k8s/Makefile

@@ -3,5 +3,5 @@ KUSTOMIZE=go run sigs.k8s.io/kustomize/kustomize/v5@latest
 
 deploy:
 	cd ${DEPLOYMENT} && $(KUSTOMIZE) edit set image textile/basin_worker=${IMAGE_BASIN_WORKER} textile/basin_exporter=${IMAGE_BASIN_EXPORTER}
-	cd ${DEPLOYMENT} && $(KUSTOMIZE) build . | kubectl apply -f -
+	cd ${DEPLOYMENT} && $(KUSTOMIZE) build . | sed -e 's/\x27"3000"\x27/3000/g' | kubectl apply -f -
 .PHONY: deploy

k8s/ingress-nginx-controller.yaml → k8s/base/ingress-controller.yaml

@@ -1,12 +1,4 @@
 apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/name: ingress-nginx
-  name: ingress-nginx
----
-apiVersion: v1
 automountServiceAccountToken: true
 kind: ServiceAccount
 metadata:
@@ -17,7 +9,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx
-  namespace: ingress-nginx
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -29,7 +20,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-admission
-  namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -41,7 +31,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx
-  namespace: ingress-nginx
 rules:
 - apiGroups:
   - ""
@@ -131,7 +120,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-admission
-  namespace: ingress-nginx
 rules:
 - apiGroups:
   - ""
@@ -251,15 +239,13 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx
-  namespace: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: ingress-nginx
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx
-  namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -271,15 +257,13 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-admission
-  namespace: ingress-nginx
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: ingress-nginx-admission
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx-admission
-  namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -297,7 +281,6 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx
-  namespace: ingress-nginx
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -316,7 +299,6 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: ingress-nginx-admission
-  namespace: ingress-nginx
 ---
 apiVersion: v1
 data:
@@ -330,7 +312,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-controller
-  namespace: ingress-nginx
 ---
 apiVersion: v1
 kind: Service
@@ -342,21 +323,25 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-controller
-  namespace: ingress-nginx
 spec:
   externalTrafficPolicy: Local
   ipFamilies:
   - IPv4
   ipFamilyPolicy: SingleStack
   ports:
-  - name: rpc
+  - name: rpcssl
     port: 3000
     protocol: TCP
     targetPort: 3000
+  - name: http
+    port: 80
+    protocol: TCP
+    targetPort: 80    
   selector:
     app.kubernetes.io/component: controller
     app.kubernetes.io/instance: ingress-nginx
     app.kubernetes.io/name: ingress-nginx
+  loadBalancerIP: 34.74.106.137
   type: LoadBalancer
 ---
 apiVersion: v1
@@ -369,7 +354,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-controller-admission
-  namespace: ingress-nginx
 spec:
   ports:
   - appProtocol: https
@@ -382,14 +366,6 @@ spec:
     app.kubernetes.io/name: ingress-nginx
   type: ClusterIP
 ---
-apiVersion: v1
-data:
-  3000: "basin-staging/basin-worker:3000"
-kind: ConfigMap
-metadata:
-  name: tcp-services
-  namespace: ingress-nginx
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -400,7 +376,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-controller
-  namespace: ingress-nginx
 spec:
   minReadySeconds: 0
   revisionHistoryLimit: 10
@@ -428,12 +403,11 @@ spec:
         - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
         - --election-id=ingress-nginx-leader
         - --controller-class=k8s.io/ingress-nginx
-        - --ingress-class=nginx
+        - --ingress-class=nginx-tls-tcp
         - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
-        - --tcp-services-configmap=ingress-nginx/tcp-services
         env:
         - name: POD_NAME
           valueFrom:
@@ -464,6 +438,9 @@ spec:
           timeoutSeconds: 1
         name: controller
         ports:
+        - containerPort: 3000
+          name: rpc
+          protocol: TCP
         - containerPort: 80
           name: http
           protocol: TCP
@@ -499,6 +476,9 @@ spec:
         - mountPath: /usr/local/certificates/
           name: webhook-cert
           readOnly: true
+        - mountPath: /etc/nginx/template
+          name: nginx-template-volume
+          readOnly: true
       dnsPolicy: ClusterFirst
       nodeSelector:
         kubernetes.io/os: linux
@@ -508,6 +488,12 @@ spec:
       - name: webhook-cert
         secret:
           secretName: ingress-nginx-admission
+      - name: nginx-template-volume
+        configMap:
+          name: nginx-template
+          items:
+          - key: nginx.tmpl
+            path: nginx.tmpl
 ---
 apiVersion: batch/v1
 kind: Job
@@ -519,7 +505,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-admission-create
-  namespace: ingress-nginx
 spec:
   template:
     metadata:
@@ -566,7 +551,6 @@ metadata:
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
   name: ingress-nginx-admission-patch
-  namespace: ingress-nginx
 spec:
   template:
     metadata:
@@ -614,7 +598,7 @@ metadata:
     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/version: 1.8.2
-  name: nginx
+  name: nginx-tls-tcp
 spec:
   controller: k8s.io/ingress-nginx
 ---
@@ -634,7 +618,7 @@ webhooks:
   clientConfig:
     service:
       name: ingress-nginx-controller-admission
-      namespace: ingress-nginx
+
       path: /networking/v1/ingresses
   failurePolicy: Fail
   matchPolicy: Equivalent

k8s/base/ingress-nginx.yaml → k8s/base/ingress.yaml

@@ -1,7 +1,7 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: basin-ingress-nginx
+  name: ingress-nginx
   annotations:
     kubernetes.io/ingress.class: 'nginx'
     nginx.ingress.kubernetes.io/proxy-send-timeout: '600'
@@ -10,4 +10,5 @@ metadata:
     kubernetes.io/ingress.allow-http: 'true'
     nginx.ingress.kubernetes.io/enable-cors: 'true'
     nginx.ingress.kubernetes.io/cors-allow-headers: >-
-      DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
+      DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
+    cert-manager.io/cluster-issuer: "letsencrypt-production"

k8s/base/kustomization.yaml

@@ -1,6 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+- ingress-controller.yaml
 - worker.yaml
 - exporter.yaml
-- ingress-nginx.yaml
+- ingress.yaml
+
+configMapGenerator:
+- files:
+  - nginx.tmpl
+  name: nginx-template