KubeHarbor · Back to portfolio · Case study

kustomize / prod

17 objects, grouped by kind. Source file: rendered/kustomize/prod.yaml.

Namespace ledgerlite-prod

apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/component: namespace
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/warn: restricted
  name: ledgerlite-prod

ResourceQuota ledgerlite

apiVersion: v1
kind: ResourceQuota
metadata:
  labels:
    app.kubernetes.io/component: quota
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite
  namespace: ledgerlite-prod
spec:
  hard:
    limits.cpu: "16"
    limits.memory: 16Gi
    persistentvolumeclaims: "0"
    pods: "40"
    requests.cpu: "8"
    requests.memory: 8Gi
    requests.storage: "0"

ServiceAccount ledgerlite

apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite
  namespace: ledgerlite-prod

ConfigMap ledgerlite-api

apiVersion: v1
data:
  ENVIRONMENT: prod
  LOG_LEVEL: info
  METRICS_PATH: /metrics
  PORT: "8000"
  WEB_CONCURRENCY: "1"
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-prod

Service ledgerlite-api

apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-prod
spec:
  ports:
  - name: http
    port: 8000
    protocol: TCP
    targetPort: http
  selector:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
  type: ClusterIP

LimitRange ledgerlite

apiVersion: v1
kind: LimitRange
metadata:
  labels:
    app.kubernetes.io/component: limits
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite
  namespace: ledgerlite-prod
spec:
  limits:
  - default:
      cpu: 250m
      memory: 256Mi
    defaultRequest:
      cpu: 50m
      memory: 64Mi
    max:
      cpu: "2"
      memory: 2Gi
    type: Container

Deployment ledgerlite-api

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-prod
spec:
  replicas: 3
  selector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
    type: RollingUpdate
  template:
    metadata:
      labels:
        app.kubernetes.io/component: api
        app.kubernetes.io/instance: ledgerlite
        app.kubernetes.io/name: ledgerlite
        app.kubernetes.io/part-of: ledgerlite
    spec:
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - podAffinityTerm:
              labelSelector:
                matchLabels:
                  app.kubernetes.io/component: api
                  app.kubernetes.io/instance: ledgerlite
                  app.kubernetes.io/name: ledgerlite
              topologyKey: kubernetes.io/hostname
            weight: 100
      automountServiceAccountToken: false
      containers:
      - command:
        - python
        - -m
        - app
        env:
        - name: PORT
          value: "8000"
        - name: DATA_DIR
          value: /tmp
        - name: PYTHONDONTWRITEBYTECODE
          value: "1"
        - name: PYTHONUNBUFFERED
          value: "1"
        - name: LOG_LEVEL
          valueFrom:
            configMapKeyRef:
              key: LOG_LEVEL
              name: ledgerlite-api
        - name: WEB_CONCURRENCY
          valueFrom:
            configMapKeyRef:
              key: WEB_CONCURRENCY
              name: ledgerlite-api
        - name: ENVIRONMENT
          valueFrom:
            configMapKeyRef:
              key: ENVIRONMENT
              name: ledgerlite-api
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              key: DATABASE_URL
              name: ledgerlite-prod-db
        image: ghcr.io/OWNER/ledgerlite@sha256:deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef
        imagePullPolicy: Always
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /healthz
            port: http
          periodSeconds: 10
          timeoutSeconds: 2
        name: api
        ports:
        - containerPort: 8000
          name: http
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          httpGet:
            path: /readyz
            port: http
          periodSeconds: 10
          timeoutSeconds: 2
        resources:
          limits:
            cpu: "1"
            memory: 512Mi
          requests:
            cpu: 250m
            memory: 256Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 10001
          runAsNonRoot: true
          runAsUser: 10001
          seccompProfile:
            type: RuntimeDefault
        startupProbe:
          failureThreshold: 30
          httpGet:
            path: /healthz
            port: http
          periodSeconds: 5
          timeoutSeconds: 2
        volumeMounts:
        - mountPath: /tmp
          name: tmp
      enableServiceLinks: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: ledgerlite
      topologySpreadConstraints:
      - labelSelector:
          matchLabels:
            app.kubernetes.io/component: api
            app.kubernetes.io/instance: ledgerlite
            app.kubernetes.io/name: ledgerlite
        maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: ScheduleAnyway
      - labelSelector:
          matchLabels:
            app.kubernetes.io/component: api
            app.kubernetes.io/instance: ledgerlite
            app.kubernetes.io/name: ledgerlite
        maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: ScheduleAnyway
      volumes:
      - emptyDir: {}
        name: tmp

PodDisruptionBudget ledgerlite-api

apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-prod
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  unhealthyPodEvictionPolicy: AlwaysAllow

HorizontalPodAutoscaler ledgerlite-api

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-prod
spec:
  behavior:
    scaleDown:
      policies:
      - periodSeconds: 60
        type: Percent
        value: 50
      stabilizationWindowSeconds: 300
    scaleUp:
      policies:
      - periodSeconds: 60
        type: Percent
        value: 100
      stabilizationWindowSeconds: 60
  maxReplicas: 10
  metrics:
  - resource:
      name: cpu
      target:
        averageUtilization: 70
        type: Utilization
    type: Resource
  - resource:
      name: memory
      target:
        averageUtilization: 70
        type: Utilization
    type: Resource
  minReplicas: 3
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: ledgerlite-api

Job ledgerlite-migrate

apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    argocd.argoproj.io/hook: PreSync
    argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded
  labels:
    app.kubernetes.io/component: migrate
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-migrate
  namespace: ledgerlite-prod
spec:
  backoffLimit: 2
  template:
    metadata:
      labels:
        app.kubernetes.io/component: migrate
        app.kubernetes.io/instance: ledgerlite
        app.kubernetes.io/name: ledgerlite
        app.kubernetes.io/part-of: ledgerlite
    spec:
      automountServiceAccountToken: false
      containers:
      - command:
        - alembic
        - upgrade
        - head
        env:
        - name: PYTHONDONTWRITEBYTECODE
          value: "1"
        - name: PYTHONUNBUFFERED
          value: "1"
        - name: DATABASE_URL
          valueFrom:
            secretKeyRef:
              key: DATABASE_URL
              name: ledgerlite-prod-db
        image: ghcr.io/OWNER/ledgerlite@sha256:deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef
        imagePullPolicy: Always
        livenessProbe:
          exec:
            command:
            - alembic
            - --help
          failureThreshold: 3
          periodSeconds: 10
          timeoutSeconds: 5
        name: migrate
        readinessProbe:
          exec:
            command:
            - alembic
            - --help
          failureThreshold: 3
          periodSeconds: 10
          timeoutSeconds: 5
        resources:
          limits:
            cpu: 250m
            memory: 256Mi
          requests:
            cpu: 50m
            memory: 64Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsGroup: 10001
          runAsNonRoot: true
          runAsUser: 10001
          seccompProfile:
            type: RuntimeDefault
        startupProbe:
          exec:
            command:
            - alembic
            - --help
          failureThreshold: 12
          periodSeconds: 5
          timeoutSeconds: 5
        volumeMounts:
        - mountPath: /tmp
          name: tmp
      enableServiceLinks: false
      hostIPC: false
      hostNetwork: false
      hostPID: false
      restartPolicy: Never
      securityContext:
        fsGroup: 10001
        runAsGroup: 10001
        runAsNonRoot: true
        runAsUser: 10001
        seccompProfile:
          type: RuntimeDefault
      serviceAccountName: ledgerlite
      volumes:
      - emptyDir: {}
        name: tmp
  ttlSecondsAfterFinished: 600

ServiceMonitor ledgerlite-api

apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-prod
spec:
  endpoints:
  - interval: 30s
    path: /metrics
    port: http
    scheme: http
  selector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite

Ingress ledgerlite-api

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  labels:
    app.kubernetes.io/component: api
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-api
  namespace: ledgerlite-prod
spec:
  ingressClassName: nginx
  rules:
  - host: ledgerlite.prod.example.com
    http:
      paths:
      - backend:
          service:
            name: ledgerlite-api
            port:
              number: 8000
        path: /
        pathType: Prefix
  tls:
  - hosts:
    - ledgerlite.prod.example.com
    secretName: ledgerlite-prod-tls

NetworkPolicy ledgerlite-allow-dns

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-dns
  namespace: ledgerlite-prod
spec:
  egress:
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
    to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
  podSelector:
    matchExpressions:
    - key: app.kubernetes.io/name
      operator: In
      values:
      - ledgerlite
    - key: app.kubernetes.io/component
      operator: In
      values:
      - api
      - migrate
      - backup
  policyTypes:
  - Egress

NetworkPolicy ledgerlite-allow-egress-postgres

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-egress-postgres
  namespace: ledgerlite-prod
spec:
  egress:
  - ports:
    - port: 5432
      protocol: TCP
    to:
    - ipBlock:
        cidr: 10.8.0.0/16
  podSelector:
    matchExpressions:
    - key: app.kubernetes.io/name
      operator: In
      values:
      - ledgerlite
    - key: app.kubernetes.io/component
      operator: In
      values:
      - api
      - migrate
  policyTypes:
  - Egress

NetworkPolicy ledgerlite-allow-ingress-nginx

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-ingress-nginx
  namespace: ledgerlite-prod
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: ingress-nginx
    ports:
    - port: 8000
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  policyTypes:
  - Ingress

NetworkPolicy ledgerlite-allow-prometheus

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-allow-prometheus
  namespace: ledgerlite-prod
spec:
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: monitoring
    ports:
    - port: 8000
      protocol: TCP
  podSelector:
    matchLabels:
      app.kubernetes.io/component: api
      app.kubernetes.io/instance: ledgerlite
      app.kubernetes.io/name: ledgerlite
  policyTypes:
  - Ingress

NetworkPolicy ledgerlite-default-deny

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  labels:
    app.kubernetes.io/component: network
    app.kubernetes.io/instance: ledgerlite
    app.kubernetes.io/name: ledgerlite
    app.kubernetes.io/part-of: ledgerlite
  name: ledgerlite-default-deny
  namespace: ledgerlite-prod
spec:
  egress: []
  ingress: []
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress