auth-proxy-server.yaml

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: aps-s3-filebeat-config
  namespace: auth
  labels:
    k8s-app: filebeat
data:
  filebeat.yml: |-
    filebeat.inputs:
    - type: log
      enabled: true
      paths:
        - /data/srv/logs/frontend/*${MY_POD_NAME}*
      ignore_older: 1h
      scan_frequency: 10s
      backoff: 5s
      max_backoff: 10s
      tags: ["aps"]
    output.logstash:
      hosts: ["logstash.monitoring:5044"]
      compression_level: 3
      worker: 4
      bulk_max_size: 4096
      pipelining: 2
    queue.mem:
      events: 65536
    logging.metrics.enabled: false
---
kind: DaemonSet
apiVersion: apps/v1
metadata:
  labels:
    app: auth-proxy-server
  name: auth-proxy-server
  namespace: auth
spec:
  selector:
    matchLabels:
      app: auth-proxy-server
  template:
    metadata:
      labels:
        app: auth-proxy-server
        env: k8s #k8s#
      annotations:
        prometheus.io/scrape: 'true'
        prometheus.io/port: "9091"
    spec:
      serviceAccountName: auth-proxy-server-sa
      terminationGracePeriodSeconds: 60
      hostNetwork: true
      # this daemonset will be applied to all nodes which will have role=autha label
      # kubectl label node <node-name> role=auth --overwrite
      nodeSelector:
        role: auth
      dnsPolicy: ClusterFirstWithHostNet
      containers:
      - image: registry.cern.ch/cmsweb/auth-proxy-server #imagetag
        name: auth-proxy-server
#         imagePullPolicy: Always
        # NOTE: to migrate CMSWEB frontend to Go APS using x509 auth on port 443
        #       we explicitly specify this port and -useX509 flag below
        #       when we'll transition to tokens we should remove these two options
        # NOTE: we explicitly use port, metricsPort and logFile options
        #       to re-use single config.json between APS and XPS
        args:
          - /data/auth-proxy-server
          - -config=/etc/secrets/config.json
          - -port=443
          - -useX509
          - -metricsPort=9091
#PROD#    - -logFile=/data/srv/logs/frontend/auth-proxy-server.log
          - -testRule
          - ""
        resources:
          requests:
            memory: "50Mi"
            cpu: "30m"
          limits:
            memory: "10Gi"
            cpu: "4000m" # we can add higher limit here
        env:
        - name: X509_USER_PROXY
          value: /etc/proxy/proxy
        - name: MY_POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        ports:
        - containerPort: 443
          name: https
        - containerPort: 9091
          name: metrics
        volumeMounts:
        - name: auth-proxy-server-secrets
          mountPath: /etc/secrets
          #defaultMode: 256
          readOnly: true
        - name: proxy-secrets
          mountPath: /etc/proxy
          readOnly: true
        - name: www-htdocs
          mountPath: /www
        - name: token-secrets
          mountPath: /etc/token
          readOnly: true   
        - mountPath: /etc/grid-security
          name: etc-grid-security
          readOnly: true   
        - name: hostcert
          mountPath: /etc/grid-security/hostcert.pem
        - name: hostkey
          mountPath: /etc/grid-security/hostkey.pem 
#PROD#  - mountPath: /etc/cric
#PROD#    name: cric-volume
#PROD#  - name: logs
#PROD#    mountPath: /data/srv/logs/frontend
#PROD#  - name: filebeat-cephfs
#PROD#    mountPath: /data/filebeat
#PROD#- name: aps-s3-filebeat
#PROD#  image: docker.elastic.co/beats/filebeat:7.12.0
#PROD#  args: [
#PROD#    "-c", "/etc/filebeat.yml",
#PROD#    "-e",
#PROD#  ]
#PROD#  env:
#PROD#  - name: MY_POD_NAME
#PROD#    valueFrom:
#PROD#      fieldRef:
#PROD#        apiVersion: v1
#PROD#        fieldPath: metadata.name
#PROD#  resources:
#PROD#    requests:
#PROD#      memory: "50Mi"
#PROD#      cpu: "50m"
#PROD#  volumeMounts:
#PROD#  - name: logs
#PROD#    mountPath: /data/srv/logs/frontend
#PROD#  - name: config
#PROD#    mountPath: /etc/filebeat.yml
#PROD#    readOnly: true
#PROD#    subPath: filebeat.yml
#PROD#  - name: data
#PROD#    mountPath: /usr/share/filebeat/data
#PROD#  - name: varlog
#PROD#    mountPath: /var/log
#PROD#  - name: varlibdockercontainers
#PROD#    mountPath: /var/lib/docker/containers
#PROD#    readOnly: true
      initContainers:
      - name: htdocs
        image: registry.cern.ch/cmsweb/htdocs:0.0.2
        command: ['sh', '-c', 'cp -r /www/* /tmp/htdocs']
        volumeMounts:
        - name: www-htdocs
          mountPath: /tmp/htdocs
      volumes:
      - name: auth-proxy-server-secrets
        secret:
          secretName: auth-proxy-server-secrets
      - name: proxy-secrets
        secret:
          secretName: proxy-secrets
      - name: www-htdocs
        emptyDir: {}
      - name: token-secrets
        secret:
          secretName: token-secrets
      - name: etc-grid-security
        hostPath:
            path: /etc/grid-security
      - name: hostcert
        hostPath:
            path: /etc/grid-security/hostcert.pem
      - name: hostkey
        hostPath:
            path: /etc/grid-security/hostkey.pem
#PROD#- name: cric-volume
#PROD#  persistentVolumeClaim:
#PROD#    claimName: cric-pvc
#PROD#- name: varlog
#PROD#  hostPath:
#PROD#    path: /var/log
#PROD#- name: varlibdockercontainers
#PROD#  hostPath:
#PROD#    path: /var/lib/docker/containers
#PROD#- name: config
#PROD#  configMap:
#PROD#    defaultMode: 0640
#PROD#    name: aps-s3-filebeat-config
#PROD#- name: data
#PROD#  emptyDir: {}
#PROD#- name: filebeat-cephfs
#PROD#  persistentVolumeClaim:
#PROD#      claimName: filebeat-cephfs-claim-default
#PROD#- name: logs
#PROD#  persistentVolumeClaim:
#PROD#      claimName: logs-cephfs-claim-aps
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: auth-proxy-server
subjects:
- kind: ServiceAccount
  name: auth-proxy-server-sa
  namespace: auth
roleRef:
  kind: ClusterRole
  name: auth-proxy-server
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: auth-proxy-server
  labels:
    k8s-app: auth-proxy-server
rules:
- apiGroups: [""] # "" indicates the core API group
  resources:
  - namespaces
  - pods
  verbs:
  - get
  - watch
  - list
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: auth-proxy-server-sa
  namespace: auth
  labels:
    k8s-app: auth-proxy-server
---