59 lines
2.5 KiB
YAML
59 lines
2.5 KiB
YAML
|
apiVersion: batch/v1
|
||
|
|
kind: Job
|
||
|
|
metadata:
|
||
|
|
name: mirror-bootstrap
|
||
|
|
namespace: mirrored-image
|
||
|
|
annotations:
|
||
|
|
kustomize.toolkit.fluxcd.io/force: Enabled
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirror-bootstrap
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
spec:
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: mirror-bootstrap
|
||
|
|
app.kubernetes.io/instance: mirrored-image
|
||
|
|
spec:
|
||
|
|
serviceAccountName: mirror-bootstrap
|
||
|
|
restartPolicy: Never
|
||
|
|
securityContext:
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
runAsGroup: 65532
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
seccompProfile: {type: RuntimeDefault}
|
||
|
|
containers:
|
||
|
|
- name: bootstrap
|
||
|
|
image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
|
||
|
|
command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
|
||
|
|
args: [/bootstrap/bootstrap.fsx]
|
||
|
|
env:
|
||
|
|
- {name: VAULT_ADDR, value: https://vault.vault.svc.cluster.local:8200}
|
||
|
|
- {name: VAULT_ROLE, value: mirror-bootstrap}
|
||
|
|
- {name: JWT_PATH, value: /var/run/secrets/kubernetes.io/serviceaccount/token}
|
||
|
|
- {name: CA_PATH, value: /registry-ca/ca.crt}
|
||
|
|
- {name: QUAY_URL, value: https://registry.quorate.internal}
|
||
|
|
- {name: ZITADEL_API, value: http://zitadel.zitadel.svc.cluster.local:8080}
|
||
|
|
- {name: ZITADEL_ISSUER, value: https://auth.quorate.dev}
|
||
|
|
- {name: KUBE_URL, value: https://kubernetes.default.svc}
|
||
|
|
- {name: KUBE_CA, value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt}
|
||
|
|
- {name: LOGIN_NAMESPACE, value: zitadel}
|
||
|
|
- {name: LOGIN_SECRET, value: zitadel-login-service-key}
|
||
|
|
- {name: ADMIN_PATH, value: secret/data/quay/bootstrap}
|
||
|
|
resources:
|
||
|
|
requests: {cpu: 50m, memory: 64Mi}
|
||
|
|
limits: {cpu: 500m, memory: 256Mi}
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities: {drop: [ALL]}
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
volumeMounts:
|
||
|
|
- {name: scripts, mountPath: /bootstrap, readOnly: true}
|
||
|
|
- {name: registry-ca, mountPath: /registry-ca, readOnly: true}
|
||
|
|
- {name: temporary, mountPath: /tmp}
|
||
|
|
volumes:
|
||
|
|
- {name: scripts, configMap: {name: mirror-bootstrap, defaultMode: 0444}}
|
||
|
|
- {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
|
||
|
|
- {name: temporary, emptyDir: {}}
|