54 lines
1.9 KiB
YAML
54 lines
1.9 KiB
YAML
|
apiVersion: apps/v1
|
||
|
|
kind: Deployment
|
||
|
|
metadata:
|
||
|
|
name: mirrored-image
|
||
|
|
namespace: mirrored-image
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
spec:
|
||
|
|
replicas: 2
|
||
|
|
selector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirrored-image
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
spec:
|
||
|
|
serviceAccountName: mirrored-image
|
||
|
|
automountServiceAccountToken: true
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
seccompProfile: {type: RuntimeDefault}
|
||
|
|
containers:
|
||
|
|
- name: controller
|
||
|
|
image: mirrored-image-controller
|
||
|
|
args: [run]
|
||
|
|
env:
|
||
|
|
- name: POD_NAMESPACE
|
||
|
|
valueFrom:
|
||
|
|
fieldRef: {fieldPath: metadata.namespace}
|
||
|
|
- {name: REGISTRY, value: registry.quorate.internal}
|
||
|
|
- {name: QUAY_API, value: https://registry.quorate.internal}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 20m, memory: 32Mi}
|
||
|
|
limits: {cpu: 200m, memory: 128Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- {name: candidates-reader, mountPath: /candidates-reader, readOnly: true}
|
||
|
|
- {name: mirror-reader, mountPath: /mirror-reader, readOnly: true}
|
||
|
|
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||
|
|
volumes:
|
||
|
|
- {name: candidates-reader, secret: {secretName: candidates-reader, defaultMode: 0440}}
|
||
|
|
- {name: mirror-reader, secret: {secretName: mirror-reader, defaultMode: 0440}}
|
||
|
|
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|