k8s.yaml

##  __  __            _       ____  ____
## |  \/  | __ _ _ __(_) __ _|  _ \| __ )
## | |\/| |/ _` | '__| |/ _` | | | |  _ \
## | |  | | (_| | |  | | (_| | |_| | |_) |
## |_|  |_|\__,_|_|  |_|\__,_|____/|____/
## 

## https://mariadb.org/ + https://github.com/MariaDB/server
## https://hub.docker.com/_/mariadb + https://github.com/MariaDB/mariadb-docker
## https://hub.docker.com/r/tobi312/rpi-mariadb/ + https://github.com/Tob1as/docker-mariadb

## https://kubernetes.io/docs/tasks/run-application/run-single-instance-stateful-application/

## root login?
## [DE] https://kofler.info/root-login-problem-mit-mariadb/ + https://www.linuxmaker.com/tutorials/mariadb-problem-mit-root-login.html
## [EN] https://community.flexera.com/t5/Software-Vulnerability-Manager/Grant-Remote-Access-to-Root-in-MariaDB-On-Prem/ta-p/4967

## reset pw: https://linuxconfig.org/how-to-reset-root-mysql-mariadb-password-on-ubuntu-20-04-focal-fossa-linux

---

## volume
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: mariadb-data
  namespace: default
  labels:
    app: mariadb
spec:
  accessModes:
  - ReadWriteOnce
  volumeMode: Filesystem
  storageClassName: local-path # https://github.com/rancher/local-path-provisioner
  resources:
    requests:
      storage: 25Gi

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: mariadb-env-config
  namespace: default
  labels:
    app: mariadb
data:
  TZ: "Europe/Berlin"
  MARIADB_DATABASE: user-database
  #MARIADB_RANDOM_ROOT_PASSWORD: "yes"
  MARIADB_MYSQL_LOCALHOST_USER: "true"

---

## convert string to base64 in Linux: "echo -n 'value' | base64"

apiVersion: v1
kind: Secret
metadata:
  name: mariadb-env-secret
  namespace: default
  labels:
    app: mariadb
data:
  MARIADB_ROOT_PASSWORD: bXktc2VjcmV0LXB3              # my-secret-pw
  MARIADB_USER: ZXhhbXBsZS11c2Vy                       # example-user
  MARIADB_PASSWORD: bXlfY29vbF9zZWNyZXQ=               # my_cool_secret
  MARIADB_EXPORTER_PASSWORD: dDlzRFNwTjMjOWdEUVZSYQ==  # t9sDSpN3#9gDQVRa

---

apiVersion: apps/v1
kind: Deployment
metadata:
  name: mariadb
  namespace: default
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: mariadb
  template:
    metadata:
      labels:
        app: mariadb
      annotations: {}
    spec:
      containers:
        - name: mariadb
          #image: mariadb:10.6
          image: tobi312/rpi-mariadb:10.6-alpine
          imagePullPolicy: Always
          envFrom:
          - configMapRef:
              name: mariadb-env-config
          - secretRef:
              name: mariadb-env-secret
          ports:
            - containerPort: 3306
          command: ["/bin/sh", "-c", "echo \"SET GLOBAL time_zone = '$(TZ)'; SET time_zone = '$(TZ)'; SELECT CURRENT_TIME; CREATE USER IF NOT EXISTS 'exporter'@'%' IDENTIFIED BY '$(MARIADB_EXPORTER_PASSWORD)' WITH MAX_USER_CONNECTIONS 3; GRANT PROCESS, REPLICATION CLIENT, SELECT ON *.* TO 'exporter'@'%'; \" > /docker-entrypoint-initdb.d/init.sql; /usr/local/bin/docker-entrypoint.sh --character-set-server=utf8mb4 --collation-server=utf8mb4_unicode_ci"]
          readinessProbe:
            exec:
              command: ["/bin/sh", "-c", "mysqladmin ping -h localhost --user=$MARIADB_USER --password=$MARIADB_PASSWORD || exit 1"]
            #tcpSocket:
            #  port: 3306
            initialDelaySeconds: 15
            periodSeconds: 120
            timeoutSeconds: 5
          livenessProbe:
            exec:
              command: ["/bin/sh", "-c", "mysqladmin ping -h localhost --user=$MARIADB_USER --password=$MARIADB_PASSWORD || exit 1"]
            #tcpSocket:
            #  port: 3306
            initialDelaySeconds: 30
            periodSeconds: 120
            timeoutSeconds: 5
          resources:
            requests:
              memory: "256Mi"
              cpu: "0.5"
            limits:
              memory: "1Gi"
              cpu: "1.0"
          volumeMounts:
          - name: mariadb-data
            mountPath: /var/lib/mysql
          - name: mariadb-db-file-config
            mountPath: /etc/my.cnf.d/99-my.cnf # for offical image use: /etc/mysql/mariadb.conf.d/99-my.cnf
            subPath: 99-my.cnf
        - name: exporter
          image: prom/mysqld-exporter:latest
          imagePullPolicy: Always
          ports:
          - containerPort: 9104
          env:
          - name: EXPORTER_PASSWORD
            valueFrom:
              secretKeyRef:
                name: mariadb-env-secret
                key: MARIADB_EXPORTER_PASSWORD
          - name: DATA_SOURCE_NAME
            value: "exporter:$(EXPORTER_PASSWORD)@(localhost:3306)/"
          args: ["--web.listen-address", ":9104", "--web.telemetry-path", "/metrics"]
          resources:
            requests:
              memory: "64Mi"
              cpu: "0.1"
            limits:
              memory: "256Mi"
              cpu: "0.5"
      restartPolicy: Always
      serviceAccountName: ""
      volumes:
        - name: mariadb-data
          persistentVolumeClaim:
            claimName: mariadb-data
        - name: mariadb-db-file-config
          configMap:
            name: mariadb-db-file-config

---

apiVersion: v1
kind: Service
metadata:
  name: mariadb
  namespace: default
  labels:
    app: mariadb
spec:
  type: ClusterIP    # default: "ClusterIP" , set to "NodePort" for access over external-ip
  ports:
    - name: "mariadb"
      protocol: TCP
      port: 3306
      targetPort: 3306
      #nodePort: 33306
    - name: "mariadb-exporter"
      protocol: TCP
      port: 9104
      targetPort: 9104
  selector:
    app: mariadb

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: mariadb-db-file-config
  namespace: default
  labels:
    app: mariadb
data:
  99-my.cnf: |-
    [mysqld]
    skip-host-cache
    skip-name-resolve