cluster

Infrastructure files for Nordgedanken and Midnightthoughts.
git clone git://archive.git.mtrnord.blog/MTRNord/cluster.git
Log | Files | Refs | README

deployment.yaml (10767B)

      1 apiVersion: apps/v1
      2 kind: Deployment
      3 metadata:
      4   name: connectivity-tester
      5   namespace: matrix
      6 spec:
      7   progressDeadlineSeconds: 120
      8   strategy:
      9     rollingUpdate:
     10       maxUnavailable: 0
     11     type: RollingUpdate
     12   selector:
     13     matchLabels:
     14       app: connectivity-tester
     15   template:
     16     metadata:
     17       labels:
     18         app: connectivity-tester
     19     spec:
     20       automountServiceAccountToken: false
     21       affinity:
     22         podAntiAffinity:
     23           requiredDuringSchedulingIgnoredDuringExecution:
     24             - labelSelector:
     25                 matchExpressions:
     26                   - key: app
     27                     operator: In
     28                     values:
     29                       - connectivity-tester
     30               topologyKey: "kubernetes.io/hostname"
     31       hostNetwork: false
     32       containers:
     33         - name: connection-checker-ui
     34           image: ghcr.io/mtrnord/matrix-connection-tester-ui:v0.4.1 # {"$imagepolicy": "flux-system:matrix-connection-tester-ui"}
     35           imagePullPolicy: Always
     36           lifecycle:
     37             preStop:
     38               exec:
     39                 command:
     40                   - sleep
     41                   - "10"
     42           securityContext:
     43             allowPrivilegeEscalation: false
     44             readOnlyRootFilesystem: true
     45             runAsNonRoot: true
     46             runAsUser: 1000
     47             runAsGroup: 1000
     48             capabilities:
     49               drop:
     50                 - ALL
     51             seccompProfile:
     52               type: RuntimeDefault
     53           resources:
     54             limits:
     55               cpu: "200m"
     56               memory: "512Mi"
     57             requests:
     58               memory: "100Mi"
     59               cpu: "100m"
     60           ports:
     61             - containerPort: 8000
     62               name: web
     63               protocol: TCP
     64           volumeMounts:
     65             - name: configs
     66               mountPath: "/app/_fresh/client/config.json"
     67               subPath: config.json
     68               readOnly: true
     69             - mountPath: /tmp
     70               name: tmp
     71           livenessProbe:
     72             httpGet:
     73               path: /
     74               port: web
     75               scheme: HTTP
     76           readinessProbe:
     77             httpGet:
     78               path: /
     79               port: web
     80               scheme: HTTP
     81           startupProbe:
     82             httpGet:
     83               path: /
     84               port: web
     85       volumes:
     86         - name: configs
     87           configMap:
     88             name: connectivity-tester-config
     89         - name: tmp
     90           emptyDir:
     91             sizeLimit: 2048Mi
     92 ---
     93 apiVersion: apps/v1
     94 kind: Deployment
     95 metadata:
     96   name: connectivity-tester-api
     97   namespace: matrix
     98 spec:
     99   replicas: 2
    100   progressDeadlineSeconds: 120
    101   strategy:
    102     rollingUpdate:
    103       maxUnavailable: 0
    104       maxSurge: 1
    105     type: RollingUpdate
    106   selector:
    107     matchLabels:
    108       app: connectivity-tester-api
    109   template:
    110     metadata:
    111       labels:
    112         app: connectivity-tester-api
    113     spec:
    114       automountServiceAccountToken: false
    115       affinity:
    116         podAntiAffinity:
    117           requiredDuringSchedulingIgnoredDuringExecution:
    118             - labelSelector:
    119                 matchExpressions:
    120                   - key: app
    121                     operator: In
    122                     values:
    123                       - connectivity-tester-api
    124               topologyKey: "kubernetes.io/hostname"
    125       hostNetwork: true
    126       dnsPolicy: ClusterFirstWithHostNet
    127       containers:
