k8s: fixes and formating

- Add checkmk secrets example
- space-tab fixes (linter)
- switcher kener redis to statefulset
- disabled netronome voulme mount (not needed). postgres statefulset instead
-  switched naio to 8888 port (traefik port conflict)
- changed nextcloud ips and ports to prod

checkmk/k8s/secrets.yaml.example

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: checkmk-secrets
+  namespace: checkmk
+type: Opaque
+stringData:
+  CMK_PASSWORD: "password"

dockmon/k8s/dockmon.yaml

@@ -7,8 +7,8 @@ spec:
   selector:
     app: dockmon
   ports:
-  - port: 443
-    targetPort: 443
+    - port: 443
+      targetPort: 443
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -26,39 +26,39 @@ spec:
         app: dockmon
     spec:
       containers:
-      - name: dockmon
-        image: darthnorse/dockmon:latest
-        ports:
-        - containerPort: 443
-        volumeMounts:
-        - name: data
-          mountPath: /app/data
-        - name: docker-sock
-          mountPath: /var/run/docker.sock
-        livenessProbe:
-          httpGet:
-            path: /health
-            port: 443
-            scheme: HTTPS
-          initialDelaySeconds: 30
-          periodSeconds: 30
-          timeoutSeconds: 10
-          failureThreshold: 3
-        resources:
-          requests:
-            memory: "512Gi"
-            cpu: "200m"
-          limits:
-            memory: "2Gi"
-            cpu: "1500m "
+        - name: dockmon
+          image: darthnorse/dockmon:latest
+          ports:
+            - containerPort: 443
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            - name: docker-sock
+              mountPath: /var/run/docker.sock
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 443
+              scheme: HTTPS
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "200m"
+            limits:
+              memory: "2Gi"
+              cpu: "1500m "
       volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: dockmon-data-pvc
-      - name: docker-sock
-        hostPath:
-          path: /var/run/docker.sock
-          type: Socket
+        - name: data
+          persistentVolumeClaim:
+            claimName: dockmon-data-pvc
+        - name: docker-sock
+          hostPath:
+            path: /var/run/docker.sock
+            type: Socket
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
@@ -67,7 +67,7 @@ metadata:
   namespace: dockmon
 spec:
   accessModes:
-  - ReadWriteOnce
+    - ReadWriteOnce
   resources:
     requests:
       storage: 1Gi

kener/k8s/redis.yaml

@@ -1,21 +1,10 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: kener-redis-service
-  namespace: kener
-spec:
-  selector:
-    app: kener-redis
-  ports:
-  - port: 6379
-    targetPort: 6379
----
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
-  name: kener-redis-deployment
+  name: kener-redis
   namespace: kener
 spec:
+  serviceName: kener-redis-service
   replicas: 1
   selector:
     matchLabels:
@@ -26,26 +15,18 @@ spec:
         app: kener-redis
     spec:
       containers:
-      - name: redis
-        image: redis:7-alpine
-        ports:
-        - containerPort: 6379
-        volumeMounts:
-        - name: redis-data
-          mountPath: /data
-      volumes:
-      - name: redis-data
-        persistentVolumeClaim:
-          claimName: kener-redis-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: kener-redis-pvc
-  namespace: kener
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
+        - name: redis
+          image: redis:7-alpine
+          ports:
+            - containerPort: 6379
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+  volumeClaimTemplates:
+    - metadata:
+        name: redis-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        resources:
+          requests:
+            storage: 1Gi

netronome/k8s/netronome.yaml

@@ -7,9 +7,9 @@ spec:
   selector:
     app: netronome
   ports:
-  - port: 7575
-    protocol: TCP
-    targetPort: 7575
+    - port: 7575
+      protocol: TCP
+      targetPort: 7575
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -29,49 +29,30 @@ spec:
         app: netronome
     spec:
       containers:
-      - name: netronome
-        image: ghcr.io/autobrr/netronome:latest
-        ports:
-        - name: netronome-port
-          protocol: TCP
-          containerPort: 7575
-        envFrom:
-        - configMapRef:
-            name: netronome-config
-        env:
-        - name: NETRONOME__DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: netronome-secret
-              key: NETRONOME__DB_USER
-        - name: NETRONOME__DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: netronome-secret
-              key: NETRONOME__DB_PASSWORD
-        resources:
-          requests:
-            memory: "512Mi"
-            cpu: "500m"
-          limits:
-            memory: "1Gi"
-            cpu: "1000m"
-        volumeMounts:
-        - name: netronome-data
-          mountPath: /data
-      volumes:
-      - name: netronome-data
-        persistentVolumeClaim:
-          claimName: netronome-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: netronome-pvc
-  namespace: netronome
-spec:
-  resources:
-    requests:
-      storage: 1Gi
-  accessModes:
-    - ReadWriteOnce
+        - name: netronome
+          image: ghcr.io/autobrr/netronome:latest
+          ports:
+            - name: netronome-port
+              protocol: TCP
+              containerPort: 7575
+          envFrom:
+            - configMapRef:
+                name: netronome-config
+          env:
+            - name: NETRONOME__DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_USER
+            - name: NETRONOME__DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_PASSWORD
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"

netronome/k8s/postgres.yaml

@@ -0,0 +1,71 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netronome-postgres-service
+  namespace: netronome
+spec:
+  selector:
+    app: netronome-postgres
+  ports:
+    - protocol: TCP
+      port: 5432
+      targetPort: 5432
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: netronome-postgres
+  namespace: netronome
+spec:
+  serviceName: "netronome-postgres-service"
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netronome-postgres
+  template:
+    metadata:
+      labels:
+        app: netronome-postgres
+    spec:
+      containers:
+        - name: netronome-postgres
+          image: postgres:17-alpine
+          ports:
+            - name: postgres-port
+              protocol: TCP
+              containerPort: 5432
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_USER
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: netronome-secrets
+                  key: NETRONOME__DB_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                configMapKeyRef:
+                  name: netronome-config
+                  key: NETRONOME__DB_NAME
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "500m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          volumeMounts:
+            - name: netronome-pg-data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: netronome-pg-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi

nextcloud/compose.yaml

@@ -9,7 +9,7 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       - /dev/dri:/dev/dri
     ports:
-      - 8080:8080
+      - 8888:8080
     networks:
       - nextcloud-aio
       - proxy # Optional: Connects the mastercontainer to the proxy network in order to make the built-in reverse proxy detection work. See https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md

nextcloud/k8s/external-service.yaml

@@ -5,8 +5,8 @@ metadata:
   namespace: nextcloud
 spec:
   ports:
-  - port: 11000
-    targetPort: 11000
+    - port: 11000
+      targetPort: 11000
 ---
 apiVersion: discovery.k8s.io/v1
 kind: EndpointSlice
@@ -17,11 +17,11 @@ metadata:
     kubernetes.io/service-name: nextcloud-apache
 addressType: IPv4
 ports:
-- port: 11000
-  protocol: TCP
+  - port: 11000
+    protocol: TCP
 endpoints:
-- addresses:
-  - "192.168.49.1"
+  - addresses:
+      - "192.168.88.100"
 ---
 apiVersion: v1
 kind: Service
@@ -30,8 +30,8 @@ metadata:
   namespace: nextcloud
 spec:
   ports:
-  - port: 8080
-    targetPort: 8080
+    - port: 8080
+      targetPort: 8888
 ---
 apiVersion: discovery.k8s.io/v1
 kind: EndpointSlice
@@ -42,8 +42,8 @@ metadata:
     kubernetes.io/service-name: nextcloud-aio
 addressType: IPv4
 ports:
-- port: 8080
-  protocol: TCP
+  - port: 8888
+    protocol: TCP
 endpoints:
-- addresses:
-  - "192.168.49.1"
+  - addresses:
+      - "192.168.88.100"

nextcloud/k8s/ingress.yaml

@@ -8,13 +8,13 @@ spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`nextcloud.forust.xyz`)
-    kind: Rule
-    middlewares:
-    - name: nextcloud-chain@file
-    services:
-    - name: nextcloud-apache
-      port: 11000
+    - match: Host(`nextcloud.forust.xyz`)
+      kind: Rule
+      middlewares:
+        - name: nextcloud-chain@file
+      services:
+        - name: nextcloud-apache
+          port: 11000
   tls:
     certResolver: letsencrypt
 ---
@@ -27,13 +27,13 @@ spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`nextcloud.workstation.internal`)
-    kind: Rule
-    middlewares:
-    - name: nextcloud-chain@file
-    services:
-    - name: nextcloud-apache
-      port: 11000
+    - match: Host(`nextcloud.workstation.internal`)
+      kind: Rule
+      middlewares:
+        - name: nextcloud-chain@file
+      services:
+        - name: nextcloud-apache
+          port: 11000
   tls:
     secretName: local-tls
 ---
@@ -46,13 +46,13 @@ spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`nextcloud.gigaforust.internal`)
-    kind: Rule
-    middlewares:
-    - name: nextcloud-chain@file
-    services:
-    - name: nextcloud-apache
-      port: 11000
+    - match: Host(`nextcloud.gigaforust.internal`)
+      kind: Rule
+      middlewares:
+        - name: nextcloud-chain@file
+      services:
+        - name: nextcloud-apache
+          port: 11000
   tls:
     secretName: local-tls
 ---
@@ -66,13 +66,13 @@ spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`naio.forust.xyz`)
-    kind: Rule
-    services:
-    - name: nextcloud-aio
-      port: 8080
-      scheme: https
-      serversTransport: insecureTransport@file
+    - match: Host(`naio.forust.xyz`)
+      kind: Rule
+      services:
+        - name: nextcloud-aio
+          port: 8888
+          scheme: https
+          serversTransport: insecure-transport # <-- Ссылка на ваш CRD ресурс вместо @file
   tls:
     certResolver: letsencrypt
 ---
@@ -85,13 +85,13 @@ spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`naio.workstation.internal`)
-    kind: Rule
-    services:
-    - name: nextcloud-aio
-      port: 8080
-      scheme: https
-      serversTransport: insecureTransport@file
+    - match: Host(`naio.workstation.internal`)
+      kind: Rule
+      services:
+        - name: nextcloud-aio
+          port: 8888
+          scheme: https
+          serversTransport: insecure-transport
   tls:
     secretName: local-tls
 ---
@@ -104,12 +104,12 @@ spec:
   entryPoints:
     - websecure
   routes:
-  - match: Host(`naio.gigaforust.internal`)
-    kind: Rule
-    services:
-    - name: nextcloud-aio
-      port: 8080
-      scheme: https
-      serversTransport: insecureTransport@file
+    - match: Host(`naio.gigaforust.internal`)
+      kind: Rule
+      services:
+        - name: nextcloud-aio
+          port: 8888
+          scheme: https
+          serversTransport: insecure-transport
   tls:
     secretName: local-tls