Initial commit

camtiler/application.yml

@@ -0,0 +1,474 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: camtiler
+  annotations:
+    keel.sh/policy: force
+    keel.sh/trigger: poll
+spec:
+  revisionHistoryLimit: 0
+  replicas: 1
+  selector:
+    matchLabels:
+      app: camtiler
+  template:
+    metadata:
+      labels:
+        app: camtiler
+        component: camtiler
+    spec:
+      serviceAccountName: camtiler
+      containers:
+        - name: camtiler
+          image: harbor.k-space.ee/k-space/camera-tiler:latest
+          securityContext:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: log-viewer-frontend
+  annotations:
+    keel.sh/policy: force
+    keel.sh/trigger: poll
+spec:
+  revisionHistoryLimit: 0
+  replicas: 2
+  selector:
+    matchLabels:
+      app: log-viewer-frontend
+  template:
+    metadata:
+      labels:
+        app: log-viewer-frontend
+    spec:
+      containers:
+        - name: log-viewer-frontend
+          image: harbor.k-space.ee/k-space/log-viewer-frontend:latest
+#          securityContext:
+#            readOnlyRootFilesystem: true
+#            runAsNonRoot: true
+#            runAsUser: 1000
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: log-viewer-backend
+  annotations:
+    keel.sh/policy: force
+    keel.sh/trigger: poll
+spec:
+  revisionHistoryLimit: 0
+  replicas: 3
+  selector:
+    matchLabels:
+      app: log-viewer-backend
+  template:
+    metadata:
+      labels:
+        app: log-viewer-backend
+    spec:
+      containers:
+        - name: log-backend-backend
+          image: harbor.k-space.ee/k-space/log-viewer:latest
+          securityContext:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+          env:
+            - name: MONGO_URI
+              valueFrom:
+                secretKeyRef:
+                  name: mongodb-application-readwrite
+                  key: connectionString.standard
+            - name: MINIO_BUCKET
+              value: application
+            - name: MINIO_HOSTNAME
+              value: cams-s3.k-space.ee
+            - name: MINIO_PORT
+              value: "443"
+            - name: MINIO_SCHEME
+              value: "https"
+            - name: MINIO_SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: minio-secret
+                  key: secretkey
+            - name: MINIO_ACCESS_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: minio-secret
+                  key: accesskey
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: log-viewer-frontend
+spec:
+  type: ClusterIP
+  selector:
+    app: log-viewer-frontend
+  ports:
+  - protocol: TCP
+    port: 3003
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: log-viewer-backend
+spec:
+  type: ClusterIP
+  selector:
+    app: log-viewer-backend
+  ports:
+  - protocol: TCP
+    port: 3002
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: camtiler
+  annotations:
+    prometheus.io/scrape: 'true'
+  labels:
+    component: camtiler
+spec:
+  type: ClusterIP
+  selector:
+    app: camtiler
+    component: camtiler
+  ports:
+  - protocol: TCP
+    port: 5001
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: camtiler
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: camtiler
+rules:
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["list"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: camtiler
+subjects:
+- kind: ServiceAccount
+  name: camtiler
+  apiGroup: ""
+roleRef:
+  kind: Role
+  name: camtiler
+  apiGroup: ""
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: camtiler
+  annotations:
+    kubernetes.io/ingress.class: traefik
+
+    # Following specifies the certificate issuer defined in
+    # ../cert-manager/issuer.yml
+    # This is where the HTTPS certificates for the
+    # `tls:` section below are obtained from
+    cert-manager.io/cluster-issuer: default
+
+    # This tells Traefik this Ingress object is associated with the
+    # https:// entrypoint
+    # Global http:// to https:// redirect is enabled in
+    # ../traefik/values.yml using `globalArguments`
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+
+    # Following enables Authelia intercepting middleware
+    # which makes sure user is authenticated and then
+    # proceeds to inject Remote-User header for the application
+    traefik.ingress.kubernetes.io/router.middlewares: traefik-sso@kubernetescrd
+
+    traefik.ingress.kubernetes.io/router.tls: "true"
+
+    # Following tells external-dns to add CNAME entry which makes
+    # cams.k-space.ee point to same IP address as traefik.k-space.ee
