# -*- mode: ruby -*-
# vi: set ft=ruby :

## configuration variables ##
# max number of worker nodes
N = 3 

# each of components to install 
k8s_V = '1.20.2'           # Kubernetes 
docker_V = '19.03.14-3.el7' # Docker  
ctrd_V = '1.3.9-3.1.el7'   # Containerd 
## /configuration variables ##

Vagrant.configure("2") do |config|

config.vm.define "WO-m-k8s-#{k8s_V[0..3]}" do |cfg|

cfg.vm.box = "sysnet4admin/CentOS-k8s"

cfg.vm.provider "virtualbox" do |vb|
  vb.name = "WO-m-k8s-#{k8s_V[0..3]}(github_SysNet4Admin)"
  vb.cpus = 2
  vb.memory = 1746
  vb.customize ["modifyvm", :id, "--groups", "/WO-k8s-SgMST-#{k8s_V[0..3]}(github_SysNet4Admin)"]
end

cfg.vm.host_name = "m-k8s"
cfg.vm.network "private_network", ip: "192.168.1.10"
cfg.vm.network "forwarded_port", guest: 22, host: 60010, auto_correct: true, id: "ssh"
cfg.vm.synced_folder "../data", "/vagrant", disabled: true 

cfg.vm.provision "shell", path: "k8s_env_build.sh", args: N
cfg.vm.provision "shell", path: "k8s_pkg_cfg.sh", args: [ k8s_V, docker_V, ctrd_V ]
#cfg.vm.provision "shell", path: "master_node.sh"
cfg.vm.provision "shell", path: "k_cfg_n_git_clone.sh" # add kubectl config & git clone source

(1..N).each do |i|

config.vm.define "WO-w#{i}-k8s-#{k8s_V[0..3]}" do |cfg|
  cfg.vm.box = "sysnet4admin/CentOS-k8s"
  cfg.vm.provider "virtualbox" do |vb|
    vb.name = "WO-w#{i}-k8s-#{k8s_V[0..3]}(github_SysNet4Admin)"
    vb.cpus = 1
    vb.memory = 1024
    vb.customize ["modifyvm", :id, "--groups", "/WO-k8s-SgMST-#{k8s_V[0..3]}(github_SysNet4Admin)"]
  end
  cfg.vm.host_name = "w#{i}-k8s"
  cfg.vm.network "private_network", ip: "192.168.1.10#{i}"
  cfg.vm.network "forwarded_port", guest: 22, host: "6010#{i}", auto_correct: true, id: "ssh"
  cfg.vm.synced_folder "../data", "/vagrant", disabled: true
  cfg.vm.provision "shell", path: "k8s_env_build.sh", args: N
  cfg.vm.provision "shell", path: "k8s_pkg_cfg.sh", args: [ k8s_V, docker_V, ctrd_V ]
  #cfg.vm.provision "shell", path: "work_nodes.sh"

#!/usr/bin/env bash

# vim configuration 
echo 'alias vi=vim' >> /etc/profile

# swapoff -a to disable swapping
swapoff -a

# sed to comment the swap partition in /etc/fstab
sed -i.bak -r 's/(.+ swap .+)/#\1/' /etc/fstab

# kubernetes repo
gg_pkg="packages.cloud.google.com/yum/doc" # Due to shorten addr for key
cat <<EOF > /etc/yum.repos.d/kubernetes.repo
[kubernetes]
name=Kubernetes
baseurl=https://packages.cloud.google.com/yum/repos/kubernetes-el7-x86_64
enabled=1
gpgcheck=0
repo_gpgcheck=0
gpgkey=https://${gg_pkg}/yum-key.gpg https://${gg_pkg}/rpm-package-key.gpg
EOF

# add docker-ce repo
yum install yum-utils -y 
yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo

# Set SELinux in permissive mode (effectively disabling it)
setenforce 0
sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

# RHEL/CentOS 7 have reported traffic issues being routed incorrectly due to iptables bypassed
cat <<EOF >  /etc/sysctl.d/k8s.conf
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
EOF
modprobe br_netfilter

# local small dns & vagrant cannot parse and delivery shell code.
echo "192.168.1.10 m-k8s" >> /etc/hosts
for (( i=1; i<=$1; i++  )); do echo "192.168.1.10$i w$i-k8s" >> /etc/hosts; done

# config DNS  
cat <<EOF > /etc/resolv.conf
nameserver 1.1.1.1 #cloudflare DNS
nameserver 8.8.8.8 #Google DNS
EOF

# install util packages 
yum install epel-release -y
yum install vim-enhanced -y
yum install git -y

# install docker 
yum install docker-ce-$2 docker-ce-cli-$2 containerd.io-$3 -y

# install kubernetes
# both kubelet and kubectl will install by dependency
# but aim to latest version. so fixed version by manually
yum install kubelet-$1 kubectl-$1 kubeadm-$1 -y 

# Ready to install for k8s 
systemctl enable --now docker
systemctl enable --now kubelet

# install bash-completion for kubectl 
yum install bash-completion -y 

# kubectl completion on bash-completion dir
kubectl completion bash >/etc/bash_completion.d/kubectl

# alias kubectl to k 
echo 'alias k=kubectl' >> ~/.bashrc
echo 'complete -F __start_kubectl k' >> ~/.bashrc

# git clone k8s-code
git clone https://github.com/sysnet4admin/_Lecture_k8s_learning.kit.git
mv /home/vagrant/_Lecture_k8s_learning.kit $HOME
find $HOME/_Lecture_k8s_learning.kit -regex ".*\.\(sh\)" -exec chmod 700 {} \;

# init kubernetes 
kubeadm init --token 123456.1234567890123456 --token-ttl 0 \
--pod-network-cidr=172.16.0.0/16 --apiserver-advertise-address=192.168.1.10

