Configurazione iniziale:

master node
3 server con queste caratteristiche: 
 2 vcpu, 4gb ram 20gb HD Ubuntu 25.10 

Worker node
3 server con queste caratteristiche:
 2 vcpu, 4gb ram 50gb HD Ubuntu 25.10 
 
Load Balancer (HAproxy)
1 server con queste caratteristiche:
  1 vcpu, 1gb ram 10gb HD Ubuntu 25.10 
  indirizzo pubblico definito sul gatewa ruotato sul Balancer, porte aperte:
  80,443 per servizi applicativi
  10000,10002,10003,10004 per kubeedge
  
------------------------------------------------------------------------------------------------------------------------------  
Installazione:

Su ogni nodo master e worker

# 1. Aggiorna OS
sudo apt update && sudo apt -y upgrade   # Ubuntu/Debian
sudo apt install -y iputils-ping
sudo apt install -y telnetd telnet
sudo snap install -y kubectl --classic
sudo apt install -y iptables
sudo apt install -y iptables-persistent

# 2. Disabilita SWAP (necessario)
sudo swapoff -a
sudo sed -i.bak '/ swap / s/^\(.*\)$/#\1/g' /etc/fstab

# 3. Config kernel requisiti Kubernetes (es. bridge netfilter)
cat <<EOF | sudo tee /etc/sysctl.d/99-k8s.conf
net.bridge.bridge-nf-call-iptables  = 1
net.ipv4.ip_forward                 = 1
net.bridge.bridge-nf-call-ip6tables = 1
fs.inotify.max_user_watches         = 524288
EOF
sudo sysctl --system

# 4. Sincronizza orologio
sudo apt install -y chrony
sudo systemctl enable --now chrony

#installa yq
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
sudo chmod a+x /usr/local/bin/yq
# 5. Imposta hostname (es.)
#sudo hostnamectl set-hostname $1
------------------------------------------------------------------------------------------------------------------------------
Sul master 1
# 1. Installa RKE2 (script ufficial)
curl -sfL https://get.rke2.io | sh -
sudo systemctl enable rke2-server.service

# 2. Crea config (personalizza token e tls-san se serve)
sudo mkdir -p /etc/rancher/rke2
sudo tee /etc/rancher/rke2/config.yaml > /dev/null <<EOF

# RKE2 Server Configuration - First Master Node
write-kubeconfig-mode: "0644"

# CRITICAL: Add all possible API server access points to the certificate
tls-san:
  - "POC-Kube-Balancer" 
  - "10.20.1.100"
  - "POC-Master0"
  - "10.20.1.101"
  - "POC-Master1"
  - "10.20.1.102"
  - "POC-Master2"
  - "10.20.1.103"
  - "POC-Worker0"
  - "10.20.1.104" 
  - "POC-Worker1"
  - "10.20.1.105" 
  - "POC-Worker2"
  - "10.20.1.106" 
  

# Network configuration
#cluster-cidr: "10.42.64.0/18"
#service-cidr: "10.42.0.0/18"
#cluster-dns: "10.42.0.10"

# Security hardening
#profile: "cis-1.6"
selinux: true
secrets-encryption: true

# Node configuration
node-taint:
  - "CriticalAddonsOnly=true:NoExecute"  
  
ingress-controller: none  
  
EOF

# 3. Avvia RKE2 server
sudo systemctl start rke2-server

# Attendi che i pod kube-system siano up (sul master 1)

#installa kubectl
curl -LO https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl


mkdir /root/.kube
cp /etc/rancher/rke2/rke2.yaml /root/.kube/config
echo "MASTER TOKEN TO COPY"
cat /var/lib/rancher/rke2/server/node-token

sui master 2 e 3:
# 1. Installa RKE2 (script ufficial)
curl -sfL https://get.rke2.io | sh -
sudo systemctl enable rke2-server.service

# 2. Crea config (personalizza token e tls-san se serve)
sudo mkdir -p /etc/rancher/rke2
sudo tee /etc/rancher/rke2/config.yaml > /dev/null <<EOF

# RKE2 Server Configuration - Additional Master
server: https://POC-Master0:9345  # Direct connection for initial join
token: "K10b8b252de84e5aab8bc1d2a8e4aad3e329ee84d638892b8638de0260b7cb8212a::server:34b189ab7b91fc924500ba0b3608b80b"
write-kubeconfig-mode: "0644"

# Same TLS SANs as master-1 - consistency is crucial!
tls-san:
  - "POC-Kube-Balancer" 
  - "10.20.1.100"
  - "POC-Master0"
  - "10.20.1.101"
  - "POC-Master1"
  - "10.20.1.102"
  - "POC-Master2"
  - "10.20.1.103"
  - "POC-Worker0"
  - "10.20.1.104" 
  - "POC-Worker1"
  - "10.20.1.105" 
  - "POC-Worker2"
  - "10.20.1.106" 
  
# Identical network configuration
#cluster-cidr: "10.42.64.0/18"
#service-cidr: "10.42.0.0/18"
#cluster-dns: "10.42.0.10"

# Same backup and security settings
#profile: "cis-1.6"
selinux: true
secrets-encryption: true

# Node configuration
node-taint:
  - "CriticalAddonsOnly=true:NoExecute"
  
ingress-controller: none    
  
EOF

# 3. Avvia RKE2 server
sudo systemctl start rke2-server

curl -LO https://dl.k8s.io/release/v1.35.0/bin/linux/amd64/kubectl
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

mkdir /root/.kube
cp /etc/rancher/rke2/rke2.yaml /root/.kube/config


#installa helm
# scarica helm (esempio Linux AMD64)
curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh

# verifica
helm version

------------------------------------------------------------------------------------------------------------------------------
su ogni nodo worker:
sudo apt install open-iscsi
systemctl enable open-iscsi
systemctl enable iscsid
systemctl restart iscsid.service
# Install RKE2 agent
curl -sfL https://get.rke2.io | INSTALL_RKE2_TYPE="agent" sudo sh -

# Create configuration
sudo mkdir -p /etc/rancher/rke2

# Worker configuration - connects through the load balancer!
sudo tee /etc/rancher/rke2/config.yaml > /dev/null << EOF
# RKE2 Agent Configuration
server: https://POC-Kube-Balancer:9345  # Using the main load balancer!
token: "K10b8b252de84e5aab8bc1d2a8e4aad3e329ee84d638892b8638de0260b7cb8212a::server:34b189ab7b91fc924500ba0b3608b80b"

# Node labels for workload scheduling
node-label:
  - "node.kubernetes.io/worker=true"
  - "workload-type=general"

# Optional: Reserve resources for system stability
# kubelet-arg:
#   - "system-reserved=cpu=500m,memory=1Gi"
#   - "kube-reserved=cpu=500m,memory=1Gi"
EOF

# Start the worker
sudo systemctl enable rke2-agent.service
sudo systemctl start rke2-agent.service

# Check status
sudo systemctl status rke2-agent.service

------------------------------------------------------------------------------------------------------------------------------
sul Balancer:
sudo apt update && sudo apt install -y haproxy

sudo tee /etc/haproxy/haproxy.cfg > /dev/null <<'EOF'
global
  log /dev/log local0
  maxconn 20000
  tune.bufsize 16384
 # SSL configuration for future HTTPS endpoints
        ca-base /etc/ssl/certs
        crt-base /etc/ssl/private
        
        # Modern SSL configuration - only secure protocols
        ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
        ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
        ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        timeout connect 5000
        timeout client  50000
        timeout server  50000
        errorfile 400 /etc/haproxy/errors/400.http
        errorfile 403 /etc/haproxy/errors/403.http
        errorfile 408 /etc/haproxy/errors/408.http
        errorfile 500 /etc/haproxy/errors/500.http
        errorfile 502 /etc/haproxy/errors/502.http
        errorfile 503 /etc/haproxy/errors/503.http
        errorfile 504 /etc/haproxy/errors/504.http

frontend rke2_registration_frontend
    bind *:9345
    mode tcp
    option tcplog
    default_backend rke2_registration_backend

#---------------------------------------------------------------------
# RKE2 Supervisor/Registration Backend
# Round-robin between masters for node registration
#---------------------------------------------------------------------
backend rke2_registration_backend
    mode tcp
    balance roundrobin
    option tcp-check
    # Health check ensures we only send traffic to healthy masters
    server POC-Master0 POC-Master0:9345 check
    server POC-Master1 POC-Master1:9345 check
    server POC-Master2 POC-Master2:9345 check

#---------------------------------------------------------------------
# Kubernetes API Frontend
# This is where kubectl commands and apps connect
#---------------------------------------------------------------------
frontend k8s_api_frontend
    bind *:6443
    mode tcp
    option tcplog
    default_backend k8s_api_backend

#---------------------------------------------------------------------
# Kubernetes API Backend
# Distributes API requests across all masters
#---------------------------------------------------------------------
backend k8s_api_backend
    mode tcp
    balance roundrobin
    option tcp-check
    # TCP health checks on the API port
    server POC-Master0 POC-Master0:6443 check
    server POC-Master1 POC-Master1:6443 check
    server POC-Master2 POC-Master2:6443 check

#---------------------------------------------------------------------
# Statistics Page (Optional but useful for monitoring)
#---------------------------------------------------------------------
listen stats
    bind *:8080
    stats enable
    stats uri /stats
    stats refresh 30s
    stats show-node
    stats auth admin:admin  # Change this password!

#---------------------------------------------------------------------
# nginx ingress
# This is where kubectl commands and apps connect
#---------------------------------------------------------------------
frontend nginx_frontend_443
    bind *:443
    mode tcp
    option tcplog
    default_backend nginx_backend

frontend nginx_frontend_80
    bind *:80
    mode http
    http-response set-header Access-Control-Allow-Origin %[hdr(origin)]
    default_backend nginx_backend_http
#---------------------------------------------------------------------
# Kubernetes API Backend
# Distributes API requests across all masters
#---------------------------------------------------------------------
backend nginx_backend
    mode tcp
    balance roundrobin
    option tcp-check
    # TCP health checks on the API port
    server POC-Master0 POC-Master0:30864 check 
    server POC-Master1 POC-Master1:30864 check
    server POC-Master2 POC-Master2:30864 check

backend nginx_backend_http
    mode http
    balance roundrobin
    # TCP health checks on the API port
    server POC-Master0 POC-Master0:30864 check ssl verify none
    server POC-Master1 POC-Master1:30864 check ssl verify none
    server POC-Master2 POC-Master2:30864 check ssl verify none
EOF

sudo systemctl enable --now haproxy
------------------------------------------------------------------------------------------------------------------------------
Installazione componenti k8s



- **Rancher**  
helm repo add rancher-stable https://releases.rancher.com/server-charts/stable
kubectl create namespace cattle-system

helm install rancher rancher-stable/rancher \
  --namespace cattle-system \
  --set hostname=k8s.italiadatacenter.com \
  --set bootstrapPassword=admin


patch gateway add under listener:
  - allowedRoutes:
      namespaces:
        from: cattle-system
    hostname: k8s.italiadatacenter.com
    name: k8s-https
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: k8s-secret
      mode: Terminate
  - allowedRoutes:
      namespaces:
        from: cattle-system
    hostname: k8s.italiadatacenter.com
    name: k8s-http
    port: 80
    protocol: HTTP

creazione httproute:
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: rancher
  namespace: cattle-system
spec:
  hostnames:
  - k8s.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: rancher
      port: 80

 ------------------------------------------------------------------------------------------------------------------------------

- **CephCsi**  
cat <<EOF > csi-config-map.yaml
---
apiVersion: v1
kind: ConfigMap
data:
  config.json: |-
    [
      {
        "clusterID": "004ee854-86cc-4ddc-b7d6-75e4fe962296",
        "monitors": [
          "72.20.1.33:6789",
          "72.20.1.34:6789",
          "72.20.1.35:6789"
        ]
      }
    ]
metadata:
  name: ceph-csi-config
EOF
kubectl apply -f csi-config-map.yaml


 cat <<EOF > csi-kms-config-map.yaml
---
apiVersion: v1
kind: ConfigMap
data:
  config.json: |-
    {}
metadata:
  name: ceph-csi-encryption-kms-config
EOF
kubectl apply -f csi-kms-config-map.yaml


cat <<EOF > ceph-config-map.yaml
---
apiVersion: v1
kind: ConfigMap
data:
  ceph.conf: |
    [global]
    auth_cluster_required = cephx
    auth_service_required = cephx
    auth_client_required = cephx
  # keyring is a required key and its value should be empty
  keyring: |
metadata:
  name: ceph-config
EOF
kubectl apply -f ceph-config-map.yaml



cat <<EOF > csi-rbd-secret.yaml
---
apiVersion: v1
kind: Secret
metadata:
  name: csi-rbd-secret
  namespace: default
stringData:
  userID: kubernetes
  userKey: AQD2zo5pm8aZIRAAPzWS+dROeX7iJtv5EukfKA==
EOF






kubectl apply -f https://raw.githubusercontent.com/ceph/ceph-csi/master/deploy/rbd/kubernetes/csi-provisioner-rbac.yaml
kubectl apply -f https://raw.githubusercontent.com/ceph/ceph-csi/master/deploy/rbd/kubernetes/csi-nodeplugin-rbac.yaml

wget https://raw.githubusercontent.com/ceph/ceph-csi/master/deploy/rbd/kubernetes/csi-rbdplugin-provisioner.yaml
kubectl apply -f csi-rbdplugin-provisioner.yaml
wget https://raw.githubusercontent.com/ceph/ceph-csi/master/deploy/rbd/kubernetes/csi-rbdplugin.yaml
kubectl apply -f csi-rbdplugin.yaml

------- TEST-----

cat <<EOF > csi-rbd-sc.yaml
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
   name: csi-rbd-sc
provisioner: rbd.csi.ceph.com
parameters:
   clusterID: 004ee854-86cc-4ddc-b7d6-75e4fe962296
   pool: k8s-rbd
   imageFeatures: layering
   csi.storage.k8s.io/provisioner-secret-name: csi-rbd-secret
   csi.storage.k8s.io/provisioner-secret-namespace: default
   csi.storage.k8s.io/controller-expand-secret-name: csi-rbd-secret
   csi.storage.k8s.io/controller-expand-secret-namespace: default
   csi.storage.k8s.io/node-stage-secret-name: csi-rbd-secret
   csi.storage.k8s.io/node-stage-secret-namespace: default
reclaimPolicy: Delete
allowVolumeExpansion: true
mountOptions:
   - discard
EOF
kubectl apply -f csi-rbd-sc.yaml


cat <<EOF > raw-block-pvc.yaml
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: raw-block-pvc
spec:
  accessModes:
    - ReadWriteOnce
  volumeMode: Block
  resources:
    requests:
      storage: 1Gi
  storageClassName: csi-rbd-sc
EOF
kubectl apply -f raw-block-pvc.yaml
  ------------------------------------------------------------------------------------------------------------------------------

- **Gateway API** 
 # Install Gateway API CRDs 
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.1/standard-install.yaml

kubectl get crd | grep gateway

kubectl create namespace nginx-gateway

kubectl apply --server-side -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v2.4.1/deploy/crds.yaml
kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v2.4.1/deploy/nodeport/deploy.yaml

---- Gatway configuration ----
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: main-gateway
  namespace: nginx-gateway
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  gatewayClassName: nginx
  listeners:
  - allowedRoutes:
      namespaces:
        from: All
    hostname: poc1.italiadatacenter.com
    name: https
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: poc1-secret
      mode: Terminate
  - allowedRoutes:
      namespaces:
        from: All
    hostname: poc1.italiadatacenter.com
    name: http
    port: 80
    protocol: HTTP


----- Nodeport service ---
kubectl apply -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/instance: nginx-gateway
    app.kubernetes.io/managed-by: nginx-gateway-nginx
    app.kubernetes.io/name: main-gateway-nginx
    gateway.networking.k8s.io/gateway-name: main-gateway
  name: gateway-nginx-nodeport
  namespace: nginx-gateway
spec:
  ports:
  - name: port-80
    nodePort: 30864
    port: 80
    protocol: TCP
    targetPort: 80
  - name: port-443
    nodePort: 30874
    port: 443
    protocol: TCP
    targetPort: 443	
  selector:
    app.kubernetes.io/instance: nginx-gateway
    app.kubernetes.io/managed-by: nginx-gateway-nginx
    app.kubernetes.io/name: main-gateway-nginx
    gateway.networking.k8s.io/gateway-name: main-gateway
  sessionAffinity: None
  type: NodePort
EOF

----- httproute ---

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: demo-route
  namespace: demo-apps
spec:
  hostnames:
  - poc2.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: app-v1
      port: 80

--- work area

kubectl  edit  gateway main-gateway -n nginx-gateway

add

- allowedRoutes:
      namespaces:
        from: cattle-system
    hostname: k8s.italiadatacenter.com
    name: k8s-https
    port: 443
    protocol: HTTPS
    tls:
      certificateRefs:
      - group: ""
        kind: Secret
        name: k8s-secret
      mode: Terminate
  - allowedRoutes:
      namespaces:
        from: cattle-system
    hostname: k8s.italiadatacenter.com
    name: k8s-http
    port: 80
    protocol: HTTP



 ------------------------------------------------------------------------------------------------------------------------------ 

- **CertManager**  
kubectl create namespace cert-manager
helm repo add jetstack https://charts.jetstack.io
helm repo update

# Install versione consigliata
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --set installCRDs=true \
  --wait
# Verifica
kubectl -n cert-manager get pods

Crea cluster issuer per let’s Encrypt:
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    email: <insert a valid email-address>
    privateKeySecretRef:
      name: letsencrypt-production-key
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    - http01:
        gatewayHTTPRoute:
          parentRefs:
          - group: gateway.networking.k8s.io
            kind: Gateway
            name: main-gateway
            namespace: nginx-gateway
------------------------------------------------------------------------------------------------------------------------------

---

## Servizi DevOps

-- **db devops**

apiVersion: v1
kind: Secret
metadata:
  name: pg-app-user
  namespace: demo-apps
type: kubernetes.io/basic-auth
stringData:
  username: devops
  password: KAYQE1QA7uwUZ8uI
---
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-devops
  namespace: devops
spec:
  instances: 3
 
  storage:
    size: 1Gi
    storageClass: csi-rbdfs-sc
  
  walStorage:
    storageClass: csi-rbdfs-sc
    size: 1Gi	

  bootstrap:
    initdb:
      database: devops
      owner: admin
      secret:
        name: pg-app-user

  postgresql:
    parameters:
      max_connections: "300"
      shared_buffers: "1GB"

  resources:
    requests:
      cpu: "500m"
      memory: "1Gi"
    limits:
      cpu: "2"
      memory: "2Gi"




- **Gitea**  

kubectl cnpg psql pg-devops -n devops

CREATE DATABASE giteadb;
CREATE USER gitea WITH PASSWORD 'KAYQE1QA7uwUZ8uI';
GRANT ALL PRIVILEGES ON DATABASE giteadb TO gitea;
ALTER DATABASE giteadb OWNER TO gitea;

helm repo add gitea https://dl.gitea.io/charts/
helm repo update


kubectl create namespace gitea

cat <<EOF |cat >values.yaml -
replicaCount: 1

image:
  repository: gitea/gitea
  tag: 1.22.0
  pullPolicy: IfNotPresent

strategy:
  type: Recreate

service:
  http:
    type: ClusterIP
    port: 3000
  ssh:
    type: ClusterIP
    port: 22

redis-cluster:
  enabled: false

redis:
  enabled: false
  
ingress:
  enabled: false

persistence:
  enabled: true
  storageClass: csi-rbdfs-sc
  size: 10Gi

postgresql:
  enabled: false

postgresql-ha:
  enabled: false
  
gitea:
  admin:
    username: gitadmin
    password: KAYQE1QA7uwUZ8uI
    email: gitadmin@italiadatacenter.com

  config:
    database:
      DB_TYPE: postgres
      HOST: pg-devops-rw.devops.svc:5432
      NAME: giteadb
      USER: gitea
      PASSWD: KAYQE1QA7uwUZ8uI
      SSL_MODE: disable

    server:
      ROOT_URL: https://git.italiadatacenter.com/
      SSH_DOMAIN: git.italiadatacenter.com
      SSH_PORT: 22

    security:
      INSTALL_LOCK: true

EOF

helm upgrade --install gitea gitea-charts/gitea  --namespace gitea -f values.yaml


apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: gitea
  namespace: gitea
spec:
  hostnames:
  - git.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: gitea-http
      port: 3000

