fix(edu): run redis as statefulset

Keep the existing Redis PVC and data while migrating the edu-master workload from Deployment to StatefulSet.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.gitea/workflows/deploy.yaml

@@ -1,9 +1,6 @@
 name: deploy
 
 on:
-  push:
-    branches:
-      - main
   workflow_dispatch:
 
 concurrency:

.github/workflows/deploy.yaml

@@ -1,9 +1,6 @@
 name: deploy
 
 on:
-  push:
-    branches:
-      - main
   workflow_dispatch:
 
 concurrency:

.gitignore

@@ -41,6 +41,7 @@ traefik/dynamic/fileservers.yml
 traefik/dynamic/*.local.y*ml.*
 traefik/dynamic/*.external.y*ml
 traefik/k8s/fileservers.y*ml
+traefik/k8s/aliasHeadersStrategy.md
 
 traefik/logs/*
 

checkmk/k8s/checkmk.yaml

@@ -7,8 +7,12 @@ spec:
   selector:
     app: checkmk
   ports:
-    - port: 5000
+    - name: web
+      port: 5000
       targetPort: 5000
+    - name: agent-receiver
+      port: 8000
+      targetPort: 8000
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -34,7 +38,10 @@ spec:
             - configMapRef:
                 name: checkmk-config
           ports:
-            - containerPort: 5000
+            - name: web
+              containerPort: 5000
+            - name: agent-receiver
+              containerPort: 8000
           volumeMounts:
             - name: sites
               mountPath: /omd/sites

checkmk/k8s/ingress.yaml

@@ -16,6 +16,22 @@ spec:
     certResolver: letsencrypt
 ---
 apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: checkmk-agent-receiver
+  namespace: checkmk
+spec:
+  entryPoints:
+    - checkmk-agent
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: checkmk-service
+          port: 8000
+  tls:
+    passthrough: true
+---
+apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
   name: checkmk-local

edu_master/k8s/redis.yaml

@@ -1,11 +1,12 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
   name: redis
   namespace: edu-master
   labels:
     app: edu-master-redis
 spec:
+  serviceName: redis
   replicas: 1
   selector:
     matchLabels:

traefik/k8s/traefik-values.yaml

@@ -3,7 +3,7 @@ hostNetwork: false
 image:
   registry: docker.io/library
   repository: traefik
-  tag: v3.7.6
+  tag: v3.7.13
 
 securityContext:
   capabilities:
@@ -44,6 +44,7 @@ ports:
   web:
     port: 80
     http:
+      aliasHeadersStrategy: delete
       redirections:
         entryPoint:
           to: websecure
@@ -52,32 +53,54 @@ ports:
   websecure:
     port: 443
     http:
+      aliasHeadersStrategy: delete
       tls:
         enabled: true
+  traefik:
+    port: 8080
+    exposedPort: 8080
+    protocol: TCP
+    expose:
+      default: false
+    http:
+      aliasHeadersStrategy: delete
   ssh:
     port: 2221
     exposedPort: 2221
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-tcp:
     port: 25565
     exposedPort: 25565
     protocol: TCP
     expose:
       default: true
+    http:
+      aliasHeadersStrategy: delete
   minecraft-udp:
     port: 19132
     exposedPort: 19132
     protocol: UDP
     expose:
       default: true
+  checkmk-agent:
+    port: 8000
+    protocol: TCP
+    expose:
+      default: true
+    http:
+      aliasHeadersStrategy: delete
   metrics:
     port: 9100
     exposedPort: 9100
     protocol: TCP
     expose:
       default: false
+    http:
+      aliasHeadersStrategy: delete
 
 metrics:
   prometheus:
@@ -122,11 +145,6 @@ additionalArguments:
   - "--providers.file.directory=/etc/traefik/dynamic"
   - "--providers.file.watch=true"
   - "--providers.kubernetesCRD.allowCrossNamespace=true"
+  - "--providers.kubernetesCRD.safeNaming=false"
   - "--entryPoints.websecure.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
   - "--entryPoints.web.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/13,104.24.0.0/14,172.64.0.0/13,131.0.72.0/22,192.168.1.1,192.168.1.0/24,192.168.88.0/24,192.168.88.1"
-
-log:
-  level: INFO
-accessLog:
-  enabled: true
-  format: common