feat(ring-mqtt): add pvc and init-container to persist token and config

[tyriis]

• add backup

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[tyriis-automation]

--- kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt HelmRelease: home-automation/ring-mqtt

+++ kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt HelmRelease: home-automation/ring-mqtt

@@ -51,27 +51,44 @@

               liveness:
                 enabled: true
               readiness:
                 enabled: true
               startup:
                 enabled: true
+        initContainers:
+          copy-config:
+            command:
+            - sh
+            - -c
+            - |
+              if [ ! -f /data/config.json ]; then
+                cp /config/config.json /data/config.json
+              fi
+              if [ ! -f /data/ring-state.json ]; then
+                cp /config/ring-state.json /data/ring-state.json
+              fi
+            image:
+              repository: busybox
+              tag: 1.33.1
     persistence:
       credentials:
-        globalMounts:
-        - path: /data/config.json
-          readOnly: true
-          subPath: config.json
-        - path: /data/ring-state.json
-          readOnly: true
-          subPath: ring-state.json
+        advancedMounts:
+          ring-mqtt:
+            copy-config:
+            - path: /config/config.json
+              readOnly: true
+              subPath: config.json
+            - path: /config/ring-state.json
+              readOnly: true
+              subPath: ring-state.json
         name: ring-mqtt-config
         type: secret
       data:
+        existingClaim: ring-mqtt-data
         globalMounts:
         - path: /data
-        type: emptyDir
     service:
       app:
         controller: ring-mqtt
         ports:
           http:
             port: 8554
--- kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt PersistentVolumeClaim: home-automation/ring-mqtt-data

+++ kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt PersistentVolumeClaim: home-automation/ring-mqtt-data

@@ -0,0 +1,22 @@

+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/name: ring-mqtt
+    kustomize.toolkit.fluxcd.io/name: ring-mqtt
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: ring-mqtt-data
+  namespace: home-automation
+spec:
+  accessModes:
+  - ReadWriteOnce
+  dataSourceRef:
+    apiGroup: volsync.backube
+    kind: ReplicationDestination
+    name: ring-mqtt-data
+  resources:
+    requests:
+      storage: 10Mi
+  storageClassName: ceph-block
+
--- kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt ReplicationSource: home-automation/ring-mqtt-data

+++ kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt ReplicationSource: home-automation/ring-mqtt-data

@@ -0,0 +1,33 @@

+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationSource
+metadata:
+  labels:
+    app.kubernetes.io/name: ring-mqtt
+    kustomize.toolkit.fluxcd.io/name: ring-mqtt
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+  name: ring-mqtt-data
+  namespace: home-automation
+spec:
+  restic:
+    accessModes:
+    - ReadWriteOnce
+    cacheAccessModes:
+    - ReadWriteOnce
+    cacheCapacity: 10Mi
+    cacheStorageClassName: ceph-block
+    copyMethod: Snapshot
+    moverSecurityContext:
+      fsGroup: 1000
+      runAsGroup: 1000
+      runAsUser: 1000
+    pruneIntervalDays: 1
+    repository: ring-mqtt-volsync
+    retain:
+      hourly: 24
+    storageClassName: ceph-block
+    volumeSnapshotClassName: csi-ceph-blockpool
+  sourcePVC: ring-mqtt-data
+  trigger:
+    schedule: 15 * * * *
+
--- kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt ReplicationDestination: home-automation/ring-mqtt-data

+++ kubernetes/talos-flux/apps/home-automation/ring-mqtt/app Kustomization: flux-system/ring-mqtt ReplicationDestination: home-automation/ring-mqtt-data

@@ -0,0 +1,34 @@

+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  labels:
+    app.kubernetes.io/name: ring-mqtt
+    kustomize.toolkit.fluxcd.io/name: ring-mqtt
+    kustomize.toolkit.fluxcd.io/namespace: flux-system
+    kustomize.toolkit.fluxcd.io/ssa: IfNotPresent
+  name: ring-mqtt-data
+  namespace: home-automation
+spec:
+  restic:
+    accessModes:
+    - ReadWriteOnce
+    cacheAccessModes:
+    - ReadWriteOnce
+    cacheCapacity: 10Mi
+    cacheStorageClassName: ceph-block
+    capacity: 10Mi
+    cleanupCachePVC: true
+    cleanupTempPVC: true
+    copyMethod: Snapshot
+    enableFileDeletion: true
+    moverSecurityContext:
+      fsGroup: 1000
+      runAsGroup: 1000
+      runAsUser: 1000
+    repository: ring-mqtt-volsync
+    storageClassName: ceph-block
+    volumeSnapshotClassName: csi-ceph-blockpool
+  trigger:
+    manual: restore-once
+

[tyriis-automation]

--- HelmRelease: home-automation/ring-mqtt Deployment: home-automation/ring-mqtt

+++ HelmRelease: home-automation/ring-mqtt Deployment: home-automation/ring-mqtt

@@ -31,12 +31,36 @@

       serviceAccountName: default
       automountServiceAccountToken: true
       hostIPC: false
       hostNetwork: false
       hostPID: false
       dnsPolicy: ClusterFirst
+      initContainers:
+      - command:
+        - sh
+        - -c
+        - |
+          if [ ! -f /data/config.json ]; then
+            cp /config/config.json /data/config.json
+          fi
+          if [ ! -f /data/ring-state.json ]; then
+            cp /config/ring-state.json /data/ring-state.json
+          fi
+        image: busybox:1.33.1
+        name: copy-config
+        volumeMounts:
+        - mountPath: /config/config.json
+          name: credentials
+          readOnly: true
+          subPath: config.json
+        - mountPath: /config/ring-state.json
+          name: credentials
+          readOnly: true
+          subPath: ring-state.json
+        - mountPath: /data
+          name: data
       containers:
       - env:
         - name: S6_READ_ONLY_ROOT
           value: 'true'
         - name: TZ
           value: Europe/Vienna
@@ -65,23 +89,16 @@

           initialDelaySeconds: 0
           periodSeconds: 10
           tcpSocket:
             port: 8554
           timeoutSeconds: 1
         volumeMounts:
-        - mountPath: /data/config.json
-          name: credentials
-          readOnly: true
-          subPath: config.json
-        - mountPath: /data/ring-state.json
-          name: credentials
-          readOnly: true
-          subPath: ring-state.json
         - mountPath: /data
           name: data
       volumes:
       - name: credentials
         secret:
           secretName: ring-mqtt-config
-      - emptyDir: {}
-        name: data
+      - name: data
+        persistentVolumeClaim:
+          claimName: ring-mqtt-data

[tyriis-automation]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ EDITORCONFIG	editorconfig-checker	6		0	0.02s
✅ REPOSITORY	gitleaks	yes		no	3.02s
✅ YAML	prettier	5		0	0.38s
✅ YAML	yamllint	6		0	0.37s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security