------------------------------------------------------------------------------------------------------------------------------

- **Harbor**  
#HARBOR
kubectl create namespace harbor

helm repo add harbor https://helm.goharbor.io
helm repo update

cat <<EOF | cat > harbor-cert.yaml -
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: harbor-tls
  namespace: harbor
spec:
  secretName: harbor-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  dnsNames:
  - harbor.italiadatacenter.com
  
EOF

kubectl apply -f harbor-cert.yaml




cat <<EOF | cat > harborvalues.yaml -
# -----------------------
# EXPOSURE
# -----------------------
expose:
  # Set how to expose the service. Set the type as "ingress", "clusterIP", "nodePort" or "loadBalancer"
  # and fill the information in the corresponding section
  type: clusterIP
externalURL: https://harbor.italiadatacenter.com

# -----------------------
# ADMIN
# -----------------------
harborAdminPassword: "KAYQE1QA7uwUZ8uI"

# -----------------------
# PERSISTENCE
# -----------------------
persistence:
  enabled: true
  persistentVolumeClaim:
    registry:
      storageClass: csi-rbdfs-sc
      size: 50Gi
    jobservice:
      storageClass: csi-rbdfs-sc
      size: 2Gi
    trivy:
      storageClass: csi-rbdfs-sc
      size: 2Gi

# -----------------------
# POSTGRESQL (EXTERNAL)
# -----------------------
database:
  type: external
  external:
    host: pg-devops-rw.devops.svc
    port: 5432
    username: harbor
    password: "KAYQE1QA7uwUZ8uI"
    database: registry
    sslmode: require

# -----------------------
# REDIS (EXTERNAL)
# -----------------------
redis:
  type: external
  external:
    addr: redis.redis.svc.cluster.local:6379
    password: "KAYQE1QA7uwUZ8uI"
    database: 0

# -----------------------
# DISABLE INTERNAL SERVICES
# -----------------------
postgresql:
  enabled: false

redisInternal:
  enabled: false

# -----------------------
# COMPONENTS
# -----------------------
trivy:
  enabled: true

metrics:
  enabled: false
EOF

kubectl cnpg psql pg-devops -n devops

CREATE DATABASE registry;
CREATE USER harbor WITH PASSWORD 'KAYQE1QA7uwUZ8uI';
GRANT ALL PRIVILEGES ON DATABASE registry TO harbor;
ALTER DATABASE registry OWNER TO harbor;
#test
kubectl run psql-test  --rm -it --image=postgres:16 -- psql  -h pg-prod-rw.database.svc  -U harbor
kubectl run redis-test --rm -it  --image=redis:7 -- redis-cli  -h redis.redis.svc.cluster.local  -a Japp0cam



helm install harbor harbor/harbor  -n harbor -f harborvalues.yaml



--- httproute & body setting nginx ----
kubectl apply -f - <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: harbor
  namespace: harbor
spec:
  hostnames:
  - harbor.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: harbor
      port: 80
---
apiVersion: gateway.nginx.org/v1alpha1
kind: ClientSettingsPolicy
metadata:
  name: gateway-client-settings
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: main-gateway
  body:
    maxSize: "0" 
EOF



TEST:
#push
docker login harbor.italiadatacenter.com
docker pull nginx:1.25
docker tag nginx:1.25 harbor.italiadatacenter.com/library/nginx:1.25
docker push harbor.italiadatacenter.com/library/nginx:1.25

#pull
docker rmi harbor.italiadatacenter.com/library/nginx:1.25
docker pull harbor.italiadatacenter.com/library/nginx:1.25

#pull da k8s

#STEP 1– Creare Robot Account in Harbor
#Harbor UI → Projects → (es. library o apps) → Robot Accounts
#Nome: k8s-pull
#Permessi:
#✔️ Repository → Pull


kubectl create secret docker-registry harbor-pull \
  -n default \
  --docker-server=harbor.italiadatacenter.com \
  --docker-username=robot$k8s-pull \
  --docker-password=ir0ELEJEFg804qljh2p32ALzIsMJepWt \
  --docker-email=harbor@italiadatacenter.com

#per namespace nuovi
kubectl patch serviceaccount default  -n default  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'

#applicare per i vecchi:
kubectl patch serviceaccount default  -n primo-dev  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'

#test
kubectl run test-nginx   --image=harbor.italiadatacenter.com/library/nginx:1.25   --restart=Never -n poc



kubectl -n primo-dev create secret docker-registry harbor-pull \
  --docker-server=harbor.italiadatacenter.com \
  --docker-username=robot\$primo+primo \
  --docker-password=agQLiKJ8K5qmBWhO1bHngzb9UorPLIw1 \
  --docker-email=harbor@italiadatacenter.com
  
kubectl patch serviceaccount default  -n primo-dev  -p '{"imagePullSecrets":[{"name":"harbor-pull"}]}'
  ------------------------------------------------------------------------------------------------------------------------------

- **Gitea Act Runner**  
Download act_runner binary
 mv act_runner-0.3.0-linux-amd64 act_runner
 chmod +x ./act_runner
 ./act_runner --version
./act_runner register

Git server: https.//git.italiadatacener.com
token: SiP2B1Wth0FwORkLrIX7WYhho78IVaW3ZppO9vrx
label: runner1:host

start:
nohup ./act_runner daemon &


Install node
sudo apt update
sudo apt upgrade -y
sudo apt install -y curl ca-certificates gnupg
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash -
sudo apt install -y nodejs

verifica
node -v
npm -v

Installa docker:
sudo apt update
sudo apt install ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

# Add the repository to Apt sources:
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF

sudo apt update

sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

  ------------------------------------------------------------------------------------------------------------------------------

- **Pipeline CICD**  
  ------------------------------------------------------------------------------------------------------------------------------

customize.sh
#!/bin/bash
# Usage: ./customize.sh dev|qa|prod
echo "tetst" $IMAGE_TAG_backend
ENV=$1
VALUES_FILE="env/$ENV/values.env"
PROPERTIES_FILE="properties.env"
YAML_DIR="kubernetes"

# Estrai l'hash completo del commit e crea una variabile temporanea per la sostituzione
TAG=$(git rev-parse HEAD)
TMP_TAG_FILE=$(mktemp)
echo "TAG=$TAG" > "$TMP_TAG_FILE"
cat ./imglist >> "$TMP_TAG_FILE"


if [ ! -f "$VALUES_FILE" ]; then
  echo "File $VALUES_FILE non trovato."
  exit 1
fi

if [ ! -f "$PROPERTIES_FILE" ]; then
  echo "File $PROPERTIES_FILE non trovato."
  exit 1
fi

# Trova tutti i file .yaml nella directory kubernetes e sottodirectory
find "$YAML_DIR" -type f -name "*.yaml" | while read YAML_FILE; do

  while IFS='=' read -r key value; do
    sed -i "s|<$key>|$value|g" "$YAML_FILE"
  done < "$VALUES_FILE"

  while IFS='=' read -r key value; do
    sed -i "s|<$key>|$value|g" "$YAML_FILE"
  done < "$PROPERTIES_FILE"

  # Sostituzione dinamica della chiave TAG
  while IFS='=' read -r key value; do
    sed -i "s|<$key>|$value|g" "$YAML_FILE"
  done < "$TMP_TAG_FILE"

  echo "Sostituzione completata per file $YAML_FILE ambiente $ENV."
  cat $YAML_FILE
done

rm -f "$TMP_TAG_FILE"
---
deploy.sh
#!/bin/bash
# Esegue kubectl apply per ogni sottodirectory di kubernetes separatamente

YAML_DIR="kubernetes"
# Trova tutte le sottodirectory (inclusa la principale) che contengono file .yaml
find "$YAML_DIR" -type d | while read DIR; do
  if ls "$DIR"/*.yaml 1> /dev/null 2>&1; then
    echo "Deploy delle risorse nella directory $DIR..."
    kubectl --kubeconfig=./kubeconfig apply -f "$DIR"
  fi
done

echo "Deploy completato di tutte le directory YAML."
---
build_container.sh:
#!/bin/bash
set -e
set -o pipefail

echo "progetto"  $1
REPO_NAME=$1
COMMIT_SHA=$(git rev-parse HEAD)
REGISTRY_URL=$2

for dir in containers/*/; do
  CONTAINER_NAME=$(basename "$dir")
  cp -R src/${CONTAINER_NAME}/. containers/${CONTAINER_NAME}/.
  ls -la $dir
  DOCKERFILE="$dir/dockerfile"
  IMAGE_TAG="${REGISTRY_URL}/${REPO_NAME}/${CONTAINER_NAME}:${COMMIT_SHA}"
  echo "IMAGE_TAG_${CONTAINER_NAME}=$IMAGE_TAG" >> ./imglist
  if [ -f "$DOCKERFILE" ]; then
    docker build -t "$IMAGE_TAG" -f "$DOCKERFILE" "$dir"
    docker push "$IMAGE_TAG"
    echo "Build e push completate: $IMAGE_TAG"
  else
    echo "Dockerfile non trovato in $dir"
  fi
done

----
kube-provisioning.sh
#!/usr/bin/env bash
###########################################################
#./kube-provisioning.sh dev cicd-user kubeconfig-dev.yaml
#arg1 = namespace
#arg2 = env  (dev|qa|prod)
###########################################################

set -euo pipefail

############################################
# CONFIG
############################################

NAMESPACE=${1:-dev}-$2
SERVICE_ACCOUNT="deployer"
KUBECONFIG_FILE=${NAMESPACE}.yaml

echo "Namespace: $NAMESPACE"
echo "ServiceAccount: $SERVICE_ACCOUNT"
echo "Output kubeconfig: $KUBECONFIG_FILE"

############################################
# CHECK REQUIREMENTS
############################################

if ! command -v kubectl >/dev/null 2>&1; then
  echo "kubectl not found"
  exit 1
fi

############################################
# CREATE NAMESPACE
############################################

kubectl get ns "$NAMESPACE" >/dev/null 2>&1 || kubectl create namespace "$NAMESPACE"

############################################
# CREATE SERVICE ACCOUNT
############################################

kubectl -n "$NAMESPACE" get sa "$SERVICE_ACCOUNT" >/dev/null 2>&1 || \
kubectl -n "$NAMESPACE" create serviceaccount "$SERVICE_ACCOUNT"

############################################
# CREATE SECRET FOR SERVICE ACCOUNT TOKEN (legacy, validità illimitata)
############################################

SECRET_NAME="${SERVICE_ACCOUNT}-token"
if ! kubectl -n "$NAMESPACE" get secret "$SECRET_NAME" >/dev/null 2>&1; then
  kubectl -n "$NAMESPACE" create secret generic "$SECRET_NAME" \
    --type='kubernetes.io/service-account-token' \
    --dry-run=client -o yaml > tmp-secret.yaml

  # Inserisci correttamente l'annotazione YAML
  yq eval ".metadata.annotations.\"kubernetes.io/service-account.name\" = \"$SERVICE_ACCOUNT\"" -i tmp-secret.yaml

  kubectl apply -f tmp-secret.yaml
  rm tmp-secret.yaml
fi
# Attendi che il token venga popolato nel secret
for i in {1..10}; do
  TOKEN=$(kubectl -n "$NAMESPACE" get secret "$SECRET_NAME" -o jsonpath='{.data.token}' 2>/dev/null | base64 --decode || true)
  if [[ -n "$TOKEN" ]]; then break; fi
  sleep 1
done

if [[ -z "$TOKEN" ]]; then
  echo "Errore: il token non è stato generato."
  exit 1
fi

############################################
# CREATE ROLE
############################################

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: namespace-deployer
  namespace: $NAMESPACE
rules:
- apiGroups: ["", "apps", "batch", "networking.k8s.io"]
  resources: ["*"]
  verbs: ["*"]
EOF

############################################
# CREATE ROLE BINDING
############################################

kubectl -n "$NAMESPACE" get rolebinding namespace-deployer-binding >/dev/null 2>&1 || \
kubectl create rolebinding namespace-deployer-binding \
  --role=namespace-deployer \
  --serviceaccount=${NAMESPACE}:${SERVICE_ACCOUNT} \
  -n "$NAMESPACE"

############################################
# GET CLUSTER INFO
############################################

CLUSTER_NAME=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
CLUSTER_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
CLUSTER_CA=$(kubectl config view --raw --minify -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')

############################################
# GENERATE KUBECONFIG
############################################

cat <<EOF > "$KUBECONFIG_FILE"
apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: ${CLUSTER_CA}
    server: ${CLUSTER_SERVER}
  name: ${CLUSTER_NAME}

contexts:
- context:
    cluster: ${CLUSTER_NAME}
    namespace: ${NAMESPACE}
    user: ${SERVICE_ACCOUNT}
  name: ${SERVICE_ACCOUNT}-${CLUSTER_NAME}

current-context: ${SERVICE_ACCOUNT}-${CLUSTER_NAME}

users:
- name: ${SERVICE_ACCOUNT}
  user:
    token: ${TOKEN}
EOF

echo
echo "Kubeconfig generated:"
echo "$KUBECONFIG_FILE"

echo
echo "Test command:"
echo "kubectl --kubeconfig=$KUBECONFIG_FILE get pods"

---

## Servizi Database

- **CloudNativePG**  
kubectl apply --server-side -f  https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/release-1.28/releases/cnpg-1.28.0.yaml--force-conflicts
curl -sSfL  https://github.com/cloudnative-pg/cloudnative-pg/raw/main/hack/install-cnpg-plugin.sh |  sudo sh -s -- -b /usr/local/bin


kubectl create namespace database


database.yaml:

---
apiVersion: v1
kind: Secret
metadata:
  name: pg-app-user
  namespace: demo-apps
type: kubernetes.io/basic-auth
stringData:
  username: admin
  password: admin
---
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: pg-test
  namespace: demo-apps
spec:
  instances: 3
 
  storage:
    size: 1Gi
    storageClass: csi-rbdfs-sc
  
  walStorage:
    storageClass: csi-rbdfs-sc
    size: 1Gi	

  bootstrap:
    initdb:
      database: testdb
      owner: admin
      secret:
        name: pg-app-user

  postgresql:
    parameters:
      max_connections: "300"
      shared_buffers: "1GB"

  resources:
    requests:
      cpu: "500m"
      memory: "1Gi"
    limits:
      cpu: "2"
      memory: "2Gi"


#test
kubectl run psql-client -n database --rm -it --image=postgres:16 --env="PGPASSWORD=admin" -- psql -h pg-test-rw.demo-apps.svc -U admin -d appdb

kubectl patch pvc pg-test-1-wal -n demo_apps -p '{"spec":{"resources":{"requests":{"storage":"32Gi"}}}}'

backup:
  barmanObjectStore:
    destinationPath: s3://pg-backups/prod
    endpointURL: http://minio.minio.svc:9000
    s3Credentials:
      accessKeyId:
        name: s3-creds
        key: ACCESS_KEY
      secretAccessKey:
        name: s3-creds
        key: SECRET_KEY




--- pgadmin -------------------
apiVersion: apps/v1
kind: Deployment
metadata:
  name: pgadmin-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pgadmin
  template:
    metadata:
      labels:
        app: pgadmin
    spec:
      containers:
        - name: pgadmin
          image: dpage/pgadmin4
          ports:
            - containerPort: 80
          env:
            - name: PGADMIN_DEFAULT_EMAIL
              value: pgadmin@italiadatacenter.com
            - name: PGADMIN_DEFAULT_PASSWORD
              value: KAYQE1QA7uwUZ8uI
---
apiVersion: v1
kind: Service
metadata:
  name: pgadmin-service
spec:
  selector:
    app: pgadmin
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: demo-route
  namespace: demo-apps
spec:
  hostnames:
  - poc3.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: pgadmin-service
      port: 80

	  
	  
	  
	  
--------------------------------------------------------------------------------	  

cat <<EOF | kubectl -n database apply -f -
# This StorageClass is optimized for use with CloudNativePG.
# It disables storage-level replication and ensures data is local to the pod.
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: longhorn-cnpg-strict-local
provisioner: driver.longhorn.io
 # allowVolumeExpansion is crucial for scaling database storage without downtime.
allowVolumeExpansion: true
 # reclaimPolicy: Delete ensures that when a PVC is deleted, the underlying
 # Longhorn volume is also removed, preventing orphaned storage.
reclaimPolicy: Delete
parameters:
  # This is the most important setting. We rely on CloudNativePG for replication,
  # so we only need one copy at the storage layer to avoid write amplification.
  numberOfReplicas: "1"
  # dataLocality: strict-local guarantees that the volume data will be stored
  # on the same node as the pod that uses it. This is essential for performance
  # and for aligning with a true shared-nothing architecture.
  dataLocality: "strict-local"
  # A longer timeout for stale replicas is suitable for database workloads.
  staleReplicaTimeout: "2880" # 48 hours in minutes
  # Default filesystem.
  fsType: "ext4"
EOF
 
 



kubectl cnpg psql pg-devops -n devops

CREATE DATABASE giteadb;
CREATE USER gitea WITH PASSWORD 'KAYQE1QA7uwUZ8uI';
GRANT ALL PRIVILEGES ON DATABASE giteadb TO gitea;
ALTER DATABASE giteadb OWNER TO gitea;


cluster production ready:

apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: mycluster
  namespace: database
spec:
  instances: 3                  # → 3 nodi per HA reale

  primaryUpdateStrategy: unsupervised  
  failover:                     # → Failover automatico
    promoteTimeout: 5m
    targetPromotionRule: "prefer-high-promotion-score"

  # ---------------------------
  # STORAGE (PRODUCTION)
  # ---------------------------
  storage:
    size: 200Gi
    storageClass: fast-rbd     # Ceph, SSD, GP3 ecc.
    resizeInUse: true

  walStorage:                   # Consigliato in produzione
    size: 50Gi
    storageClass: fast-rbd

  # ---------------------------
  # WAL ARCHIVING (S3/MINIO)
  # ---------------------------
  walArchive:
    enabled: true
    destinationPath: "s3://mybucket/wal/"
    s3Credentials:
      accessKeyId:
        name: cnpg-s3-creds
        key: ACCESS_KEY_ID
      secretAccessKey:
        name: cnpg-s3-creds
        key: SECRET_ACCESS_KEY
    endpointURL: "https://s3.myregion.amazonaws.com"
    region: "myregion"
    encryption: AES256

  # ---------------------------
  # BACKUP AUTOMATICI
  # ---------------------------
  backup:
    barmanObjectStore:
      destinationPath: "s3://mybucket/basebackup/"
      endpointURL: "https://s3.myregion.amazonaws.com"
      s3Credentials:
        accessKeyId:
          name: cnpg-s3-creds
          key: ACCESS_KEY_ID
        secretAccessKey:
          name: cnpg-s3-creds
          key: SECRET_ACCESS_KEY
      wal:
        compression: bzip2
        encryption: AES256
    retentionPolicy: "30d"  # → 30 giorni di retention
  monitoring:
    enablePodMonitor: true

  # ---------------------------
  # TLS INTERNO (RACCOMANDATO)
  # ---------------------------
  certificates:
    serverTLSSecret: cnpg-server-tls
    clientTLSSecret: cnpg-client-tls

  # ---------------------------
  # RESOURCE MANAGEMENT
  # ---------------------------
  resources:
    requests:
      cpu: "1"
      memory: "2Gi"
    limits:
      cpu: "4"
      memory: "8Gi"

  # ---------------------------
  # ANTI-AFFINITY & PDB
  # ---------------------------
  affinity:
    enablePodAntiAffinity: true
    topologyKey: "kubernetes.io/hostname"

  podDisruptionBudget:
    minAvailable: 2

  # ---------------------------
  # STARTUP & HEALTH
  # ---------------------------
  postgresql:
    shared_preload_libraries:
      - "pg_stat_statements"
      - "auto_explain"
    parameters:
      max_connections: "300"
      shared_buffers: "2GB"
      effective_cache_size: "6GB"
      maintenance_work_mem: "512MB"
      wal_compression: "on"
      wal_level: "replica"
      max_wal_size: "4GB"
      checkpoint_timeout: "15min"
      synchronous_commit: "remote_apply"

  # ---------------------------
  # SYNCHRONOUS REPLICATION
  # ---------------------------
  replication:
    synchronous:
      mode: " quorum "
      number: 1   # One sync replica; others async