+    # The A record for traefik.k-space.ee is created via annotation
+    # added in ../traefik/ingress.yml
+    external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
+spec:
+  rules:
+  - host: cams.k-space.ee
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/tiled"
+        backend:
+          service:
+            name: camtiler
+            port:
+              number: 5001
+      - pathType: Prefix
+        path: "/events"
+        backend:
+          service:
+            name: log-viewer-backend
+            port:
+              number: 3002
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: log-viewer-frontend
+            port:
+              number: 3003
+  tls:
+  - hosts:
+    - cams.k-space.ee
+    secretName: camtiler-tls
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: camera-operator
+  annotations:
+    keel.sh/policy: force
+    keel.sh/trigger: poll
+spec:
+  revisionHistoryLimit: 0
+  replicas: 1
+  serviceName: camera-operator
+  selector:
+    matchLabels:
+      app: camera-operator
+  template:
+    metadata:
+      labels:
+        app: camera-operator
+    spec:
+      serviceAccount: camera-operator
+      containers:
+        - name: camera-operator
+          image: harbor.k-space.ee/k-space/camera-operator:latest
+          securityContext:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+          env:
+            - name: MY_POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: camera-operator
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - create
+  - delete
+  - list
+  - update
+- apiGroups:
+  - apps
+  resources:
+  - deployments
+  verbs:
+  - create
+  - delete
+  - list
+  - update
+- apiGroups:
+  - k-space.ee
+  resources:
+  - cams
+  verbs:
+  - get
+  - list
+  - watch
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: camera-operator
+subjects:
+- kind: ServiceAccount
+  name: camera-operator
+roleRef:
+  kind: Role
+  name: camera-operator
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: camera-operator
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: camera-motion-detect
+spec:
+  podSelector:
+    matchLabels:
+      component: camdetect
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          component: camtiler
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: monitoring
+      podSelector:
+        matchLabels:
+          app: prometheus
+  egress:
+    - to:
+        - ipBlock:
+            # Permit access to cameras outside the cluster
+            cidr: 100.102.0.0/16
+    - to:
+      - podSelector:
+          matchLabels:
+            app: mongodb-svc
+      ports:
+      - port: 27017
+    - to:
+      - podSelector:
+          matchLabels:
+            v1.min.io/tenant: minio
+      ports:
+      - port: 9000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: camera-tiler
+spec:
+  podSelector:
+    matchLabels:
+      component: camtiler
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          component: camdetect
+    ports:
+    - port: 5000
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: monitoring
+      podSelector:
+        matchLabels:
+          app: prometheus
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: traefik
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: traefik
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: log-viewer-backend
+spec:
+  podSelector:
+    matchLabels:
+      app: log-viewer-backend
+  policyTypes:
+  - Ingress
+  - Egress
+  egress:
+    - to:
+      - podSelector:
+          matchLabels:
+            app: mongodb-svc
+    - to:
+      - podSelector:
+          matchLabels:
+            v1.min.io/tenant: minio
+      ports:
+      - port: 9000
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: traefik
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: traefik
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: log-viewer-frontend
+spec:
+  podSelector:
+    matchLabels:
+      app: log-viewer-frontend
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: traefik
+      podSelector:
+        matchLabels:
+          app.kubernetes.io/name: traefik
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: minio
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    cert-manager.io/cluster-issuer: default
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    external-dns.alpha.kubernetes.io/target: traefik.k-space.ee
+spec:
+  rules:
+  - host: cams-s3.k-space.ee
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: minio
+            port:
+              number: 80
+  tls:
+  - hosts:
+    - cams-s3.k-space.ee
+    secretName: cams-s3-tls