- Staging cluster werkend tot op phase 6 van cluster-install.md, inclusief HTTPS, Bunny, verificatie service.
This commit is contained in:
Josako
@@ -1,15 +1,3 @@
|
||||
# staging-test-setup.yaml
|
||||
# Complete test and debug setup for EveAI staging environment
|
||||
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: eveai-staging
|
||||
labels:
|
||||
environment: staging
|
||||
app: eveai
|
||||
|
||||
---
|
||||
# ConfigMap with HTML content for the test interface
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
@@ -331,172 +319,51 @@ data:
|
||||
add_header Content-Type text/plain;
|
||||
}
|
||||
|
||||
# Health endpoint
|
||||
# Handle /verify prefix paths - NEW
|
||||
location /verify/health {
|
||||
try_files /health.html =404;
|
||||
}
|
||||
|
||||
location /verify/info {
|
||||
try_files /info.html =404;
|
||||
}
|
||||
|
||||
location /verify/headers {
|
||||
try_files /headers.html =404;
|
||||
}
|
||||
|
||||
location /verify/network {
|
||||
try_files /network.html =404;
|
||||
}
|
||||
|
||||
# /verify root - serve main interface
|
||||
location /verify/ {
|
||||
try_files /index.html =404;
|
||||
}
|
||||
|
||||
location /verify {
|
||||
try_files /index.html =404;
|
||||
}
|
||||
|
||||
# Original paths (for direct access)
|
||||
location /health {
|
||||
try_files /health.html =404;
|
||||
}
|
||||
|
||||
# Info endpoint
|
||||
location /info {
|
||||
try_files /info.html =404;
|
||||
}
|
||||
|
||||
# Headers analysis
|
||||
location /headers {
|
||||
try_files /headers.html =404;
|
||||
}
|
||||
|
||||
# Network tests
|
||||
location /network {
|
||||
try_files /network.html =404;
|
||||
}
|
||||
|
||||
# Main interface - serve index.html for all other requests
|
||||
# Main interface - serve index.html for root
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
||||
|
||||
---
|
||||
# Verification service deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: verify-service
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: verify-service
|
||||
component: verification
|
||||
environment: staging
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: verify-service
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: verify-service
|
||||
component: verification
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:alpine
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- name: html-content
|
||||
mountPath: /usr/share/nginx/html
|
||||
- name: nginx-config
|
||||
mountPath: /etc/nginx/conf.d
|
||||
resources:
|
||||
requests:
|
||||
memory: "32Mi"
|
||||
cpu: "50m"
|
||||
limits:
|
||||
memory: "64Mi"
|
||||
cpu: "100m"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /verify/health
|
||||
port: 80
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /verify/health
|
||||
port: 80
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: html-content
|
||||
configMap:
|
||||
name: verify-content
|
||||
- name: nginx-config
|
||||
configMap:
|
||||
name: verify-nginx-config
|
||||
|
||||
---
|
||||
# Service for the verification app
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: verify-service
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: verify-service
|
||||
spec:
|
||||
selector:
|
||||
app: verify-service
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
name: http
|
||||
type: ClusterIP
|
||||
|
||||
---
|
||||
# Ingress rules with path-based routing
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: eveai-staging-ingress
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: eveai
|
||||
environment: staging
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
rules:
|
||||
- host: evie-staging.askeveai.com
|
||||
http:
|
||||
paths:
|
||||
# Verification service paths
|
||||
- path: /verify
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
|
||||
# Future services (commented out for now)
|
||||
# Admin service (not deployed yet)
|
||||
# - path: /admin
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: admin-service
|
||||
# port:
|
||||
# number: 80
|
||||
|
||||
# API service (not deployed yet)
|
||||
# - path: /api
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: api-service
|
||||
# port:
|
||||
# number: 8000
|
||||
|
||||
# Client/Frontend service (not deployed yet)
|
||||
# - path: /client
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: client-service
