mariadb_v1alpha1_mariadb.yaml

apiVersion: mariadb.mmontes.io/v1alpha1
kind: MariaDB
metadata:
  name: mariadb
spec:
  rootPasswordSecretKeyRef:
    name: mariadb
    key: root-password

  database: mariadb
  username: mariadb
  passwordSecretKeyRef:
    name: mariadb
    key: password

  image:
    repository: mariadb
    tag: "10.11.3"
    pullPolicy: IfNotPresent

  port: 3306

  volumeClaimTemplate:
    resources:
      requests:
        storage: 100Mi
    accessModes:
      - ReadWriteOnce

  volumes: 
    - name: mariadb-persistent-storage
      persistentVolumeClaim:
        claimName: mariadb-pv-claim

  volumeMounts: 
    - name: mariadb-persistent-storage
      mountPath: /

  myCnf: |
    [mysqld]
    bind-address=0.0.0.0
    default_storage_engine=InnoDB
    binlog_format=row
    innodb_autoinc_lock_mode=2
    max_allowed_packet=256M

  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 300m
      memory: 512Mi

  env:
    - name: TZ
      value: SYSTEM

  envFrom:
    - configMapRef:
        name: mariadb

  podSecurityContext:
    runAsUser: 500

  securityContext:
    allowPrivilegeEscalation: false

  livenessProbe:
    exec:
      command:
        - bash
        - -c
        - mysql -u root -p"${MARIADB_ROOT_PASSWORD}" -e "SELECT 1;"
    initialDelaySeconds: 20
    periodSeconds: 10
    timeoutSeconds: 5

  readinessProbe:
    exec:
      command:
        - bash
        - -c
        - mysql -u root -p"${MARIADB_ROOT_PASSWORD}" -e "SELECT 1;"
    initialDelaySeconds: 20
    periodSeconds: 10
    timeoutSeconds: 5

  service:
    type: LoadBalancer
    annotations:
      metallb.universe.tf/loadBalancerIPs: 172.18.0.20
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mariadb-pv-claim
  labels:
    app: mariadb
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: "julian-service-account"
  annotations:
    # cluster name formatting should match this:
    # https://gitlab.appian-stratus.com/appian/prod/clusters/-/blob/2b1616e193193338124fe5cb6414c15cf2f0778c/infrastructure/clusters/modules/sites_cluster_resources/sites_iam.tf#L372
    eks.amazonaws.com/role-arn: arn:aws:iam::{{ .Values.cluster.accountId }}:role/TokenVendingMachineTest_{{ .Values.cluster.name | replace "-" "" }}
automountServiceAccountToken: true
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: tvm-gitlab-runner-permissions
  name: service-runner-permissions:tvm-r:gitlab-runner:privleged-psp
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: eks:podsecuritypolicy:privileged
subjects:
- kind: ServiceAccount
  name: "julian-service-account"