infra/modules/kubernetes/freshrss/main.tf
Viktor Barzin d345841ef2 [ci skip] Add tier labels to all namespace resources for Kyverno resource governance
Added `tier = var.tier` to kubernetes_namespace labels in ~73 service
modules. This enables Kyverno to generate LimitRange defaults,
ResourceQuotas, and PriorityClass injection for all namespaces.

Previously only 11 namespaces had tier labels; now all 80 active
namespaces are labeled. All pods restarted in rolling waves to pick
up the new policies.
2026-02-21 23:38:05 +00:00

122 lines
2.5 KiB
HCL

variable "tls_secret_name" {}
variable "tier" { type = string }
module "tls_secret" {
source = "../setup_tls_secret"
namespace = "freshrss"
tls_secret_name = var.tls_secret_name
}
resource "kubernetes_namespace" "immich" {
metadata {
name = "freshrss"
labels = {
tier = var.tier
}
}
}
resource "kubernetes_deployment" "freshrss" {
metadata {
name = "freshrss"
namespace = "freshrss"
labels = {
app = "freshrss"
"kubernetes.io/cluster-service" = "true"
tier = var.tier
}
}
spec {
replicas = 1
strategy {
type = "Recreate"
}
selector {
match_labels = {
app = "freshrss"
}
}
template {
metadata {
labels = {
app = "freshrss"
"kubernetes.io/cluster-service" = "true"
}
}
spec {
container {
name = "freshrss"
image = "freshrss/freshrss"
env {
name = "CRON_MIN"
value = "0,30"
}
env {
name = "BASE_URL"
value = "https://rss.viktorbarzin.me"
}
env {
name = "PUBLISHED_PORT"
value = 80
}
volume_mount {
name = "data"
mount_path = "/var/www/FreshRSS/data"
}
volume_mount {
name = "extensions"
mount_path = "/var/www/FreshRSS/extensions"
}
port {
name = "http"
container_port = 80
protocol = "TCP"
}
}
volume {
name = "data"
nfs {
path = "/mnt/main/freshrss/data"
server = "10.0.10.15"
}
}
volume {
name = "extensions"
nfs {
path = "/mnt/main/freshrss/extensions"
server = "10.0.10.15"
}
}
}
}
}
}
resource "kubernetes_service" "freshrss" {
metadata {
name = "freshrss"
namespace = "freshrss"
labels = {
"app" = "freshrss"
}
}
spec {
selector = {
app = "freshrss"
}
port {
port = "80"
target_port = "80"
}
}
}
module "ingress" {
source = "../ingress_factory"
namespace = "freshrss"
name = "rss"
service_name = "freshrss"
tls_secret_name = var.tls_secret_name
}