ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
133
services/stalwart/k8s/normal/controller/deploy.yaml
Normal file
133
services/stalwart/k8s/normal/controller/deploy.yaml
Normal file
|
|
@ -0,0 +1,133 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: stalwart-controller
|
||||
namespace: stalwart
|
||||
spec:
|
||||
replicas: 2
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 0
|
||||
template:
|
||||
spec:
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
minDomains: 2
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: DoNotSchedule
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: stalwart-controller
|
||||
app.kubernetes.io/instance: stalwart
|
||||
containers:
|
||||
- name: controller
|
||||
args:
|
||||
- --dsn-file
|
||||
- /run/database/dsn
|
||||
- --plan
|
||||
- /desired/plan.json
|
||||
- --secret-root
|
||||
- /run/control
|
||||
- --stalwart-url
|
||||
- http://stalwart-admin.stalwart.svc.cluster.local:8080
|
||||
- --certificate-san
|
||||
- mail.quorate.dev
|
||||
- --oidc-issuer-file
|
||||
- /run/control/oidc_issuer_url
|
||||
- --oidc-audience-file
|
||||
- /run/control/oidc_audience
|
||||
- --oidc-client-id-file
|
||||
- /run/control/oidc_client_id
|
||||
- --oidc-client-secret-file
|
||||
- /run/control/oidc_client_secret
|
||||
- --app-passwords
|
||||
- /desired/app-passwords.json
|
||||
- --vault-address
|
||||
- https://vault.vault.svc.cluster.local:8200
|
||||
- --vault-role
|
||||
- stalwart-cred-writer
|
||||
- --vault-token-file
|
||||
- /run/vault/token
|
||||
- --vault-ca-cert-file
|
||||
- /run/control/internal_ca_cert
|
||||
- --status-address
|
||||
- 0.0.0.0:9090
|
||||
- --interval
|
||||
- 5m
|
||||
- --initial-backoff
|
||||
- 5s
|
||||
- --max-backoff
|
||||
- 5m
|
||||
- --reconcile-timeout
|
||||
- 2m
|
||||
- --persistent-failure-after
|
||||
- "5"
|
||||
- --standby-ready
|
||||
volumeMounts:
|
||||
- name: control
|
||||
mountPath: /run/control
|
||||
readOnly: true
|
||||
- name: vault-token
|
||||
mountPath: /run/vault
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: control
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- secret:
|
||||
name: stalwart-oidc
|
||||
items:
|
||||
- key: audience
|
||||
path: oidc_audience
|
||||
- key: client_id
|
||||
path: oidc_client_id
|
||||
- key: client_secret
|
||||
path: oidc_client_secret
|
||||
- key: controller_subject
|
||||
path: oidc_controller_subject
|
||||
- key: human_admin_subject
|
||||
path: oidc_human_admin_subject
|
||||
- key: issuer_url
|
||||
path: oidc_issuer_url
|
||||
- key: notifier_subject
|
||||
path: oidc_notifier_subject
|
||||
- key: notifier_client_id
|
||||
path: notifier_client_id
|
||||
- key: notifier_client_secret
|
||||
path: notifier_client_secret
|
||||
- key: sender_subject
|
||||
path: oidc_sender_subject
|
||||
- key: sender_client_id
|
||||
path: sender_client_id
|
||||
- key: sender_client_secret
|
||||
path: sender_client_secret
|
||||
- key: test_client_id
|
||||
path: test_client_id
|
||||
- key: test_client_secret
|
||||
path: test_client_secret
|
||||
- key: test_subject
|
||||
path: oidc_test_subject
|
||||
- secret:
|
||||
name: stalwart-runtime
|
||||
items:
|
||||
- key: dragonfly_url
|
||||
path: dragonfly_url
|
||||
- key: internal_ca_cert
|
||||
path: internal_ca_cert
|
||||
- secret:
|
||||
name: stalwart-delivery
|
||||
items:
|
||||
- key: relay_endpoint
|
||||
path: relay_endpoint
|
||||
- key: relay_username
|
||||
path: relay_username
|
||||
- name: vault-token
|
||||
projected:
|
||||
defaultMode: 0440
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
expirationSeconds: 600
|
||||
Loading…
Reference in a new issue