Skip to content

Instantly share code, notes, and snippets.

@wilsonianb

wilsonianb/acme-dns-ingress.yaml

Last active June 21, 2019 21:14
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save wilsonianb/0b09086821f55b46e3bfb0e83b042b8e to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save wilsonianb/0b09086821f55b46e3bfb0e83b042b8e to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. wilsonianb revised this gist Jun 21, 2019. 1 changed file with 0 additions and 592 deletions.
    592 changes: 0 additions & 592 deletions canal.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,592 +0,0 @@
    # https://docs.projectcalico.org/v3.7/manifests/canal.yaml
    # modified to allow_ip_forwarding
    ---
    # Source: calico/templates/calico-config.yaml
    # This ConfigMap is used to configure a self-hosted Canal installation.
    kind: ConfigMap
    apiVersion: v1
    metadata:
    name: canal-config
    namespace: kube-system
    data:
    # Typha is disabled.
    typha_service_name: "none"
    # The interface used by canal for host <-> host communication.
    # If left blank, then the interface is chosen using the node's
    # default route.
    canal_iface: ""

    # Whether or not to masquerade traffic to destinations not within
    # the pod network.
    masquerade: "true"

    # The CNI network configuration to install on each node. The special
    # values in this config will be automatically populated.
    cni_network_config: |-
    {
    "name": "k8s-pod-network",
    "cniVersion": "0.3.0",
    "plugins": [
    {
    "type": "calico",
    "log_level": "info",
    "datastore_type": "kubernetes",
    "nodename": "__KUBERNETES_NODE_NAME__",
    "ipam": {
    "type": "host-local",
    "subnet": "usePodCidr"
    },
    "container_settings": {
    "allow_ip_forwarding": true
    },
    "policy": {
    "type": "k8s"
    },
    "kubernetes": {
    "kubeconfig": "__KUBECONFIG_FILEPATH__"
    }
    },
    {
    "type": "portmap",
    "snat": true,
    "capabilities": {"portMappings": true}
    }
    ]
    }
    # Flannel network configuration. Mounted into the flannel container.
    net-conf.json: |
    {
    "Network": "10.244.0.0/16",
    "Backend": {
    "Type": "vxlan"
    }
    }
    ---
    # Source: calico/templates/kdd-crds.yaml
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: felixconfigurations.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: FelixConfiguration
    plural: felixconfigurations
    singular: felixconfiguration
    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: bgpconfigurations.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: BGPConfiguration
    plural: bgpconfigurations
    singular: bgpconfiguration

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: ippools.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: IPPool
    plural: ippools
    singular: ippool

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: hostendpoints.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: HostEndpoint
    plural: hostendpoints
    singular: hostendpoint

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: clusterinformations.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: ClusterInformation
    plural: clusterinformations
    singular: clusterinformation

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: globalnetworkpolicies.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: GlobalNetworkPolicy
    plural: globalnetworkpolicies
    singular: globalnetworkpolicy

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: globalnetworksets.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: GlobalNetworkSet
    plural: globalnetworksets
    singular: globalnetworkset

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: networkpolicies.crd.projectcalico.org
    spec:
    scope: Namespaced
    group: crd.projectcalico.org
    version: v1
    names:
    kind: NetworkPolicy
    plural: networkpolicies
    singular: networkpolicy

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: networksets.crd.projectcalico.org
    spec:
    scope: Namespaced
    group: crd.projectcalico.org
    version: v1
    names:
    kind: NetworkSet
    plural: networksets
    singular: networkset
    ---
    # Source: calico/templates/rbac.yaml

    # Include a clusterrole for the calico-node DaemonSet,
    # and bind it to the calico-node serviceaccount.
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
    name: calico-node
    rules:
    # The CNI plugin needs to get pods, nodes, and namespaces.
    - apiGroups: [""]
    resources:
    - pods
    - nodes
    - namespaces
    verbs:
    - get
    - apiGroups: [""]
    resources:
    - endpoints
    - services
    verbs:
    # Used to discover service IPs for advertisement.
    - watch
    - list
    # Used to discover Typhas.
    - get
    - apiGroups: [""]
    resources:
    - nodes/status
    verbs:
    # Needed for clearing NodeNetworkUnavailable flag.
    - patch
    # Calico stores some configuration information in node annotations.
    - update
    # Watch for changes to Kubernetes NetworkPolicies.
    - apiGroups: ["networking.k8s.io"]
    resources:
    - networkpolicies
    verbs:
    - watch
    - list
    # Used by Calico for policy information.
    - apiGroups: [""]
    resources:
    - pods
    - namespaces
    - serviceaccounts
    verbs:
    - list
    - watch
    # The CNI plugin patches pods/status.
    - apiGroups: [""]
    resources:
    - pods/status
    verbs:
    - patch
    # Calico monitors various CRDs for config.
    - apiGroups: ["crd.projectcalico.org"]
    resources:
    - globalfelixconfigs
    - felixconfigurations
    - bgppeers
    - globalbgpconfigs
    - bgpconfigurations
    - ippools
    - ipamblocks
    - globalnetworkpolicies
    - globalnetworksets
    - networkpolicies
    - networksets
    - clusterinformations
    - hostendpoints
    verbs:
    - get
    - list
    - watch
    # Calico must create and update some CRDs on startup.
    - apiGroups: ["crd.projectcalico.org"]
    resources:
    - ippools
    - felixconfigurations
    - clusterinformations
    verbs:
    - create
    - update
    # Calico stores some configuration information on the node.
    - apiGroups: [""]
    resources:
    - nodes
    verbs:
    - get
    - list
    - watch
    # These permissions are only requried for upgrade from v2.6, and can
    # be removed after upgrade or on fresh installations.
    - apiGroups: ["crd.projectcalico.org"]
    resources:
    - bgpconfigurations
    - bgppeers
    verbs:
    - create
    - update
    ---
    # Flannel ClusterRole
    # Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
    name: flannel
    rules:
    - apiGroups: [""]
    resources:
    - pods
    verbs:
    - get
    - apiGroups: [""]
    resources:
    - nodes
    verbs:
    - list
    - watch
    - apiGroups: [""]
    resources:
    - nodes/status
    verbs:
    - patch
    ---
    # Bind the flannel ClusterRole to the canal ServiceAccount.
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
    name: canal-flannel
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: flannel
    subjects:
    - kind: ServiceAccount
    name: canal
    namespace: kube-system
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
    name: canal-calico
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: calico-node
    subjects:
    - kind: ServiceAccount
    name: canal
    namespace: kube-system

    ---
    # Source: calico/templates/calico-node.yaml
    # This manifest installs the canal container, as well
    # as the CNI plugins and network config on
    # each master and worker node in a Kubernetes cluster.
    kind: DaemonSet
    apiVersion: extensions/v1beta1
    metadata:
    name: canal
    namespace: kube-system
    labels:
    k8s-app: canal
    spec:
    selector:
    matchLabels:
    k8s-app: canal
    updateStrategy:
    type: RollingUpdate
    rollingUpdate:
    maxUnavailable: 1
    template:
    metadata:
    labels:
    k8s-app: canal
    annotations:
    # This, along with the CriticalAddonsOnly toleration below,
    # marks the pod as a critical add-on, ensuring it gets
    # priority scheduling and that its resources are reserved
    # if it ever gets evicted.
    scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
    nodeSelector:
    beta.kubernetes.io/os: linux
    hostNetwork: true
    tolerations:
    # Make sure canal gets scheduled on all nodes.
    - effect: NoSchedule
    operator: Exists
    # Mark the pod as a critical add-on for rescheduling.
    - key: CriticalAddonsOnly
    operator: Exists
    - effect: NoExecute
    operator: Exists
    serviceAccountName: canal
    # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
    # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
    terminationGracePeriodSeconds: 0
    initContainers:
    # This container installs the CNI binaries
    # and CNI network config file on each node.
    - name: install-cni
    image: calico/cni:v3.7.3
    command: ["/install-cni.sh"]
    env:
    # Name of the CNI config file to create.
    - name: CNI_CONF_NAME
    value: "10-canal.conflist"
    # The CNI network config to install on each node.
    - name: CNI_NETWORK_CONFIG
    valueFrom:
    configMapKeyRef:
    name: canal-config
    key: cni_network_config
    # Set the hostname based on the k8s node name.
    - name: KUBERNETES_NODE_NAME
    valueFrom:
    fieldRef:
    fieldPath: spec.nodeName
    # Prevents the container from sleeping forever.
    - name: SLEEP
    value: "false"
    volumeMounts:
    - mountPath: /host/opt/cni/bin
    name: cni-bin-dir
    - mountPath: /host/etc/cni/net.d
    name: cni-net-dir
    containers:
    # Runs canal container on each Kubernetes node. This
    # container programs network policy and routes on each
    # host.
    - name: calico-node
    image: calico/node:v3.7.3
    env:
    # Use Kubernetes API as the backing datastore.
    - name: DATASTORE_TYPE
    value: "kubernetes"
    # Configure route aggregation based on pod CIDR.
    - name: USE_POD_CIDR
    value: "true"
    # Wait for the datastore.
    - name: WAIT_FOR_DATASTORE
    value: "true"
    # Set based on the k8s node name.
    - name: NODENAME
    valueFrom:
    fieldRef:
    fieldPath: spec.nodeName
    # Don't enable BGP.
    - name: CALICO_NETWORKING_BACKEND
    value: "none"
    # Cluster type to identify the deployment type
    - name: CLUSTER_TYPE
    value: "k8s,canal"
    # Period, in seconds, at which felix re-applies all iptables state
    - name: FELIX_IPTABLESREFRESHINTERVAL
    value: "60"
    # No IP address needed.
    - name: IP
    value: ""
    # The default IPv4 pool to create on startup if none exists. Pod IPs will be
    # chosen from this range. Changing this value after installation will have
    # no effect. This should fall within `--cluster-cidr`.
    - name: CALICO_IPV4POOL_CIDR
    value: "192.168.0.0/16"
    # Disable file logging so `kubectl logs` works.
    - name: CALICO_DISABLE_FILE_LOGGING
    value: "true"
    # Set Felix endpoint to host default action to ACCEPT.
    - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
    value: "ACCEPT"
    # Disable IPv6 on Kubernetes.
    - name: FELIX_IPV6SUPPORT
    value: "false"
    # Set Felix logging to "info"
    - name: FELIX_LOGSEVERITYSCREEN
    value: "info"
    - name: FELIX_HEALTHENABLED
    value: "true"
    securityContext:
    privileged: true
    resources:
    requests:
    cpu: 250m
    livenessProbe:
    httpGet:
    path: /liveness
    port: 9099
    host: localhost
    periodSeconds: 10
    initialDelaySeconds: 10
    failureThreshold: 6
    readinessProbe:
    httpGet:
    path: /readiness
    port: 9099
    host: localhost
    periodSeconds: 10
    volumeMounts:
    - mountPath: /lib/modules
    name: lib-modules
    readOnly: true
    - mountPath: /run/xtables.lock
    name: xtables-lock
    readOnly: false
    - mountPath: /var/run/calico
    name: var-run-calico
    readOnly: false
    - mountPath: /var/lib/calico
    name: var-lib-calico
    readOnly: false
    # This container runs flannel using the kube-subnet-mgr backend
    # for allocating subnets.
    - name: kube-flannel
    image: quay.io/coreos/flannel:v0.11.0
    command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ]
    securityContext:
    privileged: true
    env:
    - name: POD_NAME
    valueFrom:
    fieldRef:
    fieldPath: metadata.name
    - name: POD_NAMESPACE
    valueFrom:
    fieldRef:
    fieldPath: metadata.namespace
    - name: FLANNELD_IFACE
    valueFrom:
    configMapKeyRef:
    name: canal-config
    key: canal_iface
    - name: FLANNELD_IP_MASQ
    valueFrom:
    configMapKeyRef:
    name: canal-config
    key: masquerade
    volumeMounts:
    - mountPath: /run/xtables.lock
    name: xtables-lock
    readOnly: false
    - name: flannel-cfg
    mountPath: /etc/kube-flannel/
    volumes:
    # Used by canal.
    - name: lib-modules
    hostPath:
    path: /lib/modules
    - name: var-run-calico
    hostPath:
    path: /var/run/calico
    - name: var-lib-calico
    hostPath:
    path: /var/lib/calico
    - name: xtables-lock
    hostPath:
    path: /run/xtables.lock
    type: FileOrCreate
    # Used by flannel.
    - name: flannel-cfg
    configMap:
    name: canal-config
    # Used to install CNI.
    - name: cni-bin-dir
    hostPath:
    path: /opt/cni/bin
    - name: cni-net-dir
    hostPath:
    path: /etc/cni/net.d
    ---

    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: canal
    namespace: kube-system

