ms2k/quorate
SHA256
Watch
0
Code Releases Activity

ce7cb702218693d08ea6d83464d2457c9250027c

Browse source
This commit is contained in:
ms2k 2026-11-12 20:46:28 +09:00
commit 34c5f8963c
4 changed files with 145336 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

186
services/stalwart/k8s/bootstrap/server/job.yaml Normal file
View file

@ -0,0 +1,186 @@
apiVersion: batch/v1
kind: Job
metadata:
name: stalwart-bootstrap
namespace: stalwart
spec:
backoffLimit: 3
template:
metadata:
labels:
app.kubernetes.io/name: stalwart-bootstrap
app.kubernetes.io/instance: stalwart
quorate.dev/zitadel-relay: "true"
spec:
serviceAccountName: stalwart
automountServiceAccountToken: false
restartPolicy: Never
runtimeClassName: gvisor
securityContext:
fsGroup: 65532
seccompProfile:
type: RuntimeDefault
initContainers:
- name: trust-bundle
image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
imagePullPolicy: IfNotPresent
command:
- /bin/sh
- -ec
args:
- cat /etc/ssl/certs/ca-certificates.crt /run/runtime/internal_ca_cert > /run/trust/ca-certificates.crt
securityContext:
runAsNonRoot: true
runAsUser: 2000
runAsGroup: 2000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
resources:
requests:
cpu: 5m
memory: 8Mi
limits:
cpu: 50m
memory: 16Mi
volumeMounts:
- name: runtime
mountPath: /run/runtime
readOnly: true
- name: trust
mountPath: /run/trust
- name: recovery
image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
imagePullPolicy: IfNotPresent
restartPolicy: Always
args:
- --config
- /etc/stalwart/config.json
env:
- name: SSL_CERT_FILE
value: /run/trust/ca-certificates.crt
- name: STALWART_RECOVERY_MODE
value: "true"
- name: STALWART_RECOVERY_MODE_PORT
value: "8080"
- name: STALWART_RECOVERY_ADMIN
valueFrom:
secretKeyRef:
name: stalwart-bootstrap
key: recovery_admin
- name: STALWART_DB_PASSWORD
valueFrom:
secretKeyRef:
name: stalwart-db
key: password
- name: STALWART_S3_SECRET_KEY
valueFrom:
secretKeyRef:
name: stalwart-runtime
key: s3_secret_key
- name: STALWART_CACHE_PASSWORD
valueFrom:
secretKeyRef:
name: stalwart-runtime
key: dragonfly_password
- name: STALWART_RELAY_PASSWORD
valueFrom:
secretKeyRef:
name: stalwart-delivery
key: relay_password
ports:
- name: management
containerPort: 8080
startupProbe:
tcpSocket:
port: management
failureThreshold: 90
periodSeconds: 2
readinessProbe:
httpGet:
path: /healthz/live
port: management
periodSeconds: 5
securityContext:
runAsNonRoot: true
runAsUser: 2000
runAsGroup: 2000
allowPrivilegeEscalation: false
capabilities:
add:
- NET_BIND_SERVICE
drop:
- ALL
readOnlyRootFilesystem: true
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: "1"
memory: 1Gi
volumeMounts:
- name: startup
mountPath: /etc/stalwart/config.json
subPath: config.json
readOnly: true
- name: runtime
mountPath: /run/runtime
readOnly: true
- name: tls
mountPath: /run/tls
readOnly: true
- name: trust
mountPath: /run/trust
readOnly: true
- name: tmp
mountPath: /tmp
containers:
- name: completion
image: docker.io/library/busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
imagePullPolicy: IfNotPresent
command:
- /bin/sh
- -ec
args:
- until wget -qO- http://stalwart-controller:9090/readyz >/dev/null 2>&1; do sleep 2; done
env:
- name: HOME
value: /tmp
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
resources:
requests:
cpu: 25m
memory: 32Mi
limits:
cpu: 250m
memory: 128Mi
volumeMounts:
- name: tmp
mountPath: /tmp
volumes:
- name: startup
configMap:
name: startup
- name: runtime
secret:
secretName: stalwart-runtime
defaultMode: 0440
- name: tls
secret:
secretName: stalwart-tls
defaultMode: 0440
- name: tmp
emptyDir: {}
- name: trust
emptyDir: {}

90
services/stalwart/k8s/bootstrap/server/policy.yaml Normal file
View file

@ -0,0 +1,90 @@
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: stalwart-bootstrap
namespace: stalwart
spec:
endpointSelector:
matchLabels:
app.kubernetes.io/name: stalwart-bootstrap
app.kubernetes.io/instance: stalwart
ingress:
- fromEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "8080"
protocol: TCP
- fromEntities:
- host
toPorts:
- ports:
- port: "8080"
protocol: TCP
egress:
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: postgres
cnpg.io/cluster: main
toPorts:
- ports:
- port: "5432"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: dragonfly
app.kubernetes.io/name: dragonfly
app: stalwart
toPorts:
- ports:
- port: "6379"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: versitygw
app.kubernetes.io/name: versitygw
app.kubernetes.io/instance: versitygw
toPorts:
- ports:
- port: "7070"
protocol: TCP
- toCIDR:
- 10.66.127.81/32
toPorts:
- ports:
- port: "443"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: stalwart
app.kubernetes.io/name: stalwart-controller
app.kubernetes.io/instance: stalwart
toPorts:
- ports:
- port: "9090"
protocol: TCP
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: kube-system
k8s-app: kube-dns
toPorts:
- ports:
- port: "53"
protocol: UDP
- port: "53"
protocol: TCP
rules:
dns:
- matchPattern: "*"
- toEndpoints:
- matchLabels:
k8s:io.kubernetes.pod.namespace: zitadel
app.kubernetes.io/name: zitadel-oidc-internal
app.kubernetes.io/instance: zitadel
toPorts:
- ports:
- port: "8443"
protocol: TCP

13
services/stalwart/k8s/bootstrap/server/secret.yaml Normal file
View file

@ -0,0 +1,13 @@
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
name: stalwart-bootstrap
namespace: stalwart
spec:
type: kv-v2
mount: secret
path: stalwart/bootstrap-credentials
destination:
name: stalwart-bootstrap
create: true
vaultAuthRef: default

13
services/stalwart/k8s/bootstrap/server/service.yaml Normal file
View file

@ -0,0 +1,13 @@
apiVersion: v1
kind: Service
metadata:
name: stalwart-bootstrap
namespace: stalwart
spec:
selector:
app.kubernetes.io/name: stalwart-bootstrap
app.kubernetes.io/instance: stalwart
ports:
- name: management
port: 8080
targetPort: management