|
||||
# port:
|
||||
# number: 3000
|
||||
|
||||
# Default: root path to verification service
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
# Verification service deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: verify-service
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: verify-service
|
||||
component: verification
|
||||
environment: staging
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: verify-service
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: verify-service
|
||||
component: verification
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:alpine
|
||||
ports:
|
||||
- containerPort: 80
|
||||
volumeMounts:
|
||||
- name: html-content
|
||||
mountPath: /usr/share/nginx/html
|
||||
- name: nginx-config
|
||||
mountPath: /etc/nginx/conf.d
|
||||
resources:
|
||||
requests:
|
||||
memory: "32Mi"
|
||||
cpu: "50m"
|
||||
limits:
|
||||
memory: "64Mi"
|
||||
cpu: "100m"
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /verify/health
|
||||
port: 80
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /verify/health
|
||||
port: 80
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 5
|
||||
volumes:
|
||||
- name: html-content
|
||||
configMap:
|
||||
name: verify-content
|
||||
- name: nginx-config
|
||||
configMap:
|
||||
name: verify-nginx-config
|
||||
@@ -0,0 +1,16 @@
|
||||
# Service for the verification app
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: verify-service
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: verify-service
|
||||
spec:
|
||||
selector:
|
||||
app: verify-service
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
name: http
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,12 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- 00-configmaps.yaml
|
||||
- 01-deployment.yaml
|
||||
- 02-service.yaml
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app: verify-service
|
||||
component: verification
|
||||
16
scaleway/manifests/base/infrastructure/00-namespaces.yaml
Normal file
16
scaleway/manifests/base/infrastructure/00-namespaces.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: eveai-staging
|
||||
labels:
|
||||
environment: staging
|
||||
app: eveai
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: monitoring
|
||||
labels:
|
||||
environment: staging
|
||||
app: monitoring
|
||||
@@ -0,0 +1,15 @@
|
||||
# ClusterIssuer for Let's Encrypt staging (test first)
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
email: pieter@askeveai.com
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
@@ -0,0 +1,52 @@
|
||||
# cert-manager-values.yaml
|
||||
# Global configuration
|
||||
global:
|
||||
leaderElection:
|
||||
namespace: "cert-manager"
|
||||
|
||||
# Install CRDs as part of Helm release (alternative to manual install)
|
||||
# installCRDs: false # We install manually above
|
||||
|
||||
# Resource configuration
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
|
||||
# Webhook configuration
|
||||
webhook:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
|
||||
# CA Injector configuration
|
||||
cainjector:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
|
||||
# Security context
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1001
|
||||
|
||||
# Node selector (optional)
|
||||
# nodeSelector:
|
||||
# kubernetes.io/os: linux
|
||||
|
||||
# Prometheus monitoring (disabled - no Prometheus operator installed)
|
||||
prometheus:
|
||||
enabled: false
|
||||
servicemonitor:
|
||||
enabled: false
|
||||
46
scaleway/manifests/base/infrastructure/ingress-values.yaml
Normal file
46
scaleway/manifests/base/infrastructure/ingress-values.yaml
Normal file
@@ -0,0 +1,46 @@
|
||||
# ingress-values.yaml
|
||||
controller:
|
||||
# Disable admission webhook to prevent ACME challenge validation issues
|
||||
admissionWebhooks:
|
||||
enabled: false
|
||||
# Service configuratie
|
||||
service:
|
||||
type: LoadBalancer
|
||||
loadBalancerIP: "51.159.25.49" # Jouw huidige IP
|
||||
annotations:
|
||||
# Scaleway specifieke annotaties
|
||||
service.beta.kubernetes.io/scw-loadbalancer-use-hostname: "true"
|
||||
service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v1: "false"
|
||||
service.beta.kubernetes.io/scw-loadbalancer-proxy-protocol-v2: "false"
