feat(auth): adopt oidc apps in gitops
This commit is contained in:
Andrew Stoltz
295
apps/fc-media/fc-media.yaml
Normal file
295
apps/fc-media/fc-media.yaml
Normal file
@@ -0,0 +1,295 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: fc-media
|
||||
labels:
|
||||
app.kubernetes.io/name: fc-media
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
---
|
||||
apiVersion: onepassword.com/v1
|
||||
kind: OnePasswordItem
|
||||
metadata:
|
||||
name: media-oidc-client
|
||||
namespace: fc-media
|
||||
labels:
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
spec:
|
||||
itemPath: "vaults/IAmWorkin/items/media-oidc-client"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: fc-media-config
|
||||
namespace: fc-media
|
||||
labels:
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
data:
|
||||
appsettings.Production.json: |
|
||||
{
|
||||
"DatabaseProvider": "Sqlite",
|
||||
"ConnectionStrings": {
|
||||
"Sqlite": "Data Source=/data/media.db"
|
||||
},
|
||||
"FlowerCore": {
|
||||
"Auth": {
|
||||
"Enabled": true,
|
||||
"Oidc": {
|
||||
"Authority": "https://id.iamworkin.lan/application/o/media/",
|
||||
"ClientId": "media",
|
||||
"ClientSecret": "",
|
||||
"Audience": "media",
|
||||
"RequireHttpsMetadata": true
|
||||
}
|
||||
},
|
||||
"Tenant": {
|
||||
"JwtClaimsEnabled": false,
|
||||
"DefaultTenantHosts": [ "media.iamworkin.lan" ]
|
||||
}
|
||||
},
|
||||
"Media": {
|
||||
"LibraryRoot": "/media/library",
|
||||
"Sources": [
|
||||
{
|
||||
"Name": "BlueJayNAS Video",
|
||||
"Driver": "Nfs",
|
||||
"MountedPath": "/media/library",
|
||||
"RemotePath": "nfs://10.0.58.3/volume1/video",
|
||||
"IsEnabled": true,
|
||||
"IsDefault": true,
|
||||
"Notes": "Synology NFS media share mounted read-only inside the cluster."
|
||||
}
|
||||
],
|
||||
"GeneratedRoot": "/data/generated",
|
||||
"TranscodeRoot": "/data/transcodes",
|
||||
"InboxPath": "/media/inbox",
|
||||
"InboxScanIntervalMinutes": 5,
|
||||
"ScanOnStartup": false,
|
||||
"ComputeChecksums": false,
|
||||
"FfmpegCommand": "ffmpeg",
|
||||
"FfprobeCommand": "ffprobe",
|
||||
"Hls": {
|
||||
"MaxConcurrentJobs": 1
|
||||
},
|
||||
"DefaultViewerName": "BlueJay",
|
||||
"Dlna": {
|
||||
"IsEnabled": true,
|
||||
"MulticastAddress": "239.255.255.250",
|
||||
"Port": 1900,
|
||||
"DiscoveryTimeoutSeconds": 2,
|
||||
"DescriptionFetchTimeoutSeconds": 2,
|
||||
"MaxResponsesPerSearchTarget": 32,
|
||||
"SearchTargets": [
|
||||
"urn:schemas-upnp-org:device:MediaRenderer:1",
|
||||
"urn:schemas-upnp-org:device:MediaServer:1"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: fc-media-data
|
||||
namespace: fc-media
|
||||
labels:
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
storageClassName: longhorn
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: fc-media-web
|
||||
namespace: fc-media
|
||||
labels:
|
||||
app: fc-media-web
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
spec:
|
||||
replicas: 1
|
||||
strategy:
|
||||
type: Recreate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: fc-media-web
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: fc-media-web
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "5200"
|
||||
prometheus.io/path: "/metrics"
|
||||
spec:
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: rke2-server
|
||||
containers:
|
||||
- name: fc-media-web
|
||||
image: localhost/fc-media-web:v20260604-oidc-proper
|
||||
imagePullPolicy: Never
|
||||
ports:
|
||||
- containerPort: 5200
|
||||
name: http
|
||||