    128         - name: federation-tester-api
    129           image: ghcr.io/mtrnord/rust-federation-tester:0.4.2 # {"$imagepolicy": "flux-system:rust-federation-tester"}
    130           imagePullPolicy: IfNotPresent
    131           securityContext:
    132             allowPrivilegeEscalation: false
    133             readOnlyRootFilesystem: true
    134             runAsNonRoot: true
    135             runAsUser: 1000
    136             runAsGroup: 1000
    137             capabilities:
    138               drop:
    139                 - ALL
    140             seccompProfile:
    141               type: RuntimeDefault
    142           resources:
    143             limits:
    144               cpu: "500m"
    145               memory: "512Mi"
    146             requests:
    147               memory: "344Mi"
    148               cpu: "252m"
    149           volumeMounts:
    150             - name: api-config
    151               mountPath: /app/config.yaml
    152               subPath: config.yaml
    153               readOnly: true
    154           ports:
    155             - containerPort: 8080
    156               name: api
    157               protocol: TCP
    158           readinessProbe:
    159             httpGet:
    160               path: /healthz
    161               port: api
    162               scheme: HTTP
    163           livenessProbe:
    164             httpGet:
    165               path: /healthz
    166               port: api
    167               scheme: HTTP
    168           startupProbe:
    169             httpGet:
    170               path: /healthz
    171               port: api
    172           env:
    173             - name: RUST_LOG
    174               value: rust_federation_tester=debug,info
    175       volumes:
    176         - name: api-config
    177           secret:
    178             secretName: connectivity-tester-config
    179 ---
    180 apiVersion: flagger.app/v1beta1
    181 kind: MetricTemplate
    182 metadata:
    183   name: connectivity-tester-latency
    184   namespace: matrix
    185 spec:
    186   provider:
    187     type: prometheus
    188     address: "http://thanos-query-frontend.monitoring.svc.cluster.local:10902"
    189   query: |
    190     histogram_quantile(0.99,
    191       sum(
    192         irate(
    193           envoy_cluster_upstream_rq_time_bucket{
    194             envoy_cluster_name=~".*{{ namespace }}/{{ target }}.*",
    195           }[{{ interval }}]
    196         )
    197       ) by (le)
    198     )/1000
    199 ---
    200 apiVersion: flagger.app/v1beta1
    201 kind: MetricTemplate
    202 metadata:
    203   name: connectivity-tester-error-rate
    204   namespace: matrix
    205 spec:
    206   provider:
    207     type: prometheus
    208     address: "http://thanos-query-frontend.monitoring.svc.cluster.local:10902"
    209   query: |
    210     sum(
    211       rate(
    212         envoy_cluster_upstream_rq{
    213           envoy_cluster_name=~".*{{ namespace }}/{{ target }}.*",
    214           envoy_response_code!~"5.*"
    215         }[{{ interval }}]
    216       )
    217     )
    218     /
    219     sum(
    220       rate(
    221         envoy_cluster_upstream_rq_total{
    222           envoy_cluster_name=~".*{{ namespace }}/{{ target }}.*",
    223         }[{{ interval }}]
    224       )
    225     ) / 100
    226 ---
    227 apiVersion: flagger.app/v1beta1
    228 kind: Canary
    229 metadata:
    230   name: connectivity-tester
    231   namespace: matrix
    232 spec:
    233   # deployment reference
    234   targetRef:
    235     apiVersion: apps/v1
    236     kind: Deployment
    237     name: connectivity-tester
    238   # the maximum time in seconds for the canary deployment
    239   # to make progress before it is rollback (default 600s)
    240   progressDeadlineSeconds: 60
    241   # HPA reference (optional)
    242   #autoscalerRef:
    243   #    apiVersion: autoscaling/v2
    244   #    kind: HorizontalPodAutoscaler
    245   #    name: connectivity-tester
    246   service:
    247     # service port number
    248     port: 8000
    249     # container port number or name (optional)
    250     targetPort: 8000
    251     # Gateway API HTTPRoute host names
    252     hosts:
    253       - connectivity-tester.mtrnord.blog
    254       - federationtester.mtrnord.blog
    255     # Reference to the Gateway that the generated HTTPRoute would attach to.