|
||||
|
||||
# Resource limits (optioneel, maar aanbevolen)
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 512Mi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
|
||||
# Replica's voor high availability (optioneel)
|
||||
replicaCount: 1
|
||||
|
||||
# Node selector (optioneel, voor specific nodes)
|
||||
# nodeSelector:
|
||||
# kubernetes.io/os: linux
|
||||
|
||||
# Metrics (voor monitoring later)
|
||||
metrics:
|
||||
enabled: true
|
||||
service:
|
||||
annotations:
|
||||
prometheus.io/scrape: "true"
|
||||
prometheus.io/port: "10254"
|
||||
|
||||
# Default backend (optioneel)
|
||||
defaultBackend:
|
||||
enabled: true
|
||||
image:
|
||||
registry: registry.k8s.io
|
||||
image: defaultbackend-amd64
|
||||
tag: "1.5"
|
||||
17
scaleway/manifests/base/kustomization.yaml
Normal file
17
scaleway/manifests/base/kustomization.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- infrastructure/00-namespaces.yaml
|
||||
- infrastructure/01-ingress-controller.yaml
|
||||
- infrastructure/02-cert-manager.yaml
|
||||
- infrastructure/03-cluster-issuers.yaml
|
||||
- applications/verification/
|
||||
- networking/ingress-https.yaml
|
||||
- secrets/scaleway-secrets.yaml
|
||||
- monitoring/
|
||||
|
||||
labels:
|
||||
- pairs:
|
||||
app: eveai
|
||||
managed-by: kustomize
|
||||
16
scaleway/manifests/base/monitoring/kustomization.yaml
Normal file
16
scaleway/manifests/base/monitoring/kustomization.yaml
Normal file
@@ -0,0 +1,16 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: monitoring
|
||||
|
||||
helmCharts:
|
||||
- name: kube-prometheus-stack
|
||||
repo: https://prometheus-community.github.io/helm-charts
|
||||
version: "55.5.0"
|
||||
releaseName: monitoring
|
||||
namespace: monitoring
|
||||
valuesFile: values-monitoring.yaml
|
||||
|
||||
commonLabels:
|
||||
environment: staging
|
||||
managed-by: kustomize
|
||||
71
scaleway/manifests/base/monitoring/prometheus-values.yaml
Normal file
71
scaleway/manifests/base/monitoring/prometheus-values.yaml
Normal file
@@ -0,0 +1,71 @@
|
||||
# prometheus-values.yaml
|
||||
# Global settings
|
||||
fullnameOverride: "monitoring"
|
||||
|
||||
# Prometheus configuration
|
||||
prometheus:
|
||||
prometheusSpec:
|
||||
retention: 15d
|
||||
resources:
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 2Gi
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 512Mi
|
||||
storageSpec:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
|
||||
# Grafana configuration
|
||||
grafana:
|
||||
enabled: true
|
||||
adminPassword: "admin123" # Change this for production
|
||||
resources:
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
persistence:
|
||||
enabled: true
|
||||
size: 2Gi
|
||||
|
||||
# AlertManager configuration
|
||||
alertmanager:
|
||||
alertmanagerSpec:
|
||||
resources:
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 64Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 2Gi
|
||||
|
||||
# Node Exporter
|
||||
nodeExporter:
|
||||
enabled: true
|
||||
|
||||
# Kube State Metrics
|
||||
kubeStateMetrics:
|
||||
enabled: true
|
||||
|
||||
# Disable components you might not need in staging
|
||||
kubeEtcd:
|
||||
enabled: false
|
||||
kubeScheduler:
|
||||
enabled: false
|
||||
kubeControllerManager:
|
||||
enabled: false
|
||||
131
scaleway/manifests/base/monitoring/values-monitoring.yaml
Normal file
131
scaleway/manifests/base/monitoring/values-monitoring.yaml
Normal file
@@ -0,0 +1,131 @@
|
||||
# Prometheus Community Helm Chart Values
|
||||
# For kube-prometheus-stack
|
||||
|
||||
# Global settings
|
||||
global:
|
||||
scrape_interval: 15s
|
||||
evaluation_interval: 15s
|
||||
|
||||
# Prometheus configuration
|
||||
prometheus:
|
||||
prometheusSpec:
|
||||
retention: 30d
|
||||
storageSpec:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: scw-bssd
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 50Gi
|
||||
|
||||
# External services monitoring (Scaleway managed services)
|
||||
additionalScrapeConfigs:
|
||||
- job_name: 'scaleway-redis'
|
||||
static_configs:
|
||||
- targets: ['redis-endpoint:6379']
|
||||
metrics_path: /metrics
|
||||
scrape_interval: 30s
|
||||
|
||||
- job_name: 'scaleway-postgresql'
|
||||
static_configs:
|
||||
- targets: ['postgres-endpoint:5432']
|
||||
metrics_path: /metrics
