Configuration du cluster kubernetes

kubernetes/aplus-app.yaml

@@ -0,0 +1,127 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: aplus-app
+  labels:
+    app: aplus
+spec:
+  type: NodePort
+  ports:
+  - port: 80
+    targetPort: 9000
+  selector:     # Should be a Pod selector
+    app: aplus
+    tier: frontend
+  externalIPs:
+    - 54.38.254.141
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: aplus-files-pvc
+  labels:
+    app: aplus
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: csi-cinder-classic
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: aplus-app-deployment
+  labels:
+    app: aplus
+spec:
+  replicas: 1
+  selector:       # Should match .spec.template
+    matchLabels:
+      app: aplus
+      tier: frontend
+  strategy:
+    type: Recreate  # here RollingUpdate is not well handled by app sql queries
+  template:
+    metadata:
+      labels:
+        app: aplus
+        tier: frontend
+    spec:
+      containers:
+      - image: administrationplus.azurecr.io/aplus:master-20210526-084710z-f9c361b67edc2536f89e0cf1d1190a7467b6dba7
+        name: aplus-app
+        env:
+        - name: APP_HOST
+          value: aplus.beta.gouv.fr
+        - name: APP_HTTPS
+          value: "false"
+        - name: APPLICATION_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: aplus-application-secret
+              key: APPLICATION_SECRET
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: aplus-db-app-secret
+              key: DATABASE_URL
+        - name: EVOLUTIONS_AUTOAPPLY
+          value: "true"
+        - name: FEATURE_AUTO_ADD_EXPERT
+          value: "true"
+        - name: FEATURE_SEND_APPLICATIONS_ANYWHERE
+          value: "true"
+        - name: FEATURE_SMS_MANDAT
+          value: "false"
+        - name: FEATURE_WEEKLY_EMAILS
+          value: "true"
+        - name: FILES_EXPIRATION_IN_DAYS
+          value: "15"
+        - name: FILES_PATH
+          value: "/app/files"
+        - name: GROUPS_WHICH_CANNOT_HAVE_INSTRUCTORS
+          value: "f32d20bf-a201-4875-9c69-16a5a4ad2f9c,ecb83438-b78b-4fbc-b0cd-880ce55562df"
+        - name: MAIL_HOST
+          valueFrom:
+            secretKeyRef:
+              name: aplus-email-secret
+              key: MAIL_HOST
+        - name: MAIL_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: aplus-email-secret
+              key: MAIL_PASSWORD
+        - name: MAIL_PORT
+          valueFrom:
+            secretKeyRef:
+              name: aplus-email-secret
+              key: MAIL_PORT
+        - name: MAIL_USER
+          valueFrom:
+            secretKeyRef:
+              name: aplus-email-secret
+              key: MAIL_USER
+        - name: NOTIFICATION_EMAIL_BLACKLIST
+          value: "daniel.balmy@beta.gouv.fr"
+        - name: SMS_USE_LIVE_API
+          value: "false"
+        - name: WEEKLY_EMAILS_DAY_OF_WEEK
+          value: tuesday
+        - name: WEEKLY_EMAILS_HOUR_OF_DAY
+          value: "10"
+        - name: WEEKLY_EMAILS_MAX_NUMBER
+          value: "1000"
+
+        ports:
+        - containerPort: 9000
+        volumeMounts:
+        - name: aplus-files-pv
+          mountPath: /app/files
+      imagePullSecrets:
+      - name: acr-docker-creds
+      volumes:
+      - name: aplus-files-pv
+        persistentVolumeClaim:
+          claimName: aplus-files-pvc

