targetPort: 53 | |
| --- | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: acme-dns | |
| namespace: acme-dns | |
| labels: | |
| app: acme-dns | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| app: acme-dns | |
| template: | |
| metadata: | |
| labels: | |
| app: acme-dns | |
| spec: | |
| containers: | |
| - name: acme-dns | |
| image: joohoi/acme-dns | |
| ports: | |
| - containerPort: 443 | |
| name: https | |
| - containerPort: 80 | |
| name: http | |
| - containerPort: 53 | |
| name: dns | |
| - containerPort: 53 | |
| name: dns-udp | |
| protocol: UDP | |
| volumeMounts: | |
| - name: config-volume | |
| mountPath: /etc/acme-dns/config.cfg | |
| subPath: config.cfg | |
| - name: data-volume | |
| mountPath: /var/lib/acme-dns | |
| volumes: | |
| - name: config-volume | |
| configMap: | |
| name: acme-dns-config | |
| - name: data-volume | |
| persistentVolumeClaim: | |
| claimName: acme-dns-pvc |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://docs.projectcalico.org/v3.7/manifests/canal.yaml | |
| # modified to allow_ip_forwarding | |
| --- | |
| # Source: calico/templates/calico-config.yaml | |
| # This ConfigMap is used to configure a self-hosted Canal installation. | |
| kind: ConfigMap | |
| apiVersion: v1 | |
| metadata: | |
| name: canal-config | |
| namespace: kube-system | |
| data: | |
| # Typha is disabled. | |
| typha_service_name: "none" | |
| # The interface used by canal for host <-> host communication. | |
| # If left blank, then the interface is chosen using the node's | |
| # default route. | |
| canal_iface: "" | |
| # Whether or not to masquerade traffic to destinations not within | |
| # the pod network. | |
| masquerade: "true" | |
| # The CNI network configuration to install on each node. The special | |
| # values in this config will be automatically populated. | |
| cni_network_config: |- | |
| { | |
| "name": "k8s-pod-network", | |
| "cniVersion": "0.3.0", | |
| "plugins": [ | |
| { | |
| "type": "calico", | |
| "log_level": "info", | |
| "datastore_type": "kubernetes", | |
| "nodename": "__KUBERNETES_NODE_NAME__", | |
| "ipam": { | |
| "type": "host-local", | |
| "subnet": "usePodCidr" | |
| }, | |
| "container_settings": { | |
| "allow_ip_forwarding": true | |
| }, | |
| "policy": { | |
| "type": "k8s" | |
| }, | |
| "kubernetes": { | |
| "kubeconfig": "__KUBECONFIG_FILEPATH__" | |
| } | |
| }, | |
| { | |
| "type": "portmap", | |
| "snat": true, | |
| "capabilities": {"portMappings": true} | |
| } | |
| ] | |
| } | |
| # Flannel network configuration. Mounted into the flannel container. | |
| net-conf.json: | | |
| { | |
| "Network": "10.244.0.0/16", | |
| "Backend": { | |
| "Type": "vxlan" | |
| } | |
| } | |
| --- | |
| # Source: calico/templates/kdd-crds.yaml | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: felixconfigurations.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: FelixConfiguration | |
| plural: felixconfigurations | |
| singular: felixconfiguration | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: bgpconfigurations.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: BGPConfiguration | |
| plural: bgpconfigurations | |
| singular: bgpconfiguration | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: ippools.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: IPPool | |
| plural: ippools | |
| singular: ippool | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: hostendpoints.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: HostEndpoint | |
| plural: hostendpoints | |
| singular: hostendpoint | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: clusterinformations.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: ClusterInformation | |
| plural: clusterinformations | |
| singular: clusterinformation | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: globalnetworkpolicies.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: GlobalNetworkPolicy | |
| plural: globalnetworkpolicies | |
| singular: globalnetworkpolicy | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: globalnetworksets.crd.projectcalico.org | |
| spec: | |
| scope: Cluster | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: GlobalNetworkSet | |
| plural: globalnetworksets | |
| singular: globalnetworkset | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: networkpolicies.crd.projectcalico.org | |
| spec: | |
| scope: Namespaced | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: NetworkPolicy | |
| plural: networkpolicies | |
| singular: networkpolicy | |
| --- | |
| apiVersion: apiextensions.k8s.io/v1beta1 | |
| kind: CustomResourceDefinition | |
| metadata: | |
| name: networksets.crd.projectcalico.org | |
| spec: | |
| scope: Namespaced | |
| group: crd.projectcalico.org | |
| version: v1 | |
| names: | |
| kind: NetworkSet | |
| plural: networksets | |
| singular: networkset | |
| --- | |
| # Source: calico/templates/rbac.yaml | |
| # Include a clusterrole for the calico-node DaemonSet, | |
| # and bind it to the calico-node serviceaccount. | |
| kind: ClusterRole | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| metadata: | |
| name: calico-node | |
| rules: | |
| # The CNI plugin needs to get pods, nodes, and namespaces. | |
| - apiGroups: [""] | |
| resources: | |
| - pods | |
| - nodes | |
| - namespaces | |
| verbs: | |
| - get | |
| - apiGroups: [""] | |
| resources: | |
| - endpoints | |
| - services | |
| verbs: | |
| # Used to discover service IPs for advertisement. | |
| - watch | |
| - list | |
| # Used to discover Typhas. | |
| - get | |
| - apiGroups: [""] | |
| resources: | |
| - nodes/status | |
| verbs: | |
| # Needed for clearing NodeNetworkUnavailable flag. | |
| - patch | |
| # Calico stores some configuration information in node annotations. | |
| - update | |
| # Watch for changes to Kubernetes NetworkPolicies. | |
| - apiGroups: ["networking.k8s.io"] | |
| resources: | |
| - networkpolicies | |
| verbs: | |
| - watch | |
| - list | |
| # Used by Calico for policy information. | |
| - apiGroups: [""] | |
| resources: | |
| - pods | |
| - namespaces | |
| - serviceaccounts | |
| verbs: | |
| - list | |
| - watch | |
| # The CNI plugin patches pods/status. | |
| - apiGroups: [""] | |
| resources: | |
| - pods/status | |
| verbs: | |
| - patch | |
| # Calico monitors various CRDs for config. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - globalfelixconfigs | |
| - felixconfigurations | |
| - bgppeers | |
| - globalbgpconfigs | |
| - bgpconfigurations | |
| - ippools | |
| - ipamblocks | |
| - globalnetworkpolicies | |
| - globalnetworksets | |
| - networkpolicies | |
| - networksets | |
| - clusterinformations | |
| - hostendpoints | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| # Calico must create and update some CRDs on startup. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - ippools | |
| - felixconfigurations | |
| - clusterinformations | |
| verbs: | |
| - create | |
| - update | |
| # Calico stores some configuration information on the node. | |
| - apiGroups: [""] | |
| resources: | |
| - nodes | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| # These permissions are only requried for upgrade from v2.6, and can | |
| # be removed after upgrade or on fresh installations. | |
| - apiGroups: ["crd.projectcalico.org"] | |
| resources: | |
| - bgpconfigurations | |
| - bgppeers | |
| verbs: | |
| - create | |
| - update | |
| --- | |
| # Flannel ClusterRole | |
| # Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml | |
| kind: ClusterRole | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| metadata: | |
| name: flannel | |
| rules: | |
| - apiGroups: [""] | |
| resources: | |
| - pods | |
| verbs: | |
| - get | |
| - apiGroups: [""] | |
| resources: | |
| - nodes | |
| verbs: | |
| - list | |
| - watch | |
| - apiGroups: [""] | |
| resources: | |
| - nodes/status | |
| verbs: | |
| - patch | |
| --- | |