# config for master node only 
mkdir -p $HOME/.kube
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

# raw_address for gitcontent
raw_git="raw.githubusercontent.com/sysnet4admin/IaC/master/manifests" 

# config for kubernetes's network 
kubectl apply -f https://$raw_git/172.16_net_calico_v1.yaml

# config for work_nodes only 
kubeadm join --token 123456.1234567890123456 \
             --discovery-token-unsafe-skip-ca-verification 192.168.1.10:6443

apiVersion: v1 # pod version
kind: Pod # Object type
metadata: # information of pod
  labels:
    run: po-nginx
  name: po-nginx
spec: # spec of pod
  containers:  # information of container
  - image: nginx
    name: nginx

apiVersion: apps/v1 # deployment version
kind: Deployment # object type
metadata: # information of deployment
  labels:
    app: deploy-nginx
  name: deploy-nginx
spec:  # spec of deployment
  replicas: 3  # replica set
  selector:  # choose templete
    matchLabels:
      app: po-nginx
  template:  # templete to make pod
    metadata:
      labels:
        app: po-nginx
    spec:
      containers:  # information of container
      - name: nginx  
        image: nginx  # container image

apiVersion: apps/v1 # replicaset version
kind: ReplicaSet # object type
metadata: # information of replicaset
  labels:
    app: rs-nginx
  name: rs-nginx
spec:  # spec of replicaset
  replicas: 3
  selector:  # choose templete
    matchLabels:
      app: po-nginx
  template:  # templete to make pod
    metadata:
      labels:
        app: po-nginx
    spec:
      containers:  # information of container
      - image: nginx  # container image
        name: nginx

apiVersion: batch/v1  # job version
kind: Job  # object type
metadata:  # information of job
  name: job-curl-succ
spec:  # spec of job
  template:  # templete to make job
    spec:
      containers: # information of container
      - name: net-tools
        image: sysnet4admin/net-tools  # container image
        command: ["curlchk",  "nginx"]
      restartPolicy: Never  # restart option

apiVersion: batch/v1  # job version
kind: Job  # object type
metadata:  # information of job
  name: job-completions 
spec:  # spec of job
  completions: 3  # run sequentially 3 times
  template:  # templete to make job
    spec:
      containers:
      - name: net-tools
        image: sysnet4admin/net-tools  # container image
        command: ["curlchk",  "nginx"]
      restartPolicy: Never  # restart option

apiVersion: batch/v1  # job version
kind: Job  # object type
metadata:  # information of job
  name: job-parallelism
spec:  # spec of job
  parallelism: 3  # run parallely 3 times
  template:  # templete to make job
    spec:
      containers:
      - name: net-tools
        image: sysnet4admin/net-tools  # container image
        command: ["curlchk",  "nginx"]
      restartPolicy: Never  # restart option

apiVersion: batch/v1  # job version
kind: Job  # object type
metadata:  # information of job
  name: job-activedeadlineseconds
spec:  # spec of job
  backoffLimit: 3
  activeDeadlineSeconds: 30  # dead time after run command
  template:  # templete to make job
    spec:
      containers:
      - name: net-tools
        image: sysnet4admin/net-tools  # container image
        command: ["/bin/sh", "-c"]
        args:
        - sleep 60;
          curlchk nginx;  
      restartPolicy: Never  # restart option

apiVersion: batch/v1  # job version
kind: Job  # object type
metadata: # information of job
  name: job-ttlsecondsafterfinished
spec:  # spec of job
  backoffLimit: 3
  ttlSecondsAfterFinished: 30 # dead time after completed
  template:  # templete to make job
    spec:
      containers:
      - name: net-tools
        image: sysnet4admin/net-tools  # container image
        command: ["/bin/sh", "-c"]
        args:
        - sleep 60;
          curlchk nginx;  
      restartPolicy: Never  # restart option

apiVersion: batch/v1  # cron job version
kind: CronJob  #  object type
metadata:  # information of cron job
  name: cj-1m-hist3-curl 
spec:  # spec of cron job
  schedule: "*/1 * * * *"  # cron rule
  jobTemplate:             # Template for job 
    spec:                  # same as before 
      template:  # templete to make job
        spec:
          containers:
          - name: net-tools
            image: sysnet4admin/net-tools  # container image
            command: ["curlchk",  "nginx"]
          restartPolicy: Never   # restart option

apiVersion: batch/v1  # cron job version
kind: CronJob  #  object type
metadata:  # information of cron job
  name: cj-1m-hist10-curl 
spec:  # spec of cron job
  schedule: "*/1 * * * *"   # cron rule
  successfulJobsHistoryLimit: 10
  jobTemplate:             # Template for job 
    spec:                  # same as before 
      template:  # templete to make job
        spec:
          containers:
          - name: net-tools
            image: sysnet4admin/net-tools  # container image
            command: ["curlchk",  "nginx"]
          restartPolicy: Never  # restart option

apiVersion: apps/v1  # daemon set version
kind: DaemonSet  #  object type
metadata:  # information of daemon set
  labels:
    app: ds-nginx 
  name: ds-nginx
spec:  # spec of daemon set
  selector:
    matchLabels:
      app: po-nginx 
  template:  # Template for job 
    metadata:
      labels:
        app: po-nginx
    spec:  # same as before 
      containers:
      - name: nginx 
        image: nginx # container image

apiVersion: apps/v1  # StatefulSet version
kind: StatefulSet  #  object type
metadata:  # information of StatefulSet
  name: sts-chk-hn
spec:  # spec of StatefulSet
  replicas: 3
  serviceName: sts-svc-domain #statefulset need it
  selector:
    matchLabels:
      app: sts
  template:  # Template for StatefulSet 
    metadata:
      labels:
        app: sts
    spec:
      containers:
      - name: chk-hn
        image: sysnet4admin/chk-hn  # container image

apiVersion: v1
kind: Pod
metadata:
  name: fwd-chk-hn
spec:
  containers:
  - name: chk-hn 
    image: sysnet4admin/chk-hn

apiVersion: v1
kind: Pod
metadata:
  name: hp-chk-hn 
spec:
  containers:
  - name: chk-hn
    image: sysnet4admin/chk-hn
    ports:
    - containerPort: 80
      hostPort: 8080

apiVersion: v1
kind: Pod
metadata:
  name: hnet-chk-hn
spec:
  hostNetwork: true
  containers:
    - name: chk-hn
      image: sysnet4admin/chk-hn 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-nginx
  labels:
    app: deploy-nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-nginx
  template:
    metadata:
      labels:
        app: deploy-nginx 
    spec:
      containers:
      - name: nginx
        image: nginx
---  # separator for objects
apiVersion: v1
kind: Service
metadata:
  name: np-nginx 
spec:
  selector:
    app: deploy-nginx  # deployment to expose
  ports:
    - name: http
      port: 80  # service
      targetPort: 80  # pod
      nodePort: 30000 #option 
  type: NodePort # using NodePort

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-nginx
  labels:
    app: deploy-nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-nginx
  template:
    metadata:
      labels:
        app: deploy-nginx 
    spec:
      containers:
      - name: nginx
        image: nginx
---
apiVersion: v1
kind: Service
metadata:
  name: lb-nginx 
spec:
  selector:
    app: deploy-nginx  
  ports:
    - name: http
      port: 80
      targetPort: 80 
  type: LoadBalancer

