ce7cb702218693d08ea6d83464d2457c9250027c

services/project-delivery/k8s/controller.yaml

@@ -0,0 +1,66 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: project-delivery-controller
+  namespace: project-delivery
+  labels:
+    app.kubernetes.io/name: project-delivery-controller
+    app.kubernetes.io/instance: project-delivery-controller
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: project-delivery-controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: project-delivery-controller
+        app.kubernetes.io/instance: project-delivery-controller
+        delivery.quorate.dev/stage: controller
+    spec:
+      serviceAccountName: project-delivery-controller
+      automountServiceAccountToken: true
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: controller
+          image: project-delivery-controller
+          args: [run]
+          env:
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: FORGEJO_PUBLIC_AUTHORITY
+              value: git.quorate.dev
+            - name: FORGEJO_PUBLIC_URL
+              value: http://forge-git-http.forgejo-public.svc.cluster.local:3000
+            - name: FORGEJO_PUBLIC_TOKEN_PATH
+              value: /public-source-auth/token
+            - name: FORGEJO_PRIVATE_AUTHORITY
+              value: forge.quorate.internal
+            - name: FORGEJO_PRIVATE_URL
+              value: http://forgejo-http.forgejo.svc.cluster.local:3000
+            - name: FORGEJO_PRIVATE_TOKEN_PATH
+              value: /private-source-auth/token
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {cpu: 500m, memory: 256Mi}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+            readOnlyRootFilesystem: true
+          volumeMounts:
+            - {name: public-source-auth, mountPath: /public-source-auth, readOnly: true}
+            - {name: private-source-auth, mountPath: /private-source-auth, readOnly: true}
+      imagePullSecrets:
+        - name: quay-reader
+      volumes:
+        - {name: public-source-auth, secret: {secretName: project-delivery-source, defaultMode: 0440}}
+        - {name: private-source-auth, secret: {secretName: quorate-pull, defaultMode: 0440}}