ce7cb702218693d08ea6d83464d2457c9250027c

services/mirrored-image/k8s/controller.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mirrored-image
+  namespace: mirrored-image
+  labels:
+    app.kubernetes.io/name: mirrored-image
+    app.kubernetes.io/instance: mirrored-image
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: mirrored-image
+      app.kubernetes.io/instance: mirrored-image
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: mirrored-image
+        app.kubernetes.io/instance: mirrored-image
+    spec:
+      serviceAccountName: mirrored-image
+      automountServiceAccountToken: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: {type: RuntimeDefault}
+      containers:
+        - name: controller
+          image: mirrored-image-controller
+          args: [run]
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef: {fieldPath: metadata.namespace}
+            - {name: REGISTRY, value: registry.quorate.internal}
+            - {name: QUAY_API, value: https://registry.quorate.internal}
+          resources:
+            requests: {cpu: 20m, memory: 32Mi}
+            limits: {cpu: 200m, memory: 128Mi}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - {name: candidates-reader, mountPath: /candidates-reader, readOnly: true}
+            - {name: mirror-reader, mountPath: /mirror-reader, readOnly: true}
+            - {name: registry-ca, mountPath: /registry-ca, readOnly: true}
+      volumes:
+        - {name: candidates-reader, secret: {secretName: candidates-reader, defaultMode: 0440}}
+        - {name: mirror-reader, secret: {secretName: mirror-reader, defaultMode: 0440}}
+        - {name: registry-ca, secret: {secretName: mirror-ca, defaultMode: 0440}}