Add Go demo with isolated CI and manual production release

config/dev/ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: demo-dev
+  namespace: platform-dev
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: demo-test.5dev.cn
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: demo-dev
+                port:
+                  name: http

config/dev/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service.yaml
+  - ingress.yaml

config/dev/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: demo-dev
+  namespace: platform-dev
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: dev
+  ports:
+    - name: http
+      port: 80
+      targetPort: 18080
+      protocol: TCP

config/dev/supervisor.ini

@@ -0,0 +1,12 @@
+[program:demo]
+directory=/dm/service/project/demo/src
+command=/usr/local/go/bin/go run .
+environment=PORT="18080"
+autostart=true
+autorestart=unexpected
+stopasgroup=true
+killasgroup=true
+redirect_stderr=true
+stdout_logfile=/work/log/demo.log
+stdout_logfile_maxbytes=10MB
+stdout_logfile_backups=3

config/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: project-demo
+  labels:
+    app.kubernetes.io/part-of: demo

config/prod/deployment.yaml

@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: demo
+  namespace: project-demo
+spec:
+  replicas: 0
+  revisionHistoryLimit: 5
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: demo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: demo
+    spec:
+      automountServiceAccountToken: false
+      nodeSelector:
+        kubernetes.io/hostname: shemic
+      imagePullSecrets:
+        - name: demo-registry-pull
+      terminationGracePeriodSeconds: 15
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: demo
+          image: git.dever.cc/demo-ci/demo:bootstrap
+          imagePullPolicy: Always
+          env:
+            - name: PORT
+              value: '8080'
+          ports:
+            - name: http
+              containerPort: 8080
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: [ALL]
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              cpu: 250m
+              memory: 64Mi
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            periodSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 10

config/prod/ingress.yaml

@@ -0,0 +1,20 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: demo
+  namespace: project-demo
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: demo.5dev.cn
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: demo
+                port:
+                  name: http

config/prod/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - networkpolicy.yaml
+  - rbac.yaml

config/prod/networkpolicy.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: demo
+  namespace: project-demo
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: demo
+  policyTypes: [Ingress, Egress]
+  egress: []
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: kube-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+      ports:
+        - protocol: TCP
+          port: 8080

config/prod/rbac.yaml

@@ -0,0 +1,24 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: demo-release
+  namespace: project-demo
+rules:
+  - apiGroups: [apps]
+    resources: [deployments]
+    resourceNames: [demo]
+    verbs: [get, watch, patch]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: demo-release
+  namespace: project-demo
+subjects:
+  - kind: ServiceAccount
+    name: demo-deployer
+    namespace: platform-ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: demo-release

config/prod/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: demo
+  namespace: project-demo
+spec:
+  selector:
+    app.kubernetes.io/name: demo
+  ports:
+    - name: http
+      port: 80
+      targetPort: http