ce7cb702218693d08ea6d83464d2457c9250027c

services/oci-l4-relay-wan-controller/k8s/deployment.yaml

@@ -0,0 +1,109 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oci-l4-relay-wan-controller
+  namespace: kube-system
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: oci-l4-relay-wan-controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: oci-l4-relay-wan-controller
+    spec:
+      serviceAccountName: oci-l4-relay-wan-controller
+      automountServiceAccountToken: true
+      securityContext:
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: oci-l4-relay-wan-controller
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: controller
+          image: registry.quorate.internal/quorate/oci-l4-relay-wan-controller@sha256:395e68f424e6fddcfb72cee8f83887ed219b47e16cd87562c4073325b3598803
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: OPNSENSE_URL
+              value: https://10.212.111.120:8443
+            - name: OPNSENSE_INTERFACE
+              value: WAN
+            - name: POLL_INTERVAL
+              value: 10s
+            - name: MINIMUM_OBSERVATIONS
+              value: "2"
+            - name: WIREGUARD_PORT
+              value: "51820"
+            - name: OPNSENSE_KEY_PATH
+              value: /run/secrets/opnsense/key
+            - name: OPNSENSE_SECRET_PATH
+              value: /run/secrets/opnsense/secret
+            - name: OPNSENSE_CA_PATH
+              value: /run/secrets/opnsense-ca/ca.crt
+            - name: OCI_TENANCY_OCID_PATH
+              value: /run/secrets/oci/tenancy_ocid
+            - name: OCI_USER_OCID_PATH
+              value: /run/secrets/oci/user_ocid
+            - name: OCI_FINGERPRINT_PATH
+              value: /run/secrets/oci/fingerprint
+            - name: OCI_PRIVATE_KEY_PATH
+              value: /run/secrets/oci/private_key
+            - name: OCI_REGION_PATH
+              value: /run/secrets/oci/region
+            - name: OCI_NSG_OCID_PATH
+              value: /run/secrets/oci/network_security_group_id
+            - name: OCI_SECURITY_RULE_ID_PATH
+              value: /run/secrets/oci/security_rule_id
+            - name: WG_STATUS_URL
+              value: http://oci-l4-relay-metrics.kube-system.svc.cluster.local:19100/metrics
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65532
+            seccompProfile:
+              type: RuntimeDefault
+          resources:
+            requests:
+              cpu: 4m
+              memory: 20Mi
+            limits:
+              memory: 128Mi
+          volumeMounts:
+            - name: opnsense
+              mountPath: /run/secrets/opnsense
+              readOnly: true
+            - name: opnsense-ca
+              mountPath: /run/secrets/opnsense-ca
+              readOnly: true
+            - name: oci
+              mountPath: /run/secrets/oci
+              readOnly: true
+      volumes:
+        - name: opnsense
+          secret:
+            secretName: opnsense-interface-watcher
+            defaultMode: 0440
+        - name: opnsense-ca
+          secret:
+            secretName: ca-opnsense
+            defaultMode: 0440
+        - name: oci
+          secret:
+            secretName: oci-l4-relay-wan-controller-api
+            defaultMode: 0440