Skip to content

Commit d075404

Browse files
NGPixelNGPixel
committed
refactor: add beat + celery deployments
1 parent 05bd47c commit d075404

6 files changed

Lines changed: 263 additions & 78 deletions

File tree

‎k8s/beat.yaml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: beat
5+
spec:
6+
replicas: 1
7+
revisionHistoryLimit: 2
8+
selector:
9+
matchLabels:
10+
app: beat
11+
strategy:
12+
type: Recreate
13+
template:
14+
metadata:
15+
labels:
16+
app: beat
17+
spec:
18+
securityContext:
19+
runAsNonRoot: true
20+
containers:
21+
- name: beat
22+
image: "ghcr.io/ietf-tools/datatracker:$APP_IMAGE_TAG"
23+
imagePullPolicy: Always
24+
ports:
25+
- containerPort: 8000
26+
name: http
27+
protocol: TCP
28+
volumeMounts:
29+
- name: dt-vol
30+
mountPath: /a
31+
- name: dt-tmp
32+
mountPath: /tmp
33+
- name: dt-cfg
34+
mountPath: /workspace/ietf/settings_local.py
35+
subPath: settings_local.py
36+
env:
37+
- name: "CONTAINER_ROLE"
38+
value: "beat"
39+
envFrom:
40+
- configMapRef:
41+
name: django-config
42+
securityContext:
43+
allowPrivilegeEscalation: false
44+
capabilities:
45+
drop:
46+
- ALL
47+
readOnlyRootFilesystem: true
48+
runAsUser: 1000
49+
runAsGroup: 1000
50+
volumes:
51+
# To be overriden with the actual shared volume
52+
- name: dt-vol
53+
- name: dt-tmp
54+
emptyDir:
55+
sizeLimit: "2Gi"
56+
- name: dt-cfg
57+
configMap:
58+
name: files-cfgmap
59+
dnsPolicy: ClusterFirst
60+
restartPolicy: Always
61+
terminationGracePeriodSeconds: 30

‎k8s/celery.yaml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: celery
5+
spec:
6+
replicas: 1
7+
revisionHistoryLimit: 2
8+
selector:
9+
matchLabels:
10+
app: celery
11+
strategy:
12+
type: Recreate
13+
template:
14+
metadata:
15+
labels:
16+
app: celery
17+
spec:
18+
securityContext:
19+
runAsNonRoot: true
20+
containers:
21+
# -----------------------------------------------------
22+
# ScoutAPM Container
23+
# -----------------------------------------------------
24+
- name: scoutapm
25+
image: "scoutapp/scoutapm:version-1.4.0"
26+
imagePullPolicy: IfNotPresent
27+
livenessProbe:
28+
exec:
29+
command:
30+
- "sh"
31+
- "-c"
32+
- "./core-agent probe --tcp 0.0.0.0:6590 | grep -q 'Agent found'"
33+
securityContext:
34+
readOnlyRootFilesystem: true
35+
runAsUser: 65534 # "nobody" user by default
36+
runAsGroup: 65534 # "nogroup" group by default
37+
# -----------------------------------------------------
38+
# Celery Container
39+
# -----------------------------------------------------
40+
- name: celery
41+
image: "ghcr.io/ietf-tools/datatracker:$APP_IMAGE_TAG"
42+
imagePullPolicy: Always
43+
ports:
44+
- containerPort: 8000
45+
name: http
46+
protocol: TCP
47+
volumeMounts:
48+
- name: dt-vol
49+
mountPath: /a
50+
- name: dt-tmp
51+
mountPath: /tmp
52+
- name: dt-cfg
53+
mountPath: /workspace/ietf/settings_local.py
54+
subPath: settings_local.py
55+
env:
56+
- name: "CONTAINER_ROLE"
57+
value: "celery"
58+
envFrom:
59+
- configMapRef:
60+
name: django-config
61+
securityContext:
62+
allowPrivilegeEscalation: false
63+
capabilities:
64+
drop:
65+
- ALL
66+
readOnlyRootFilesystem: true
67+
runAsUser: 1000
68+
runAsGroup: 1000
69+
volumes:
70+
# To be overriden with the actual shared volume
71+
- name: dt-vol
72+
- name: dt-tmp
73+
emptyDir:
74+
sizeLimit: "2Gi"
75+
- name: dt-cfg
76+
configMap:
77+
name: files-cfgmap
78+
dnsPolicy: ClusterFirst
79+
restartPolicy: Always
80+
terminationGracePeriodSeconds: 30