|
||||
scrape_interval: 30s
|
||||
|
||||
# Resource limits
|
||||
resources:
|
||||
requests:
|
||||
memory: 2Gi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 4Gi
|
||||
cpu: 1000m
|
||||
|
||||
# Grafana configuration
|
||||
grafana:
|
||||
adminPassword: "admin123" # Change in production
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClassName: scw-bssd
|
||||
size: 10Gi
|
||||
|
||||
# Resource limits
|
||||
resources:
|
||||
requests:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
limits:
|
||||
memory: 512Mi
|
||||
cpu: 200m
|
||||
|
||||
# Pre-configured dashboards
|
||||
dashboardProviders:
|
||||
dashboardproviders.yaml:
|
||||
apiVersion: 1
|
||||
providers:
|
||||
- name: 'eveai-dashboards'
|
||||
folder: 'EveAI'
|
||||
type: file
|
||||
options:
|
||||
path: /var/lib/grafana/dashboards/eveai
|
||||
|
||||
# Ingress configuration (will be handled by main ingress)
|
||||
ingress:
|
||||
enabled: false
|
||||
|
||||
# Pushgateway for batch jobs
|
||||
pushgateway:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 64Mi
|
||||
cpu: 50m
|
||||
limits:
|
||||
memory: 128Mi
|
||||
cpu: 100m
|
||||
|
||||
# AlertManager
|
||||
alertmanager:
|
||||
alertmanagerSpec:
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: scw-bssd
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
resources:
|
||||
requests:
|
||||
memory: 128Mi
|
||||
cpu: 50m
|
||||
limits:
|
||||
memory: 256Mi
|
||||
cpu: 100m
|
||||
|
||||
# Node Exporter
|
||||
nodeExporter:
|
||||
enabled: true
|
||||
|
||||
# Kube State Metrics
|
||||
kubeStateMetrics:
|
||||
enabled: true
|
||||
|
||||
# Disable components we don't need
|
||||
kubeApiServer:
|
||||
enabled: false
|
||||
kubelet:
|
||||
enabled: true
|
||||
kubeControllerManager:
|
||||
enabled: false
|
||||
coreDns:
|
||||
enabled: true
|
||||
kubeEtcd:
|
||||
enabled: false
|
||||
kubeScheduler:
|
||||
enabled: false
|
||||
kubeProxy:
|
||||
enabled: false
|
||||
44
scaleway/manifests/base/networking/ingress-http-acme.yaml
Normal file
44
scaleway/manifests/base/networking/ingress-http-acme.yaml
Normal file
@@ -0,0 +1,44 @@
|
||||
# Temporary HTTP-only ingress for ACME certificate challenges
|
||||
# Use this temporarily while Let's Encrypt validates domain ownership
|
||||
# Remove this file and revert to ingress-https.yaml once certificate is Ready
|
||||
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: eveai-staging-ingress
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: eveai
|
||||
environment: staging
|
||||
annotations:
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "false"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- hosts:
|
||||
- evie-staging.askeveai.com
|
||||
secretName: evie-staging-tls
|
||||
rules:
|
||||
- host: evie-staging.askeveai.com
|
||||
http:
|
||||
paths:
|
||||
# Verification service paths
|
||||
- path: /verify
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
|
||||
# Default: root path to verification service
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
80
scaleway/manifests/base/networking/ingress-https.yaml
Normal file
80
scaleway/manifests/base/networking/ingress-https.yaml
Normal file
@@ -0,0 +1,80 @@
|
||||
# HTTPS-only ingress with TLS configuration
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: eveai-staging-ingress
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: eveai
|
||||
environment: staging
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- hosts:
|
||||
- evie-staging.askeveai.com
|
||||
secretName: evie-staging-tls
|
||||
rules:
|
||||
- host: evie-staging.askeveai.com
|
||||
http:
|
||||
paths:
|
||||
# Verification service paths
|
||||
- path: /verify
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
|
||||
# Future services (ready for deployment)
|
||||
# Admin service
|
||||
# - path: /admin
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: eveai-app-service
|
||||
# port:
|
||||
# number: 80
|
||||
|
||||
# API service
|
||||
# - path: /api
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: eveai-api-service
|
||||
# port:
|
||||
# number: 80
|
||||
|
||||
# Client/Frontend service
|
||||
# - path: /client
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: eveai-chat-client-service
|
||||
# port:
|
||||
# number: 80
|
||||
|
||||
