88 lines
2.7 KiB
YAML
88 lines
2.7 KiB
YAML
|
apiVersion: batch/v1
|
||
|
|
kind: CronJob
|
||
|
|
metadata:
|
||
|
|
name: ca-sync
|
||
|
|
namespace: vault
|
||
|
|
spec:
|
||
|
|
schedule: "*/15 * * * *"
|
||
|
|
concurrencyPolicy: Forbid
|
||
|
|
successfulJobsHistoryLimit: 1
|
||
|
|
failedJobsHistoryLimit: 1
|
||
|
|
jobTemplate:
|
||
|
|
spec:
|
||
|
|
backoffLimit: 0
|
||
|
|
activeDeadlineSeconds: 120
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: ca-sync
|
||
|
|
app.kubernetes.io/instance: ca-sync
|
||
|
|
spec:
|
||
|
|
restartPolicy: Never
|
||
|
|
serviceAccountName: ca-sync
|
||
|
|
imagePullSecrets:
|
||
|
|
- name: ca-sync-pull
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
containers:
|
||
|
|
- name: sync
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
|
||
|
|
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||
|
|
args:
|
||
|
|
- /source/run.fsx
|
||
|
|
- pki=ca/internal
|
||
|
|
- pki_postgres=ca/postgres
|
||
|
|
- pki_opnsense=ca/opnsense
|
||
|
|
env:
|
||
|
|
- name: VAULT_ADDR
|
||
|
|
value: https://vault.vault.svc.cluster.local:8200
|
||
|
|
- name: VAULT_ROLE
|
||
|
|
value: ca-sync
|
||
|
|
- name: VAULT_MOUNT
|
||
|
|
value: secret
|
||
|
|
- name: JWT_PATH
|
||
|
|
value: /var/run/secrets/kubernetes.io/serviceaccount/token
|
||
|
|
- name: HOME
|
||
|
|
value: /tmp
|
||
|
|
- name: SSL_CERT_FILE
|
||
|
|
value: /ca/ca.crt
|
||
|
|
- name: DOTNET_NOLOGO
|
||
|
|
value: "true"
|
||
|
|
- name: DOTNET_CLI_TELEMETRY_OPTOUT
|
||
|
|
value: "1"
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 50m
|
||
|
|
memory: 128Mi
|
||
|
|
limits:
|
||
|
|
memory: 512Mi
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
capabilities:
|
||
|
|
drop: [ALL]
|
||
|
|
volumeMounts:
|
||
|
|
- name: source
|
||
|
|
mountPath: /source
|
||
|
|
readOnly: true
|
||
|
|
- name: ca
|
||
|
|
mountPath: /ca
|
||
|
|
readOnly: true
|
||
|
|
- name: tmp
|
||
|
|
mountPath: /tmp
|
||
|
|
volumes:
|
||
|
|
- name: source
|
||
|
|
configMap:
|
||
|
|
name: ca-sync
|
||
|
|
- name: ca
|
||
|
|
secret:
|
||
|
|
secretName: ca-sync-root
|
||
|
|
items:
|
||
|
|
- key: ca.crt
|
||
|
|
path: ca.crt
|
||
|
|
- name: tmp
|
||
|
|
emptyDir: {}
|