probes

2023-08-18 05:38:55 +05:30
parent b089060d72
commit 850c945974
8 changed files with 522 additions and 0 deletions
--- a/build/prod/configmap.yaml
+++ b/build/prod/configmap.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: medicalalert-web-cm
+  namespace: medicalalert-web
+  labels:
+    app: medicalalert-web
+data:
+  DB_HOST: medicalalert-ecommerce.c5om7w6xopq1.us-east-1.rds.amazonaws.com
+  ENV: qa
+  WP_DEBUG: "false"
+  DB_CHARSET: utf8 
+  DB_COLLATE: utf8_general_ci
+  CACHE_HOST: master.redis-cache-all-be-caresage.cqsmse.use1.cache.amazonaws.com
+  CACHE_PORT: "6379"
+  DB_NAME: "www"
+  DB_USER: "pantheon"
--- a/build/prod/deployment.tpl
+++ b/build/prod/deployment.tpl
@@ -0,0 +1,113 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    deployment.kubernetes.io/revision: "11"
+  labels:
+    app: medicalalert-web
+  name: medicalalert-web
+  namespace: medicalalert-web
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: medicalalert-web
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/restartedAt: "2023-06-08T17:04:19-04:00"
+      creationTimestamp: null
+      labels:
+        app: medicalalert-web
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
+                - arm64
+      containers:
+      - env:
+        - name: ENVIRONMENT
+          value: "$ENV"
+        image: 716593996126.dkr.ecr.us-east-1.amazonaws.com/medicalalert-web:$VERSION
+        envFrom:
+        - secretRef:
+            name: medicalalert-web-secrets
+        - configMapRef:
+            name: medicalalert-web-cm
+        imagePullPolicy: Always
+        name: medicalalert-web
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        startupProbe:
+          exec:
+            command:
+            - /root/redinessprobe-wp.sh
+          initialDelaySeconds: 60
+          periodSeconds: 15
+          timeoutSeconds: 5
+          failureThreshold: 10
+          successThreshold: 1
+        readinessProbe:
+          exec:
+            command:
+            - /bin/sh
+            - -c
+            - "wget -qO-  127.0.0.1/status |grep start  && echo redinessprobe-success || exit 9"
+          initialDelaySeconds: 180
+          periodSeconds: 5
+          successThreshold: 1
+          failureThreshold: 5
+          timeoutSeconds: 5
+        livenessProbe:
+          tcpSocket:
+            port: 80
+          initialDelaySeconds: 2
+          periodSeconds: 2
+          successThreshold: 1
+          failureThreshold: 3
+          timeoutSeconds: 3
+        resources:
+          limits:
+            cpu: 500m
+            memory: 700Mi
+          requests:
+            cpu: 300m
+            memory: 500Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /usr/share/nginx/subdomain/www/wp-content/uploads
+          name: persistent-storage
+        - mountPath: /etc/nginx/conf.d/
+          name: default-conf
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: regcred
+      nodeSelector:
+        kubernetes.io/os: linux
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      terminationGracePeriodSeconds: 30
+      volumes:
+      - name: persistent-storage
+        persistentVolumeClaim:
+          claimName: efs-claim-medicalalert
+      - name: default-conf
+        configMap:
+          defaultMode: 420
+          name: medicalalert-web-default-conf-cm
--- a/build/prod/pod.tpl
+++ b/build/prod/pod.tpl
@@ -0,0 +1,45 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: common-job-pod
+  namespace: medicalalert-web
+  labels:
+    app: medicalalert-web
+    rds: enable
+    pod: common
+spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/arch
+                operator: In
+                values:
+                - amd64
+                - arm64
+      containers:
+      - name: common-job
+        image: wyveo/nginx-php-fpm:php74
+        envFrom:
+        - secretRef:
+            name: medicalalert-web-secrets
+        - configMapRef:
+            name: medicalalert-web-cm
+        command: ["bash"]
+        args:
+        - -c
+        - sleep infinity  
+        volumeMounts:
+        - mountPath: /usr/share/nginx/subdomain/www/wp-content/uploads
+          name: persistent-storage
+      imagePullSecrets:
+      - name: regcred
+      nodeSelector:
+        kubernetes.io/os: linux
+      restartPolicy: Never
+      volumes:
+      - name: persistent-storage
+        persistentVolumeClaim:
+          claimName: efs-claim-medicalalert
+
--- a/build/prod/pvc.yml
+++ b/build/prod/pvc.yml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: efs-claim-medicalalert
+  namespace: medicalalert-web
+spec:
+  accessModes:
+  - ReadWriteMany
+  storageClassName: efs-sc-ecommerce
+  resources:
+    requests:
+      storage: 5Gi
--- a/build/prod/secrets.yaml
+++ b/build/prod/secrets.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+data:
+  CACHE_PASSWORD: UU1FRVQ0ZG15VlE4OXZKWUFSUjdQQXhoUU1FRVQ0ZG15VlE4OXZKWUFSUjdQQXho
+  DB_PASSWORD: NUtJTklPbFNSdmRYZEVVNWZDd29JTGxleUJoSHNLVnU=
+  TOKEN: QVRDVFQzeEZmR04wWC1yOWcyb090X3c2WGY0bUdkQl94QlZ5Ymd2RWozU09aR055bEJtLXZzTkxDcHhRZE5IZTV0WTh4ZHc5MW9reDlZSlI3WlhGMk56SmFZaXpzSlBBWmFEMG5Hakp3RG92YkJZWTVaTzJRRC0wNEN3c0cxV3FZeWM2UzRkMHA2RWpOY0plOTZmLWVfalgwM3FDZlA0NEtkQkFCeGtzQTZQTEdWdGFidGMwSjdFPUZBMjdBRjgx
+kind: Secret
+metadata:
+  annotations:
+  labels:
+    app: medicalalert-web
+  name: medicalalert-web-secrets
+  namespace: medicalalert-web
+type: Opaque
--- a/build/prod/service.yml
+++ b/build/prod/service.yml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: medicalalert-web
+  namespace: medicalalert-web
+  labels:
+    app: medicalalert-web
+spec:
+  type: NodePort
+  selector:
+    app: medicalalert-web
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+      nodePort: 30846
--- a/build/prod/web-default-conf-cm.yaml
+++ b/build/prod/web-default-conf-cm.yaml
@@ -0,0 +1,293 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: medicalalert-web-default-conf-cm
+  namespace: medicalalert-web
+  labels:
+    app: medicalalert-web
+data:
+  default.conf: |
+
+    # ---------------------
+    fastcgi_cache_path /var/lib/nginx/cache levels=1:2 keys_zone=MYAPP:100m inactive=60m;
+    fastcgi_cache_key "$scheme$request_method$host$request_uri";
+    # -----------------------------------------
+    fastcgi_intercept_errors on;
+    fastcgi_ignore_client_abort on;
+    fastcgi_buffers 8 16k;
+    fastcgi_buffer_size 32k;
+    fastcgi_read_timeout 120;
+    #fastcgi_index  index.php;
+    # --------------------------------
+    
+    # Only cache positive responses
+    proxy_cache_valid       200 1h;
+    proxy_cache_valid       301 302 15m;
+
+    server {
+        listen   80 default; ## listen for ipv4; this line is default and implied
+        listen   [::]:80 default ipv6only=on; ## listen for ipv6
+
+        server_name medicalalert.com "";
+        
+        return 301 https://www.$host$request_uri;
+
+        root /usr/share/nginx/subdomain/www;
+        index index.php index.html index.htm;
+       
+    }
+
+           
+  subdomain.conf: |
+
+    server {
+        listen   80;
+        listen   [::]:80;
+        
+        server_name ~^(?<subdomain>.+)\.medicalalert\.com$;
+        
+        if ($http_x_forwarded_proto != 'https') {
+        return 301 https://$host$request_uri;
+        }
+        
+        root /usr/share/nginx/subdomain/$subdomain;
+        index index.php index.html index.htm;
+        sendfile off;
+
+        # Security - Hide nginx version number in error pages and Server header
+        server_tokens off;
+
+        # Add stdout logging
+        error_log /dev/stdout error;
+        access_log /dev/stdout;
+
+        # reduce the data that needs to be sent over network
+        gzip on;
