ce7cb702218693d08ea6d83464d2457c9250027c

services/mirrored-image/k8s/bootstrap/job.yaml

@@ -0,0 +1,59 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: mirror-bootstrap
+  namespace: mirrored-image
+  annotations:
+    kustomize.toolkit.fluxcd.io/force: Enabled
+  labels:
+    app.kubernetes.io/name: mirror-bootstrap
+    app.kubernetes.io/instance: mirrored-image
+spec:
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: mirror-bootstrap
+        app.kubernetes.io/instance: mirrored-image
+    spec:
+      serviceAccountName: mirror-bootstrap
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: bootstrap
+          image: registry.quorate.internal/quorate/fsharp-runner@sha256:e4cbf2cfcbd903ff4600590b84a08c0e09d95fa1e2edda4daf8d32a6aeda35f7
+          command: [/usr/share/dotnet/dotnet, /opt/fsi/fsi.dll, --exec]
+          args: [/bootstrap/bootstrap.fsx]
+          env:
+            - {name: VAULT_ADDR, value: https://vault.vault.svc.cluster.local:8200}
+            - {name: VAULT_ROLE, value: mirror-bootstrap}
+            - {name: JWT_PATH, value: /var/run/secrets/kubernetes.io/serviceaccount/token}
+            - {name: CA_PATH, value: /registry-ca/ca.crt}
+            - {name: QUAY_URL, value: https://registry.quorate.internal}
+            - {name: ZITADEL_API, value: http://zitadel.zitadel.svc.cluster.local:8080}
+            - {name: ZITADEL_ISSUER, value: https://auth.quorate.dev}
+            - {name: KUBE_URL, value: https://kubernetes.default.svc}
+            - {name: KUBE_CA, value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt}
+            - {name: LOGIN_NAMESPACE, value: zitadel}
+            - {name: LOGIN_SECRET, value: zitadel-login-service-key}
+            - {name: ADMIN_PATH, value: secret/data/quay/bootstrap}
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {cpu: 500m, memory: 256Mi}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - {name: scripts, mountPath: /bootstrap, readOnly: true}
+            - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
+            - {name: temporary, mountPath: /tmp}
+      volumes:
+        - {name: scripts, configMap: {name: mirror-bootstrap, defaultMode: 0444}}
+        - {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}
+        - {name: temporary, emptyDir: {}}