Update 'README.md'

.gitignore

@@ -0,0 +1 @@
+certmanager

README.md

@@ -1 +1,2 @@
 All my k8s charts.
+

blog/blog-deployment.yaml

@@ -0,0 +1,28 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: blog
+  name: blog
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: blog
+  template:
+    metadata:
+      labels:
+        run: blog
+    spec:
+      containers:
+        - image: nginx:latest
+          name: blog
+          imagePullPolicy: "Always"
+          volumeMounts:
+            - mountPath: /usr/share/nginx/html
+              name: blog
+      restartPolicy: Always
+      volumes:
+        - name: blog
+          persistentVolumeClaim:
+            claimName: blog

blog/blog-ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  tls:
+    - secretName: blog-tls
+      hosts:
+        - cptrthgs.fr
+  ingressClassName: nginx
+  rules:
+    - host: cptrthgs.fr
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: blog
+                port:
+                  number: 80
+            path: /

blog/blog-persistentvolumes.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: blog
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/blog"
+  mountOptions:
+    - nfsvers=4.2
+

blog/blog-pvc.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: blog
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: blog

blog/blog-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: blog
+  name: blog
+spec:
+  ports:
+    - name: "blog"
+      port: 80
+      targetPort: 80
+  selector:
+    run: blog

chaos-mesh/Experiments/killtest.yaml

@@ -0,0 +1,16 @@
+kind: PodChaos
+apiVersion: chaos-mesh.org/v1alpha1
+metadata:
+  namespace: default
+  name: killtest
+spec:
+  selector:
+    namespaces:
+      - default
+    labelSelectors:
+      run: linx
+  mode: one
+  action: pod-failure
+  duration: 30s
+  gracePeriod: 0
+

chaos-mesh/README.md

@@ -0,0 +1,14 @@
+# Install
+
+helm repo add chaos-mesh https://charts.chaos-mesh.org
+
+helm repo update
+
+helm install chaos-mesh chaos-mesh/chaos-mesh --namespace=chaos-testing --create-namespace --set dashboard.create=true
+
+# Get the token
+See the dashboard folder, it is the same method:
+```
+sudo k3s kubectl -n kubernetes-dashboard create token admin-user
+```
+...gives a token named admin-user

chaos-mesh/chaos-ingress.yaml

@@ -0,0 +1,19 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: chaos-ingr
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 500m
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: chaos.sq.lan
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: chaos-dashboard
+                port:
+                  number: 2333
+            path: /

chaos-mesh/rbac.yaml

@@ -0,0 +1,36 @@
+kind: ServiceAccount
+apiVersion: v1
+metadata:
+  namespace: default
+  name: account-default-manager-goovh
+
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  namespace: default
+  name: role-default-manager-goovh
+rules:
+- apiGroups: [""]
+  resources: ["pods", "namespaces"]
+  verbs: ["get", "watch", "list"]
+- apiGroups:
+  - chaos-mesh.org
+  resources: [ "*" ]
+  verbs: ["get", "list", "watch", "create", "delete", "patch", "update"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: bind-default-manager-goovh
+  namespace: default
+subjects:
+- kind: ServiceAccount
+  name: account-default-manager-goovh
+  namespace: default
+roleRef:
+  kind: Role
+  name: role-default-manager-goovh
+  apiGroup: rbac.authorization.k8s.io
+

cryptpad/crypt-deploy.yaml

@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: cryptpad
+  name: cryptpad
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: cryptpad
+  template:
+    metadata:
+      labels:
+        run: cryptpad
+    spec:
+      containers:
+        - image: promasu/cryptpad:latest
+          name: cryptpad
+          ports:
+            - containerPort: 3000
+          resources: {}
+          volumeMounts:
+            - mountPath: /cryptpad/blob
+              name: cryptpad-blob
+            - mountPath: /cryptpad/block
+              name: cryptpad-block
+            - mountPath: /cryptpad/data
+              name: cryptpad-data
+            - mountPath: /cryptpad/datastore
+              name: cryptpad-datastore
+            - mountPath: /cryptpad/config
+              name: cryptpad-config
+      restartPolicy: Always
+      volumes:
+        - name: cryptpad-blob
+          persistentVolumeClaim:
+            claimName: cryptpad-blob
+        - name: cryptpad-block
+          persistentVolumeClaim:
+            claimName: cryptpad-block
+        - name: cryptpad-data
+          persistentVolumeClaim:
+            claimName: cryptpad-data
+        - name: cryptpad-datastore
+          persistentVolumeClaim:
+            claimName: cryptpad-datastore
+        - name: cryptpad-config
+          persistentVolumeClaim:
+            claimName: cryptpad-config

cryptpad/crypt-ingress.yml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: cryptpad-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    nginx.ingress.kubernetes.io/proxy-body-size: 50m
+spec:
+  tls:
+    - secretName: crypt-tls
+      hosts:
+        - pad.squi.fr
+  ingressClassName: nginx
+  rules:
+    - host: pad.squi.fr
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: cryptpad
+                port:
+                  number: 3000
+            path: /
+

cryptpad/crypt-pvc.yml

@@ -0,0 +1,68 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cryptpad-blob
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 100Gi
+  volumeName: cryptpad-blob
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cryptpad-block
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 60Gi
+  volumeName: cryptpad-block
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cryptpad-data
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 100Gi
+  volumeName: cryptpad-data
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cryptpad-datastore
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: cryptpad-datastore
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: cryptpad-config
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 3Gi
+  volumeName: cryptpad-config

cryptpad/crypt-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: cryptpad
+  name: cryptpad
+spec:
+  ports:
+    - name: "http"
+      port: 3000
+      targetPort: 3000
+  selector:
+    run: cryptpad

cryptpad/crypt-volumeclaims.yaml

@@ -0,0 +1,81 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cryptpad-blob
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/cryptpad/blob"
+  mountOptions:
+    - nfsvers=4.2
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cryptpad-block
+spec:
+  capacity:
+    storage: 60Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/cryptpad/block"
+  mountOptions:
+    - nfsvers=4.2
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cryptpad-data
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/cryptpad/data"
+  mountOptions:
+    - nfsvers=4.2
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cryptpad-datastore
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/cryptpad/datastore"
+  mountOptions:
+    - nfsvers=4.2
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: cryptpad-config
+spec:
+  capacity:
+    storage: 3Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/cryptpad/config"
+  mountOptions:
+    - nfsvers=4.2
+
+
+

dashboard/README.md

@@ -0,0 +1,5 @@
+# Obtenir le token
+Une fois tout déployé, sur le master:
+```
+sudo k3s kubectl -n kubernetes-dashboard create token admin-user
+```

dashboard/account.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: admin-user
+  namespace: kubernetes-dashboard
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: admin-user
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: admin-user
+  namespace: kubernetes-dashboard
+

dashboard/dashboard-ingress.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: kubernetes-dashboard-ingr
+  namespace: kubernetes-dashboard
+  annotations:
+    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: k8s.sq.lan
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: kubernetes-dashboard 
+                port:
+                  number: 443
+            path: /
+

