search

msz13 / zapisywarka

0 stars 0 forks source link

[Task] Uruchomienie środowiska staging #88

Open msz13 opened 2 years ago

msz13 commented 2 years ago

Desription

Wymagania:

Faza druga, środowisko produkcyjne: wymagania

zadania:

msz13 commented 2 years ago

Problem - server node musi mieć min. 2 cory

versja podstawowa 1 server i 2 agenty

wersja produkcyjna 3 servery

wersja full wypas 3 servery - 2 vpc, 4gb 4 agenty - po 1vps, 2gb

mam jeszcze dwie instancje amd 1/4 core i 1 gb memory

Propozycja architektury

  1. LB - 6643,22 forward to server subnet, 80, 443 to agents subnet
  2. server subnet dla control plane, worker subnet dla agents
  3. zasady komunikacji między sieciami

Propozycja architektury HA - networking, basic security

  1. Każdy control plane node w osobnej avability zone
  2. Public subnet for control plane
  3. kubernetes load balancer do decyzji - oci albo metallb albo z k3s
  4. service gatway do object storage
  5. konfiguracja dns do mojej domeny

czy load balanser musi być stworozny w node pool, czy można go dodać kubernetees oci controller

Zabezpieczenie node-ów

skomplikowana siec https://docs.oracle.com/en-us/iaas/Content/Resources/Assets/whitepapers/using-oci-load-balancing-with-wordpress.pdf

lb https://docs.oracle.com/en-us/iaas/Content/GSG/Tasks/loadbalancing.htm

dostep poprzez bastion https://blogs.oracle.com/cloudsecurity/post/secure-access-with-oci-bastion

https://docs.oracle.com/en-us/iaas/Content/Security/Reference/compute_security.htm

https://medium.com/oracledevs/k3s-on-oci-a-kubernetes-cluster-in-under-5-mins-d7c194c19d59 https://github.com/k8s-at-home/awesome-home-kubernetes

k3s production https://digitalis.io/blog/kubernetes/k3s-lightweight-kubernetes-made-ready-for-production-part-1/

k3s cluster with k3os https://github.com/r0b2g1t/k3s-cluster-on-oracle-cloud-infrastructure

msz13 commented 2 years ago

Konfiguracja DNS

dostępne dla administratora z adresu kube.admin.zapisywarka.pl monitoring grafana.admin.zapisywarka.pl baza danych postgres.admin.zapisywarka.pl

dwie trasy:

  1. kube.admin.zapisywarka.pl przekierowany jest do kube admin
  2. reszta zapytan przekierowana jest do kubernetes ingress controller

opcje:

msz13 commented 2 years ago

Architektura:

  1. Publiczne porty
    • kube API - 6443 k3s, albo 16443 dla microk8s
    • 80, 443 - aplikacja
    • 22
msz13 commented 2 years ago

k3s terraform module

inputs: oci provider node pool k3s agents numbers of agents nodes number of server nodes public ports - 6443, 80, 443 domain name

output

msz13 commented 2 years ago

TODO

msz13 commented 2 years ago

deployment api

msz13 commented 1 year ago
msz13 commented 1 year ago

Add iptable rule

sed '/-A INPUT -j REJECT --reject-with icmp-host-prohibited/i -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT/' rules.v4.bak sudo iptables-restore < /etc/iptables/rules.v

msz13 commented 1 year ago

Struktura

dev stag

dev: deploy infra - helmfile, powalczyć raw manifests, template,

deploy api - ddeploy operator, database. dotnet app deploy infra sh script: helm install stackgres ..

deploy api i server

msz13 commented 1 year ago

TODO

na srodowisku dev i na srodowisku staging

msz13 commented 1 year ago

Do decyzji, jak zrobić warianty helm

Elementy aplikacji • Zapisywarka-rejestracja • Zapisywarka-api • Postgresql Różnice

Postgresql

Staging • Cert manager • Clusterissuer • Seald secrets?? • ImagePullSecret • Grafana agent?

