From da00bc5842d6d3eb5185c821189d85ab3afed6df Mon Sep 17 00:00:00 2001
From: Junwei Zhao <wahyd4@gmail.com>
Date: Wed, 22 Jul 2020 22:59:17 +1000
Subject: [PATCH] k8s optimization

---
 apply.sh               |  6 +++++-
 media.yaml             | 17 ++++++++++++-----
 pihole.yaml            |  6 +++---
 prometheus-values.yaml |  4 ++--
 4 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/apply.sh b/apply.sh
index d49a710..b7a0442 100755
--- a/apply.sh
+++ b/apply.sh
@@ -3,6 +3,9 @@
 ## install nginx ingress controller grafana dashboards
 # https://github.com/kubernetes/ingress-nginx/tree/master/deploy/grafana/dashboards
 
+# in order to pull private docker image
+kubectl create secret docker-registry regcred --docker-server=https://docker.pkg.github.com --docker-username=wahyd4 --docker-password=344f51a3979759788914088c8bfe87736ffefb5b --docker-email=wahyd4@gmail.com
+
 kubectl -n kube-system apply -f https://raw.githubusercontent.com/coreos/flannel/master/Documentation/kube-flannel.yml
 
 k apply -f prometheus-pv.yml -n default
@@ -56,8 +59,9 @@ k apply -f pihole-pv.yaml -n home-apps
 
 kubectl -n home-apps create secret generic pihole-admin-password --from-literal=webpassword=Uj2s3iUkRubkJs4
 
-helm upgrade --install telegraf -f telegraf-values.yaml  stable/telegraf -n home-apps
+ k apply -f pihole.yaml -n home-apps
 
+helm upgrade --install telegraf -f telegraf-values.yaml  stable/telegraf -n home-apps
 
 ### level=error ts=2020-06-25T14:19:22.581Z caller=klog.go:94 component=k8s_client_runtime func=ErrorDepth msg="/app/discovery/kubernetes/kubernetes.go:263: Failed to list *v1.Pod: pods is forbidden: User \"system:serviceaccount:default:default\" cannot list resource \"pods\" in API group \"\" in the namespace \"home-apps\""
 # https://github.com/coreos/prometheus-operator/blob/master/Documentation/user-guides/getting-started.md
diff --git a/media.yaml b/media.yaml
index 8788c91..cd77caa 100644
--- a/media.yaml
+++ b/media.yaml
@@ -27,7 +27,7 @@ spec:
             type: Directory
       containers:
         - name: sonarr
-          image: linuxserver/sonarr
+          image: linuxserver/sonarr@sha256:5f2be8adff5048623434f37846fb54b29c936291a84f8e6021a75683012042de
           securityContext:
             runAsUser: 0
           imagePullPolicy: Always
@@ -350,6 +350,13 @@ spec:
             limits:
               cpu: 200m
               memory: 300Mi
+          livenessProbe:
+            exec:
+              command:
+              - curl
+              - 1.1.1.1
+            initialDelaySeconds: 120
+            periodSeconds: 300
 
 ---
 apiVersion: v1
@@ -521,8 +528,8 @@ spec:
       containers:
         - name: files
           image: wahyd4/aria2-ui:latest
-          securityContext:
-            runAsUser: 0
+          # securityContext:
+          #   runAsUser: 1000
           imagePullPolicy: Always
           ports:
             - containerPort: 80
@@ -616,8 +623,8 @@ spec:
       containers:
         - name: books
           image: bixidock/h5ai
-          securityContext:
-            runAsUser: 0
+          # securityContext:
+          #   runAsUser: 1000
           imagePullPolicy: Always
           ports:
             - containerPort: 8080
diff --git a/pihole.yaml b/pihole.yaml
index 1b2fe17..683449e 100644
--- a/pihole.yaml
+++ b/pihole.yaml
@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: pihole
-          image: pihole/pihole:latest
+          image: pihole/pihole@sha256:e75e3166398cf070a94ce8b1a922b40bca29bd3afb2e7ab1dbecf356a2717917
           imagePullPolicy: Always
           ports:
             - containerPort: 80
@@ -56,10 +56,10 @@ spec:
               mountPath: "/etc/dnsmasq.d"
           resources:
             requests:
-              cpu: 100m
+              cpu: 50m
               memory: 200Mi
             limits:
-              cpu: 200m
+              cpu: 100m
               memory: 400Mi
       volumes:
       - name: pihole-local-etc-volume
diff --git a/prometheus-values.yaml b/prometheus-values.yaml
index 79bb7a9..aaa95dc 100644
--- a/prometheus-values.yaml
+++ b/prometheus-values.yaml
@@ -24,10 +24,10 @@ prometheus:
           accessModes: ["ReadWriteOnce"]
     resources:
       requests:
-        cpu: 900m
+        cpu: 800m
         memory: 2000Mi
       limits:
-        cpu: 1400m
+        cpu: 1200m
         memory: 3000Mi
     securityContext:
       runAsGroup: 1000