ravendb-eks-cluster.yaml

apiVersion: v1
kind: Namespace
metadata:
  labels:
    app.kubernetes.io/name: ravendb
  name: ravendb
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: ebs-sc
provisioner: ebs.csi.aws.com
volumeBindingMode: WaitForFirstConsumer
parameters:
  csi.storage.k8s.io/fstype: xfs
  type: io1
  iopsPerGB: "50"
  encrypted: "true"
allowedTopologies:
- matchLabelExpressions:
  - key: topology.kubernetes.io/zone
    values:
    - us-east-1a
    - us-east-1b
---
apiVersion: v1
kind: Secret
metadata:
  name: ravendb-certs
  namespace: ravendb
type: Opaque
data: # todo: your base64 encoded .pfx certificates go here
  a.pfx: |-
    xxx   
  b.pfx: |-
    xxx
  c.pfx: |-
    xxx    
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ravendb-scripts
  namespace: ravendb
  labels:
    app.kubernetes.io/name: ravendb
data:
  get-server-cert.sh: |
    #!/bin/bash

    # get node tag
    node_tag="$(env | grep HOSTNAME | cut -f 2 -d '-')"

    # print .pfx
    cat -u /ravendb/certs/"$node_tag".pfx
    exit

  update-cert.sh:  |
    #!/bin/bash

    function update_secret {
        # read stdin
        echo "Reading certificate from stdin..."
        read -re new_cert
        
        # install depts
        echo "Updating OS..."
        apt-get update -qq
        echo "Installing curl sudo and jq..."
        apt-get install curl sudo jq -qq

        # install kubectl

        echo "Installing kubectl..."
        cd /usr || exit
        mkdir kubectl
        cd kubectl || exit
        curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
        sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

        # get node tag
        echo "Getting node tag from HOSTNAME environmental:..."
        node_tag="$(env | grep HOSTNAME | cut -f 2 -d '-')"
        echo "Node tag: $node_tag"
        
        previous_content=$(cat /ravendb/certs/"$node_tag".pfx)
        # update secret
        echo "Updating sever certificate on node $node_tag by updating ravendb-certs secret"
        kubectl get secret ravendb-certs -o json -n ravendb | jq ".data[\"$node_tag.pfx\"]=\"$new_cert\"" | kubectl apply -f -

        content=$(cat "/ravendb/certs/$node_tag.pfx")

        if [[ $previous_content == "$content" ]]; then
            echo "ERROR: The updated certificate (mounted secret path) is identical to the previous one..."
            exit 111
        fi
    }

    update_secret >> /var/log/ravendb-cert-update-logs
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: modify-config
  namespace: ravendb
  labels:
    app.kubernetes.io/name: ravendb
rules:
  - apiGroups: [""]
    resources:
      - secrets
    verbs:
      - get
      - patch
---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: ravendb
  name: modify-config
  labels:
    app.kubernetes.io/name: ravendb
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: modify-config
  namespace: ravendb
  labels:
    app.kubernetes.io/name: ravendb

subjects:
  - kind: ServiceAccount
    name: modify-config
    namespace: ravendb
roleRef:
  kind: Role
  name: modify-config
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Service
metadata:
  name: "ravendb-a"
  namespace: ravendb
  labels:
    app.kubernetes.io/name: ravendb
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"  # Ensure it's an NLB
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"  # Public NLB
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"  # Direct traffic to pod IPs
spec:
  type: LoadBalancer
  ports:
  - port: 4443
    name: https
  - port: 38888
    protocol: TCP
    name: tcp
  selector:
    nodeTag: a
---
apiVersion: v1
kind: Service
metadata:
  name: "ravendb-b"
  namespace: ravendb
  labels:
    app.kubernetes.io/name: ravendb
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"  # Ensure it's an NLB
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"  # Public NLB
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"  # Direct traffic to pod IPs
spec:
  type: LoadBalancer
  ports:
  - port: 4443
    name: https
  - port: 38888
    protocol: TCP
    name: tcp
  selector:
    nodeTag: b
---
apiVersion: v1
kind: Service
metadata:
  name: "ravendb-c"
  namespace: ravendb
  labels:
    app.kubernetes.io/name: ravendb
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-type: "nlb"  # Ensure it's an NLB
    service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"  # Public NLB
    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"  # Direct traffic to pod IPs  
spec:
  type: LoadBalancer
  ports:
  - port: 4443
    name: https
  - port: 38888
    protocol: TCP
    name: tcp
  selector:
    nodeTag: c
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ravendb-claim-a
  namespace: ravendb
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: ebs-sc
  resources:
    requests:
      storage: 5Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ravendb-claim-b
  namespace: ravendb
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: ebs-sc
  resources:
    requests:
      storage: 5Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ravendb-claim-c
  namespace: ravendb
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: ebs-sc
  resources:
    requests:
      storage: 5Gi
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: "ravendb-a"
  namespace: ravendb
  annotations: 
    ingress.kubernetes.io/ssl-passthrough: "true"
  labels:
    app.kubernetes.io/name: ravendb
    nodeTag: "a"
spec:
  selector:
    matchLabels:
      nodeTag: a
  serviceName: "ravendb-a"
  replicas: 1
  template:
    metadata:
      namespace: ravendb
      labels:
        nodeTag: a
    spec:
      serviceAccountName: modify-config
      initContainers:
      - name: init-volume-permissions
        image: busybox
        command: ['sh', '-c', 'chown -R 999:999 /var/lib/ravendb/data && chmod -R 0755 /var/lib/ravendb/data']
        volumeMounts:
        - name: ravendb-storage-a
          mountPath: /var/lib/ravendb/data
      containers:
      - name: ravendb-container
        image: "ravendb/ravendb:latest"
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 4443
          name: https
        - containerPort: 38888
          name: tcp
          protocol: TCP

        env:
        - name: RAVEN_Setup_Mode
          value: "None"
        - name: RAVEN_ServerUrl
          value: "https://0.0.0.0:4443"
        - name: RAVEN_ServerUrl_Tcp
          value: "tcp://0.0.0.0:38888"
        - name: RAVEN_PublicServerUrl
          value: "" # todo: your domain goes here
        - name: RAVEN_License # todo: your RavenDB licenense goes here
          value:  |
            xxx
        - name: RAVEN_Security_Certificate_Load_Exec
          value: "/ravendb/scripts/get-server-cert.sh"
        - name: RAVEN_Security_Certificate_Exec_TimeoutInSec
          value: "15"
        - name: RAVEN_Security_Certificate_Change_Exec
          value: "/ravendb/scripts/update-cert.sh"

        volumeMounts:
          - name: "ravendb-storage-a"
            mountPath: /var/lib/ravendb/data
          - name: ravendb-scripts
            mountPath: /ravendb/scripts
          - name: ravendb-certs
            mountPath: /ravendb/certs

      volumes:
        - name: ravendb-storage-a
          persistentVolumeClaim:
            claimName: ravendb-claim-a
        - name: ravendb-scripts
          configMap:
            name: ravendb-scripts
            defaultMode: 0755
        - name: ravendb-certs
          secret:
            secretName: ravendb-certs
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: "ravendb-b"
  namespace: ravendb
  annotations: 
    ingress.kubernetes.io/ssl-passthrough: "true"
  labels:
    app.kubernetes.io/name: ravendb
    nodeTag: "b"
spec:
  selector:
    matchLabels:
      nodeTag: b
  serviceName: "ravendb-b"
  replicas: 1
  template:
    metadata:
      namespace: ravendb
      labels:
        nodeTag: b
    spec:
      serviceAccountName: modify-config
      initContainers:
      - name: init-volume-permissions
        image: busybox
        command: ['sh', '-c', 'chown -R 999:999 /var/lib/ravendb/data && chmod -R 0755 /var/lib/ravendb/data']
        volumeMounts:
        - name: ravendb-storage-b
          mountPath: /var/lib/ravendb/data
      containers:
      - name: ravendb-container
        image: "ravendb/ravendb:latest"
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 443
          name: https
        - containerPort: 38888
          name: tcp
          protocol: TCP


        env:
        - name: RAVEN_ServerUrl
          value: "https://0.0.0.0:4443"
        - name: RAVEN_ServerUrl_Tcp
          value: "tcp://0.0.0.0:38888"
        - name: RAVEN_Setup_Mode
          value: "None"
        - name: RAVEN_PublicServerUrl
          value: "" # todo: your domain goes here
        - name: RAVEN_License # todo: your RavenDB license goes here
          value:  |
            xxxx
        - name: RAVEN_Security_Certificate_Load_Exec
          value: "/ravendb/scripts/get-server-cert.sh"
        - name: RAVEN_Security_Certificate_Exec_TimeoutInSec
          value: "15"
        - name: RAVEN_Security_Certificate_Change_Exec
          value: "/ravendb/scripts/update-cert.sh"

        volumeMounts:
          - name: "ravendb-storage-b"
            mountPath: /var/lib/ravendb/data
          - name: ravendb-scripts
            mountPath: /ravendb/scripts
          - name: ravendb-certs
            mountPath: /ravendb/certs

      volumes:
        - name: ravendb-storage-b
          persistentVolumeClaim:
            claimName: ravendb-claim-b
        - name: ravendb-scripts
          configMap:
            name: ravendb-scripts
            defaultMode: 0755
        - name: ravendb-certs
          secret:
            secretName: ravendb-certs
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: "ravendb-c"
  namespace: ravendb
  annotations: 
    ingress.kubernetes.io/ssl-passthrough: "true"
  labels:
    app.kubernetes.io/name: ravendb
    nodeTag: "c"
spec:
  selector:
    matchLabels:
      nodeTag: c
  serviceName: "ravendb-c"
  replicas: 1
  template:
    metadata:
      namespace: ravendb
      labels:
        nodeTag: c
    spec:
      serviceAccountName: modify-config
      initContainers:
      - name: init-volume-permissions
        image: busybox
        command: ['sh', '-c', 'chown -R 999:999 /var/lib/ravendb/data && chmod -R 0755 /var/lib/ravendb/data']
        volumeMounts:
        - name: ravendb-storage-c
          mountPath: /var/lib/ravendb/data
      containers:
      - name: ravendb-container
        image: "ravendb/ravendb:latest"
        imagePullPolicy: IfNotPresent
        ports:
        - containerPort: 443
          name: https
        - containerPort: 38888
          name: tcp
          protocol: TCP


        env:
        - name: RAVEN_ServerUrl
          value: "https://0.0.0.0:4443"
        - name: RAVEN_ServerUrl_Tcp
          value: "tcp://0.0.0.0:38888"
        - name: RAVEN_Setup_Mode
          value: "None"
        - name: RAVEN_PublicServerUrl
          value: "" # todo: your domain goes here
        - name: RAVEN_License # todo: your RavenDB license goes here
          value:  |
            xxxx
        - name: RAVEN_Security_Certificate_Load_Exec
          value: "/ravendb/scripts/get-server-cert.sh"
        - name: RAVEN_Security_Certificate_Exec_TimeoutInSec
          value: "15"
        - name: RAVEN_Security_Certificate_Change_Exec
          value: "/ravendb/scripts/update-cert.sh"

        volumeMounts:
          - name: "ravendb-storage-c"
            mountPath: /var/lib/ravendb/data
          - name: ravendb-scripts
            mountPath: /ravendb/scripts
          - name: ravendb-certs
            mountPath: /ravendb/certs

      volumes:
        - name: ravendb-storage-c
          persistentVolumeClaim:
            claimName: ravendb-claim-c
        - name: ravendb-scripts
          configMap:
            name: ravendb-scripts
            defaultMode: 0755
        - name: ravendb-certs
          secret:
            secretName: ravendb-certs