    ---
    # Source: calico/templates/calico-etcd-secrets.yaml

    ---
    # Source: calico/templates/calico-kube-controllers.yaml

    ---
    # Source: calico/templates/calico-typha.yaml

    ---
    # Source: calico/templates/configure-canal.yaml

  2. wilsonianb revised this gist Jun 21, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion kata-deploy.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -24,7 +24,7 @@ spec:
    preStop:
    exec:
    command: ["bash", "-c", "/opt/kata-artifacts/scripts/kata-deploy.sh cleanup"]
    command: [ "bash", "-c", "sed -i 's/systemctl restart \$1/#&/' /opt/kata-artifacts/scripts/kata-deploy.sh; /opt/kata-artifacts/scripts/kata-deploy.sh install" ]
    command: [ "bash", "-c", "sed -i 's/systemctl restart \\$1/#&/' /opt/kata-artifacts/scripts/kata-deploy.sh; /opt/kata-artifacts/scripts/kata-deploy.sh install" ]
    env:
    - name: NODE_NAME
    valueFrom:
  3. wilsonianb revised this gist Jun 21, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion kata-deploy.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -24,7 +24,7 @@ spec:
    preStop:
    exec:
    command: ["bash", "-c", "/opt/kata-artifacts/scripts/kata-deploy.sh cleanup"]
    command: [ "bash", "-c", "/opt/kata-artifacts/scripts/kata-deploy.sh install" ]
    command: [ "bash", "-c", "sed -i 's/systemctl restart \$1/#&/' /opt/kata-artifacts/scripts/kata-deploy.sh; /opt/kata-artifacts/scripts/kata-deploy.sh install" ]
    env:
    - name: NODE_NAME
    valueFrom:
  4. wilsonianb revised this gist Jun 21, 2019. 1 changed file with 71 additions and 0 deletions.
    71 changes: 71 additions & 0 deletions kata-deploy.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,71 @@
    # from https://raw.githubusercontent.com/kata-containers/packaging/master/kata-deploy/kata-deploy.yaml
    # removes expectation that containerd is running via systemd
    ---
    apiVersion: apps/v1
    kind: DaemonSet
    metadata:
    name: kata-deploy
    namespace: kube-system
    spec:
    selector:
    matchLabels:
    name: kata-deploy
    template:
    metadata:
    labels:
    name: kata-deploy
    spec:
    serviceAccountName: kata-label-node
    containers:
    - name: kube-kata
    image: katadocker/kata-deploy
    imagePullPolicy: Always
    lifecycle:
    preStop:
    exec:
    command: ["bash", "-c", "/opt/kata-artifacts/scripts/kata-deploy.sh cleanup"]
    command: [ "bash", "-c", "/opt/kata-artifacts/scripts/kata-deploy.sh install" ]
    env:
    - name: NODE_NAME
    valueFrom:
    fieldRef:
    fieldPath: spec.nodeName
    securityContext:
    privileged: false
    volumeMounts:
    - name: crio-conf
    mountPath: /etc/crio/
    - name: containerd-conf
    mountPath: /etc/containerd/
    - name: kata-artifacts
    mountPath: /opt/kata/
    - name: dbus
    mountPath: /var/run/dbus
    - name: systemd
    mountPath: /run/systemd
    - name: local-bin
    mountPath: /usr/local/bin/
    volumes:
    - name: crio-conf
    hostPath:
    path: /etc/crio/
    - name: containerd-conf
    hostPath:
    path: /etc/containerd/
    - name: kata-artifacts
    hostPath:
    path: /opt/kata/
    type: DirectoryOrCreate
    - name: dbus
    hostPath:
    path: /var/run/dbus
    - name: systemd
    hostPath:
    path: /run/systemd
    - name: local-bin
    hostPath:
    path: /usr/local/bin/
    updateStrategy:
    rollingUpdate:
    maxUnavailable: 1
    type: RollingUpdate
  5. wilsonianb revised this gist Jun 20, 2019. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -28,15 +28,14 @@ apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
    name: codiusd
    namespace: codiusd
    namespace: codius-untrusted
    subjects:
    - kind: ServiceAccount
    name: codiusd
    namespace: codiusd
    roleRef:
    kind: Role
    name: codiusd
    namespace: codius-untrusted
    apiGroup: rbac.authorization.k8s.io
    ---
    apiVersion: v1
  6. wilsonianb revised this gist Jun 14, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -71,7 +71,7 @@ metadata:
    name: codiusd
    namespace: codiusd
    annotations:
    # kubernetes.io/ingress.class: "traefik"
    kubernetes.io/ingress.class: "traefik"
    # ingress.kubernetes.io/ssl-redirect: "true"
    ingress.kubernetes.io/hsts-max-age: "63072000"
    ingress.kubernetes.io/hsts-include-subdomains: "true"
  7. wilsonianb revised this gist Jun 14, 2019. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions canal.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,5 @@
    # https://docs.projectcalico.org/v3.7/manifests/canal.yaml
    # modified to allow_ip_forwarding
    ---
    # Source: calico/templates/calico-config.yaml
    # This ConfigMap is used to configure a self-hosted Canal installation.
  8. wilsonianb revised this gist Jun 14, 2019. 1 changed file with 590 additions and 0 deletions.
    590 changes: 590 additions & 0 deletions canal.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,590 @@
    ---
    # Source: calico/templates/calico-config.yaml
    # This ConfigMap is used to configure a self-hosted Canal installation.
    kind: ConfigMap
    apiVersion: v1
    metadata:
    name: canal-config
    namespace: kube-system
    data:
    # Typha is disabled.
    typha_service_name: "none"
    # The interface used by canal for host <-> host communication.
    # If left blank, then the interface is chosen using the node's
    # default route.
    canal_iface: ""

    # Whether or not to masquerade traffic to destinations not within
    # the pod network.
    masquerade: "true"

    # The CNI network configuration to install on each node. The special
    # values in this config will be automatically populated.
    cni_network_config: |-
    {
    "name": "k8s-pod-network",
    "cniVersion": "0.3.0",
    "plugins": [
    {
    "type": "calico",
    "log_level": "info",
    "datastore_type": "kubernetes",
    "nodename": "__KUBERNETES_NODE_NAME__",
    "ipam": {
    "type": "host-local",
    "subnet": "usePodCidr"
    },
    "container_settings": {
    "allow_ip_forwarding": true
    },
    "policy": {
    "type": "k8s"
    },
    "kubernetes": {
    "kubeconfig": "__KUBECONFIG_FILEPATH__"
    }
    },
    {
    "type": "portmap",
    "snat": true,
    "capabilities": {"portMappings": true}
    }
    ]
    }
    # Flannel network configuration. Mounted into the flannel container.
    net-conf.json: |
    {
    "Network": "10.244.0.0/16",
    "Backend": {
    "Type": "vxlan"
    }
    }
    ---
    # Source: calico/templates/kdd-crds.yaml
    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: felixconfigurations.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: FelixConfiguration
    plural: felixconfigurations
    singular: felixconfiguration
    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: bgpconfigurations.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: BGPConfiguration
    plural: bgpconfigurations
    singular: bgpconfiguration

