ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay/k8s/deployment.yaml

@@ -0,0 +1,147 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oci-l4-relay
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oci-l4-relay
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oci-l4-relay
+    spec:
+      serviceAccountName: oci-l4-relay
+      automountServiceAccountToken: true
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: oci-l4-relay
+              topologyKey: kubernetes.io/hostname
+      priorityClassName: system-node-critical
+      terminationGracePeriodSeconds: 35
+      containers:
+        - name: relay-agent
+          image: registry.quorate.internal/quorate/oci-l4-relay-agent@sha256:c5d82adbde80a5a3c3e3ecbbc5aebf53d449474cbcfc2e7a7988576edf068dfc
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_UID
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.uid
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: POD_NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: RELAY_TUNNEL_ADDRESS
+              value: 10.153.238.225/30
+            - name: RELAY_TARGETS
+              value: '[{"address":"10.104.40.127","ports":[80,443]}]'
+            - name: RELAY_MAIL_UPSTREAM
+              value: stalwart-relay.stalwart.svc.cluster.local
+            - name: RELAY_LOCAL_RETURN_CIDRS
+              value: 10.63.81.107/24,10.162.8.60/24
+            - name: RELAY_METRICS_LISTEN_ADDRESS
+              value: :19100
+            - name: OCI_RELAY_METRICS_URL
+              value: http://10.40.68.115:19100/metrics
+            - name: OCI_RELAY_ENDPOINT_IP
+              valueFrom:
+                secretKeyRef:
+                  name: oci-l4-relay-oci-wireguard
+                  key: endpoint_ip
+            - name: OCI_RELAY_LISTEN_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: oci-l4-relay-oci-wireguard
+                  key: listen_port
+            - name: OCI_RELAY_PUBLIC_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: oci-l4-relay-oci-wireguard
+                  key: public_key
+          ports:
+            - name: metrics
+              containerPort: 19100
+              protocol: TCP
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+              add:
+                - NET_ADMIN
+                - NET_BIND_SERVICE
+            readOnlyRootFilesystem: true
+            runAsNonRoot: false
+            runAsUser: 0
+            seccompProfile:
+              type: RuntimeDefault
+          readinessProbe:
+            exec:
+              command:
+                - /oci-l4-relay-agent
+                - health
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            failureThreshold: 3
+          livenessProbe:
+            exec:
+              command:
+                - /oci-l4-relay-agent
+                - health
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 128Mi
+          volumeMounts:
+            - name: home-wireguard
+              mountPath: /run/secrets/wireguard
+              readOnly: true
+            - name: runtime
+              mountPath: /run/relay-agent
+      volumes:
+        - name: home-wireguard
+          secret:
+            secretName: oci-l4-relay-home-wireguard
+            defaultMode: 0400
+        - name: runtime
+          emptyDir:
+            medium: Memory
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: oci-l4-relay
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oci-l4-relay