kubernetes/aplus-db-backup-job.yaml

@@ -0,0 +1,112 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: aplus-db-backup-script
+data:
+  backup-script: |
+    set -e
+    apt-get update
+    apt-get install -y jq postgresql-client-11
+    pip install python-swiftclient==3.12.0
+    pip install python-keystoneclient==4.2.0
+
+    if [ ! -s /key/key.pub ]
+    then
+      echo "Stopping: no public key"
+      exit 0
+    fi
+    gpg --no-tty --import /key/key.pub
+
+    # Create new backup
+    NOW="$(date +"%Y-%m-%d-%s")"
+    FILENAME="$DATABASE_BACKUP_PREFIX.$NOW.pgdump.gz"
+    pg_dump -Fc $DATABASE_NAME | gzip > $FILENAME
+    gpg --batch --trust-model always --output "${FILENAME}.gpg" --recipient ${RECIPIENT_PUBLIC_KEY_EMAIL} --encrypt ${FILENAME}
+    swift --os-auth-token $AUTH_TOKEN --os-storage-url $STORAGE_URL upload $STORAGE_CONTAINER "${FILENAME}.gpg"
+
+    # Cleanup old backups
+    while read line
+    do
+      date=$(echo "$line" | jq -r '.last_modified')
+      if [ $(date -d "$date" +%s) -le $(date +%s -d "$RETENTION_NUM_OF_DAYS days ago") ]
+      then
+        OLD=$(echo "$line" | jq -r '.name')
+        echo WILL DELETE OLD BACKUP $OLD
+        swift --os-auth-token $AUTH_TOKEN --os-storage-url $STORAGE_URL delete $STORAGE_CONTAINER "$OLD"
+      fi
+    done < <(swift --os-auth-token $AUTH_TOKEN --os-storage-url $STORAGE_URL list --json $STORAGE_CONTAINER | jq -c '.[]')
+---
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: aplus-db-backup-job
+spec:
+  schedule: "0 * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: aplus-db-backup
+            image: python:3
+            env:
+            - name: AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: ovh-storage-creds
+                  key: AUTH_TOKEN
+            - name: DATABASE_BACKUP_PREFIX
+              value: "aplus-db"
+            - name: DATABASE_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: aplus-db-app-secret
+                  key: DATABASE_NAME
+            - name: PGHOST
+              valueFrom:
+                secretKeyRef:
+                  name: aplus-db-app-secret
+                  key: DATABASE_HOST
+            - name: PGPASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: aplus-db-postgres-secret
+                  key: POSTGRES_PASSWORD
+            - name: PGUSER
+              value: postgres
+            - name: RECIPIENT_PUBLIC_KEY_EMAIL
+              valueFrom:
+                secretKeyRef:
+                  name: aplus-backup-pub-key
+                  key: RECIPIENT_PUBLIC_KEY_EMAIL
+            - name: RETENTION_NUM_OF_DAYS
+              value: "2"
+            - name: STORAGE_CONTAINER
+              value: "aplus-test-storage"
+            - name: STORAGE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: ovh-storage-creds
+                  key: STORAGE_URL
+            volumeMounts:
+            - name: script
+              mountPath: "/script"
+            - name: public-key
+              mountPath: "/key"
+            command: ["bash",  "/script/backup.sh"]
+          volumes:
+          - name: script
+            configMap:
+              name: aplus-db-backup-script
+              items:
+              - key: backup-script
+                path: "backup.sh"
+          - name: public-key
+            secret:
+              secretName: aplus-backup-pub-key
+              items:
+              - key: RECIPIENT_PUBLIC_KEY
+                path: "key.pub"
+          restartPolicy: Never
+      backoffLimit: 4
+      # ttlSecondsAfterFinished is not activated on the cluster

kubernetes/aplus-db.yaml

@@ -0,0 +1,65 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: aplus-db
+  labels:
+    app: aplus
+spec:
+  clusterIP: None
+  ports:
+  - port: 5432
+  selector:
+    app: aplus
+    tier: postgres
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: aplus-db-pvc
+  labels:
+    app: aplus
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: csi-cinder-classic
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: aplus-db-statefulset
+  labels:
+    app: aplus
+spec:
+  selector:
+    matchLabels:
+      app: aplus
+      tier: postgres
+  serviceName: aplus-db
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: aplus
+        tier: postgres
+    spec:
+      containers:
+        - name: postgres-database
+          image: postgres:11
+          volumeMounts:
+            - name: aplus-db-pv
+              mountPath: /var/lib/postgresql/data
+          env:
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: aplus-db-postgres-secret
+                  key: DATABASE_URL
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+      volumes:
+        - name: aplus-db-pv
+          persistentVolumeClaim:
+            claimName: aplus-db-pvc