Cloud: Shared Media and Writable Paths

#!/usr/bin/env bash
# Lists files written into the container's own layer in the last two hours.
# -xdev skips every mounted volume (EFS, emptyDir), so only unmanaged writes remain.
set -euo pipefail

namespace=pocketcoffee
pod=$(kubectl -n "$namespace" get pods -l app.kubernetes.io/component=web -o name | head -n 1)

kubectl -n "$namespace" exec "$pod" -c php-fpm -- \
  find /var/www/html -xdev -type f -mmin -120 -not -path '*/var/cache/*'

# media.tf: the access point of the shop volume and the CloudFront distribution of the media host.
variable "efs_file_system_id" {
  description = "ID of the EFS file system created by the infrastructure module."
  type        = string
}

variable "media_certificate_arn" {
  description = "ACM certificate for media.pocketcoffee.example, issued in us-east-1."
  type        = string
}

variable "route53_zone_id" {
  description = "Hosted zone of pocketcoffee.example."
  type        = string
}

variable "media_origin_domain" {
  description = "Name that resolves to the load balancer and routes to the web Service."
  type        = string
  default     = "media-origin.pocketcoffee.example"
}

resource "aws_efs_access_point" "shared" {
  file_system_id = var.efs_file_system_id

  posix_user {
    uid = 33
    gid = 33
  }

  root_directory {
    path = "/pocketcoffee/shared"

    creation_info {
      owner_uid   = 33
      owner_gid   = 33
      permissions = "0775"
    }
  }

  tags = {
    Name = "pocketcoffee-shared"
  }
}

resource "aws_cloudfront_cache_policy" "media" {
  name        = "pocketcoffee-media"
  comment     = "Static files of the shop; no cookies or headers reach the origin."
  min_ttl     = 0
  default_ttl = 86400
  max_ttl     = 31536000

  parameters_in_cache_key_and_forwarded_to_origin {
    enable_accept_encoding_gzip   = true
    enable_accept_encoding_brotli = true

    cookies_config {
      cookie_behavior = "none"
    }

    headers_config {
      header_behavior = "none"
    }

    query_strings_config {
      query_string_behavior = "all"
    }
  }
}

resource "aws_cloudfront_distribution" "media" {
  enabled         = true
  is_ipv6_enabled = true
  http_version    = "http2and3"
  comment         = "media.pocketcoffee.example"
  aliases         = ["media.pocketcoffee.example"]

  origin {
    domain_name = var.media_origin_domain
    origin_id   = "pocketcoffee-web"

    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  default_cache_behavior {
    target_origin_id       = "pocketcoffee-web"
    viewer_protocol_policy = "redirect-to-https"
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    compress               = true
    cache_policy_id        = aws_cloudfront_cache_policy.media.id
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }

  viewer_certificate {
    acm_certificate_arn      = var.media_certificate_arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

resource "aws_route53_record" "media" {
  zone_id = var.route53_zone_id
  name    = "media.pocketcoffee.example"
  type    = "A"

  alias {
    name                   = aws_cloudfront_distribution.media.domain_name
    zone_id                = aws_cloudfront_distribution.media.hosted_zone_id
    evaluate_target_health = false
  }
}

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: efs-pocketcoffee
provisioner: efs.csi.aws.com
parameters:
  provisioningMode: efs-ap
  fileSystemId: fs-0123456789abcdef0
  directoryPerms: "0775"
  uid: "33"
  gid: "33"
  basePath: /pocketcoffee
  subPathPattern: ${.PVC.namespace}/${.PVC.name}
  ensureUniqueDirectory: "false"
reclaimPolicy: Retain
volumeBindingMode: Immediate
mountOptions:
  - tls
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pocketcoffee-shared
  namespace: pocketcoffee
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: efs-pocketcoffee
  resources:
    requests:
      storage: 100Gi

