hw done

Otus-DevOps-2023-05 · Nov 16, 2023 · 0e1ae7e · 0e1ae7e
1 parent eeb738f
commit 0e1ae7e
Show file tree

Hide file tree

Showing 6 changed files with 61 additions and 7 deletions.
diff --git a/kubernetes/infra/main.tf b/kubernetes/infra/main.tf
@@ -12,7 +12,7 @@ module "a1-subnet" {
   subnet_name                 = "subnet-${var.project}-${var.environment}-a1"
   subnet_network_id           = yandex_vpc_network.network-otus-devops-prod.id
   subnet_zone                 = "ru-central1-a"
-  subnet_v4_cidr_blocks       = local.cidr_local
+  subnet_v4_cidr_blocks       = [local.cidr_local]
 
   depends_on = [yandex_vpc_network.network-otus-devops-prod]
 }
@@ -139,8 +139,8 @@ module "k8s-node-group-sa" {
   sa_role          = "container-registry.images.puller"
 }
 
-module "c1-k8s-cluster-calico" {
-  source                                = "../modules/k8s-cluster"
+module "c1-k8s-cluster" {
+  source                                = "../modules/k8s-cluster-calico"
   k8s_cluster_name                      = "cluster-1"
   k8s_cluster_project                   = var.project
   k8s_cluster_environment               = var.environment
@@ -213,3 +213,10 @@ resource "yandex_dns_recordset" "r1-dns-rs-otus-devops-prod" {
 
   depends_on = [yandex_dns_zone.z1-dns-zone-otus-devops]
 }
+
+resource "yandex_compute_disk" "disk-otus-devops-prod-k8s" {
+  name       = "k8s"
+  type       = "network-hdd"
+  zone       = "ru-central1-a"
+  size       = 4
+}
diff --git a/kubernetes/modules/k8s-cluster-calico/main.tf b/kubernetes/modules/k8s-cluster-calico/main.tf
@@ -32,8 +32,5 @@ resource "yandex_kubernetes_cluster" "k8s-cluster" {
 
   service_account_id      = data.yandex_iam_service_account.service_account.service_account_id
   node_service_account_id = data.yandex_iam_service_account.node_service_account.service_account_id
-  cluster_ipv4_range      = var.k8s_cluster_cluster_ipv4_range
-  service_ipv4_range      = var.k8s_cluster_service_ipv4_range
   network_policy_provider = "CALICO"
-
 }
diff --git a/kubernetes/reddit/mongo-deployment.yml b/kubernetes/reddit/mongo-deployment.yml
@@ -31,4 +31,5 @@ spec:
           mountPath: /data/db
       volumes:
       - name: mongo-persistent-storage
-        emptyDir: {}
+        persistentVolumeClaim:
+          claimName:  mongo-pvc
diff --git a/kubernetes/reddit/mongo-network-policy.yml b/kubernetes/reddit/mongo-network-policy.yml
@@ -0,0 +1,24 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: deny-db-traffic
+  labels:
+    app: reddit
+spec:
+  podSelector:
+    matchLabels:
+      app: reddit
+      component: mongo
+  policyTypes:
+  - Ingress
+  ingress:
+  - from:
+    - podSelector:
+        matchLabels:
+          app: reddit
+          component: comment
+    - podSelector:
+        matchLabels:
+          app: reddit
+          component: post
diff --git a/kubernetes/reddit/persistence-volume-claim.yml b/kubernetes/reddit/persistence-volume-claim.yml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mongo-pvc
+spec:
+  storageClassName: ""
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 4Gi
+  volumeName: mongo-pv
diff --git a/kubernetes/reddit/persistent-volume.yml b/kubernetes/reddit/persistent-volume.yml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mongo-pv
+spec:
+  capacity:
+    storage: 4Gi
+  accessModes:
+    - ReadWriteOnce
+  csi:
+    driver: disk-csi-driver.mks.ycloud.io
+    fsType: ext4
+    volumeHandle: fhmbc24g03jrlbb61p4g