modix-kubernetes.yml

#csharp namespace
apiVersion: v1
kind: Namespace
metadata:
  name: csharp

---
# modix secrets

apiVersion: v1
data:
  discord-bot-token: <base64 encoded discord bot token>
  discord-client-id: <base64 encoded discord bot oauth client id>
  discord-client-secret: <base64 encoded discord bot oauth client secret>
  log-webhook-id: <base64 encoded discord webhook id>
  log-webhook-token: <base64 encoded discord webhook token>
  modix-db-connection: U2VydmVyPW1vZGl4LWRiLXNlcnZpY2U7UG9ydD01NDMyO0RhdGFiYXNlPU1vZGl4O1VzZXIgSWQ9cG9zdGdyZXM=
  stackoverflow-token: <base64 encoded stackoverflow api token>
kind: Secret
metadata:
  annotations: {}
  name: modix
  namespace: csharp
type: Opaque

--- 
#db-persistent-volume

apiVersion: v1
kind: PersistentVolume
metadata:
  annotations: {}
  labels:
    name: modix-db-pv
  name: modix-db-pv
spec:
  accessModes:
  - ReadWriteOnce
  capacity:
    storage: 40Gi
  nfs:
    path: /nfsfileshare/modix-db-pv
    server: 172.16.100.13
  persistentVolumeReclaimPolicy: Retain

---
#db-persistent-volume-claim

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations: {}
  name: modix-db-pvc
  namespace: csharp
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 40Gi
  selector:
    matchLabels:
      name: modix-db-pv
  volumeName: modix-db-pv

--- 
#db-admin-persistent-volume

apiVersion: v1
kind: PersistentVolume
metadata:
  annotations: {}
  labels:
    name: modix-db-admin-pv
  name: modix-db-admin-pv
spec:
  accessModes:
  - ReadWriteOnce
  capacity:
    storage: 40Gi
  nfs:
    path: /nfsfileshare/modix-db-admin-pv
    server: 172.16.100.13
  persistentVolumeReclaimPolicy: Retain

--- 
#db-admin-persistent-volume-claim

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations: {}
  name: modix-db-admin-pvc
  namespace: csharp
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 40Gi
  selector:
    matchLabels:
      name: modix-db-admin-pv
  volumeName: modix-db-admin-pv
  
--- 
#db-service

apiVersion: v1
kind: Service
metadata:
  annotations: {}
  name: modix-db-service
  namespace: csharp
spec:
  ports:
  - name: modix-db
    port: 5432
    protocol: TCP
    targetPort: 5432
  selector:
    app: modix-db
  sessionAffinity: None
  type: ClusterIP

--- 
#db

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations: {}
  labels:
    app: modix-db
  name: modix-db
  namespace: csharp
spec:
  minReadySeconds: 40
  progressDeadlineSeconds: 600
  replicas: 1
  selector:
    matchLabels:
      app: modix-db
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: modix-db
    spec:
      containers:
      - env:
        - name: POSTGRESS_DB
          value: Modix
        image: postgres
        imagePullPolicy: Always
        name: modix-db
        ports:
        - containerPort: 5432
          name: postgres
          protocol: TCP
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /var/lib/postgresql/data
          name: modix-db-pv
      dnsPolicy: ClusterFirst
      nodeSelector:
        beta.kubernetes.io/os: linux
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
      - name: modix-db-pv
        persistentVolumeClaim:
          claimName: modix-db-pvc

--- 
#db admin service

apiVersion: v1
kind: Service
metadata:
  annotations: {}
  name: modix-db-admin-service
  namespace: csharp
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: modix-db-admin
  sessionAffinity: None
  type: ClusterIP

---
#db admin ingress

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
  name: modix-db-admin-ingress
  namespace: csharp
spec:
  rules:
  - host: modix-db.cisien.com
    http:
      paths:
      - backend:
          serviceName: modix-db-admin-service
          servicePort: 80
        path: /
  tls:
  - hosts:
    - modix-db.cisien.com
    secretName: modix-db-admin-tls-cert-prod

---
#db admin

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations: {}
  labels:
    app: modix-db-admin
  name: modix-db-admin
  namespace: csharp
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  selector:
    matchLabels:
      app: modix-db-admin
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: modix-db-admin
    spec:
      containers:
      - env:
        - name: PGADMIN_DEFAULT_EMAIL
          value: change@me.com
        - name: PGADMIN_DEFAULT_PASSWORD
          value: CHANGEME
        image: dpage/pgadmin4
        imagePullPolicy: Always
        name: modix-db-admin
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      nodeSelector:
        beta.kubernetes.io/os: linux
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30

---
#modix-bot-persistent-volume

apiVersion: v1
kind: PersistentVolume
metadata:
  annotations: {}
  labels:
    name: modix-bot-pv
  name: modix-bot-pv
spec:
  accessModes:
  - ReadWriteMany
  capacity:
    storage: 40Gi
  nfs:
    path: /nfsfileshare/modix-bot-pv
    server: 172.16.100.13
  persistentVolumeReclaimPolicy: Retain

--- 
#modix-bot-persistent-volume-claim

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations: {}
  name: modix-bot-pvc
  namespace: csharp
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  selector:
    matchLabels:
      name: modix-bot-pv
  volumeName: modix-bot-pv

---
#modix-frontend-service

apiVersion: v1
kind: Service
metadata:
  annotations: {}
  name: modix-frontend-service
  namespace: csharp
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: modix-bot
  sessionAffinity: None
  type: ClusterIP

---
#modix-frontend-ingress

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
  name: modix-fe-ingress
  namespace: csharp
spec:
  rules:
  - host: mod.gg
    http:
      paths:
      - backend:
          serviceName: modix-frontend-service
          servicePort: 80
        path: /
  tls:
  - hosts:
    - mod.gg
    secretName: modix-fe-tls-cert-prod

---
#modix

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations: {}
  labels:
    app: modix-bot
  name: modix-bot
  namespace: csharp
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: modix-bot
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: modix-bot
    spec:
      containers:
      - env:
        - name: MODIX_DiscordToken
          valueFrom:
            secretKeyRef:
              key: discord-bot-token
              name: modix
        - name: MODIX_DiscordClientId
          valueFrom:
            secretKeyRef:
              key: discord-client-id
              name: modix
        - name: MODIX_DiscordClientSecret
          valueFrom:
            secretKeyRef:
              key: discord-client-secret
              name: modix
        - name: MODIX_StackoverflowToken
          valueFrom:
            secretKeyRef:
              key: stackoverflow-token
              name: modix
        - name: MODIX_DbConnection
          valueFrom:
            secretKeyRef:
              key: modix-db-connection
              name: modix
        - name: MODIX_LogWebhookId
          value: "382609729802862592"
        - name: MODIX_LogWebhookToken
          valueFrom:
            secretKeyRef:
              key: log-webhook-token
              name: modix
        - name: MODIX_EnableStatsd
          value: "true"
        image: cisien/modix:latest
        imagePullPolicy: Always
        name: modix
        volumeMounts:
        - mountPath: /app/secrets
          name: secrets
          readOnly: true
        - mountPath: /app/dataprotection
          name: modix-bot
          readOnly: false
      dnsPolicy: ClusterFirst
      nodeSelector:
        beta.kubernetes.io/os: linux
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      volumes:
      - name: secrets
        secret:
          defaultMode: 420
          secretName: modix
      - name: modix-bot
        persistentVolumeClaim:
          claimName: modix-bot-pvc


--- 
#repl-service service

apiVersion: v1
kind: Service
metadata:
  annotations: {}
  name: csdiscord-repl-service
  namespace: csharp
spec:
  externalTrafficPolicy: Cluster
  ports:
  - name: http
    port: 31337
    protocol: TCP
    targetPort: 31337
  selector:
    app: csdiscord-repl
  sessionAffinity: None
  type: ClusterIP

---
#network policy to isolate repl.
#todo: migrate 10.32.0.0 ipblock to podselector for k8s-app=kube-dns