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pocketcoffee-shared
spec:
  capacity:
    storage: 100Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: ""
  mountOptions:
    - tls
  csi:
    driver: efs.csi.aws.com
    volumeHandle: fs-0123456789abcdef0::fsap-0123456789abcdef0
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pocketcoffee-shared
  namespace: pocketcoffee
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: ""
  volumeName: pocketcoffee-shared
  resources:
    requests:
      storage: 100Gi

apiVersion: batch/v1
kind: Job
metadata:
  name: pocketcoffee-seed-shared
  namespace: pocketcoffee
spec:
  backoffLimit: 2
  ttlSecondsAfterFinished: 86400
  template:
    spec:
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        runAsUser: 33
        runAsGroup: 33
      containers:
        - name: seed
          image: 123456789012.dkr.ecr.eu-west-1.amazonaws.com/pocketcoffee/prestashop:<git-sha>
          command: ["/bin/sh", "-c"]
          args:
            - |
              set -eu
              cd /var/www/html
              mkdir -p /shared/img /shared/upload /shared/download /shared/admin-import \
                /shared/theme-assets-cache /shared/config-themes
              for dir in img upload download; do
                tar -C "/var/www/html/$dir" -cf - . \
                  | tar -C "/shared/$dir" -xf - --skip-old-files --no-same-owner
              done
              ls -ld /shared/*
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - name: shared
              mountPath: /shared
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: shared
          persistentVolumeClaim:
            claimName: pocketcoffee-shared
        - name: tmp
          emptyDir: {}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: pocketcoffee-web
  namespace: pocketcoffee
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: pocketcoffee-prestashop
      app.kubernetes.io/instance: pocketcoffee
      app.kubernetes.io/component: web
  template:
    metadata:
      labels:
        app.kubernetes.io/name: pocketcoffee-prestashop
        app.kubernetes.io/instance: pocketcoffee
        app.kubernetes.io/component: web
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 33
        runAsGroup: 33
        fsGroup: 33
      initContainers:
        - name: warmup
          image: 123456789012.dkr.ecr.eu-west-1.amazonaws.com/pocketcoffee/prestashop:<git-sha>
          command: ["sh", "-c"]
          args:
            - |
              set -e
              for app in admin front; do
                php bin/console cache:warmup --env=prod --app-id="$app"
              done
          envFrom:
            - configMapRef:
                name: pocketcoffee-env
            - secretRef:
                name: pocketcoffee-secrets
          env:
            - { name: DB_USER, value: ps_app }
            - name: DB_PASSWD
              valueFrom:
                secretKeyRef:
                  name: pocketcoffee-secrets
                  key: DB_PASSWORD_APP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - { name: var-cache, mountPath: /var/www/html/var/cache }
            - { name: var-logs, mountPath: /var/www/html/var/logs }
            - { name: tmp, mountPath: /tmp }
      containers:
        - name: php-fpm
          image: 123456789012.dkr.ecr.eu-west-1.amazonaws.com/pocketcoffee/prestashop:<git-sha>
          envFrom:
            - configMapRef:
                name: pocketcoffee-env
            - secretRef:
                name: pocketcoffee-secrets
          env:
            - { name: DB_USER, value: ps_app }
            - name: DB_PASSWD
              valueFrom:
                secretKeyRef:
                  name: pocketcoffee-secrets
                  key: DB_PASSWORD_APP
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
          volumeMounts:
            - { name: shared, mountPath: /var/www/html/img, subPath: img }
            - { name: shared, mountPath: /var/www/html/upload, subPath: upload }
            - { name: shared, mountPath: /var/www/html/download, subPath: download }
            - { name: shared, mountPath: /var/www/html/admin-pocketcoffee/import, subPath: admin-import }
            - { name: shared, mountPath: /var/www/html/themes/pocketcoffee/assets/cache, subPath: theme-assets-cache }
            - { name: shared, mountPath: /var/www/html/config/themes, subPath: config-themes }
            - { name: var-cache, mountPath: /var/www/html/var/cache }
            - { name: var-logs, mountPath: /var/www/html/var/logs }
            - { name: export, mountPath: /var/www/html/admin-pocketcoffee/export }
            - { name: tmp, mountPath: /tmp }
        - name: nginx
          image: 123456789012.dkr.ecr.eu-west-1.amazonaws.com/pocketcoffee/prestashop:<git-sha>-nginx
          securityContext:
            allowPrivilegeEscalation: false
          volumeMounts:
            - { name: shared, mountPath: /var/www/html/img, subPath: img, readOnly: true }
            - { name: shared, mountPath: /var/www/html/themes/pocketcoffee/assets/cache, subPath: theme-assets-cache, readOnly: true }
      volumes:
        - name: shared
          persistentVolumeClaim:
            claimName: pocketcoffee-shared
        - name: var-cache
          emptyDir: {}
        - name: var-logs
          emptyDir:
            sizeLimit: 512Mi
        - name: export
          emptyDir:
            sizeLimit: 512Mi
        - name: tmp
          emptyDir: {}