| # Bind the flannel ClusterRole to the canal ServiceAccount. | |
| kind: ClusterRoleBinding | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| metadata: | |
| name: canal-flannel | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: flannel | |
| subjects: | |
| - kind: ServiceAccount | |
| name: canal | |
| namespace: kube-system | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: canal-calico | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: calico-node | |
| subjects: | |
| - kind: ServiceAccount | |
| name: canal | |
| namespace: kube-system | |
| --- | |
| # Source: calico/templates/calico-node.yaml | |
| # This manifest installs the canal container, as well | |
| # as the CNI plugins and network config on | |
| # each master and worker node in a Kubernetes cluster. | |
| kind: DaemonSet | |
| apiVersion: extensions/v1beta1 | |
| metadata: | |
| name: canal | |
| namespace: kube-system | |
| labels: | |
| k8s-app: canal | |
| spec: | |
| selector: | |
| matchLabels: | |
| k8s-app: canal | |
| updateStrategy: | |
| type: RollingUpdate | |
| rollingUpdate: | |
| maxUnavailable: 1 | |
| template: | |
| metadata: | |
| labels: | |
| k8s-app: canal | |
| annotations: | |
| # This, along with the CriticalAddonsOnly toleration below, | |
| # marks the pod as a critical add-on, ensuring it gets | |
| # priority scheduling and that its resources are reserved | |
| # if it ever gets evicted. | |
| scheduler.alpha.kubernetes.io/critical-pod: '' | |
| spec: | |
| nodeSelector: | |
| beta.kubernetes.io/os: linux | |
| hostNetwork: true | |
| tolerations: | |
| # Make sure canal gets scheduled on all nodes. | |
| - effect: NoSchedule | |
| operator: Exists | |
| # Mark the pod as a critical add-on for rescheduling. | |
| - key: CriticalAddonsOnly | |
| operator: Exists | |
| - effect: NoExecute | |
| operator: Exists | |
| serviceAccountName: canal | |
| # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force | |
| # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods. | |
| terminationGracePeriodSeconds: 0 | |
| initContainers: | |
| # This container installs the CNI binaries | |
| # and CNI network config file on each node. | |
| - name: install-cni | |
| image: calico/cni:v3.7.3 | |
| command: ["/install-cni.sh"] | |
| env: | |
| # Name of the CNI config file to create. | |
| - name: CNI_CONF_NAME | |
| value: "10-canal.conflist" | |
| # The CNI network config to install on each node. | |
| - name: CNI_NETWORK_CONFIG | |
| valueFrom: | |
| configMapKeyRef: | |
| name: canal-config | |
| key: cni_network_config | |
| # Set the hostname based on the k8s node name. | |
| - name: KUBERNETES_NODE_NAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: spec.nodeName | |
| # Prevents the container from sleeping forever. | |
| - name: SLEEP | |
| value: "false" | |
| volumeMounts: | |
| - mountPath: /host/opt/cni/bin | |
| name: cni-bin-dir | |
| - mountPath: /host/etc/cni/net.d | |
| name: cni-net-dir | |
| containers: | |
| # Runs canal container on each Kubernetes node. This | |
| # container programs network policy and routes on each | |
| # host. | |
| - name: calico-node | |
| image: calico/node:v3.7.3 | |
| env: | |
| # Use Kubernetes API as the backing datastore. | |
| - name: DATASTORE_TYPE | |
| value: "kubernetes" | |
| # Configure route aggregation based on pod CIDR. | |
| - name: USE_POD_CIDR | |
| value: "true" | |
| # Wait for the datastore. | |
| - name: WAIT_FOR_DATASTORE | |
| value: "true" | |
| # Set based on the k8s node name. | |
| - name: NODENAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: spec.nodeName | |
| # Don't enable BGP. | |
| - name: CALICO_NETWORKING_BACKEND | |
| value: "none" | |
| # Cluster type to identify the deployment type | |
| - name: CLUSTER_TYPE | |
| value: "k8s,canal" | |
| # Period, in seconds, at which felix re-applies all iptables state | |
| - name: FELIX_IPTABLESREFRESHINTERVAL | |
| value: "60" | |
| # No IP address needed. | |
| - name: IP | |
| value: "" | |
| # The default IPv4 pool to create on startup if none exists. Pod IPs will be | |
| # chosen from this range. Changing this value after installation will have | |
| # no effect. This should fall within `--cluster-cidr`. | |
| - name: CALICO_IPV4POOL_CIDR | |
| value: "192.168.0.0/16" | |
| # Disable file logging so `kubectl logs` works. | |
| - name: CALICO_DISABLE_FILE_LOGGING | |
| value: "true" | |
| # Set Felix endpoint to host default action to ACCEPT. | |
| - name: FELIX_DEFAULTENDPOINTTOHOSTACTION | |
| value: "ACCEPT" | |
| # Disable IPv6 on Kubernetes. | |
| - name: FELIX_IPV6SUPPORT | |
| value: "false" | |
| # Set Felix logging to "info" | |
| - name: FELIX_LOGSEVERITYSCREEN | |
| value: "info" | |
| - name: FELIX_HEALTHENABLED | |
| value: "true" | |
| securityContext: | |
| privileged: true | |
| resources: | |
| requests: | |
| cpu: 250m | |
| livenessProbe: | |
| httpGet: | |
| path: /liveness | |
| port: 9099 | |
| host: localhost | |
| periodSeconds: 10 | |
| initialDelaySeconds: 10 | |
| failureThreshold: 6 | |
| readinessProbe: | |
| httpGet: | |
| path: /readiness | |
| port: 9099 | |
| host: localhost | |
| periodSeconds: 10 | |
| volumeMounts: | |
| - mountPath: /lib/modules | |
| name: lib-modules | |
| readOnly: true | |
| - mountPath: /run/xtables.lock | |
| name: xtables-lock | |
| readOnly: false | |
| - mountPath: /var/run/calico | |
| name: var-run-calico | |
| readOnly: false | |
| - mountPath: /var/lib/calico | |
| name: var-lib-calico | |
| readOnly: false | |
| # This container runs flannel using the kube-subnet-mgr backend | |
| # for allocating subnets. | |
| - name: kube-flannel | |
| image: quay.io/coreos/flannel:v0.11.0 | |
| command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ] | |
| securityContext: | |
| privileged: true | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| - name: FLANNELD_IFACE | |
| valueFrom: | |
| configMapKeyRef: | |
| name: canal-config | |
| key: canal_iface | |
| - name: FLANNELD_IP_MASQ | |
| valueFrom: | |
| configMapKeyRef: | |
| name: canal-config | |
| key: masquerade | |
| volumeMounts: | |
| - mountPath: /run/xtables.lock | |
| name: xtables-lock | |
| readOnly: false | |
| - name: flannel-cfg | |
| mountPath: /etc/kube-flannel/ | |
| volumes: | |
| # Used by canal. | |
| - name: lib-modules | |
| hostPath: | |
| path: /lib/modules | |
| - name: var-run-calico | |
| hostPath: | |
| path: /var/run/calico | |
| - name: var-lib-calico | |
| hostPath: | |
| path: /var/lib/calico | |
| - name: xtables-lock | |
| hostPath: | |
| path: /run/xtables.lock | |
| type: FileOrCreate | |
| # Used by flannel. | |
| - name: flannel-cfg | |
| configMap: | |
| name: canal-config | |
| # Used to install CNI. | |
| - name: cni-bin-dir | |
| hostPath: | |
| path: /opt/cni/bin | |
| - name: cni-net-dir | |
| hostPath: | |
| path: /etc/cni/net.d | |
| --- | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: canal | |
| namespace: kube-system | |
| --- | |
| # Source: calico/templates/calico-etcd-secrets.yaml | |
| --- | |
| # Source: calico/templates/calico-kube-controllers.yaml | |
| --- | |
| # Source: calico/templates/calico-typha.yaml | |
| --- | |
| # Source: calico/templates/configure-canal.yaml | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: certmanager.k8s.io/v1alpha1 | |
| kind: Certificate | |
| metadata: | |
| name: codius-host-certificate | |
| namespace: codiusd | |
| spec: | |
| secretName: codiusd-certificate | |
| issuerRef: | |
| name: issuer-letsencrypt | |
| namespace: codiusd | |
| commonName: codius.example.com | |
| dnsNames: | |
| - codius.example.com | |
| - "*.codius.example.com" | |
| acme: | |
| config: | |
| - dns01: | |
| provider: acmedns | |
| domains: | |
| - codius.example.com | |
| - "*.codius.example.com" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: certmanager.k8s.io/v1alpha1 | |
| kind: Issuer | |
| metadata: | |
| name: issuer-letsencrypt | |
| namespace: codiusd | |
| spec: | |
| acme: | |
| server: https://acme-v02.api.letsencrypt.org/directory | |
| email: [email protected] | |
| privateKeySecretRef: | |
| name: account-private-key-secret | |
| dns01: | |
| providers: | |
| - name: acmedns | |
| acmedns: | |
| # host: https://acme.codius.example.com | |
| host: http://acme-dns.acme-dns | |
| accountSecretRef: | |
| name: certmanager-secret | |
| key: acmedns.json |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| kind: NetworkPolicy | |
| apiVersion: networking.k8s.io/v1 | |
| metadata: | |
| namespace: codius-untrusted | |
| name: codius-untrusted | |
| spec: | |
| policyTypes: | |
| - Egress | |
| podSelector: {} | |
| egress: | |
| - to: | |
| - ipBlock: | |
| cidr: 0.0.0.0/0 | |
| except: | |
| - 10.0.0.0/8 | |
| - 172.16.0.0/12 | |
| - 192.168.0.0/16 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: codiusd-service | |
| spec: | |
| type: LoadBalancer | |
| selector: | |
| app: codiusd | |
| ports: | |
| - protocol: TCP | |
| port: 3000 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: v1 | |
| kind: Namespace | |
| metadata: | |
| name: codiusd | |
| --- | |
| apiVersion: v1 | |
| kind: Namespace | |
| metadata: | |
| name: codius-untrusted | |
| --- | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: codiusd | |
| namespace: codiusd | |
| --- | |
| kind: Role | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| metadata: | |
| namespace: codius-untrusted | |
| name: codiusd | |
| rules: | |
| - apiGroups: [""] | |
| resources: ["pods"] | |
| verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1 | |
| kind: RoleBinding | |
| metadata: | |
| name: codiusd | |
| namespace: codiusd | |
| subjects: | |
| - kind: ServiceAccount | |
| name: codiusd | |
| namespace: codiusd | |
| roleRef: | |
| kind: Role | |
| name: codiusd | |
| namespace: codius-untrusted | |
| apiGroup: rbac.authorization.k8s.io | |
| --- | |
| apiVersion: v1 | |
| kind: PersistentVolumeClaim | |
| metadata: | |
| name: codiusd-pvc | |
| namespace: codiusd | |
| spec: | |
| accessModes: | |
| - ReadWriteOnce | |
| storageClassName: local-path | |
| resources: | |
| requests: | |
| storage: 100Mi | |
| --- | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: codiusd-service | |
| namespace: codiusd | |
| spec: | |
| type: LoadBalancer | |
| selector: | |
| app: codiusd | |
| ports: | |
| - protocol: TCP | |
| port: 3000 | |
| --- | |
| apiVersion: extensions/v1beta1 | |
| kind: Ingress | |
| metadata: | |
| name: codiusd | |
| namespace: codiusd | |
| annotations: | |
| # kubernetes.io/ingress.class: "traefik" | |
| # ingress.kubernetes.io/ssl-redirect: "true" | |
| ingress.kubernetes.io/hsts-max-age: "63072000" | |
| ingress.kubernetes.io/hsts-include-subdomains: "true" | |
| ingress.kubernetes.io/hsts-preload: "true" | |
| ingress.kubernetes.io/frame-deny: "true" | |
| ingress.kubernetes.io/content-type-nosniff: "true" | |
| ingress.kubernetes.io/browser-xss-filter: "true" | |
| spec: | |
| tls: | |
| - hosts: | |
| - codius.example.com | |
| - "*.codius.example.com" | |
| secretName: codiusd-certificate | |
| rules: | |
| - host: "codius.example.com" | |
| http: &http_rules | |
| paths: | |
| - backend: | |
| serviceName: codiusd-service | |
| servicePort: 3000 | |
| - host: "*.codius.example.com" | |
| http: *http_rules | |
| --- | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: codiusd | |
| namespace: codiusd | |
| labels: | |
| app: codiusd | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| app: codiusd | |
| template: | |
| metadata: | |
| labels: | |
| app: codiusd | |
| spec: | |
| containers: | |
| - name: codiusd | |
| image: wilsonianbcoil/codiusd | |
| env: | |
| - name: CODIUS_PUBLIC_URI | |
| value: https://codius.example.com | |
| - name: DEBUG | |
| value: "*codiusd*" | |
| - name: CODIUS_BIND_IP | |
| value: "0.0.0.0" | |
| - name: CODIUS_ADMIN_API | |
| value: "true" | |
| - name: ILP_BTP_SERVER | |
