ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/control/deployment.yaml

@@ -0,0 +1,114 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: controller
+  namespace: short
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: controller
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: controller
+        app.kubernetes.io/instance: short
+    spec:
+      serviceAccountName: short-controller
+      imagePullSecrets:
+      - name: pull
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: kubernetes.io/hostname
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: controller
+                app.kubernetes.io/instance: short
+      containers:
+      - name: controller
+        image: short-image
+        args:
+        - controller
+        env:
+        - name: POD_UID
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.uid
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: VAULT_ADDR
+          value: https://vault.vault.svc.cluster.local:8200
+        - name: OPNSENSE_URL
+          value: https://10.212.111.120:8443
+        - name: SSL_CERT_FILE
+          value: /ca/ca.crt
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            memory: 192Mi
+        volumeMounts:
+        - name: config
+          mountPath: /config
+          readOnly: true
+        - name: ca
+          mountPath: /ca
+          readOnly: true
+      volumes:
+      - name: ca
+        secret:
+          secretName: ca
+      - name: config
+        projected:
+          defaultMode: 288
+          sources:
+          - secret:
+              name: api
+              items:
+              - key: private_key
+                path: private_key
+          - secret:
+              name: cloud
+              items:
+              - key: config
+                path: cloud.json
+          - secret:
+              name: opnsense
+              items:
+              - key: key
+                path: opnsense/key
+              - key: secret
+                path: opnsense/secret
+          - secret:
+              name: ca-opnsense
+              items:
+              - key: ca.crt
+                path: opnsense/ca.crt
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: controller
+  namespace: short
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: controller