Image: mikirisec/mikiri-waf-api. Claim mount: /mikiri-waf-api. Service port: 8080.
The first start leaves Nginx running and does not start the API. The API starts on the next start, after settings.py points at PostgreSQL. The database is created in Deploying PostgreSQL in Kubernetes. The namespace and the first-start rule are in Kubernetes.
first-launch. The Pod stays running, because this image leaves Nginx up.kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mikiri-waf-api
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 16Gi
---
apiVersion: v1
kind: Pod
metadata:
name: mikiri-waf-api-first
labels:
app: mikiri-waf-api-first
spec:
restartPolicy: Never
initContainers:
- name: first-launch
image: mikirisec/mikiri-waf-api:latest
command: ["touch", "/mikiri-waf-api/first-launch"]
volumeMounts:
- name: data
mountPath: /mikiri-waf-api
containers:
- name: api
image: mikirisec/mikiri-waf-api:latest
ports:
- containerPort: 8080
volumeMounts:
- name: data
mountPath: /mikiri-waf-api
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-api
---
apiVersion: v1
kind: Service
metadata:
name: mikiri-waf-api
spec:
selector:
app: mikiri-waf-api
ports:
- port: 8080
targetPort: 8080
EOF
kubectl wait -n mikiri-waf --for=condition=ready pod/mikiri-waf-api-first --timeout=180s
kubectl exec -n mikiri-waf mikiri-waf-api-first -c api -- bash -c 'while [ -f /mikiri-waf-api/first-launch ]; do sleep 1; done'
The entrypoint copies settings.py, the Nginx configuration and the log directories into the claim, then deletes first-launch. The second command returns after that file is gone, so settings.py is on the claim before the next step. settings.py is created with mode 0555. The Service selects the Deployment from the last step, so it has no endpoints yet.
The Pod has the init container first-launch and the container api. -c api runs the command in api. Without it, kubectl writes Defaulted container "api" out of: api, first-launch (init).
kubectl exec -n mikiri-waf mikiri-waf-api-first -c api -- chmod u+w /mikiri-waf-api/settings.py
kubectl exec -n mikiri-waf mikiri-waf-api-first -c api -- sed -i \
-e "s|^DB_HOST.*|DB_HOST = 'mikiri-waf-db'|" \
-e "s|^DB_PORT.*|DB_PORT = '5432'|" \
-e "s|^DB_NAME.*|DB_NAME = 'api'|" \
-e "s|^DB_USER.*|DB_USER = 'api'|" \
-e "s|^DB_PASS.*|DB_PASS = 'YOUR_PASSWORD'|" \
/mikiri-waf-api/settings.py
YOUR_PASSWORD is the password of the api role created for PostgreSQL. The generated settings.py already contains these names. The same fields are set in Deploying Mikiri WAF API Docker container. To change another line, including one that is commented, use the command in Editing a file in the container.
first-launch is already gone, so this start runs mikiri-waf-api and mikiri-waf-api-aux.kubectl delete pod mikiri-waf-api-first -n mikiri-waf --wait=true
kubectl apply -n mikiri-waf -f - <<'EOF'
apiVersion: apps/v1
kind: Deployment
metadata:
name: mikiri-waf-api
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: mikiri-waf-api
template:
metadata:
labels:
app: mikiri-waf-api
spec:
containers:
- name: api
image: mikirisec/mikiri-waf-api:latest
ports:
- containerPort: 8080
volumeMounts:
- name: data
mountPath: /mikiri-waf-api
volumes:
- name: data
persistentVolumeClaim:
claimName: mikiri-waf-api
EOF
kubectl rollout status deployment/mikiri-waf-api -n mikiri-waf
Logs are written to /mikiri-waf-api/log/mikiri-waf/ in the container.
| On the claim | In the container | Contents |
|---|---|---|
settings.py |
/var/www/mikiri-waf-api/settings.py |
Main configuration |
conf.d/ |
/etc/nginx/conf.d/ |
Server and upstream configuration |
snippets/ |
/etc/nginx/snippets/ |
Custom includes |
log/mikiri-waf/ |
/var/log/mikiri-waf/ |
API and auxiliary logs |
A claim that still has nginx/mikiri-waf-api.conf is migrated into conf.d/ on start. init.py is always taken from the image.
kubectl rollout restart deployment/mikiri-waf-api -n mikiri-waf
kubectl rollout status deployment/mikiri-waf-api -n mikiri-waf
Do not create first-launch again. If the package version changed, the previous claim contents are copied to old/. The working files stay in place.