feat(ingress): add TLS configuration for staging hosts

Add TLS configuration for staging-shiny and staging-shiny-api hosts in the ingress resources. Create a new namespace for ingress-nginx to better organize resources. Update kustomization files to include new certificates and secrets. Streamline setup process with improved wait commands for pod readiness.
2025-12-10 08:16:27 +01:00
parent 7dd42187fe
commit 58b04fe47e
12 changed files with 68 additions and 24 deletions
@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- postgres.yaml
+- rabbitmq.yaml
+- namespaces.yaml
+helmCharts:
+- name: external-secrets
+  namespace: external-secrets
+  includeCRDs: true
+  releaseName: external-secrets
+  repo: https://charts.external-secrets.io
+  version: 1.1.1
+- name: cert-manager
+  namespace: cert-manager
+  includeCRDs: true
+  releaseName: cert-manager
+  repo: https://charts.jetstack.io
+  version: v1.19.2
+  valuesInline:
+    crds:
+      enabled: true
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
@@ -0,0 +1,106 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: shared-postgres
+data:
+  DB_HOST: "postgres-postgresql"
+  DB_PORT: "5432"
+  DB_USER: "postgres"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgres-init
+data:
+  initdb.sh: |-
+    #!/usr/bin/env bash
+    set -e
+
+    psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+    	CREATE DATABASE schemas WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE accounting WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE banking WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE authz WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE company WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE consumer WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE employee WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE invoice WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE notification WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE salary WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE supplier WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE supplier_invoice WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE tax WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE time WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE dancefinder WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE hifi WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE sloth WITH OWNER postgres ENCODING utf8;
+    EOSQL
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: postgres
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: postgres
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:18.1-alpine@sha256:eca6fb2d91fda290eb8cfb8ba53dd0dcbf3508a08011e30adb039ea7c8e1e9f2
+        args:
+        - -c
+        - shared_buffers=384MB
+        - -c
+        - max_connections=300
+        imagePullPolicy: "IfNotPresent"
+        resources:
+          requests:
+            memory: 400Mi
+          limits:
+            memory: 600Mi
+        ports:
+        - containerPort: 5432
+        env:
+        - name: POSTGRES_DB
+          value: postgres
+        - name: POSTGRES_USER
+          value: postgres
+        - name: POSTGRES_PASSWORD
+          value: postgres
+        - name: LANG
+          value: sv_SE.utf8
+        - name: POSTGRES_INITDB_ARGS
+          value: --locale-provider=icu --icu-locale=sv-SE
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/postgresql
+        - mountPath: /docker-entrypoint-initdb.d/initdb.sh
+          name: initdb
+          subPath: initdb.sh
+      volumes:
+      - name: data
+        hostPath:
+          path: /data/postgres
+      - name: initdb
+        configMap:
+          name: postgres-init
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  labels:
+    app.kubernetes.io/name: postgres
+spec:
+  ports:
+  - port: 5432
+    nodePort: 5432
+  selector:
+    app.kubernetes.io/name: postgres
+  type: NodePort
@@ -0,0 +1,166 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: shared-rabbitmq
+data:
+  RABBITMQ_SERVERS: rabbitmq
+  RABBITMQ_VHOST: /
+  RABBITMQ_USERNAME: user
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rabbitmq-env-config
+data:
+  memory.conf: |-
+    total_memory_available_override_value = 1GB
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rabbitmq
+stringData:
+  AMQP_URL: "amqp://user:password@rabbitmq:5672/"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: rabbitmq
+    release: rabbitmq
+  name: rabbitmq
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: rabbitmq
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: rabbitmq
+    spec:
+      securityContext:
+        fsGroup: 999
+        runAsUser: 999
+        runAsGroup: 999
+      containers:
+      - env:
+        - name: RABBITMQ_DEFAULT_USER
+          value: user
+        - name: RABBITMQ_DEFAULT_PASS
+          value: password
+        - name: RABBITMQ_NODE_PORT_NUMBER
+          value: "5672"
+        - name: RABBITMQ_NODE_TYPE
+          value: stats
+        - name: RABBITMQ_NODENAME
+          value: rabbit@localhost
+        - name: RABBITMQ_CLUSTER_NODE_NAME
+        - name: RABBITMQ_DEFAULT_VHOST
+          value: /
+        - name: RABBITMQ_MANAGER_PORT_NUMBER
+          value: "15672"
+        - name: RABBITMQ_DISK_FREE_LIMIT
+          value: '"8GiB"'
+        - name: RABBITMQ_CONFIG_FILES
+          value: /etc/rabbitmq/conf.d
+        image: rabbitmq:4.2.1-management@sha256:86fa2b761fc3a71a2b73090d7e45ad820f611fc829c1cb8cf087e09258fb65c1
+        imagePullPolicy: Always
+        livenessProbe:
+          exec:
+            command:
+            - rabbitmqctl
+            - status
+          failureThreshold: 6
+          initialDelaySeconds: 120
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: rabbitmq
+        ports:
+        - containerPort: 4369
+          name: epmd
+          protocol: TCP
+        - containerPort: 5672
+          name: amqp
+          protocol: TCP
+        - containerPort: 25672
+          name: dist
+          protocol: TCP
+        - containerPort: 15672
+          name: stats
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            port: 15672
+            path: /api/aliveness-test/%2F
+            httpHeaders:
+            - name: "Authorization"
+              value: "Basic dXNlcjpwYXNzd29yZA=="
+          failureThreshold: 3
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          successThreshold: 1
+          timeoutSeconds: 3
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/rabbitmq
+        - name: config
+          mountPath: /etc/rabbitmq/conf.d/20-memory.conf
+          subPath: memory.conf
+          readOnly: true
+      volumes:
+      - name: data
+        hostPath:
+          path: /data/rabbitmq
+      - name: config
+        configMap:
+          name: rabbitmq-env-config
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: rabbitmq
+    release: rabbitmq
+  name: rabbitmq
+spec:
+  externalTrafficPolicy: Cluster
+  ports:
+  - name: epmd
+    nodePort: 31799
+    port: 4369
+    protocol: TCP
+    targetPort: epmd
+  - name: amqp
+    nodePort: 5672
+    port: 5672
+    protocol: TCP
+    targetPort: amqp
+  - name: dist
+    nodePort: 32687
+    port: 25672
+    protocol: TCP
+    targetPort: dist
+  - name: stats
+    nodePort: 15672
+    port: 15672
+    protocol: TCP
+    targetPort: stats
+  selector:
+    app.kubernetes.io/name: rabbitmq
+  sessionAffinity: None
+  type: NodePort