  # ---------------------------
  # SERVICE & NETWORKING
  # ---------------------------
  service:
    type: ClusterIP
    primary:
      type: ClusterIP
    replicas:
      type: ClusterIP

  # ---------------------------
  # ENCRYPTION AT REST (OPZIONALE)
  # ---------------------------
  encryption:
    enabled: true
    mode: aes256-gcm
  ------------------------------------------------------------------------------------------------------------------------------

- **MySql Operator**  
helm repo add mysql-operator https://mysql.github.io/mysql-operator/
helm repo update

helm install my-mysql-operator mysql-operator/mysql-operator  --namespace mysql-operator --create-namespace

--db instance
kubectl create secret generic mypwds \
        --from-literal=rootUser=root \
        --from-literal=rootHost=% \
        --from-literal=rootPassword="sakila"


apiVersion: mysql.oracle.com/v2
kind: InnoDBCluster
metadata:
  name: mycluster
spec:
  secretName: mypwds
  tlsUseSelfSigned: true
  instances: 3
  router:
    instances: 1		
	
	
--- test
$> kubectl run --rm -it myshell --image=container-registry.oracle.com/mysql/community-operator -- mysqlsh root@mycluster --sql
If you don't see a command prompt, try pressing enter.
******

MySQL mycluster SQL> SELECT @@hostname

+-------------+
| @@hostname  |
+-------------+
| mycluster-0 |
+-------------+	
  ------------------------------------------------------------------------------------------------------------------------------

- **Redis**  
  ------------------------------------------------------------------------------------------------------------------------------
kubectl create namespace redis
helm repo add bitnami https://charts.bitnami.com/bitnami
helm repo update


cat <<EOF | cat > redisvalues.yaml -
architecture: replication

auth:
  enabled: true
  password: KAYQE1QA7uwUZ8uI 

master:
  persistence:
    enabled: true
    storageClass: csi-rbdfs-sc
    size: 5Gi
  resources:
    requests:
      cpu: 100m
      memory: 256Mi

replica:
  replicaCount: 2
  persistence:
    enabled: true
    storageClass: csi-rbdfs-sc
    size: 5Gi
  resources:
    requests:
      cpu: 100m
      memory: 256Mi

sentinel:
  enabled: true
  replicas: 3
  resources:
    requests:
      cpu: 50m
      memory: 64Mi

metrics:
  enabled: false
EOF

helm install redis bitnami/redis  -n redis   -f redisvalues.yaml

#test
kubectl run redis-client -n redis --rm -it --image=redis:7.2 -- redis-cli  -h redis.redis.svc.cluster.local  -a KAYQE1QA7uwUZ8uI



###########################################################################################################################
Redis(R) can be accessed via port 6379 on the following DNS name from within your cluster:

    redis.redis.svc.cluster.local for read only operations

For read/write operations, first access the Redis(R) Sentinel cluster, which is available in port 26379 using the same domain name above.

To get your password run:

    export REDIS_PASSWORD=$(kubectl get secret --namespace redis redis -o jsonpath="{.data.redis-password}" | base64 -d)

To connect to your Redis(R) server:

1. Run a Redis(R) pod that you can use as a client:

   kubectl run --namespace redis redis-client --restart='Never'  --env REDIS_PASSWORD=$REDIS_PASSWORD  --image registry-1.docker.io/bitnami/redis:latest --command -- sleep infinity

   Use the following command to attach to the pod:

   kubectl exec --tty -i redis-client \
   --namespace redis -- bash

2. Connect using the Redis(R) CLI:
   REDISCLI_AUTH="$REDIS_PASSWORD" redis-cli -h redis -p 6379 # Read only operations
   REDISCLI_AUTH="$REDIS_PASSWORD" redis-cli -h redis -p 26379 # Sentinel access

To connect to your database from outside the cluster execute the following commands:

    kubectl port-forward --namespace redis svc/redis 6379:6379 &
    REDISCLI_AUTH="$REDIS_PASSWORD" redis-cli -h 127.0.0.1 -p 6379
- **InfluxDB**  
  ------------------------------------------------------------------------------------------------------------------------------
helm repo add influxdata https://helm.influxdata.com/
helm repo update
----
kubectl create namespace influxdb
----
influxdb-values.yaml:
image:
  repository: influxdb
  tag: 2.7

persistence:
  enabled: true
  size: 20Gi

resources:
  requests:
    cpu: 200m
    memory: 256Mi
  limits:
    cpu: 1
    memory: 1Gi

service:
  type: ClusterIP
  port: 8086

adminUser:
  organization: sts-lab
  bucket: demo-bucket
  user: admin
  password: KAYQE1QA7uwUZ8uI5
  token: my-super-token


----  
helm install influxdb influxdata/influxdb2  --namespace influxdb  -f influxdb-values.yaml
  
 --- 
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: influxdb
spec:
  hostnames:
  - poc2.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: influxdb-influxdb2
      port: 8086

  
  
  
******************  TEST ****************************
  
echo $(kubectl get secret influxdb-influxdb2-auth -o "jsonpath={.data['admin-password']}" --namespace influxdb | base64 --decode)
  
  logon UI
  http://localhost:8086
  
  user: admin
  password: KAYQE1QA7uwUZ8uI5
  
  TEST API:
  curl http://localhost:8086/health
  
  
  link svc:
  influxdb-influxdb2.influxdb.svc.cluster.local
- **MongoDB**  
  ------------------------------------------------------------------------------------------------------------------------------

- **DbGate**  
  ------------------------------------------------------------------------------------------------------------------------------
apiVersion: v1
kind: Namespace
metadata:
  name: dbgate
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dbgate
  namespace: dbgate

spec:
  replicas: 1

  selector:
    matchLabels:
      app: dbgate

  template:
    metadata:
      labels:
        app: dbgate

    spec:
      containers:
        - name: dbgate
          image: dbgate/dbgate:latest

          ports:
            - containerPort: 3000

          env:
            - name: CONNECTIONS
              value: ""

          resources:
            requests:
              cpu: "100m"
              memory: "128Mi"

            limits:
              cpu: "500m"
              memory: "512Mi"  
---
apiVersion: v1
kind: Service
metadata:
  name: dbgate
  namespace: dbgate

spec:
  selector:
    app: dbgate

  ports:
    - port: 80
      targetPort: 3000

  type: ClusterIP			  
  
 httproute:
 apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: demo-route
  namespace: demo-apps
spec:
  hostnames:
  - poc3.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: dbgate
      port: 3000
---
------------------------------------------------------------------------------------------------------------------------------
## Servizi Applicativi / Utility

- **NodeRed**  
apiVersion: v1
kind: Namespace
metadata:
  name: nodered
---  
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: node-red-pvc
  namespace: nodered
  labels:
    app: node-red
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
---	  
apiVersion: apps/v1
kind: Deployment
metadata:
  name: node-red
  namespace: nodered
  labels:
    app: node-red
spec:
  replicas: 1
  selector:
    matchLabels:
      app: node-red
  template:
    metadata:
      labels:
        app: node-red
    spec:
      securityContext:
        fsGroup: 1000
      containers:
      - name: nodered
        image: nodered/node-red:4.1
        args: ["--settings", "/config/settings.js"]
        env:
        - name: NODE_OPTIONS
          value: "--trace-warnings"
        ports:
        - containerPort: 1880
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          allowPrivilegeEscalation: false
        resources:
          limits:
            memory: "512Mi"
            cpu: "500m"
          requests:
            memory: "256Mi"
            cpu: "250m"
        livenessProbe:
          httpGet:
            path: /
            port: 1880
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /
            port: 1880
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: node-red-storage
          mountPath: /data
        - name: node-red-settings
          mountPath: /config/settings.js
          subPath: settings.js
      volumes:
      - name: node-red-storage
        persistentVolumeClaim:
          claimName: node-red-pvc
      - name: node-red-settings
        configMap:
          name: node-red-settings
---		  
apiVersion: v1
kind: ConfigMap
metadata:
  name: node-red-settings
  namespace: nodered
data:
  settings.js: |
    module.exports = {
      httpAdminRoot: '/',
      httpNodeRoot: '/',
      userDir: '/data',
      flowFile: 'flows.json',
      credentialSecret: 'yzM0ol6Zn5kd1234',
      adminAuth: {
        type: "credentials",
        users: [{
          username: "admin",
          password: "",
          permissions: "*"
        }]
      },
      uiPort: process.env.PORT || 1880,
      mqttReconnectTime: 15000,
      serialReconnectTime: 15000,
      debugMaxLength: 1000,
      functionGlobalContext: {},
      exportGlobalContextKeys: false,
      logging: {
        console: {
          level: "info",
          metrics: false,
          audit: false
        }
      },
      editorTheme: {
        projects: {
          enabled: false
        }
      }
    };
---
apiVersion: v1
kind: Service
metadata:
  name: node-red-service
  namespace: nodered
  labels:
    app: node-red
spec:
  type: ClusterIP
  ports:
  - port: 1880
    targetPort: 1880
    protocol: TCP
    name: http
  selector:
    app: node-red
---	
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: node-red-hpa
  namespace: nodered
  labels:
    app: node-red
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: node-red
  minReplicas: 1
  maxReplicas: 3
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 80
---		
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: node-red
  namespace: nodered
spec:
  hostnames:
  - nodered.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: node-red-service
      port: 1880
	  
Istruzioni per set token influxdb	  
kubectl get pods -n nodered
kubectl exec -it node-red-bd88bc7df-knqfw -n nodered -- node-red admin hash-pw  

kubectl edit configmap node-red-settings -n nodered  --->(set campo password password: "<bcrypt-hash-here>", nella sezione adminAuth)

kubectl delete pods node-red-bd88bc7df-knqfw -n nodered
  ------------------------------------------------------------------------------------------------------------------------------

- **Grafana**
  Aggiungere repository Helm Grafana

helm repo add grafana https://grafana.github.io/helm-charts
helm repo update
----
kubectl create namespace grafana
----
grafana-values.yaml:
replicas: 1

adminUser: admin
adminPassword: KAYQE1QA7uwUZ8uI5

service:
  type: ClusterIP
  port: 80

persistence:
  enabled: true
  size: 10Gi

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi
---	
helm install grafana grafana/grafana  -n grafana  -f grafana-values.yaml
---  
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: grafana
spec:
  hostnames:
  - tekton.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: grafana
      port: 80 
  
  
  
******************  TEST ****************************
Accesso alla UI Grafana
  
Aprire browser:

http://localhost:3000

Login:

user: admin
password: KAYQE1QA7uwUZ8uI5



link svc:
  grafana.grafana.svc.cluster.local


---------------------------------------
Aggiungere InfluxDB come datasource


In Grafana:

Connections
   ↓
Data Sources
   ↓
Add data source
   ↓
InfluxDB

Configurazione:

URL
http://influxdb:8086

Organization:
demo-org

Token:
my-super-token

Bucket:
demo-bucket

Salva.

6️⃣ Test datasource

Click:

Save & Test

Se corretto:

Datasource is working
7️⃣ Creare dashboard

In Grafana:

Create
  ↓
Dashboard
  ↓
Add panel

Query esempio (InfluxDB Flux):

from(bucket: "demo-bucket")
  |> range(start: -1h)
  ------------------------------------------------------------------------------------------------------------------------------

- **Prometheus**  
  ------------------------------------------------------------------------------------------------------------------------------

- **SonarQube**  
  ------------------------------------------------------------------------------------------------------------------------------
###########  repo helm ################
helm repo add sonarqube https://SonarSource.github.io/helm-chart-sonarqube
helm repo update

###########  creazione ns e secret db ################
kubectl create namespace sonarqube

kubectl create secret generic sonarqube-database-cred \
  --from-literal=username=sonarqube \
  --from-literal=password=KAYQE1QA7uwUZ8uI \
  -n sonarqube
  
  
###########  creazione database ################ 
kubectl cnpg psql pg-devops -n devops

CREATE DATABASE sonarqube;
CREATE USER sonarqube WITH PASSWORD 'KAYQE1QA7uwUZ8uI';
GRANT ALL PRIVILEGES ON DATABASE sonarqube TO sonarqube;
ALTER DATABASE sonarqube OWNER TO sonarqube;  
  
########### Values.yaml per installazione helm  ################  

service:
  type: ClusterIP

postgresql:
  enabled: false

jdbcOverwrite:
  enabled: true
  jdbcUrl: "jdbc:postgresql://pg-devops-rw.devops.svc.cluster.local:5432/sonarqube"
  jdbcUsername: "postgres"
  jdbcSecretName: "sonarqube-database-cred"
  jdbcSecretPasswordKey: "password"

readinessProbe:
  initialDelaySeconds: 300  # Increase initial delay to accommodate the database start time
  timeoutSeconds: 60
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 3

livenessProbe:
  initialDelaySeconds: 360  # Ensure the application has enough time to start
  timeoutSeconds: 60
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 3

startupProbe:
  initialDelaySeconds: 300  # Allow for sufficient startup time
  timeoutSeconds: 60
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 3  
  
  
###########  installazione helm ################  
helm upgrade -f sonarvalues.yaml --install -n sonarqube sonarqube sonarqube/sonarqube --set community.enabled=true,monitoringPasscode="KAYQE1QA7uwUZ8uI"

  
  
###########  httproute ################  
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: sonarqube
  namespace: sonarqube
spec:
  hostnames:
  - sonarqube.italiadatacenter.com
  parentRefs:
  - name: main-gateway
    namespace: nginx-gateway
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: sonarqube-sonarqube
      port: 9000
	  

  
- **KubeEdge**  
  ------------------------------------------------------------------------------------------------------------------------------

- **Knative**  
  ------------------------------------------------------------------------------------------------------------------------------

- **Locust**  
  ------------------------------------------------------------------------------------------------------------------------------