‎k8s/datatracker.yaml‎

Lines changed: 3 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@ spec:
5252
- name: dt-cfg
5353
mountPath: /workspace/ietf/settings_local.py
5454
subPath: settings_local.py
55+
env:
56+
- name: "CONTAINER_ROLE"
57+
value: "datatracker"
5558
envFrom:
5659
- configMapRef:
5760
name: django-config
@@ -77,84 +80,6 @@ spec:
7780
terminationGracePeriodSeconds: 30
7881
---
7982
apiVersion: v1
80-
kind: ConfigMap
81-
metadata:
82-
name: django-config
83-
data:
84-
# n.b., these are debug values / non-secret secrets
85-
DATATRACKER_SERVER_MODE: "development" # development for staging, production for production
86-
DATATRACKER_ADMINS: |-
87-
Robert Sparks <rjsparks@nostrum.com>
88-
Ryan Cross <rcross@amsl.com>
89-
Kesara Rathnayake <kesara@staff.ietf.org>
90-
Jennifer Richards <jennifer@staff.ietf.org>
91-
Nicolas Giard <nick@staff.ietf.org>
92-
DATATRACKER_ALLOWED_HOSTS: ".ietf.org" # newline-separated list also allowed
93-
# DATATRACKER_DATATRACKER_DEBUG: "false"
94-
95-
# DB access details - needs to be filled in
96-
# DATATRACKER_DBHOST: "db"
97-
# DATATRACKER_DBPORT: "5432"
98-
# DATATRACKER_DBNAME: "datatracker"
99-
# DATATRACKER_DBUSER: "django" # secret
100-
# DATATRACKER_DBPASS: "RkTkDPFnKpko" # secret
101-
102-
DATATRACKER_DJANGO_SECRET_KEY: "PDwXboUq!=hPjnrtG2=ge#N$Dwy+wn@uivrugwpic8mxyPfHk" # secret
103-
104-
# Set this to point testing / staging at the production statics server until we
105-
# sort that out
106-
# DATATRACKER_STATIC_URL: "https://static.ietf.org/dt/12.10.0/"
107-
108-
# DATATRACKER_EMAIL_DEBUG: "true"
109-
110-
# Outgoing email details
111-
# DATATRACKER_EMAIL_HOST: "localhost" # defaults to localhost
112-
# DATATRACKER_EMAIL_PORT: "2025" # defaults to 2025
113-
114-
# The value here is the default from settings.py (i.e., not actually secret)
115-
DATATRACKER_NOMCOM_APP_SECRET_B64: "m9pzMezVoFNJfsvU9XSZxGnXnwup6P5ZgCQeEnROOoQ=" # secret
116-
117-
DATATRACKER_IANA_SYNC_PASSWORD: "this-is-the-iana-sync-password" # secret
118-
DATATRACKER_RFC_EDITOR_SYNC_PASSWORD: "this-is-the-rfc-editor-sync-password" # secret
119-
DATATRACKER_YOUTUBE_API_KEY: "this-is-the-youtube-api-key" # secret
120-
DATATRACKER_GITHUB_BACKUP_API_KEY: "this-is-the-github-backup-api-key" # secret
121-
122-
# API key configuration
123-
DATATRACKER_API_KEY_TYPE: "ES265"
124-
# secret - value here is the default from settings.py (i.e., not actually secret)
125-
DATATRACKER_API_PUBLIC_KEY_PEM_B64: |-
126-
Ci0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tCk1Ga3dFd1lIS29aSXpqMENBUVlJS
127-
29aSXpqMERBUWNEUWdBRXFWb2pzYW9mREpTY3VNSk4rdHNodW15Tk01TUUKZ2Fyel
128-
ZQcWtWb3ZtRjZ5RTdJSi9kdjRGY1YrUUtDdEovck9TOGUzNlk4WkFFVll1dWtoZXM
129-
weVoxdz09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=
130-
# secret - value here is the default from settings.py (i.e., not actually secret)
131-
DATATRACKER_API_PRIVATE_KEY_PEM_B64: |-
132-
Ci0tLS0tQkVHSU4gUFJJVkFURSBLRVktLS0tLQpNSUdIQWdFQU1CTUdCeXFHU000O
133-
UFnRUdDQ3FHU000OUF3RUhCRzB3YXdJQkFRUWdvSTZMSmtvcEtxOFhySGk5ClFxR1
134-
F2RTRBODNURllqcUx6KzhnVUxZZWNzcWhSQU5DQUFTcFdpT3hxaDhNbEp5NHdrMzY
135-
yeUc2Ykkwemt3U0IKcXZOVStxUldpK1lYcklUc2duOTIvZ1Z4WDVBb0swbitzNUx4
136-
N2ZwanhrQVJWaTY2U0Y2elRKblgKLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=
137-
138-
# DATATRACKER_MEETECHO_API_BASE: "https://meetings.conf.meetecho.com/api/v1/"
139-
DATATRACKER_MEETECHO_CLIENT_ID: "this-is-the-meetecho-client-id" # secret
140-
DATATRACKER_MEETECHO_CLIENT_SECRET: "this-is-the-meetecho-client-secret" # secret
141-
142-
# DATATRACKER_MATOMO_SITE_ID: "7" # must be present to enable Matomo
143-
# DATATRACKER_MATOMO_DOMAIN_PATH: "analytics.ietf.org"
144-
145-
CELERY_PASSWORD: "this-is-a-secret" # secret
146-
147-
DATATRACKER_APP_API_TOKENS_JSON: "{}" # secret
148-
149-
# use this to override default - one entry per line
150-
# DATATRACKER_CSRF_TRUSTED_ORIGINS: |-
151-
# https://datatracker.staging.ietf.org
152-
153-
# Scout configuration
154-
DATATRACKER_SCOUT_KEY: "this-is-the-scout-key"
155-
DATATRACKER_SCOUT_NAME: "StagingDatatracker"
156-
---
157-
apiVersion: v1
15883
kind: Service
15984
metadata:
16085
name: datatracker

‎k8s/django-config.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: django-config
5+
data:
6+
# n.b., these are debug values / non-secret secrets
7+
DATATRACKER_SERVER_MODE: "development" # development for staging, production for production
8+
DATATRACKER_ADMINS: |-
9+
Robert Sparks <rjsparks@nostrum.com>
10+
Ryan Cross <rcross@amsl.com>
11+
Kesara Rathnayake <kesara@staff.ietf.org>
12+
Jennifer Richards <jennifer@staff.ietf.org>
13+
Nicolas Giard <nick@staff.ietf.org>
14+
DATATRACKER_ALLOWED_HOSTS: ".ietf.org" # newline-separated list also allowed
15+
# DATATRACKER_DATATRACKER_DEBUG: "false"
16+
17+
# DB access details - needs to be filled in
18+
# DATATRACKER_DBHOST: "db"
19+
# DATATRACKER_DBPORT: "5432"
20+
# DATATRACKER_DBNAME: "datatracker"
21+
# DATATRACKER_DBUSER: "django" # secret
22+
# DATATRACKER_DBPASS: "RkTkDPFnKpko" # secret
23+
24+
DATATRACKER_DJANGO_SECRET_KEY: "PDwXboUq!=hPjnrtG2=ge#N$Dwy+wn@uivrugwpic8mxyPfHk" # secret
25+
26+
# Set this to point testing / staging at the production statics server until we
27+
# sort that out
28+
# DATATRACKER_STATIC_URL: "https://static.ietf.org/dt/12.10.0/"
29+
30+
# DATATRACKER_EMAIL_DEBUG: "true"
31+
32+
# Outgoing email details
33+
# DATATRACKER_EMAIL_HOST: "localhost" # defaults to localhost
34+
# DATATRACKER_EMAIL_PORT: "2025" # defaults to 2025
35+
36+
# The value here is the default from settings.py (i.e., not actually secret)
37+
DATATRACKER_NOMCOM_APP_SECRET_B64: "m9pzMezVoFNJfsvU9XSZxGnXnwup6P5ZgCQeEnROOoQ=" # secret
38+
39+
DATATRACKER_IANA_SYNC_PASSWORD: "this-is-the-iana-sync-password" # secret
40+
DATATRACKER_RFC_EDITOR_SYNC_PASSWORD: "this-is-the-rfc-editor-sync-password" # secret
41+
DATATRACKER_YOUTUBE_API_KEY: "this-is-the-youtube-api-key" # secret
42+
DATATRACKER_GITHUB_BACKUP_API_KEY: "this-is-the-github-backup-api-key" # secret
43+
44+
# API key configuration
45+
DATATRACKER_API_KEY_TYPE: "ES265"
46+
# secret - value here is the default from settings.py (i.e., not actually secret)
47+
DATATRACKER_API_PUBLIC_KEY_PEM_B64: |-
48+
Ci0tLS0tQkVHSU4gUFVCTElDIEtFWS0tLS0tCk1Ga3dFd1lIS29aSXpqMENBUVlJS
49+
29aSXpqMERBUWNEUWdBRXFWb2pzYW9mREpTY3VNSk4rdHNodW15Tk01TUUKZ2Fyel
50+
ZQcWtWb3ZtRjZ5RTdJSi9kdjRGY1YrUUtDdEovck9TOGUzNlk4WkFFVll1dWtoZXM
51+
weVoxdz09Ci0tLS0tRU5EIFBVQkxJQyBLRVktLS0tLQo=
52+
# secret - value here is the default from settings.py (i.e., not actually secret)
53+
DATATRACKER_API_PRIVATE_KEY_PEM_B64: |-
54+
Ci0tLS0tQkVHSU4gUFJJVkFURSBLRVktLS0tLQpNSUdIQWdFQU1CTUdCeXFHU000O
55+
UFnRUdDQ3FHU000OUF3RUhCRzB3YXdJQkFRUWdvSTZMSmtvcEtxOFhySGk5ClFxR1
56+
F2RTRBODNURllqcUx6KzhnVUxZZWNzcWhSQU5DQUFTcFdpT3hxaDhNbEp5NHdrMzY
57+
yeUc2Ykkwemt3U0IKcXZOVStxUldpK1lYcklUc2duOTIvZ1Z4WDVBb0swbitzNUx4
58+
N2ZwanhrQVJWaTY2U0Y2elRKblgKLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLQo=
59+
60+
# DATATRACKER_MEETECHO_API_BASE: "https://meetings.conf.meetecho.com/api/v1/"
61+
DATATRACKER_MEETECHO_CLIENT_ID: "this-is-the-meetecho-client-id" # secret
62+
DATATRACKER_MEETECHO_CLIENT_SECRET: "this-is-the-meetecho-client-secret" # secret
63+
64+
# DATATRACKER_MATOMO_SITE_ID: "7" # must be present to enable Matomo
65+
# DATATRACKER_MATOMO_DOMAIN_PATH: "analytics.ietf.org"
66+
67+
CELERY_PASSWORD: "this-is-a-secret" # secret
68+
69+
DATATRACKER_APP_API_TOKENS_JSON: "{}" # secret
70+
71+
# use this to override default - one entry per line
72+
# DATATRACKER_CSRF_TRUSTED_ORIGINS: |-
73+
# https://datatracker.staging.ietf.org
74+
75+
# Scout configuration
76+
DATATRACKER_SCOUT_KEY: "this-is-the-scout-key"
77+
DATATRACKER_SCOUT_NAME: "StagingDatatracker"

