diff --git a/docs/install/kubernetes.md b/docs/install/kubernetes.md index 992be89c0..8a67b5de1 100644 --- a/docs/install/kubernetes.md +++ b/docs/install/kubernetes.md @@ -1,22 +1,26 @@ -**!!! info "Community Contributed" This guide was contributed by the community and is neither officially supported, nor updated or tested.** +!!! info "Community Contributed" + This guide was contributed by the community and is neither officially supported, nor updated or tested. -# K8s Setup +## K8s Setup This is a setup which should be sufficent for production use. Be sure to replace the default secrets! -# Files +## Files -## 10-configmap.yaml +### 10-configmap.yaml The nginx config map. This is loaded as nginx.conf in the nginx sidecar to configure nginx to deliver static content. -## 15-secrets.yaml +### 15-secrets.yaml -The secrets **replace them!!** This file is only here for a quick start. Be aware that changing secrets after installation will be messy and is not documented here. **You should set new secrets before the installation.** As you are reading this document **before** the installation ;-) +!!! warning "Contains secrets" + **Replace them!** -Create your own postgresql passwords and the secret key for the django app +This file is only here for a quick start. Be aware that changing secrets after installation will be messy and is not documented here. **You should set new secrets before the installation.** As you are reading this document **before** the installation ;-) -see also [Managing Secrets using kubectl](https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/) +Create your own postgresql passwords and the secret key for the django app. + +See also [Managing Secrets using kubectl](https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/) **Replace** `db-password`, `postgres-user-password` and `secret-key` **with something - well - secret :-)** @@ -35,37 +39,37 @@ kubectl create secret generic recipes \ --from-file=secret-key=./secret-key.txt ~~~ -## 20-service-account.yml +### 20-service-account.yml Creating service account `recipes` for deployment and stateful set. -## 30-pvc.yaml +### 30-pvc.yaml The creation of the persistent volume claims for media and static content. May you want to increase the size. This expects to have a storage class installed. -## 40-sts-postgresql.yaml +### 40-sts-postgresql.yaml The PostgreSQL stateful set, based on a bitnami image. It runs a init container as root to do the preparations. The postgres container itsef runs as a lower privileged user. The recipes app uses the database super user (postgres) as the recipies app is doing some db migrations on startup, which needs super user privileges. -## 45-service-db.yaml +### 45-service-db.yaml Creating the database service. -## 50-deployment.yaml +### 50-deployment.yaml The deployment first fires up a init container to do the database migrations and file modifications. This init container runs as root. The init conainer runs part of the [boot.sh](https://github.com/TandoorRecipes/recipes/blob/develop/boot.sh) script from the `vabene1111/recipes` image. The deployment then runs two containers, the recipes-nginx and the recipes container which runs the gunicorn app. The nginx container gets it's nginx.conf via config map to deliver static content `/static` and `/media`. The guincorn container gets it's secret key and the database password from the secret `recipes`. `gunicorn` runs as user `nobody`. -## 60-service.yaml +### 60-service.yaml Creating the app service. -## 70-ingress.yaml +### 70-ingress.yaml Setting up the ingress for the recipes service. Requests for static content `/static` and `/media` are send to the nginx container, everything else to gunicorn. TLS setup via cert-manager is prepared. You have to **change the host** from `recipes.local` to your specific domain. -# Conclusion +## Conclusion All in all: @@ -80,16 +84,16 @@ I tried the setup with [kind](https://kind.sigs.k8s.io/) and it runs well on my There is a warning, when you check your system as super user: -**Media Serving Warning** -Serving media files directly using gunicorn/python is not recommend! Please follow the steps described here to update your installation. +!!! warning "Media Serving Warning" + Serving media files directly using gunicorn/python is not recommend! Please follow the steps described here to update your installation. I don't know how this check works, but this warning is simply wrong! ;-) Media and static files are routed by ingress to the nginx container - I promise :-) -# Updates +## Updates These manifests are tested against Release 1.0.1. Newer versions may not work without changes. -# Apply the manifets +## Apply the manifets To apply the manifest with kubectl, use the following command: