use correct loki url

README.md

@@ -40,7 +40,8 @@ kubectl -n <namespace> rollout restart deployment/anyway-backend
 ### CI/CD and credentials
 For the deployment to work, the CI runner needs to authenticate against the kubernetes cluster. This is done by creating a service account in the cluster and providing the CI runner with the necessary credentials through a kubeconfig file. This file is stored as a repository secret `KUBE_CONFIG` and is used by the `kubectl` command in the CI pipeline.
 
-The RBAC configuration for the service included for your reference in the file `rbac.yaml`. 
+The RBAC configuration for the service included for your reference in the file `rbac.yaml`. To use it, extract the token from the secret `deployment-token-secret`.
+Then fill in the token and service account name into the kubeconfig.
 
 
 ### Deployment environments

base/deployment.yaml

@@ -21,12 +21,14 @@ spec:
         ports:
         - containerPort: 8000
         env:
+        - name: MEMCACHED_HOST_PATH
+          value: "memcached:11211"
         - name: NUM_WORKERS
           value: "3"
         - name: OSM_CACHE_DIR
           value: "/osm-cache"
-        - name: MEMCACHED_HOST_PATH
-          value: "memcached:11211"
+        - name: LOKI_URL
+          value: "http://loki.monitoring.svc:3100/loki/api/v1/push"
         volumeMounts:
         - name: osm-cache
           mountPath: /osm-cache

base/kustomization.yaml

@@ -2,7 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - namespace.yaml
+  # - namespace.yaml
   - pvc.yaml
   - deployment.yaml
   - service.yaml

overlays/prod/kustomization.yaml

@@ -4,7 +4,12 @@ kind: Kustomization
 resources:
   - ../../base
 
-namespace: anyway-prod
+namespace: anyway-backend
+nameSuffix: -prod
+labels:
+  - includeSelectors: true
+    pairs:
+      env: prod
 
 images:
   - name: backend-image
@@ -16,3 +21,7 @@ patches:
     target:
       kind: IngressRoute
       name: anyway-ingress
+  - path: patch-deployment-memcached-address.yaml
+    target:
+      kind: Deployment
+      name: anyway-backend

overlays/prod/patch-deployment-memcached-address.yaml

@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/template/spec/containers/0/env/0/value
+  value: "memcached-prod:11211"

overlays/prod/patch-ingress.yaml

@@ -1,3 +1,6 @@
-- op: replace #action 
+- op: replace
   path: /spec/routes/0/match
   value: Host(`anyway.anydev.info`) || Host(`anyway.kluster.moll.re`) 
+- op: replace
+  path: /spec/routes/0/services/0/name
+  value: anyway-backend-prod

overlays/stg/kustomization.yaml

@@ -4,7 +4,13 @@ kind: Kustomization
 resources:
   - ../../base
 
-namespace: anyway-stg
+namespace: anyway-backend
+nameSuffix: -stg
+labels:
+  - includeSelectors: true
+    pairs:
+      env: stg
+
 
 images:
   - name: backend-image
@@ -16,3 +22,12 @@ patches:
     target:
       kind: IngressRoute
       name: anyway-ingress
+  - path: patch-deployment-memcached-address.yaml
+    target:
+      kind: Deployment
+      name: anyway-backend
+  - path: patch-deployment.yaml
+    target:
+      kind: Deployment
+      name: anyway-backend
+

overlays/stg/patch-deployment-memcached-address.yaml

@@ -0,0 +1,3 @@
+- op: replace
+  path: /spec/template/spec/containers/0/env/0/value
+  value: "memcached-stg:11211"

overlays/stg/patch-deployment.yaml

@@ -0,0 +1,5 @@
+- op: add
+  path: /spec/template/spec/containers/0/env/-
+  value:
+    name: DEBUG
+    value: "true"

overlays/stg/patch-ingress.yaml

@@ -1,3 +1,6 @@
 - op: replace #action 
   path: /spec/routes/0/match
   value: Host(`anyway-stg.anydev.info`) || Host(`anyway-stg.kluster.moll.re`) 
+- op: replace
+  path: /spec/routes/0/services/0/name
+  value: anyway-backend-stg

rbac.yaml

@@ -0,0 +1,61 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  namespace: anyway-backend
+  name: deployment-role
+rules:
+- apiGroups:
+    - ""
+    - "apps"
+    - "traefik.io"
+  resources:
+    - pods
+    - services
+    - deployments
+    - ingressroutes
+    - persistentvolumeclaims
+  verbs:
+    - create
+    - delete
+    - deletecollection
+    - get
+    - list
+    - patch
+    - update
+    - watch
+
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: deployment-rolebinding
+  namespace: anyway-backend
+subjects:
+- kind: ServiceAccount
+  name: deployment-sa
+  namespace: anyway-backend
+roleRef:
+  kind: Role
+  name: deployment-role
+  apiGroup: rbac.authorization.k8s.io
+
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: deployment-sa
+  namespace: anyway-backend
+automountServiceAccountToken: false
+
+---
+
+apiVersion: v1
+kind: Secret
+metadata:
+  namespace: anyway-backend
+  name: deployment-token-secret
+  annotations:
+    kubernetes.io/service-account.name: deployment-sa
+type: kubernetes.io/service-account-token