‎k8s/kustomization.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ configMapGenerator:
55
files:
66
- settings_local.py
77
resources:
8+
- beat.yaml
9+
- celery.yaml
810
- datatracker.yaml
11+
- django-config.yaml
912
- memcached.yaml
1013
- rabbitmq.yaml

‎k8s/memcached.yaml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,42 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: memcached
5+
spec:
6+
replicas: 1
7+
revisionHistoryLimit: 2
8+
serviceName: memcached
9+
selector:
10+
matchLabels:
11+
app: memcached
12+
template:
13+
metadata:
14+
labels:
15+
app: memcached
16+
spec:
17+
securityContext:
18+
runAsNonRoot: true
19+
containers:
20+
- image: "memcached:1.6-alpine"
21+
imagePullPolicy: IfNotPresent
22+
args: ["-m", "1024"]
23+
name: memcached
24+
ports:
25+
- name: memcached
26+
containerPort: 11211
27+
protocol: TCP
28+
securityContext:
29+
allowPrivilegeEscalation: false
30+
capabilities:
31+
drop:
32+
- ALL
33+
readOnlyRootFilesystem: true
34+
# memcached image sets up uid/gid 11211
35+
runAsUser: 11211
36+
runAsGroup: 11211
37+
dnsPolicy: ClusterFirst
38+
restartPolicy: Always
39+
terminationGracePeriodSeconds: 30
140
---
241
apiVersion: v1
342
kind: Service

0 commit comments

Comments
 (0)