Merge branch 'mrtz/prod-plume' into 'main'

feat: Create production instance of plume

See merge request oceanbox/manifests!13

values/atlantis/kustomize/prod/appsettings.json

@@ -67,6 +67,7 @@
             "roles": [ "admin" ]
         }
     ],
+    "plume": "plume.data.oceanbox.io",
     "redis": "prod-atlantis-redis-master:6379",
     "objectStore": "https://atlantis.blob.core.windows.net",
     "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",

values/atlantis/kustomize/staging/appsettings.json

@@ -67,6 +67,7 @@
             "roles": [ "admin" ]
         }
     ],
+    "plume": "plume.ekman.oceanbox.io",
     "redis": "staging-atlantis-redis-master:6379",
     "objectStore": "https://atlantis.blob.core.windows.net",
     "connString": "Username=postgres;Password=secret;Host=localhost;Port=5432;Database=app;Pooling=true;",

values/atlantis/manifests/network/allow-plume.yaml

@@ -8,6 +8,7 @@ spec:
   egress:
     - toFQDNs:
         - matchPattern: 'plume.data.oceanbox.io'
+        - matchPattern: 'plume.ekman.oceanbox.io'
   endpointSelector:
     matchLabels:
       app.kubernetes.io/name: atlantis

values/plume/kustomize/prod/appsettings.json

@@ -0,0 +1,8 @@
+{
+    "archmaesterUrl": "https://maps.oceanbox.io",
+    "appName": "plume",
+    "appEnv": "prod",
+    "appNamespace": "prod-plume",
+    "appVersion": "1.0.0",
+    "cacheDir": "/data/archives/cache"
+}

values/plume/kustomize/prod/deployment_patch.yaml

@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/template/spec/containers/0/volumeMounts/0/mountPath
+  value: /data

values/plume/kustomize/prod/kustomization.yaml

@@ -0,0 +1,17 @@
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+- name: prod-plume-appsettings
+  files:
+    - appsettings.json
+patches:
+- target:
+    group: apps
+    version: v1
+    kind: Deployment
+  path: deployment_patch.yaml
+resources:
+- ../base
+- pv.yaml
+- pvc.yaml
+- pubsub.yaml

values/plume/kustomize/prod/pubsub.yaml

@@ -0,0 +1,54 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: pubsub
+spec:
+  version: v1
+  type: pubsub.rabbitmq
+  metadata:
+  - name: hostname
+    secretKeyRef:
+      name: prod-rabbitmq
+      key:  connString
+  - name: username
+    value: user
+  - name: password
+    secretKeyRef:
+      name: prod-rabbitmq
+      key:  rabbitmq-password
+  - name: protocol
+    value: amqp
+  - name: durable
+    value: true
+  - name: deletedWhenUnused
+    value: false
+  - name: autoAck
+    value: false
+  - name: deliveryMode
+    value: 1
+  - name: requeueInFailure
+    value: false
+  - name: prefetchCount
+    value: 0
+  - name: reconnectWait
+    value: 0
+  - name: concurrencyMode
+    value: parallel
+  - name: publisherConfirm
+    value: false
+  - name: backOffPolicy
+    value: exponential
+  - name: backOffInitialInterval
+    value: 100
+  - name: backOffMaxRetries
+    value: 16
+  - name: enableDeadLetter # Optional enable dead Letter or not
+    value: true
+  - name: maxLen # Optional max message count in a queue
+    value: 3000
+  - name: maxLenBytes # Optional maximum length in bytes of a queue.
+    value: 10485760
+  - name: exchangeKind
+    value: fanout
+  - name: clientName
+    value: "{appID}"

values/plume/kustomize/prod/pv.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-prod-plume-ceph-archives
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-prod-plume-ceph-archives
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem

values/plume/kustomize/prod/pvc.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prod-plume-ceph-archives
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-prod-plume-ceph-archives
+status:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi

values/plume/values/values-prod.yaml

@@ -0,0 +1,51 @@
+replicaCount: 1
+image:
+  tag: 0cb7f469-debug
+podAnnotations:
+  dapr.io/enabled: "true"
+  dapr.io/app-id: "prod-plume"
+  dapr.io/app-port: "8085"
+  dapr.io/api-token-secret: "dapr-api-token"
+  dapr.io/app-protocol: "http"
+  dapr.io/log-as-json: "true"
+  dapr.io/sidecar-cpu-request: "10m"
+  dapr.io/sidecar-memory-request: "50Mi"
+env:
+  - name: DAPR_API_TOKEN
+    valueFrom:
+      secretKeyRef:
+        name: dapr-api-token
+        key: token
+ingress:
+  enabled: true
+  className: "nginx"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    oceanbox.io/expose: internal
+  hosts:
+    - host: plume.data.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+      internal:
+        - path: /internal
+          pathType: ImplementationSpecific
+        - path: /dapr
+          pathType: ImplementationSpecific
+        - path: /actors
+          pathType: ImplementationSpecific
+        - path: /job
+          pathType: ImplementationSpecific
+        - path: /events
+          pathType: ImplementationSpecific
+        - path: /metrics
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - plume.data.oceanbox.io
+      secretName: plume-tls
+persistence:
+  enabled: true
+  existingClaim: prod-plume-ceph-archives

values/plume/values/values-staging.yaml

@@ -25,7 +25,7 @@ ingress:
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     oceanbox.io/expose: internal
   hosts:
-    - host: plume.data.oceanbox.io
+    - host: plume.ekman.oceanbox.io
       paths:
         - path: /
           pathType: ImplementationSpecific
@@ -44,8 +44,8 @@ ingress:
           pathType: ImplementationSpecific
   tls:
     - hosts:
-        - plume.data.oceanbox.io
+        - plume.ekman.oceanbox.io
-      secretName: plume-tls
+      secretName: staging-plume-tls
 persistence:
   enabled: true
   existingClaim: staging-plume-ceph-archives