forust
ac0f845da6
ci / lint-compose (push) Successful in 3s
ci / lint-actionlint (push) Successful in 1s
ci / lint-shellcheck (push) Successful in 2s
ci / lint-prettier (push) Successful in 3s
ci / lint-ruff (push) Successful in 1s
ci / lint-yaml (push) Successful in 2s
ci / lint-dockerfiles (push) Successful in 1s
ci / scan-deps (push) Successful in 15s
ci / test-backend (push) Successful in 7s
ci / test-frontend (push) Successful in 11s
ci / validate (push) Successful in 3s
renovate-ci / validate-renovate (push) Successful in 12s
ci / build (push) Successful in 37s
USERBOT_IMAGE named userbot:latest, but the build stopped pushing latest when images became :prod. render_pinned resolves every gcr.forust.xyz reference it finds in a manifest, not just the ones it rewrites, so that env var made the whole apply abort with "cannot resolve userbot:latest; applying nothing". Naming it :prod also makes the build job rebuild userbot, which is what restores forust/userbot:prod - the tag is listed in the registry but its manifest 404s, so the image: field in userbots.yaml had nothing to resolve either. Found by resolving every digest apply-k8s will need before spending a run on it: 6 of 8 resolved, and both failures were userbot.
268 lines
4.9 KiB
YAML
268 lines
4.9 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: userbot
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: userbot-runtime
|
|
namespace: userbot
|
|
automountServiceAccountToken: false
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: userbot-common-config
|
|
namespace: userbot
|
|
data:
|
|
DATABASE_TYPE: ""
|
|
DATABASE_NAME: ""
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
rules:
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- patch
|
|
- delete
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments/scale
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods/log
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- persistentvolumeclaims
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- create
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
- create
|
|
- delete
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- metrics.k8s.io
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: userbot-panel
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: userbot-panel-legacy
|
|
namespace: default
|
|
rules:
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- patch
|
|
- apiGroups:
|
|
- apps
|
|
resources:
|
|
- deployments/scale
|
|
verbs:
|
|
- get
|
|
- patch
|
|
- update
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods/log
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- persistentvolumeclaims
|
|
verbs:
|
|
- get
|
|
- list
|
|
- apiGroups:
|
|
- metrics.k8s.io
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- get
|
|
- list
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: userbot-panel-legacy
|
|
namespace: default
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: userbot-panel-legacy
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
labels:
|
|
app: userbot-panel
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app: userbot-panel
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: userbot-panel
|
|
spec:
|
|
serviceAccountName: userbot-panel
|
|
containers:
|
|
- name: userbot-panel
|
|
image: gcr.forust.xyz/forust/userbot-panel:prod
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
env:
|
|
- name: USERBOT_NAMESPACE
|
|
value: userbot
|
|
- name: USERBOT_LEGACY_NAMESPACES
|
|
value: default
|
|
- name: USERBOT_IMAGE
|
|
# The build pushes main/prod only. The deploy resolves every gcr ref in
|
|
# this file, so a :latest here aborts the whole apply as unresolvable.
|
|
value: gcr.forust.xyz/forust/userbot:prod
|
|
- name: USERBOT_STORAGE_CLASS
|
|
value: local-path-retain
|
|
- name: USERBOT_DOWNLOADS_HOST_PATH
|
|
value: /srv/homelab/userbot/Downloads
|
|
resources:
|
|
requests:
|
|
cpu: 20m
|
|
memory: 96Mi
|
|
limits:
|
|
cpu: 300m
|
|
memory: 384Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: userbot-panel
|
|
namespace: userbot
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: userbot-panel
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|
|
---
|
|
apiVersion: traefik.io/v1alpha1
|
|
kind: IngressRoute
|
|
metadata:
|
|
name: userbot-panel-route
|
|
namespace: userbot
|
|
spec:
|
|
entryPoints:
|
|
- websecure
|
|
routes:
|
|
- match: Host(`userbot.workstation.internal`)
|
|
kind: Rule
|
|
services:
|
|
- name: userbot-panel
|
|
port: 8080
|
|
tls:
|
|
secretName: internal-wildcard-tls
|