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-chk-ip
  labels:
    app: deploy-chk-ip
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-chk-ip
  template:
    metadata:
      labels:
        app: deploy-chk-ip 
    spec:
      containers:
      - name: chk-ip
        image: sysnet4admin/chk-ip
---
apiVersion: v1
kind: Service
metadata:
  name: lb-chk-ip 
spec:
  selector:
    app: deploy-chk-ip  
  ports:
    - name: http
      port: 80
      targetPort: 80 
  type: LoadBalancer

apiVersion: v1
kind: Service
metadata:
  name: ex-url-1 
  namespace: default
spec:
  type: ExternalName 
  externalName: sysnet4admin.github.io # External Domain Name

apiVersion: v1
kind: Service
metadata:
  name: ex-url-2 
  namespace: default
spec:
  type: ExternalName
  externalName: k8s-edu.github.io # changable as you want 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-nginx
  labels:
    app: deploy-nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-nginx
  template:
    metadata:
      labels:
        app: deploy-nginx 
    spec:
      containers:
      - name: nginx
        image: nginx
---
apiVersion: v1
kind: Service
metadata:
  name: cl-nginx 
spec:
  selector:
    app: deploy-nginx  
  ports:  # ClusterIP has port and target port to connect each other. 
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-nginx
  labels:
    app: deploy-nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-nginx
  template:
    metadata:
      labels:
        app: deploy-nginx 
    spec:
      containers:
      - name: nginx
        image: nginx
---
apiVersion: v1
kind: Service
metadata:
  name: hdl-nginx 
spec:
  selector:
    app: deploy-nginx  
  ports:
    - name: http
      port: 80
      targetPort: 80
  clusterIP: None # Headless has no type and no IP.

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sts-chk-hn
spec:
  replicas: 3
  serviceName: sts-svc-domain #statefulset need it
  selector:
    matchLabels:
      app: sts
  template:
    metadata:
      labels:
        app: sts
    spec:
      containers:
      - name: chk-hn
        image: sysnet4admin/chk-hn
---
apiVersion: v1
kind: Service
metadata:
  name: sts-svc-domain
spec:
  selector:
    app: sts
  ports:
    - port: 80
  clusterIP: None

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-chk-ip
  labels:
    app: deploy-chk-ip
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-chk-ip
  template:
    metadata:
      labels:
        app: deploy-chk-ip 
    spec:
      containers:
      - name: chk-ip
        image: sysnet4admin/chk-ip
---
apiVersion: v1
kind: Service
metadata:
  name: lb-chk-ip 
spec:
  selector:
    app: deploy-chk-ip  
  ports:
    - name: http
      port: 80
      targetPort: 80 
  type: LoadBalancer

apiVersion: v1
kind: Service
metadata:
  name: external-data 
spec:
  ports:
    - name: http
      port: 80
      targetPort: 80
---
apiVersion: v1
kind: Endpoints
metadata:
  name: external-data # match name with service.
subsets:
  - addresses:
      - ip: 192.168.1.11 # LoadBalancer IP
    ports:
      - name: http
        port: 80

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-nginx
  labels:
    app: deploy-nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-nginx
  template:
    metadata:
      labels:
        app: deploy-nginx 
    spec:
      containers:
      - name: nginx
        image: nginx
---
apiVersion: v1
kind: Service
metadata:
  name: ing-default 
spec:
  selector:
    app: deploy-nginx  
  ports:
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-hn
  labels:
    app: deploy-hn
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-hn
  template:
    metadata:
      labels:
        app: deploy-hn
    spec:
      containers:
      - name: chk-hn
        image: sysnet4admin/chk-hn
---
apiVersion: v1
kind: Service
metadata:
  name: ing-hn 
spec:
  selector:
    app: deploy-hn  
  ports:
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-ip
  labels:
    app: deploy-ip
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-ip
  template:
    metadata:
      labels:
        app: deploy-ip
    spec:
      containers:
      - name: chk-ip
        image: sysnet4admin/chk-ip
---
apiVersion: v1
kind: Service
metadata:
  name: ing-ip 
spec:
  selector:
    app: deploy-ip  
  ports:
    - name: http
      port: 80
      targetPort: 80
  type: ClusterIP

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  annotations: # set default path
    kubernetes.io/ingress.class: "nginx"
spec:
  rules:
  - http:
      paths:
      - path: / 
        pathType: Prefix
        backend:
          service:
            name: ing-default
            port:
              number: 80
      - path: /hn
        pathType: Prefix
        backend:
          service:
            name: ing-hn
            port:
              number: 80
      - path: /ip 
        pathType: Prefix
        backend:
          service:
            name: ing-ip
            port:
              number: 80

apiVersion: v1
kind: Pod # make emptyDir as a pod
metadata:
  name: pod-emptydir 
  labels:
    app: nginx 
spec:
  containers:
  - name: web-page # make container 1
    image: nginx 
    volumeMounts:
    - mountPath: /usr/share/nginx/html # container 1 first page
      name: empty-directory 

  - name: html-builder # make container 2
    image: alpine 
    volumeMounts:
    - mountPath: /html-dir # container 2 first page is /html-dir/index.html
      name: empty-directory 
    command: ["/bin/sh", "-c"]
    args: 
      - echo "This page created on $(date +%Y-%m-%d)" > /html-dir/index.html;
        sleep infinity;
        
  volumes:
  - name: empty-directory 
    emptyDir: {}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-hostpath
  labels:
    app: deploy-hostpath
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-hostpath 
  template:
    metadata:
      labels:
        app: deploy-hostpath 
    spec:
      containers:
      - name: host-mon
        image: sysnet4admin/sleepy
        volumeMounts:
        - mountPath: /host-log  
          name: hostpath-directory 
      volumes:
      - name: hostpath-directory 
        hostPath:
          path: /var/log

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: ds-hostpath
  labels:
    app: ds-hostpath
spec:
  selector:
    matchLabels:
      app: ds-hostpath 
  template:
    metadata:
      labels:
        app: ds-hostpath 
    spec:
      containers:
      - name: host-mon
        image: sysnet4admin/sleepy
        volumeMounts:
        - mountPath: /host-log  
          name: hostpath-directory 
      volumes:
      - name: hostpath-directory 
        hostPath:
          path: /var/log

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-nfs
  labels:
    app: deploy-nfs
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-nfs
  template:
    metadata:
      labels:
        app: deploy-nfs
    spec:
      containers:
      - name: chk-log 
        image: sysnet4admin/chk-log
        volumeMounts:
        - name: nfs-vol
          mountPath: /audit
      volumes:
      - name: nfs-vol
        nfs:
          server: 192.168.1.10
          path: /nfs_shared/nfs-vol

