arrstack: add kids backend tier (sonarr/radarr/nzbget-kids) (#412)
Splits the arrstack media pipeline into an adult and a kids tier so kids content lives in its own libraries, databases, and downloader while reusing the shared prowlarr, CNPG cluster, Valkey, media PVCs, and S3 buckets. Backend workloads only — no routing/ingress, no arrproxy, no adult-instance changes in this PR. How: - sonarr-kids / radarr-kids: mirror the adult -unkin fork Deployments (same images/tags, 3 active-active replicas) on their own Postgres DBs (sonarr-kids-main / radarr-kids-main), UrlBase /3df803/sonarr and /3df803/radarr, and kids MediaCover/Backup S3 prefixes. - Media mounts use the tvshows/kids and movies/kids subPaths of the shared media-tv / media-movies PVCs, so kids libraries are isolated on the same CephFS subvolumes. - nzbget-kids: second downloader on its own RWO config PVC, completed downloads land in the kids media subtrees for same-filesystem hardlink imports. - postgres: two managed roles + Database CRDs and their VSO-synced <app>-kids-db credential secrets. - per-app VMPodScrape for each kids exportarr sidecar; new apps registered in the base kustomization. Validated: kustomize build + kubeconform (96/96 valid), yamllint + pre-commit clean. Reviewed-on: #412 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
This commit was merged in pull request #412.
This commit is contained in:
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# Non-secret env for the -unkin2 fork (kids tier). Identical mechanism to the
|
||||
# adult radarr, pointed at its own shared-Postgres database (radarr-kids-main)
|
||||
# and its own UrlBase (/3df803/radarr) so arrproxy path-routing reaches the kids
|
||||
# instance separately. Shares the one arrstack Valkey (keys namespaced by the
|
||||
# fork's radarr:ratelimit: prefix). User/Password/ApiKey come from Secrets (see
|
||||
# deployment.yaml), not here.
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: radarr-kids-env
|
||||
namespace: arrstack
|
||||
data:
|
||||
Radarr__Postgres__Host: arrstack-postgres-rw.arrstack.svc.cluster.local
|
||||
Radarr__Postgres__Port: "5432"
|
||||
Radarr__Postgres__MainDb: radarr-kids-main
|
||||
Radarr__Log__DbEnabled: "false"
|
||||
Radarr__Auth__Method: External
|
||||
Radarr__Auth__Required: DisabledForLocalAddresses
|
||||
Radarr__App__InstanceName: Radarr
|
||||
Radarr__Server__Port: "7878"
|
||||
Radarr__Server__UrlBase: /3df803/radarr
|
||||
Radarr__Update__Mechanism: External
|
||||
Radarr__Redis__Host: valkey-arrstack-valkey.arrstack.svc.cluster.local
|
||||
Radarr__Redis__Port: "6379"
|
||||
@@ -0,0 +1,245 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: radarr-kids
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
# Reloader rolls the Deployment when radarr-kids-env changes (plain envFrom
|
||||
# ConfigMap does not trigger a rollout on its own).
|
||||
configmap.reloader.stakater.com/auto: "true"
|
||||
spec:
|
||||
# Active-active: the -unkin2 fork keeps all state in the shared Postgres
|
||||
# (arrstack-postgres) and coordinates via Postgres advisory locks, so N
|
||||
# replicas run concurrently behind the radarr-kids Service. RollingUpdate is
|
||||
# safe — no SQLite, no RWO lock.
|
||||
replicas: 3
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
selector:
|
||||
matchLabels:
|
||||
app: radarr-kids
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: radarr-kids
|
||||
spec:
|
||||
securityContext:
|
||||
# Fork image has no USER; pin it to a non-root UID and group-write the
|
||||
# shared RWX CephFS media subtree. OnRootMismatch avoids a recursive
|
||||
# chown of the whole media tree.
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
fsGroup: 1000
|
||||
fsGroupChangePolicy: OnRootMismatch
|
||||
initContainers:
|
||||
# Gate the app on its own Postgres database+role being reachable.
|
||||
# waitfordb reads the PG* env as a libpq fallback, so the password never
|
||||
# lands in argv.
|
||||
- name: wait-for-db
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/waitfordb:v0.1.0
|
||||
env:
|
||||
- name: WAITFORDB_TIMEOUT
|
||||
value: 5m
|
||||
- name: WAITFORDB_SSLMODE
|
||||
value: disable
|
||||
- name: PGHOST
|
||||
value: arrstack-postgres-rw.arrstack.svc.cluster.local
|
||||
- name: PGPORT
|
||||
value: "5432"
|
||||
- name: PGDATABASE
|
||||
value: radarr-kids-main
|
||||
- name: PGUSER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: radarr-kids-db
|
||||
key: username
|
||||
- name: PGPASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: radarr-kids-db
|
||||
key: password
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
containers:
|
||||
- name: radarr
|
||||
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/radarr:v6.4.2-unkin7
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /app/Radarr
|
||||
args:
|
||||
- -nobrowser
|
||||
- -data=/config
|
||||
# Bypass the single-instance guard so multiple replicas can share one
|
||||
# /config. Cross-replica safety is the Postgres layer, not a lock file.
|
||||
- -nosingleinstancecheck
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 7878
|
||||
protocol: TCP
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: radarr-kids-env
|
||||
env:
|
||||
- name: Radarr__Postgres__User
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: radarr-kids-db
|
||||
key: username
|
||||
- name: Radarr__Postgres__Password
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: radarr-kids-db
|
||||
key: password
|
||||
- name: Radarr__Auth__ApiKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: radarr-kids-apikey
