ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/tunnel/deployment.yaml

@@ -0,0 +1,156 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tunnel
+  namespace: short
+spec:
+  replicas: 2
+  template:
+    spec:
+      imagePullSecrets:
+      - name: pull
+      initContainers:
+      - name: stage
+        image: short-image
+        args:
+        - stage
+        - /agent/short
+        securityContext:
+          runAsUser: 65532
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources:
+          requests:
+            cpu: 25m
+            memory: 32Mi
+          limits:
+            memory: 64Mi
+        volumeMounts:
+        - name: agent
+          mountPath: /agent
+      containers:
+      - name: tunnel
+        image: docker.io/openeuler/strongswan@sha256:7cf59f44ca5e0b12938ce1cf66de437c6f7686d3d112c7057f30d8e055a608bc
+        command:
+        - /agent/short
+        args:
+        - tunnel
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        securityContext:
+          runAsNonRoot: false
+          runAsUser: 0
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+            add:
+            - NET_ADMIN
+            - NET_BIND_SERVICE
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            memory: 256Mi
+        ports:
+        - name: health
+          containerPort: 9090
+        readinessProbe:
+          httpGet:
+            path: /ready
+            port: health
+          periodSeconds: 5
+        volumeMounts:
+        - name: agent
+          mountPath: /agent
+          readOnly: true
+        - name: runtime
+          mountPath: /config
+          readOnly: true
+        - name: strongswan
+          mountPath: /usr/local/etc/strongswan.conf
+          subPath: strongswan.conf
+          readOnly: true
+        - name: run
+          mountPath: /var/run
+        - name: api
+          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+          readOnly: true
+      volumes:
+      - name: api
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              expirationSeconds: 3600
+          - configMap:
+              name: kube-root-ca.crt
+              items:
+              - key: ca.crt
+                path: ca.crt
+      - name: agent
+        emptyDir: {}
+      - name: run
+        emptyDir: {}
+      - name: runtime
+        secret:
+          secretName: peers
+          items:
+          - key: config
+            path: runtime.json
+      - name: strongswan
+        configMap:
+          name: charon
+      securityContext:
+        fsGroup: 65532
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      serviceAccountName: tunnel
+      automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 30
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - topologyKey: kubernetes.io/hostname
+            labelSelector:
+              matchLabels:
+                app.kubernetes.io/name: tunnel
+                app.kubernetes.io/instance: short
+    metadata:
+      labels:
+        app.kubernetes.io/name: tunnel
+        app.kubernetes.io/instance: short
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tunnel
+      app.kubernetes.io/instance: short
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: tunnel
+  namespace: short
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tunnel
+      app.kubernetes.io/instance: short