dashboard/recommended.yaml

@@ -0,0 +1,306 @@
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kubernetes-dashboard
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  ports:
+    - port: 443
+      targetPort: 8443
+  selector:
+    k8s-app: kubernetes-dashboard
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-certs
+  namespace: kubernetes-dashboard
+type: Opaque
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-csrf
+  namespace: kubernetes-dashboard
+type: Opaque
+data:
+  csrf: ""
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-key-holder
+  namespace: kubernetes-dashboard
+type: Opaque
+
+---
+
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard-settings
+  namespace: kubernetes-dashboard
+
+---
+
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+rules:
+  # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
+  - apiGroups: [""]
+    resources: ["secrets"]
+    resourceNames: ["kubernetes-dashboard-key-holder", "kubernetes-dashboard-certs", "kubernetes-dashboard-csrf"]
+    verbs: ["get", "update", "delete"]
+    # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["kubernetes-dashboard-settings"]
+    verbs: ["get", "update"]
+    # Allow Dashboard to get metrics.
+  - apiGroups: [""]
+    resources: ["services"]
+    resourceNames: ["heapster", "dashboard-metrics-scraper"]
+    verbs: ["proxy"]
+  - apiGroups: [""]
+    resources: ["services/proxy"]
+    resourceNames: ["heapster", "http:heapster:", "https:heapster:", "dashboard-metrics-scraper", "http:dashboard-metrics-scraper"]
+    verbs: ["get"]
+
+---
+
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+rules:
+  # Allow Metrics Scraper to get metrics from the Metrics server
+  - apiGroups: ["metrics.k8s.io"]
+    resources: ["pods", "nodes"]
+    verbs: ["get", "list", "watch"]
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: kubernetes-dashboard
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kubernetes-dashboard
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kubernetes-dashboard
+subjects:
+  - kind: ServiceAccount
+    name: kubernetes-dashboard
+    namespace: kubernetes-dashboard
+
+---
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: kubernetes-dashboard
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: kubernetes-dashboard
+  template:
+    metadata:
+      labels:
+        k8s-app: kubernetes-dashboard
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: kubernetes-dashboard
+          image: kubernetesui/dashboard:v2.5.0
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8443
+              protocol: TCP
+          args:
+            - --auto-generate-certificates
+            - --namespace=kubernetes-dashboard
+            # Uncomment the following line to manually specify Kubernetes API server Host
+            # If not specified, Dashboard will attempt to auto discover the API server and connect
+            # to it. Uncomment only if the default does not work.
+            # - --apiserver-host=http://my-address:port
+          volumeMounts:
+            - name: kubernetes-dashboard-certs
+              mountPath: /certs
+              # Create on-disk volume to store exec logs
+            - mountPath: /tmp
+              name: tmp-volume
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /
+              port: 8443
+            initialDelaySeconds: 30
+            timeoutSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
+      volumes:
+        - name: kubernetes-dashboard-certs
+          secret:
+            secretName: kubernetes-dashboard-certs
+        - name: tmp-volume
+          emptyDir: {}
+      serviceAccountName: kubernetes-dashboard
+      nodeSelector:
+        "kubernetes.io/os": linux
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+
+---
+
+kind: Service
+apiVersion: v1
+metadata:
+  labels:
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kubernetes-dashboard
+spec:
+  ports:
+    - port: 8000
+      targetPort: 8000
+  selector:
+    k8s-app: dashboard-metrics-scraper
+
+---
+
+kind: Deployment
+apiVersion: apps/v1
+metadata:
+  labels:
+    k8s-app: dashboard-metrics-scraper
+  name: dashboard-metrics-scraper
+  namespace: kubernetes-dashboard
+spec:
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      k8s-app: dashboard-metrics-scraper
+  template:
+    metadata:
+      labels:
+        k8s-app: dashboard-metrics-scraper
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: dashboard-metrics-scraper
+          image: kubernetesui/metrics-scraper:v1.0.7
+          ports:
+            - containerPort: 8000
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /
+              port: 8000
+            initialDelaySeconds: 30
+            timeoutSeconds: 30
+          volumeMounts:
+          - mountPath: /tmp
+            name: tmp-volume
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsUser: 1001
+            runAsGroup: 2001
+      serviceAccountName: kubernetes-dashboard
+      nodeSelector:
+        "kubernetes.io/os": linux
+      # Comment the following tolerations if Dashboard must not be deployed on master
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+      volumes:
+        - name: tmp-volume
+          emptyDir: {}

