Luca
468d4562c7
Toolkit per deployare/aggiornare un tenant LoginMaster su qualsiasi Kubernetes (EKS/AKS/DOKS/Scaleway/vSphere/...). Contiene: - deploy.sh: bootstrap di un nuovo tenant (idempotente, re-run protection, storage class auto-rilevata, prompt separati api/admin tag, generazione segreti crittografici via openssl rand). - update.sh: rolling update zero-downtime con tag api/admin separati, rollback hint via 'kubectl rollout undo', riapplicazione opzionale del ConfigMap. - templates/: 8 manifest parametrici (envsubst): namespace, cert-manager TLS Mongo, NetworkPolicy intra-namespace, ConfigMap, MongoDB StatefulSet 3 repliche con TLS interno + initContainer per keyfile/PEM, tenant-api Deployment 2 repliche con CA validation, tenant-admin, ingress nginx + Let's Encrypt. Sicurezza: TLS interno Mongo (cert-manager CA self-signed 10y), keyFile per auth replica set, password client mai in argv, NetworkPolicy che isola il tenant, pod Mongo non-root (uid 999) con initContainer come root per i file runtime in tmpfs.
72 lines
1.8 KiB
YAML
72 lines
1.8 KiB
YAML
# NetworkPolicy: isolamento del namespace tenant.
|
|
# - mongodb-tenant: ingress solo dai pod tenant-api e dagli altri membri del replica set.
|
|
# - tenant-api: ingress solo dall'ingress controller (namespace 'ingress-nginx').
|
|
# - tenant-admin: ingress solo dall'ingress controller.
|
|
# Egress: non vincolato (DNS, registry, SMTP, LOGINMASTER_API_URL devono restare raggiungibili).
|
|
#
|
|
# Nota: la namespace label 'kubernetes.io/metadata.name' è automatica dal K8s 1.22+.
|
|
# Se l'ingress controller è installato in un namespace diverso, modificare il selector.
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: mongodb-tenant
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: mongodb-tenant
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: mongodb-tenant
|
|
- podSelector:
|
|
matchLabels:
|
|
app: tenant-api
|
|
ports:
|
|
- protocol: TCP
|
|
port: 27017
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: tenant-api
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: tenant-api
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: ingress-nginx
|
|
ports:
|
|
- protocol: TCP
|
|
port: 3000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: tenant-admin
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: tenant-admin
|
|
policyTypes:
|
|
- Ingress
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: ingress-nginx
|
|
ports:
|
|
- protocol: TCP
|
|
port: 80
|