k8s-mongo-labeler-sidecar/deployment-example.yaml at master · combor/k8s-mongo-labeler-sidecar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mongo-labeler
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: mongo-labeler
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mongo-labeler
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mongo-labeler
subjects:
- kind: ServiceAccount
  name: mongo-labeler
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: mongo-bootstrap
data:
  start-mongo.sh: |
    #!/usr/bin/env bash
    set -euo pipefail

    mongod \
      --replSet rs0 \
      --bind_ip_all \
      --port 27017 \
      --dbpath /data/db \
      --logpath /proc/1/fd/1 \
      --logappend &
    mongod_pid="$!"

    if [[ "${HOSTNAME}" == "mongo-0" ]]; then
      for host in mongo-0.mongo-cluster mongo-1.mongo-cluster mongo-2.mongo-cluster; do
        until mongosh --quiet --host "${host}" --eval "db.adminCommand({ ping: 1 }).ok" >/dev/null 2>&1; do
          sleep 1
        done
      done

      if ! mongosh --quiet --eval "rs.status().ok" >/dev/null 2>&1; then
        mongosh --quiet --eval "rs.initiate({
          _id: 'rs0',
          members: [
            {_id: 0, host: 'mongo-0.mongo-cluster:27017'},
            {_id: 1, host: 'mongo-1.mongo-cluster:27017'},
            {_id: 2, host: 'mongo-2.mongo-cluster:27017'}
          ]
        })"
      fi
    fi

    wait "${mongod_pid}"
---
apiVersion: v1
kind: Service
metadata:
  name: mongo-cluster
spec:
  clusterIP: None
  selector:
    role: mongo
  ports:
  - name: mongo
    port: 27017
---
apiVersion: v1
kind: Service
metadata:
  name: mongo
spec:
  selector:
    role: mongo
    primary: "true"
  ports:
  - name: mongo
    port: 27017
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: mongo
spec:
  serviceName: "mongo-cluster"
  replicas: 3
  selector:
    matchLabels:
      role: mongo
  template:
    metadata:
      labels:
        role: mongo
    spec:
      serviceAccountName: mongo-labeler
      # Seccomp profile configuration
      securityContext:
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: mongo
        image: mongo:8.0.19
        command: ["/bin/bash", "/scripts/start-mongo.sh"]
        ports:
        - containerPort: 27017
        volumeMounts:
        - name: mongo-persistent-storage
          mountPath: /data/db
        - name: mongo-bootstrap
          mountPath: /scripts
          readOnly: true
      # Mongo labeler sidecar
      - name: labeler
        image: ghcr.io/combor/k8s-mongo-labeler-sidecar:0.6.2
        env:
        - name: LABEL_SELECTOR
          value: "role=mongo"
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: MONGO_ADDRESS
          value: "localhost:27017"
        - name: K8S_REQUEST_TIMEOUT
          value: "10s"
        - name: LABEL_ALL
          value: "true"
        - name: DEBUG
          value: "true"
        # Security context for the sidecar
        securityContext:
          runAsNonRoot: true
          runAsUser: 65532
          runAsGroup: 65532
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
          seccompProfile:
            type: RuntimeDefault
      volumes:
      - name: mongo-persistent-storage
        emptyDir: {}
      - name: mongo-bootstrap
        configMap:
          name: mongo-bootstrap
          defaultMode: 0755