flog/flog-deployment.yaml

@@ -0,0 +1,29 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: flog
+  name: flog
+spec:
+  replicas: 1
+  selector: 
+    matchLabels:
+      app: flog
+  template:
+    metadata:
+      labels:
+        app: flog
+    spec:
+      containers:
+        - image: squi/flog:0.1.0
+          name: flog
+          ports:
+            - containerPort: 8000
+          volumeMounts:
+            - mountPath: /opt/flog
+              name: flog
+      restartPolicy: Always
+      volumes:
+        - name: flog
+          persistentVolumeClaim:
+            claimName: flog-data

flog/flog-ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: flog-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  tls:
+    - secretName: flog-tls
+      hosts:
+        - blog.squi.fr
+  ingressClassName: nginx
+  rules:
+    - host: blog.squi.fr
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: flog 
+                port:
+                  number: 8000
+            path: /
+

flog/flog-persistentvolumeclaim.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: flog-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: flog-data

flog/flog-service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: flog
+  name: flog
+spec:
+  ports:
+    - name: "8000"
+      port: 8000
+      targetPort: 8000
+  selector:
+    app: flog
+status:
+  loadBalancer: {}

flog/flog-volume.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: flog-data
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteOnce
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/flog"
+  mountOptions:
+    - nfsvers=4.2
+

freshrss/freshrss-deployment.yaml

@@ -1,10 +1,11 @@
 apiVersion: apps/v1
-kind: DaemonSet
+kind: Deployment
 metadata:
   labels:
     run: freshrss
   name: freshrss
 spec:
+  replicas: 1
   selector:
     matchLabels:
       run: freshrss

freshrss/freshrss-ingress.yaml

@@ -2,7 +2,14 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: freshrss-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - secretName: freshrss-tls
+      hosts:
+        - rss.squi.fr
   ingressClassName: nginx
   rules:
     - host: rss.squi.fr

gallery/gallery-deployment.yaml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gallery
+  labels:
+    run: gallery
+spec:
+  replicas: 1
+  selector: 
+    matchLabels:
+      run: gallery
+  template:
+    metadata:
+      labels:
+        run: gallery
+    spec:
+      containers:
+        - image: squi/gallery:1.0
+          name: gallery
+          ports:
+            - containerPort: 80
+          volumeMounts:
+            - mountPath: /var/www/html/Sources
+              name: gallery
+      restartPolicy: Always
+      volumes:
+        - name: gallery
+          persistentVolumeClaim:
+            claimName: gallery
+            readOnly: true

gallery/gallery-ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gallery-ingr
+  annotations:
+    nginx.ingress.kubernetes.io/auth-type: basic
+    nginx.ingress.kubernetes.io/auth-secret: basic-auth
+    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - you fool'
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  tls:
+    - secretName: gallery-tls
+      hosts:
+        - gallery.squi.fr
+  rules:
+    - host: gallery.squi.fr
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: gallery 
+                port:
+                  number: 80
+            path: /
+

gallery/gallery-pvc.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gallery
+spec:
+  accessModes:
+    - ReadOnlyMany
+  volumeName: gallery
+  resources:
+    requests:
+      storage: 300Gi
+  storageClassName: ""

gallery/gallery-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: gallery
+  name: gallery
+spec:
+  ports:
+    - name: "80"
+      port: 80
+      targetPort: 80
+  selector:
+    run: gallery

gallery/gallery-vol.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: gallery
+spec:
+  accessModes:
+    - ReadOnlyMany
+  nfs:
+    server: nas.sq.lan
+    path: "/data/Gallery"
+  mountOptions:
+    - nfsvers=4.2
+  capacity:
+    storage: 300Gi
+

gitea/gitea-ingress.yaml

@@ -2,7 +2,14 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: gitea-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - secretName: gitea-tls
+      hosts:
+        - gitea.squi.fr
   ingressClassName: nginx
   rules:
     - host: gitea.squi.fr

gitea/gitea-services.yaml

@@ -12,6 +12,22 @@ spec:
   selector:
     run: gitea
 
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: gitea
+  name: gitea-lb
+spec:
+  ports:
+    - name: "gitealb"
+      port: 8001
+      targetPort: 3000
+  selector:
+    run: gitea
+  type: LoadBalancer
+
 ---
 apiVersion: v1
 kind: Service

linx-serv/linx-depl.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: linx
+  name: linx
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: linx
+  template:
+    metadata:
+      labels:
+        run: linx
+    spec:
+      containers:
+        - image: andreimarcu/linx-server:latest
+          name: linx
+          ports:
+            - containerPort: 8080
+          imagePullPolicy: "Always"
+          volumeMounts:
+            - mountPath: /data/files
+              name: linx-files
+            - mountPath: /data/meta
+              name: linx-meta
+            - mountPath: /data/linx-server.conf
+              subPath: linx-server.conf
+              name: linx-conf
+            - mountPath: /go/src/github.com/andreimarcu/linx-server/static/css/linx.css
+              subPath: linx.css
+              name: linx-css
+            - mountPath: /go/src/github.com/andreimarcu/linx-server/static/css/github-markdown.css
+              subPath: github-markdown.css
+              name: linx-css
+      restartPolicy: Always
+      volumes:
+        - name: linx-files
+          persistentVolumeClaim:
+            claimName: linx-files
+        - name: linx-meta
+          persistentVolumeClaim:
+            claimName: linx-meta
+        - name: linx-conf
+          persistentVolumeClaim:
+            claimName: linx-conf
+        - name: linx-css
+          persistentVolumeClaim:
+            claimName: linx-css
+
+

linx-serv/linx-ingress.yaml

@@ -1,19 +1,19 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: notes-ingr
+  name: linx-ingr
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: 500m
 spec:
   ingressClassName: nginx
   rules:
-    #- host: test.squi.fr
+    - host: linx.sq.lan
-    - host: notes.squi.fr
       http:
         paths:
           - pathType: Prefix
             backend:
               service:
-                name: notes 
+                name: linx
                 port:
                   number: 8080
             path: /
-

linx-serv/linx-pv.yaml

@@ -0,0 +1,62 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: linx-files
+spec:
+  capacity:
+    storage: 20Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/linx/files"
+  mountOptions:
+    - nfsvers=4.2
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: linx-meta
+spec:
+  capacity:
+    storage: 20Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/linx/metadata"
+  mountOptions:
+    - nfsvers=4.2
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: linx-conf
+spec:
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/linx/conf"
+  mountOptions:
+    - nfsvers=4.2
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: linx-css
+spec:
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/linx/css"
+  mountOptions:
+    - nfsvers=4.2

linx-serv/linx-pvc.yaml

@@ -0,0 +1,54 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: linx-files
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 20Gi
+  volumeName: linx-files
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: linx-meta
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 20Gi
+  volumeName: linx-meta
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: linx-conf
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 2Gi
+  volumeName: linx-conf
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: linx-css
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 2Gi
+  volumeName: linx-css

linx-serv/linx-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: linx
+  name: linx
+spec:
+  ports:
+    - name: "linx"
+      port: 8080
+      targetPort: 8080
+  selector:
+    run: linx
+

mediawiki/mediawiki-ingress.yaml

@@ -2,7 +2,14 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: mediawiki-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - secretName: mediawiki-tls
+      hosts:
+        - wiki.squi.fr
   ingressClassName: nginx
   rules:
     - host: wiki.squi.fr

monitoring/grafpromstack/graf-deployment.yaml

@@ -1,10 +1,12 @@
 apiVersion: apps/v1
-kind: DaemonSet
+kind: Deployment
 metadata:
   labels:
     run: blackbox-exporter
   name: blackbox-exporter
+  namespace: monitoring
 spec:
+  replicas: 1
   selector:
     matchLabels:
       run: blackbox-exporter
@@ -28,12 +30,14 @@ spec:
 
 ---
 apiVersion: apps/v1
-kind: DaemonSet
+kind: Deployment
 metadata:
   labels:
     run: grafana
   name: grafana
+  namespace: monitoring
 spec:
+  replicas: 1
   selector:
     matchLabels:
       run: grafana
@@ -82,12 +86,14 @@ spec:
 
 ---
 apiVersion: apps/v1
-kind: DaemonSet
+kind: Deployment
 metadata:
   labels:
     run: prometheus
   name: prometheus
+  namespace: monitoring
 spec:
+  replicas: 1
   selector:
     matchLabels:
       run: prometheus
@@ -108,10 +114,16 @@ spec:
             - mountPath: /etc/prometheus
               readOnly: true
               name: prometheus
+            - mountPath: /prometheus/data
+              readOnly: false
+              name: prometheus-data
       restartPolicy: Always
       volumes:
         - name: prometheus
           persistentVolumeClaim:
             claimName: prometheus
+        - name: prometheus-data
+          persistentVolumeClaim:
+            claimName: prometheus-data
 
 

monitoring/grafpromstack/graf-ingress.yaml

@@ -2,7 +2,15 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: grafana-ingr
+  namespace: monitoring
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - secretName: grafana-tls
+      hosts:
+        - graf.squi.fr
   ingressClassName: nginx
   rules:
     - host: graf.squi.fr

monitoring/grafpromstack/graf-services.yaml

@@ -4,6 +4,7 @@ metadata:
   labels:
     run: grafana
   name: grafana
+  namespace: monitoring
 spec:
   ports:
     - name: "grafweb"
@@ -19,13 +20,14 @@ metadata:
   labels:
     run: prometheus
   name: prometheus
+  namespace: monitoring
 spec:
   ports:
     - name: "prom"
       port: 9090
       targetPort: 9090
   selector:
-    run: grafana
+    run: prometheus
   type: LoadBalancer
 
 ---
@@ -35,6 +37,7 @@ metadata:
   labels:
     run: blackbox-exporter
   name: blackbox-exporter
+  namespace: monitoring
 spec:
   ports:
     - name: "bbox"

monitoring/grafpromstack/grafana-pvc.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: blackbox-exporter
+  namespace: monitoring
 spec:
   accessModes:
     - ReadWriteMany
@@ -17,6 +18,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: grafana-data
+  namespace: monitoring
 spec:
   accessModes:
     - ReadWriteMany
@@ -31,6 +33,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: grafana-conf
+  namespace: monitoring
 spec:
   accessModes:
     - ReadWriteMany
@@ -45,6 +48,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: prometheus
+  namespace: monitoring
 spec:
   accessModes:
     - ReadWriteMany
@@ -54,3 +58,18 @@ spec:
       storage: 10Gi
   volumeName: prometheus
 
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prometheus-data
+  namespace: monitoring
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: prometheus-data
+

monitoring/grafpromstack/grafana-volumeclaims.yaml

@@ -3,6 +3,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: blackbox-exporter
+  namespace: monitoring
 spec:
   capacity:
     storage: 10Gi
@@ -19,6 +20,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: grafana-data
+  namespace: monitoring
 spec:
   capacity:
     storage: 50Gi
@@ -35,6 +37,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: grafana-conf
+  namespace: monitoring
 spec:
   capacity:
     storage: 10Gi
@@ -51,6 +54,7 @@ apiVersion: v1
 kind: PersistentVolume
 metadata:
   name: prometheus
+  namespace: monitoring
 spec:
   capacity:
     storage: 10Gi
@@ -62,3 +66,20 @@ spec:
   mountOptions:
     - nfsvers=4.2
 
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: prometheus-data
+  namespace: monitoring
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/grafana/prometheus-data"
+  mountOptions:
+    - nfsvers=4.2
+

monitoring/monitoring-ns.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring

monitoring/prom-state-metrics/kub-state-metrics-rbac.yaml

@@ -0,0 +1,16 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.3.0
+  name: kube-state-metrics
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: kube-state-metrics
+subjects:
+- kind: ServiceAccount
+  name: kube-state-metrics
+  namespace: monitoring