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-pvc
  labels:
    app: deploy-pvc 
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-pvc
  template:
    metadata:
      labels:
        app: deploy-pvc
    spec:
      containers:
      - name: chk-log 
        image: sysnet4admin/chk-log
        volumeMounts:
        - name: pvc-vol
          mountPath: /audit
      volumes:
      - name: pvc-vol
        persistentVolumeClaim:
          claimName: pvc-nfs # created pvc name

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-nfs 
spec:
  capacity:
    storage: 100Mi
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  nfs:
    server: 192.168.1.10
    path: /nfs_shared/pvc-vol

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-nfs  
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Mi

kind: Deployment
apiVersion: apps/v1
metadata:
  name: nfs-client-provisioner
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nfs-client-provisioner
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: nfs-client-provisioner
    spec:
      serviceAccountName: nfs-client-provisioner
      containers:
        - name: nfs-client-provisioner
          image: k8s.gcr.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2
          volumeMounts:
            - name: nfs-client-root
              mountPath: /persistentvolumes
          env:
            - name: PROVISIONER_NAME
              value: k8s-sigs.io/nfs-subdir-external-provisioner
            - name: NFS_SERVER # NFS Server
              value: 192.168.1.10
            - name: NFS_PATH
              value: /nfs_shared/dynamic-vol
      volumes:
        - name: nfs-client-root
          nfs:
            server: 192.168.1.10 # NFS Client Root
            path: /nfs_shared/dynamic-vol

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: managed-nfs-storage
# or choose another name, must match deployment's env PROVISIONER_NAME'
provisioner: k8s-sigs.io/nfs-subdir-external-provisioner 
parameters:
  # waits for nfs.io/storage-path annotation, if not specified will accept as empty string.
  pathPattern: "${.PVC.namespace}/${.PVC.annotations.nfs.io/storage-path}" 
  onDelete: delete

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-dynamic  
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Gi
  storageClassName: managed-nfs-storage # name of StorageClass

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-pvc 
  labels:
    app: deploy-pvc 
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-pvc
  template:
    metadata:
      labels:
        app: deploy-pvc
    spec:
      containers:
      - name: chk-log 
        image: sysnet4admin/chk-log
        volumeMounts:
        - name: pvc-vol
          mountPath: /audit
      volumes:
      - name: pvc-vol
        persistentVolumeClaim:
          claimName: pvc-dynamic # PVC name 

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: sts
spec:
  replicas: 3
  serviceName: sts-svc-domain #statefulset need it
  selector:
    matchLabels:
      app: sts
  template:
    metadata:
      labels:
        app: sts
    spec:
      containers:
      - name: chk-hn
        image: sysnet4admin/chk-hn
        volumeMounts:
        - name: each-sts-backup # should be same with vol
          mountPath: /backup_data
  volumeClaimTemplates:
  - metadata:
      name: each-sts-backup
    spec:
      accessModes: [ "ReadWriteOnce" ] # cause it takes only one Pod
      storageClassName: "managed-nfs-storage"
      resources:
        requests:
          storage: 20Gi

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-drain 
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-drain
  template:
    metadata:
      labels:
        app: deploy-drain
    spec:
      containers:
      - name: nginx  
        image: nginx 

apiVersion: v1
kind: Pod
metadata:
  name: nodename 
spec:
  containers:
  - name: nginx
    image: nginx
  nodeName: w3-k8s # set nodeName where pod be deployed

#!/usr/bin/env bash

kubectl label node w1-k8s gpupool=nvidia accelerator=tesla-a100
kubectl label node w2-k8s gpupool=nvidia accelerator=tesla-v100
kubectl label node w3-k8s diskint=nvme inmemory=redis

apiVersion: v1
kind: Pod
metadata:
  name: nodeselector-inmemory
spec:
  containers:
  - name: nginx
    image: nginx
  nodeSelector:
    inmemory: redis # w3-k8s

apiVersion: v1
kind: Pod
metadata:
  name: nodeselector-gpupool
spec:
  containers:
  - name: nginx
    image: nginx
  nodeSelector:
    gpupool: nvidia # w1-k8s, w2-k8s

apiVersion: v1
kind: Pod
metadata:
  name: nodeaffinity
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions: # inmemory-redis
          - key: inmemory
            operator: In
            values:
            - redis
  containers:
  - name: nginx
    image: nginx

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nodeaffinity-preferred
  name: nodeaffinity-preferred
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nodeaffinity-preferred
  template:
    metadata:
      labels:
        app: nodeaffinity-preferred
    spec:
      containers:
      - image: nginx
        name: nginx
      affinity:
        nodeAffinity: # It will search nodes who has gpupool-nvidia and prefer node who has accelerator-tesla-a100 to release
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions: # gpupool-nvidia
              - key: gpupool
                operator: In
                values:
                - nvidia
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1 # higher means more affinity
            preference:
              matchExpressions: # accelerator-tesla-a100
              - key: accelerator
                operator: In
                values:
                - tesla-a100

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: anti-nodeaffinity
  name: anti-nodeaffinity
spec:
  replicas: 3
  selector:
    matchLabels:
      app: anti-nodeaffinity
  template:
    metadata:
      labels:
        app: anti-nodeaffinity
    spec:
      containers:
      - image: nginx
        name: nginx
      affinity:
        nodeAffinity: # It will search nodes who has gpupool-nvidia and unprefer node who has accelerator-tesla-a100 to release
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions: # gpupool-nvidia
              - key: gpupool
                operator: In
                values:
                - nvidia
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 1
            preference:
              matchExpressions:
              - key: accelerator # accelerator-tesla-a100 is unpreferred
                operator: NotIn
                values:
                - tesla-a100

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: daemonset-w-tolerations
  labels:
    app: daemonset-w-tolerations
spec:
  selector:
    matchLabels:
      app: daemonset-w-tolerations
  template:
    metadata:
      labels:
        app: daemonset-w-tolerations
    spec:
      containers:
      - name: nginx
        image: nginx
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-after-taints
  name: deploy-after-taints
spec:
  replicas: 6
  selector:
    matchLabels:
      app: deploy-after-taints
  template:
    metadata:
      labels:
        app: deploy-after-taints
    spec:
      containers:
      - image: nginx
        name: nginx