+        gzip_min_length 10240;
+        gzip_proxied expired no-cache no-store private auth;
+        gzip_types text/plain text/css text/xml application/json text/javascript application/x-javascript application/xml;
+        gzip_disable "MSIE [1-6]\.";
+        add_header 'Content-Security-Policy' 'upgrade-insecure-requests';
+        add_header X-Cache-Status $upstream_cache_status;
+        add_header Cache-Control "public";
+
+        #Cache everything by default
+        set $no_cache 0;
+
+        #Don't cache POST requests
+        if ($request_method = POST)
+        {
+            set $no_cache 1;
+        }
+
+        #Don't cache if the URL contains a query string
+        if ($query_string != "")
+        {
+            set $no_cache 1;
+        }
+
+        #Don't cache the following URLs
+        if ($request_uri ~* "/(administrator/|wp-login.php)")
+        {
+            set $no_cache 1;
+        }
+
+        #Don't cache if there is a cookie called PHPSESSID
+        if ($http_cookie = "PHPSESSID")
+        {
+            set $no_cache 1;
+        }
+
+        location / {
+            # First attempt to serve request as file, then
+            # as directory, then fall back to index.php
+            try_files $uri $uri/ /index.php?$args;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            fastcgi_param SUBDOMAIN $subdomain; # $_SERVER["SUBDOMAIN"]
+            include fastcgi_params;
+            fastcgi_cache MYAPP;
+            fastcgi_cache_valid 200 302 60m;
+            fastcgi_cache_valid 301      1h;
+            fastcgi_cache_valid any      1m;
+            fastcgi_cache_bypass $no_cache;
+            fastcgi_no_cache $no_cache;
+
+        }
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   /usr/share/nginx/subdomain/$subdomain;
+        }
+
+        # pass the PHP scripts to FastCGI server listening on socket
+        #
+        #~ \.php$
+        location ~ [^/]\.php(/|$)  {
+            proxy_set_header X-Forwarded-Proto $scheme;
+            try_files $uri $uri/ /index.php?$args;
+            if (!-f $document_root$fastcgi_script_name) {
+            return 404;
+            }
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            
+            fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+            fastcgi_index index.php;
+            include fastcgi_params;
+            fastcgi_param SUBDOMAIN $subdomain; # $_SERVER["SUBDOMAIN"]
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_cache MYAPP;
+            fastcgi_cache_valid 200 302 60m;
+            fastcgi_cache_valid 301      1h;
+            fastcgi_cache_valid any      1m;
+            fastcgi_cache_bypass $no_cache;
+            fastcgi_no_cache $no_cache;
+        }
+
+        location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
+            proxy_set_header X-Forwarded-Proto $scheme;
+            fastcgi_cache MYAPP;
+            fastcgi_cache_valid 200 302 60m;
+            fastcgi_cache_valid 301      1h;
+            fastcgi_cache_valid any      1m; 
+            proxy_cache_background_update on;
+            proxy_cache_lock on;
+        }
+
+        # deny access to . files, for security
+        #
+        location ~ /\. {
+                log_not_found off;
+                deny all;
+        }
+
+    }
+    
+  localhost.conf: |
+
+    server {
+        listen   80;
+        listen   [::]:80;
+        
+        server_name localhost 127.0.0.1;
+        root /usr/share/nginx/subdomain/www;
+        index index.php index.html index.htm;
+
+        sendfile off;
+        server_tokens off;
+        error_log /dev/stdout error;
+        access_log /dev/stdout;
+
+        # reduce the data that needs to be sent over network
+        gzip on;
+        gzip_min_length 10240;
+        gzip_proxied expired no-cache no-store private auth;
+        gzip_types text/plain text/css text/xml application/json text/javascript application/x-javascript application/xml;
+        gzip_disable "MSIE [1-6]\.";
+        add_header 'Content-Security-Policy' 'upgrade-insecure-requests';
+        add_header X-Cache-Status $upstream_cache_status;
+        add_header Cache-Control "public";
+
+        #Cache everything by default
+        set $no_cache 0;
+
+        #Don't cache POST requests
+        if ($request_method = POST)
+        {
+            set $no_cache 1;
+        }
+
+        #Don't cache if the URL contains a query string
+        if ($query_string != "")
+        {
+            set $no_cache 1;
+        }
+
+        #Don't cache the following URLs
+        if ($request_uri ~* "/(administrator/|wp-login.php)")
+        {
+            set $no_cache 1;
+        }
+
+        #Don't cache if there is a cookie called PHPSESSID
+        if ($http_cookie = "PHPSESSID")
+        {
+            set $no_cache 1;
+        }
+
+        location / {
+            # First attempt to serve request as file, then
+            # as directory, then fall back to index.php
+            try_files $uri $uri/ /index.php?$args;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            fastcgi_param SUBDOMAIN www; # $_SERVER["SUBDOMAIN"]
+            include fastcgi_params;
+            fastcgi_cache MYAPP;
+            fastcgi_cache_valid 200 302 60m;
+            fastcgi_cache_valid 301      1h;
+            fastcgi_cache_valid any      1m;
+            fastcgi_cache_bypass $no_cache;
+            fastcgi_no_cache $no_cache;
+
+        }
+
+        # redirect server error pages to the static page /50x.html
+        #
+        error_page   500 502 503 504  /50x.html;
+        location = /50x.html {
+            root   /usr/share/nginx/subdomain/www;
+        }
+
+        # pass the PHP scripts to FastCGI server listening on socket
+        #
+        #~ \.php$
+        location ~ [^/]\.php(/|$)  {
+            proxy_set_header X-Forwarded-Proto $scheme;
+            try_files $uri $uri/ /index.php?$args;
+            if (!-f $document_root$fastcgi_script_name) {
+            return 404;
+            }
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            
+            fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+            fastcgi_index index.php;
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param SUBDOMAIN www; # $_SERVER["SUBDOMAIN"]
+            fastcgi_cache MYAPP;
+            fastcgi_cache_valid 200 302 60m;
+            fastcgi_cache_valid 301      1h;
+            fastcgi_cache_valid any      1m;
+            fastcgi_cache_bypass $no_cache;
+            fastcgi_no_cache $no_cache;
+        }
+
+        location ~* \.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
+            proxy_set_header X-Forwarded-Proto $scheme;
+            fastcgi_cache MYAPP;
+            fastcgi_cache_valid 200 302 60m;
+            fastcgi_cache_valid 301      1h;
+            fastcgi_cache_valid any      1m; 
+            proxy_cache_background_update on;
+            proxy_cache_lock on;
+        }
+
+        # deny access to . files, for security
+        #
+        location ~ /\. {
+                log_not_found off;
+                deny all;
+        }
+        location ~ ^/(status|ping)$  {
+        access_log off;
+        allow 127.0.0.1;
+        deny all;
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME $fastcgi_script_name;
+        fastcgi_pass unix:/run/php/php7.4-fpm.sock;
+        }
+
+    }
--- a/build/prod/web-hpa.yml
+++ b/build/prod/web-hpa.yml
@@ -0,0 +1,13 @@
+apiVersion: autoscaling/v1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: medicalalert-web-hpa
+  namespace: medicalalert-web
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: medicalalert-web
+  minReplicas: 1
+  maxReplicas: 1
+  targetCPUUtilizationPercentage: 70