fix(edu): run redis as statefulset

Keep the existing Redis PVC and data while migrating the edu-master workload from Deployment to StatefulSet.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitea/workflows/deploy.yaml

@@ -1,9 +1,6 @@
 name: deploy
 
 on:
-  push:
-    branches:
-      - main
   workflow_dispatch:
 
 concurrency:
@@ -152,4 +149,4 @@ jobs:
             fi
             docker compose -f "$cf" up -d --pull always --remove-orphans
           done
-          EOF
+          EOF

.github/workflows/deploy.yaml

@@ -1,9 +1,6 @@
 name: deploy
 
 on:
-  push:
-    branches:
-      - main
   workflow_dispatch:
 
 concurrency:
@@ -152,4 +149,4 @@ jobs:
             fi
             docker compose -f "$cf" up -d --pull always --remove-orphans
           done
-          EOF
+          EOF

.gitignore

@@ -41,6 +41,7 @@ traefik/dynamic/fileservers.yml
 traefik/dynamic/*.local.y*ml.*
 traefik/dynamic/*.external.y*ml
 traefik/k8s/fileservers.y*ml
+traefik/k8s/aliasHeadersStrategy.md
 
 traefik/logs/*
 

checkmk/k8s/checkmk.yaml

@@ -7,8 +7,12 @@ spec:
   selector:
     app: checkmk
   ports:
-    - port: 5000
+    - name: web
+      port: 5000
       targetPort: 5000
+    - name: agent-receiver
+      port: 8000
+      targetPort: 8000
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -34,7 +38,10 @@ spec:
             - configMapRef:
                 name: checkmk-config
           ports:
-            - containerPort: 5000
+            - name: web
+              containerPort: 5000
+            - name: agent-receiver
+              containerPort: 8000
           volumeMounts:
             - name: sites
               mountPath: /omd/sites

checkmk/k8s/ingress.yaml

@@ -16,6 +16,22 @@ spec:
     certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: checkmk-agent-receiver
+  namespace: checkmk
+spec:
+  entryPoints:
+    - checkmk-agent
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: checkmk-service
+          port: 8000
+  tls:
+    passthrough: true
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: checkmk-local

edu_master/.env.example

@@ -9,5 +9,6 @@ WEBINAR_CHECK_INTERVAL=60
 REDIS_HOST=redis
 REDIS_PORT=6379
 PLAYWRIGHT_WS=ws://playwright-service:3000/ws
+TZ=Europe/Kyiv
 WEBINAR_TELEGRAM_TOKEN=your_telegram_bot_token_here
 WEBINAR_ADMIN_ID=123456789

edu_master/k8s/redis.yaml

@@ -1,11 +1,12 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
   name: redis
   namespace: edu-master
   labels:
     app: edu-master-redis
 spec:
+  serviceName: redis
   replicas: 1
   selector:
     matchLabels:

edu_master/k8s/restore-seed-job.yaml.example

@@ -1,17 +1,17 @@
-# Разовый Job для переноса состояния redis из docker compose в k8s (maintenance window).
-# Файл .example -> deploy-пайплайн его не применяет (маска *.example.yaml).
+# One-time Job to migrate redis state from docker compose to k8s (maintenance window).
+# The .example file is not applied by the deploy pipeline (mask *.example.yaml).
 #
 # Runbook:
-#   1. docker compose -f <repo>/edu_master/compose.yaml stop        # SIGTERM -> redis сбросит dump.rdb
+#   1. docker compose -f <repo>/edu_master/compose.yaml stop        # SIGTERM -> redis will flush dump.rdb
 #   2. docker run --rm -v edu_master_redis-data:/data \
 #        -v /tmp/edu-master-backup:/backup \
 #        redis:alpine sh -c "cp /data/dump.rdb /backup/ && ls -la /backup"
 #   3. kubectl apply -f edu_master/k8s/namespace.yaml
-#   4. kubectl apply -f <только PVC из redis.yaml>                  # seed строго ДО старта redis-пода
+#   4. kubectl apply -f <only the PVC from redis.yaml>              # seed must come BEFORE redis pod starts
 #   5. kubectl apply -f edu_master/k8s/restore-seed-job.yaml.example
 #      kubectl wait --for=condition=complete job/redis-restore-seed -n edu-master --timeout=120s
 #   6. kubectl delete job redis-restore-seed -n edu-master
-#   7. kubectl apply -f edu_master/k8s/ -R                           # остальные манифесты
+#   7. kubectl apply -f edu_master/k8s/ -R                           # apply remaining manifests
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -47,4 +47,4 @@ spec:
         - name: backup
           hostPath:
             path: /tmp/edu-master-backup
-            type: DirectoryOrCreate
+            type: DirectoryOrCreate