# Monitoring (when deployed)
|
||||
# - path: /monitoring
|
||||
# pathType: Prefix
|
||||
# backend:
|
||||
# service:
|
||||
# name: monitoring-grafana
|
||||
# port:
|
||||
# number: 80
|
||||
|
||||
# Default: root path to verification service
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
38
scaleway/manifests/base/secrets/eveai-external-secrets.yaml
Normal file
38
scaleway/manifests/base/secrets/eveai-external-secrets.yaml
Normal file
@@ -0,0 +1,38 @@
|
||||
# eveai-external-secrets.yaml
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: eveai-external-secrets
|
||||
namespace: eveai-staging
|
||||
spec:
|
||||
refreshInterval: 300s
|
||||
secretStoreRef:
|
||||
name: scaleway-secret-store
|
||||
kind: SecretStore
|
||||
target:
|
||||
name: eveai-secrets
|
||||
creationPolicy: Owner
|
||||
dataFrom:
|
||||
# Alle keys uit eveai-postgresql secret
|
||||
- extract:
|
||||
key: name:eveai-postgresql
|
||||
# Alle keys uit eveai-redis secret
|
||||
- extract:
|
||||
key: name:eveai-redis
|
||||
# Alle keys uit eveai-openai secret
|
||||
- extract:
|
||||
key: name:eveai-openai
|
||||
# Alle keys uit eveai-mistral secret
|
||||
- extract:
|
||||
key: name:eveai-mistral
|
||||
# Alle keys uit eveai-app-keys secret
|
||||
- extract:
|
||||
key: name:eveai-app-keys
|
||||
# Alle keys uit eveai-object-storage secret
|
||||
- extract:
|
||||
key: name:eveai-object-storage
|
||||
data:
|
||||
# Certificaat als aparte data entry
|
||||
- secretKey: REDIS_CERT
|
||||
remoteRef:
|
||||
key: name:eveai-redis-certificate
|
||||
19
scaleway/manifests/base/secrets/scaleway-secret-store.yaml
Normal file
19
scaleway/manifests/base/secrets/scaleway-secret-store.yaml
Normal file
@@ -0,0 +1,19 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: SecretStore
|
||||
metadata:
|
||||
name: scaleway-secret-store
|
||||
namespace: eveai-staging
|
||||
spec:
|
||||
provider:
|
||||
scaleway:
|
||||
# apiUrl: "https://api.scaleway.com"
|
||||
region: "fr-par"
|
||||
projectId: "ad7d2ed9-252b-4b2a-9f4c-daca3edc4c4b" # Vervang met je Scaleway project ID
|
||||
accessKey:
|
||||
secretRef:
|
||||
name: scaleway-credentials
|
||||
key: access-key
|
||||
secretKey:
|
||||
secretRef:
|
||||
name: scaleway-credentials
|
||||
key: secret-key
|
||||
29
scaleway/manifests/overlays/staging/kustomization.yaml
Normal file
29
scaleway/manifests/overlays/staging/kustomization.yaml
Normal file
@@ -0,0 +1,29 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
# Reference base components
|
||||
resources:
|
||||
- ../../base/
|
||||
|
||||
# Staging-specific configuration
|
||||
namePrefix: ""
|
||||
nameSuffix: ""
|
||||
|
||||
commonLabels:
|
||||
environment: staging
|
||||
managed-by: kustomize
|
||||
|
||||
# Images (can be overridden for staging-specific versions)
|
||||
images:
|
||||
- name: nginx
|
||||
newTag: alpine
|
||||
|
||||
# ConfigMap and Secret generators for staging-specific values
|
||||
configMapGenerator:
|
||||
- name: staging-config
|
||||
literals:
|
||||
- ENVIRONMENT=staging
|
||||
- LOG_LEVEL=INFO
|
||||
- DEBUG=false
|
||||
|
||||
# Note: Namespace is handled per resource to avoid conflicts
|
||||
@@ -1,88 +0,0 @@
|
||||
# cert-manager-setup.yaml
|
||||
# Install cert-manager for automatic SSL certificate management
|
||||
|
||||
# Install cert-manager CRDs first
|
||||
# kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.2/cert-manager.crds.yaml
|
||||
|
||||
# cert-manager namespace
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: cert-manager
|
||||
|
||||
---
|
||||
# ClusterIssuer for Let's Encrypt staging (test first)
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-staging
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
email: pieter@askeveai.com # CHANGE THIS
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-staging
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
|
||||
---
|
||||
# ClusterIssuer for Let's Encrypt production
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: ClusterIssuer
|
||||
metadata:
|
||||
name: letsencrypt-prod
|
||||
spec:
|
||||
acme:
|
||||
server: https://acme-v02.api.letsencrypt.org/directory
|
||||
email: pieter@askeveai.com # CHANGE THIS
|
||||
privateKeySecretRef:
|
||||
name: letsencrypt-prod
|
||||
solvers:
|
||||
- http01:
|
||||
ingress:
|
||||
class: nginx
