web-server-test.yml

### File            : web-server-test.yml
### Description     : Test pod for testing installed kubernetes
### Author          : Michael Yasko
### Version history :

apiVersion: v1
kind: Namespace
metadata:
  name: n0wm-ws-test
  labels:
    pod-security.kubernetes.io/enforce: restricted
    istio-injection: enabled

#---
#apiVersion: v1
#kind: ResourceQuota
#metadata:
#  name: n0wm-test-resource-quota
#  namespace: n0wm-ws-test  # Укажите целевой namespace
#spec:
#  hard:
#    requests.cpu: "1"        # Максимум 1 CPU запрошено подами
#    requests.memory: "30Mi"   # Максимум 1 GiB памяти запрошено подами
#    limits.cpu: "1"          # Максимум 2 CPU может быть использовано
#    limits.memory: "120Mi"     # Максимум 2 GiB памяти может быть использовано
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: n0wm-ws-test
  namespace: n0wm-ws-test
  labels:
    env: test
    app: n0wm-ws-test
    tier: frontend
    owner: YaskoMichael_YaskoVarvara
    project: n0wm-test-prj
spec:
  selector:
    matchLabels:
      project: n0wm-test-prj
  template:
    metadata:
      labels:
        env: test
        app: n0wm-ws-test
        owner: YaskoMichael_YaskoVarvara
        project: n0wm-test-prj
        monitoring: "true"
    spec:
      containers:
      - name: n0wm-test-prj-web
        image: n0where3an/testdocker:1.7
        securityContext:
          runAsUser: 1009
          runAsGroup: 1009
          runAsNonRoot: true
          allowPrivilegeEscalation: false
          capabilities:
            drop:
              - ALL
          seccompProfile:
            type: RuntimeDefault
        resources:
          limits:
            memory: 128Mi
          requests:
            memory: 64Mi
            cpu: 10m
        env:
        - name: SERVER_PORT
          value: "8000"
        - name: WEB_MYSQL_HOST
          value: ""
        - name: WEB_MYSQL_PORT
          value: "3306"
        - name: WEB_MYSQL_USERNAME
          value: ""
        - name: WEB_MYSQL_PASSWORD
          value: ""
        - name: WEB_MYSQL_DBNAME
          value: ""
        - name: WEB_REDIS_HOST
          value: ""
        - name: WEB_REDIS_PORT
          value: "6379"
        - name: WEB_REDIS_DB
          value: "-1"
        #Jaeger Tracing Configuration
        - name: JAEGER_SERVICE_NAME
          value: n0wm-ws-test
        - name: JAEGER_AGENT_HOST
          value: jaeger-agent.istio-system.svc.cluster.local
        - name: JAEGER_REPORTER_LOG_SPANS
          value: "true"
        - name: JAEGER_SAMPLER_TYPE
          value: "const"
        - name: JAEGER_SAMPLER_PARAM
          value: "1"
        ports:
        - containerPort: 8000
        - containerPort: 9100
          name: metrics
        livenessProbe:
          httpGet:
            path: /healthcheck
            port: 8000
          initialDelaySeconds: 120
          periodSeconds: 20
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
        readinessProbe:
          httpGet:
            path: /readycheck
            port: 8000
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 2
          failureThreshold: 5
        startupProbe:
          httpGet:
            path: /startupcheck
            port: 8000
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5

---
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: n0wm-ws-test
  namespace: n0wm-ws-test
  labels:
    env: test
    owner: YaskoMichael_YaskoVarvara
    project: n0wm-test-prj
spec:
  scaleTargetRef:
    apiVersion: apps/v2
    kind: Deployment
    name: n0wm-ws-test
  minReplicas: 1
  maxReplicas: 3
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 65
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 70

