136 lines
4.2 KiB
YAML
136 lines
4.2 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: nuthatch-@@LANE@@
|
|
namespace: nuthatch-testbed
|
|
data:
|
|
NUTHATCH_LISTEN: 0.0.0.0:8080
|
|
NUTHATCH_PUBLIC_BASE_URL: https://nuthatch-@@LANE@@:8080
|
|
NUTHATCH_REDIS_URL: "@@REDIS_URL@@"
|
|
NUTHATCH_OIDC_ISSUER: "@@OIDC_ISSUER@@"
|
|
NUTHATCH_OIDC_CLIENT_ID: "@@OIDC_CLIENT_ID@@"
|
|
NUTHATCH_OIDC_ADDITIONAL_AUDIENCES: "@@OIDC_ADDITIONAL_AUDIENCES@@"
|
|
NUTHATCH_OIDC_REDIRECT_URI: https://nuthatch-@@LANE@@:8080/oidc/callback
|
|
NUTHATCH_S3_ENDPOINT: "@@S3_ENDPOINT@@"
|
|
NUTHATCH_S3_REGION: "@@S3_REGION@@"
|
|
NUTHATCH_S3_BUCKET: "@@S3_BUCKET@@"
|
|
NUTHATCH_S3_PATH_STYLE: "true"
|
|
NUTHATCH_BROWSE_PAGE_SIZE: "200"
|
|
NUTHATCH_SEARCH_MAX_KEYS: "500"
|
|
NUTHATCH_SEARCH_TIMEOUT_MS: "2000"
|
|
NUTHATCH_DELETE_PAGE_SIZE: "100"
|
|
NUTHATCH_LIST_CACHE_TTL_SEC: "30"
|
|
NUTHATCH_IDEMPOTENCY_WINDOW_SEC: "86400"
|
|
NUTHATCH_OBJECT_REQUEST_TIMEOUT_SEC: "300"
|
|
NUTHATCH_STARTUP_ATTEMPTS: "60"
|
|
NUTHATCH_STARTUP_DELAY_MS: "1000"
|
|
NUTHATCH_AUDIT_OBJECT_KEYS: "false"
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: nuthatch-@@LANE@@
|
|
namespace: nuthatch-testbed
|
|
type: Opaque
|
|
stringData:
|
|
NUTHATCH_JWT_SECRET: synthetic-kind-session-jwt-secret-@@LANE@@
|
|
NUTHATCH_OIDC_CLIENT_SECRET: "@@OIDC_CLIENT_SECRET@@"
|
|
NUTHATCH_PG_CONN: "@@PG_CONN@@"
|
|
NUTHATCH_S3_ACCESS_KEY: "@@S3_ACCESS_KEY@@"
|
|
NUTHATCH_S3_SECRET_KEY: "@@S3_SECRET_KEY@@"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: nuthatch-@@LANE@@
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels: {app: nuthatch-@@LANE@@}
|
|
template:
|
|
metadata:
|
|
labels: {app: nuthatch-@@LANE@@}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
dnsPolicy: None
|
|
dnsConfig:
|
|
nameservers: [10.96.0.53]
|
|
searches:
|
|
- nuthatch-testbed.svc.cluster.local
|
|
- svc.cluster.local
|
|
- cluster.local
|
|
options:
|
|
- {name: ndots, value: "5"}
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile: {type: RuntimeDefault}
|
|
initContainers:
|
|
- name: tls-certificate
|
|
image: @@APP_IMAGE@@
|
|
imagePullPolicy: Never
|
|
command: [/bin/sh, -ec]
|
|
args:
|
|
- |
|
|
openssl req \
|
|
-x509 \
|
|
-newkey rsa:2048 \
|
|
-nodes \
|
|
-days 1 \
|
|
-subj "/CN=nuthatch-@@LANE@@" \
|
|
-addext "subjectAltName=DNS:nuthatch-@@LANE@@,DNS:nuthatch-@@LANE@@.nuthatch-testbed.svc" \
|
|
-keyout /tls/tls.key \
|
|
-out /tls/tls.crt
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: {drop: ["ALL"]}
|
|
volumeMounts:
|
|
- {name: tls, mountPath: /tls}
|
|
resources:
|
|
requests: {cpu: 25m, memory: 16Mi}
|
|
limits: {cpu: 250m, memory: 32Mi}
|
|
containers:
|
|
- name: nuthatch
|
|
image: @@APP_IMAGE@@
|
|
imagePullPolicy: Never
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: {drop: ["ALL"]}
|
|
envFrom:
|
|
- configMapRef: {name: nuthatch-@@LANE@@}
|
|
- secretRef: {name: nuthatch-@@LANE@@}
|
|
ports:
|
|
- {name: https, containerPort: 8080}
|
|
livenessProbe:
|
|
httpGet: {path: /healthz, port: https, scheme: HTTPS}
|
|
periodSeconds: 2
|
|
failureThreshold: 15
|
|
readinessProbe:
|
|
httpGet: {path: /readyz, port: https, scheme: HTTPS}
|
|
periodSeconds: 2
|
|
failureThreshold: 30
|
|
resources:
|
|
requests: {cpu: 100m, memory: 96Mi}
|
|
limits: {cpu: "2", memory: 512Mi}
|
|
volumeMounts:
|
|
- {name: tls, mountPath: /tls, readOnly: true}
|
|
volumes:
|
|
- name: tls
|
|
emptyDir: {}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: nuthatch-@@LANE@@
|
|
namespace: nuthatch-testbed
|
|
spec:
|
|
selector: {app: nuthatch-@@LANE@@}
|
|
ports:
|
|
- {name: https, port: 8080, targetPort: https}
|