| value: "btp+ws://moneyd.moneyd:7768" | |
| - name: CODIUS_K8S_NAMESPACE | |
| value: codius-untrusted | |
| ports: | |
| - containerPort: 3000 | |
| - containerPort: 3001 | |
| volumeMounts: | |
| - name: data-volume | |
| mountPath: /var/lib/codius | |
| serviceAccountName: codiusd | |
| volumes: | |
| - name: data-volume | |
| persistentVolumeClaim: | |
| claimName: codiusd-pvc |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: ingress-nginx | |
| namespace: ingress-nginx | |
| spec: | |
| type: ClusterIP | |
| ports: | |
| - name: http | |
| port: 80 | |
| targetPort: 80 | |
| protocol: TCP | |
| - name: https | |
| port: 443 | |
| targetPort: 443 | |
| protocol: TCP | |
| - name: dns-tcp | |
| protocol: TCP | |
| port: 53 | |
| targetPort: 53 | |
| - name: dns-udp | |
| protocol: UDP | |
| port: 53 | |
| targetPort: 53 | |
| selector: | |
| app: ingress-nginx |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.24.1/deploy/mandatory.yaml | |
| # modified expose port 53 | |
| apiVersion: v1 | |
| kind: Namespace | |
| metadata: | |
| name: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| --- | |
| kind: ConfigMap | |
| apiVersion: v1 | |
| metadata: | |
| name: nginx-configuration | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| --- | |
| kind: ConfigMap | |
| apiVersion: v1 | |
| metadata: | |
| name: tcp-services | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| data: | |
| 53: "acme-dns/acme-dns:53" | |
| --- | |
| kind: ConfigMap | |
| apiVersion: v1 | |
| metadata: | |
| name: udp-services | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| data: | |
| 53: "acme-dns/acme-dns:53" | |
| --- | |
| apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: nginx-ingress-serviceaccount | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: ClusterRole | |
| metadata: | |
| name: nginx-ingress-clusterrole | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| rules: | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - configmaps | |
| - endpoints | |
| - nodes | |
| - pods | |
| - secrets | |
| verbs: | |
| - list | |
| - watch | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - nodes | |
| verbs: | |
| - get | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - services | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| - apiGroups: | |
| - "extensions" | |
| resources: | |
| - ingresses | |
| verbs: | |
| - get | |
| - list | |
| - watch | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - events | |
| verbs: | |
| - create | |
| - patch | |
| - apiGroups: | |
| - "extensions" | |
| resources: | |
| - ingresses/status | |
| verbs: | |
| - update | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: Role | |
| metadata: | |
| name: nginx-ingress-role | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| rules: | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - configmaps | |
| - pods | |
| - secrets | |
| - namespaces | |
| verbs: | |
| - get | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - configmaps | |
| resourceNames: | |
| # Defaults to "<election-id>-<ingress-class>" | |
| # Here: "<ingress-controller-leader>-<nginx>" | |
| # This has to be adapted if you change either parameter | |
| # when launching the nginx-ingress-controller. | |
| - "ingress-controller-leader-nginx" | |
| verbs: | |
| - get | |
| - update | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - configmaps | |
| verbs: | |
| - create | |
| - apiGroups: | |
| - "" | |
| resources: | |
| - endpoints | |
| verbs: | |
| - get | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: RoleBinding | |
| metadata: | |
| name: nginx-ingress-role-nisa-binding | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: Role | |
| name: nginx-ingress-role | |
| subjects: | |
| - kind: ServiceAccount | |
| name: nginx-ingress-serviceaccount | |
| namespace: ingress-nginx | |
| --- | |
| apiVersion: rbac.authorization.k8s.io/v1beta1 | |
| kind: ClusterRoleBinding | |