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-repl-policy
  namespace: csharp
spec:
  podSelector:
    matchLabels:
      app: csdiscord-repl
  ingress:
  - from:
    - ipBlock:
       cidr: 0.0.0.0/0
  egress:
  - to:
    - ipBlock:
        cidr: 10.96.0.10/32
    - ipBlock:
        cidr: 10.32.0.0/24
    - ipBlock:
        cidr: 0.0.0.0/0
        except:
        - 10.0.0.0/8
        - 172.16.0.0/12
        - 192.168.0.0/24

---
#repl ingress

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
  name: repl-fe-ingress
  namespace: csharp
spec:
  rules:
  - host: eval.cisien.com
    http:
      paths:
      - backend:
          serviceName: csdiscord-repl-service
          servicePort: 31337
        path: /
  tls:
  - hosts:
    - eval.cisien.com
    secretName: csdiscord-repl-tls-cert-prod

---
#repl service

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations: {}
  labels:
    app: csdiscord-repl
  name: csdiscord-repl
  namespace: csharp
spec:
  replicas: 10
  selector:
    matchLabels:
      app: csdiscord-repl
  strategy:
    rollingUpdate:
      maxSurge: 5
      maxUnavailable: 5
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: csdiscord-repl
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: ASPNETCORE_URLS
          value: http://+:31337
        image: cisien/csdiscord:linux
        imagePullPolicy: Always
        name: repl
        resources: {}
        securityContext:
          readOnlyRootFilesystem: true
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /tmp
          name: tmp
        - mountPath: /var
          name: var
      dnsPolicy: ClusterFirst
      nodeSelector:
        beta.kubernetes.io/os: linux
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        fsGroup: 33
        runAsUser: 33
      terminationGracePeriodSeconds: 30
      volumes:
      - emptyDir: {}
        name: tmp
      - emptyDir: {}
        name: var

---
#hastebin-persistent-volume

apiVersion: v1
kind: PersistentVolume
metadata:
  annotations: {}
  labels:
    name: hastebin-pv
  name: hastebin-pv
spec:
  accessModes:
  - ReadWriteMany
  capacity:
    storage: 40Gi
  nfs:
    path: /nfsfileshare/hastebin-pv
    server: 172.16.100.13
  persistentVolumeReclaimPolicy: Retain

--- 
#hastebin-persistent-volume-claim

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations: {}
  name: hastebin-pvc
  namespace: csharp
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  selector:
    matchLabels:
      name: hastebin-pv
  volumeName: hastebin-pv

---
#hastebin-service

apiVersion: v1
kind: Service
metadata:
  annotations: {}
  name: hastebin-frontend-service
  namespace: csharp
spec:
  ports:
  - name: http
    port: 80
    protocol: TCP
    targetPort: 7777
  selector:
    app: hastebin-frontend
  sessionAffinity: None
  type: ClusterIP

---
#hastebin-frontend-ingress

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    certmanager.k8s.io/cluster-issuer: letsencrypt
    kubernetes.io/ingress.class: nginx
  name: hastebin-frontend-ingress
  namespace: csharp
spec:
  rules:
  - host: paste.mod.gg
    http:
      paths:
      - backend:
          serviceName: hastebin-frontend-service
          servicePort: 80
        path: /
  tls:
  - hosts:
    - paste.mod.gg
    secretName: hastebin-fe-tls-cert-prod

---
#hastebin

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  annotations: {}
  labels:
    app: hastebin-frontend
  name: hastebin-frontend
  namespace: csharp
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 2
  selector:
    matchLabels:
      app: hastebin-frontend
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: hastebin-frontend
    spec:
      containers:
        - image: rlister/hastebin:latest
          imagePullPolicy: Always
          name: hastebin
          volumeMounts:
          - mountPath: /app/data
            name: hastebin-data
            readOnly: false
      dnsPolicy: ClusterFirst
      nodeSelector:
        beta.kubernetes.io/os: linux
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      volumes:
      - name: hastebin-data
        persistentVolumeClaim:
          claimName: hastebin-pvc