This repository has been archived by the owner on Aug 19, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 14
/
backstage-default-config_v1_configmap.yaml
330 lines (330 loc) · 11.3 KB
/
backstage-default-config_v1_configmap.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
apiVersion: v1
data:
app-config.yaml: |
apiVersion: v1
kind: ConfigMap
metadata:
name: my-backstage-config-cm1 # placeholder for <bs>-default-appconfig
data:
default.app-config.yaml: |
backend:
auth:
externalAccess:
- type: legacy
options:
subject: legacy-default-config
# This is a default value, which you should change by providing your own app-config
secret: "pl4s3Ch4ng3M3"
db-secret.yaml: |-
apiVersion: v1
kind: Secret
metadata:
name: postgres-secrets # will be replaced
type: Opaque
#stringData:
# POSTGRES_PASSWORD:
# POSTGRES_PORT: "5432"
# POSTGRES_USER: postgres
# POSTGRESQL_ADMIN_PASSWORD: admin123
# POSTGRES_HOST: bs1-db-service #placeholder <crname>-db-service
db-service.yaml: |
apiVersion: v1
kind: Service
metadata:
name: backstage-psql # placeholder for 'backstage-psql-<cr-name>' .NOTE: For the time it is static and linked to Secret-> postgres-secrets -> OSTGRES_HOST
spec:
selector:
rhdh.redhat.com/app: backstage-psql-cr1 # placeholder for 'backstage-psql-<cr-name>'
clusterIP: None
ports:
- port: 5432
db-statefulset.yaml: |-
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: backstage-psql-cr1 # placeholder for 'backstage-psql-<cr-name>'
spec:
podManagementPolicy: OrderedReady
replicas: 1
selector:
matchLabels:
rhdh.redhat.com/app: backstage-psql-cr1 # placeholder for 'backstage-psql-<cr-name>'
serviceName: backstage-psql-cr1-hl # placeholder for 'backstage-psql-<cr-name>-hl'
template:
metadata:
labels:
rhdh.redhat.com/app: backstage-psql-cr1 # placeholder for 'backstage-psql-<cr-name>'
spec:
# fsGroup does not work for Openshift
# AKS/EKS does not work w/o it
#securityContext:
# fsGroup: 26
automountServiceAccountToken: false
## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/
## The optional .spec.persistentVolumeClaimRetentionPolicy field controls if and how PVCs are deleted during the lifecycle of a StatefulSet.
## You must enable the StatefulSetAutoDeletePVC feature gate on the API server and the controller manager to use this field.
# persistentVolumeClaimRetentionPolicy:
# whenDeleted: Retain
# whenScaled: Retain
containers:
- env:
- name: POSTGRESQL_PORT_NUMBER
value: "5432"
- name: POSTGRESQL_VOLUME_DIR
value: /var/lib/pgsql/data
- name: PGDATA
value: /var/lib/pgsql/data/userdata
image: quay.io/fedora/postgresql-15:latest # will be replaced with the actual image
imagePullPolicy: IfNotPresent
securityContext:
# runAsUser:26 does not work for Openshift but looks work for AKS/EKS
# runAsUser: 26
runAsGroup: 0
runAsNonRoot: true
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
livenessProbe:
exec:
command:
- /bin/sh
- -c
- exec pg_isready -U ${POSTGRES_USER} -h 127.0.0.1 -p 5432
failureThreshold: 6
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
name: postgresql
ports:
- containerPort: 5432
name: tcp-postgresql
protocol: TCP
readinessProbe:
exec:
command:
- /bin/sh
- -c
- -e
- |
exec pg_isready -U ${POSTGRES_USER} -h 127.0.0.1 -p 5432
failureThreshold: 6
initialDelaySeconds: 5
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 5
resources:
requests:
cpu: 250m
memory: 256Mi
limits:
cpu: 250m
memory: 1024Mi
ephemeral-storage: 20Mi
volumeMounts:
- mountPath: /dev/shm
name: dshm
- mountPath: /var/lib/pgsql/data
name: data
restartPolicy: Always
serviceAccountName: default
volumes:
- emptyDir:
medium: Memory
name: dshm
updateStrategy:
rollingUpdate:
partition: 0
type: RollingUpdate
volumeClaimTemplates:
- apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
deployment.yaml: |
apiVersion: apps/v1
kind: Deployment
metadata:
name: backstage # placeholder for 'backstage-<cr-name>'
spec:
replicas: 1
selector:
matchLabels:
rhdh.redhat.com/app: # placeholder for 'backstage-<cr-name>'
template:
metadata:
labels:
rhdh.redhat.com/app: # placeholder for 'backstage-<cr-name>'
spec:
automountServiceAccountToken: false
# if securityContext not present in AKS/EKS, the error is like this:
#Error: EACCES: permission denied, open '/dynamic-plugins-root/backstage-plugin-scaffolder-backend-module-github-dynamic-0.2.2.tgz'
# fsGroup doesn not work for Openshift
#securityContext:
# fsGroup: 1001
volumes:
- ephemeral:
volumeClaimTemplate:
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 2Gi
name: dynamic-plugins-root
- name: dynamic-plugins-npmrc
secret:
defaultMode: 420
optional: true
secretName: dynamic-plugins-npmrc
- emptyDir: {}
name: npmcacache
initContainers:
- name: install-dynamic-plugins
command:
- ./install-dynamic-plugins.sh
- /dynamic-plugins-root
# image will be replaced by the value of the `RELATED_IMAGE_backstage` env var, if set
image: quay.io/janus-idp/backstage-showcase:next
imagePullPolicy: IfNotPresent
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
env:
- name: NPM_CONFIG_USERCONFIG
value: /opt/app-root/src/.npmrc.dynamic-plugins
volumeMounts:
- mountPath: /dynamic-plugins-root
name: dynamic-plugins-root
- mountPath: /opt/app-root/src/.npmrc.dynamic-plugins
name: dynamic-plugins-npmrc
readOnly: true
subPath: .npmrc
- mountPath: /opt/app-root/src/.npm/_cacache
name: npmcacache
workingDir: /opt/app-root/src
resources:
requests:
cpu: 250m
memory: 256Mi
limits:
cpu: 1000m
memory: 2.5Gi
ephemeral-storage: 5Gi
containers:
- name: backstage-backend
# image will be replaced by the value of the `RELATED_IMAGE_backstage` env var, if set
image: quay.io/janus-idp/backstage-showcase:next
imagePullPolicy: IfNotPresent
args:
- "--config"
- "dynamic-plugins-root/app-config.dynamic-plugins.yaml"
securityContext:
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
runAsNonRoot: true
allowPrivilegeEscalation: false
readinessProbe:
failureThreshold: 3
httpGet:
path: /healthcheck
port: 7007
scheme: HTTP
initialDelaySeconds: 30
periodSeconds: 10
successThreshold: 2
timeoutSeconds: 2
livenessProbe:
failureThreshold: 3
httpGet:
path: /healthcheck
port: 7007
scheme: HTTP
initialDelaySeconds: 60
periodSeconds: 10
successThreshold: 1
timeoutSeconds: 2
ports:
- name: backend
containerPort: 7007
env:
- name: APP_CONFIG_backend_listen_port
value: "7007"
volumeMounts:
- mountPath: /opt/app-root/src/dynamic-plugins-root
name: dynamic-plugins-root
resources:
requests:
cpu: 250m
memory: 256Mi
limits:
cpu: 1000m
memory: 2.5Gi
ephemeral-storage: 5Gi
dynamic-plugins.yaml: |-
apiVersion: v1
kind: ConfigMap
metadata:
name: default-dynamic-plugins # must be the same as (deployment.yaml).spec.template.spec.volumes.name.dynamic-plugins-conf.configMap.name
data:
"dynamic-plugins.yaml": |
includes:
- dynamic-plugins.default.yaml
plugins: []
route.yaml: |-
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: route # placeholder for 'backstage-<cr-name>'
spec:
port:
targetPort: http-backend
path: /
tls:
insecureEdgeTerminationPolicy: Redirect
termination: edge
to:
kind: Service
name: # placeholder for 'backstage-<cr-name>'
secret-envs.yaml: |
apiVersion: v1
kind: Secret
metadata:
name: backend-auth-secret
stringData:
# generated with the command below (from https://janus-idp.io/docs/auth/service-to-service-auth/#setup):
# node -p 'require("crypto").randomBytes(24).toString("base64")'
BACKEND_SECRET: "R2FxRVNrcmwzYzhhN3l0V1VRcnQ3L1pLT09WaVhDNUEK" # notsecret
service.yaml: |-
apiVersion: v1
kind: Service
metadata:
name: backstage # placeholder for 'backstage-<cr-name>'
spec:
type: ClusterIP
selector:
rhdh.redhat.com/app: # placeholder for 'backstage-<cr-name>'
ports:
- name: http-backend
port: 80
targetPort: backend
kind: ConfigMap
metadata:
name: backstage-default-config