monitoring/prom-state-metrics/promstate-crole.yaml

@@ -0,0 +1,109 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.3.0
+  name: kube-state-metrics
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - secrets
+  - nodes
+  - pods
+  - services
+  - resourcequotas
+  - replicationcontrollers
+  - limitranges
+  - persistentvolumeclaims
+  - persistentvolumes
+  - namespaces
+  - endpoints
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - apps
+  resources:
+  - statefulsets
+  - daemonsets
+  - deployments
+  - replicasets
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - batch
+  resources:
+  - cronjobs
+  - jobs
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - autoscaling
+  resources:
+  - horizontalpodautoscalers
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
+- apiGroups:
+  - authorization.k8s.io
+  resources:
+  - subjectaccessreviews
+  verbs:
+  - create
+- apiGroups:
+  - policy
+  resources:
+  - poddisruptionbudgets
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - certificates.k8s.io
+  resources:
+  - certificatesigningrequests
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - storage.k8s.io
+  resources:
+  - storageclasses
+  - volumeattachments
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - mutatingwebhookconfigurations
+  - validatingwebhookconfigurations
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - networkpolicies
+  - ingresses
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - list
+  - watch

monitoring/prom-state-metrics/promstate-depl.yaml

@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.3.0
+  name: kube-state-metrics
+  namespace: monitoring
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: kube-state-metrics
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: exporter
+        app.kubernetes.io/name: kube-state-metrics
+        app.kubernetes.io/version: 2.3.0
+    spec:
+      automountServiceAccountToken: true
+      containers:
+      - image: k8s.gcr.io/kube-state-metrics/kube-state-metrics:v2.3.0
+        imagePullPolicy: Always
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+        name: kube-state-metrics
+        ports:
+        - containerPort: 8080
+          name: http-metrics
+        - containerPort: 8081
+          name: telemetry
+        readinessProbe:
+          httpGet:
+            path: /
+            port: 8081
+          initialDelaySeconds: 5
+          timeoutSeconds: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          runAsUser: 65534
+      nodeSelector:
+        kubernetes.io/os: linux
+      serviceAccountName: kube-state-metrics

monitoring/prom-state-metrics/promstate-rbac.yaml

@@ -0,0 +1,34 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: prometheus
+  namespace: monitoring
+rules:
+- apiGroups: [""]
+  resources:
+  - nodes
+  - nodes/proxy
+  - services
+  - endpoints
+  - pods
+  verbs: ["get", "list", "watch"]
+- apiGroups:
+  - extensions
+  resources:
+  - ingresses
+  verbs: ["get", "list", "watch"]
+- nonResourceURLs: ["/metrics"]
+  verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: prometheus
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: prometheus
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: monitoring

monitoring/prom-state-metrics/promstate-svc.yaml

@@ -0,0 +1,20 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.3.0
+  name: kube-state-metrics
+  namespace: monitoring
+spec:
+  type: LoadBalancer
+  ports:
+  - name: http-metrics
+    port: 8080
+    targetPort: http-metrics
+  - name: telemetry
+    port: 8081
+    targetPort: telemetry
+  selector:
+    app.kubernetes.io/name: kube-state-metrics

monitoring/prom-state-metrics/promstate-svcaccount.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+automountServiceAccountToken: false
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: exporter
+    app.kubernetes.io/name: kube-state-metrics
+    app.kubernetes.io/version: 2.3.0
+  name: kube-state-metrics
+  namespace: monitoring

nginx-ingress/auth

@@ -0,0 +1 @@
+squip:$apr1$e0QTsUBf$rVuHisO/pKnOKTBAwcYiT0

nginx-ingress/secret.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  auth: c3F1aXA6JGFwcjEkZTBRVHNVQmYkclZ1SGlzTy9wS25PS1RCQXdjWWlUMAo=
+kind: Secret
+metadata:
+  name: basic-auth
+  namespace: default
+type: Opaque

