add-kubernetes

Plex/Kubernetes/default-headers.yaml

@@ -0,0 +1,16 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: default-headers
+  namespace: plex
+spec:
+  headers:
+    browserXssFilter: true
+    contentTypeNosniff: true
+    forceSTSHeader: true
+    stsIncludeSubdomains: true
+    stsPreload: true
+    stsSeconds: 15552000
+    customFrameOptionsValue: SAMEORIGIN
+    customRequestHeaders:
+      X-Forwarded-Proto: https

Plex/Kubernetes/ingress.yaml

@@ -0,0 +1,26 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: plex
+  namespace: plex
+  annotations: 
+    kubernetes.io/ingress.class: traefik-external
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`www.plex.yourdomain.co.uk`)
+      kind: Rule
+      services:
+        - name: plex
+          port: 32400
+    - match: Host(`plex.yourdomain.co.uk`)
+      kind: Rule
+      services:
+        - name: plex
+          port: 32400
+      middlewares:
+        - name: default-headers
+  tls:
+    secretName: yourdomain-tls

Plex/Kubernetes/networkpolicy.yaml

@@ -0,0 +1,24 @@
+kind: NetworkPolicy
+apiVersion: networking.k8s.io/v1
+metadata:
+  name: allow-internet-only
+  namespace: plex
+spec:
+  podSelector: {}
+  policyTypes:
+  - Egress
+  egress:
+  - to:
+    - ipBlock:
+        cidr: "0.0.0.0/0"
+        except:
+        - "10.0.0.0/8"
+        - "172.16.0.0/12"
+        - "192.168.0.0/16"
+  - to:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: "kube-system"
+    - podSelector:
+        matchLabels:
+          k8s-app: "kube-dns"

Plex/Kubernetes/plex-deployment-2.yaml

@@ -0,0 +1,105 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app: plex
+  name: plex
+  namespace: plex
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: plex
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: plex
+    spec:
+      affinity: {}
+      containers:
+        - name: plex
+          securityContext:
+            privileged: true
+          image: plexinc/pms-docker:latest
+          imagePullPolicy: IfNotPresent
+          readinessProbe:
+            httpGet:
+              path: /identity
+              port: 32400
+            initialDelaySeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /identity
+              port: 32400
+            initialDelaySeconds: 15
+            timeoutSeconds: 10
+          resources: 
+            requests: 
+              gpu.intel.com/i915: "1"
+              cpu: 1000m
+              memory: 7.5Gi
+            limits: 
+              gpu.intel.com/i915: "1"
+          env:
+            - name: PUID
+              value: "99"
+            - name: PGID
+              value: "100"
+            - name: TZ
+              value: Europe/London
+            - name: VERSION
+              value: docker
+            - name: ADVERTISE_IP
+              value: 'https://plex.yourdomain.co.uk:443'
+            - name: ALLOWED_NETWORKS
+              value: 192.168.0.0/16,10.0.0.0/8
+            - name: PLEX_CLAIM
+              value: claim-your-token
+          volumeMounts:
+            - mountPath: /config
+              name: plex-longhorn
+            - mountPath: /transcode
+              name: transcode
+            - mountPath: /data
+              name: plex-longhorn
+            - mountPath: /Films
+              name: plex-smb
+              readOnly: true
+              subPath: Films
+            - mountPath: /TVShows
+              name: plex-smb
+              readOnly: true
+              subPath: TVShows
+            - mountPath: /Audiobooks
+              name: plex-smb
+              readOnly: true
+              subPath: Audiobooks
+            - mountPath: /Music
+              name: plex-smb
+              readOnly: true
+              subPath: Music
+      dnsConfig: {}
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - name: plex-longhorn
+          persistentVolumeClaim:
+            claimName: plex
+            readOnly: false
+        - name: plex-smb
+          persistentVolumeClaim:
+            claimName: pvc-plex-smb
+            readOnly: true
+        - name: transcode
+          emptyDir:
+            medium: Memory
+            sizeLimit: 10Gi

Plex/Kubernetes/pms-docker-service.yaml

@@ -0,0 +1,55 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    kompose.cmd: ./kompose convert -f plex/docker-compose.yml
+    kompose.version: 1.27.0 (b0ed6a2c9)
+  creationTimestamp: null
+  labels:
+    io.kompose.service: pms-docker
+  name: plex
+  namespace: plex
+spec:
+  ports:
+    - name: "32400"
+      port: 32400
+      protocol: TCP
+      targetPort: 32400
+    - name: "32400-udp"
+      port: 32400
+      protocol: UDP
+      targetPort: 32400
+    - name: "3005"
+      port: 3005
+      targetPort: 3005
+    - name: "8324"
+      port: 8324
+      targetPort: 8324
+    - name: "32469"
+      port: 32469
+      targetPort: 32469
+    - name: "1900"
+      port: 1900
+      protocol: UDP
+      targetPort: 1900
+    - name: "32410"
+      port: 32410
+      protocol: UDP
+      targetPort: 32410
+    - name: "32412"
+      port: 32412
+      protocol: UDP
+      targetPort: 32412
+    - name: "32413"
+      port: 32413
+      protocol: UDP
+      targetPort: 32413
+    - name: "32414"
+      port: 32414
+      protocol: UDP
+      targetPort: 32414
+  selector:
+    app: plex
+  externalTrafficPolicy: Local
+  loadBalancerIP: 192.168.200.12
+  type: LoadBalancer

Plex/Kubernetes/pv-smb.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  annotations:
+    pv.kubernetes.io/provisioned-by: smb.csi.k8s.io
+  name: pv-plex-smb
+spec:
+  capacity:
+    storage: 100Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: smb
+  mountOptions:
+    - dir_mode=0777
+    - file_mode=0777
+  csi:
+    driver: smb.csi.k8s.io
+    readOnly: false
+    # volumeHandle format: {smb-server-address}#{sub-dir-name}#{share-name}
+    # make sure this value is unique for every share in the cluster
+    volumeHandle: plex
+    volumeAttributes:
+      source: "//192.168.x.x/your-nas"
+    nodeStageSecretRef:
+      name: smbcreds
+      namespace: default

Plex/Kubernetes/pvc-smb.yaml

@@ -0,0 +1,14 @@
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: pvc-plex-smb
+  namespace: plex
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi
+  volumeName: pv-plex-smb
+  storageClassName: smb