#cloud-config

# cloud config de base pour multipass

# lancement:
# multipass launch --name test --memory 1G --cpus 4 --disk 10G --cloud-init common-config.yaml

# package_update: true
# package_upgrade: true

packages:
  - net-tools
  - emacs-nox
  - elpa-yaml-mode

write_files:
# emacs par défaut via variable EDITOR                                                                                              
- path: /etc/environment
  content: |
    EDITOR=emacs
  append: true
# des alias "biens" définis dans le fichier principal de configuration de bash                                                      
- path: /etc/skel/.bashrc
  append: true
  content: |

    # alias personalisés
    alias du='du -h'
    alias df='df -h'
    alias locate='locate -i'
    alias cal='ncal -bMw'
    alias less='less -i'
    alias egrep='egrep --color=auto'
    alias fgrep='fgrep --color=auto'
    alias grep='grep --color=auto'
    alias ll='ls -lFh'

users:
  - # default = ubuntu avec multipass 
    ssh_authorized_keys:
    # ma clef du pc pour l'utilisateur "default" (ubuntu)
    - ssh-ed25519 AAAAC3N...contenu du fichier de clef publique ssh...

swap:
  filename: /swapfile
  size: 1G
  maxsize: 1G

apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin-user
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: admin-user
  namespace: kubernetes-dashboard

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-k3s
  namespace: default
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 512Mi
---
apiVersion: v1
kind: Pod
metadata:
  name: pvc-k3s-test
  namespace: default
spec:
  containers:
  - name: pvc-k3s-test-container
    image: alpine
    imagePullPolicy: IfNotPresent
    args:
      - sleep
      - "3600"
    volumeMounts:
    - name: pvc-k3s
      mountPath: /data
  volumes:
  - name: pvc-k3s
    persistentVolumeClaim:
      claimName: pvc-k3s

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: longhorn-pvc1
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn
  resources:
    requests:
      storage: 256Mi

apiVersion: v1
kind: Pod
metadata:
  name: longhorn-pvc1-pod
  namespace: default
spec:
  containers:
  - name: longhorn-pvc1-container
    image: alpine
    args:
    - sleep
    - "3600"
    imagePullPolicy: IfNotPresent
    volumeMounts:
    - name: volume-longhorn1
      mountPath: /data

  volumes:
  - name: volume-longhorn1
    persistentVolumeClaim:
      claimName: longhorn-pvc1

apiVersion: v1
kind: Namespace
metadata:
  name: primes
---
# frontal WEB
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: primes
  name: primes-deployment
  namespace: primes
spec:
  replicas: 2
  selector:
    matchLabels:
      app: primes
  template:
    metadata:
      labels:
        app: primes
    spec:
      containers:
      - image: quay.io/bruno_dubois1012/flask-primes:v2.0
        name: primes-container
        imagePullPolicy: IfNotPresent
        env:
        - name: REDIS
          value: redis-primes-svc.primes.svc.cluster.local
      initContainers:
      - name: wait-db-ready-init-container
        image: alpine
        imagePullPolicy: IfNotPresent
        command:
        - sh
        - -c
        - apk add netcat-openbsd; until echo quit|nc redis-primes-svc.primes.svc.cluster.local 6379; do  sleep 1 ;done
---
#PVC K3S
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-redis-primes
  namespace: primes
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: local-path
  resources:
    requests:
      storage: 512Mi
---
# Base noSQL Redis
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    run: redis-primes    
  name: redis-primes-deployment
  namespace: primes
spec:
  replicas: 1 # ne pas changer sans apprendre le produit (c'est une base de données!!!)
  strategy:
    type: Recreate
  selector:
    matchLabels:
      run: redis-primes
  template:
    metadata:
      labels:
        run: redis-primes
    spec:
      volumes:
      - name: pvc-redis-primes
        persistentVolumeClaim:
          claimName: pvc-redis-primes
      containers:
      - name: redis-primes-container
        image: redis
        imagePullPolicy: IfNotPresent
        volumeMounts:
        - name: pvc-redis-primes
          mountPath: /data
---
# SERVICES
kind: Service
apiVersion: v1
metadata:
  name: redis-primes-svc
  namespace: primes
spec:
  selector:
    run: redis-primes
  ports:
    - protocol: TCP
      port: 6379
      targetPort: 6379
      name: redis
---
kind: Service
apiVersion: v1
metadata:
  name: primes-svc
  namespace: primes
spec:
  selector:
    app: primes
  ports:
    - protocol: TCP
      port: 80
      targetPort: 5000
      name: flask-http
      nodePort: 31987
  type: NodePort

kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
  namespace: default
  name: deny-from-other-namespaces
spec:
  podSelector:
    matchLabels:
    # donc ceci s'applique à tous les pods du ns
  ingress:
  - from:
    - podSelector: {}
    # donc podSelector contient 1 règle vide, donc tous les pods du même ns sont autorisés
    # REM si un svc LoadBalancer est associé à un des pod, l'IP externe est bloquée
    # pour autoriser une IP externe:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0
        except: 
        - 10.0.0.0/8
        - 192.168.0.0/16
        - 172.16.0.0/12
  # Donc la liste de "from" est liée par OU
  # on aurait aussi pu mettre (avec des labels communs aux pods de ns):
  # - from:
  #   - podSelector:
  #       matchLabels:
  #         l1: .......
  #         l2: .......
  #         ......
  #        voir: https://github.com/ahmetb/kubernetes-network-policy-recipes/issues/1