ce7cb702218693d08ea6d83464d2457c9250027c

services/ca-sync/k8s/job.yaml

@@ -0,0 +1,88 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: ca-sync
+  namespace: vault
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      activeDeadlineSeconds: 120
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: ca-sync
+            app.kubernetes.io/instance: ca-sync
+        spec:
+          restartPolicy: Never
+          serviceAccountName: ca-sync
+          imagePullSecrets:
+            - name: ca-sync-pull
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 65532
+            runAsGroup: 65532
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: sync
+              image: registry.quorate.internal/quorate/fsharp-runner@sha256:d7b904f4f0cae9fdba7c7345cdf08c91162245834a8a13658d93396272aeec83
+              command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
+              args:
+                - /source/run.fsx
+                - pki=ca/internal
+                - pki_postgres=ca/postgres
+                - pki_opnsense=ca/opnsense
+              env:
+                - name: VAULT_ADDR
+                  value: https://vault.vault.svc.cluster.local:8200
+                - name: VAULT_ROLE
+                  value: ca-sync
+                - name: VAULT_MOUNT
+                  value: secret
+                - name: JWT_PATH
+                  value: /var/run/secrets/kubernetes.io/serviceaccount/token
+                - name: HOME
+                  value: /tmp
+                - name: SSL_CERT_FILE
+                  value: /ca/ca.crt
+                - name: DOTNET_NOLOGO
+                  value: "true"
+                - name: DOTNET_CLI_TELEMETRY_OPTOUT
+                  value: "1"
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 128Mi
+                limits:
+                  memory: 512Mi
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: true
+                capabilities:
+                  drop: [ALL]
+              volumeMounts:
+                - name: source
+                  mountPath: /source
+                  readOnly: true
+                - name: ca
+                  mountPath: /ca
+                  readOnly: true
+                - name: tmp
+                  mountPath: /tmp
+          volumes:
+            - name: source
+              configMap:
+                name: ca-sync
+            - name: ca
+              secret:
+                secretName: ca-sync-root
+                items:
+                  - key: ca.crt
+                    path: ca.crt
+            - name: tmp
+              emptyDir: {}