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-w-tolerations
  name: deploy-w-tolerations
spec:
  replicas: 6
  selector:
    matchLabels:
      app: deploy-w-tolerations
  template:
    metadata:
      labels:
        app: deploy-w-tolerations
    spec:
      containers:
      - image: nginx
        name: nginx
      tolerations: # it has telerations
      - effect: NoSchedule
        key: DB
        value: customer-info

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-w-tolerations-nodeaffinity
  name: deploy-w-tolerations-nodeaffinity
spec:
  replicas: 6
  selector:
    matchLabels:
      app: deploy-w-tolerations-nodeaffinity
  template:
    metadata:
      labels:
        app: deploy-w-tolerations-nodeaffinity
    spec:
      containers:
      - image: nginx
        name: nginx
      tolerations:
      - effect: NoSchedule
        key: DB
        value: customer-info
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions: # it prefer node who has inmemory-redis label
              - key: inmemory
                operator: In
                values:
                - redis

#!/usr/bin/env bash

kubectl patch node w1-k8s -p '{"spec":{"taints":[]}}'
kubectl patch node w2-k8s -p '{"spec":{"taints":[]}}'
kubectl patch node w3-k8s -p '{"spec":{"taints":[]}}'

CODE=$(kubectl get node -o yaml |  grep -i taints | wc -l) # Check status of taints

echo "successfully init taints in the k8s cluster"
echo "Result code is $CODE"
echo "if Result is not 1, please reload all of worker nodes"

apiVersion: v1
kind: Pod
metadata:
  name: static-pod 
spec:
  containers:
  - name: nginx
    image: nginx

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: pod-always
  name: pod-always
spec:
  containers:
  - image: sysnet4admin/net-tools
    name: net-tools
    command: ["/bin/sh", "-c"]
    args:
    - nslookup kubernetes
  restartPolicy: Always 

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: pod-never
  name: pod-never
spec:
  containers:
  - image: sysnet4admin/net-tools
    name: net-tools
    command: ["/bin/sh", "-c"]
    args:
    - nslookup kubernetes
  restartPolicy: Never 

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: pod-onfailure
  name: pod-onfailure
spec:
  containers:
  - image: sysnet4admin/net-tools
    name: net-tools
    command: ["/bin/sh", "-c"]
    args:
    - nslookup kubernetes
  restartPolicy: OnFailure 

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-never-failure
  name: deploy-never-failure
spec:
  replicas: 1
  selector:
    matchLabels:
      app: deploy-never-failure
  template:
    metadata:
      labels:
        app: deploy-never-failure
    spec:
      containers:
      - name: nginx
        image: nginx
      restartPolicy: Never # Never cannot be used

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-onfailure-failure
  name: deploy-onfailure-failure
spec:
  replicas: 1
  selector:
    matchLabels:
      app: deploy-onfailure-failure
  template:
    metadata:
      labels:
        app: deploy-onfailure-failure
    spec:
      containers:
      - name: nginx
        image: nginx
      restartPolicy: OnFailure # Never cannot be used

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: liveness-exec
  name: liveness-exec
spec:
  containers:
  - name: tardy-nginx 
    image: sysnet4admin/tardy-nginx 
    livenessProbe:
      exec:
        command:
        - cat 
        - /tmp/healthy-on
      initialDelaySeconds: 10
      periodSeconds: 10 #it cannot start properly 

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: liveness-httpget
  name: liveness-httpget
spec:
  containers:
  - name: healthz-nginx 
    image: sysnet4admin/healthz-nginx 
    livenessProbe:
      httpGet:
        path: /healthz
        port: 80
        httpHeaders:
        - name: purpose
          value: health-check 
      initialDelaySeconds: 3
      periodSeconds: 3

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: liveness-tcpsocket
  name: liveness-tcpsocket
spec:
  containers:
  - name: healthz-nginx 
    image: sysnet4admin/healthz-nginx 
    livenessProbe:
      tcpSocket:
        port: 80
      initialDelaySeconds: 3
      periodSeconds: 3

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: readiness-exec
  name: readiness-exec
spec:
  containers:
  - name: tardy-nginx 
    image: sysnet4admin/tardy-nginx 
    readinessProbe: // we will use a pod
      exec:
        command:
        - cat 
        - /tmp/healthy-on
      initialDelaySeconds: 10 
      periodSeconds: 5 // we will give short periodSecond.
---
apiVersion: v1
kind: Service // service is for removing endpoint.
metadata:
  name: readiness-exec-lb
spec:
  selector:
    run: readiness-exec
  ports:
    - name: http
      port: 80
      targetPort: 80 
  type: LoadBalancer

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: startup-w-others
  name: startup-w-others
spec:
  containers:
  - name: tardy-nginx 
    image: sysnet4admin/tardy-nginx  
    startupProbe: // startupProbe
      exec:
        command:
        - cat 
        - /tmp/healthy-on
      initialDelaySeconds: 10
      periodSeconds: 60
    livenessProbe: // livenessProbe
      exec:
        command:
        - cat 
        - /tmp/healthy-on
      initialDelaySeconds: 10
      periodSeconds: 10 // This is not matter because startupProbe has already made the image.
    readinessProbe: // readinessProbe
      exec:
        command:
        - cat 
        - /tmp/healthy-on
      initialDelaySeconds: 5
      periodSeconds: 5

apiVersion: v1
kind: Pod
metadata:
  name: pod-initcontainers 
  labels:
    app: nginx 
spec:
  containers:
  - name: web-page
    image: nginx 
    volumeMounts:
    - mountPath: /usr/share/nginx/html 
      name: empty-directory 
  initContainers:
  - name: html-builder 
    image: alpine 
    volumeMounts:
    - mountPath: /html-dir 
      name: empty-directory 
    command: ["/bin/sh", "-c"]
    args: 
      - echo "This page created on $(date +%Y-%m-%d) by initContainers" > /html-dir/index.html;
  volumes:
  - name: empty-directory 
    emptyDir: {}

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-conf
data:
  default.conf: |
    server {
      listen       80;
      server_name  nginx;
      location / {
          root   /usr/share/nginx/html;
          index  index.html index.htm;
      }
      error_page   500 502 503 504  /50x.html;
      location = /50x.html {
          root   /usr/share/nginx/html;
      }
      location /stub_status {
        stub_status;
        allow 127.0.0.1;
        allow 192.168.1.0/24;
        allow 172.16.0.0/16;
        deny all;   #deny all other hosts
      }
    }

apiVersion: v1
kind: Pod
metadata:
  name: pod-adapter
  labels:
    app: nginx
spec:
  containers:
  - name: web-page
    image: nginx
    volumeMounts:
    - mountPath: /etc/nginx/conf.d
      name: nginx-conf

  - name: adapter
    image: nginx/nginx-prometheus-exporter:0.9.0
    env:
    - name: SCRAPE_URI
      value: http://localhost/stub_status
    ports:
    - containerPort: 9113

  volumes:
  - name: nginx-conf
    configMap:
      name: nginx-conf
      items:
      - key: default.conf
        path: default.conf

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: sleepy
    affinity: leader 
  name: w1-affinity-leader
spec:
  containers:
  - image: sysnet4admin/sleepy
    name: sleepy
  nodeSelector:
    kubernetes.io/hostname: w1-k8s

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-podaffinity
  name: deploy-podaffinity
spec:
  replicas: 4
  selector:
    matchLabels:
      app: deploy-podaffinity
  template:
    metadata:
      labels:
        app: deploy-podaffinity
    spec:
      containers:
      - image: nginx
        name: nginx
      affinity:
        podAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: affinity
                operator: In
                values:
                - leader
            # If you want to change topologyKey, 
            # modify the admission controller, or disable.
            topologyKey: kubernetes.io/hostname

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: sleepy
    affinity: leader 
  name: w3-affinity-leader 
spec:
  containers:
  - image: sysnet4admin/sleepy
    name: sleepy
  nodeSelector:
    kubernetes.io/hostname: w3-k8s

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-anti-podaffinity
  name: deploy-anti-podaffinity
spec:
  replicas: 4
  selector:
    matchLabels:
      app: deploy-anti-podaffinity
  template:
    metadata:
      labels:
        app: deploy-anti-podaffinity
    spec:
      containers:
      - image: nginx
        name: nginx
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: affinity
                operator: In
                values:
                - leader
            # If you want to change topologyKey, 
            # modify the admission controller, or disable.
            topologyKey: kubernetes.io/hostname

#!/usr/bin/env bash

kubectl label node w1-k8s topology.kubernetes.io/region=ap-northeast-2 topology.kubernetes.io/zone=ap-northeast-2a
kubectl label node w2-k8s topology.kubernetes.io/region=ap-northeast-2 topology.kubernetes.io/zone=ap-northeast-2a
kubectl label node w3-k8s topology.kubernetes.io/region=ap-northeast-2 topology.kubernetes.io/zone=ap-northeast-2b
kubectl label node w4-k8s topology.kubernetes.io/region=ap-northeast-2 topology.kubernetes.io/zone=ap-northeast-2b

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-topologyspreadconstraints
  name: deploy-topologyspreadconstraints
spec:
  replicas: 4
  selector:
    matchLabels:
      app: deploy-topologyspreadconstraints
  template:
    metadata:
      labels:
        app: deploy-topologyspreadconstraints
    spec:
      containers:
      - image: nginx
        name: nginx
      topologySpreadConstraints:
      - maxSkew: 1 // difference of each section should be not bigger then 1
        topologyKey: topology.kubernetes.io/region // make same key
        whenUnsatisfiable: DoNotSchedule // If this condition is false, it will not schedule any pods more.
        labelSelector:
          matchLabels:
            app: deploy-topologyspreadconstraints // it will use this label, so pods are 4.
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone // make same zone
        whenUnsatisfiable: DoNotSchedule
        labelSelector:
          matchLabels:
            app: deploy-topologyspreadconstraints

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy12-load-w3
  name: deploy12-load-w3
spec:
  replicas: 12
  selector:
    matchLabels:
      app: deploy12-load-w3
  template:
    metadata:
      labels:
        app: deploy12-load-w3
    spec:
      containers:
      - name: nginx
        image: nginx
      nodeName: w3-k8s

# dev1 namespace and account 
apiVersion: v1
kind: Namespace
metadata:
  name: dev1
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dev1-hoon 
  namespace: dev1
---
# dev2 namespace and account 
apiVersion: v1
kind: Namespace
metadata:
  name: dev2
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: dev2-moon  
  namespace: dev2

# account for clusterrole
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-pod-admin

# dev1 Role
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: dev1
  name: role-get-dev1
rules:
- apiGroups: ["*"]
  resources: ["pods", "deployments"]
  verbs: ["get", "list"]

# dev1 Role Binding
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: rolebinding-dev1
  namespace: dev1
subjects:
- kind: ServiceAccount
  name: dev1-hoon
  apiGroup: ""
roleRef:
  kind: Role
  name: role-get-dev1 
  apiGroup: rbac.authorization.k8s.io

# dev2 Role
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: dev2
  name: role-gct-dev2
rules:
- apiGroups: ["*"]
  resources: ["pods", "deployments"]
  verbs: ["get", "list","create"]

# dev2 Role Binding
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: rolebinding-dev2
  namespace: dev2
subjects:
- kind: ServiceAccount
  name: dev2-moon
  apiGroup: ""
roleRef:
  kind: Role
  name: role-gct-dev2
  apiGroup: rbac.authorization.k8s.io

# Cluster Role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-admin 
rules:
- apiGroups: ["*"]
  resources: ["pods","deployments","deployments/scale"]
  verbs: ["*"]

# Cluster Role Binding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: clusterrolebinding-pod-admin 
subjects:
- kind: ServiceAccount
  name: sa-pod-admin 
  apiGroup: ""
  # need namespace for CRB subjects
  namespace: default
roleRef:
  kind: ClusterRole
  name: pod-admin 
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: ResourceQuota
metadata:
  name: quota-dev1
  namespace: dev1
spec:
  hard:
    pods: 10
    managed-nfs-storage.storageclass.storage.k8s.io/persistentvolumeclaims: "2"
    managed-nfs-storage.storageclass.storage.k8s.io/requests.storage: "2Gi"
    #persistentvolumeclaims: "2"
    #requests.storage: "2Gi"

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: quota-3g-pvc-failure  
  namespace: dev1
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 3Gi
  storageClassName: managed-nfs-storage 

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: quota-1g-pvc1  
  namespace: dev1
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: managed-nfs-storage 

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: quota-1g-pvc2  
  namespace: dev1
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: managed-nfs-storage 

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: quota-1g-pvc3  
  namespace: dev1
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: managed-nfs-storage 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: quota-pod11-failure
  namespace: dev1
spec:
  replicas: 11
  selector:
    matchLabels:
      app: quota-pod11-failure
  template:
    metadata:
      labels:
        app: quota-pod11-failure
    spec:
      containers:
      - name: nginx
        image: nginx

apiVersion: v1
kind: LimitRange
metadata:
  name: limits-dev2
  namespace: dev2 
spec:
  limits:
  - type: PersistentVolumeClaim
    max:
      storage: 2Gi
    min:
      storage: 1Gi
  - type: Container
    default:
      memory: 512Mi
    defaultRequest:
      memory: 256Mi

