k3s.yml

apiVersion: traefik.io/v1alpha1
kind: IngressRoute
metadata:
  name: dev.cruiser-secure-ingress
spec:
  entryPoints:
    - websecure
  routes:
    - kind: Rule
      match: Host(`dev.cruiser.dev`)
      services:
        - name: cruiser
          port: 80
  tls:
    secretName: dev.cruiser.dev-tls

---

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pvc-cruiser-filestore
spec:
  capacity:
    storage: 16Gi
  hostPath:
    path: >-
      /var/lib/rancher/k3s/storage/pvc-cruiser-filestore
    type: DirectoryOrCreate
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Delete
  storageClassName: local-path
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values:
                - k3s-02

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cruiser-filestore-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 4Gi
  volumeName: pvc-cruiser-filestore
  storageClassName: local-path
  volumeMode: Filesystem

---

apiVersion: v1
kind: Service
metadata:
  name: cruiser
spec:
  selector:
    app: cruiser
  ports:
  - protocol: "TCP"
    port: 80
    targetPort: 8080
  type: ClusterIP

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cruiser
spec:
  selector:
    matchLabels:
      app: cruiser
  replicas: 1
  template:
    metadata:
      labels:
        app: cruiser
    spec:
      volumes:
        - name: filestore
          persistentVolumeClaim:
            claimName: cruiser-filestore-pvc
      serviceAccountName: cruiser-server
      containers:
      - name: cruiser
        image: harbor.dotglitch.dev/library/cruiser:latest
        resources:
          requests:
            cpu: 10m
            memory: 100Mi
          limits:
            cpu: 500m
            memory: 1000Mi
        ports:
        - containerPort: 8080
        env:
        - name: SURREAL_URL
          value: 'http://cruiser-db.cruiser-dev.svc.cluster.local:8000'
        - name: CRUISER_AGENT_NAMESPACE
          value: cruiser-dev
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: "http://dynatrace-otel-collector.dynatrace-otel.svc.cluster.local:4318/v1/traces"
        - name: CRUISER_ADMINISTRATOR
          valueFrom:
            configMapKeyRef:
              name: cruiser-config
              key: CRUISER_ADMINISTRATOR
        - name: SURREAL_USER
          valueFrom:
            secretKeyRef:
              name: cruiser-db-secret
              key: SURREAL_USER
        - name: SURREAL_PASSWORD
          valueFrom:
            secretKeyRef:
              name: cruiser-db-secret
              key: SURREAL_PASS
        - name: SESSION_SECRET
          valueFrom:
            secretKeyRef:
              name: cruiser-secret
              key: SESSION_SECRET
        - name: GITHUB_OAUTH_SECRET
          valueFrom:
            secretKeyRef:
              name: cruiser-github-secret
              key: GITHUB_OAUTH_SECRET
        - name: GITHUB_OAUTH_CLIENTID
          valueFrom:
            secretKeyRef:
              name: cruiser-github-secret
              key: GITHUB_OAUTH_CLIENTID
        - name: CRUISER_CLUSTER_URL
          valueFrom:
            configMapKeyRef:
              name: cruiser-config
              key: CRUISER_CLUSTER_URL
        volumeMounts:
          - name: filestore
            mountPath: /filestore
        securityContext:
          privileged: false
          allowPrivilegeEscalation: false
        #   readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 101
          capabilities:
            drop:
              - ALL
        livenessProbe:
          httpGet:
            path: /manifest.webmanifest
            port: 8080
          initialDelaySeconds: 60
          failureThreshold: 3
          periodSeconds: 10
      imagePullSecrets:
      - name: harbor-key

---

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: dev.cruiser.dev
spec:
  commonName: dev.cruiser.dev
  dnsNames:
    - dev.cruiser.dev
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-prod
  secretName: dev.cruiser.dev-tls

---

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pvc-cruiser-db
spec:
  capacity:
    storage: 16Gi
  hostPath:
    path: >-
      /var/lib/rancher/k3s/storage/pvc-cruiser-db
    type: DirectoryOrCreate
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Delete
  storageClassName: local-path
  nodeAffinity:
    required:
      nodeSelectorTerms:
        - matchExpressions:
            - key: kubernetes.io/hostname
              operator: In
              values:
                - k3s-03

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: cruiser-db-pvc
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 16Gi
  volumeName: pvc-cruiser-db
  storageClassName: local-path
  volumeMode: Filesystem

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cruiser-db
  namespace: cruiser-dev
spec:
  selector:
    matchLabels:
      app: cruiser-db
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: cruiser-db
    spec:
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: cruiser-db-pvc
      containers:
      - name: cruiser-db
        image: surrealdb/surrealdb:v1.5.4
        ports:
          - containerPort: 8000
        resources:
          requests:
            cpu: 10m
            memory: 100Mi
          limits:
            cpu: 500m
            memory: 1000Mi
        args: ["start", "file:/data/database.db"]
        volumeMounts:
          - name: data
            mountPath: /data
        securityContext:
          privileged: false
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
        #   fsGroup: 1000
          runAsUser: 1000
          runAsGroup: 1000
          capabilities:
            drop:
              - ALL
        env:
        - name: SURREAL_AUTH
          value: 'true'
        - name: SURREAL_CAPS_ALLOW_ALL
          value: 'true'
        - name: SURREAL_LOG
          valueFrom:
            configMapKeyRef:
              name: cruiser-db-config
              key: SURREAL_LOG
              optional: true
        - name: SURREAL_USER
          valueFrom:
            secretKeyRef:
              name: cruiser-db-secret
              key: SURREAL_USER
        - name: SURREAL_PASS
          valueFrom:
            secretKeyRef:
              name: cruiser-db-secret
              key: SURREAL_PASS
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: http://dynatrace-otel-collector.dynatrace-otel.svc.cluster.local:4318/
        - name: SURREAL_TRACING_TRACER
          value: otlp

---

apiVersion: v1
kind: Service
metadata:
  name: cruiser-db
spec:
  selector:
    app: cruiser-db
  ports:
  - protocol: "TCP"
    port: 8000
    targetPort: 8000
  type: ClusterIP

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cruiser-server

---

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cruiser-server-job-scheduler
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cruiser-server-job-scheduler-binding
subjects:
  - kind: ServiceAccount
    name: cruiser-server
roleRef:
  kind: Role
  name: cruiser-server-job-scheduler
  apiGroup: rbac.authorization.k8s.io