k8s.yaml

##__        __   _    ____  _ _                 ____ ____  _   _    ______  _____ _____ ____
##\ \      / /__| |__/ ___|(_) |_ ___     _    / ___/ ___|| | | |  / / ___||  ___|_   _|  _ \
## \ \ /\ / / _ \ '_ \___ \| | __/ _ \  _| |_  \___ \___ \| |_| | / /\___ \| |_    | | | |_) |
##  \ V  V /  __/ |_) |__) | | ||  __/ |_   _|  ___) |__) |  _  |/ /  ___) |  _|   | | |  __/
##   \_/\_/ \___|_.__/____/|_|\__\___|   |_|   |____/____/|_| |_/_/  |____/|_|     |_| |_|
##

## https://github.com/Tob1as/docker-php + https://hub.docker.com/r/tobi312/php
## https://github.com/linuxserver/docker-openssh-server + https://hub.docker.com/r/linuxserver/openssh-server

## https://kubernetes.io/docs/reference/kubectl/cheatsheet/
## kubectl apply -f k8s.yaml

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: openssh-env-config
  namespace: default
  labels:
    app: openssh
data:
  PUID: "33"          # default: 1000 ; set it like in website image: (www-data) 33 for debian and 82 for alpine (path: /var/www/html), (nginx) 101 for offical nginx image (path: /usr/share/nginx/html)!
  PGID: "33"          # (see above) 
  TZ: "Europe/Berlin"
  #SUDO_ACCESS: "false"
  PASSWORD_ACCESS: "true"

---

## convert string to base64 in Linux: "echo -n 'value' | base64"
## example generator for Password: https://passwordsgenerator.net/
## example command for ssk-key: "ssh-keygen -t rsa -b 4096 -C 'your_email@example.com' -f $HOME/.ssh/id_rsa"

apiVersion: v1
kind: Secret
metadata:
  name: openssh-env-secret
  namespace: default
  labels:
    app: openssh
data:
  #PUBLIC_KEY: < ~/.ssh/key_rsa.pub in base64 >
  USER_NAME: c3NodXNlcg==                    # Username in base64, example: sshuser
  USER_PASSWORD: Nk55NG5IdzRueUhmWmZTRQ==    # Password in base64, example: 6Ny4nHw4nyHfZfSE

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: website-env-config
  namespace: default
  labels:
    app: website
data:
  TZ: "Europe/Berlin"
  PHP_ERRORS: "1"
  PHP_MEM_LIMIT: "128"
  PHP_POST_MAX_SIZE: "250"
  PHP_UPLOAD_MAX_FILESIZE: "250"
  PHP_MAX_FILE_UPLOADS: "20"
  CREATE_PHPINFO_FILE: "0"
  CREATE_INDEX_FILE: "0"
  ## next env only with php-fpm
  #ENABLE_PHP_FPM_STATUS: "1"
  ## next env only with apache
  ENABLE_APACHE_REWRITE: "1"
  ENABLE_APACHE_ACTIONS: "0"
  ENABLE_APACHE_SSL: "0"
  ENABLE_APACHE_HEADERS: "0"
  ENABLE_APACHE_ALLOWOVERRIDE: "1"
  ENABLE_APACHE_REMOTEIP: "1"
  ENABLE_APACHE_STATUS: "1"
  #ENABLE_APACHE_SSL_REDIRECT: "0"
  #APACHE_SERVER_NAME: ""
  #APACHE_SERVER_ALIAS: ""
  #APACHE_SERVER_ADMIN: ""
  DISABLE_APACHE_DEFAULTSITES: "0"
  ## next env only with nginx
  #ENABLE_NGINX_REMOTEIP: "1"
  #ENABLE_NGINX_STATUS: "1"
  
---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: website
  namespace: default
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: website
  template:
    metadata:
      labels:
        app: website
      annotations: {}
    spec:
      #hostname: website
      containers:
        - name: website
          #image: tobi312/php:8.1-fpm-nginx-alpine
          image: tobi312/php:8.1-apache
          imagePullPolicy: Always
          envFrom:
          - configMapRef:
              name: website-env-config
          ports:
          - containerPort: 80
          - containerPort: 443
          resources:
            requests:
              memory: "128Mi"
              cpu: "0.1"
            limits:
              memory: "1Gi"
              cpu: "1.0"
          volumeMounts:
            - mountPath: /var/www/html
              name: website-data
            #- name: website-php-file-config
            #  mountPath: /usr/share/nginx/html/test.php
            #  subPath: test.php
        - name: openssh-server
          #image: ghcr.io/linuxserver/openssh-server:latest
          image: linuxserver/openssh-server:latest
          imagePullPolicy: Always
          envFrom:
          - configMapRef:
              name: openssh-env-config
          - secretRef:
              name: openssh-env-secret
          ports:
            - containerPort: 2222
          resources:
            requests:
              memory: "128Mi"
              cpu: "0.1"
            limits:
              memory: "512Mi"
              cpu: "0.5"
          volumeMounts:
            - mountPath: /var/www/html
              name: website-data
            - mountPath: /config
              name: openssh-data
            #- name: openssh-file-config
            #  mountPath: /config/custom-cont-init.d/10-sshd_portforwarding.sh
            #  subPath: 10-sshd_portforwarding.sh
            - name: openssh-bashprofile-config
              mountPath: /config/.bash_profile
              subPath: .bash_profile
      initContainers:
        - name: volume-mount-chmod
          image: busybox
          command: ["sh", "-c", "mkdir -p /var/www/html; chmod 777 /var/www/html; mkdir -p /config; chmod 777 /config; exit"]
          volumeMounts:
            - mountPath: /var/www/html
              name: website-data
            - mountPath: /config
              name: openssh-data
          resources:
            requests:
              memory: "128Mi"
              cpu: "0.1"
            limits:
              memory: "256Mi"
              cpu: "0.5"
      restartPolicy: Always
      volumes:
        - name: website-data
          persistentVolumeClaim:
            claimName: website-data
        - name: openssh-data
          persistentVolumeClaim:
            claimName: openssh-data
        - name: website-php-file-config
          configMap:
            name: website-php-file-config
        - name: openssh-file-config
          configMap:
            name: openssh-file-config
        - name: openssh-bashprofile-config
          configMap:
            name: openssh-bashprofile-config