Preview • Cert manager • Clusterissuer • Seald secrets?? • ImagePullSecret

Budowa zależności

Shared resources Postgresql Password Username Imagepull secrets Cert manager Issuer

Pytanie jak będzie deployowana aplikacja?

msz13 commented 1 year ago

https://stackoverflow.com/questions/29420706/best-practices-for-user-permissions-in-postgresql

msz13 commented 1 year ago 
{{- define "test"}}
{{- $randomVal := randAlphaNum 12 -}}
{{ printf "%s" $randomVal }}
{{ end  -}}

---
apiVersion: stackgres.io/v1
kind: SGCluster
metadata:
  name: {{ template "test" . }}
spec:
  instances: {{ .Values.instances  | default 1 }}
  postgres:
    version: {{ .Values.pgVersion | default "latest" | quote }} 
  pods:
    persistentVolume:
      size: {{ required .Values.storageSize  }}
---
---
instances: 1
pgVersion: 14
storageSize: 2Gi
msz13 commented 1 year ago

https://supabase.com/blog https://neon.tech/

msz13 commented 1 year ago

Zwykły helm Realises

  1. zapisywarka-api a. zapisywarka-db
  2. zapisywarka-rejestracja
  3. infrastructure
msz13 commented 1 year ago

Budowa zależności

Kryteria szybkść stworzenia, łatwość obsługi, prostota, funkcjonalnosc Helmfile vs argo

helmfile - stworzenie pliku i konfiguracji instalacja helmfile lokalnie argo -

msz13 commented 1 year ago 

#staging

#production
releaseName: prod-zapisywarka

global:
  registry: ghcr.io
  imagePullSecrets: ghcr-cred
  domain: test.zapisywarka.pl  
  certyficateIssuerRef:
    type: Cluster

ssl: 
  enable: true
  issuer: ACMA - prod

db-cluster:
  name: zapisywarka-db
  profile: 'small'
  storageSize: '2Gi'
  webUi:
    ingress:
      domainPrefix: postgres-admin.pr-34567.zapisywarka.pl
  database:
    users:
      - name: dbowner
        roles: [pg_db_owner ....]
        secretName: zapisywarka-db-dbowner
      - name: dbuser
        roles: [...]
        secretName: zapisywarka-db-dbowner

image: 
  repository: ghcr.com/msz13
  secrets:
    imagePullSecrets:
      user: msz13 
      auth: xxx

zapisywarka-api:
  #nameOverride: api
  needs: ..
  ingress:
    domainPrefix: api
    tls:
      - hosts:
          - api.zapisywarka.pl
        secretName: 
  image:
    tag: "123"
  replicas: 2
  env:
    DB_CONNECTION:
      secretRef: zapisywarka-db-dbuser
        ..

zapisywarka-rejestracja:

db_migration:
  filePaths: "/ss"
  env:
    DB_CONNECTION:
      secretRef:

db_migration:
  enable: false
  filePaths: "/ss"
  env:
    DB_CONNECTION:
      secretRef:

zapisywarka-rejestracja:
  hostNamePrefix: api
  image:
    registry:
    repository:
    tag:  
enableMonitoring: true
msz13 commented 1 year ago

środowisko dev:

msz13 commented 1 year ago

db migrations warianty

msz13 commented 1 year ago

TODO:

msz13 commented 1 year ago

Lables

aplikacje: zapisywarka-api zapisywarka-rejestracja zapisywarka-db

postgresql-cluster part of: zapisywArka

app.kubernetes.io/name: aspnet-co app.kubernetes.io/instance: zapisywarka-api app.kubernetes.io/version: "4.9.4" app.kubernetes.io/managed-by: helm app.kubernetes.io/component: server app.kubernetes.io/part-of: zapisywarka

name: zapisywarka-api instance: staging-1

msz13 commented 1 year ago

Install environment

  1. Install stacgres
  2. Install cluster
  3. Install imagePullSecrets
  4. Install zapisywarka-api
msz13 commented 1 year ago

https://mixi-developers.mixi.co.jp/argocd-with-helm-fee954d1003c

msz13 commented 1 year ago

repositories:

releases:

environments: dev:

msz13 commented 1 year ago 
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: {{ .Values.issuerName }}
  spec:
    acme:
       # The ACME server URL
      server: {{ .Values.server }}
       # Email address used for ACME registration
      email: {{ .Values.email }}
       # Name of a secret used to store the ACME account private key
      privateKeySecretRef:
        name: {{ .Values.issuerSecret }}
       # Enable the HTTP-01 challenge provider
      solvers:
        - http01:
            ingress:
              class: {{ .Values.ingressClass }}
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: acme-crt
spec:
  secretName: {{ .Values.certyficateSecret }}
  dnsNames:
{{ .Values.hostNames | toYaml | indent 3 }}
  issuerRef:
    name: {{ .Values.issuerName }}
    # We can reference ClusterIssuers by changing the kind here.
    # The default value is Issuer (i.e. a locally namespaced Issuer)
    kind: ClusterIssuer
    group: cert-manager.io
msz13 commented 1 year ago