| metadata: | |
| name: nginx-ingress-clusterrole-nisa-binding | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| roleRef: | |
| apiGroup: rbac.authorization.k8s.io | |
| kind: ClusterRole | |
| name: nginx-ingress-clusterrole | |
| subjects: | |
| - kind: ServiceAccount | |
| name: nginx-ingress-serviceaccount | |
| namespace: ingress-nginx | |
| --- | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: nginx-ingress-controller | |
| namespace: ingress-nginx | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| template: | |
| metadata: | |
| labels: | |
| app.kubernetes.io/name: ingress-nginx | |
| app.kubernetes.io/part-of: ingress-nginx | |
| annotations: | |
| prometheus.io/port: "10254" | |
| prometheus.io/scrape: "true" | |
| spec: | |
| serviceAccountName: nginx-ingress-serviceaccount | |
| containers: | |
| - name: nginx-ingress-controller | |
| image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.24.1 | |
| args: | |
| - /nginx-ingress-controller | |
| - --configmap=$(POD_NAMESPACE)/nginx-configuration | |
| - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services | |
| - --udp-services-configmap=$(POD_NAMESPACE)/udp-services | |
| - --publish-service=$(POD_NAMESPACE)/ingress-nginx | |
| - --annotations-prefix=nginx.ingress.kubernetes.io | |
| securityContext: | |
| allowPrivilegeEscalation: true | |
| capabilities: | |
| drop: | |
| - ALL | |
| add: | |
| - NET_BIND_SERVICE | |
| # www-data -> 33 | |
| runAsUser: 33 | |
| env: | |
| - name: POD_NAME | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.name | |
| - name: POD_NAMESPACE | |
| valueFrom: | |
| fieldRef: | |
| fieldPath: metadata.namespace | |
| ports: | |
| - name: http | |
| containerPort: 80 | |
| - name: https | |
| containerPort: 443 | |
| - name: dns-tcp | |
| containerPort: 53 | |
| hostPort: 53 | |
| protocol: TCP | |
| - name: dns-udp | |
| containerPort: 53 | |
| hostPort: 53 | |
| protocol: UDP | |
| livenessProbe: | |
| failureThreshold: 3 | |
| httpGet: | |
| path: /healthz | |
| port: 10254 | |
| scheme: HTTP | |
| initialDelaySeconds: 10 | |
| periodSeconds: 10 | |
| successThreshold: 1 | |
| timeoutSeconds: 10 | |
| readinessProbe: | |
| failureThreshold: 3 | |
| httpGet: | |
| path: /healthz | |
| port: 10254 | |
| scheme: HTTP | |
| periodSeconds: 10 | |
| successThreshold: 1 | |
| timeoutSeconds: 10 | |
| --- |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: v1 | |
| kind: Namespace | |
| metadata: | |
| name: moneyd | |
| --- | |
| apiVersion: v1 | |
| kind: Service | |
| metadata: | |
| name: moneyd | |
| namespace: moneyd | |
| spec: | |
| selector: | |
| app: moneyd | |
| ports: | |
| - protocol: TCP | |
| port: 7768 | |
| --- | |
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: moneyd | |
| namespace: moneyd | |
| labels: | |
| app: moneyd | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| app: moneyd | |
| template: | |
| metadata: | |
| labels: | |
| app: moneyd | |
| spec: | |
| volumes: | |
| - name: moneyd-config | |
| secret: | |
| secretName: moneyd-config | |
| containers: | |
| - name: moneyd-xrp | |
| image: wilsonianbcoil/moneyd-xrp | |
| args: ["xrp:start"] | |
| env: | |
| - name: DEBUG | |
| value: "*" | |
| ports: | |
| - containerPort: 7768 | |
| volumeMounts: | |
| - name: moneyd-config | |
| mountPath: "/root" | |
| readOnly: true |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| apiVersion: apps/v1 | |
| kind: Deployment | |
| metadata: | |
| name: selftest | |
| labels: | |
| app: selftest | |
| spec: | |
| replicas: 1 | |
| selector: | |
| matchLabels: | |
| app: selftest | |
| template: | |
| metadata: | |
| labels: | |
| app: selftest | |
| spec: | |
| containers: | |
| - name: selftest | |
| image: androswong418/codius-test-image@sha256:0dce885c4e558a8a7612b80e3c7f5faa54520ed27836b1f892962cf855d031a2 | |
| ports: | |
| - containerPort: 3000 | |
| serviceAccountName: codiusd |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment