k8s optimization

apply.sh

@@ -3,6 +3,9 @@
 ## install nginx ingress controller grafana dashboards
 # https://github.com/kubernetes/ingress-nginx/tree/master/deploy/grafana/dashboards
 
+# in order to pull private docker image
+kubectl create secret docker-registry regcred --docker-server=https://docker.pkg.github.com --docker-username=wahyd4 --docker-password=344f51a3979759788914088c8bfe87736ffefb5b --docker-email=wahyd4@gmail.com
+
 kubectl -n kube-system apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
 
 k apply -f prometheus-pv.yml -n default
@@ -56,8 +59,9 @@ k apply -f pihole-pv.yaml -n home-apps
 
 kubectl -n home-apps create secret generic pihole-admin-password --from-literal=webpassword=Uj2s3iUkRubkJs4
 
-helm upgrade --install telegraf -f telegraf-values.yaml  stable/telegraf -n home-apps
+ k apply -f pihole.yaml -n home-apps
 
+helm upgrade --install telegraf -f telegraf-values.yaml  stable/telegraf -n home-apps
 
 ### level=error ts=2020-06-25T14:19:22.581Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="/app/discovery/kubernetes/kubernetes.go:263: Failed to list *v1.Pod: pods is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"pods\" in API group \"\" in the namespace \"home-apps\""
 # https://github.com/coreos/prometheus-operator/blob/master/Documentation/user-guides/getting-started.md

media.yaml

@@ -27,7 +27,7 @@ spec:
             type: Directory
       containers:
         - name: sonarr
-          image: linuxserver/sonarr
+          image: linuxserver/sonarr@sha256:5f2be8adff5048623434f37846fb54b29c936291a84f8e6021a75683012042de
           securityContext:
             runAsUser: 0
           imagePullPolicy: Always
@@ -350,6 +350,13 @@ spec:
             limits:
               cpu: 200m
               memory: 300Mi
+          livenessProbe:
+            exec:
+              command:
+              - curl
+              - 1.1.1.1
+            initialDelaySeconds: 120
+            periodSeconds: 300
 
 ---
 apiVersion: v1
@@ -521,8 +528,8 @@ spec:
       containers:
         - name: files
           image: wahyd4/aria2-ui:latest
-          securityContext:
-            runAsUser: 0
+          # securityContext:
+          #   runAsUser: 1000
           imagePullPolicy: Always
           ports:
             - containerPort: 80
@@ -616,8 +623,8 @@ spec:
       containers:
         - name: books
           image: bixidock/h5ai
-          securityContext:
-            runAsUser: 0
+          # securityContext:
+          #   runAsUser: 1000
           imagePullPolicy: Always
           ports:
             - containerPort: 8080

pihole.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: pihole
-          image: pihole/pihole:latest
+          image: pihole/pihole@sha256:e75e3166398cf070a94ce8b1a922b40bca29bd3afb2e7ab1dbecf356a2717917
           imagePullPolicy: Always
           ports:
             - containerPort: 80
@@ -56,10 +56,10 @@ spec:
               mountPath: "/etc/dnsmasq.d"
           resources:
             requests:
-              cpu: 100m
+              cpu: 50m
               memory: 200Mi
             limits:
-              cpu: 200m
+              cpu: 100m
               memory: 400Mi
       volumes:
       - name: pihole-local-etc-volume

prometheus-values.yaml

@@ -24,10 +24,10 @@ prometheus:
           accessModes: ["ReadWriteOnce"]
     resources:
       requests:
-        cpu: 900m
+        cpu: 800m
         memory: 2000Mi
       limits:
-        cpu: 1400m
+        cpu: 1200m
         memory: 3000Mi
     securityContext:
       runAsGroup: 1000