Deploy achievement-safe Factorio 2.0.77 with strict placement, monitoring and limited CD

factorio.yaml

@@ -0,0 +1,261 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: factorio
+  namespace: factorio
+  labels: &id001
+    app.kubernetes.io/name: factorio
+spec:
+  replicas: 1
+  revisionHistoryLimit: 5
+  progressDeadlineSeconds: 1800
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels: *id001
+  template:
+    metadata:
+      labels: *id001
+    spec:
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 180
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+        fsGroup: 845
+        fsGroupChangePolicy: OnRootMismatch
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - arschrock
+      tolerations:
+      - key: node-role.kubernetes.io/control-plane
+        operator: Exists
+        effect: NoSchedule
+      - key: node.kubernetes.io/not-ready
+        operator: Exists
+        effect: NoExecute
+        tolerationSeconds: 300
+      - key: node.kubernetes.io/unreachable
+        operator: Exists
+        effect: NoExecute
+        tolerationSeconds: 300
+      containers:
+      - name: factorio
+        image: docker.io/factoriotools/factorio:2.0.77
+        command:
+        - /scripts/start.sh
+        env:
+        - name: TZ
+          value: Europe/Vienna
+        - name: DLC_SPACE_AGE
+          value: 'false'
+        ports:
+        - name: game-udp
+          containerPort: 34197
+          protocol: UDP
+        - name: rcon
+          containerPort: 27015
+        startupProbe:
+          exec: &id002
+            command:
+            - /scripts/health.sh
+          periodSeconds: 15
+          timeoutSeconds: 10
+          failureThreshold: 80
+        readinessProbe:
+          exec: *id002
+          periodSeconds: 15
+          timeoutSeconds: 10
+          failureThreshold: 4
+        livenessProbe:
+          exec: *id002
+          periodSeconds: 30
+          timeoutSeconds: 10
+          failureThreshold: 10
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - /bin/sh
+              - -c
+              - timeout 90 rcon /server-save || true
+        resources:
+          requests:
+            cpu: '1'
+            memory: 2Gi
+            ephemeral-storage: 256Mi
+          limits:
+            memory: 12Gi
+            ephemeral-storage: 2Gi
+        securityContext:
+          allowPrivilegeEscalation: false
+        volumeMounts:
+        - name: data
+          mountPath: /factorio
+        - name: scripts
+          mountPath: /scripts
+          readOnly: true
+        - name: settings
+          mountPath: /settings
+          readOnly: true
+        - name: credentials
+          mountPath: /credentials
+          readOnly: true
+      - name: player-collector
+        image: factorio-image-from-server
+        command:
+        - /scripts/collect.sh
+        env:
+        - name: CONFIG
+          value: /factorio/config
+        startupProbe:
+          exec: &id003
+            command:
+            - /scripts/collector-health.sh
+          periodSeconds: 15
+          timeoutSeconds: 5
+          failureThreshold: 12
+        readinessProbe: &id004
+          exec: *id003
+          periodSeconds: 15
+          timeoutSeconds: 5
+          failureThreshold: 3
+        livenessProbe: *id004
+        resources:
+          requests:
+            cpu: 10m
+            memory: 16Mi
+          limits:
+            memory: 64Mi
+        securityContext: &id007
+          allowPrivilegeEscalation: false
+          runAsNonRoot: true
+          runAsUser: 845
+          runAsGroup: 845
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        volumeMounts:
+        - name: scripts
+          mountPath: /scripts
+          readOnly: true
+        - name: rcon-collector
+          mountPath: /factorio/config
+          readOnly: true
+        - name: metrics
+          mountPath: /metrics
+      - name: exporter
+        image: docker.io/prom/node-exporter:v1.10.2
+        args:
+        - --web.listen-address=:9772
+        - --collector.disable-defaults
+        - --collector.textfile
+        - --collector.textfile.directory=/metrics
+        ports:
+        - name: metrics
+          containerPort: 9772
+        startupProbe:
+          httpGet: &id005
+            path: /
+            port: metrics
+          periodSeconds: 15
+          timeoutSeconds: 5
+          failureThreshold: 12
+        readinessProbe: &id006
+          httpGet: *id005
+          periodSeconds: 15
+          timeoutSeconds: 5
+          failureThreshold: 3
+        livenessProbe: *id006
+        resources:
+          requests:
+            cpu: 10m
+            memory: 24Mi
+          limits:
+            memory: 128Mi
+        securityContext: *id007
+        volumeMounts:
+        - name: metrics
+          mountPath: /metrics
+          readOnly: true
+      volumes:
+      - name: data
+        persistentVolumeClaim:
+          claimName: factorio-data
+      - name: scripts
+        configMap:
+          name: factorio-scripts
+          defaultMode: 365
+      - name: settings
+        configMap:
+          name: factorio-settings
+      - name: credentials
+        secret:
+          secretName: factorio-runtime
+          defaultMode: 256
+      - name: metrics
+        emptyDir:
+          sizeLimit: 16Mi
+      - name: rcon-collector
+        secret:
+          secretName: factorio-runtime
+          defaultMode: 288
+          items:
+          - key: rcon-password
+            path: rconpw
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: factorio-data
+  namespace: factorio
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 16Gi
+  storageClassName: rook-ceph-block
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: factorio
+  namespace: factorio
+  labels: &id001
+    app.kubernetes.io/name: factorio
+  annotations:
+    mikrotik.brunner.ninja/router: newgw
+    mikrotik.brunner.ninja/forwardings: '[{"name":"game-udp","servicePort":"game-udp","dstAddressList":"WANs"}]'
+spec:
+  type: LoadBalancer
+  loadBalancerIP: 192.168.0.17
+  ports:
+  - name: game-udp
+    port: 34197
+    targetPort: game-udp
+    protocol: UDP
+  selector: *id001
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: factorio-metrics
+  namespace: factorio
+  labels:
+    app.kubernetes.io/name: factorio
+    app.kubernetes.io/component: metrics
+spec:
+  ports:
+  - name: metrics
+    port: 9772
+    targetPort: metrics
+  selector:
+    app.kubernetes.io/name: factorio