mirror of
https://github.com/ChristianLight/tutor.git
synced 2024-05-30 12:50:48 +00:00
bce6432d85
Running jobs was previously done with "exec". This was because it allowed us to avoid copying too much container specification information from the docker-compose/deployments files to the jobs files. However, this was limiting: - In order to run a job, the corresponding container had to be running. This was particularly painful in Kubernetes, where containers are crashing as long as migrations are not correctly run. - Containers in which we need to run jobs needed to be present in the docker-compose/deployments files. This is unnecessary, for example when mysql is disabled, or in the case of the certbot container. Now, we create dedicated jobs files, both for local and k8s deployment. This introduces a little redundancy, but not too much. Note that dependent containers are not listed in the docker-compose.jobs.yml file, so an actual platform is still supposed to be running when we launch the jobs. This also introduces a subtle change: now, jobs go through the container entrypoint prior to running. This is probably a good thing, as it will avoid forgetting about incorrect environment variables. In k8s, we find ourselves interacting way too much with the kubectl utility. Parsing output from the CLI is a pain. So we need to switch to the native kubernetes client library.
53 lines
1.4 KiB
YAML
53 lines
1.4 KiB
YAML
---{% set hosts = [LMS_HOST, "preview." + LMS_HOST, CMS_HOST] %}
|
|
apiVersion: networking.k8s.io/v1beta1
|
|
kind: Ingress
|
|
metadata:
|
|
name: web
|
|
labels:
|
|
app.kubernetes.io/name: web
|
|
annotations:
|
|
kubernetes.io/ingress.class: nginx
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 1000m
|
|
{% if ACTIVATE_HTTPS%}kubernetes.io/tls-acme: "true"
|
|
cert-manager.io/issuer: letsencrypt{% endif %}
|
|
spec:
|
|
rules:
|
|
{% for host in hosts %}
|
|
- host: {{ host }}
|
|
http:
|
|
paths:
|
|
- backend:
|
|
serviceName: nginx
|
|
servicePort: {% if ACTIVATE_HTTPS %}443{% else %}80{% endif %}{% endfor %}
|
|
{{ patch("k8s-ingress-rules")|indent(2) }}
|
|
{% if ACTIVATE_HTTPS %}
|
|
tls:
|
|
- hosts:
|
|
{% for host in hosts %}
|
|
- {{ host }}{% endfor %}
|
|
{{ patch("k8s-ingress-tls-hosts")|indent(6) }}
|
|
# TODO maybe we should not take care of generating certificates ourselves
|
|
# and here just point to a tls secret
|
|
secretName: letsencrypt
|
|
{%endif%}
|
|
{% if ACTIVATE_HTTPS %}
|
|
---
|
|
apiVersion: cert-manager.io/v1alpha2
|
|
kind: Issuer
|
|
metadata:
|
|
name: letsencrypt
|
|
labels:
|
|
app.kubernetes.io/name: letsencrypt
|
|
spec:
|
|
acme:
|
|
server: https://acme-v02.api.letsencrypt.org/directory
|
|
email: {{ CONTACT_EMAIL }}
|
|
privateKeySecretRef:
|
|
name: letsencrypt-privatekey
|
|
solvers:
|
|
- selector: {}
|
|
http01:
|
|
ingress:
|
|
class: nginx
|
|
{% endif %}
|