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: ippools.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: IPPool
    plural: ippools
    singular: ippool

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: hostendpoints.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: HostEndpoint
    plural: hostendpoints
    singular: hostendpoint

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: clusterinformations.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: ClusterInformation
    plural: clusterinformations
    singular: clusterinformation

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: globalnetworkpolicies.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: GlobalNetworkPolicy
    plural: globalnetworkpolicies
    singular: globalnetworkpolicy

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: globalnetworksets.crd.projectcalico.org
    spec:
    scope: Cluster
    group: crd.projectcalico.org
    version: v1
    names:
    kind: GlobalNetworkSet
    plural: globalnetworksets
    singular: globalnetworkset

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: networkpolicies.crd.projectcalico.org
    spec:
    scope: Namespaced
    group: crd.projectcalico.org
    version: v1
    names:
    kind: NetworkPolicy
    plural: networkpolicies
    singular: networkpolicy

    ---

    apiVersion: apiextensions.k8s.io/v1beta1
    kind: CustomResourceDefinition
    metadata:
    name: networksets.crd.projectcalico.org
    spec:
    scope: Namespaced
    group: crd.projectcalico.org
    version: v1
    names:
    kind: NetworkSet
    plural: networksets
    singular: networkset
    ---
    # Source: calico/templates/rbac.yaml

    # Include a clusterrole for the calico-node DaemonSet,
    # and bind it to the calico-node serviceaccount.
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
    name: calico-node
    rules:
    # The CNI plugin needs to get pods, nodes, and namespaces.
    - apiGroups: [""]
    resources:
    - pods
    - nodes
    - namespaces
    verbs:
    - get
    - apiGroups: [""]
    resources:
    - endpoints
    - services
    verbs:
    # Used to discover service IPs for advertisement.
    - watch
    - list
    # Used to discover Typhas.
    - get
    - apiGroups: [""]
    resources:
    - nodes/status
    verbs:
    # Needed for clearing NodeNetworkUnavailable flag.
    - patch
    # Calico stores some configuration information in node annotations.
    - update
    # Watch for changes to Kubernetes NetworkPolicies.
    - apiGroups: ["networking.k8s.io"]
    resources:
    - networkpolicies
    verbs:
    - watch
    - list
    # Used by Calico for policy information.
    - apiGroups: [""]
    resources:
    - pods
    - namespaces
    - serviceaccounts
    verbs:
    - list
    - watch
    # The CNI plugin patches pods/status.
    - apiGroups: [""]
    resources:
    - pods/status
    verbs:
    - patch
    # Calico monitors various CRDs for config.
    - apiGroups: ["crd.projectcalico.org"]
    resources:
    - globalfelixconfigs
    - felixconfigurations
    - bgppeers
    - globalbgpconfigs
    - bgpconfigurations
    - ippools
    - ipamblocks
    - globalnetworkpolicies
    - globalnetworksets
    - networkpolicies
    - networksets
    - clusterinformations
    - hostendpoints
    verbs:
    - get
    - list
    - watch
    # Calico must create and update some CRDs on startup.
    - apiGroups: ["crd.projectcalico.org"]
    resources:
    - ippools
    - felixconfigurations
    - clusterinformations
    verbs:
    - create
    - update
    # Calico stores some configuration information on the node.
    - apiGroups: [""]
    resources:
    - nodes
    verbs:
    - get
    - list
    - watch
    # These permissions are only requried for upgrade from v2.6, and can
    # be removed after upgrade or on fresh installations.
    - apiGroups: ["crd.projectcalico.org"]
    resources:
    - bgpconfigurations
    - bgppeers
    verbs:
    - create
    - update
    ---
    # Flannel ClusterRole
    # Pulled from https://github.com/coreos/flannel/blob/master/Documentation/kube-flannel-rbac.yml
    kind: ClusterRole
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
    name: flannel
    rules:
    - apiGroups: [""]
    resources:
    - pods
    verbs:
    - get
    - apiGroups: [""]
    resources:
    - nodes
    verbs:
    - list
    - watch
    - apiGroups: [""]
    resources:
    - nodes/status
    verbs:
    - patch
    ---
    # Bind the flannel ClusterRole to the canal ServiceAccount.
    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
    name: canal-flannel
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: flannel
    subjects:
    - kind: ServiceAccount
    name: canal
    namespace: kube-system
    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
    name: canal-calico
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: calico-node
    subjects:
    - kind: ServiceAccount
    name: canal
    namespace: kube-system

    ---
    # Source: calico/templates/calico-node.yaml
    # This manifest installs the canal container, as well
    # as the CNI plugins and network config on
    # each master and worker node in a Kubernetes cluster.
    kind: DaemonSet
    apiVersion: extensions/v1beta1
    metadata:
    name: canal
    namespace: kube-system
    labels:
    k8s-app: canal
    spec:
    selector:
    matchLabels:
    k8s-app: canal
    updateStrategy:
    type: RollingUpdate
    rollingUpdate:
    maxUnavailable: 1
    template:
    metadata:
    labels:
    k8s-app: canal
    annotations:
    # This, along with the CriticalAddonsOnly toleration below,
    # marks the pod as a critical add-on, ensuring it gets
    # priority scheduling and that its resources are reserved
    # if it ever gets evicted.
    scheduler.alpha.kubernetes.io/critical-pod: ''
    spec:
    nodeSelector:
    beta.kubernetes.io/os: linux
    hostNetwork: true
    tolerations:
    # Make sure canal gets scheduled on all nodes.
    - effect: NoSchedule
    operator: Exists
    # Mark the pod as a critical add-on for rescheduling.
    - key: CriticalAddonsOnly
    operator: Exists
    - effect: NoExecute
    operator: Exists
    serviceAccountName: canal
    # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a "force
    # deletion": https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.
    terminationGracePeriodSeconds: 0
    initContainers:
    # This container installs the CNI binaries
    # and CNI network config file on each node.
    - name: install-cni
    image: calico/cni:v3.7.3
    command: ["/install-cni.sh"]
    env:
    # Name of the CNI config file to create.
    - name: CNI_CONF_NAME
    value: "10-canal.conflist"
    # The CNI network config to install on each node.
    - name: CNI_NETWORK_CONFIG
    valueFrom:
    configMapKeyRef:
    name: canal-config
    key: cni_network_config
    # Set the hostname based on the k8s node name.
    - name: KUBERNETES_NODE_NAME
    valueFrom:
    fieldRef:
    fieldPath: spec.nodeName
    # Prevents the container from sleeping forever.
    - name: SLEEP
    value: "false"
    volumeMounts:
    - mountPath: /host/opt/cni/bin
    name: cni-bin-dir
    - mountPath: /host/etc/cni/net.d
    name: cni-net-dir
    containers:
    # Runs canal container on each Kubernetes node. This
    # container programs network policy and routes on each
    # host.
    - name: calico-node
    image: calico/node:v3.7.3
    env:
    # Use Kubernetes API as the backing datastore.
    - name: DATASTORE_TYPE
    value: "kubernetes"
    # Configure route aggregation based on pod CIDR.
    - name: USE_POD_CIDR
    value: "true"
    # Wait for the datastore.
    - name: WAIT_FOR_DATASTORE
    value: "true"
    # Set based on the k8s node name.
    - name: NODENAME
    valueFrom:
    fieldRef:
    fieldPath: spec.nodeName
    # Don't enable BGP.
    - name: CALICO_NETWORKING_BACKEND
    value: "none"
    # Cluster type to identify the deployment type
    - name: CLUSTER_TYPE
    value: "k8s,canal"
    # Period, in seconds, at which felix re-applies all iptables state
    - name: FELIX_IPTABLESREFRESHINTERVAL
    value: "60"
    # No IP address needed.
    - name: IP
    value: ""
    # The default IPv4 pool to create on startup if none exists. Pod IPs will be
    # chosen from this range. Changing this value after installation will have
    # no effect. This should fall within `--cluster-cidr`.
    - name: CALICO_IPV4POOL_CIDR
    value: "192.168.0.0/16"
    # Disable file logging so `kubectl logs` works.
    - name: CALICO_DISABLE_FILE_LOGGING
    value: "true"
    # Set Felix endpoint to host default action to ACCEPT.
    - name: FELIX_DEFAULTENDPOINTTOHOSTACTION
    value: "ACCEPT"
    # Disable IPv6 on Kubernetes.
    - name: FELIX_IPV6SUPPORT
    value: "false"
    # Set Felix logging to "info"
    - name: FELIX_LOGSEVERITYSCREEN
    value: "info"
    - name: FELIX_HEALTHENABLED
    value: "true"
    securityContext:
    privileged: true
    resources:
    requests:
    cpu: 250m
    livenessProbe:
    httpGet:
    path: /liveness
    port: 9099
    host: localhost
    periodSeconds: 10
    initialDelaySeconds: 10
    failureThreshold: 6
    readinessProbe:
    httpGet:
    path: /readiness
    port: 9099
    host: localhost
    periodSeconds: 10
    volumeMounts:
    - mountPath: /lib/modules
    name: lib-modules
    readOnly: true
    - mountPath: /run/xtables.lock
    name: xtables-lock
    readOnly: false
    - mountPath: /var/run/calico
    name: var-run-calico
    readOnly: false
    - mountPath: /var/lib/calico
    name: var-lib-calico
    readOnly: false
    # This container runs flannel using the kube-subnet-mgr backend
    # for allocating subnets.
    - name: kube-flannel
    image: quay.io/coreos/flannel:v0.11.0
    command: [ "/opt/bin/flanneld", "--ip-masq", "--kube-subnet-mgr" ]
    securityContext:
    privileged: true
    env:
    - name: POD_NAME
    valueFrom:
    fieldRef:
    fieldPath: metadata.name
    - name: POD_NAMESPACE
    valueFrom:
    fieldRef:
    fieldPath: metadata.namespace
    - name: FLANNELD_IFACE
    valueFrom:
    configMapKeyRef:
    name: canal-config
    key: canal_iface
    - name: FLANNELD_IP_MASQ
    valueFrom:
    configMapKeyRef:
    name: canal-config
    key: masquerade
    volumeMounts:
    - mountPath: /run/xtables.lock
    name: xtables-lock
    readOnly: false
    - name: flannel-cfg
    mountPath: /etc/kube-flannel/
    volumes:
    # Used by canal.
    - name: lib-modules
    hostPath:
    path: /lib/modules
    - name: var-run-calico
    hostPath:
    path: /var/run/calico
    - name: var-lib-calico
    hostPath:
    path: /var/lib/calico
    - name: xtables-lock
    hostPath:
    path: /run/xtables.lock
    type: FileOrCreate
    # Used by flannel.
    - name: flannel-cfg
    configMap:
    name: canal-config
    # Used to install CNI.
    - name: cni-bin-dir
    hostPath:
    path: /opt/cni/bin
    - name: cni-net-dir
    hostPath:
    path: /etc/cni/net.d
    ---

    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: canal
    namespace: kube-system

    ---
    # Source: calico/templates/calico-etcd-secrets.yaml

    ---
    # Source: calico/templates/calico-kube-controllers.yaml

    ---
    # Source: calico/templates/calico-typha.yaml

    ---
    # Source: calico/templates/configure-canal.yaml

  9. wilsonianb revised this gist Jun 12, 2019. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -43,6 +43,7 @@ apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
    name: codiusd-pvc
    namespace: codiusd
    spec:
    accessModes:
    - ReadWriteOnce
  10. wilsonianb revised this gist Jun 12, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -122,7 +122,7 @@ spec:
    - name: CODIUS_BIND_IP
    value: "0.0.0.0"
    - name: CODIUS_ADMIN_API
    value: true
    value: "true"
    - name: ILP_BTP_SERVER
    value: "btp+ws://moneyd.moneyd:7768"
    - name: CODIUS_K8S_NAMESPACE
  11. wilsonianb revised this gist Jun 12, 2019. 1 changed file with 6 additions and 1 deletion.
    7 changes: 6 additions & 1 deletion codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -4,6 +4,11 @@ metadata:
    name: codiusd
    ---
    apiVersion: v1
    kind: Namespace
    metadata:
    name: codius-untrusted
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: codiusd
    @@ -119,7 +124,7 @@ spec:
    - name: CODIUS_ADMIN_API
    value: true
    - name: ILP_BTP_SERVER
    value: btp+ws://moneyd.moneyd:7768
    value: "btp+ws://moneyd.moneyd:7768"
    - name: CODIUS_K8S_NAMESPACE
    value: codius-untrusted
    ports:
  12. wilsonianb revised this gist Jun 12, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -65,7 +65,7 @@ metadata:
    name: codiusd
    namespace: codiusd
    annotations:
    kubernetes.io/ingress.class: "traefik"
    # kubernetes.io/ingress.class: "traefik"
    # ingress.kubernetes.io/ssl-redirect: "true"
    ingress.kubernetes.io/hsts-max-age: "63072000"
    ingress.kubernetes.io/hsts-include-subdomains: "true"
  13. wilsonianb revised this gist Jun 7, 2019. 1 changed file with 22 additions and 0 deletions.
    22 changes: 22 additions & 0 deletions selftest.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,22 @@
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: selftest
    labels:
    app: selftest
    spec:
    replicas: 1
    selector:
    matchLabels:
    app: selftest
    template:
    metadata:
    labels:
    app: selftest
    spec:
    containers:
    - name: selftest
    image: androswong418/codius-test-image@sha256:0dce885c4e558a8a7612b80e3c7f5faa54520ed27836b1f892962cf855d031a2
    ports:
    - containerPort: 3000
    serviceAccountName: codiusd
  14. wilsonianb revised this gist Jun 6, 2019. 1 changed file with 9 additions and 3 deletions.
    12 changes: 9 additions & 3 deletions codius-untrusted-network-policy.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -4,8 +4,14 @@ metadata:
    namespace: codius-untrusted
    name: codius-untrusted
    spec:
    podSelector:
    matchLabels:
    policyTypes:
    - Egress
    podSelector: {}
    egress:
    - to:
    - podSelector: {}
    - ipBlock:
    cidr: 0.0.0.0/0
    except:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  15. wilsonianb revised this gist Jun 6, 2019. 1 changed file with 11 additions and 0 deletions.
    11 changes: 11 additions & 0 deletions codius-untrusted-network-policy.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,11 @@
    kind: NetworkPolicy
    apiVersion: networking.k8s.io/v1
    metadata:
    namespace: codius-untrusted
    name: codius-untrusted
    spec:
    podSelector:
    matchLabels:
    egress:
    - to:
    - podSelector: {}
  16. wilsonianb revised this gist Jun 6, 2019. 3 changed files with 5 additions and 2 deletions.
    4 changes: 3 additions & 1 deletion codius-host-certificate.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -2,10 +2,12 @@ apiVersion: certmanager.k8s.io/v1alpha1
    kind: Certificate
    metadata:
    name: codius-host-certificate
    namespace: codiusd
    spec:
    secretName: codius-certificate-secret
    secretName: codiusd-certificate
    issuerRef:
    name: issuer-letsencrypt
    namespace: codiusd
    commonName: codius.example.com
    dnsNames:
    - codius.example.com
    1 change: 1 addition & 0 deletions codius-host-issuer.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -2,6 +2,7 @@ apiVersion: certmanager.k8s.io/v1alpha1
    kind: Issuer
    metadata:
    name: issuer-letsencrypt
    namespace: codiusd
    spec:
    acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    2 changes: 1 addition & 1 deletion codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -78,7 +78,7 @@ spec:
    - hosts:
    - codius.example.com
    - "*.codius.example.com"
    secretName: codius-certificate-secret
    secretName: codiusd-certificate
    rules:
    - host: "codius.example.com"
    http: &http_rules
  17. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion acme-dns.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,7 +1,7 @@
    apiVersion: v1
    kind: Namespace
    metadata:
    name: acme-dns
    name: acme-dns
    ---
    apiVersion: v1
    kind: PersistentVolumeClaim
  18. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 279 additions and 0 deletions.
    279 changes: 279 additions & 0 deletions ingress-nginx.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,279 @@
    # https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-0.24.1/deploy/mandatory.yaml
    # modified expose port 53
    apiVersion: v1
    kind: Namespace
    metadata:
    name: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

    ---

    kind: ConfigMap
    apiVersion: v1
    metadata:
    name: nginx-configuration
    namespace: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

    ---
    kind: ConfigMap
    apiVersion: v1
    metadata:
    name: tcp-services
    namespace: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    data:
    53: "acme-dns/acme-dns:53"

    ---
    kind: ConfigMap
    apiVersion: v1
    metadata:
    name: udp-services
    namespace: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    data:
    53: "acme-dns/acme-dns:53"

    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: nginx-ingress-serviceaccount
    namespace: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx

    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRole
    metadata:
    name: nginx-ingress-clusterrole
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    rules:
    - apiGroups:
    - ""
    resources:
    - configmaps
    - endpoints
    - nodes
    - pods
    - secrets
    verbs:
    - list
    - watch
    - apiGroups:
    - ""
    resources:
    - nodes
    verbs:
    - get
    - apiGroups:
    - ""
    resources:
    - services
    verbs:
    - get
    - list
    - watch
    - apiGroups:
    - "extensions"
    resources:
    - ingresses
    verbs:
    - get
    - list
    - watch
    - apiGroups:
    - ""
    resources:
    - events
    verbs:
    - create
    - patch
    - apiGroups:
    - "extensions"
    resources:
    - ingresses/status
    verbs:
    - update

    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: Role
    metadata:
    name: nginx-ingress-role
    namespace: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    rules:
    - apiGroups:
    - ""
    resources:
    - configmaps
    - pods
    - secrets
    - namespaces
    verbs:
    - get
    - apiGroups:
    - ""
    resources:
    - configmaps
    resourceNames:
    # Defaults to "<election-id>-<ingress-class>"
    # Here: "<ingress-controller-leader>-<nginx>"
    # This has to be adapted if you change either parameter
    # when launching the nginx-ingress-controller.
    - "ingress-controller-leader-nginx"
    verbs:
    - get
    - update
    - apiGroups:
    - ""
    resources:
    - configmaps
    verbs:
    - create
    - apiGroups:
    - ""
    resources:
    - endpoints
    verbs:
    - get

    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: RoleBinding
    metadata:
    name: nginx-ingress-role-nisa-binding
    namespace: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: Role
    name: nginx-ingress-role
    subjects:
    - kind: ServiceAccount
    name: nginx-ingress-serviceaccount
    namespace: ingress-nginx

    ---
    apiVersion: rbac.authorization.k8s.io/v1beta1
    kind: ClusterRoleBinding
    metadata:
    name: nginx-ingress-clusterrole-nisa-binding
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: nginx-ingress-clusterrole
    subjects:
    - kind: ServiceAccount
    name: nginx-ingress-serviceaccount
    namespace: ingress-nginx

    ---

    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: nginx-ingress-controller
    namespace: ingress-nginx
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    spec:
    replicas: 1
    selector:
    matchLabels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    template:
    metadata:
    labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    annotations:
    prometheus.io/port: "10254"
    prometheus.io/scrape: "true"
    spec:
    serviceAccountName: nginx-ingress-serviceaccount
    containers:
    - name: nginx-ingress-controller
    image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.24.1
    args:
    - /nginx-ingress-controller
    - --configmap=$(POD_NAMESPACE)/nginx-configuration
    - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
    - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
    - --publish-service=$(POD_NAMESPACE)/ingress-nginx
    - --annotations-prefix=nginx.ingress.kubernetes.io
    securityContext:
    allowPrivilegeEscalation: true
    capabilities:
    drop:
    - ALL
    add:
    - NET_BIND_SERVICE
    # www-data -> 33
    runAsUser: 33
    env:
    - name: POD_NAME
    valueFrom:
    fieldRef:
    fieldPath: metadata.name
    - name: POD_NAMESPACE
    valueFrom:
    fieldRef:
    fieldPath: metadata.namespace
    ports:
    - name: http
    containerPort: 80
    - name: https
    containerPort: 443
    - name: dns-tcp
    containerPort: 53
    hostPort: 53
    protocol: TCP
    - name: dns-udp
    containerPort: 53
    hostPort: 53
    protocol: UDP
    livenessProbe:
    failureThreshold: 3
    httpGet:
    path: /healthz
    port: 10254
    scheme: HTTP
    initialDelaySeconds: 10
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 10
    readinessProbe:
    failureThreshold: 3
    httpGet:
    path: /healthz
    port: 10254
    scheme: HTTP
    periodSeconds: 10
    successThreshold: 1
    timeoutSeconds: 10

    ---
  19. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 2 additions and 7 deletions.
    9 changes: 2 additions & 7 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -120,19 +120,14 @@ spec:
    value: true
    - name: ILP_BTP_SERVER
    value: btp+ws://moneyd.moneyd:7768
    - name: CODIUS_K8S_NAMESPACE
    value: codius-untrusted
    ports:
    - containerPort: 3000
    - containerPort: 3001
    volumeMounts:
    - name: data-volume
    mountPath: /var/lib/codius
    - name: moneyd-local
    image: wilsonianbcoil/moneyd-local
    env:
    - name: DEBUG
    value: "*"
    ports:
    - containerPort: 7768
    serviceAccountName: codiusd
    volumes:
    - name: data-volume
  20. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 5 additions and 4 deletions.
    9 changes: 5 additions & 4 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -12,8 +12,8 @@ metadata:
    kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
    namespace: codiusd
    name: codius-pod-manager
    namespace: codius-untrusted
    name: codiusd
    rules:
    - apiGroups: [""]
    resources: ["pods"]
    @@ -22,15 +22,16 @@ rules:
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
    name: codius-role-binding
    name: codiusd
    namespace: codiusd
    subjects:
    - kind: ServiceAccount
    name: codiusd
    namespace: codiusd
    roleRef:
    kind: Role
    name: codius-pod-manager
    name: codiusd
    namespace: codius-untrusted
    apiGroup: rbac.authorization.k8s.io
    ---
    apiVersion: v1
  21. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 5 additions and 2 deletions.
    7 changes: 5 additions & 2 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -65,10 +65,13 @@ metadata:
    namespace: codiusd
    annotations:
    kubernetes.io/ingress.class: "traefik"
    ingress.kubernetes.io/ssl-redirect: "true"
    # ingress.kubernetes.io/ssl-redirect: "true"
    ingress.kubernetes.io/hsts-max-age: "63072000"
    ingress.kubernetes.io/hsts-include-subdomains: "true"
    ingress.kubernetes.io/hsts-preload: "true"
    ingress.kubernetes.io/frame-deny: "true"
    ingress.kubernetes.io/content-type-nosniff: "true"
    ingress.kubernetes.io/custom-browser-xss-value: "1; mode=block"
    ingress.kubernetes.io/browser-xss-filter: "true"
    spec:
    tls:
    - hosts:
  22. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -68,6 +68,7 @@ metadata:
    ingress.kubernetes.io/ssl-redirect: "true"
    ingress.kubernetes.io/frame-deny: "true"
    ingress.kubernetes.io/content-type-nosniff: "true"
    ingress.kubernetes.io/custom-browser-xss-value: "1; mode=block"
    spec:
    tls:
    - hosts:
  23. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 3 additions and 0 deletions.
    3 changes: 3 additions & 0 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -65,6 +65,9 @@ metadata:
    namespace: codiusd
    annotations:
    kubernetes.io/ingress.class: "traefik"
    ingress.kubernetes.io/ssl-redirect: "true"
    ingress.kubernetes.io/frame-deny: "true"
    ingress.kubernetes.io/content-type-nosniff: "true"
    spec:
    tls:
    - hosts:
  24. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion moneyd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -9,7 +9,6 @@ metadata:
    name: moneyd
    namespace: moneyd
    spec:
    type: LoadBalancer
    selector:
    app: moneyd
    ports:
  25. wilsonianb revised this gist Jun 5, 2019. 4 changed files with 46 additions and 35 deletions.
    1 change: 1 addition & 0 deletions acme-dns-ingress.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -2,6 +2,7 @@ apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
    name: acme-dns
    namespace: acme-dns
    annotations:
    kubernetes.io/ingress.class: "traefik"
    spec:
    11 changes: 0 additions & 11 deletions acme-dns-pvc.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,11 +0,0 @@
    apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
    name: acme-dns-pvc
    spec:
    accessModes:
    - ReadWriteOnce
    storageClassName: local-path
    resources:
    requests:
    storage: 50Mi
    24 changes: 0 additions & 24 deletions acme-dns-service.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,24 +0,0 @@
    apiVersion: v1
    kind: Service
    metadata:
    name: acme-dns
    spec:
    selector:
    app: acme-dns
    ports:
    - name: https
    protocol: TCP
    port: 443
    targetPort: 443
    - name: http
    protocol: TCP
    port: 80
    targetPort: 80
    - name: dns-tcp
    protocol: TCP
    port: 53
    targetPort: 53
    - name: dns-udp
    protocol: UDP
    port: 53
    targetPort: 53
    45 changes: 45 additions & 0 deletions acme-dns-deployment.yaml → acme-dns.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,7 +1,52 @@
    apiVersion: v1
    kind: Namespace
    metadata:
    name: acme-dns
    ---
    apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
    name: acme-dns-pvc
    namespace: acme-dns
    spec:
    accessModes:
    - ReadWriteOnce
    storageClassName: local-path
    resources:
    requests:
    storage: 50Mi
    ---
    apiVersion: v1
    kind: Service
    metadata:
    name: acme-dns
    namespace: acme-dns
    spec:
    selector:
    app: acme-dns
    ports:
    - name: https
    protocol: TCP
    port: 443
    targetPort: 443
    - name: http
    protocol: TCP
    port: 80
    targetPort: 80
    - name: dns-tcp
    protocol: TCP
    port: 53
    targetPort: 53
    - name: dns-udp
    protocol: UDP
    port: 53
    targetPort: 53
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: acme-dns
    namespace: acme-dns
    labels:
    app: acme-dns
    spec:
  26. wilsonianb revised this gist Jun 5, 2019. 2 changed files with 14 additions and 7 deletions.
    2 changes: 1 addition & 1 deletion codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -111,7 +111,7 @@ spec:
    - name: CODIUS_ADMIN_API
    value: true
    - name: ILP_BTP_SERVER
    value: btp+ws://moneyd-xrp.moneyd:7768
    value: btp+ws://moneyd.moneyd:7768
    ports:
    - containerPort: 3000
    - containerPort: 3001
    19 changes: 13 additions & 6 deletions moneyd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,30 +1,37 @@
    apiVersion: v1
    kind: Namespace
    metadata:
    name: moneyd
    ---
    apiVersion: v1
    kind: Service
    metadata:
    name: moneyd-xrp
    name: moneyd
    namespace: moneyd
    spec:
    type: LoadBalancer
    selector:
    app: moneyd-xrp
    app: moneyd
    ports:
    - protocol: TCP
    port: 7768
    ---
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: moneyd-xrp
    name: moneyd
    namespace: moneyd
    labels:
    app: moneyd-xrp
    app: moneyd
    spec:
    replicas: 1
    selector:
    matchLabels:
    app: moneyd-xrp
    app: moneyd
    template:
    metadata:
    labels:
    app: moneyd-xrp
    app: moneyd
    spec:
    volumes:
    - name: moneyd-config
  27. wilsonianb revised this gist Jun 5, 2019. 6 changed files with 0 additions and 101 deletions.
    43 changes: 0 additions & 43 deletions codiusd-deployment.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,43 +0,0 @@
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: codiusd
    labels:
    app: codiusd
    spec:
    replicas: 1
    selector:
    matchLabels:
    app: codiusd
    template:
    metadata:
    labels:
    app: codiusd
    spec:
    containers:
    - name: codiusd
    image: wilsonianbcoil/codiusd
    env:
    - name: CODIUS_PUBLIC_URI
    value: https://codius.example.com
    - name: DEBUG
    value: "*codiusd*"
    - name: CODIUS_BIND_IP
    value: "0.0.0.0"
    ports:
    - containerPort: 3000
    volumeMounts:
    - name: data-volume
    mountPath: /var/lib/codius
    - name: moneyd-local
    image: wilsonianbcoil/moneyd-local
    env:
    - name: DEBUG
    value: "*"
    ports:
    - containerPort: 7768
    serviceAccountName: codiusd
    volumes:
    - name: data-volume
    persistentVolumeClaim:
    claimName: codiusd-pvc
    21 changes: 0 additions & 21 deletions codiusd-ingress.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,21 +0,0 @@
    apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
    name: codiusd
    annotations:
    kubernetes.io/ingress.class: "traefik"
    spec:
    tls:
    - hosts:
    - codius.example.com
    - "*.codius.example.com"
    secretName: codius-certificate-secret
    rules:
    - host: "codius.example.com"
    http: &http_rules
    paths:
    - backend:
    serviceName: codiusd-service
    servicePort: 3000
    - host: "*.codius.example.com"
    http: *http_rules
    11 changes: 0 additions & 11 deletions codiusd-pvc.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,11 +0,0 @@
    apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
    name: codiusd-pvc
    spec:
    accessModes:
    - ReadWriteOnce
    storageClassName: local-path
    resources:
    requests:
    storage: 100Mi
    13 changes: 0 additions & 13 deletions codiusd-role-binding.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,13 +0,0 @@
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
    name: codius-role-binding
    namespace: default
    subjects:
    - kind: ServiceAccount
    name: codiusd
    namespace: default
    roleRef:
    kind: Role
    name: codius-pod-manager
    apiGroup: rbac.authorization.k8s.io
    9 changes: 0 additions & 9 deletions codiusd-role.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,9 +0,0 @@
    kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
    namespace: default
    name: codius-pod-manager
    rules:
    - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
    4 changes: 0 additions & 4 deletions codiusd-service-account.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +0,0 @@
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: codiusd
  28. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -49,6 +49,7 @@ apiVersion: v1
    kind: Service
    metadata:
    name: codiusd-service
    namespace: codiusd
    spec:
    type: LoadBalancer
    selector:
  29. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -61,6 +61,7 @@ apiVersion: extensions/v1beta1
    kind: Ingress
    metadata:
    name: codiusd
    namespace: codiusd
    annotations:
    kubernetes.io/ingress.class: "traefik"
    spec:
  30. wilsonianb revised this gist Jun 5, 2019. 1 changed file with 12 additions and 3 deletions.
    15 changes: 12 additions & 3 deletions codiusd.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -1,12 +1,18 @@
    apiVersion: v1
    kind: Namespace
    metadata:
    name: codiusd
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
    name: codiusd
    namespace: codiusd
    ---
    kind: Role
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
    namespace: default
    namespace: codiusd
    name: codius-pod-manager
    rules:
    - apiGroups: [""]
    @@ -17,11 +23,11 @@ apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
    name: codius-role-binding
    namespace: default
    namespace: codiusd
    subjects:
    - kind: ServiceAccount
    name: codiusd
    namespace: default
    namespace: codiusd
    roleRef:
    kind: Role
    name: codius-pod-manager
    @@ -77,6 +83,7 @@ apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: codiusd
    namespace: codiusd
    labels:
    app: codiusd
    spec:
    @@ -101,6 +108,8 @@ spec:
    value: "0.0.0.0"
    - name: CODIUS_ADMIN_API
    value: true
    - name: ILP_BTP_SERVER
    value: btp+ws://moneyd-xrp.moneyd:7768
    ports:
    - containerPort: 3000
    - containerPort: 3001