environemnts.docx

msz13 commented 1 year ago

oracle container engine

msz13 commented 1 year ago 
---
{{- define "webservice.imagePullSecrets" -}}
{{- $pullSecrets := .Values.global.imagePullSecrets | default .Values.imagePullSecrets -}}
{{- if $pullSecrets -}}
imagePullSecrets: 
  - name: {{ $pullSecrets }}  
{{ end }}
{{- end }}

example: 
{{- include "webservice.imagePullSecrets" . | nindent 0 -}}
containers:
msz13 commented 1 year ago

https://helm-playground.com/#t=N7C0AIBMFMDMEsB21wCIAuBDAzgawHSKYC20q4oAvpQFAjgAOATkurGgKTahfn4DCAC0xN0%2BAHIkU%2BAErQANtBzQJU8LIVLsKuQDd42eAHtE4anTDhoiSBXOgHNTA3gA1aE0MmAXOABGmOgAxoIA9LoAjDS4SJC%2BAFJGfjSkWJCBmN404OBEpL70SEHyAK4waFh4hFJ8ZrQ5mIiIRljoxojYvtk54DTYDNBBWTno0MQM8oHQwz39gzM94EEmWEgend2LEHnT4PQCwqKqpHWbi%2BDwxJgA5rsDTPLeAKz4AMwALPgADGeLy8RXGwFYDqVyYUrQbD4f6A2zmc49ETXTp7EH4MEQqFI7CnBFMSFYUQABSM8ngQQAnr5xNBdB5ugEgrgjLBYAAZS7wdC%2Bd40IA&v=LQhQGIBcEMGcGsA0ACAVgewEalAOgMIAW0ATpLgHLQC2ApgFzIAqc8OoAltdAOYOjJkJWjw6xIJAJ6MARDIFDaAB3SwOkdFNnzBMHttABjdNW4A7ACaMA2hfSQztSChIBXM7gsAbALqhSPLA2foTo6PCMSsIcZuLQXl4oUbSuSjwk0Ba0oKHhAOq0HDyEkIzAAIwADJX%2BhpAcAG60ACK0mV4xtADKtMaWQchVlUA

msz13 commented 1 year ago
msz13 commented 1 year ago

local workflow

ci/cd worflow local workflow

msz13 commented 1 year ago

Components • app o Webservice o Task o imagePullSecret • Infrastructure o Cert issuer o Imagepull secrets

extraDeploy: | apiVersion: bitnami.com/v1alpha1 kind: SealedSecret metadata: name: mysecret namespace: mynamespace annotations: "kubectl.kubernetes.io/last-applied-configuration": .... spec: encryptedData: .dockerconfigjson: AgBy3i4OJSWK+PiTySYZZA9rO43cGDEq..... template: type: kubernetes.io/dockerconfigjson

this is an example of labels and annotations that will be added to the output secret

  metadata:
    labels:
      "jenkins.io/credentials-type": usernamePassword
    annotations:
      "jenkins.io/credentials-description": credentials from Kubernetes
msz13 commented 1 year ago

How to add single resource to app: • extra deploy • template z secretem i values • chart referencing sub chart z dodanymi pełnymi resourcami w template • flux cd o kustomisation  release  namespace  selad secret – dockerconfigjson kubectl apply namespace dokcer config json helm release

msz13 commented 1 year ago

export PROJECT=test1 export ${PROJECT}_IMAGE="TESTVALUE" echo $test1_IMAGE

msz13 commented 8 months ago

Do zrobienia:

msz13 commented 8 months ago

Server Site MVC Dotnet-Apa – serverd in dotnet SPA, back, served separatley baza danych

Środowisko deweloperskie Docker + docker database

Run script (run database, migrate, serve) Docker compose (run database, migrate, run docker) Manage by test test containers

Środowisko staging

Deploying front Deploying backend Deoploung data base schema