Skip to content

Commit 6284eb2

Browse files
soerenschneidersoerenschneider
committed
add taskchampion
1 parent 6c85e00 commit 6284eb2

File tree

10 files changed

+268
-0
lines changed

10 files changed

+268
-0
lines changed

‎apps/taskchampion/components/istio/istio-virtualservice.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
apiVersion: "networking.istio.io/v1alpha3"
3+
kind: "VirtualService"
4+
metadata:
5+
name: "taskchampion"
6+
spec:
7+
hosts:
8+
- "taskchampion"
9+
gateways:
10+
- "istio-system/gateway"
11+
http:
12+
- match:
13+
- uri:
14+
prefix: "/"
15+
route:
16+
- destination:
17+
host: "taskchampion"
18+
port:
19+
number: 80

‎apps/taskchampion/components/istio/kustomization.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1alpha1
3+
kind: Component
4+
resources:
5+
- istio-virtualservice.yaml
6+
patches:
7+
- target:
8+
kind: "NetworkPolicy"
9+
name: "taskchampion"
10+
patch: |-
11+
- op: "add"
12+
path: "/spec/ingress/0/from/-"
13+
value:
14+
namespaceSelector:
15+
matchLabels:
16+
kubernetes.io/metadata.name: "istio-system"
17+
podSelector:
18+
matchLabels:
19+
istio: "ingressgateway"

‎apps/taskchampion/components/pvc/kustomization.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1alpha1
3+
kind: Component
4+
resources:
5+
- taskchampion-pvc.yaml
6+
patches:
7+
- target:
8+
kind: Deployment
9+
name: taskchampion
10+
patch: |-
11+
- op: add
12+
path: /spec/template/spec/priorityClassName
13+
value: prod-default-prio
14+
- op: replace
15+
path: /spec/template/spec/volumes/0
16+
value:
17+
name: storage
18+
persistentVolumeClaim:
19+
claimName: taskchampion

‎apps/taskchampion/components/pvc/taskchampion-pvc.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
kind: PersistentVolumeClaim
3+
apiVersion: v1
4+
metadata:
5+
name: taskchampion
6+
spec:
7+
accessModes:
8+
- ReadWriteOnce
9+
resources:
10+
requests:
11+
storage: 1Gi

‎apps/taskchampion/components/restic-pvc/kustomization.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
apiVersion: kustomize.config.k8s.io/v1alpha1
3+
kind: Component
4+
resources:
5+
- ../../../../infra/restic-pvc
6+
configMapGenerator:
7+
- name: "taskd-restic-pvc"
8+
behavior: merge # TODO: https://github.com/kubernetes-sigs/kustomize/issues/4402
9+
literals:
10+
- "RETENTION_DAYS=7"
11+
- "RETENTION_WEEKS=4"
12+
- "RETENTION_MONTHS=6"
13+
- "RESTIC_TARGETS=/var/taskd"
14+
- "RESTIC_BACKUP_ID=taskd"
15+
patches:
16+
- target:
17+
kind: "CronJob"
18+
name: "restic-pvc-backup"
19+
patch: |-
20+
- op: "replace"
21+
path: "/spec/schedule"
22+
value: "5 6 * * *"
23+
- op: "replace"
24+
path: "/spec/jobTemplate/spec/template/metadata/labels/restic~1name"
25+
value: "taskd"
26+
- op: "replace"
27+
path: "/spec/jobTemplate/spec/template/spec/securityContext/runAsUser"
28+
value: 53589
29+
- op: "replace"
30+
path: "/spec/jobTemplate/spec/template/spec/securityContext/runAsGroup"
31+
value: 53589
32+
- op: "replace"
33+
path: "/spec/jobTemplate/spec/template/spec/securityContext/fsGroup"
34+
value: 53589
35+
- op: "replace"
36+
path: "/spec/jobTemplate/spec/template/spec/containers/0/securityContext/runAsUser"
37+
value: 53589
38+
- op: "replace"
39+
path: "/spec/jobTemplate/spec/template/spec/containers/0/securityContext/runAsGroup"
40+
value: 53589
41+
- op: "replace"
42+
path: "/spec/jobTemplate/spec/template/spec/containers/0/envFrom"
43+
value:
44+
- configMapRef:
45+
name: "taskd-restic-pvc"
46+
- secretRef:
47+
name: "taskd-restic-pvc"
48+
- op: "replace"
49+
path: "/spec/jobTemplate/spec/template/spec/volumes/0/persistentVolumeClaim/claimName"
50+
value: "taskd"
51+
- op: "replace"
52+
path: "/spec/jobTemplate/spec/template/spec/containers/0/volumeMounts/0/mountPath"
53+
value: "/var/taskd"
54+
- target:
55+
kind: "CronJob"
56+
name: "restic-pvc-prune"
57+
patch: |-
58+
- op: "replace"
59+
path: "/spec/jobTemplate/spec/template/metadata/labels/restic~1name"
60+
value: "taskd"
61+
- op: "replace"
62+
path: "/spec/jobTemplate/spec/template/spec/containers/0/envFrom"
63+
value:
64+
- configMapRef:
65+
name: "taskd-restic-pvc"
66+
- secretRef:
67+
name: "taskd-restic-pvc"

‎apps/taskchampion/components/restic-pvc/upsert-secret-taskd-restic-pvc.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/usr/bin/env bash
2+
3+
###########################################################
4+
# Copy this header
5+
###########################################################
6+
7+
set -o pipefail
8+
set -eu
9+
10+
source "$(git rev-parse --show-toplevel)/contrib/variables.sh"
11+
###########################################################
12+
13+
BACKUP_ID="${K8S_APP_SUB}"
14+
S3_DIR="restic-${BACKUP_ID}"
15+
TF_VALUE=$(terraform -chdir=../../../../tf-aws-s3-backups output -json ids | jq -r '.["'"${S3_DIR}"'"]')
16+
AWS_ACCESS_KEY_ID=$(echo "$TF_VALUE" | jq -r '.id')
17+
AWS_SECRET_ACCESS_KEY=$(echo "$TF_VALUE" | jq -r '.secret')
18+
RESTIC_REPOSITORY="s3:s3.amazonaws.com/soerenschneider-backups/${S3_DIR}"
19+
RESTIC_PASSWORD="$(pass backups/restic/prod/${BACKUP_ID})"
20+
21+
kubectl create secret generic "${K8S_SECRET_NAME}" \
22+
--from-literal=AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID}" \
23+
--from-literal=AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY}" \
24+
--from-literal=RESTIC_REPOSITORY="${RESTIC_REPOSITORY}" \
25+
--from-literal=RESTIC_PASSWORD="${RESTIC_PASSWORD}" \
26+
--from-literal=RESTIC_BACKUP_ID="${BACKUP_ID}" \
27+
--dry-run=client -o yaml |
28+
sops -e --input-type=yaml --output-type=yaml -e \
29+
--encrypted-regex '^(data|stringData)$' \
30+
--output "${K8S_SECRET_FILE_NAME}" /dev/stdin

‎apps/taskchampion/deployment.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
apiVersion: apps/v1
3+
kind: Deployment
4+
metadata:
5+
name: taskchampion
6+
spec:
7+
replicas: 1
8+
selector:
9+
matchLabels:
10+
app: taskchampion
11+
template:
12+
metadata:
13+
labels:
14+
app: taskchampion
15+
app.kubernetes.io/name: taskchampion
16+
app.kubernetes.io/instance: taskchampion-prod
17+
app.kubernetes.io/component: taskchampion
18+
app.kubernetes.io/part-of: taskchampion
19+
spec:
20+
securityContext:
21+
runAsUser: 53589
22+
runAsGroup: 53589
23+
fsGroup: 53589
24+
runAsNonRoot: true
25+
seccompProfile:
26+
type: "RuntimeDefault"
27+
containers:
28+
- name: "taskchampion"
29+
image: "ghcr.io/gothenburgbitfactory/taskchampion-sync-server:main@sha256:4798edada4b264cdcc82f1c8ea2389cdd5cde02926f74b2361005438056f5729"
30+
imagePullPolicy: "IfNotPresent"
31+
ports:
32+
- containerPort: 8080
33+
name: "taskchampion"
34+
resources:
35+
requests:
36+
memory: "16Mi"
37+
cpu: "1m"
38+
limits:
39+
memory: "32Mi"
40+
livenessProbe:
41+
tcpSocket:
42+
port: "taskchampion"
43+
initialDelaySeconds: 15
44+
timeoutSeconds: 5
45+
failureThreshold: 5
46+
readinessProbe:
47+
tcpSocket:
48+
port: "taskchampion"
49+
initialDelaySeconds: 2
50+
securityContext:
51+
allowPrivilegeEscalation: false
52+
readOnlyRootFilesystem: true
53+
privileged: false
54+
runAsNonRoot: true
55+
runAsUser: 53589
56+
runAsGroup: 53589
57+
capabilities:
58+
drop:
59+
- "ALL"
60+
seccompProfile:
61+
type: "RuntimeDefault"
62+
volumeMounts:
63+
- name: "storage"
64+
mountPath: "/var/lib/taskchampion-sync-server"
65+
volumes:
66+
- name: "storage"
67+
emptyDir:
68+
sizeLimit: "100Mi"

‎apps/taskchampion/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
apiVersion: "kustomize.config.k8s.io/v1beta1"
3+
kind: "Kustomization"
4+
resources:
5+
- "deployment.yaml"
6+
- "service.yaml"
7+
- "networkpolicy.yaml"

‎apps/taskchampion/networkpolicy.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
apiVersion: "networking.k8s.io/v1"
3+
kind: "NetworkPolicy"
4+
metadata:
5+
name: "taskchampion"
6+
spec:
7+
podSelector: {}
8+
policyTypes:
9+
- "Egress"
10+
- "Ingress"
11+
ingress:
12+
- ports:
13+
- protocol: "TCP"
14+
port: "taskchampion"
15+
from: []
16+
egress: []

‎apps/taskchampion/service.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: "v1"
3+
kind: "Service"
4+
metadata:
5+
name: "taskchampion"
6+
spec:
7+
selector:
8+
app: "taskchampion"
9+
ports:
10+
- protocol: "TCP"
11+
port: 80
12+
targetPort: "taskchampion"

0 commit comments

Comments
 (0)