    256     gatewayRefs:
    257       - name: envoy-gateway
    258         namespace: envoy-gateway
    259     retries:
    260       attempts: 10
    261       perTryTimeout: 5s
    262       retryOn: "gateway-error,connect-failure,refused-stream"
    263   analysis:
    264     # schedule interval (default 60s)
    265     interval: 1m
    266     # max number of failed metric checks before rollback
    267     threshold: 5
    268     # max traffic percentage routed to canary
    269     # percentage (0-100)
    270     maxWeight: 50
    271     # canary increment step
    272     # percentage (0-100)
    273     stepWeight: 10
    274     metrics:
    275       - name: error-rate
    276         # max error rate (5xx responses)
    277         # percentage (0-100)
    278         templateRef:
    279           name: connectivity-tester-error-rate
    280           namespace: matrix
    281         thresholdRange:
    282           max: 2
    283         interval: 1m
    284       - name: latency
    285         templateRef:
    286           name: connectivity-tester-latency
    287           namespace: matrix
    288         # seconds
    289         thresholdRange:
    290           max: 7
    291         interval: 30s
    292     sessionAffinity:
    293       cookieName: flagger-cookie
    294     # testing (optional)
    295     webhooks:
    296       - name: smoke-test
    297         type: pre-rollout
    298         url: http://flagger-loadtester.flagger-system/
    299         timeout: 15s
    300         metadata:
    301           type: bash
    302           cmd: "curl -s http://connectivity-tester-canary.matrix:8000"
    303       - name: load-test
    304         url: http://flagger-loadtester.flagger-system/
    305         timeout: 10m
    306         metadata:
    307           cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-canary.matrix/?serverName=mtrnord.blog"
    308 ---
    309 apiVersion: flagger.app/v1beta1
    310 kind: Canary
    311 metadata:
    312   name: connectivity-tester-api
    313   namespace: matrix
    314 spec:
    315   # deployment reference
    316   targetRef:
    317     apiVersion: apps/v1
    318     kind: Deployment
    319     name: connectivity-tester-api
    320   # the maximum time in seconds for the canary deployment
    321   # to make progress before it is rollback (default 600s)
    322   progressDeadlineSeconds: 60
    323   # HPA reference (optional)
    324   #autoscalerRef:
    325   #    apiVersion: autoscaling/v2
    326   #    kind: HorizontalPodAutoscaler
    327   #    name: connectivity-tester
    328   service:
    329     # service port number
    330     port: 8080
    331     # container port number or name (optional)
    332     targetPort: 8080
    333     # Gateway API HTTPRoute host names
    334     hosts:
    335       - api.connectivity-tester.mtrnord.blog
    336     # Reference to the Gateway that the generated HTTPRoute would attach to.
    337     gatewayRefs:
    338       - name: envoy-gateway
    339         namespace: envoy-gateway
    340     retries:
    341       attempts: 10
    342       perTryTimeout: 5s
    343       retryOn: "gateway-error,connect-failure,refused-stream"
    344   analysis:
    345     # schedule interval (default 60s)
    346     interval: 1m
    347     # max number of failed metric checks before rollback
    348     threshold: 5
    349     # max traffic percentage routed to canary
    350     # percentage (0-100)
    351     maxWeight: 50
    352     # canary increment step
    353     # percentage (0-100)
    354     stepWeight: 10
    355     metrics:
    356       - name: error-rate
    357         # max error rate (5xx responses)
    358         # percentage (0-100)
    359         templateRef:
    360           name: connectivity-tester-error-rate
    361           namespace: matrix
    362         thresholdRange:
    363           max: 2
    364         interval: 1m
    365       - name: latency
    366         templateRef:
    367           name: connectivity-tester-latency
    368           namespace: matrix
    369         # seconds
    370         thresholdRange:
    371           max: 7
    372         interval: 30s
    373     sessionAffinity:
    374       cookieName: flagger-cookie
    375     # testing (optional)
    376     webhooks:
    377       - name: smoke-test
    378         type: pre-rollout
    379         url: http://flagger-loadtester.flagger-system/
    380         timeout: 15s
    381         metadata:
    382           type: bash
    383           cmd: "curl -s http://connectivity-tester-api-canary.matrix:8080/healthz | grep 'ok'"
    384       - name: load-test
    385         url: http://flagger-loadtester.flagger-system/
    386         timeout: 10m
    387         metadata:
    388           cmd: "hey -z 10m -q 10 -c 2 http://connectivity-tester-api-canary.matrix/api/federation/federation-ok?serverName=mtrnord.blog&no_cache=true"