trips-cluster.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: frontend
  labels:
    name: frontend
---
apiVersion: v1
kind: Namespace
metadata:
  name: backend
  labels:
    name: backend
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-kv
  namespace: backend
spec:
  provider: azure
  secretObjects:
    - secretName: sql
      type: Opaque
      data:
        - objectName: sql-username
          key: username
        - objectName: sql-password
          key: password
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "true"
    userAssignedIdentityID: 14222f08-8910-4a4a-9eba-78bf6f3b47b6
    keyvaultName: kv-tripcluster-dev
    cloudName: ""
    objects: |
      array:
        - |
          objectName: sql-username
          objectType: secret
        - |
          objectName: sql-password
          objectType: secret
    tenantId: c0414387-ee8a-411f-b21e-8d7fce2af971
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: poi
  namespace: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: poi
  template:
    metadata:
      labels:
        app: poi
    spec:
      nodeSelector:
        "kubernetes.io/os": linux
      containers:
        - name: poi
          image: registryntt1010.azurecr.io/poi:kmazurek_1.0
          volumeMounts:
            - name: secrets-store01-inline
              mountPath: "/mnt/secrets-store"
              readOnly: true
          env:
            - name: SQL_USER
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: username
            - name: SQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: password
            - name: SQL_SERVER
              value: sqlserverntt1010.database.windows.net
            - name: SQL_DBNAME
              value: mydrivingDB
            - name: ASPNETCORE_ENVIRONMENT
              value: Development
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 256Mi
          ports:
            - containerPort: 80
              name: redis
      volumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: azure-kv
---
apiVersion: v1
kind: Service
metadata:
  name: poi-service
  namespace: backend
spec:
  ports:
    - port: 80
  selector:
    app: poi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: trips
  namespace: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: trips
  template:
    metadata:
      labels:
        app: trips
    spec:
      nodeSelector:
        "kubernetes.io/os": linux
      containers:
        - name: trips
          image: registryntt1010.azurecr.io/trips:kmazurek_1.0
          volumeMounts:
            - name: secrets-store01-inline
              mountPath: "/mnt/secrets-store"
              readOnly: true
          env:
            - name: SQL_USER
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: username
            - name: SQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: password
            - name: SQL_SERVER
              value: sqlserverntt1010.database.windows.net
            - name: SQL_DBNAME
              value: mydrivingDB
            - name: DEBUG_LOGGING
              value: "true"
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 256Mi
          ports:
            - containerPort: 80
              name: redis
      volumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: azure-kv
---
apiVersion: v1
kind: Service
metadata:
  name: trips-service
  namespace: backend
spec:
  ports:
    - port: 80
  selector:
    app: trips
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: userprofile
  namespace: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: userprofile
  template:
    metadata:
      labels:
        app: userprofile
    spec:
      nodeSelector:
        "kubernetes.io/os": linux
      containers:
        - name: userprofile
          image: registryntt1010.azurecr.io/userprofile:dominic_1.0
          volumeMounts:
            - name: secrets-store01-inline
              mountPath: "/mnt/secrets-store"
              readOnly: true
          env:
            - name: SQL_USER
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: username
            - name: SQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: password
            - name: SQL_SERVER
              value: sqlserverntt1010.database.windows.net
            - name: SQL_DBNAME
              value: mydrivingDB
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 256Mi
          ports:
            - containerPort: 80
              name: redis
      volumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: azure-kv
---
apiVersion: v1
kind: Service
metadata:
  name: userprofile-service
  namespace: backend
spec:
  ports:
    - port: 80
  selector:
    app: userprofile
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: user-java
  namespace: backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: user-java
  template:
    metadata:
      labels:
        app: user-java
    spec:
      nodeSelector:
        "kubernetes.io/os": linux
      containers:
        - name: user-java
          image: registryntt1010.azurecr.io/user-java:dominic_1.0
          volumeMounts:
            - name: secrets-store01-inline
              mountPath: "/mnt/secrets-store"
              readOnly: true
