fix(edu): run redis as statefulset

Keep the existing Redis PVC and data while migrating the edu-master workload from Deployment to StatefulSet.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitignore

@@ -41,6 +41,7 @@ traefik/dynamic/fileservers.yml
 traefik/dynamic/*.local.y*ml.*
 traefik/dynamic/*.external.y*ml
 traefik/k8s/fileservers.y*ml
+traefik/k8s/aliasHeadersStrategy.md
 
 traefik/logs/*
 

checkmk/k8s/checkmk.yaml

@@ -7,8 +7,12 @@ spec:
   selector:
     app: checkmk
   ports:
-    - port: 5000
+    - name: web
+      port: 5000
       targetPort: 5000
+    - name: agent-receiver
+      port: 8000
+      targetPort: 8000
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -34,7 +38,10 @@ spec:
             - configMapRef:
                 name: checkmk-config
           ports:
-            - containerPort: 5000
+            - name: web
+              containerPort: 5000
+            - name: agent-receiver
+              containerPort: 8000
           volumeMounts:
             - name: sites
               mountPath: /omd/sites

checkmk/k8s/ingress.yaml

@@ -16,6 +16,22 @@ spec:
     certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: checkmk-agent-receiver
+  namespace: checkmk
+spec:
+  entryPoints:
+    - checkmk-agent
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: checkmk-service
+          port: 8000
+  tls:
+    passthrough: true
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: checkmk-local

edu_master/k8s/redis.yaml

@@ -1,11 +1,12 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
   name: redis
   namespace: edu-master
   labels:
     app: edu-master-redis
 spec:
+  serviceName: redis
   replicas: 1
   selector:
     matchLabels:

esp32/ingress.yaml

@@ -1,95 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: esp32
-  labels:
-    app.kubernetes.io/name: esp32
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: esp
-  namespace: esp32
-  labels:
-    app.kubernetes.io/name: esp32
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      port: 80
-      targetPort: 80
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: esp
-  namespace: esp32
-  labels:
-    app.kubernetes.io/name: esp32
-subsets:
-  - addresses:
-      - ip: 192.168.88.88
-    ports:
-      - name: http
-        port: 80
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: strip-esp-headers
-  namespace: esp32
-  labels:
-    app.kubernetes.io/name: esp32
-spec:
-  headers:
-    customRequestHeaders:
-      Cookie: ""
-      Referer: ""
-      Origin: ""
-      User-Agent: ""
-      Accept: ""
-      Accept-Encoding: ""
-      Accept-Language: ""
-      Upgrade-Insecure-Requests: ""
-      Cache-Control: ""
-      Pragma: ""
-      Connection: ""
-      Te: ""
-      Sec-Fetch-Dest: ""
-      Sec-Fetch-Mode: ""
-      Sec-Fetch-Site: ""
-      Sec-Fetch-User: ""
-      Sec-CH-UA: ""
-      Sec-CH-UA-Mobile: ""
-      Sec-CH-UA-Platform: ""
-      X-Forwarded-For: ""
-      X-Forwarded-Host: ""
-      X-Forwarded-Port: ""
-      X-Forwarded-Proto: ""
-      X-Forwarded-Server: ""
-      Forwarded: ""
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: esp
-  namespace: esp32
-  labels:
-    app.kubernetes.io/name: esp32
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`esp.forust.xyz`)
-      kind: Rule
-      middlewares:
-        - name: strip-esp-headers
-          namespace: esp32
-      services:
-        - kind: Service
-          name: esp
-          namespace: esp32
-          port: 80
-  tls:
-    certResolver: letsencrypt

traefik/k8s/traefik-values.yaml

@@ -3,7 +3,7 @@ hostNetwork: false
 image:
   registry: docker.io/library
   repository: traefik
-  tag: v3.7.6
+  tag: v3.7.13
 
 securityContext:
   capabilities:
@@ -44,6 +44,7 @@ ports:
   web:
     port: 80
     http:
+      aliasHeadersStrategy: delete
       redirections:
         entryPoint:
           to: websecure
@@ -52,32 +53,54 @@ ports:
   websecure:
     port: 443
     http:
+      aliasHeadersStrategy: delete
       tls:
         enabled: true
+  traefik:
+    port: 8080
+    exposedPort: 8080
+    protocol: TCP
+    expose:
+      default: false
+    http:
+      aliasHeadersStrategy: delete
   ssh:
     port: 2221
     exposedPort: 2221
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-tcp:
     port: 25565
     exposedPort: 25565
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-udp:
     port: 19132
     exposedPort: 19132
     protocol: UDP
     expose:
       default: true
+  checkmk-agent:
+    port: 8000
+    protocol: TCP
+    expose:
+      default: true
+    http:
+      aliasHeadersStrategy: delete
   metrics:
     port: 9100
     exposedPort: 9100
     protocol: TCP
     expose:
       default: false
+    http:
+      aliasHeadersStrategy: delete
 
 metrics:
   prometheus:
@@ -122,11 +145,6 @@ additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"
   - "--providers.file.watch=true"
   - "--providers.kubernetesCRD.allowCrossNamespace=true"
+  - "--providers.kubernetesCRD.safeNaming=false"
   - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
   - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
-
-log:
-  level: INFO
-accessLog:
-  enabled: true
-  format: common