Initial commit

apps/gitlab/manifests/redis-cluster.yaml

@@ -0,0 +1,95 @@
+# Redis standalone instance for GitLab (used instead of Sentinel for simplicity)
+# Password auth is required - GitLab reads the password from redis-gitlab-secret
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-gitlab-additional
+  namespace: gitlab
+spec:
+  ports:
+  - port: 6379
+    targetPort: 6379
+    name: redis
+  selector:
+    app: redis-gitlab-standalone
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-gitlab-standalone
+  namespace: gitlab
+spec:
+  ports:
+  - port: 6379
+    targetPort: 6379
+    name: redis
+  selector:
+    app: redis-gitlab-standalone
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: redis-gitlab-standalone
+  namespace: gitlab
+spec:
+  serviceName: redis-gitlab-additional
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis-gitlab-standalone
+  template:
+    metadata:
+      labels:
+        app: redis-gitlab-standalone
+    spec:
+      securityContext:
+        fsGroup: 1000
+      containers:
+      - name: redis
+        image: redis:7.0-alpine
+        securityContext:
+          runAsUser: 999
+          runAsGroup: 1000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+        ports:
+        - containerPort: 6379
+          name: redis
+        command:
+        - sh
+        - -c
+        - redis-server --appendonly yes --requirepass "$REDIS_PASSWORD"
+        env:
+        - name: REDIS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: redis-gitlab-secret
+              key: password
+        resources:
+          requests:
+            cpu: 25m
+            memory: 256Mi
+          limits:
+            memory: 512Mi
+        volumeMounts:
+        - name: data
+          mountPath: /data
+        - name: tmp
+          mountPath: /tmp
+      volumes:
+      - name: tmp
+        emptyDir: {}
+  volumeClaimTemplates:
+  - metadata:
+      name: data
+    spec:
+      accessModes: ["ReadWriteOnce"]
+      storageClassName: rook-ceph-block
+      resources:
+        requests:
+          storage: 5Gi