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: limits-3g-pvc-failure
  namespace: dev2
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 3Gi
  storageClassName: managed-nfs-storage 

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: limits-1g-pvc
  namespace: dev2
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: managed-nfs-storage 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: limits-defaultrequest
  namespace: dev2
spec:
  replicas: 6 # will be out of memory 
  selector:
    matchLabels:
      app: limits-defaultrequest
  template:
    metadata:
      labels:
        app: limits-defaultrequest
    spec:
      containers:
      - name: chk-log 
        image: sysnet4admin/chk-log
        volumeMounts:
        - name: pvc-vol
          mountPath: /audit
      volumes:
      - name: pvc-vol
        persistentVolumeClaim:
          claimName: limits-1g-pvc  
      nodeName: w3-k8s # only here for testing purpose

apiVersion: v1
kind: Pod
metadata:
  name: net
spec:
  containers:
  - image: sysnet4admin/net-tools-ifn
    name: net

apiVersion: v1
kind: Pod
metadata:
  name: net-dev1
  namespace: dev1
spec:
  containers:
  - image: sysnet4admin/net-tools-ifn
    name: net
---
apiVersion: v1
kind: Pod
metadata:
  name: net-dev2
  namespace: dev2
spec:
  containers:
  - image: sysnet4admin/net-tools-ifn
    name: net

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    role: sensitive  
    app: chk-info
  name: deploy-deny-all
spec:
  replicas: 3
  selector:
    matchLabels:
      role: sensitive  
      app: chk-info
  template:
    metadata:
      labels:
        role: sensitive  
        app: chk-info
    spec:
      containers:
      - image: sysnet4admin/chk-info
        name: chk-info
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: chk-info
  name: deploy-deny-all
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: chk-info
  type: LoadBalancer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: networkpolicy-deny-all
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: sensitive 
  policyTypes:
  - Ingress
  - Egress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: networkpolicy-podselector
  namespace: default
spec:
  podSelector:
    matchLabels:
      role: internal  
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from: 
    - podSelector:
        matchLabels:
          app: chk-info
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: chk-info

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: networkpolicy-ipblock
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        # 172.16.0.1 - 172.16.255.254
        cidr: 172.16.0.0/16
  egress:
  - to:
    - ipBlock:
        # 172.16.0.1 - 172.16.127.254
        cidr: 172.16.0.0/17

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: networkpolicy-ipblock-except
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - ipBlock:
        cidr: 172.16.0.0/16
        # change your CIDR to shut it down 
        #except:
        # - 172.16.n.n/24
  egress:
  - to:
    - ipBlock:
        cidr: 172.16.0.0/16
        # change your CIDR to shut it down 
        #except:
        # - 172.16.n.n/24

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: networkpolicy-namespaceselector-dev2
  namespace: dev2
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress 
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: dev2
  egress:
  - {}

apiVersion: v1
kind: ConfigMap
metadata:
 name: sleepy-config 
data: 
 STATUS: "SLEEP AGAIN"
 NOTE: "TestBed Configuration"
 # create a form with data type

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-configmapref
  name: deploy-configmapref
spec:
  replicas: 1
  selector:
    matchLabels:
      app: deploy-configmapref
  template:
    metadata:
      labels:
        app: deploy-configmapref
    spec:
      containers:
      - image: sysnet4admin/sleepy 
        name: sleepy 
        command: ["/bin/sh","-c"]
        args:
        - |
          echo "sleepy $STATUS"
          echo "NOTE: $NOTE"
          sleep 3600
          # $ means, we will use a specific variable here with same name
        envFrom:
        - configMapRef:
            name: sleepy-config
            # reference container 'sleepy-config' and it will be used as a environment variable

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-configmapkeyref
  name: deploy-configmapkeyref
spec:
  replicas: 1
  selector:
    matchLabels:
      app: deploy-configmapkeyref
  template:
    metadata:
      labels:
        app: deploy-configmapkeyref
    spec:
      containers:
      - image: sysnet4admin/sleepy 
        name: sleepy 
        command: ["/bin/sh","-c"]
        args:
        - |
          echo "sleepy $APP_STATUS"
          sleep 3600
        env:
        - name: APP_STATUS # mandantory field
          valueFrom:
            configMapKeyRef:
              name: sleepy-config
              key: STATUS
              # reference key STATUS in 'sleepy-config' and this STATUS renamed to APP_STATUS

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: deploy-vol-configMap
  name: deploy-vol-configmap
spec:
  replicas: 1
  selector:
    matchLabels:
      app: deploy-vol-configmap
  template:
    metadata:
      labels:
        app: deploy-vol-configmap
    spec:
      containers:
      - image: sysnet4admin/sleepy 
        name: sleepy 
        command: ["/bin/sh","-c"]
        args:
        - |
          sleep 3600
        volumeMounts:
        - name: appconfigvol
          mountPath: /etc/sleepy.d
          # mount ConfigMap as a volume
          # read ConfigMap and mount it on the directory
          # take values when we need
      volumes:
      - name: appconfigvol
        configMap:
          name: sleepy-config

apiVersion: v1
kind: ConfigMap
metadata:
 name: sleepy-config 
data:
 STATUS: "SLEEP AGAIN" # changed
 NOTE: "TestBed Configuration"

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb-system
  name: config
data:
  config: |
    address-pools:
    - name: metallb-ip-range
      protocol: layer2
      addresses:
      - 192.168.1.11-192.168.1.19

apiVersion: v1
kind: Secret
metadata:
  name: mysql-cred
  namespace: default
data: # base64
  username: ZGItdXNlcg==
  password: bGVlaHVobGVl
type: Opaque # default value

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    run: deploy-secretkeyref
  name: deploy-secretkeyref
spec:
  replicas: 1
  selector:
    matchLabels:
      app: deploy-secretkeyref
  template:
    metadata:
      labels:
        app: deploy-secretkeyref
    spec:
      containers:
      - image: sysnet4admin/mysql-auth 
        name: mysql-auth 
        env:
        # Need to init mysql 
        - name: MYSQL_ROOT_PASSWORD
          value: rootpassword
        # Custom auth 
        - name: MYSQL_USER_ID
          valueFrom: # similar with ConfigMapRef
            secretKeyRef:
              name: mysql-cred # secret name
              key: username # db-user
        - name: MYSQL_USER_PASSWORD
          valueFrom:
            secretKeyRef:
              name: mysql-cred 
              key: password # leehuhlee
        ports:
        - containerPort: 3306
        volumeMounts:
        - name: mysql-pvc
          mountPath: /var/lib/mysql
      volumes:
      - name: mysql-pvc
        persistentVolumeClaim:
          claimName: mysql-pvc
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mysql-pvc  
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 20Gi
  storageClassName: managed-nfs-storage 

apiVersion: v1
kind: Secret
metadata:
  name: mysql-cred
  namespace: default
data:
  username: ZGItdXNlcg==
  password: bGVlaHVobGVl
type: Opaque
immutable: true

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deploy-rollout
spec:
  replicas: 3
  selector:
    matchLabels:
      app: deploy-rollout 
  template:
    metadata:
      labels:
        app: deploy-rollout
    spec:
      containers:
      - name: nginx
        image: nginx:1.20.1

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities: []
  allowedHostPaths: []
  defaultAddCapabilities: []
  defaultAllowPrivilegeEscalation: false
  fsGroup:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  hostIPC: false
  hostNetwork: false
  hostPID: false
  privileged: false
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
  - ALL
  runAsUser:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    ranges:
    - max: 65535
      min: 1
    rule: MustRunAs
  volumes:
  - configMap
  - secret
  - emptyDir
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  labels:
    app: metallb
  name: speaker
  namespace: metallb-system
spec:
  allowPrivilegeEscalation: false
  allowedCapabilities:
  - NET_RAW
  allowedHostPaths: []
  defaultAddCapabilities: []
  defaultAllowPrivilegeEscalation: false
  fsGroup:
    rule: RunAsAny
  hostIPC: false
  hostNetwork: true
  hostPID: false
  hostPorts:
  - max: 7472
    min: 7472
  - max: 7946
    min: 7946
  privileged: true
  readOnlyRootFilesystem: true
  requiredDropCapabilities:
  - ALL
  runAsUser:
    rule: RunAsAny
  seLinux:
    rule: RunAsAny
  supplementalGroups:
    rule: RunAsAny
  volumes:
  - configMap
  - secret
  - emptyDir
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: metallb
  name: speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: metallb
  name: metallb-system:controller
rules:
- apiGroups:
  - ''
  resources:
  - services
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ''
  resources:
  - services/status
  verbs:
  - update
- apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - policy
  resourceNames:
  - controller
  resources:
  - podsecuritypolicies
  verbs:
  - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app: metallb
  name: metallb-system:speaker
rules:
- apiGroups:
  - ''
  resources:
  - services
  - endpoints
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups: ["discovery.k8s.io"]
  resources:
  - endpointslices
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ''
  resources:
  - events
  verbs:
  - create
  - patch
- apiGroups:
  - policy
  resourceNames:
  - speaker
  resources:
  - podsecuritypolicies
  verbs:
  - use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: metallb
  name: config-watcher
  namespace: metallb-system
rules:
- apiGroups:
  - ''
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: metallb
  name: pod-lister
  namespace: metallb-system
rules:
- apiGroups:
  - ''
  resources:
  - pods
  verbs:
  - list
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
rules:
- apiGroups:
  - ''
  resources:
  - secrets
  verbs:
  - create
- apiGroups:
  - ''
  resources:
  - secrets
  resourceNames:
  - memberlist
  verbs:
  - list
- apiGroups:
  - apps
  resources:
  - deployments
  resourceNames:
  - controller
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: metallb
  name: metallb-system:controller
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:controller
subjects:
- kind: ServiceAccount
  name: controller
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app: metallb
  name: metallb-system:speaker
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: metallb-system:speaker
subjects:
- kind: ServiceAccount
  name: speaker
  namespace: metallb-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: metallb
  name: config-watcher
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: config-watcher
subjects:
- kind: ServiceAccount
  name: controller
- kind: ServiceAccount
  name: speaker
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: metallb
  name: pod-lister
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-lister
subjects:
- kind: ServiceAccount
  name: speaker
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: metallb
  name: controller
  namespace: metallb-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: controller
subjects:
- kind: ServiceAccount
  name: controller
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: metallb
    component: speaker
  name: speaker
  namespace: metallb-system
spec:
  selector:
    matchLabels:
      app: metallb
      component: speaker
  template:
    metadata:
      annotations:
        prometheus.io/port: '7472'
        prometheus.io/scrape: 'true'
      labels:
        app: metallb
        component: speaker
    spec:
      containers:
      - args:
        - --port=7472
        - --config=config
        env:
        - name: METALLB_NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        - name: METALLB_HOST
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: METALLB_ML_BIND_ADDR
          valueFrom:
            fieldRef:
              fieldPath: status.podIP
        # needed when another software is also using memberlist / port 7946
        # when changing this default you also need to update the container ports definition
        # and the PodSecurityPolicy hostPorts definition
        #- name: METALLB_ML_BIND_PORT
        #  value: "7946"
        - name: METALLB_ML_LABELS
          value: "app=metallb,component=speaker"
        - name: METALLB_ML_SECRET_KEY
          valueFrom:
            secretKeyRef:
              name: memberlist
              key: secretkey
        image: quay.io/metallb/speaker:main
        name: speaker
        ports:
        - containerPort: 7472
          name: monitoring
        - containerPort: 7946
          name: memberlist-tcp
        - containerPort: 7946
          name: memberlist-udp
          protocol: UDP
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            add:
            - NET_RAW
            drop:
            - ALL
          readOnlyRootFilesystem: true
      hostNetwork: true
      nodeSelector:
        kubernetes.io/os: linux
      serviceAccountName: speaker
      terminationGracePeriodSeconds: 2
      tolerations:
      - effect: NoSchedule
        key: node-role.kubernetes.io/master
        operator: Exists
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: metallb
    component: controller
  name: controller
  namespace: metallb-system
spec:
  revisionHistoryLimit: 3
  selector:
    matchLabels:
      app: metallb
      component: controller
  template:
    metadata:
      annotations:
        prometheus.io/port: '7472'
        prometheus.io/scrape: 'true'
      labels:
        app: metallb
        component: controller
    spec:
      containers:
      - args:
        - --port=7472
        - --config=config
        env:
        - name: METALLB_ML_SECRET_NAME
          value: memberlist
        - name: METALLB_DEPLOYMENT
          value: controller
        image: quay.io/metallb/controller:main
        name: controller
        ports:
        - containerPort: 7472
          name: monitoring
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - all
          readOnlyRootFilesystem: true
      nodeSelector:
        kubernetes.io/os: linux
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        fsGroup: 65534
      serviceAccountName: controller
      terminationGracePeriodSeconds: 0