diff --git a/manifests/centurion_erp/base/00.settings.py b/manifests/centurion_erp/base/00.settings.py new file mode 100644 index 0000000..5471bfc --- /dev/null +++ b/manifests/centurion_erp/base/00.settings.py @@ -0,0 +1,25 @@ +DEBUG = False + +# FEATURE_FLAG_OVERRIDES = [ +# {'disable_downloading': False}, +# ] + +METRICS_ENABLED = False +# PROMETHEUS_EXPORT_MIGRATIONS = True + +AUTH_PASSWORD_VALIDATORS = [] + +SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") +SECURE_SSL_REDIRECT = True + +USE_X_FORWARDED_HOST = True + +LOG_FILES = { + "catch_all":"/var/log/catch-all.log", + "centurion_trace": "/var/log/trace.log", + "centurion": "/var/log/centurion.log", + "error": "/var/log/error.log", + "gunicorn": "/var/log/gunicorn.log", + "rest_api": "/var/log/rest_api.log", + "weblog": "/var/log/weblog.log", +} diff --git a/manifests/centurion_erp/base/10.celery-broker.py b/manifests/centurion_erp/base/10.celery-broker.py new file mode 100644 index 0000000..0974739 --- /dev/null +++ b/manifests/centurion_erp/base/10.celery-broker.py @@ -0,0 +1,2 @@ +# amqp://:@/ +CELERY_BROKER_URL = '' diff --git a/manifests/centurion_erp/base/15.ui-redirect.py b/manifests/centurion_erp/base/15.ui-redirect.py new file mode 100644 index 0000000..0aacb64 --- /dev/null +++ b/manifests/centurion_erp/base/15.ui-redirect.py @@ -0,0 +1,2 @@ +LOGIN_REDIRECT_URL = "/" +LOGOUT_REDIRECT_URL = "login" \ No newline at end of file diff --git a/manifests/centurion_erp/base/20.database.py b/manifests/centurion_erp/base/20.database.py new file mode 100644 index 0000000..4720e13 --- /dev/null +++ b/manifests/centurion_erp/base/20.database.py @@ -0,0 +1,11 @@ +DATABASES = { + 'default': { + 'ENGINE': 'django_prometheus.db.backends.postgresql', + 'NAME': 'centurion', # Database name + 'USER': '', # PostgreSQL username + 'PASSWORD': '', # PostgreSQL password + 'HOST': '', # Database server + 'PORT': '', # Database port (leave blank for default) + 'CONN_MAX_AGE': 300, # Max database connection age + } +} diff --git a/manifests/centurion_erp/base/80.csrf.py b/manifests/centurion_erp/base/80.csrf.py new file mode 100644 index 0000000..7aa4176 --- /dev/null +++ b/manifests/centurion_erp/base/80.csrf.py @@ -0,0 +1,14 @@ +SITE_URL = 'https://' + +TRUSTED_ORIGINS = [ + 'https://', + 'https://', +] + +# SSL +SECURE_SSL_HOST = '' +SECURE_SSL_REDIRECT = True +SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https") + +USE_X_FORWARDED_HOST = True +SESSION_COOKIE_SECURE = True diff --git a/manifests/centurion_erp/base/90.secret_key.py b/manifests/centurion_erp/base/90.secret_key.py new file mode 100644 index 0000000..5444868 --- /dev/null +++ b/manifests/centurion_erp/base/90.secret_key.py @@ -0,0 +1,2 @@ +# Add your secret key here +SECRET_KEY = '' diff --git a/manifests/centurion_erp/base/Deployment-api.yaml b/manifests/centurion_erp/base/Deployment-api.yaml new file mode 100644 index 0000000..6f4c4e6 --- /dev/null +++ b/manifests/centurion_erp/base/Deployment-api.yaml @@ -0,0 +1,114 @@ +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp + name: api +spec: + selector: + matchLabels: + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp + replicas: 1 + minReadySeconds: 10 + template: + metadata: + labels: + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp + spec: + terminationGracePeriodSeconds: 10 + affinity: {} + containers: + + - name: web + image: nofusscomputing/centurion-erp:dev + resources: + limits: + cpu: 1 + memory: 2Gi + requests: + cpu: 400m + memory: 800Mi + + ports: + - containerPort: 8000 + name: api + + volumeMounts: + + - name: configuration + mountPath: /etc/itsm + readOnly: true + + - name: data + mountPath: /data + subPath: data + + - mountPath: /var/log + name: logs + + - mountPath: /tmp + name: tmp + subPath: tmp + + + - name: ui + image: nofusscomputing/centurion-erp-ui:dev + env: [] + resources: + limits: + cpu: 500m + memory: 256Mi + requests: + cpu: 10m + memory: 20Mi + + ports: + - containerPort: 80 + name: ui + + volumeMounts: [] + + tolerations: [] + volumes: + + - name: configuration + projected: + sources: + - configMap: + name: configuration + items: + - key: 00.settings.py + path: 00.settings.py + - key: 15.ui-redirect.py + path: 15.ui-redirect.py + - key: 80.csrf.py + path: 80.csrf.py + - secret: + name: celery-broker + items: + - key: 10.celery-broker.py + path: 10.celery-broker.py + - secret: + name: database + items: + - key: 20.database.py + path: 20.database.py + + - name: data + persistentVolumeClaim: + claimName: centurion + + - name: logs + hostPath: + path: /opt/logs/centurion-api + type: DirectoryOrCreate + + - name: tmp + emptyDir: + medium: Memory + # sizeLimit: 64Mi diff --git a/manifests/centurion_erp/base/Deployment-worker.yaml b/manifests/centurion_erp/base/Deployment-worker.yaml new file mode 100644 index 0000000..e5391c0 --- /dev/null +++ b/manifests/centurion_erp/base/Deployment-worker.yaml @@ -0,0 +1,86 @@ +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/name: worker + app.kubernetes.io/part-of: centurion-erp + name: worker +spec: + selector: + matchLabels: + app.kubernetes.io/name: worker + app.kubernetes.io/part-of: centurion-erp + replicas: 1 + minReadySeconds: 10 + template: + metadata: + labels: + app.kubernetes.io/name: worker + app.kubernetes.io/part-of: centurion-erp + spec: + terminationGracePeriodSeconds: 10 + affinity: {} + containers: + - name: worker + image: nofusscomputing/centurion-erp:dev + env: + - name: IS_WORKER + value: "true" + resources: + limits: + cpu: 800m + memory: 200Mi + requests: + cpu: 10m + memory: 20Mi + + ports: + - containerPort: 8080 + name: metrics + + volumeMounts: + + - name: configuration + mountPath: /etc/itsm + readOnly: true + + - mountPath: /var/log + name: logs + + - mountPath: /tmp + name: tmp + subPath: tmp + + tolerations: [] + volumes: + + - name: configuration + projected: + sources: + - configMap: + name: configuration + items: + - key: 00.settings.py + path: 00.settings.py + - secret: + name: celery-broker + items: + - key: 10.celery-broker.py + path: 10.celery-broker.py + - secret: + name: database + items: + - key: 20.database.py + path: 20.database.py + + - name: logs + hostPath: + path: /opt/logs/centurion-worker + type: DirectoryOrCreate + + - name: tmp + emptyDir: + medium: Memory + # sizeLimit: 64Mi diff --git a/manifests/centurion_erp/base/PVC-centurion.yaml b/manifests/centurion_erp/base/PVC-centurion.yaml new file mode 100644 index 0000000..6efbc7b --- /dev/null +++ b/manifests/centurion_erp/base/PVC-centurion.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + labels: + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp + name: centurion +spec: + volumeMode: Filesystem + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 5Gi diff --git a/manifests/centurion_erp/base/Service-api.yaml b/manifests/centurion_erp/base/Service-api.yaml new file mode 100644 index 0000000..a31a7e0 --- /dev/null +++ b/manifests/centurion_erp/base/Service-api.yaml @@ -0,0 +1,19 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: centurion + labels: + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp +spec: + selector: + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp + ports: + - name: api + port: 8000 + targetPort: api + - name: ui + port: 80 + targetPort: ui diff --git a/manifests/centurion_erp/base/kustomization.yaml b/manifests/centurion_erp/base/kustomization.yaml new file mode 100644 index 0000000..0650bdb --- /dev/null +++ b/manifests/centurion_erp/base/kustomization.yaml @@ -0,0 +1,52 @@ +--- +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization + +configMapGenerator: + - name: configuration + files: + - 00.settings.py + - 15.ui-redirect.py + - 80.csrf.py + +generatorOptions: + disableNameSuffixHash: true + +# patches: +# - patch: |- +# apiVersion: apps/v1 +# kind: Deployment +# metadata: +# name: api +# spec: +# template: +# spec: +# containers: +# - name: ui +# env: +# - name: API_URL +# value: https:///api/v2 + +# target: +# kind: Deployment +# name: api +# version: v1 + +resources: + - PVC-centurion.yaml + - Deployment-api.yaml + - Deployment-worker.yaml + - Service-api.yaml + +secretGenerator: + - name: secret-key + files: + - 90.secret_key.py + + - name: celery-broker + files: + - 10.celery-broker.py + + - name: database + files: + - 20.database.py diff --git a/manifests/centurion_erp/components/ingress/Ingress-centurion.yaml b/manifests/centurion_erp/components/ingress/Ingress-centurion.yaml new file mode 100644 index 0000000..70a2f7f --- /dev/null +++ b/manifests/centurion_erp/components/ingress/Ingress-centurion.yaml @@ -0,0 +1,79 @@ +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + cert-manager.io/common-name: example.com + cert-manager.io/duration: 2160h + cert-manager.io/private-key-algorithm: ECDSA + cert-manager.io/private-key-rotation-policy: Always + cert-manager.io/private-key-size: "384" + cert-manager.io/subject-countries: N/A + cert-manager.io/subject-organizationalunits: N/A + cert-manager.io/subject-organizations: N/A + cert-manager.io/subject-provinces: N/A + labels: + app.kubernetes.io/component: Ingress + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp + name: centurion +spec: + ingressClassName: nginx + rules: + - host: example.com + http: + paths: + - backend: + service: + name: centurion + port: + name: api + path: /account/ + pathType: Prefix + - backend: + service: + name: centurion + port: + name: api + path: /admin + pathType: Prefix + - backend: + service: + name: centurion + port: + name: api + path: /api + pathType: Prefix + - backend: + service: + name: centurion + port: + name: api + path: /sso/ + pathType: Prefix + - backend: + service: + name: centurion + port: + name: api + path: /static/ + pathType: Prefix + - backend: + service: + name: centurion + port: + name: api + path: /robots.txt + pathType: Exact + - backend: + service: + name: centurion + port: + name: ui + path: / + pathType: Prefix + tls: + - hosts: + - example.com + secretName: certificate-tls-centurion diff --git a/manifests/centurion_erp/components/ingress/kustomization.yaml b/manifests/centurion_erp/components/ingress/kustomization.yaml new file mode 100644 index 0000000..a2fdf57 --- /dev/null +++ b/manifests/centurion_erp/components/ingress/kustomization.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component + +# patches: + +# - patch: |- + +# - op: replace +# path: /metadata/annotations/cert-manager.io~1cluster-issuer +# value: cluster + +# - op: replace +# path: /metadata/annotations/cert-manager.io~1common-name +# value: + +# - op: replace +# path: /spec/rules/0/host +# value: + +# - op: replace +# path: /spec/tls/0/hosts/0 +# value: +# target: +# kind: Ingress +# name: centurion +# version: v1 + +resources: + - Ingress-centurion.yaml diff --git a/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-Permission-Centurion.yaml b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-Permission-Centurion.yaml new file mode 100644 index 0000000..5238b80 --- /dev/null +++ b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-Permission-Centurion.yaml @@ -0,0 +1,20 @@ +--- + +apiVersion: rabbitmq.com/v1beta1 +kind: Permission +metadata: + labels: + app.kubernetes.io/component: message-queuing + app.kubernetes.io/name: rabbitmq + app.kubernetes.io/part-of: centurion-erp + name: permission-centurion +spec: + vhost: "centurion" + user: "centurion" + permissions: + write: ".*" + configure: ".*" + read: ".*" + rabbitmqClusterReference: + name: main + namespace: rabbitmq diff --git a/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-Queue-Centurion.yaml b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-Queue-Centurion.yaml new file mode 100644 index 0000000..0b9eb20 --- /dev/null +++ b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-Queue-Centurion.yaml @@ -0,0 +1,18 @@ +--- + +apiVersion: rabbitmq.com/v1beta1 +kind: Queue +metadata: + labels: + app.kubernetes.io/component: message-queuing + app.kubernetes.io/name: rabbitmq + app.kubernetes.io/part-of: centurion-erp + name: queue-centurion +spec: + name: centurion + autoDelete: false + durable: true + rabbitmqClusterReference: + name: main + namespace: rabbitmq + vhost: centurion diff --git a/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-User-Centurion.yaml b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-User-Centurion.yaml new file mode 100644 index 0000000..1dde7b7 --- /dev/null +++ b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-User-Centurion.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: rabbitmq.com/v1beta1 +kind: User +metadata: + labels: + app.kubernetes.io/component: message-queuing + app.kubernetes.io/name: rabbitmq + app.kubernetes.io/part-of: centurion-erp + name: centurion +spec: + importCredentialsSecret: + name: user-centurion + tags: + - policymaker + rabbitmqClusterReference: + name: main + namespace: rabbitmq diff --git a/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-VHost-Centurion.yaml b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-VHost-Centurion.yaml new file mode 100644 index 0000000..cedf6b6 --- /dev/null +++ b/manifests/centurion_erp/components/rabbitmq-setup/RabbitMQ-VHost-Centurion.yaml @@ -0,0 +1,15 @@ +--- + +apiVersion: rabbitmq.com/v1beta1 +kind: Vhost +metadata: + labels: + app.kubernetes.io/component: message-queuing + app.kubernetes.io/name: rabbitmq + app.kubernetes.io/part-of: centurion-erp + name: vhost-centurion +spec: + name: centurion + rabbitmqClusterReference: + name: main + namespace: rabbitmq diff --git a/manifests/centurion_erp/components/rabbitmq-setup/kustomization.yaml b/manifests/centurion_erp/components/rabbitmq-setup/kustomization.yaml new file mode 100644 index 0000000..d44362d --- /dev/null +++ b/manifests/centurion_erp/components/rabbitmq-setup/kustomization.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component + +generatorOptions: + disableNameSuffixHash: true + +resources: + - RabbitMQ-Permission-Centurion.yaml + - RabbitMQ-Queue-Centurion.yaml + - RabbitMQ-User-Centurion.yaml + - RabbitMQ-VHost-Centurion.yaml + +secretGenerator: + - name: user-centurion + options: + labels: + app.kubernetes.io/component: message-queuing + app.kubernetes.io/name: rabbitmq + app.kubernetes.io/part-of: centurion-erp + envs: + - user-centurion.env diff --git a/manifests/centurion_erp/components/rabbitmq-setup/user-centurion.env b/manifests/centurion_erp/components/rabbitmq-setup/user-centurion.env new file mode 100644 index 0000000..bfa41bc --- /dev/null +++ b/manifests/centurion_erp/components/rabbitmq-setup/user-centurion.env @@ -0,0 +1,2 @@ +username= +password= diff --git a/manifests/centurion_erp/components/service-monitor/99.enable-metrics.py b/manifests/centurion_erp/components/service-monitor/99.enable-metrics.py new file mode 100644 index 0000000..743511d --- /dev/null +++ b/manifests/centurion_erp/components/service-monitor/99.enable-metrics.py @@ -0,0 +1 @@ +METRICS_ENABLED = True diff --git a/manifests/centurion_erp/components/service-monitor/Service-worker.yaml b/manifests/centurion_erp/components/service-monitor/Service-worker.yaml new file mode 100644 index 0000000..5ea3f71 --- /dev/null +++ b/manifests/centurion_erp/components/service-monitor/Service-worker.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: service-monitor + app.kubernetes.io/name: worker + app.kubernetes.io/part-of: centurion-erp + name: worker +spec: + selector: + app.kubernetes.io/name: worker + app.kubernetes.io/part-of: centurion-erp + ports: + - name: metrics + port: 8080 + targetPort: metrics diff --git a/manifests/centurion_erp/components/service-monitor/ServiceMonitor-api.yaml b/manifests/centurion_erp/components/service-monitor/ServiceMonitor-api.yaml new file mode 100644 index 0000000..3233eb6 --- /dev/null +++ b/manifests/centurion_erp/components/service-monitor/ServiceMonitor-api.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + labels: + app.kubernetes.io/component: service-monitor + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp + name: api +spec: + endpoints: + - interval: 30s + port: metrics + relabelings: + - targetLabel: "job" + replacement: "django" + selector: + matchLabels: + app.kubernetes.io/name: centurion + app.kubernetes.io/part-of: centurion-erp diff --git a/manifests/centurion_erp/components/service-monitor/ServiceMonitor-worker.yaml b/manifests/centurion_erp/components/service-monitor/ServiceMonitor-worker.yaml new file mode 100644 index 0000000..db35148 --- /dev/null +++ b/manifests/centurion_erp/components/service-monitor/ServiceMonitor-worker.yaml @@ -0,0 +1,21 @@ +--- +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + labels: + app.kubernetes.io/component: service-monitor + app.kubernetes.io/name: worker + app.kubernetes.io/part-of: centurion-erp + name: worker +spec: + endpoints: + - interval: 30s + port: metrics + relabelings: + - targetLabel: "job" + replacement: "django" + selector: + matchLabels: + app.kubernetes.io/component: service-monitor + app.kubernetes.io/name: worker + app.kubernetes.io/part-of: centurion-erp diff --git a/manifests/centurion_erp/components/service-monitor/kustomization.yaml b/manifests/centurion_erp/components/service-monitor/kustomization.yaml new file mode 100644 index 0000000..3fa06b6 --- /dev/null +++ b/manifests/centurion_erp/components/service-monitor/kustomization.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component + +configMapGenerator: + - name: configuration + behavior: merge + files: + - 99.enable-metrics.py + +resources: + - Service-worker.yaml + - ServiceMonitor-api.yaml + - ServiceMonitor-worker.yaml + +patches: + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: api + spec: + template: + spec: + containers: + - name: web + ports: + - containerPort: 8080 + name: metrics + target: + kind: Deployment + name: api + version: v1 + + - patch: |- + - op: add + path: /spec/template/spec/volumes/0/projected/sources/0/configMap/items/- + value: + key: 99.enable-metrics.py + path: 99.enable-metrics.py + target: + kind: Deployment + name: api + version: v1 + + - patch: |- + - op: add + path: /spec/template/spec/volumes/0/projected/sources/0/configMap/items/- + value: + key: 99.enable-metrics.py + path: 99.enable-metrics.py + target: + kind: Deployment + name: worker + version: v1 + + - patch: |- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: worker + spec: + template: + spec: + containers: + - name: worker + ports: + - containerPort: 8080 + name: metrics + target: + kind: Deployment + name: worker + version: v1 + + - patch: |- + apiVersion: v1 + kind: Service + metadata: + name: centurion + spec: + ports: + - name: metrics + port: 8080 + targetPort: metrics + target: + kind: Service + name: centurion + version: v1 diff --git a/manifests/centurion_erp/components/sso-keycloak/70.social_auth_keycloak.py b/manifests/centurion_erp/components/sso-keycloak/70.social_auth_keycloak.py new file mode 100644 index 0000000..999e9d8 --- /dev/null +++ b/manifests/centurion_erp/components/sso-keycloak/70.social_auth_keycloak.py @@ -0,0 +1,15 @@ +LOGIN_URL = '/sso/login/keycloak/' +LOGOUT_REDIRECT_URL = "/sso/login/keycloak/" + +SOCIAL_AUTH_KEYCLOAK_KEY = '' # Keycloak oidc id +SOCIAL_AUTH_KEYCLOAK_SECRET = '' # oidc secret key +SOCIAL_AUTH_KEYCLOAK_PUBLIC_KEY = '' # public key +SOCIAL_AUTH_KEYCLOAK_AUTHORIZATION_URL = 'https:///realms//protocol/openid-connect/auth' +SOCIAL_AUTH_KEYCLOAK_ACCESS_TOKEN_URL = 'https:///realms//protocol/openid-connect/token' + +SSO_ENABLED = True + +SSO_BACKENDS = ( + "social_core.backends.keycloak.KeycloakOAuth2", + # "social_core.backends.open_id_connect.OpenIdConnectAuth", +) diff --git a/manifests/centurion_erp/components/sso-keycloak/kustomization.yaml b/manifests/centurion_erp/components/sso-keycloak/kustomization.yaml new file mode 100644 index 0000000..a459a09 --- /dev/null +++ b/manifests/centurion_erp/components/sso-keycloak/kustomization.yaml @@ -0,0 +1,28 @@ +--- + +apiVersion: kustomize.config.k8s.io/v1alpha1 +kind: Component + +generatorOptions: + disableNameSuffixHash: true + +namespace: centurion + +secretGenerator: + - name: social-auth-keycloak + files: + - 70.social_auth_keycloak.py + +patches: + + - patch: |- + - op: add + path: /spec/template/spec/volumes/0/projected/sources/- + value: + secret: + name: social-auth-keycloak + + target: + kind: Deployment + name: api + version: v1