#!/usr/bin/env bash
# Confirms that img/ is writable on the shared volume and visible from every web pod.
set -euo pipefail

namespace=pocketcoffee
marker="probe-$(date +%s).txt"

pods=$(kubectl -n "$namespace" get pods -l app.kubernetes.io/component=web -o name)
first=$(echo "$pods" | head -n 1)

kubectl -n "$namespace" exec "$first" -c php-fpm -- sh -c "echo ok > /var/www/html/img/tmp/$marker"

for pod in $pods; do
  printf '%s: ' "$pod"
  kubectl -n "$namespace" exec "$pod" -c php-fpm -- cat "/var/www/html/img/tmp/$marker"
done

kubectl -n "$namespace" exec "$first" -c php-fpm -- rm "/var/www/html/img/tmp/$marker"

<?php
// config/defines_custom.inc.php: included at the top of config/config.inc.php.
// The media host comes from the environment, so a staging copy of the database does not use the production media host.
$pocketCoffeeMediaHost = getenv('PS_MEDIA_HOST');

if (is_string($pocketCoffeeMediaHost) && $pocketCoffeeMediaHost !== '') {
    define('_MEDIA_SERVER_1_', $pocketCoffeeMediaHost);
    define('_MEDIA_SERVER_2_', '');
    define('_MEDIA_SERVER_3_', '');
}

bin/console prestashop:config set PS_MEDIA_SERVER_1 --value=media.pocketcoffee.example --env=prod

# Second server block, next to the one of www.pocketcoffee.example.
# image-rewrites.conf holds the product and category image rewrites of the main block.
server {
    listen 8080;
    server_name media.pocketcoffee.example media-origin.pocketcoffee.example;
    root /var/www/html;

    open_file_cache          max=10000 inactive=60s;
    open_file_cache_valid    60s;
    open_file_cache_min_uses 1;
    open_file_cache_errors   on;

    include /etc/nginx/snippets/image-rewrites.conf;

    # Files that are replaced in place (category covers, favicon) get a shorter lifetime than versioned files.
    location ^~ /img/ {
        location ~* \.(?:php|phtml|phar|php[0-9])$ { deny all; }
        expires 1d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    # Combined CSS and JS are named after a version number: they never change under the same name.
    location ^~ /themes/pocketcoffee/assets/ {
        location ~* \.(?:php|tpl|twig|yml)$ { deny all; }
        expires 365d;
        add_header Cache-Control "public, immutable";
        try_files $uri =404;
    }

    location ^~ /modules/ {
        location ~* \.(?:php|tpl|twig|yml|yaml|json|lock|txt|log|xml)$ { deny all; }
        expires 7d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    location ^~ /js/ {
        location ~* \.php$ { deny all; }
        expires 7d;
        add_header Cache-Control "public";
        try_files $uri =404;
    }

    location / {
        return 404;
    }
}

aws cloudfront create-invalidation \
  --distribution-id EDFDVBD6EXAMPLE \
  --paths "/img/c/12.jpg" "/img/favicon.ico"