Add public-samples/trail-project-1-n75ia4/infrastructure/kubernetes/s…

…torage/mongodb.yaml

infrastructure/kubernetes/storage/mongodb.yaml

@@ -0,0 +1,161 @@
+# MongoDB StatefulSet and Service Configuration
+# Version: mongo:6.0
+# Purpose: Highly available document store for Task Management System
+# Dependencies:
+# - Kubernetes: 1.27+
+# - Storage Class: ebs-gp3
+# - Network Policies: allow-backend-to-storage
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mongodb
+  namespace: storage
+  labels:
+    app: mongodb
+    type: persistence
+    component: database
+    tier: storage
+spec:
+  serviceName: mongodb
+  replicas: 3
+  selector:
+    matchLabels:
+      app: mongodb
+      type: persistence
+      component: database
+      tier: storage
+  template:
+    metadata:
+      labels:
+        app: mongodb
+        type: persistence
+        component: database
+        tier: storage
+      annotations:
+        security.kubernetes.io/enforce-pod-security: "true"
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9216"
+    spec:
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+        fsGroupChangePolicy: OnRootMismatch
+      containers:
+      - name: mongodb
+        image: mongo:6.0
+        ports:
+        - containerPort: 27017
+          protocol: TCP
+          name: mongodb
+        env:
+        - name: MONGO_INITDB_ROOT_USERNAME
+          valueFrom:
+            secretKeyRef:
+              name: mongodb-secrets
+              key: root-username
+        - name: MONGO_INITDB_ROOT_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: mongodb-secrets
+              key: root-password
+        resources:
+          requests:
+            cpu: "1000m"
+            memory: "2Gi"
+          limits:
+            cpu: "2000m"
+            memory: "4Gi"
+        volumeMounts:
+        - name: mongodb-data
+          mountPath: /data/db
+        - name: mongodb-config
+          mountPath: /config
+        livenessProbe:
+          exec:
+            command:
+            - mongo
+            - --eval
+            - "db.adminCommand('ping')"
+          initialDelaySeconds: 30
+          periodSeconds: 10
+          timeoutSeconds: 5
+        readinessProbe:
+          exec:
+            command:
+            - mongo
+            - --eval
+            - "db.adminCommand('ping')"
+          initialDelaySeconds: 5
+          periodSeconds: 10
+          timeoutSeconds: 5
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app
+                  operator: In
+                  values:
+                  - mongodb
+              topologyKey: kubernetes.io/hostname
+      terminationGracePeriodSeconds: 60
+  volumeClaimTemplates:
+  - metadata:
+      name: mongodb-data
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      storageClassName: ebs-gp3
+      resources:
+        requests:
+          storage: 50Gi
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongodb
+  namespace: storage
+  labels:
+    app: mongodb
+    type: persistence
+    component: database
+    tier: storage
+spec:
+  selector:
+    app: mongodb
+    type: persistence
+  ports:
+  - port: 27017
+    targetPort: 27017
+    protocol: TCP
+    name: mongodb
+  type: ClusterIP
+  sessionAffinity: ClientIP
+  sessionAffinityConfig:
+    clientIP:
+      timeoutSeconds: 10800
+
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: mongodb-pdb
+  namespace: storage
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: mongodb
+      type: persistence