|
||||
|
||||
---
|
||||
# Updated ingress with TLS configuration
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: eveai-staging-ingress-https
|
||||
namespace: eveai-staging
|
||||
labels:
|
||||
app: eveai
|
||||
environment: staging
|
||||
annotations:
|
||||
kubernetes.io/ingress.class: nginx
|
||||
nginx.ingress.kubernetes.io/ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
|
||||
nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
|
||||
# Use staging issuer first for testing
|
||||
cert-manager.io/cluster-issuer: letsencrypt-staging
|
||||
# After verification, switch to: letsencrypt-prod
|
||||
spec:
|
||||
ingressClassName: nginx
|
||||
tls:
|
||||
- hosts:
|
||||
- evie-staging.askeveai.com
|
||||
secretName: evie-staging-tls
|
||||
rules:
|
||||
- host: evie-staging.askeveai.com
|
||||
http:
|
||||
paths:
|
||||
- path: /verify
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: verify-service
|
||||
port:
|
||||
number: 80
|
||||
@@ -1,285 +0,0 @@
|
||||
# ingress-controller-setup.yaml
|
||||
# NGINX Ingress Controller voor gebruik met externe LoadBalancer
|
||||
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/instance: ingress-nginx
|
||||
|
||||
---
|
||||
# Ingress Controller Deployment
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
spec:
|
||||
serviceAccountName: ingress-nginx
|
||||
containers:
|
||||
- name: controller
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.8.2
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
args:
|
||||
- /nginx-ingress-controller
|
||||
- --election-id=ingress-controller-leader
|
||||
- --controller-class=k8s.io/ingress-nginx
|
||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
||||
- --validating-webhook=:8443
|
||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||
- --validating-webhook-key=/usr/local/certificates/key
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
runAsUser: 101
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
protocol: TCP
|
||||
- name: https
|
||||
containerPort: 443
|
||||
protocol: TCP
|
||||
- name: webhook
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
failureThreshold: 5
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
readinessProbe:
|
||||
failureThreshold: 3
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 1
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/certificates/
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: ingress-nginx-admission
|
||||
|
||||
---
|
||||
# NodePort Service - Dit is waar je LoadBalancer naar wijst!
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
spec:
|
||||
type: NodePort
|
||||
ports:
|
||||
- port: 80
|
||||
targetPort: 80
|
||||
protocol: TCP
|
||||
name: http
|
||||
nodePort: 30080 # Externe LoadBalancer wijst naar dit poort op elke node
|
||||
- port: 443
|
||||
targetPort: 443
|
||||
protocol: TCP
|
||||
name: https
|
||||
nodePort: 30443 # Voor HTTPS traffic
|
||||
selector:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
|
||||
---
|
||||
# ServiceAccount en RBAC
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "endpoints", "nodes", "pods", "secrets", "namespaces"]
|
||||
verbs: ["list", "watch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
resourceNames: ["ingress-nginx-controller"]
|
||||
verbs: ["get", "list", "watch", "create", "update", "patch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["list", "watch", "get"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "pods", "secrets", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
resourceNames: ["ingress-controller-leader"]
|
||||
verbs: ["get", "update"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["list", "watch", "get"]
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
|
||||
---
|
||||
# ConfigMap voor Ingress Controller configuratie
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
data:
|
||||
allow-snippet-annotations: "true"
|
||||
|
||||
---
|
||||
# IngressClass definitie
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
name: nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
@@ -1,243 +0,0 @@
|
||||
### Aangepaste Analyse en Stappenplan - Definitieve Versie
|
||||
|
||||
Bedankt voor de duidelijke antwoorden! Dit geeft me alle informatie die ik nodig heb om een definitief stappenplan op te stellen.
