KubeHarbor · Back to portfolio · Case study

kustomize / dev

19 objects, grouped by kind. Source file: rendered/kustomize/dev.yaml.

Namespace ledgerlite-dev

apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/component: namespace
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
  name: ledgerlite-dev

ResourceQuota ledgerlite

apiVersion: v1
kind: ResourceQuota
metadata:
  labels:
    app.kubernetes.io/component: quota
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite
  namespace: ledgerlite-dev
spec:
  hard:
    limits.cpu: "4"
    limits.memory: 4Gi
    persistentvolumeclaims: "4"
    pods: "20"
    requests.cpu: "2"
    requests.memory: 2Gi
    requests.storage: 5Gi

ServiceAccount ledgerlite

apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite
  namespace: ledgerlite-dev

ConfigMap ledgerlite-api

apiVersion: v1
data:
  ENVIRONMENT: dev
  LOG_LEVEL: info
  METRICS_PATH: /metrics
  PORT: "8000"
  WEB_CONCURRENCY: "1"
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-dev

Service ledgerlite-api

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-dev
spec:
  ports:
  - name: http
    port: 8000
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
  type: ClusterIP

Service ledgerlite-postgres

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: postgres
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-postgres
  namespace: ledgerlite-dev
spec:
  clusterIP: None
  ports:
  - name: postgres
    port: 5432
    protocol: TCP
    targetPort: postgres
  selector:
    app.kubernetes.io/component: postgres
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite

LimitRange ledgerlite

apiVersion: v1
kind: LimitRange
metadata:
  labels:
    app.kubernetes.io/component: limits
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite
  namespace: ledgerlite-dev
spec:
  limits:
  - default:
      cpu: 250m
      memory: 256Mi
    defaultRequest:
      cpu: 50m
      memory: 64Mi
    max:
      cpu: "2"
      memory: 2Gi
    type: Container

PersistentVolumeClaim ledgerlite-postgres-backup

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app.kubernetes.io/component: backup
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-postgres-backup
  namespace: ledgerlite-dev
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi

Deployment ledgerlite-api

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-dev
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/component: api
        app.kubernetes.io/instance: ledgerlite
        app.kubernetes.io/name: ledgerlite
        app.kubernetes.io/part-of: ledgerlite
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchLabels:
                  app.kubernetes.io/component: api
                  app.kubernetes.io/instance: ledgerlite
                  app.kubernetes.io/name: ledgerlite
              topologyKey: kubernetes.io/hostname
            weight: 100
      automountServiceAccountToken: false
      containers:
      - command:
        - python
        - -m
        - app
        env:
        - name: PORT
          value: "8000"
        - name: DATA_DIR
          value: /tmp
        - name: PYTHONDONTWRITEBYTECODE
          value: "1"
        - name: PYTHONUNBUFFERED
          value: "1"
        - name: LOG_LEVEL
          valueFrom:
            configMapKeyRef:
              key: LOG_LEVEL
              name: ledgerlite-api
        - name: WEB_CONCURRENCY
          valueFrom:
            configMapKeyRef:
              key: WEB_CONCURRENCY
              name: ledgerlite-api
        - name: ENVIRONMENT
          valueFrom:
            configMapKeyRef:
              key: ENVIRONMENT
              name: ledgerlite-api
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              key: DATABASE_URL
              name: ledgerlite-dev-db
        image: ghcr.io/OWNER/ledgerlite:0.1.0
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: http
          periodSeconds: 10
          timeoutSeconds: 2
        name: api
        ports:
        - containerPort: 8000
          name: http
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: http
          periodSeconds: 10
          timeoutSeconds: 2
        resources:
          limits:
            cpu: 250m
            memory: 256Mi
          requests:
            cpu: 50m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 10001
          runAsNonRoot: true
          runAsUser: 10001
          seccompProfile:
            type: RuntimeDefault
        startupProbe:
          failureThreshold: 30
          httpGet:
            path: /healthz
            port: http
          periodSeconds: 5
          timeoutSeconds: 2
        volumeMounts:
        - mountPath: /tmp
          name: tmp
      enableServiceLinks: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: ledgerlite
      topologySpreadConstraints:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/component: api
            app.kubernetes.io/instance: ledgerlite
            app.kubernetes.io/name: ledgerlite
        maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway
      - labelSelector:
          matchLabels:
            app.kubernetes.io/component: api
            app.kubernetes.io/instance: ledgerlite
            app.kubernetes.io/name: ledgerlite
        maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: ScheduleAnyway
      volumes:
      - emptyDir: {}
        name: tmp

StatefulSet ledgerlite-postgres

apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app.kubernetes.io/component: postgres
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-postgres
  namespace: ledgerlite-dev
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/component: postgres
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  serviceName: ledgerlite-postgres
  template:
    metadata:
      labels:
        app.kubernetes.io/component: postgres
        app.kubernetes.io/instance: ledgerlite
        app.kubernetes.io/name: ledgerlite
        app.kubernetes.io/part-of: ledgerlite
    spec:
      automountServiceAccountToken: false
      containers:
      - env:
        - name: PGDATA
          value: /var/lib/postgresql/data/pgdata
        - name: POSTGRES_USER
          valueFrom:
            secretKeyRef:
              key: POSTGRES_USER
              name: ledgerlite-dev-db
        - name: POSTGRES_PASSWORD
          valueFrom:
            secretKeyRef:
              key: POSTGRES_PASSWORD
              name: ledgerlite-dev-db
        - name: POSTGRES_DB
          valueFrom:
            secretKeyRef:
              key: POSTGRES_DB
              name: ledgerlite-dev-db
        image: postgres:16-alpine
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
          periodSeconds: 10
          tcpSocket:
            port: postgres
          timeoutSeconds: 2
        name: postgres
        ports:
        - containerPort: 5432
          name: postgres
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          periodSeconds: 10
          tcpSocket:
            port: postgres
          timeoutSeconds: 2
        resources:
          limits:
            cpu: 250m
            memory: 256Mi
          requests:
            cpu: 50m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 70
          runAsNonRoot: true
          runAsUser: 70
          seccompProfile:
            type: RuntimeDefault
        startupProbe:
          failureThreshold: 30
          periodSeconds: 5
          tcpSocket:
            port: postgres
          timeoutSeconds: 2
        volumeMounts:
        - mountPath: /var/lib/postgresql/data
          name: data
        - mountPath: /var/run/postgresql
          name: run
        - mountPath: /tmp
          name: tmp
      enableServiceLinks: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
      securityContext:
        fsGroup: 70
        runAsGroup: 70
        runAsNonRoot: true
        runAsUser: 70
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: ledgerlite
      volumes:
      - emptyDir: {}
        name: run
      - emptyDir: {}
        name: tmp
  volumeClaimTemplates:
  - metadata:
      labels:
        app.kubernetes.io/component: postgres
        app.kubernetes.io/instance: ledgerlite
        app.kubernetes.io/name: ledgerlite
        app.kubernetes.io/part-of: ledgerlite
      name: data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 1Gi

CronJob ledgerlite-postgres-backup

apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    app.kubernetes.io/component: backup
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-postgres-backup
  namespace: ledgerlite-dev
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 1
  jobTemplate:
    spec:
      template:
        metadata:
          labels:
            app.kubernetes.io/component: backup
            app.kubernetes.io/instance: ledgerlite
            app.kubernetes.io/name: ledgerlite
            app.kubernetes.io/part-of: ledgerlite
        spec:
          automountServiceAccountToken: false
          containers:
          - command:
            - /bin/sh
            - -c
            - |
              set -eu
              ts=$(date -u +%Y%m%dT%H%M%SZ)
              mkdir -p /backup
              pg_dump --file="/backup/ledgerlite-${ts}.sql"
              ls -1t /backup/ledgerlite-*.sql | awk 'NR>7' | while IFS= read -r old; do
                rm -f "$old"
              done
            env:
            - name: PGHOST
              value: ledgerlite-postgres
            - name: PGUSER
              valueFrom:
                secretKeyRef:
                  key: POSTGRES_USER
                  name: ledgerlite-dev-db
            - name: PGPASSWORD
              valueFrom:
                secretKeyRef:
                  key: POSTGRES_PASSWORD
                  name: ledgerlite-dev-db
            - name: PGDATABASE
              valueFrom:
                secretKeyRef:
                  key: POSTGRES_DB
                  name: ledgerlite-dev-db
            image: postgres:16-alpine
            imagePullPolicy: Always
            livenessProbe:
              exec:
                command:
                - pg_dump
                - --version
              failureThreshold: 3
              periodSeconds: 20
              timeoutSeconds: 5
            name: backup
            readinessProbe:
              exec:
                command:
                - pg_dump
                - --version
              failureThreshold: 3
              periodSeconds: 10
              timeoutSeconds: 5
            resources:
              limits:
                cpu: 250m
                memory: 256Mi
              requests:
                cpu: 50m
                memory: 64Mi
            securityContext:
              allowPrivilegeEscalation: false
              capabilities:
                drop:
                - ALL
              privileged: false
              readOnlyRootFilesystem: true
              runAsGroup: 70
              runAsNonRoot: true
              runAsUser: 70
              seccompProfile:
                type: RuntimeDefault
            startupProbe:
              exec:
                command:
                - pg_dump
                - --version
              failureThreshold: 12
              periodSeconds: 5
              timeoutSeconds: 5
            volumeMounts:
            - mountPath: /backup
              name: backup
            - mountPath: /tmp
              name: tmp
          enableServiceLinks: false
          hostIPC: false
          hostNetwork: false
          hostPID: false
          restartPolicy: Never
          securityContext:
            fsGroup: 70
            runAsGroup: 70
            runAsNonRoot: true
            runAsUser: 70
            seccompProfile:
              type: RuntimeDefault
          serviceAccountName: ledgerlite
          volumes:
          - name: backup
            persistentVolumeClaim:
              claimName: ledgerlite-postgres-backup
          - emptyDir: {}
            name: tmp
  schedule: 0 3 * * *
  successfulJobsHistoryLimit: 1

