Skip to content

Commit a541e12

Browse files
sleepycatsleepycat
authored
Add staging overlays (canada-ca#2432)
This commit adds the overlays needed for an AKS based staging environment. This should be enough to get Tracker going: ```sh make secrets # env=dev is the default make deploy env=staging ```
1 parent 0f749e9 commit a541e12

14 files changed

Lines changed: 318 additions & 0 deletions

‎app/staging/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Staging on AKS
2+
3+
The purpose of this overlay is to bring up Tracker on AKS in a Staging config. The config here is just a draft. We're just getting started!
4+
5+
If you need some dev credentials for this test cluster, you can generate them with `make credentials mode=dev`.
6+
7+
## Bringing up a cluster on AKS
8+
9+
Normally we would create the cluster with `make cluster`, but we haven't gotten an AKS equivalent worked out yet. In the absence of that, we'll just assume you already have a 6 node cluster somehow, and `kubectl` configured to talk to it.
10+
11+
## Installing Tracker
12+
13+
Just run the following commands.
14+
15+
```sh
16+
make secrets env=aks
17+
# If either of these fail, just run them again
18+
make platform env=staging
19+
make app env=staging
20+
```
21+
Or as an alternate path, you could install flux and let it do the work for you.
22+
23+
```sh
24+
make secrets env=aks
25+
make deploy env=staging
26+
```
27+
28+
If you want to watch the pod creation process, you can do it with this:
29+
30+
```sh
31+
watch kubectl get po -A
32+
```
33+
34+
That will bring the cluster up with a self-signed certificate. To connect to it, we just need the external IP.
35+
36+
```sh
37+
kubectl get svc -n istio-system istio-ingressgateway
38+
```
39+
40+
Connecting to both `https://<externalip>` and `https://<externalip>/graphql` should succeed. Reaching the frontend and API respectively.
41+
42+
## Loading data
43+
44+
The database isn't exposed to the outside world, so loading data requires you to forward the database ports to your local machine.
45+
46+
```sh
47+
kubectl port-forward -n db svc/arangodb 8529:8529
48+
```
49+
50+
With that port forwarding in place, you can now load/dump with the following commands:
51+
52+
```sh
53+
make backup to=~/track_dmarc-$(date --iso-8601)
54+
make restore from=~/track_dmarc-2021-05-12
55+
```

‎app/staging/arangodb-deployment.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
kind: ArangoDeployment
2+
apiVersion: database.arangodb.com/v1alpha
3+
metadata:
4+
name: arangodb
5+
namespace: db
6+
spec:
7+
agents:
8+
volumeClaimTemplate:
9+
spec:
10+
storageClassName: slow-retain
11+
persistentVolumeReclaimPolicy: Retain
12+
dbservers:
13+
volumeClaimTemplate:
14+
spec:
15+
storageClassName: fast-retain
16+
persistentVolumeReclaimPolicy: Retain
17+

‎app/staging/certificate.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
creationTimestamp: null
5+
name: ingress-cert
6+
namespace: istio-system
7+
spec:
8+
commonName: tracker.canada.ca
9+
dnsNames:
10+
- tracker.canada.ca
11+
- suivi.canada.ca
12+
issuerRef:
13+
kind: Issuer
14+
name: letsencrypt-staging
15+
privateKey:
16+
algorithm: RSA
17+
encoding: PKCS8 # ITSP.40.062 6.2 Signature Algorithms
18+
size: 4096
19+
secretName: tracker-credential
20+
status: {}

‎app/staging/knative/config/queues.yaml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
apiVersion: serving.knative.dev/v1 # Current version of Knative
2+
kind: Service
3+
metadata:
4+
name: scan-queue
5+
namespace: scanners
6+
labels:
7+
app: scanners
8+
spec:
9+
template:
10+
metadata:
11+
annotations:
12+
prometheus.io/scrape: 'true'
13+
prometheus.io/port: '9090'
14+
# Knative concurrency-based autoscaling (default).
15+
autoscaling.knative.dev/class: kpa.autoscaling.knative.dev
16+
autoscaling.knative.dev/metric: concurrency
17+
autoscaling.knative.dev/minScale: "1"
18+
autoscaling.knative.dev/maxScale: "2"
19+
spec:
20+
timeoutSeconds: 500
21+
containers:
22+
- name: scan-queue
23+
image: gcr.io/track-compliance/services/scan-queue
24+
25+
---
26+
27+
apiVersion: serving.knative.dev/v1 # Current version of Knative
28+
kind: Service
29+
metadata:
30+
name: result-queue
31+
namespace: scanners
32+
labels:
33+
app: scanners
34+
spec:
35+
template:
36+
metadata:
37+
annotations:
38+
prometheus.io/scrape: 'true'
39+
prometheus.io/port: '9090'
40+
# Knative concurrency-based autoscaling (default).
41+
autoscaling.knative.dev/class: kpa.autoscaling.knative.dev
42+
autoscaling.knative.dev/metric: concurrency
43+
autoscaling.knative.dev/minScale: "1"
44+
autoscaling.knative.dev/maxScale: "2"
45+
spec:
46+
timeoutSeconds: 500
47+
containers:
48+
- name: result-queue
49+
image: gcr.io/track-compliance/services/result-queue

‎app/staging/kustomization.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- ../bases
5+
- storage-classes.yaml
6+
patchesStrategicMerge:
7+
- arangodb-deployment.yaml
8+
- certificate.yaml
9+
- publicgateway.yaml
10+
- knative/config/queues.yaml
11+
replicas:
12+
- count: 2
13+
name: tracker-frontend
14+
- count: 2
15+
name: tracker-api
16+
- count: 1
17+
name: arango-deployment-replication-operator
18+
- count: 1
19+
name: arango-deployment-operator
20+
- count: 1
21+
name: arango-storage-operator
22+
components:
23+
- ../namespaces

‎app/staging/publicgateway.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
apiVersion: networking.istio.io/v1alpha3
2+
kind: Gateway
3+
metadata:
4+
name: publicgateway
5+
namespace: istio-system
6+
labels:
7+
istio: publicgateway
8+
spec:
9+
selector:
10+
istio: ingressgateway
11+
servers:
12+
- port:
13+
number: 80
14+
name: http
15+
protocol: HTTP
16+
hosts:
17+
- "*"
18+
tls:
19+
httpsRedirect: true
20+
- port:
21+
number: 443
22+
name: https
23+
protocol: HTTPS
24+
hosts:
25+
- "*"
26+
tls:
27+
mode: SIMPLE
28+
credentialName: ingress-cert-frompfx
29+
privateKey: sds
30+
serverCertificate: sds
31+
minProtocolVersion: TLSV1_2
32+
cipherSuites:
33+
- TLS_AES_128_GCM_SHA256
34+
- TLS_AES_256_GCM_SHA384
35+
- TLS_CHACHA20_POLY1305_SHA256
36+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
37+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
38+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

‎app/staging/storage-classes.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
kind: StorageClass
2+
apiVersion: storage.k8s.io/v1
3+
metadata:
4+
name: fast-retain
5+
provisioner: kubernetes.io/azure-disk
6+
reclaimPolicy: Retain
7+
parameters:
8+
storageaccounttype: Premium_LRS
9+
kind: Managed
10+
volumeBindingMode: WaitForFirstConsumer
11+
12+
---
13+
14+
kind: StorageClass
15+
apiVersion: storage.k8s.io/v1
16+
metadata:
17+
name: slow-retain
18+
provisioner: kubernetes.io/azure-disk
19+
reclaimPolicy: Retain
20+
parameters:
21+
storageaccounttype: Standard_LRS
22+
kind: Managed
23+
volumeBindingMode: WaitForFirstConsumer
24+
25+
---
26+
27+
kind: StorageClass
28+
apiVersion: storage.k8s.io/v1
29+
metadata:
30+
name: fast-delete
31+
provisioner: kubernetes.io/azure-disk
32+
reclaimPolicy: Delete
33+
parameters:
34+
storageaccounttype: Premium_LRS
35+
kind: Managed
36+
volumeBindingMode: WaitForFirstConsumer
37+
38+
---
39+
40+
kind: StorageClass
41+
apiVersion: storage.k8s.io/v1
42+
metadata:
43+
name: slow-delete
44+
provisioner: kubernetes.io/azure-disk
45+
reclaimPolicy: Delete
46+
parameters:
47+
storageaccounttype: Standard_LRS
48+
kind: Managed
49+
volumeBindingMode: WaitForFirstConsumer
50+
---

‎deploy/staging/app-kustomization.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
3+
kind: Kustomization
4+
metadata:
5+
name: app
6+
namespace: flux-system
7+
spec:
8+
path: ./app/staging
9+

‎deploy/staging/kustomization.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
apiVersion: kustomize.config.k8s.io/v1beta1
2+
kind: Kustomization
3+
resources:
4+
- ../bases
5+
patchesStrategicMerge:
6+
- app-kustomization.yaml
7+
- platform-kustomization.yaml

‎deploy/staging/platform-kustomization.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
apiVersion: kustomize.toolkit.fluxcd.io/v1beta1
3+
kind: Kustomization
4+
metadata:
5+
name: platform
6+
namespace: flux-system
7+
spec:
8+
path: ./platform/staging

0 commit comments

Comments
 (0)