|
||||
|
||||
### Aangepaste Situatie-analyse
|
||||
|
||||
#### **Persistent Storage Requirements**
|
||||
Je hebt gelijk - voor de **interne Prometheus** hebben we inderdaad persistent storage nodig voor:
|
||||
- **Prometheus data**: Metrics history (7-14 dagen retentie)
|
||||
- **Pushgateway data**: Temporary metrics buffer
|
||||
- **Application logs**: Via Scaleway Logs (managed)
|
||||
|
||||
#### **Logging Strategie - Helder**
|
||||
- **Application logs**: Scaleway Logs (managed, 7-14 dagen)
|
||||
- **Business event logs**: PostgreSQL (jouw controle, facturatie)
|
||||
- **Audit logs**: Niet expliciet, maar DB tracking van wijzigingen bestaat al
|
||||
|
||||
#### **Infrastructure Status**
|
||||
- **Staging cluster**: Operationeel maar leeg
|
||||
- **DNS toegang**: Via cpanel beschikbaar
|
||||
- **Secrets**: Volledig geconfigureerd in Scaleway Secret Manager
|
||||
|
||||
### Aangepast Stappenplan
|
||||
|
||||
#### **Fase 1: Infrastructure & Storage Setup (Week 1)**
|
||||
|
||||
1. **Persistent Storage Configuratie**
|
||||
```yaml
|
||||
# Scaleway Block Storage volumes
|
||||
- prometheus-data: 20GB (metrics retention)
|
||||
- pushgateway-data: 5GB (temporary buffer)
|
||||
- application-logs: 10GB (7-dagen buffer voor Scaleway Logs)
|
||||
```
|
||||
|
||||
2. **DNS & SSL Setup**
|
||||
- Configureer `evie-staging.askeveai.com` in cpanel
|
||||
- Point naar K8s LoadBalancer IP
|
||||
- Setup Let's Encrypt SSL certificaten
|
||||
|
||||
3. **Scaleway Logs Setup**
|
||||
```yaml
|
||||
# Fluent Bit DaemonSet configuratie
|
||||
# Direct shipping naar Scaleway Logs
|
||||
# 7-dagen retentie policy
|
||||
```
|
||||
|
||||
4. **External Secrets Operator**
|
||||
- Installeer ESO in K8s cluster
|
||||
- Configureer Scaleway Secret Manager integration
|
||||
- Test secrets mapping
|
||||
|
||||
#### **Fase 2: Monitoring Stack Deployment (Week 1-2)**
|
||||
|
||||
5. **Prometheus Stack met Persistent Storage**
|
||||
```yaml
|
||||
# Prometheus Deployment
|
||||
spec:
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: prometheus-data
|
||||
spec:
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
|
||||
# Pushgateway Deployment
|
||||
spec:
|
||||
volumes:
|
||||
- name: pushgateway-data
|
||||
persistentVolumeClaim:
|
||||
claimName: pushgateway-pvc
|
||||
```
|
||||
|
||||
6. **Business Metrics Integratie**
|
||||
- Behoud huidige `business_event.py` logica
|
||||
- Pushgateway blijft beschikbaar op K8s
|
||||
- Configureer Prometheus scraping van pushgateway
|
||||
|
||||
7. **Scaleway Cockpit Remote Write**
|
||||
```yaml
|
||||
# Prometheus configuratie
|
||||
remote_write:
|
||||
- url: "https://metrics.cockpit.fr-par.scw.cloud/api/v1/push"
|
||||
headers:
|
||||
X-Token: "{{ scaleway_metrics_token }}"
|
||||
```
|
||||
|
||||
#### **Fase 3: Application Services Deployment (Week 2)**
|
||||
|
||||
8. **Core Services met Secrets Integration**
|
||||
```yaml
|
||||
# Deployment template voor alle 8 services
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: eveai-service
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: eveai-app-secrets
|
||||
- secretRef:
|
||||
name: eveai-postgresql-secrets
|
||||
# etc.
|
||||
```
|
||||
|
||||
9. **Ingress Controller & SSL**
|
||||
```yaml
|
||||
# Nginx Ingress met SSL
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: eveai-staging-ingress
|
||||
annotations:
|
||||
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
||||
spec:
|
||||
tls:
|
||||
- hosts:
|
||||
- evie-staging.askeveai.com
|
||||
secretName: eveai-staging-tls
|
||||
```
|
||||
|
||||
10. **Service Dependencies & Health Checks**
|
||||
- Init containers voor database migrations
|
||||
- Readiness/liveness probes voor alle services
|
||||
- Service discovery configuratie
|
||||
|
||||
#### **Fase 4: Logging & Observability (Week 2-3)**
|
||||
|
||||
11. **Scaleway Logs Integration**
|
||||
```yaml
|
||||
# Fluent Bit DaemonSet
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: fluent-bit
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: fluent-bit
|
||||
image: fluent/fluent-bit:latest
|
||||
env:
|
||||
- name: SCALEWAY_LOGS_TOKEN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: scaleway-logs-secret
|
||||
key: token
|
||||
```
|
||||
|
||||
12. **Log Routing Configuratie**
|
||||
- Application logs → Scaleway Logs (7-dagen retentie)
|
||||
- Business events → PostgreSQL (jouw controle)
|
||||
- System logs → Scaleway Logs
|
||||
- Error logs → Scaleway Logs + alerting
|
||||
|
||||
#### **Fase 5: Testing & Go-Live (Week 3-4)**
|
||||
|
||||
13. **Deployment Automation**
|
||||
- Update `push_to_scaleway.sh` voor K8s deployment
|
||||
- Rolling update configuratie
|
||||
- Rollback procedures
|
||||
|
||||
14. **Monitoring Dashboards**
|
||||
- Scaleway Cockpit dashboards voor infrastructure
|
||||
- Custom business metrics visualisatie
|
||||
- Alerting configuratie
|
||||
|
||||
15. **Load Testing & Performance**
|
||||
- Staging environment load testing
|
||||
- Resource limits fine-tuning
|
||||
- Auto-scaling configuratie (HPA)
|
||||
|
||||
### Specifieke Storage Configuratie
|
||||
|
||||
#### **Persistent Volumes Planning**
|
||||
|
||||
```yaml
|
||||
# Prometheus Storage
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: prometheus-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 20Gi
|
||||
storageClassName: scw-bssd # Scaleway Block Storage
|
||||
|
||||
# Pushgateway Storage
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: pushgateway-data-pvc
|
||||
spec:
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 5Gi
|
||||
storageClassName: scw-bssd
|
||||
```
|
||||
|
||||
#### **Monitoring Stack Resource Allocation**
|
||||
|
||||
Voor staging environment:
|
||||
- **Prometheus**: 2GB RAM, 1 CPU, 20GB storage (14-dagen metrics)
|
||||
- **Pushgateway**: 512MB RAM, 0.5 CPU, 5GB storage
|
||||
- **Fluent Bit**: 256MB RAM, 0.2 CPU per node
|
||||
|
||||
### Antwoorden op je Specifieke Vragen
|
||||
|
||||
#### **1. Persistent Storage voor Prometheus**
|
||||
Ja, absoluut nodig. Zonder persistent storage verlies je alle metrics bij pod restarts. We configureren Scaleway Block Storage volumes voor:
|
||||
- Prometheus metrics data (20GB, 14-dagen retentie)
|
||||
- Pushgateway buffer (5GB)
|
||||
|
||||
#### **2. Audit Logs Verduidelijking**
|
||||
Met "audit logs" bedoelde ik system-level logs (wie heeft toegang gehad tot welke resources, API calls, etc.). Jouw DB tracking van wijzigingen is perfect en blijft zoals het is.
|
||||
|
||||
#### **3. Scaleway Logs vs Kubernetes Native**
|
||||
Scaleway Logs is inderdaad de beste keuze omdat:
|
||||
- Volledig managed (geen onderhoud)
|
||||
- Automatische retentie management
|
||||
- Geïntegreerd met Cockpit
|
||||
- Kosteneffectief voor staging
|
||||
|
||||
#### **4. Business Event Logs**
|
||||
Deze blijven in PostgreSQL zoals nu, want:
|
||||
- Nodig voor facturatie (kritieke data)
|
||||
- Jouw controle over retentie
|
||||
- Gestructureerde data voor business logic
|
||||
|
||||
### Volgende Concrete Stappen
|
||||
|
||||
1. **DNS Setup**: Configureer `evie-staging.askeveai.com` in cpanel
|
||||
2. **Storage Classes**: Verificeer Scaleway Block Storage classes in K8s
|
||||
3. **External Secrets**: Installeer ESO en test secrets mapping
|
||||
4. **Monitoring Stack**: Deploy Prometheus + Pushgateway met persistent storage
|
||||
|
||||
Wil je dat we beginnen met stap 1 (DNS setup) of heb je voorkeur voor een andere volgorde?
|
||||
Reference in New Issue
Block a user