v2

templates/deployment.yml.j2

@@ -0,0 +1,110 @@
+# SPDX-License-Identifier: MIT-0
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ wikideck_name | to_json }}
+  namespace: {{ wikideck_namespace | to_json }}
+  labels:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    app.kubernetes.io/managed-by: ansible
+spec:
+  # Never expose replicas as a variable: chain.json has no multi-writer locking.
+  replicas: 1
+  strategy:
+    type: Recreate
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wikideck
+      app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: wikideck
+        app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    spec:
+      serviceAccountName: {{ wikideck_name | to_json }}
+      automountServiceAccountToken: false
+      enableServiceLinks: false
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+{% if wikideck_image_pull_secrets | length > 0 %}
+      imagePullSecrets:
+{% for secret in wikideck_image_pull_secrets %}
+        - name: {{ secret | to_json }}
+{% endfor %}
+{% endif %}
+      nodeSelector: {{ wikideck_node_selector | to_json }}
+      tolerations: {{ wikideck_tolerations | to_json }}
+      affinity: {{ wikideck_affinity | to_json }}
+      containers:
+        - name: wikideck
+          image: {{ wikideck_image | to_json }}
+          imagePullPolicy: {{ wikideck_image_pull_policy | to_json }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+          ports:
+            - name: http
+              containerPort: 3001
+              protocol: TCP
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: HOST
+              value: "0.0.0.0"
+            - name: PORT
+              value: "3001"
+            - name: WIKIDECK_DATA_DIR
+              value: /app/data
+            - name: WIKIDECK_OFFLINE
+              value: {{ ('1' if wikideck_offline else '0') | to_json }}
+{% if wikideck_public_origin | length > 0 %}
+            - name: PUBLIC_ORIGIN
+              value: {{ wikideck_public_origin | to_json }}
+{% endif %}
+          resources: {{ wikideck_resources | to_json }}
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 60
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: {{ (wikideck_existing_claim if wikideck_existing_claim | length > 0 else wikideck_name ~ '-data') | to_json }}
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 32Mi

templates/ingress.yml.j2

@@ -0,0 +1,30 @@
+# SPDX-License-Identifier: MIT-0
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ wikideck_name | to_json }}
+  namespace: {{ wikideck_namespace | to_json }}
+  labels:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    app.kubernetes.io/managed-by: ansible
+  annotations: {{ wikideck_ingress_annotations | to_json }}
+spec:
+{% if wikideck_ingress_class_name | length > 0 %}
+  ingressClassName: {{ wikideck_ingress_class_name | to_json }}
+{% endif %}
+  tls:
+    - hosts:
+        - {{ wikideck_ingress_host | to_json }}
+      secretName: {{ wikideck_tls_secret_name | to_json }}
+  rules:
+    - host: {{ wikideck_ingress_host | to_json }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ wikideck_name | to_json }}
+                port:
+                  name: http

templates/networkpolicy.yml.j2

@@ -0,0 +1,44 @@
+# SPDX-License-Identifier: MIT-0
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ wikideck_name | to_json }}
+  namespace: {{ wikideck_namespace | to_json }}
+  labels:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    app.kubernetes.io/managed-by: ansible
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: wikideck
+      app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+  policyTypes: [Ingress, Egress]
+{% if wikideck_network_policy_ingress_from | length > 0 %}
+  ingress:
+    - from: {{ wikideck_network_policy_ingress_from | to_json }}
+      ports:
+        - protocol: TCP
+          port: 3001
+{% else %}
+  ingress: []
+{% endif %}
+{% if wikideck_network_policy_dns_to | length == 0 and (wikideck_offline or wikideck_network_policy_https_to | length == 0) %}
+  egress: []
+{% else %}
+  egress:
+{% if wikideck_network_policy_dns_to | length > 0 %}
+    - to: {{ wikideck_network_policy_dns_to | to_json }}
+      ports:
+        - protocol: UDP
+          port: 53
+        - protocol: TCP
+          port: 53
+{% endif %}
+{% if not wikideck_offline and wikideck_network_policy_https_to | length > 0 %}
+    - to: {{ wikideck_network_policy_https_to | to_json }}
+      ports:
+        - protocol: TCP
+          port: 443
+{% endif %}
+{% endif %}

templates/pvc.yml.j2

@@ -0,0 +1,18 @@
+# SPDX-License-Identifier: MIT-0
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: {{ (wikideck_name ~ '-data') | to_json }}
+  namespace: {{ wikideck_namespace | to_json }}
+  labels:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    app.kubernetes.io/managed-by: ansible
+spec:
+  accessModes: {{ wikideck_storage_access_modes | to_json }}
+{% if wikideck_storage_class is not none %}
+  storageClassName: {{ wikideck_storage_class | to_json }}
+{% endif %}
+  resources:
+    requests:
+      storage: {{ wikideck_storage_size | to_json }}

templates/service.yml.j2

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: MIT-0
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ wikideck_name | to_json }}
+  namespace: {{ wikideck_namespace | to_json }}
+  labels:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    app.kubernetes.io/managed-by: ansible
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP

templates/serviceaccount.yml.j2

@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: MIT-0
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ wikideck_name | to_json }}
+  namespace: {{ wikideck_namespace | to_json }}
+  labels:
+    app.kubernetes.io/name: wikideck
+    app.kubernetes.io/instance: {{ wikideck_name | to_json }}
+    app.kubernetes.io/managed-by: ansible
+automountServiceAccountToken: false