|
||||
key: apitoken
|
||||
# MediaCover object store (shared arrstack-media Ceph RGW bucket,
|
||||
# partitioned by the radarr-kids key prefix).
|
||||
- name: Radarr__MediaCover__S3__Endpoint
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: S3_ENDPOINT
|
||||
- name: Radarr__MediaCover__S3__AccessKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: Radarr__MediaCover__S3__SecretKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-media-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: Radarr__MediaCover__S3__Bucket
|
||||
value: arrstack-media
|
||||
- name: Radarr__MediaCover__S3__Prefix
|
||||
value: radarr-kids
|
||||
- name: Radarr__MediaCover__S3__ForcePathStyle
|
||||
value: "true"
|
||||
- name: Radarr__MediaCover__S3__CaCertPath
|
||||
value: /etc/ssl/vault-ca/ca.crt
|
||||
# Backup object store (shared arrstack-backups Ceph RGW bucket,
|
||||
# partitioned by the radarr-kids key prefix).
|
||||
- name: Radarr__BackupS3__Endpoint
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: S3_ENDPOINT
|
||||
- name: Radarr__BackupS3__AccessKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: AWS_ACCESS_KEY_ID
|
||||
- name: Radarr__BackupS3__SecretKey
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: arrstack-backups-s3
|
||||
key: AWS_SECRET_ACCESS_KEY
|
||||
- name: Radarr__BackupS3__Bucket
|
||||
value: arrstack-backups
|
||||
- name: Radarr__BackupS3__Prefix
|
||||
value: radarr-kids
|
||||
- name: Radarr__BackupS3__ForcePathStyle
|
||||
value: "true"
|
||||
- name: Radarr__BackupS3__CaCertPath
|
||||
value: /etc/ssl/vault-ca/ca.crt
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /3df803/radarr/ping
|
||||
port: http
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /3df803/radarr/ping
|
||||
port: http
|
||||
initialDelaySeconds: 10
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: config
|
||||
mountPath: /config
|
||||
# Kids movies subtree of the shared media-movies PVC (same CephFS
|
||||
# subvolume the adult radarr writes and jellyfin reads).
|
||||
- name: media-movies
|
||||
mountPath: /media/movies
|
||||
subPath: movies/kids
|
||||
- name: vault-ca
|
||||
mountPath: /etc/ssl/vault-ca
|
||||
readOnly: true
|
||||
# exportarr sidecar: polls the local replica's API and exposes Prometheus
|
||||
# metrics on :9708 (scraped by the radarr-kids-exportarr VMPodScrape).
|
||||
- name: exportarr
|
||||
image: ghcr.io/onedr0p/exportarr:v2.3.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- radarr
|
||||
env:
|
||||
- name: PORT
|
||||
value: "9708"
|
||||
# URL includes the /3df803/radarr UrlBase (Radarr__Server__UrlBase).
|
||||
- name: URL
|
||||
value: http://localhost:7878/3df803/radarr
|
||||
- name: APIKEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: radarr-kids-apikey
|
||||
key: apitoken
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 9708
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 30
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
failureThreshold: 3
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
volumes:
|
||||
- name: config
|
||||
emptyDir: {}
|
||||
- name: media-movies
|
||||
persistentVolumeClaim:
|
||||
claimName: media-movies
|
||||
# Estate CA for validating the Ceph RGW (s3.ceph.unkin.net) TLS cert.
|
||||
- name: vault-ca
|
||||
secret:
|
||||
secretName: vault-ca-cert
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
resources:
|
||||
- vaultstaticsecret.yaml
|
||||
- configmap.yaml
|
||||
- deployment.yaml
|
||||
- service.yaml
|
||||
- vmpodscrape.yaml
|
||||
@@ -0,0 +1,15 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: radarr-kids
|
||||
namespace: arrstack
|
||||
spec:
|
||||
ports:
|
||||
- name: http
|
||||
port: 7878
|
||||
protocol: TCP
|
||||
targetPort: http
|
||||
selector:
|
||||
app: radarr-kids
|
||||
type: ClusterIP
|
||||
@@ -0,0 +1,25 @@
|
||||
---
|
||||
# radarr-kids API key. Seeded out-of-band at
|
||||
# kv/kubernetes/namespace/arrstack/default/radarr-kids (key: apitoken); the
|
||||
# default k8s role's templated policy already grants read on
|
||||
# kv/data/kubernetes/namespace/{{sa_namespace}}/{{sa_name}}/* for the
|
||||
# arrstack/default ServiceAccount, so no terraform-vault change is needed. VSO
|
||||
# syncs it into the radarr-kids-apikey Secret consumed by the Deployment.
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: radarr-kids-apikey
|
||||
namespace: arrstack
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "0"
|
||||
spec:
|
||||
destination:
|
||||
create: true
|
||||
name: radarr-kids-apikey
|
||||
overwrite: true
|
||||
hmacSecretData: true
|
||||
mount: kv
|
||||
path: kubernetes/namespace/arrstack/default/radarr-kids
|
||||
refreshAfter: 5m
|
||||
type: kv-v2
|
||||
vaultAuthRef: default
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
# Scrape the exportarr sidecar (:9708) on every radarr-kids pod. Picked up by the
|
||||
# observability VMAgent (selectAllByDefault). Pod-level rather than
|
||||
# VMServiceScrape because the radarr-kids Service doesn't expose the metrics port.
|
||||
apiVersion: operator.victoriametrics.com/v1beta1
|
||||
kind: VMPodScrape
|
||||
metadata:
|
||||
name: radarr-kids-exportarr
|
||||
namespace: arrstack
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app: radarr-kids
|
||||
podMetricsEndpoints:
|
||||
- port: metrics
|
||||
path: /metrics
|
||||
Reference in New Issue
Block a user