---
apiVersion: v1
kind: Service
metadata:
  name: n0wm-ws-test
  namespace: n0wm-ws-test
  labels:
    env: test
    app: n0wm-ws-test
    owner: YaskoMichael_YaskoVarvara
    project: n0wm-test-prj
spec:
  type: ClusterIP
  selector:
    project: n0wm-test-prj
    env: test
    owner: YaskoMichael_YaskoVarvara
  ports:
    - name: app-listener
      protocol: TCP
      port: 8000
      targetPort: 8000
---
apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
  name: tls-local-net
  namespace: n0wm-ws-test
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVEekNDQXZlZ0F3SUJBZ0lVSWdlTWxoMmZZczZhL2dPY2pHQ2JuMm91bTFjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2daWXhDekFKQmdOVkJBWVRBa1JGTVE4d0RRWURWUVFJREFaSVpYTnpaVzR4RHpBTkJnTlZCQWNNQmt0aApjM05sYkRFT01Bd0dBMVVFQ2d3RmJHOWpZV3d4R1RBWEJnTlZCQXNNRUUxbExDQkpJR0Z1WkNCTmVYTmxiR1l4CkZEQVNCZ05WQkFNTUN5b3ViRzlqWVd3dWJtVjBNU1F3SWdZSktvWklodmNOQVFrQkZoVmhjMnR2ZG1GeWRtRnkKWVVCbmJXRnBiQzVqYjIwd0hoY05NalV3TWpFME1qQTBNelE0V2hjTk16VXdNakV5TWpBME16UTRXakNCbGpFTApNQWtHQTFVRUJoTUNSRVV4RHpBTkJnTlZCQWdNQmtobGMzTmxiakVQTUEwR0ExVUVCd3dHUzJGemMyVnNNUTR3CkRBWURWUVFLREFWc2IyTmhiREVaTUJjR0ExVUVDd3dRVFdVc0lFa2dZVzVrSUUxNWMyVnNaakVVTUJJR0ExVUUKQXd3TEtpNXNiMk5oYkM1dVpYUXhKREFpQmdrcWhraUc5dzBCQ1FFV0ZXRnphMjkyWVhKMllYSmhRR2R0WVdscwpMbU52YlRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTmlVZ3NrV3RRdmVQRUg2ClJmVGpIaklYaG0ydjRQTWpkSjBFQ3NTeWZ4UWpPVDB4Q05IZE9XQ0pZc0xMaURLWFpIZDU1Q1NHWnhNdDIyRjMKMEJmdjBIejhhZHpnMnBUWGl4Nk5SU2pQeGV5Z0htMFc2ZHdaYktqUUtkZ1hFWmVad05oRkp0N3NzbXFEaFUwcApyREJwK0FsTnNRVElaWjN3NXpvT1hIUFpiT1VybzZjSlZWck1IdnN3TnhEWFhmbWtKUCszL2pDNUc3S0U2eEJYCjVMTDR0U2FIZWV2MVJUcVpMdVU0RUNZTFJxS0phcXZtTDNWTEJtTjZvUUFsRFB1SHV2OWh5eXVXQ0h0SEVhQ1YKR1hXWU16Tnh4OVJOSGdSZ0l5WEdtVUErRWg2TXRkU3lPM0N3d3FVakdSTklRMmsrQXVlRVBWRUZZTUNiTlhIcwpGdWhGcVo4Q0F3RUFBYU5UTUZFd0hRWURWUjBPQkJZRUZCTkQ4VEpBSWV4L1IxeWh4M1ZpNEwxZ1FzdnBNQjhHCkExVWRJd1FZTUJhQUZCTkQ4VEpBSWV4L1IxeWh4M1ZpNEwxZ1FzdnBNQThHQTFVZEV3RUIvd1FGTUFNQkFmOHcKRFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUlOQXpsc0I1SWRVYWl0WU9ZL0JOTitRQ2FNWE5KQ2JjU0h1MXlTVwpVLzdBei9BazFIOHlkZHAxWWxBVkpwQjhMV01TWTdmY21Id1ZTQURieGtwWWcvUzNVRVNHczdBYjNDU1lBNnYyCkY3dVU4NXk2UUZhUFNqNWdBME5CT3hnWTZITEN0ejlUaEJCNVQ4aUhkOE5vTHhya0ZRZEdCOGhkQjZYWUIraWYKN3dQV1lySzhJSWFwMWhrUGhyQzJWM1ZBaFJ1N0w5Zk90dGhudy9BUlh6cmRJd01MT1lnQVJnTXl4N0gvMEJvbQp6a1dCK3NxZEZ4THVlY212NVIrMUtERlZodDNmT2d4QUtjS1h5VzFSM3RSSmF0Q2FoUVFNOFRpVnZkS0JCNEpMCkxYajkwVWZTYmlsWDRUWGMrT0V0Y1VKSVNVQU9kbmcwajVhYnZiVWZqdmU1MjM0PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCgo=
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRRFlsSUxKRnJVTDNqeEIKK2tYMDR4NHlGNFp0citEekkzU2RCQXJFc244VUl6azlNUWpSM1RsZ2lXTEN5NGd5bDJSM2VlUWtobWNUTGR0aApkOUFYNzlCOC9HbmM0TnFVMTRzZWpVVW96OFhzb0I1dEZ1bmNHV3lvMENuWUZ4R1htY0RZUlNiZTdMSnFnNFZOCkthd3dhZmdKVGJFRXlHV2Q4T2M2RGx4ejJXemxLNk9uQ1ZWYXpCNzdNRGNRMTEzNXBDVC90LzR3dVJ1eWhPc1EKVitTeStMVW1oM25yOVVVNm1TN2xPQkFtQzBhaWlXcXI1aTkxU3daamVxRUFKUXo3aDdyL1ljc3JsZ2g3UnhHZwpsUmwxbURNemNjZlVUUjRFWUNNbHhwbEFQaEllakxYVXNqdHdzTUtsSXhrVFNFTnBQZ0xuaEQxUkJXREFtelZ4CjdCYm9SYW1mQWdNQkFBRUNnZ0VBUjM1dTFmYTYrUm41aGtZWnhjY2JkcW14WkpBRWovNktSakxKWXprUkhoS3EKbUhxUlVNWFlaUGUxTkZ4L3IwT3VsSW9XTjhCdVVqUjNFT3UrTThpa2FEM2lyRmxGanBEQWlldFVneTVqUmNOdApoOUZpalplTytRTU9iUmpnWTgwTGpkajJCZXpZMExSdDBwVUpGRXBHNkx0T3ppZGc5QXhNS0N3SmRPeTNOOGJlCms2Y0NiNUF3MWt1blNDSkZEQzU1OTNmUUxBQ2s3cHphVU8rVnNyeXhDQVk3MWhiSGt5S2NEamxna3FQNFc1K2kKQlZZWEJmQnhQVnJIQlRxaUhiU29JU3VMa0lVOVhQR3BLR1JjNThpN1F3U3FvNlJ0Z09idzU0VkdzcGE2MWozNApJZTdPVUZQUzlZNUVvK0FyQ1NDallmUmFLWHZ0UDBEOEsreXo2R3hkc1FLQmdRRHhTU3haNmtOK3YreG5sTkNXCnlrYnBTVXRpQVRtK2JtaUVpUjJOK2ZrRTVGSElUZFVQSE9tckVMQVBXWnVJYVBqTURQTE5RQ2VjMnBMdGdpdVMKMWEyRHFCQkEwTkQxQ1FCUjlYelZWU214VEVuTnlXWDdYci9xT2djUWNYUksxTXdnbUJtU0taajhJOFlqMkd0NQpEYk9rbTFBOUxGU1BRcElnTHFyOU1mWkovUUtCZ1FEbHlhVW02SGZGU1pQSTBDUnhHdFBNNkN4NmNIbld4MFhnCmRkV1BPL3pzR2tUNzV5RXBlcVV1cXg4bXZGWStFMm9xZEZtTUpPalM1blZYSlVES3VtWEhlTWxtL3dGbk15VlUKbWNiUWc2dGRlN1laQ3IrTkxYZE9LdnVZNXcyVzh4K2ZmRVdLcis4QnJjVkE3K3pITitFSFl5KzNMbnpRZ2c1WQpBOWR1aFBaV3l3S0JnRjRSRnZkZSt6MVkrWU5RWXhuR2RtclFwbERwQldnV2h5elVmKzh2KzBOSytBOU5PTGtSCm5vK1FpL01RRGpEYUs5VHhYMTlobVkvdkxzVGxzTE1vRnVOekRCTVkxYjRSNmt3SmxzZGMwa3BLNGFNVzEybHUKZ1FlQjQrc25NQjFVWk5oNE04L2w0N3k0L2JCUDJXWnlUd3puZUJyQlE1NHVaK1dnREExMkF2ekpBb0dCQUxybgpLdmZjdWg2MFhBcElrbnVVOEpXSWV6VVQ2Mll4SzdzSTNTM21BekVmcE9Dbi9LYzZaTVR5MXlHd3F3MU95Vm5DCnpWdGFZaTI0MmRTS0xvczIxYlpMbnJXeDBUaFp0NUY2aXVYclV5VjBqSWNONFFRNTZRS2huNGVjMThiaDllVEoKTmQ4NmZ0TUV2cDYxQ0FoNmdRUjdQc0ptZzRzdFhmRmxIb044anNuRkFvR0FGb3N0NytRcGozNWxDMDg3NzJtOQo4MndFVytxMlQ5cHh0NjJUWTVrcDVSSWhRN1lTQnh4Tnd3aUVVVHlBR3U1ekdtM0NuWjV5bmtjakJEVjBHekt1Cm5pKzBwZ09VWXgwOUIvY3BEUktGRmpWaWdmeG1xWWc2ZDhYQXVDaTNvd1RQZHRTWU9IYTZRRzZrQWFWTXVMc0oKZ0ZwdGNITFJqZ3BWVmp6cWR4RE1BU0U9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K

---
#Warning!!! It configured for nginx ingress controller
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: n0wm-ws-test
  namespace: n0wm-ws-test
  annotations:
    kubernetes.io/ingress.class: nginx
    ingress.kubernetes.io/rewrite-target: "/"
    certmanager.k8s.io/cluster-issuer: monitoring-issuer
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - n0wm-ws-test-00.local.net
      secretName: tls-local-net
  rules:
    - host: "n0wm-ws-test-00.local.net"
      http:
        paths:
          - pathType: Prefix
            path: /
            backend:
              service:
                name: n0wm-ws-test
                port:
                  number: 8000
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: n0wm-ws-test-deny-all
  namespace: n0wm-ws-test
spec:
  podSelector: {}  # ally to all pods in namespace
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: n0wm-ws-test-allow-ingress-nginx-to-service
  namespace: n0wm-ws-test
spec:
  policyTypes:
  - Ingress
  podSelector:
    matchLabels:
      project:  n0wm-test-prj
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app.kubernetes.io/instance: nginx-ingress-common
      namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - port: 8000
      protocol: TCP
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: n0wm-ws-test
  namespace: n0wm-ws-test
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: default
  resources:
    requests:
      storage: 10Mi
#EOF