ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/bootstrap/job.yaml

@@ -0,0 +1,55 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: seed
+  namespace: short
+  annotations:
+    kustomize.toolkit.fluxcd.io/force: Enabled
+spec:
+  completions: 2
+  parallelism: 2
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: seed
+        app.kubernetes.io/instance: short
+    spec:
+      serviceAccountName: short-seed
+      restartPolicy: Never
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: seed
+        image: short-image
+        args:
+        - seed
+        env:
+        - name: VAULT_ADDR
+          value: https://vault.vault.svc.cluster.local:8200
+        - name: SSL_CERT_FILE
+          value: /ca/ca.crt
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 50m
+            memory: 32Mi
+          limits:
+            memory: 128Mi
+        volumeMounts:
+        - name: ca
+          mountPath: /ca
+          readOnly: true
+      volumes:
+      - name: ca
+        secret:
+          secretName: ca