          env:
            - name: SQL_USER
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: username
            - name: SQL_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sql
                  key: password
            - name: SQL_SERVER
              value: sqlserverntt1010.database.windows.net
            - name: SQL_DBNAME
              value: mydrivingDB
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 256Mi
          ports:
            - containerPort: 80
              name: redis
      volumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: azure-kv
---
apiVersion: v1
kind: Service
metadata:
  name: user-java-service
  namespace: backend
spec:
  ports:
    - port: 80
  selector:
    app: user-java
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    test: tripviewer
  name: tripviewer
  namespace: frontend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tripviewer
  template:
    metadata:
      labels:
        app: tripviewer
    spec:
      nodeSelector:
        "kubernetes.io/os": linux
      containers:
        - name: tripviewer
          image: registryntt1010.azurecr.io/tripviewer:kmazurek_1.0
          env:
            - name: TRIPS_API_ENDPOINT
              value: http://trips-service.backend:80
            - name: USERPROFILE_API_ENDPOINT
              value: http://userprofile-service.backend:80
          resources:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              cpu: 250m
              memory: 256Mi
          ports:
            - containerPort: 80
              name: redis
---
apiVersion: v1
kind: Service
metadata:
  name: tripviewer-service
  namespace: frontend
spec:
  ports:
    - port: 80
  selector:
    app: tripviewer
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: insurance-deployment
  labels:
    deploy: insurance
spec:
  replicas: 2
  selector:
    matchLabels:
      app: insurance
  template:
    metadata:
      labels:
        app: insurance
    spec:
      containers:
        - image: registryntt1010.azurecr.io/insurance:1.0
          imagePullPolicy: Always
          name: insurance
          ports:
            - containerPort: 8081
              name: http
              protocol: TCP
          resources:
            requests:
              memory: "128Mi"
              cpu: "100m"
            limits:
              memory: "512Mi"
              cpu: "250m"
---
apiVersion: v1
kind: Service
metadata:
  name: insurance
spec:
  type: ClusterIP
  selector:
    app: insurance
  ports:
    - protocol: TCP
      name: insurance-http
      port: 80
      targetPort: 8081
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: web-dev-backend
  namespace: backend
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: web-dev-backend-rolebinding
  namespace: backend
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: web-dev-backend
subjects:
  - kind: Group
    namespace: backend
    name: e3c335eb-a16b-42d4-bee9-966d1c3840cf
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: web-dev-frontend
  namespace: frontend
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: web-dev-frontend-rolebinding
  namespace: frontend
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: web-dev-frontend
subjects:
  - kind: Group
    namespace: frontend
    name: e3c335eb-a16b-42d4-bee9-966d1c3840cf
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: api-dev-backend
  namespace: backend
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: api-dev-backend-rolebinding
  namespace: backend
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: api-dev-backend
subjects:
  - kind: Group
    namespace: backend
    name: 4700bbe2-84fd-402e-93e6-4482eb0d9337
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: api-dev-frontend
  namespace: frontend
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: api-dev-frontend-rolebinding
  namespace: frontend
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: api-dev-frontend
subjects:
  - kind: Group
    namespace: frontend
    name: 4700bbe2-84fd-402e-93e6-4482eb0d9337
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: trips-ingress-backend
  namespace: backend
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
spec:
  rules:
    - http:
        paths:
          - path: /api/poi
            pathType: Prefix
            backend:
              service:
                name: poi-service
                port:
                  number: 80
          - path: /api/trips
            pathType: Prefix
            backend:
              service:
                name: trips-service
                port:
                  number: 80
          - path: /api/user
            pathType: Prefix
            backend:
              service:
                name: userprofile-service
                port:
                  number: 80
          - path: /api/user-java
            pathType: Prefix
            backend:
              service:
                name: user-java-service
                port:
                  number: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: trips-ingress-frontend
  namespace: frontend
  annotations:
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/ssl-redirect: "false"

spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: tripviewer-service
                port:
                  number: 80
---
kind: ConfigMap
apiVersion: v1
data:
  schema-version:
    #string.used by agent to parse config. supported versions are {v1}. Configs with other schema versions will be rejected by the agent.
    v1
  config-version:
    #string.used by customer to keep track of this config file's version in their source control/repository (max allowed 10 chars, other chars will be truncated)
    ver1
  log-data-collection-settings: |-
    # Log data collection settings
    # Any errors related to config map settings can be found in the KubeMonAgentEvents table in the Log Analytics workspace that the cluster is sending data to.

    [log_collection_settings]
       [log_collection_settings.stdout]
          # In the absense of this configmap, default value for enabled is true
          enabled = true
          # exclude_namespaces setting holds good only if enabled is set to true
          # kube-system log collection is disabled by default in the absence of 'log_collection_settings.stdout' setting. If you want to enable kube-system, remove it from the following setting.
          # If you want to continue to disable kube-system log collection keep this namespace in the following setting and add any other namespace you want to disable log collection to the array.
          # In the absense of this configmap, default value for exclude_namespaces = ["kube-system"]
          exclude_namespaces = ["kube-system"]

       [log_collection_settings.stderr]
          # Default value for enabled is true
          enabled = true
          # exclude_namespaces setting holds good only if enabled is set to true
          # kube-system log collection is disabled by default in the absence of 'log_collection_settings.stderr' setting. If you want to enable kube-system, remove it from the following setting.
          # If you want to continue to disable kube-system log collection keep this namespace in the following setting and add any other namespace you want to disable log collection to the array.
          # In the absense of this cofigmap, default value for exclude_namespaces = ["kube-system"]
          exclude_namespaces = ["kube-system"]

       [log_collection_settings.env_var]
          # In the absense of this configmap, default value for enabled is true
          enabled = true
       [log_collection_settings.enrich_container_logs]
          # In the absense of this configmap, default value for enrich_container_logs is false
          enabled = false
          # When this is enabled (enabled = true), every container log entry (both stdout & stderr) will be enriched with container Name & container Image
       [log_collection_settings.collect_all_kube_events]
          # In the absense of this configmap, default value for collect_all_kube_events is false
          # When the setting is set to false, only the kube events with !normal event type will be collected
          enabled = false
          # When this is enabled (enabled = true), all kube events including normal events will be collected

  prometheus-data-collection-settings: |-
    # Custom Prometheus metrics data collection settings
    [prometheus_data_collection_settings.cluster]
        # Cluster level scrape endpoint(s). These metrics will be scraped from agent's Replicaset (singleton)
        # Any errors related to prometheus scraping can be found in the KubeMonAgentEvents table in the Log Analytics workspace that the cluster is sending data to.

        #Interval specifying how often to scrape for metrics. This is duration of time and can be specified for supporting settings by combining an integer value and time unit as a string value. Valid time units are ns, us (or µs), ms, s, m, h.
        interval = "1m"

        ## Uncomment the following settings with valid string arrays for prometheus scraping
        #fieldpass = ["metric_to_pass1", "metric_to_pass12"]

        #fielddrop = ["metric_to_drop"]

        # An array of urls to scrape metrics from.
        # urls = ["http://myurl:9101/metrics"]

        # An array of Kubernetes services to scrape metrics from.
        # kubernetes_services = ["http://my-service-dns.my-namespace:9102/metrics"]

        # When monitor_kubernetes_pods = true, replicaset will scrape Kubernetes pods for the following prometheus annotations:
        # - prometheus.io/scrape: Enable scraping for this pod
        # - prometheus.io/scheme: If the metrics endpoint is secured then you will need to
        #     set this to `https` & most likely set the tls config.
        # - prometheus.io/path: If the metrics path is not /metrics, define it with this annotation.
        # - prometheus.io/port: If port is not 9102 use this annotation
        monitor_kubernetes_pods = false

        ## Restricts Kubernetes monitoring to namespaces for pods that have annotations set and are scraped using the monitor_kubernetes_pods setting.
        ## This will take effect when monitor_kubernetes_pods is set to true
        ##   ex: monitor_kubernetes_pods_namespaces = ["default1", "default2", "default3"]
        # monitor_kubernetes_pods_namespaces = ["default1"]

        ## Label selector to target pods which have the specified label
        ## This will take effect when monitor_kubernetes_pods is set to true
        ## Reference the docs at https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
        # kubernetes_label_selector = "env=dev,app=nginx"

        ## Field selector to target pods which have the specified field
        ## This will take effect when monitor_kubernetes_pods is set to true
        ## Reference the docs at https://kubernetes.io/docs/concepts/overview/working-with-objects/field-selectors/
        ## eg. To scrape pods on a specific node
        # kubernetes_field_selector = "spec.nodeName=$HOSTNAME"

    [prometheus_data_collection_settings.node]
        # Node level scrape endpoint(s). These metrics will be scraped from agent's DaemonSet running in every node in the cluster
        # Any errors related to prometheus scraping can be found in the KubeMonAgentEvents table in the Log Analytics workspace that the cluster is sending data to.

        #Interval specifying how often to scrape for metrics. This is duration of time and can be specified for supporting settings by combining an integer value and time unit as a string value. Valid time units are ns, us (or µs), ms, s, m, h.
        interval = "1m"

        ## Uncomment the following settings with valid string arrays for prometheus scraping

        # An array of urls to scrape metrics from. $NODE_IP (all upper case) will substitute of running Node's IP address
        # urls = ["http://$NODE_IP:9103/metrics"]

        #fieldpass = ["metric_to_pass1", "metric_to_pass12"]

        #fielddrop = ["metric_to_drop"]

  metric_collection_settings: |-
    # Metrics collection settings for metrics sent to Log Analytics and MDM
    [metric_collection_settings.collect_kube_system_pv_metrics]
      # In the absense of this configmap, default value for collect_kube_system_pv_metrics is false
      # When the setting is set to false, only the persistent volume metrics outside the kube-system namespace will be collected
      enabled = false
      # When this is enabled (enabled = true), persistent volume metrics including those in the kube-system namespace will be collected

  alertable-metrics-configuration-settings: |-
    # Alertable metrics configuration settings for container resource utilization
    [alertable_metrics_configuration_settings.container_resource_utilization_thresholds]
        # The threshold(Type Float) will be rounded off to 2 decimal points
        # Threshold for container cpu, metric will be sent only when cpu utilization exceeds or becomes equal to the following percentage
        container_cpu_threshold_percentage = 95.0
        # Threshold for container memoryRss, metric will be sent only when memory rss exceeds or becomes equal to the following percentage
        container_memory_rss_threshold_percentage = 95.0
        # Threshold for container memoryWorkingSet, metric will be sent only when memory working set exceeds or becomes equal to the following percentage
        container_memory_working_set_threshold_percentage = 95.0

    # Alertable metrics configuration settings for persistent volume utilization
    [alertable_metrics_configuration_settings.pv_utilization_thresholds]
        # Threshold for persistent volume usage bytes, metric will be sent only when persistent volume utilization exceeds or becomes equal to the following percentage
        pv_usage_threshold_percentage = 60.0

    # Alertable metrics configuration settings for completed jobs count
    [alertable_metrics_configuration_settings.job_completion_threshold]
        # Threshold for completed job count , metric will be sent only for those jobs which were completed earlier than the following threshold
        job_completion_threshold_time_minutes = 360
  integrations: |-
    [integrations.azure_network_policy_manager]
        collect_basic_metrics = false
        collect_advanced_metrics = false

  # Doc - https://github.com/microsoft/Docker-Provider/blob/ci_prod/Documentation/AgentSettings/ReadMe.md
  agent-settings: |-
    # prometheus scrape fluent bit settings for high scale
    # buffer size should be greater than or equal to chunk size else we set it to chunk size.
    [agent_settings.prometheus_fbit_settings]
      tcp_listener_chunk_size = 10
      tcp_listener_buffer_size = 10
      tcp_listener_mem_buf_limit = 200
    # The following settings are "undocumented", we don't recommend uncommenting them unless directed by Microsoft.
    # They increase the maximum stdout/stderr log collection rate but will also cause higher cpu/memory usage.
    # [agent_settings.fbit_config]
    #   log_flush_interval_secs = "1"                 # default value is 15
    #   tail_mem_buf_limit_megabytes = "10"           # default value is 10
    #   tail_buf_chunksize_megabytes = "1"            # default value is 32kb (comment out this line for default)
    #   tail_buf_maxsize_megabytes = "1"              # defautl value is 32kb (comment out this line for default)

metadata:
  name: container-azm-ms-agentconfig
  namespace: kube-system
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: block-network-policy
  namespace: backend
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: frontend
        - podSelector:
            matchLabels:
              test: tripviewer
      ports:
        - protocol: TCP
          port: 80
  egress: []