Skip to content

Commit b943208

Browse files
author
Ariel Rolfo
committed
add components infra
1 parent 12c6ee8 commit b943208

26 files changed

Lines changed: 251 additions & 217 deletions

‎terraform/README.md‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ eksctl create iamserviceaccount \
115115
The chart values are version-controlled at
116116
117117
```
118-
environments/staging/k8s-manifests/external-secrets-values.yaml
118+
environments/eks/k8s-manifests/external-secrets-values.yaml
119119
```
120120

121121
It contains two placeholders:
@@ -130,7 +130,7 @@ It contains two placeholders:
130130
export ROLE_ARN=$(terraform output -raw external_secrets_irsa_role_arn)
131131
export AWS_REGION=us-east-1
132132
133-
envsubst < environments/staging/k8s-manifests/external-secrets-values.yaml \
133+
envsubst < environments/eks/k8s-manifests/external-secrets-values.yaml \
134134
> /tmp/eso-values.yaml
135135
136136
# install / upgrade
@@ -142,6 +142,8 @@ helm upgrade --install eso external-secrets/external-secrets \
142142
--values /tmp/eso-values.yaml
143143
144144
rm /tmp/eso-values.yaml
145+
146+
kubectl apply -f external-secrets-operator.yaml
145147
```
146148

147149
The values set the IRSA annotation and pass `AWS_REGION` /
@@ -241,4 +243,7 @@ helm install \
241243
--version v1.18.2 \
242244
--namespace cert-manager \
243245
--create-namespace \
244-
--set crds.enabled=true
246+
--set crds.enabled=true
247+
248+
#### Make sure to add the annotation to the cert-manager SA
249+
helm upgrade cert-manager oci://quay.io/jetstack/charts/cert-manager -n cert-manager --set serviceAccount.annotations."eks\.amazonaws\.com/role-arn"=arn:aws:iam::996810415034:role/ce-registry-eks-cert-manager-irsa-role --version v1.18.2

‎terraform/environments/eks/k8s-manifests-staging/app-configmap.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: main-app-config
5+
data:
6+
POSTGRESQL_ADDRESS: eks-ce-registry-staging.cwdkv5tua6nq.us-east-1.rds.amazonaws.com
7+
POSTGRESQL_DATABASE: ceregistrystaging
8+
POSTGRESQL_USERNAME: ceregistrystaging
9+
REDIS_URL: redis://redis:6379/1
10+
RACK_ENV: production
11+
DOCKER_ENV: "true"

‎terraform/environments/eks/k8s-manifests-staging/app-deployment.yaml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: main-app
5+
labels:
6+
app: main
7+
spec:
8+
replicas: 1 # Adjust based on traffic
9+
selector:
10+
matchLabels:
11+
app: main-app
12+
strategy:
13+
rollingUpdate:
14+
maxSurge: 1
15+
maxUnavailable: 0
16+
template:
17+
metadata:
18+
labels:
19+
app: main-app
20+
spec:
21+
# Run DB migrations before starting the app
22+
initContainers:
23+
- name: db-migrate
24+
image: 996810415034.dkr.ecr.us-east-1.amazonaws.com/eks-ce-registry:eks-infrastructure
25+
imagePullPolicy: IfNotPresent
26+
command: ["/bin/bash","-lc"]
27+
args:
28+
- >-
29+
bundle exec rake db:create db:migrate RACK_ENV=production
30+
envFrom:
31+
- secretRef:
32+
name: app-secrets
33+
- configMapRef:
34+
name: main-app-config
35+
serviceAccountName: main-app-service-account
36+
containers:
37+
- name: main-app
38+
image: 996810415034.dkr.ecr.us-east-1.amazonaws.com/eks-ce-registry:eks-infrastructure
39+
imagePullPolicy: Always
40+
command: ["/bin/bash", "-c", "bin/rackup -o 0.0.0.0"]
41+
ports:
42+
- containerPort: 9292
43+
envFrom:
44+
- secretRef:
45+
name: app-secrets # DB credentials, APP_KEY, etc.
46+
- configMapRef:
47+
name: main-app-config
48+
resources:
49+
requests:
50+
cpu: "500m"
51+
memory: "256Mi"
52+
limits:
53+
cpu: "1000m"
54+
memory: "1024Mi"
55+
serviceAccountName: main-app-service-account
56+
57+
---
58+
apiVersion: v1
59+
kind: Service
60+
metadata:
61+
name: main-app
62+
spec:
63+
type: ClusterIP
64+
selector:
65+
app: main-app
66+
ports:
67+
- protocol: TCP
68+
port: 9292
69+
targetPort: 9292

