wordpress-deployment.yaml

apiVersion: v1
kind: ConfigMap
metadata:
  name: wordpress-custom-options
data:
  .htaccess: |
    # BEGIN WordPress
    # The directives (lines) between `BEGIN WordPress` and `END WordPress` are
    # dynamically generated, and should only be modified via WordPress filters.
    # Any changes to the directives between these markers will be overwritten.

    # END WordPress

    php_value upload_max_filesize 64M
    php_value post_max_size 64M
    php_value memory_limit 128M
    php_value max_execution_time 300
    php_value max_input_time 300
  uploads.ini: |
    file_uploads = On
    memory_limit 128M
    upload_max_filesize 64M
    post_max_size 64M
    max_execution_time 300
    max_input_time 300
  WORDPRESS_CONFIG_EXTRA: |
    define('WP_MEMORY_LIMIT', '64M');
    define('WP_STATELESS_MEDIA_KEY_FILE_PATH', '/var/www/html/wp-content/sa/key.json');
    define('WP_STATELESS_MEDIA_CACHE_CONTROL', 'public, max-age=36000, must-revalidate');
    define('WP_STATELESS_MEDIA_CACHE_BUSTING', 'true');
    @ini_set( 'upload_max_size', '64M' );
    @ini_set( 'post_max_size', '64M');
    @ini_set( 'max_execution_time', '300' );
---
apiVersion: v1
kind: Service
metadata:
  name: wordpress
  labels:
    app: wordpress
spec:
  ports:
    - port: 80
      targetPort: 80
      name: wp-svc
  selector:
    app: wordpress
    tier: frontend
  type: LoadBalancer
  # only specify on RPI setup
  #loadBalancerIP: redacted

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: wordpress
  labels:
    app: wordpress
    role: wp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: wordpress
      tier: frontend
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  template:
    metadata:
      labels:
        app: wordpress
        tier: frontend
    # Should only be enabled in case stateless-sa-sec.yaml is used
    spec:
      securityContext:
        fsGroup: 33 
      containers:
      - image: wordpress:6.5.4-php8.1-apache
        name: wordpress
        env:
        - name: WORDPRESS_DB_HOST
          valueFrom:
            secretKeyRef:
              name: wp-db-host
              key: host
        - name: WORDPRESS_DB_NAME
          valueFrom:
            secretKeyRef:
              name: wp-db-name
              key: password
        - name: WORDPRESS_DB_USER
          valueFrom:
            secretKeyRef:
              name: wp-db-user
              key: password
        - name: WORDPRESS_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-db-pass
              key: password
        envFrom:
        - configMapRef:
            name: wordpress-custom-options
        ports:
        - containerPort: 80
          name: wp-svc
        resources:
          limits:
            cpu: 1500m
            memory: "1000Mi"
          requests:
            memory: "400Mi"
            cpu: "250m"
        readinessProbe:
          tcpSocket:
            port: 80
          initialDelaySeconds: 3
          periodSeconds: 5
        livenessProbe:
          tcpSocket:
            port: 80
          initialDelaySeconds: 3
          periodSeconds: 5
        volumeMounts:
        - name: wordpress-persistent-storage
          mountPath: /var/www/html
        - name: wordpress-custom
          mountPath: /usr/local/etc/php/conf.d/uploads.ini
          subPath: uploads.ini
        - name: wordpress-custom
          mountPath: /var/www/html/.htaccess
          subPath: .htaccess
        # Should only be enabled in case stateless-sa-sec.yaml is used
        - name: sa-volume
          mountPath:  /var/www/html/wp-content/sa
          readOnly: true
      volumes:
      - name: wordpress-persistent-storage
        persistentVolumeClaim:
          claimName: nfs
      - name: wordpress-custom
        configMap:
          name: wordpress-custom-options
          items:
          - key: ".htaccess"
            path: ".htaccess"
          - key: "uploads.ini"
            path: "uploads.ini"
      # Should only be enabled in case stateless-sa-sec.yaml is used
      - name: sa-volume
        secret:
          secretName: wp-stateless-media-secret
          items:
          - key: WP_STATELESS_MEDIA_JSON_KEY
            path: key.json