109 lines
3.6 KiB
YAML
109 lines
3.6 KiB
YAML
|
apiVersion: apps/v1
|
||
|
|
kind: Deployment
|
||
|
|
metadata:
|
||
|
|
name: oci-l4-relay-wan-controller
|
||
|
|
namespace: kube-system
|
||
|
|
spec:
|
||
|
|
replicas: 2
|
||
|
|
strategy:
|
||
|
|
type: RollingUpdate
|
||
|
|
selector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: oci-l4-relay-wan-controller
|
||
|
|
template:
|
||
|
|
metadata:
|
||
|
|
labels:
|
||
|
|
app.kubernetes.io/name: oci-l4-relay-wan-controller
|
||
|
|
spec:
|
||
|
|
serviceAccountName: oci-l4-relay-wan-controller
|
||
|
|
automountServiceAccountToken: true
|
||
|
|
securityContext:
|
||
|
|
fsGroup: 65532
|
||
|
|
fsGroupChangePolicy: OnRootMismatch
|
||
|
|
affinity:
|
||
|
|
podAntiAffinity:
|
||
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
||
|
|
- labelSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: oci-l4-relay-wan-controller
|
||
|
|
topologyKey: kubernetes.io/hostname
|
||
|
|
containers:
|
||
|
|
- name: controller
|
||
|
|
image: registry.quorate.internal/quorate/oci-l4-relay-wan-controller@sha256:395e68f424e6fddcfb72cee8f83887ed219b47e16cd87562c4073325b3598803
|
||
|
|
imagePullPolicy: IfNotPresent
|
||
|
|
env:
|
||
|
|
- name: POD_NAMESPACE
|
||
|
|
valueFrom:
|
||
|
|
fieldRef:
|
||
|
|
fieldPath: metadata.namespace
|
||
|
|
- name: OPNSENSE_URL
|
||
|
|
value: https://10.212.111.120:8443
|
||
|
|
- name: OPNSENSE_INTERFACE
|
||
|
|
value: WAN
|
||
|
|
- name: POLL_INTERVAL
|
||
|
|
value: 10s
|
||
|
|
- name: MINIMUM_OBSERVATIONS
|
||
|
|
value: "2"
|
||
|
|
- name: WIREGUARD_PORT
|
||
|
|
value: "51820"
|
||
|
|
- name: OPNSENSE_KEY_PATH
|
||
|
|
value: /run/secrets/opnsense/key
|
||
|
|
- name: OPNSENSE_SECRET_PATH
|
||
|
|
value: /run/secrets/opnsense/secret
|
||
|
|
- name: OPNSENSE_CA_PATH
|
||
|
|
value: /run/secrets/opnsense-ca/ca.crt
|
||
|
|
- name: OCI_TENANCY_OCID_PATH
|
||
|
|
value: /run/secrets/oci/tenancy_ocid
|
||
|
|
- name: OCI_USER_OCID_PATH
|
||
|
|
value: /run/secrets/oci/user_ocid
|
||
|
|
- name: OCI_FINGERPRINT_PATH
|
||
|
|
value: /run/secrets/oci/fingerprint
|
||
|
|
- name: OCI_PRIVATE_KEY_PATH
|
||
|
|
value: /run/secrets/oci/private_key
|
||
|
|
- name: OCI_REGION_PATH
|
||
|
|
value: /run/secrets/oci/region
|
||
|
|
- name: OCI_NSG_OCID_PATH
|
||
|
|
value: /run/secrets/oci/network_security_group_id
|
||
|
|
- name: OCI_SECURITY_RULE_ID_PATH
|
||
|
|
value: /run/secrets/oci/security_rule_id
|
||
|
|
- name: WG_STATUS_URL
|
||
|
|
value: http://oci-l4-relay-metrics.kube-system.svc.cluster.local:19100/metrics
|
||
|
|
securityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
capabilities:
|
||
|
|
drop:
|
||
|
|
- ALL
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 65532
|
||
|
|
seccompProfile:
|
||
|
|
type: RuntimeDefault
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 4m
|
||
|
|
memory: 20Mi
|
||
|
|
limits:
|
||
|
|
memory: 128Mi
|
||
|
|
volumeMounts:
|
||
|
|
- name: opnsense
|
||
|
|
mountPath: /run/secrets/opnsense
|
||
|
|
readOnly: true
|
||
|
|
- name: opnsense-ca
|
||
|
|
mountPath: /run/secrets/opnsense-ca
|
||
|
|
readOnly: true
|
||
|
|
- name: oci
|
||
|
|
mountPath: /run/secrets/oci
|
||
|
|
readOnly: true
|
||
|
|
volumes:
|
||
|
|
- name: opnsense
|
||
|
|
secret:
|
||
|
|
secretName: opnsense-interface-watcher
|
||
|
|
defaultMode: 0440
|
||
|
|
- name: opnsense-ca
|
||
|
|
secret:
|
||
|
|
secretName: ca-opnsense
|
||
|
|
defaultMode: 0440
|
||
|
|
- name: oci
|
||
|
|
secret:
|
||
|
|
secretName: oci-l4-relay-wan-controller-api
|
||
|
|
defaultMode: 0440
|