terraform/environments/eks/k8s-manifests/app-hpa.yaml renamed to terraform/environments/eks/k8s-manifests-staging/app-hpa.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: autoscaling/v2
22
kind: HorizontalPodAutoscaler
33
metadata:
44
name: main-app-hpa
5-
namespace: olc
5+
namespace: credreg-staging
66
labels:
77
app: laravel
88
spec:

terraform/environments/eks/k8s-manifests/app-ingress.yaml renamed to terraform/environments/eks/k8s-manifests-staging/app-ingress.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ spec:
1111
ingressClassName: nginx
1212
tls:
1313
- hosts:
14-
- xxxx
15-
secretName: staging-ingress-tls
14+
- eks-staging.credentialengineregistry.org
15+
secretName: eks-staging-credentialengineregistry-org-tls
1616
rules:
17-
- host: xxxxx
17+
- host: eks-staging.credentialengineregistry.org
1818
http:
1919
paths:
2020
- path: /
@@ -23,7 +23,7 @@ spec:
2323
service:
2424
name: main-app
2525
port:
26-
number: 80
26+
number: 9292
2727
- path: /skooner
2828
pathType: Prefix
2929
backend:

terraform/environments/eks/k8s-manifests/app-namespace.yaml renamed to terraform/environments/eks/k8s-manifests-staging/app-namespace.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v1
22
kind: Namespace
33
metadata:
4-
name: credreg
4+
name: credreg-staging
55
labels:
66
name: main-app

terraform/environments/eks/k8s-manifests/app-secrets.yaml renamed to terraform/environments/eks/k8s-manifests-staging/app-secrets.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,3 +5,4 @@ metadata:
55
type: Opaque
66
stringData:
77
POSTGRESQL_PASSWORD=[secret value]
8+
SECRET_KEY_BASE=[openssl rand -hex 32]

terraform/environments/eks/k8s-manifests/app-service-account.yaml renamed to terraform/environments/eks/k8s-manifests-staging/app-service-account.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ kind: ServiceAccount
33
metadata:
44
name: main-app-service-account
55
annotations:
6-
eks.amazonaws.com/role-arn: "arn:aws:iam::996810415034:role/CLUSTERNAMECHANGEME-application-irsa-role"
6+
eks.amazonaws.com/role-arn: "arn:aws:iam::996810415034:role/ce-registry-eks-application-irsa-role"

‎terraform/environments/eks/k8s-manifests-staging/certificate.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: cert-manager.io/v1
2+
kind: Certificate
3+
metadata:
4+
name: eks-staging-credentialengineregistry-org-tls
5+
namespace: credreg-staging
6+
spec:
7+
secretName: eks-staging-credentialengineregistry-org-tls
8+
dnsNames:
9+
- eks-staging.credentialengineregistry.org
10+
issuerRef:
11+
name: letsencrypt-prod
12+
kind: ClusterIssuer

terraform/environments/eks/k8s-manifests/cluster-autoscaler.yaml renamed to terraform/environments/eks/k8s-manifests-staging/cluster-autoscaler.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ metadata:
1515
name: cluster-autoscaler
1616
namespace: kube-system
1717
annotations:
18-
eks.amazonaws.com/role-arn: arn:aws:iam::996810415034:role/CLUSTERNAMECHANGEME-cluster-autoscaler-irsa-role
18+
eks.amazonaws.com/role-arn: arn:aws:iam::996810415034:role/ce-registry-eks-cluster-autoscaler-irsa-role
1919

2020
---
2121
apiVersion: rbac.authorization.k8s.io/v1
@@ -113,7 +113,7 @@ spec:
113113
image: registry.k8s.io/autoscaling/cluster-autoscaler:v1.26.4
114114
command:
115115
- ./cluster-autoscaler
116-
- --cluster-name=CLUSTERNAMECHANGEME
116+
- --cluster-name=ce-registry-eks
117117
- --cloud-provider=aws
118118
- --scan-interval=10s
119119
- --balance-similar-node-groups
@@ -122,7 +122,7 @@ spec:
122122
- --aws-use-static-instance-list=true
123123
- --expander=least-waste
124124
# The line below ensures the autoscaler understands the min/max for the managed node group.
125-
- --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/CLUSTERNAMECHANGEME
125+
- --node-group-auto-discovery=asg:tag=k8s.io/cluster-autoscaler/enabled,k8s.io/cluster-autoscaler/ce-registry-eks
126126
resources:
127127
limits:
128128
cpu: 200m

0 commit comments

Comments
 (0)