---

apiVersion: v1
kind: Service
metadata:
  name: website
  namespace: default
  labels:
    app: website
spec:
  type: ClusterIP      # default
  ports:
    - name: website
      protocol: TCP
      port: 80
      targetPort: 80
    #- name: website-ssl
    #  protocol: TCP
    #  port: 443
    #  targetPort: 443
  selector:
    app: website

---

apiVersion: v1
kind: Service
metadata:
  name: openssh-server
  namespace: default
  labels:
    app: openssh
spec:
  type: NodePort      # for external access
  ports:
    - name: openssh-server
      protocol: TCP
      port: 2222
      targetPort: 2222
      #nodePort: 2222  # use this, when not random
  selector:
    app: website

---

## CertManager for Ingress (if use this then comment out "Secret for Ingress"):
## https://cert-manager.io/docs/ (https://github.com/jetstack/cert-manager)
## Installation needed: kubectl apply --validate=false -f https://github.com/jetstack/cert-manager/releases/download/v1.3.1/cert-manager.yaml

#apiVersion: cert-manager.io/v1
##kind: ClusterIssuer
#kind: Issuer
#metadata:
#  name: certmanager-ingress-nginx
#  namespace: default
#spec:
#  acme:
#    email: email@example.com
#    server: https://acme-v02.api.letsencrypt.org/directory
#    privateKeySecretRef:
#      name: ingress-tls-secret
#    solvers:
#    - http01:
#        ingress:
#          class: nginx

---

## Secret for Ingress (if use this then comment out "CertManager for Ingress"):

## convert ssl files to base64, linux examples: 
## example command: for i in $(find . -type f -regex ".*/.*\.\(crt\|key\|pem\)"); do echo -e "\nEncode-File $i:" ; cat $i | base64 -w0 ; done > ssl_convertinbase64.txt

apiVersion: v1
kind: Secret
metadata:
  name: ingress-tls-secret
  namespace: default
  labels:
    app: website
data:
  tls.crt: <ssl.crt in base64>
  tls.key: <ssl.key in base64>
type: kubernetes.io/tls

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-website
  namespace: default
  annotations:
    kubernetes.io/ingress.class: nginx
    #nginx.ingress.kubernetes.io/ssl-redirect: "false"
    # CertManager:
    #cert-manager.io/cluster-issuer: certmanager-ingress-nginx
    #cert-manager.io/acme-challenge-type: http01
    ## oAuth2: https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth/
    #nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
    #nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
spec:
  tls:
  - hosts:
    - example.com
    secretName: ingress-tls-secret
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: website
            port:
              number: 80

---

# test.php in /usr/share/nginx/html for website

apiVersion: v1
kind: ConfigMap
metadata:
  name: website-php-file-config
  namespace: default
  labels:
    app: website
data:
  test.php: |-
    <!DOCTYPE html>
    <html>
      <head>
          <meta charset="utf-8">
          <meta name="generator" content="K8S-File: tobi312/php">
           <title>Site</title>
           <!--<link rel="stylesheet" href="style.css">-->
      </head>
      <body>
        <h1>Hello!</h1>
          <p>
          This is a simple website. Time:<br>
          <?php
          echo date("Y-m-d H:i:s");
          ?>
          </p>
      </body>
    </html>

---

## 10-sshd_portforwarding.sh in /config/custom-cont-init.d/ for openssh (enable PortForwarding)
## https://www.ssh.com/academy/ssh/tunneling/example

apiVersion: v1
kind: ConfigMap
metadata:
  name: openssh-file-config
  namespace: default
  labels:
    app: openssh
data:
  10-sshd_portforwarding.sh: |-
    #!/bin/sh
    set -eu
    SSHD_CONF_FILE="/etc/ssh/sshd_config"
    echo ">> Enable PortForwarding"
    sed -i "s|AllowTcpForwarding.*|AllowTcpForwarding yes|g" ${SSHD_CONF_FILE}
    sed -i "s|GatewayPorts.*|GatewayPorts yes|g" ${SSHD_CONF_FILE}

---

## .bash_profile in /config/ for openssh user (change dir to html when login)
## https://serverfault.com/a/499566/479163

apiVersion: v1
kind: ConfigMap
metadata:
  name: openssh-bashprofile-config
  namespace: default
  labels:
    app: openssh
data:
  .bash_profile: |-
    cd /var/www/html/

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: website-data
  namespace: default
  labels:
    app: website
spec:
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: 25Gi
  storageClassName: manual

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: openssh-data
  namespace: default
  labels:
    app: openssh
spec:
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: 256Mi
  storageClassName: manual

---

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  persistentVolumeReclaimPolicy: Delete
  capacity:
    storage: 100Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/k8sdata"