From b8a5b98ee991669ef16eed50b9fa221eecf27d87 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 30 Jun 2020 16:09:52 +0200
Subject: apps/coturn: migrate to new standalone pod role

---
 roles/apps/coturn/tasks/main.yml            | 17 +++++++++----
 roles/apps/coturn/templates/pod-spec.yml.j2 | 32 +++++++++++++++++++++++++
 roles/apps/coturn/templates/pod.yml.j2      | 37 -----------------------------
 3 files changed, 44 insertions(+), 42 deletions(-)
 create mode 100644 roles/apps/coturn/templates/pod-spec.yml.j2
 delete mode 100644 roles/apps/coturn/templates/pod.yml.j2

(limited to 'roles/apps')

diff --git a/roles/apps/coturn/tasks/main.yml b/roles/apps/coturn/tasks/main.yml
index 132e4847..9971b428 100644
--- a/roles/apps/coturn/tasks/main.yml
+++ b/roles/apps/coturn/tasks/main.yml
@@ -68,8 +68,15 @@
   include_role:
     name: nginx/vhost
 
-- name: generate pod manifests
-  template:
-    src: "pod.yml.j2"
-    dest: "/etc/kubernetes/manifests/coturn-{{ coturn_realm }}.yml"
-    mode: 0600
+- name: install pod manifest
+  vars:
+    kubernetes_standalone_pod:
+      name: "coturn-{{ coturn_realm }}"
+      spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
+      mode: 0600
+      config_hash_items:
+      - path: "{{ coturn_base_path }}/{{ coturn_realm }}/config/turnserver.conf"
+        properties:
+        - checksum
+  include_role:
+    name: kubernetes/standalone/pod
diff --git a/roles/apps/coturn/templates/pod-spec.yml.j2 b/roles/apps/coturn/templates/pod-spec.yml.j2
new file mode 100644
index 00000000..d157af37
--- /dev/null
+++ b/roles/apps/coturn/templates/pod-spec.yml.j2
@@ -0,0 +1,32 @@
+securityContext:
+  allowPrivilegeEscalation: false
+  runAsUser: {{ coturn_uid }}
+  runAsGroup: {{ coturn_gid }}
+hostNetwork: true
+containers:
+- name: coturn
+  image: "instrumentisto/coturn:{{ coturn_version }}"
+  args:
+    - --log-file=stdout
+  resources:
+    limits:
+      memory: "1Gi"
+  volumeMounts:
+  - name: config
+    mountPath: /etc/coturn/
+    readOnly: true
+  - name: run
+    mountPath: /var/run
+  - name: lib
+    mountPath: /var/lib/coturn
+volumes:
+- name: config
+  hostPath:
+    path: "{{ coturn_base_path }}/{{ coturn_realm }}/config/"
+    type: Directory
+- name: run
+  emptyDir:
+    medium: Memory
+- name: lib
+  emptyDir:
+    medium: Memory
diff --git a/roles/apps/coturn/templates/pod.yml.j2 b/roles/apps/coturn/templates/pod.yml.j2
deleted file mode 100644
index 7c127c13..00000000
--- a/roles/apps/coturn/templates/pod.yml.j2
+++ /dev/null
@@ -1,37 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "coturn-{{ coturn_realm }}"
-spec:
-  securityContext:
-    allowPrivilegeEscalation: false
-    runAsUser: {{ coturn_uid }}
-    runAsGroup: {{ coturn_gid }}
-  hostNetwork: true
-  containers:
-  - name: coturn
-    image: "instrumentisto/coturn:{{ coturn_version }}"
-    args:
-      - --log-file=stdout
-    resources:
-      limits:
-        memory: "1Gi"
-    volumeMounts:
-    - name: config
-      mountPath: /etc/coturn/
-      readOnly: true
-    - name: run
-      mountPath: /var/run
-    - name: lib
-      mountPath: /var/lib/coturn
-  volumes:
-  - name: config
-    hostPath:
-      path: "{{ coturn_base_path }}/{{ coturn_realm }}/config/"
-      type: Directory
-  - name: run
-    emptyDir:
-      medium: Memory
-  - name: lib
-    emptyDir:
-      medium: Memory
-- 
cgit v1.2.3


From 5962125e7b87b271662ad356751bc57583fa3b08 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 30 Jun 2020 16:14:34 +0200
Subject: apps/jitsi/meet: migrate to new standalone pod role

---
 roles/apps/jitsi/meet/tasks/main.yml            |  17 ++-
 roles/apps/jitsi/meet/templates/pod-spec.yml.j2 | 185 +++++++++++++++++++++++
 roles/apps/jitsi/meet/templates/pod.yml.j2      | 190 ------------------------
 3 files changed, 197 insertions(+), 195 deletions(-)
 create mode 100644 roles/apps/jitsi/meet/templates/pod-spec.yml.j2
 delete mode 100644 roles/apps/jitsi/meet/templates/pod.yml.j2

(limited to 'roles/apps')

diff --git a/roles/apps/jitsi/meet/tasks/main.yml b/roles/apps/jitsi/meet/tasks/main.yml
index 66644f8f..f5bcbd21 100644
--- a/roles/apps/jitsi/meet/tasks/main.yml
+++ b/roles/apps/jitsi/meet/tasks/main.yml
@@ -17,11 +17,18 @@
     dest: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/cont-init.sh"
     mode: 0755
 
-- name: generate pod manifests
-  template:
-    src: "pod.yml.j2"
-    dest: "/etc/kubernetes/manifests/jitsi-meet-{{ jitsi_meet_inst_name }}.yml"
-    mode: 0600
+- name: install pod manifest
+  vars:
+    kubernetes_standalone_pod:
+      name: "jitsi-meet-{{ jitsi_meet_inst_name }}"
+      spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
+      mode: 0600
+      config_hash_items:
+      - path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/cont-init.sh"
+        properties:
+        - checksum
+  include_role:
+    name: kubernetes/standalone/pod
 
 ## TODO: https://github.com/jitsi/jitsi-meet/blob/master/doc/turn.md
 
diff --git a/roles/apps/jitsi/meet/templates/pod-spec.yml.j2 b/roles/apps/jitsi/meet/templates/pod-spec.yml.j2
new file mode 100644
index 00000000..7461658f
--- /dev/null
+++ b/roles/apps/jitsi/meet/templates/pod-spec.yml.j2
@@ -0,0 +1,185 @@
+initContainers:
+- name: prepare-config
+  image: busybox
+  workingDir: /config
+  command:
+    - sh
+    - -c
+    - mkdir -p jicofo prosody web jvb
+  volumeMounts:
+  - name: config
+    mountPath: /config
+containers:
+- name: jicofo
+  image: "jitsi/jicofo:{{ jitsi_meet_version }}"
+  resources:
+    requests:
+      memory: "1Gi"
+    limits:
+      memory: "4Gi"
+  volumeMounts:
+  - name: config
+    subPath: jicofo
+    mountPath: /config
+  env:
+  - name: XMPP_SERVER
+    value: 127.0.0.1
+  - name: XMPP_DOMAIN
+    value: meet.jitsi
+  - name: XMPP_AUTH_DOMAIN
+    value: auth.meet.jitsi
+  - name: XMPP_INTERNAL_MUC_DOMAIN
+    value: internal-muc.meet.jitsi
+
+  - name: JICOFO_COMPONENT_SECRET
+    value: "{{ jitsi_meet_secrets.jicofo_component_secret }}"
+  - name: JICOFO_AUTH_USER
+    value: focus
+  - name: JICOFO_AUTH_PASSWORD
+    value: "{{ jitsi_meet_secrets.jicofo_auth_password }}"
+
+  - name: JVB_BREWERY_MUC
+    value: jvbbrewery
+
+  - name: TZ
+    value: {{ jitsi_meet_timezone }}
+
+- name: prosody
+  image: "jitsi/prosody:{{ jitsi_meet_version }}"
+  resources:
+    requests:
+      memory: "128Mi"
+    limits:
+      memory: "512Mi"
+  volumeMounts:
+  - name: scripts
+    subPath: prosody/cont-init.sh
+    mountPath: /etc/cont-init.d/99-k8s
+  - name: config
+    subPath: prosody
+    mountPath: /config
+  env:
+  - name: XMPP_DOMAIN
+    value: meet.jitsi
+  - name: XMPP_AUTH_DOMAIN
+    value: auth.meet.jitsi
+  - name: XMPP_MUC_DOMAIN
+    value: muc.meet.jitsi
+  - name: XMPP_INTERNAL_MUC_DOMAIN
+    value: internal-muc.meet.jitsi
+
+  - name: JICOFO_COMPONENT_SECRET
+    value: "{{ jitsi_meet_secrets.jicofo_component_secret }}"
+  - name: JICOFO_AUTH_USER
+    value: focus
+  - name: JICOFO_AUTH_PASSWORD
+    value: "{{ jitsi_meet_secrets.jicofo_auth_password }}"
+
+  - name: JVB_AUTH_USER
+    value: jvb
+  - name: JVB_AUTH_PASSWORD
+    value: "{{ jitsi_meet_secrets.jvb_auth_password }}"
+  - name: JVB_TCP_HARVESTER_DISABLED
+    value: "true"
+
+  - name: TZ
+    value: {{ jitsi_meet_timezone }}
+
+- name: web
+  image: "jitsi/web:{{ jitsi_meet_version }}"
+  resources:
+    requests:
+      memory: "256Mi"
+    limits:
+      memory: "1Gi"
+  ports:
+  - protocol: TCP
+    containerPort: 80
+    hostPort: {{ jitsi_meet_http_port }}
+    hostIP: 127.0.0.1
+  volumeMounts:
+  - name: config
+    subPath: web
+    mountPath: /config
+  env:
+  - name: DISABLE_HTTPS
+    value: "1"
+  - name: ENABLE_HTTP_REDIRECT
+    value: "0"
+
+  - name: XMPP_SERVER
+    value: 127.0.0.1
+  - name: XMPP_DOMAIN
+    value: meet.jitsi
+  - name: XMPP_AUTH_DOMAIN
+    value: auth.meet.jitsi
+  - name: XMPP_INTERNAL_MUC_DOMAIN
+    value: internal-muc.meet.jitsi
+  - name: XMPP_BOSH_URL_BASE
+    value: http://127.0.0.1:5280
+  - name: XMPP_MUC_DOMAIN
+    value: muc.meet.jitsi
+
+  - name: JICOFO_AUTH_USER
+    value: focus
+
+  - name: JVB_TCP_HARVESTER_DISABLED
+    value: "true"
+
+  - name: TZ
+    value: {{ jitsi_meet_timezone }}
+
+- name: jvb
+  image: "jitsi/jvb:{{ jitsi_meet_version }}"
+  resources:
+    requests:
+      memory: "1Gi"
+    limits:
+      memory: "4Gi"
+  ports:
+  - protocol: UDP
+    containerPort: {{ jitsi_meet_jvb_port }}
+    hostPort: {{ jitsi_meet_jvb_port }}
+    hostIP: "{{ external_ip | default(ansible_default_ipv4.address) }}"
+  volumeMounts:
+  - name: config
+    subPath: jvb
+    mountPath: /config
+  env:
+  - name: XMPP_SERVER
+    value: 127.0.0.1
+  - name: XMPP_DOMAIN
+    value: meet.jitsi
+  - name: XMPP_AUTH_DOMAIN
+    value: auth.meet.jitsi
+  - name: XMPP_INTERNAL_MUC_DOMAIN
+    value: internal-muc.meet.jitsi
+
+  - name: JICOFO_AUTH_USER
+    value: focus
+  - name: JICOFO_AUTH_PASSWORD
+    value: "{{ jitsi_meet_secrets.jicofo_auth_password }}"
+
+  - name: JVB_AUTH_USER
+    value: jvb
+  - name: JVB_AUTH_PASSWORD
+    value: "{{ jitsi_meet_secrets.jvb_auth_password }}"
+  - name: JVB_BREWERY_MUC
+    value: jvbbrewery
+  - name: JVB_PORT
+    value: "{{ jitsi_meet_jvb_port }}"
+  - name: JVB_TCP_HARVESTER_DISABLED
+    value: "true"
+  - name: DOCKER_HOST_ADDRESS
+    value: "{{ external_ip | default(ansible_default_ipv4.address) }}"
+
+  - name: TZ
+    value: {{ jitsi_meet_timezone }}
+
+volumes:
+- name: scripts
+  hostPath:
+    path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts"
+- name: config
+  emptyDir:
+    medium: Memory
diff --git a/roles/apps/jitsi/meet/templates/pod.yml.j2 b/roles/apps/jitsi/meet/templates/pod.yml.j2
deleted file mode 100644
index 1504211a..00000000
--- a/roles/apps/jitsi/meet/templates/pod.yml.j2
+++ /dev/null
@@ -1,190 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "jitsi-meet-{{ jitsi_meet_inst_name }}"
-spec:
-  initContainers:
-  - name: prepare-config
-    image: busybox
-    workingDir: /config
-    command:
-      - sh
-      - -c
-      - mkdir -p jicofo prosody web jvb
-    volumeMounts:
-    - name: config
-      mountPath: /config
-  containers:
-  - name: jicofo
-    image: "jitsi/jicofo:{{ jitsi_meet_version }}"
-    resources:
-      requests:
-        memory: "1Gi"
-      limits:
-        memory: "4Gi"
-    volumeMounts:
-    - name: config
-      subPath: jicofo
-      mountPath: /config
-    env:
-    - name: XMPP_SERVER
-      value: 127.0.0.1
-    - name: XMPP_DOMAIN
-      value: meet.jitsi
-    - name: XMPP_AUTH_DOMAIN
-      value: auth.meet.jitsi
-    - name: XMPP_INTERNAL_MUC_DOMAIN
-      value: internal-muc.meet.jitsi
-
-    - name: JICOFO_COMPONENT_SECRET
-      value: "{{ jitsi_meet_secrets.jicofo_component_secret }}"
-    - name: JICOFO_AUTH_USER
-      value: focus
-    - name: JICOFO_AUTH_PASSWORD
-      value: "{{ jitsi_meet_secrets.jicofo_auth_password }}"
-
-    - name: JVB_BREWERY_MUC
-      value: jvbbrewery
-
-    - name: TZ
-      value: {{ jitsi_meet_timezone }}
-
-  - name: prosody
-    image: "jitsi/prosody:{{ jitsi_meet_version }}"
-    resources:
-      requests:
-        memory: "128Mi"
-      limits:
-        memory: "512Mi"
-    volumeMounts:
-    - name: scripts
-      subPath: prosody/cont-init.sh
-      mountPath: /etc/cont-init.d/99-k8s
-    - name: config
-      subPath: prosody
-      mountPath: /config
-    env:
-    - name: XMPP_DOMAIN
-      value: meet.jitsi
-    - name: XMPP_AUTH_DOMAIN
-      value: auth.meet.jitsi
-    - name: XMPP_MUC_DOMAIN
-      value: muc.meet.jitsi
-    - name: XMPP_INTERNAL_MUC_DOMAIN
-      value: internal-muc.meet.jitsi
-
-    - name: JICOFO_COMPONENT_SECRET
-      value: "{{ jitsi_meet_secrets.jicofo_component_secret }}"
-    - name: JICOFO_AUTH_USER
-      value: focus
-    - name: JICOFO_AUTH_PASSWORD
-      value: "{{ jitsi_meet_secrets.jicofo_auth_password }}"
-
-    - name: JVB_AUTH_USER
-      value: jvb
-    - name: JVB_AUTH_PASSWORD
-      value: "{{ jitsi_meet_secrets.jvb_auth_password }}"
-    - name: JVB_TCP_HARVESTER_DISABLED
-      value: "true"
-
-    - name: TZ
-      value: {{ jitsi_meet_timezone }}
-
-  - name: web
-    image: "jitsi/web:{{ jitsi_meet_version }}"
-    resources:
-      requests:
-        memory: "256Mi"
-      limits:
-        memory: "1Gi"
-    ports:
-    - protocol: TCP
-      containerPort: 80
-      hostPort: {{ jitsi_meet_http_port }}
-      hostIP: 127.0.0.1
-    volumeMounts:
-    - name: config
-      subPath: web
-      mountPath: /config
-    env:
-    - name: DISABLE_HTTPS
-      value: "1"
-    - name: ENABLE_HTTP_REDIRECT
-      value: "0"
-
-    - name: XMPP_SERVER
-      value: 127.0.0.1
-    - name: XMPP_DOMAIN
-      value: meet.jitsi
-    - name: XMPP_AUTH_DOMAIN
-      value: auth.meet.jitsi
-    - name: XMPP_INTERNAL_MUC_DOMAIN
-      value: internal-muc.meet.jitsi
-    - name: XMPP_BOSH_URL_BASE
-      value: http://127.0.0.1:5280
-    - name: XMPP_MUC_DOMAIN
-      value: muc.meet.jitsi
-
-    - name: JICOFO_AUTH_USER
-      value: focus
-
-    - name: JVB_TCP_HARVESTER_DISABLED
-      value: "true"
-
-    - name: TZ
-      value: {{ jitsi_meet_timezone }}
-
-  - name: jvb
-    image: "jitsi/jvb:{{ jitsi_meet_version }}"
-    resources:
-      requests:
-        memory: "1Gi"
-      limits:
-        memory: "4Gi"
-    ports:
-    - protocol: UDP
-      containerPort: {{ jitsi_meet_jvb_port }}
-      hostPort: {{ jitsi_meet_jvb_port }}
-      hostIP: "{{ external_ip | default(ansible_default_ipv4.address) }}"
-    volumeMounts:
-    - name: config
-      subPath: jvb
-      mountPath: /config
-    env:
-    - name: XMPP_SERVER
-      value: 127.0.0.1
-    - name: XMPP_DOMAIN
-      value: meet.jitsi
-    - name: XMPP_AUTH_DOMAIN
-      value: auth.meet.jitsi
-    - name: XMPP_INTERNAL_MUC_DOMAIN
-      value: internal-muc.meet.jitsi
-
-    - name: JICOFO_AUTH_USER
-      value: focus
-    - name: JICOFO_AUTH_PASSWORD
-      value: "{{ jitsi_meet_secrets.jicofo_auth_password }}"
-
-    - name: JVB_AUTH_USER
-      value: jvb
-    - name: JVB_AUTH_PASSWORD
-      value: "{{ jitsi_meet_secrets.jvb_auth_password }}"
-    - name: JVB_BREWERY_MUC
-      value: jvbbrewery
-    - name: JVB_PORT
-      value: "{{ jitsi_meet_jvb_port }}"
-    - name: JVB_TCP_HARVESTER_DISABLED
-      value: "true"
-    - name: DOCKER_HOST_ADDRESS
-      value: "{{ external_ip | default(ansible_default_ipv4.address) }}"
-
-    - name: TZ
-      value: {{ jitsi_meet_timezone }}
-
-  volumes:
-  - name: scripts
-    hostPath:
-      path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts"
-  - name: config
-    emptyDir:
-      medium: Memory
-- 
cgit v1.2.3


From db5874224893ea999af8558c1d5ead7f0d7223b0 Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 30 Jun 2020 16:23:20 +0200
Subject: apps/collabora/code: migrate to new standalone pod role

---
 roles/apps/collabora/code/tasks/main.yml           | 23 ++++++++++++-----
 .../apps/collabora/code/templates/pod-spec.yml.j2  | 25 ++++++++++++++++++
 roles/apps/collabora/code/templates/pod.yml.j2     | 30 ----------------------
 roles/kubernetes/standalone/pod/tasks/main.yml     |  9 ++++---
 4 files changed, 46 insertions(+), 41 deletions(-)
 create mode 100644 roles/apps/collabora/code/templates/pod-spec.yml.j2
 delete mode 100644 roles/apps/collabora/code/templates/pod.yml.j2

(limited to 'roles/apps')

diff --git a/roles/apps/collabora/code/tasks/main.yml b/roles/apps/collabora/code/tasks/main.yml
index 57bdfa34..6b41bf5a 100644
--- a/roles/apps/collabora/code/tasks/main.yml
+++ b/roles/apps/collabora/code/tasks/main.yml
@@ -21,19 +21,26 @@
   when: "'custom_image' in item.value"
   include_tasks: custom-image.yml
 
-- name: generate pod manifests
+- name: install pod manifest
   loop: "{{ collabora_code_instances | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
-  template:
-    src: "pod.yml.j2"
-    dest: "/etc/kubernetes/manifests/collabora-code-{{ item.key }}.yml"
-    mode: 0600
+  vars:
+    kubernetes_standalone_pod:
+      name: "collabora-code-{{ item.key }}"
+      spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
+      mode: 0600
+      config_hash_items:
+      - path: "{{ collabora_code_base_path }}/{{ item.key }}/config/loolwsd.xml"
+        properties:
+        - checksum
+  include_role:
+    name: kubernetes/standalone/pod
 
 - name: configure nginx vhost
   loop: "{{ collabora_code_instances | dict2items }}"
-  include_role:
-    name: nginx/vhost
+  loop_control:
+    label: "{{ item.key }}"
   vars:
     nginx_vhost:
       name: "collabora-code-{{ item.key }}"
@@ -41,3 +48,5 @@
       acme: true
       hostnames:
       - "{{ item.value.hostname }}"
+  include_role:
+    name: nginx/vhost
diff --git a/roles/apps/collabora/code/templates/pod-spec.yml.j2 b/roles/apps/collabora/code/templates/pod-spec.yml.j2
new file mode 100644
index 00000000..04d2d25a
--- /dev/null
+++ b/roles/apps/collabora/code/templates/pod-spec.yml.j2
@@ -0,0 +1,25 @@
+containers:
+- name: collabora-code
+  image: "collabora/code{% if 'custom_image' in item.value %}/{{ item.key }}{% endif %}:{{ item.value.version }}"
+  resources:
+    limits:
+      memory: "4Gi"
+  env:
+  - name: "DONT_GEN_SSL_CERT"
+    value: "1"
+  - name: "extra_params"
+    value: "--o:ssl.enable=false --o:ssl.termination=true"
+  volumeMounts:
+  - name: config
+    mountPath: /etc/loolwsd/loolwsd.xml
+    subPath: loolwsd.xml
+    readOnly: true
+  ports:
+  - containerPort: 9980
+    hostPort: {{ item.value.port }}
+    hostIP: 127.0.0.1
+volumes:
+- name: config
+  hostPath:
+    path: "{{ collabora_code_base_path }}/{{ item.key }}/config/"
+    type: Directory
diff --git a/roles/apps/collabora/code/templates/pod.yml.j2 b/roles/apps/collabora/code/templates/pod.yml.j2
deleted file mode 100644
index 53fb4c0d..00000000
--- a/roles/apps/collabora/code/templates/pod.yml.j2
+++ /dev/null
@@ -1,30 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "collabora-code-{{ item.key }}"
-spec:
-  containers:
-  - name: collabora-code
-    image: "collabora/code{% if 'custom_image' in item.value %}/{{ item.key }}{% endif %}:{{ item.value.version }}"
-    resources:
-      limits:
-        memory: "4Gi"
-    env:
-    - name: "DONT_GEN_SSL_CERT"
-      value: "1"
-    - name: "extra_params"
-      value: "--o:ssl.enable=false --o:ssl.termination=true"
-    volumeMounts:
-    - name: config
-      mountPath: /etc/loolwsd/loolwsd.xml
-      subPath: loolwsd.xml
-      readOnly: true
-    ports:
-    - containerPort: 9980
-      hostPort: {{ item.value.port }}
-      hostIP: 127.0.0.1
-  volumes:
-  - name: config
-    hostPath:
-      path: "{{ collabora_code_base_path }}/{{ item.key }}/config/"
-      type: Directory
diff --git a/roles/kubernetes/standalone/pod/tasks/main.yml b/roles/kubernetes/standalone/pod/tasks/main.yml
index 73048a81..7f87cf3f 100644
--- a/roles/kubernetes/standalone/pod/tasks/main.yml
+++ b/roles/kubernetes/standalone/pod/tasks/main.yml
@@ -10,9 +10,10 @@
   - name: gather stats for config-hash items
     loop: "{{ kubernetes_standalone_pod.config_hash_items }}"
     loop_control:
-      label: "{{ item.path }} ({{ item.properties | sort | join(', ') }})"
+      loop_var: config_hash_item
+      label: "{{ config_hash_item.path }} ({{ config_hash_item.properties | sort | join(', ') }})"
     stat:
-      path: "{{ item.path }}"
+      path: "{{ config_hash_item.path }}"
       get_checksum: yes
       checksum_algorithm: sha256
     register: config_hash_items_stat
@@ -25,8 +26,8 @@
     copy:
       content: |
         {% for result in config_hash_items_stat.results %}
-        {{ result.item.path }}:
-        {%   for property in (result.item.properties | sort) %}
+        {{ result.config_hash_item.path }}:
+        {%   for property in (result.config_hash_item.properties | sort) %}
           {{ property }}: {{ result.stat[property] }}
         {%   endfor %}
         {% endfor %}
-- 
cgit v1.2.3


From c633dbb33d1eec0dd8f4284456e0d574fb836eae Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 30 Jun 2020 16:30:57 +0200
Subject: apps/etherpad-lite: migrate to new standalone pod role

---
 roles/apps/etherpad-lite/tasks/main.yml            | 23 +++++----
 .../templates/pod-spec-with-mariadb.yml.j2         | 49 ++++++++++++++++++++
 .../templates/pod-with-mariadb.yml.j2              | 54 ----------------------
 3 files changed, 63 insertions(+), 63 deletions(-)
 create mode 100644 roles/apps/etherpad-lite/templates/pod-spec-with-mariadb.yml.j2
 delete mode 100644 roles/apps/etherpad-lite/templates/pod-with-mariadb.yml.j2

(limited to 'roles/apps')

diff --git a/roles/apps/etherpad-lite/tasks/main.yml b/roles/apps/etherpad-lite/tasks/main.yml
index 0beeb1e1..416ab7ff 100644
--- a/roles/apps/etherpad-lite/tasks/main.yml
+++ b/roles/apps/etherpad-lite/tasks/main.yml
@@ -92,24 +92,29 @@
     owner: "{{ etherpad_lite_app_uid }}"
     group: "{{ etherpad_lite_app_gid }}"
 
-
-- name: generate pod manifests
+- name: install pod manifest
   loop: "{{ etherpad_lite_instances | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
-  template:
-    src: "pod-with-{{ item.value.database.type }}.yml.j2"
-    dest: "/etc/kubernetes/manifests/etherpad-lite-{{ item.key }}.yml"
-    mode: 0600
-
+  vars:
+    kubernetes_standalone_pod:
+      name: "etherpad-lite-{{ item.key }}"
+      spec: "{{ lookup('template', 'pod-spec-with-{{ item.value.database.type }}.yml.j2') }}"
+      mode: 0600
+      config_hash_items:
+      - path: "{{ etherpad_lite_base_path }}/{{ item.key }}/config/settings.json"
+        properties:
+        - checksum
+  include_role:
+    name: kubernetes/standalone/pod
 
 - name: configure nginx vhost
   loop: "{{ etherpad_lite_instances | dict2items }}"
-  include_role:
-    name: nginx/vhost
   vars:
     nginx_vhost:
       name: "etherpad-lite-{{ item.key }}"
       content: "{{ lookup('template', 'nginx-vhost.conf.j2') }}"
       acme: true
       hostnames: "{{ item.value.hostnames }}"
+  include_role:
+    name: nginx/vhost
diff --git a/roles/apps/etherpad-lite/templates/pod-spec-with-mariadb.yml.j2 b/roles/apps/etherpad-lite/templates/pod-spec-with-mariadb.yml.j2
new file mode 100644
index 00000000..f608d6ab
--- /dev/null
+++ b/roles/apps/etherpad-lite/templates/pod-spec-with-mariadb.yml.j2
@@ -0,0 +1,49 @@
+securityContext:
+  allowPrivilegeEscalation: false
+containers:
+- name: etherpad-lite
+  image: spreadspace/etherpad-lite:{{ item.value.version }}
+  # securityContext:
+  #   runAsUser: {{ etherpad_lite_app_uid }}
+  #   runAsGroup: {{ etherpad_lite_app_gid }}
+  resources:
+    limits:
+      memory: "4Gi"
+  volumeMounts:
+  - name: config
+    mountPath: /opt/etherpad-lite/settings.json
+    subPath: settings.json
+    readOnly: true
+  ports:
+  - containerPort: 9001
+    hostPort: {{ item.value.port }}
+    hostIP: 127.0.0.1
+- name: database
+  image: "mariadb:{{ item.value.database.version }}"
+  securityContext:
+    runAsUser: {{ etherpad_lite_db_uid }}
+    runAsGroup: {{ etherpad_lite_db_gid }}
+  resources:
+    limits:
+      memory: "4Gi"
+  env:
+  - name: MYSQL_RANDOM_ROOT_PASSWORD
+    value: "true"
+  - name: MYSQL_DATABASE
+    value: etherpad-lite
+  - name: MYSQL_USER
+    value: etherpad-lite
+  - name: MYSQL_PASSWORD
+    value: "{{ item.value.database.password }}"
+  volumeMounts:
+  - name: database
+    mountPath: /var/lib/mysql
+volumes:
+- name: config
+  hostPath:
+    path: "{{ etherpad_lite_base_path }}/{{ item.key }}/config/"
+    type: Directory
+- name: database
+  hostPath:
+    path: "{{ etherpad_lite_base_path }}/{{ item.key }}/{{ item.value.database.type }}"
+    type: Directory
diff --git a/roles/apps/etherpad-lite/templates/pod-with-mariadb.yml.j2 b/roles/apps/etherpad-lite/templates/pod-with-mariadb.yml.j2
deleted file mode 100644
index 9391290f..00000000
--- a/roles/apps/etherpad-lite/templates/pod-with-mariadb.yml.j2
+++ /dev/null
@@ -1,54 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "etherpad-lite-{{ item.key }}"
-spec:
-  securityContext:
-    allowPrivilegeEscalation: false
-  containers:
-  - name: etherpad-lite
-    image: spreadspace/etherpad-lite:{{ item.value.version }}
-    # securityContext:
-    #   runAsUser: {{ etherpad_lite_app_uid }}
-    #   runAsGroup: {{ etherpad_lite_app_gid }}
-    resources:
-      limits:
-        memory: "4Gi"
-    volumeMounts:
-    - name: config
-      mountPath: /opt/etherpad-lite/settings.json
-      subPath: settings.json
-      readOnly: true
-    ports:
-    - containerPort: 9001
-      hostPort: {{ item.value.port }}
-      hostIP: 127.0.0.1
-  - name: database
-    image: "mariadb:{{ item.value.database.version }}"
-    securityContext:
-      runAsUser: {{ etherpad_lite_db_uid }}
-      runAsGroup: {{ etherpad_lite_db_gid }}
-    resources:
-      limits:
-        memory: "4Gi"
-    env:
-    - name: MYSQL_RANDOM_ROOT_PASSWORD
-      value: "true"
-    - name: MYSQL_DATABASE
-      value: etherpad-lite
-    - name: MYSQL_USER
-      value: etherpad-lite
-    - name: MYSQL_PASSWORD
-      value: "{{ item.value.database.password }}"
-    volumeMounts:
-    - name: database
-      mountPath: /var/lib/mysql
-  volumes:
-  - name: config
-    hostPath:
-      path: "{{ etherpad_lite_base_path }}/{{ item.key }}/config/"
-      type: Directory
-  - name: database
-    hostPath:
-      path: "{{ etherpad_lite_base_path }}/{{ item.key }}/{{ item.value.database.type }}"
-      type: Directory
-- 
cgit v1.2.3


From d88ec101103f5ad9cf4fa5c8acf7cd0c581eff8a Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 30 Jun 2020 16:39:23 +0200
Subject: apps/nextcloud: migrate to new standalone pod role

---
 roles/apps/nextcloud/tasks/main.yml                | 26 +++++--
 .../templates/pod-spec-with-mariadb.yml.j2         | 77 ++++++++++++++++++++
 .../nextcloud/templates/pod-with-mariadb.yml.j2    | 82 ----------------------
 3 files changed, 96 insertions(+), 89 deletions(-)
 create mode 100644 roles/apps/nextcloud/templates/pod-spec-with-mariadb.yml.j2
 delete mode 100644 roles/apps/nextcloud/templates/pod-with-mariadb.yml.j2

(limited to 'roles/apps')

diff --git a/roles/apps/nextcloud/tasks/main.yml b/roles/apps/nextcloud/tasks/main.yml
index b08ce2d0..d2ed558a 100644
--- a/roles/apps/nextcloud/tasks/main.yml
+++ b/roles/apps/nextcloud/tasks/main.yml
@@ -102,14 +102,24 @@
   when: "'custom_image' in item.value"
   include_tasks: custom-image.yml
 
-- name: generate pod manifests
+- name: install pod manifest
   loop: "{{ nextcloud_instances | dict2items }}"
   loop_control:
     label: "{{ item.key }}"
-  template:
-    src: "pod-with-{{ item.value.database.type }}.yml.j2"
-    dest: "/etc/kubernetes/manifests/nextcloud-{{ item.key }}.yml"
-    mode: 0600
+  vars:
+    kubernetes_standalone_pod:
+      name: "nextcloud-{{ item.key }}"
+      spec: "{{ lookup('template', 'pod-spec-with-{{ item.value.database.type }}.yml.j2') }}"
+      mode: 0600
+      config_hash_items:
+      - path: "{{ nextcloud_base_path }}/{{ item.key }}/config/apache-site.conf"
+        properties:
+        - checksum
+      - path: "{{ nextcloud_base_path }}/{{ item.key }}/config/ports.conf"
+        properties:
+        - checksum
+  include_role:
+    name: kubernetes/standalone/pod
 
 
 - name: install cron trigger script
@@ -141,8 +151,8 @@
 
 - name: configure nginx vhost
   loop: "{{ nextcloud_instances | dict2items }}"
-  include_role:
-    name: nginx/vhost
+  loop_control:
+    label: "{{ item.key }}"
   vars:
     nginx_vhost:
       name: "nextcloud-{{ item.key }}"
@@ -156,6 +166,8 @@
         replacement: "https://$host/"
       - redirect: "http://$host:8080/"
         replacement: "https://$host/"
+  include_role:
+    name: nginx/vhost
 
 
 - name: install management scripts
diff --git a/roles/apps/nextcloud/templates/pod-spec-with-mariadb.yml.j2 b/roles/apps/nextcloud/templates/pod-spec-with-mariadb.yml.j2
new file mode 100644
index 00000000..b587cad3
--- /dev/null
+++ b/roles/apps/nextcloud/templates/pod-spec-with-mariadb.yml.j2
@@ -0,0 +1,77 @@
+securityContext:
+  allowPrivilegeEscalation: false
+containers:
+- name: nextcloud
+  image: "nextcloud{% if 'custom_image' in item.value %}/{{ item.key }}{% endif %}:{{ item.value.version }}"
+  securityContext:
+    runAsUser: {{ nextcloud_app_uid }}
+    runAsGroup: {{ nextcloud_app_gid }}
+  resources:
+    limits:
+      memory: "4Gi"
+{% if 'new' in item.value and item.value.new %}
+  env:
+  - name: NEXTCLOUD_TRUSTED_DOMAINS
+    value: "{{ item.value.hostnames | join(' ') }}"
+  - name: MYSQL_HOST
+    value: 127.0.0.1
+  - name: MYSQL_DATABASE
+    value: nextcloud
+  - name: MYSQL_USER
+    value: nextcloud
+  - name: MYSQL_PASSWORD
+    value: "{{ item.value.database.password }}"
+{% endif %}
+  volumeMounts:
+  - name: nextcloud
+    mountPath: /var/www/html
+  - name: config
+    mountPath: /etc/apache2/sites-available/000-default.conf
+    subPath: apache-site.conf
+    readOnly: true
+  - name: config
+    mountPath: /etc/apache2/ports.conf
+    subPath: ports.conf
+    readOnly: true
+  ports:
+  - containerPort: 8080
+    hostPort: {{ item.value.port }}
+    hostIP: 127.0.0.1
+- name: database
+  image: "mariadb:{{ item.value.database.version }}"
+  args:
+  - --transaction-isolation=READ-COMMITTED
+  - --binlog-format=ROW
+  securityContext:
+    runAsUser: {{ nextcloud_db_uid }}
+    runAsGroup: {{ nextcloud_db_gid }}
+  resources:
+    limits:
+      memory: "2Gi"
+{% if 'new' in item.value and item.value.new %}
+  env:
+  - name: MYSQL_RANDOM_ROOT_PASSWORD
+    value: "true"
+  - name: MYSQL_DATABASE
+    value: nextcloud
+  - name: MYSQL_USER
+    value: nextcloud
+  - name: MYSQL_PASSWORD
+    value: "{{ item.value.database.password }}"
+{% endif %}
+  volumeMounts:
+  - name: database
+    mountPath: /var/lib/mysql
+volumes:
+- name: config
+  hostPath:
+    path: "{{ nextcloud_base_path }}/{{ item.key }}/config/"
+    type: Directory
+- name: nextcloud
+  hostPath:
+    path: "{{ nextcloud_base_path }}/{{ item.key }}/nextcloud"
+    type: Directory
+- name: database
+  hostPath:
+    path: "{{ nextcloud_base_path }}/{{ item.key }}/{{ item.value.database.type }}"
+    type: Directory
diff --git a/roles/apps/nextcloud/templates/pod-with-mariadb.yml.j2 b/roles/apps/nextcloud/templates/pod-with-mariadb.yml.j2
deleted file mode 100644
index 20752490..00000000
--- a/roles/apps/nextcloud/templates/pod-with-mariadb.yml.j2
+++ /dev/null
@@ -1,82 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: "nextcloud-{{ item.key }}"
-spec:
-  securityContext:
-    allowPrivilegeEscalation: false
-  containers:
-  - name: nextcloud
-    image: "nextcloud{% if 'custom_image' in item.value %}/{{ item.key }}{% endif %}:{{ item.value.version }}"
-    securityContext:
-      runAsUser: {{ nextcloud_app_uid }}
-      runAsGroup: {{ nextcloud_app_gid }}
-    resources:
-      limits:
-        memory: "4Gi"
-{% if 'new' in item.value and item.value.new %}
-    env:
-    - name: NEXTCLOUD_TRUSTED_DOMAINS
-      value: "{{ item.value.hostnames | join(' ') }}"
-    - name: MYSQL_HOST
-      value: 127.0.0.1
-    - name: MYSQL_DATABASE
-      value: nextcloud
-    - name: MYSQL_USER
-      value: nextcloud
-    - name: MYSQL_PASSWORD
-      value: "{{ item.value.database.password }}"
-{% endif %}
-    volumeMounts:
-    - name: nextcloud
-      mountPath: /var/www/html
-    - name: config
-      mountPath: /etc/apache2/sites-available/000-default.conf
-      subPath: apache-site.conf
-      readOnly: true
-    - name: config
-      mountPath: /etc/apache2/ports.conf
-      subPath: ports.conf
-      readOnly: true
-    ports:
-    - containerPort: 8080
-      hostPort: {{ item.value.port }}
-      hostIP: 127.0.0.1
-  - name: database
-    image: "mariadb:{{ item.value.database.version }}"
-    args:
-    - --transaction-isolation=READ-COMMITTED
-    - --binlog-format=ROW
-    securityContext:
-      runAsUser: {{ nextcloud_db_uid }}
-      runAsGroup: {{ nextcloud_db_gid }}
-    resources:
-      limits:
-        memory: "2Gi"
-{% if 'new' in item.value and item.value.new %}
-    env:
-    - name: MYSQL_RANDOM_ROOT_PASSWORD
-      value: "true"
-    - name: MYSQL_DATABASE
-      value: nextcloud
-    - name: MYSQL_USER
-      value: nextcloud
-    - name: MYSQL_PASSWORD
-      value: "{{ item.value.database.password }}"
-{% endif %}
-    volumeMounts:
-    - name: database
-      mountPath: /var/lib/mysql
-  volumes:
-  - name: config
-    hostPath:
-      path: "{{ nextcloud_base_path }}/{{ item.key }}/config/"
-      type: Directory
-  - name: nextcloud
-    hostPath:
-      path: "{{ nextcloud_base_path }}/{{ item.key }}/nextcloud"
-      type: Directory
-  - name: database
-    hostPath:
-      path: "{{ nextcloud_base_path }}/{{ item.key }}/{{ item.value.database.type }}"
-      type: Directory
-- 
cgit v1.2.3


From 6025dcf6f3dd7df02284dd6b3a37dd186879196c Mon Sep 17 00:00:00 2001
From: Christian Pointner <equinox@spreadspace.org>
Date: Tue, 30 Jun 2020 21:46:04 +0200
Subject: fix pod manifest permissions

---
 roles/apps/collabora/code/tasks/main.yml          | 2 +-
 roles/apps/coturn/tasks/main.yml                  | 2 +-
 roles/apps/etherpad-lite/tasks/main.yml           | 2 +-
 roles/apps/jitsi/meet/tasks/main.yml              | 2 +-
 roles/apps/nextcloud/tasks/main.yml               | 2 +-
 roles/kubernetes/standalone/pod/defaults/main.yml | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'roles/apps')

diff --git a/roles/apps/collabora/code/tasks/main.yml b/roles/apps/collabora/code/tasks/main.yml
index 6b41bf5a..74f3240a 100644
--- a/roles/apps/collabora/code/tasks/main.yml
+++ b/roles/apps/collabora/code/tasks/main.yml
@@ -29,7 +29,7 @@
     kubernetes_standalone_pod:
       name: "collabora-code-{{ item.key }}"
       spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
-      mode: 0600
+      mode: "0600"
       config_hash_items:
       - path: "{{ collabora_code_base_path }}/{{ item.key }}/config/loolwsd.xml"
         properties:
diff --git a/roles/apps/coturn/tasks/main.yml b/roles/apps/coturn/tasks/main.yml
index 9971b428..176be664 100644
--- a/roles/apps/coturn/tasks/main.yml
+++ b/roles/apps/coturn/tasks/main.yml
@@ -73,7 +73,7 @@
     kubernetes_standalone_pod:
       name: "coturn-{{ coturn_realm }}"
       spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
-      mode: 0600
+      mode: "0600"
       config_hash_items:
       - path: "{{ coturn_base_path }}/{{ coturn_realm }}/config/turnserver.conf"
         properties:
diff --git a/roles/apps/etherpad-lite/tasks/main.yml b/roles/apps/etherpad-lite/tasks/main.yml
index 416ab7ff..105b89d9 100644
--- a/roles/apps/etherpad-lite/tasks/main.yml
+++ b/roles/apps/etherpad-lite/tasks/main.yml
@@ -100,7 +100,7 @@
     kubernetes_standalone_pod:
       name: "etherpad-lite-{{ item.key }}"
       spec: "{{ lookup('template', 'pod-spec-with-{{ item.value.database.type }}.yml.j2') }}"
-      mode: 0600
+      mode: "0600"
       config_hash_items:
       - path: "{{ etherpad_lite_base_path }}/{{ item.key }}/config/settings.json"
         properties:
diff --git a/roles/apps/jitsi/meet/tasks/main.yml b/roles/apps/jitsi/meet/tasks/main.yml
index f5bcbd21..16e05ced 100644
--- a/roles/apps/jitsi/meet/tasks/main.yml
+++ b/roles/apps/jitsi/meet/tasks/main.yml
@@ -22,7 +22,7 @@
     kubernetes_standalone_pod:
       name: "jitsi-meet-{{ jitsi_meet_inst_name }}"
       spec: "{{ lookup('template', 'pod-spec.yml.j2') }}"
-      mode: 0600
+      mode: "0600"
       config_hash_items:
       - path: "{{ jitsi_meet_base_path }}/{{ jitsi_meet_inst_name }}/scripts/prosody/cont-init.sh"
         properties:
diff --git a/roles/apps/nextcloud/tasks/main.yml b/roles/apps/nextcloud/tasks/main.yml
index d2ed558a..325fa15d 100644
--- a/roles/apps/nextcloud/tasks/main.yml
+++ b/roles/apps/nextcloud/tasks/main.yml
@@ -110,7 +110,7 @@
     kubernetes_standalone_pod:
       name: "nextcloud-{{ item.key }}"
       spec: "{{ lookup('template', 'pod-spec-with-{{ item.value.database.type }}.yml.j2') }}"
-      mode: 0600
+      mode: "0600"
       config_hash_items:
       - path: "{{ nextcloud_base_path }}/{{ item.key }}/config/apache-site.conf"
         properties:
diff --git a/roles/kubernetes/standalone/pod/defaults/main.yml b/roles/kubernetes/standalone/pod/defaults/main.yml
index c20d37cf..2eae33a3 100644
--- a/roles/kubernetes/standalone/pod/defaults/main.yml
+++ b/roles/kubernetes/standalone/pod/defaults/main.yml
@@ -13,7 +13,7 @@
 #       - /bin/bash
 #       - -c
 #       - "sleep inf"
-#   mode: 0600
+#   mode: "0600"
 #   config_hash_items:
 #   - path: /path/to/configfile
 #     properties:
-- 
cgit v1.2.3