edu_master/k8s/secrets.yaml.example

@@ -5,7 +5,7 @@ metadata:
   namespace: edu-master
 type: Opaque
 stringData:
-  # PHPSESSID keeper
+  # Session keeper credentials
   KEEPER_LOGIN: ""
   KEEPER_PASSWORD: ""
   KEEPER_INTERVAL: "10"
@@ -23,4 +23,5 @@ stringData:
   WEBINAR_CHECK_INTERVAL: "60"
   # Database
   REDIS_HOST: "redis"
-  REDIS_PORT: "6379"
+  REDIS_PORT: "6379"
+  TZ: "Europe/Kyiv"

edu_master/k8s/webinar-checker.yaml

@@ -15,9 +15,9 @@ spec:
       labels:
         app: edu-master-webinar-checker
     spec:
+      # Enforces dependency order like compose depends_on:
+      # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
       initContainers:
-        # Держит порядок зависимостей как в compose depends_on:
-        # redis healthy -> session-keeper healthy (EXISTS EDU_PHPSESSID) -> playwright started
         - name: wait-deps
           image: redis:alpine
           command:
@@ -50,6 +50,9 @@ spec:
           envFrom:
             - secretRef:
                 name: edu-master-secrets
+          env:
+            - name: TZ
+              value: "Europe/Kyiv"
           resources:
             requests:
               cpu: 25m

traefik/k8s/traefik-values.yaml

@@ -3,7 +3,7 @@ hostNetwork: false
 image:
   registry: docker.io/library
   repository: traefik
-  tag: v3.7.6
+  tag: v3.7.13
 
 securityContext:
   capabilities:
@@ -44,6 +44,7 @@ ports:
   web:
     port: 80
     http:
+      aliasHeadersStrategy: delete
       redirections:
         entryPoint:
           to: websecure
@@ -52,32 +53,54 @@ ports:
   websecure:
     port: 443
     http:
+      aliasHeadersStrategy: delete
       tls:
         enabled: true
+  traefik:
+    port: 8080
+    exposedPort: 8080
+    protocol: TCP
+    expose:
+      default: false
+    http:
+      aliasHeadersStrategy: delete
   ssh:
     port: 2221
     exposedPort: 2221
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-tcp:
     port: 25565
     exposedPort: 25565
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-udp:
     port: 19132
     exposedPort: 19132
     protocol: UDP
     expose:
       default: true
+  checkmk-agent:
+    port: 8000
+    protocol: TCP
+    expose:
+      default: true
+    http:
+      aliasHeadersStrategy: delete
   metrics:
     port: 9100
     exposedPort: 9100
     protocol: TCP
     expose:
       default: false
+    http:
+      aliasHeadersStrategy: delete
 
 metrics:
   prometheus:
@@ -122,11 +145,6 @@ additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"
   - "--providers.file.watch=true"
   - "--providers.kubernetesCRD.allowCrossNamespace=true"
+  - "--providers.kubernetesCRD.safeNaming=false"
   - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
   - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
-
-log:
-  level: INFO
-accessLog:
-  enabled: true
-  format: common