Job ledgerlite-migrate

apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
  labels:
    app.kubernetes.io/component: migrate
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-migrate
  namespace: ledgerlite-dev
spec:
  backoffLimit: 2
  template:
    metadata:
      labels:
        app.kubernetes.io/component: migrate
        app.kubernetes.io/instance: ledgerlite
        app.kubernetes.io/name: ledgerlite
        app.kubernetes.io/part-of: ledgerlite
    spec:
      automountServiceAccountToken: false
      containers:
      - command:
        - alembic
        - upgrade
        - head
        env:
        - name: PYTHONDONTWRITEBYTECODE
          value: "1"
        - name: PYTHONUNBUFFERED
          value: "1"
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              key: DATABASE_URL
              name: ledgerlite-dev-db
        image: ghcr.io/OWNER/ledgerlite:0.1.0
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - alembic
            - --help
          failureThreshold: 3
          periodSeconds: 10
          timeoutSeconds: 5
        name: migrate
        readinessProbe:
          exec:
            command:
            - alembic
            - --help
          failureThreshold: 3
          periodSeconds: 10
          timeoutSeconds: 5
        resources:
          limits:
            cpu: 250m
            memory: 256Mi
          requests:
            cpu: 50m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 10001
          runAsNonRoot: true
          runAsUser: 10001
          seccompProfile:
            type: RuntimeDefault
        startupProbe:
          exec:
            command:
            - alembic
            - --help
          failureThreshold: 12
          periodSeconds: 5
          timeoutSeconds: 5
        volumeMounts:
        - mountPath: /tmp
          name: tmp
      enableServiceLinks: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
      restartPolicy: Never
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: ledgerlite
      volumes:
      - emptyDir: {}
        name: tmp
  ttlSecondsAfterFinished: 600

Ingress ledgerlite-api

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-staging
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-dev
spec:
  ingressClassName: nginx
  rules:
  - host: ledgerlite.dev.example.com
    http:
      paths:
      - backend:
          service:
            name: ledgerlite-api
            port:
              number: 8000
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - ledgerlite.dev.example.com
    secretName: ledgerlite-dev-tls

NetworkPolicy ledgerlite-allow-dns

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-dns
  namespace: ledgerlite-dev
spec:
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
    to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
  podSelector:
    matchExpressions:
    - key: app.kubernetes.io/name
      operator: In
      values:
      - ledgerlite
    - key: app.kubernetes.io/component
      operator: In
      values:
      - api
      - migrate
      - backup
  policyTypes:
  - Egress

NetworkPolicy ledgerlite-allow-egress-postgres

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-egress-postgres
  namespace: ledgerlite-dev
spec:
  egress:
  - ports:
    - port: 5432
      protocol: TCP
    to:
    - podSelector:
        matchLabels:
          app.kubernetes.io/component: postgres
          app.kubernetes.io/instance: ledgerlite
          app.kubernetes.io/name: ledgerlite
  podSelector:
    matchExpressions:
    - key: app.kubernetes.io/name
      operator: In
      values:
      - ledgerlite
    - key: app.kubernetes.io/component
      operator: In
      values:
      - api
      - migrate
      - backup
  policyTypes:
  - Egress

NetworkPolicy ledgerlite-allow-ingress-nginx

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-ingress-nginx
  namespace: ledgerlite-dev
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: ingress-nginx
    ports:
    - port: 8000
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  policyTypes:
  - Ingress

NetworkPolicy ledgerlite-allow-postgres-ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-postgres-ingress
  namespace: ledgerlite-dev
spec:
  ingress:
  - from:
    - podSelector:
        matchExpressions:
        - key: app.kubernetes.io/component
          operator: In
          values:
          - api
          - migrate
          - backup
    ports:
    - port: 5432
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/component: postgres
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  policyTypes:
  - Ingress

NetworkPolicy ledgerlite-allow-prometheus

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-prometheus
  namespace: ledgerlite-dev
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: monitoring
    ports:
    - port: 8000
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  policyTypes:
  - Ingress

NetworkPolicy ledgerlite-default-deny

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-default-deny
  namespace: ledgerlite-dev
spec:
  egress: []
  ingress: []
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress