added mongodb config-example

2024-02-16 10:00:35 +01:00
parent cd7d45c112
commit 3882c2175e
11 changed files with 342 additions and 0 deletions
@@ -0,0 +1,59 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mongodb-configmap
+data:
+  mongo.conf: |
+    storage:
+      dbPath: /data/db
+  ensure-users.js: |
+    const targetDbStr = 'test';
+    const rootUser = cat('/etc/k8-test/admin/MONGO_ROOT_USERNAME');
+    const rootPass = cat('/etc/k8-test/admin/MONGO_ROOT_PASSWORD');
+    const usersStr = cat('/etc/k8-test/MONGO_USERS_LIST');
+
+    const adminDb = db.getSiblingDB('admin');
+    adminDb.auth(rootUser, rootPass);
+    print('Successfully authenticated admin user');
+
+    const targetDb = db.getSiblingDB(targetDbStr);
+
+    const customRoles = adminDb
+      .getRoles({rolesInfo: 1, showBuiltinRoles: false})
+      .map(role => role.role)
+      .filter(Boolean);
+
+    usersStr
+      .trim()
+      .split(';')
+      .map(s => s.split(':'))
+      .forEach(user => {
+        const username = user[0];
+        const rolesStr = user[1];
+        const password = user[2];
+
+        if (!rolesStr || !password) {
+          return;
+        }
+
+        const roles = rolesStr.split(',');
+        const userDoc = {
+          user: username,
+          pwd: password,
+        };
+
+        userDoc.roles = roles.map(role => {
+          if (!~customRoles.indexOf(role)) {
+            return role;
+          }
+          return {role: role, db: 'admin'};
+        });
+
+        try {
+          targetDb.createUser(userDoc);
+        } catch (err) {
+          if (!~err.message.toLowerCase().indexOf('duplicate')) {
+            throw err;
+          }
+        }
+      });
@@ -0,0 +1,24 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  annotations:
+    pv.kubernetes.io/provisioned-by: nfs.csi.k8s.io
+  name: mongodb-pv
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: mongodb-storageclass
+  mountOptions:
+    - nfsvers=4.1
+  csi:
+    driver: nfs.csi.k8s.io
+    # volumeHandle format: {nfs-server-address}#{sub-dir-name}#{share-name}
+    # make sure this value is unique for every share in the cluster
+    volumeHandle: 192.168.202.50/srv/persistant/#mongodb#
+    volumeAttributes:
+      server: 192.168.202.50
+      share: /srv/persistant/
@@ -0,0 +1,25 @@
+---
+#kind: PersistentVolumeClaim
+#apiVersion: v1
+#metadata:
+#  name: pvc-nfs-static
+#spec:
+#  accessModes:
+#    - ReadWriteMany
+#  resources:
+#    requests:
+#      storage: 10Gi
+#  volumeName: pv-nfs
+#  storageClassName: nfs-csi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc-mongodb-dynamic
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: mongodb-storageclass
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mongodb-secret
+type: Opaque
+data:
+  MONGO_ROOT_USERNAME: YWRtaW4=
+  MONGO_ROOT_PASSWORD: cGFzc3dvcmQK
+  MONGO_USERNAME: bW9uZ28=
+  MONGO_PASSWORD: cGFzc3dvcmQK
+  MONGO_USERS_LIST: dGVzdDpkYkFkbWluLHJlYWRXcml0ZTpwYXNzd29yZAo=
@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongo
+  namespace: default
+  labels:
+    name: mongo
+spec:
+  ports:
+    - port: 27017
+      targetPort: 27017
+  clusterIP: None
+  selector:
+    app: mongo
+root@vmcon-master:~/mongodb# cat Service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongodb-test
+  labels:
+    app: database
+spec:
+  clusterIP: None
+  selector:
+    app: database
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongo
+  namespace: default
+  labels:
+    name: mongo
+spec:
+  ports:
+    - port: 27017
+      targetPort: 27017
+  clusterIP: None
+  selector:
+    app: mongo
@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mongodb-test
+spec:
+  serviceName: mongodb-test
+  replicas: 1
+  selector:
+    matchLabels:
+      app: database
+  template:
+    metadata:
+      labels:
+        app: database
+        selector: mongodb-test
+    spec:
+      containers:
+      - name: mongodb-test
+        image: mongo:4.0.8
+        env:
+          - name: MONGO_INITDB_ROOT_USERNAME_FILE
+            value: /etc/k8-test/admin/MONGO_ROOT_USERNAME
+          - name: MONGO_INITDB_ROOT_PASSWORD_FILE
+            value: /etc/k8-test/admin/MONGO_ROOT_PASSWORD
+        volumeMounts:
+        - name: k8-test
+          mountPath: /etc/k8-test
+          readOnly: true
+        - name: mongodb-scripts
+          mountPath: /docker-entrypoint-initdb.d
+          readOnly: true
+        - name: mongodb-configmap
+          mountPath: /config
+          readOnly: true
+        - name: mongodb-data
+          mountPath: /data/db
+      nodeSelector:
+        size: large
+      volumes:
+      - name: k8-test
+        secret:
+          secretName: mongodb-secret
+          items:
+          - key: MONGO_ROOT_USERNAME
+            path: admin/MONGO_ROOT_USERNAME
+            mode: 0444
+          - key: MONGO_ROOT_PASSWORD
+            path: admin/MONGO_ROOT_PASSWORD
+            mode: 0444
+          - key: MONGO_USERNAME
+            path: MONGO_USERNAME
+            mode: 0444
+          - key: MONGO_PASSWORD
+            path: MONGO_PASSWORD
+            mode: 0444
+          - key: MONGO_USERS_LIST
+            path: MONGO_USERS_LIST
+            mode: 0444
+      - name: mongodb-scripts
+        configMap:
+          name: mongodb-configmap
+          items:
+          - key: ensure-users.js
+            path: ensure-users.js
+      - name: mongodb-configmap
+        configMap:
+          name: mongodb-configmap
+          items:
+          - key: mongo.conf
+            path: mongo.conf
+      - name: mongodb-data
+        persistentVolumeClaim:
+          claimName: pvc-mongodb-dynamic
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mongodb-replica
+  namespace: default
+spec:
+  serviceName: mongo
+  replicas: 2
+  selector:
+    matchLabels:
+      app: mongo
+  template:
+    metadata:
+      labels:
+        app: mongo
+        selector: mongo
+    spec:
+      terminationGracePeriodSeconds: 30
+      serviceAccount: mongo-account
+      containers:
+      - name: mongodb
+        image: docker.io/mongo:4.2
+        env:
+        command: ["/bin/sh"]
+        args: ["-c", "mongod --replSet=rs0 --bind_ip_all"]
+        resources:
+          limits:
+            cpu: 1
+            memory: 1500Mi
+          requests:
+            cpu: 1
+            memory: 1000Mi
+        ports:
+        - name: mongo-port
+          containerPort: 27017
+        volumeMounts:
+        - name: mongo-data
+          mountPath: /data/db
+  volumeClaimTemplates:
+  - metadata:
+      name: mongo-data
+    spec:
+      accessModes:
+        - ReadWriteOnce
+      storageClassName: mongodb-storageclass
+      resources:
+        requests:
+          storage: 10Gi
@@ -0,0 +1,16 @@
+# create a new nfs-storageClass for mongodb
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: mongodb-storageclass
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.202.50
+  share: /srv/persistant/
+  # csi.storage.k8s.io/provisioner-secret is only needed for providing mountOptions in DeleteVolume
+  # csi.storage.k8s.io/provisioner-secret-name: "mount-options"
+  # csi.storage.k8s.io/provisioner-secret-namespace: "default"
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+mountOptions:
+  - nfsvers=4.1
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ConfigMap.yaml
+#  - PersistentVolume.yaml
+#  - PersistentVolumeClaim.yaml
+  - Secret.yaml
+  - Service.yaml
+  - StatefulSet.yaml
+#  - StorageClass.yaml
@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mongo-account
+  namespace: default
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mongo-role
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["*"]
+- apiGroups: [""]
+  resources: ["deployments"]
+  verbs: ["list", "watch"]
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["*"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get","list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mongo_role_binding
+subjects:
+- kind: ServiceAccount
+  name: mongo-account
+  namespace: default
+roleRef:
+  kind: ClusterRole
+  name: mongo-role
+  apiGroup: rbac.authorization.k8s.io