Kubernetes files

These are the differente files passed to the kubeserver api for populating the cluster

Namespace

All the different resources used are found in the namespace: repospace

Custom resource definiton (CRD)

This file is deployed in the cluster, allowing us to extend the kube sever api endpoints, adding reporetriever as a new item

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  # name must be in the form: <plural>.<group>
  name: reporetrievers.amadeus.com
spec:
  # group name to use for REST API: /apis/<group>/<version>
  group: amadeus.com
  scope: Namespaced
  names:
    # kind is normally the CamelCased singular type. 
    kind: RepoRetriever
    # singular name to be used as an alias on the CLI
    singular: reporetriever
    # plural name in the URL: /apis/<group>/<version>/<plural>
    plural: reporetrievers
  versions:
  - name: v1
    served: true
    storage: true
    schema:
      openAPIV3Schema:
        type: object
        properties:
          repoUrl: 
            type: string
          hashRef:
            type: string
          privateKeySecretRef:
            type: string
          spec:
            x-kubernetes-preserve-unknown-fields: true

Custom object (CO)

This file is deployed in the cluster, inserting a new element in the reporetriever item previously added.

apiVersion: amadeus.com/v1
kind: RepoRetriever
metadata: 
  name: reporetrieverobject
spec:
  repoUrl: your_repo_url
  hashRef: hash_reference_desired
  privateKeySecretRef: key_secret_name

Secret

For been able to consume the datasource we need some credentials, a difference of the others files, this is generated by the following command (kubectl needs to be installed):

# assure kubectl is installed
kubectl -n repospace create secret generic keys --from-file=privateKey=<PRIVATE_SSH_KEY_PATH> --from-file=knownHosts=<KNOWNHOST_PATH> --from-file=pvtKey=<PRIVATE_KEY_FILE_PATH> --from-literal=passphrase=\"\"

Role based acces control (RBAC)

For regulating the access and been able to request the kube server api

Role and role bindings for CRD

For been able to consume custom objects

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: reporetriever-reader
rules:
- apiGroups: ["amadeus.com"]
  resources: ["reporetrievers"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: reporetriever-reader-binding
subjects:
- kind: ServiceAccount
  name: default
roleRef:
  kind: Role
  name: reporetriever-reader
  apiGroup: rbac.authorization.k8s.io

Role and role bindings for secrets

For been able to consume secrets

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: secret-access-role
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: secret-access-binding
subjects:
- kind: ServiceAccount
  name: default
roleRef:
  kind: Role
  name: secret-access-role
  apiGroup: rbac.authorization.k8s.io

Pod

This file will generate a pod that demands via csi driver the fuse filesysem

#Not finished yet

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ubuntu-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ubuntu
  template:
    metadata:
      labels:
        app: ubuntu
    spec:
      nodeSelector:
        kubernetes.io/hostname: minikube
      # initContainers:
      #   - name: init-myservice
      #     image: bash
      #     command: ['bash', '-c', 'umount -l /data ; true']
      #     securityContext:
      #       privileged: true
      #       capabilities:
      #         add:
      #           - SYS_ADMIN
      #     volumeMounts:
      #       - name: emptydir-volume-host
      #         mountPath: /data
      containers:
        - name: retrieving-container
          image: go-backend:latest # custom docker image that retrieves the data
          # lifecycle:
          #   postStart:
          #     exec:
          #       command:
          #         - "/bin/sh"
          #         - "-c"
          #         - "./main &"
          #   preStop:
          #     exec:
          #       command: ["bash", "-c", "umount -f /data"]
          env:
            - name: NAMESPACE
              value: "repospace"
            - name: CUSTOM_OBJECT
              value: "reporetrieverobject"
            - name: MOUNTDIR
              value: "./myFs/tmpMountPoint"
          imagePullPolicy: Never  # Added line
          # volumeMounts:
          #   - name: emptydir-volume
          #     mountPath: /prev/data
          #   - name: emptydir-volume-host
          #     mountPath: /data
          securityContext:
            privileged: true
            capabilities:
              add:
                - SYS_ADMIN
        # - name: debian-container
        #   image: debian:stable-20240211-slim
        #   imagePullPolicy: Always  # Added line
        #   command: ["sleep","3600"]
        #   volumeMounts:
        #     - name: emptydir-volume-host-clonedir
        #       mountPath: /data
        #     - name: emptydir-volume-host-mountpoint
        #       mountPath: /tmp/cloneDir
        #     - name: emptydir-volume
        #       mountPath: /prev/data
        #       readOnly: true
      volumes:
        - name: emptydir-volume # empty dir volume shared between the retriever and the other containers
          emptyDir: {}
        - name: emptydir-volume-host-mountpoint
          hostPath:
            path: /data/fuse
            # type: DirectoryOrCreate
        - name: emptydir-volume-host-clonedir
          hostPath:
            path: /tmp/cloneDir