86 lines
1.8 KiB
YAML
86 lines
1.8 KiB
YAML
# kubernetes/mongodb/mongodb.yaml
|
|
apiVersion: v1
|
|
kind: PersistentVolume
|
|
metadata:
|
|
name: mongo-pv
|
|
spec:
|
|
capacity:
|
|
storage: 2Gi
|
|
volumeMode: Filesystem
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
persistentVolumeReclaimPolicy: Retain
|
|
storageClassName: local-storage
|
|
local:
|
|
path: /root/todoApp/kubernetes/mongodb/data
|
|
|
|
nodeAffinity:
|
|
required:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: In
|
|
values:
|
|
- master-controller
|
|
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: mongo
|
|
namespace: todo-app
|
|
spec:
|
|
serviceName: mongo-service # ✅ REQUIRED
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: mongo
|
|
|
|
volumeClaimTemplates:
|
|
- metadata:
|
|
name: mongo-pvc
|
|
spec:
|
|
accessModes: [ "ReadWriteOnce" ]
|
|
storageClassName: local-storage
|
|
resources:
|
|
requests:
|
|
storage: 2Gi
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: mongo
|
|
tier: database # ← label for NetworkPolicy
|
|
spec:
|
|
tolerations:
|
|
- key: "node-role.kubernetes.io/control-plane"
|
|
operator: "Exists"
|
|
effect: "NoSchedule"
|
|
containers:
|
|
- name: mongo
|
|
image: mongo
|
|
ports:
|
|
- containerPort: 27017
|
|
volumeMounts:
|
|
- name: mongo-pvc
|
|
mountPath: /data/db
|
|
# Security — run as non-root
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 999
|
|
allowPrivilegeEscalation: false
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: mongo-service
|
|
namespace: todo-app
|
|
spec:
|
|
clusterIP: None
|
|
selector:
|
|
app: mongo
|
|
ports:
|
|
- port: 27017
|
|
targetPort: 27017
|
|
# ClusterIP — internal only, never exposed outside
|
|
type: ClusterIP
|