env:
|
||||
- name: ASPNETCORE_ENVIRONMENT
|
||||
value: Production
|
||||
- name: ASPNETCORE_URLS
|
||||
value: http://+:5200
|
||||
- name: FlowerCore__Auth__Enabled
|
||||
value: "true"
|
||||
- name: FlowerCore__Auth__Oidc__Enabled
|
||||
value: "true"
|
||||
- name: FlowerCore__Auth__Oidc__Audience
|
||||
value: "media"
|
||||
- name: FlowerCore__Auth__Oidc__ClientId
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: media-oidc-client
|
||||
key: client_id
|
||||
optional: true
|
||||
- name: FlowerCore__Auth__Oidc__ClientSecret
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: media-oidc-client
|
||||
key: client_secret
|
||||
optional: true
|
||||
- name: FlowerCore__Auth__Oidc__Authority
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: media-oidc-client
|
||||
key: issuer_url
|
||||
optional: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
limits:
|
||||
cpu: "4"
|
||||
memory: 4Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /app/appsettings.Production.json
|
||||
subPath: appsettings.Production.json
|
||||
readOnly: true
|
||||
- name: data
|
||||
mountPath: /data
|
||||
- name: transcodes
|
||||
mountPath: /data/transcodes
|
||||
- name: media-library
|
||||
mountPath: /media/library
|
||||
readOnly: true
|
||||
- name: media-inbox
|
||||
mountPath: /media/inbox
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 5200
|
||||
httpHeaders:
|
||||
- name: X-Forwarded-Proto
|
||||
value: https
|
||||
failureThreshold: 18
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 5200
|
||||
httpHeaders:
|
||||
- name: X-Forwarded-Proto
|
||||
value: https
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 5200
|
||||
httpHeaders:
|
||||
- name: X-Forwarded-Proto
|
||||
value: https
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
volumes:
|
||||
- name: config
|
||||
configMap:
|
||||
name: fc-media-config
|
||||
- name: data
|
||||
persistentVolumeClaim:
|
||||
claimName: fc-media-data
|
||||
- name: transcodes
|
||||
nfs:
|
||||
server: 10.0.58.3
|
||||
path: /volume1/kubernetes/fc-media-transcodes
|
||||
- name: media-inbox
|
||||
nfs:
|
||||
server: 10.0.58.3
|
||||
path: /volume1/kubernetes/fc-media-inbox
|
||||
- name: media-library
|
||||
nfs:
|
||||
server: 10.0.58.3
|
||||
path: /volume1/video
|
||||
readOnly: true
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: fc-media-web
|
||||
namespace: fc-media
|
||||
labels:
|
||||
app: fc-media-web
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
spec:
|
||||
type: ClusterIP
|
||||
selector:
|
||||
app: fc-media-web
|
||||
ports:
|
||||
- port: 5200
|
||||
targetPort: 5200
|
||||
protocol: TCP
|
||||
name: http
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: fc-media-tls
|
||||
namespace: fc-media
|
||||
labels:
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
spec:
|
||||
secretName: fc-media-tls
|
||||
issuerRef:
|
||||
name: step-ca-acme
|
||||
kind: ClusterIssuer
|
||||
dnsNames:
|
||||
- media.iamworkin.lan
|
||||
---
|
||||
apiVersion: traefik.io/v1alpha1
|
||||
kind: IngressRoute
|
||||
metadata:
|
||||
name: fc-media-web
|
||||
namespace: fc-media
|
||||
labels:
|
||||
app.kubernetes.io/name: fc-media-web
|
||||
app.kubernetes.io/part-of: flowercore
|
||||
spec:
|
||||
entryPoints:
|
||||
- websecure
|
||||
routes:
|
||||
- match: Host(`media.iamworkin.lan`)
|
||||
kind: Rule
|
||||
services:
|
||||
- name: fc-media-web
|
||||
port: 5200
|
||||
tls:
|
||||
secretName: fc-media-tls
|
||||
Reference in New Issue
Block a user