persosite/site-deployment.yaml

@@ -0,0 +1,28 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    run: site
+  name: site
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      run: site
+  template:
+    metadata:
+      labels:
+        run: site
+    spec:
+      containers:
+        - image: nginx:latest
+          name: site
+          imagePullPolicy: "Always"
+          volumeMounts:
+            - mountPath: /usr/share/nginx/html
+              name: site
+      restartPolicy: Always
+      volumes:
+        - name: site
+          persistentVolumeClaim:
+            claimName: site

persosite/site-ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: site-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-staging
+spec:
+  tls:
+    - secretName: siteperso-tls
+      hosts:
+        - justinepelletreau.com
+  ingressClassName: nginx
+  rules:
+    - host: justinepelletreau.com
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: site
+                port:
+                  number: 80
+            path: /

persosite/site-persistentvolumes.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: site
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  nfs:
+    server: nas.sq.lan
+    path: "/swarmdata/personnalsite"
+  mountOptions:
+    - nfsvers=4.2
+

persosite/site-pvc.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: site
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: site

persosite/site-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    run: site
+  name: site
+spec:
+  ports:
+    - name: "site"
+      port: 80
+      targetPort: 80
+  selector:
+    run: site

sqnotes/notes-deployment.yaml

@@ -1,5 +1,5 @@
 apiVersion: apps/v1
-kind: DaemonSet
+kind: Deployment
 metadata:
   annotations:
     kompose.cmd: kompose convert -f squinotes.yml
@@ -8,6 +8,7 @@ metadata:
     io.kompose.service: notes
   name: notes
 spec:
+  replicas: 1
   selector: 
     matchLabels:
       io.kompose.service: notes
@@ -21,7 +22,6 @@ spec:
           name: notes
           ports:
             - containerPort: 8080
-          resources: {}
           volumeMounts:
             - mountPath: /app/data
               name: notes
@@ -30,9 +30,3 @@ spec:
         - name: notes
           persistentVolumeClaim:
             claimName: sqnotes-data
-  updateStrategy: {}
-status:
-  currentNumberScheduled: 0
-  desiredNumberScheduled: 0
-  numberMisscheduled: 0
-  numberReady: 0

sqnotes/notes-ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: notes-ingr
+  annotations:
+    nginx.ingress.kubernetes.io/auth-type: basic
+    nginx.ingress.kubernetes.io/auth-secret: basic-auth
+    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - you fool'
+    kubernetes.io/ingress.class: "nginx"
+    kubernetes.io/tls-acme: "true"
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  tls:
+    - secretName: notes-tls
+      hosts:
+        - notes.squi.fr
+  rules:
+    - host: notes.squi.fr
+      http:
+        paths:
+          - pathType: Prefix
+            backend:
+              service:
+                name: notes 
+                port:
+                  number: 8080
+            path: /
+

sqtasks/tasks-deployment.yaml

@@ -1,10 +1,11 @@
 apiVersion: apps/v1
-kind: DaemonSet
+kind: Deployment
 metadata:
   labels:
     app: tasks
   name: tasks
 spec:
+  replicas: 1
   selector: 
     matchLabels:
       app: tasks
@@ -18,7 +19,6 @@ spec:
           name: tasks
           ports:
             - containerPort: 8080
-          resources: {}
           volumeMounts:
             - mountPath: /app/data
               name: tasks
@@ -27,9 +27,3 @@ spec:
         - name: tasks
           persistentVolumeClaim:
             claimName: tasks-data
-  updateStrategy: {}
-status:
-  currentNumberScheduled: 0
-  desiredNumberScheduled: 0
-  numberMisscheduled: 0
-  numberReady: 0

sqtasks/tasks-ingress.yaml

@@ -2,7 +2,17 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: tasks-ingr
+  annotations:
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/auth-type: basic
+    nginx.ingress.kubernetes.io/auth-secret: basic-auth
+    nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required - you fool'
+    cert-manager.io/cluster-issuer: letsencrypt-prod
 spec:
+  tls:
+    - secretName: todo-tls
+      hosts:
+        - todo.squi.fr
   ingressClassName: nginx
   rules:
     - host: todo.squi.fr