unkin-agent
5ea193b957
Adds the mediamark app (Go single binary) to the media project: an oauth2-proxy-fronted service that reads the shared mediastore CephFS tree and talks to the adult-tier sonarr/radarr through arrproxy's hash routes. - Add apps/base/mediamark: namespace, VaultAuth, three VaultStaticSecrets, static mediastore PV/PVC, the app Deployment, oauth2-proxy ConfigMap/Deployment, two Services, and the internal + external Gateway/HTTPRoute pairs. - Run the app as 1000:1000 so it owns files on the shared media tree (hardlink/rename safe), with a read-only root filesystem, all caps dropped and no service-account token. - Project the sonarr/radarr API keys as one file per app under /etc/mediamark/keys, mirroring arrproxy's keys projection, with reloader annotations on both secrets. - Front both mediamark.unkin.net (traefik-external, reflected LE wildcard) and mediamark.k8s.syd1.au.unkin.net (traefik-internal, vault-issuer) with one oauth2-proxy using a relative redirect URL, gated on akP-mediamark-user and passing X-Forwarded-Groups to the app. - Append mediamark to the wildcard-unkin-net reflector namespace lists and register the app in the media ApplicationSet and AppProject.
114 lines
3.5 KiB
YAML
114 lines
3.5 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: mediamark
|
|
namespace: mediamark
|
|
annotations:
|
|
secret.reloader.stakater.com/reload: "sonarr-apikey,radarr-apikey"
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: mediamark
|
|
strategy:
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: mediamark
|
|
spec:
|
|
serviceAccountName: default
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
# 1000:1000 matches the media tree ownership on the shared mediastore
|
|
# subvolume; mediamark hardlinks/renames files the *arr apps own, so it
|
|
# deliberately does NOT run as the usual 65532.
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
fsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: mediamark
|
|
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/mediamark:v0.1.0
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
protocol: TCP
|
|
env:
|
|
- name: MEDIAMARK_MEDIA_ROOT
|
|
value: /media
|
|
- name: MEDIAMARK_KEYS_DIR
|
|
value: /etc/mediamark/keys
|
|
- name: MEDIAMARK_SONARR_URL
|
|
value: http://sonarr-adult.arrstack.svc.cluster.local:8989/3aa168/sonarr
|
|
- name: MEDIAMARK_RADARR_URL
|
|
value: http://radarr-adult.arrstack.svc.cluster.local:7878/3aa168/radarr
|
|
# oauth2-proxy --pass-user-headers forwards the Authentik groups as a
|
|
# comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
|
|
# auth_request-response-only and never reaches a proxied upstream.
|
|
- name: MEDIAMARK_GROUPS_HEADER
|
|
value: X-Forwarded-Groups
|
|
- name: MEDIAMARK_ALLOWED_GROUPS
|
|
value: akP-mediamark-user
|
|
volumeMounts:
|
|
- name: mediastore
|
|
mountPath: /media
|
|
- name: arr-keys
|
|
mountPath: /etc/mediamark/keys
|
|
readOnly: true
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /livez
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 256Mi
|
|
volumes:
|
|
- name: mediastore
|
|
persistentVolumeClaim:
|
|
claimName: mediamark-mediastore
|
|
# Per-app *arr API keys as one file per app under MEDIAMARK_KEYS_DIR,
|
|
# mirroring the arrproxy keys projection.
|
|
- name: arr-keys
|
|
projected:
|
|
sources:
|
|
- secret:
|
|
name: sonarr-apikey
|
|
items:
|
|
- key: apitoken
|
|
path: sonarr
|
|
- secret:
|
|
name: radarr-apikey
|
|
items:
|
|
- key: apitoken
|
|
path: radarr
|
|
restartPolicy: Always
|