ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
272
services/stalwart/k8s/normal/server/deploy.yaml
Normal file
272
services/stalwart/k8s/normal/server/deploy.yaml
Normal file
|
|
@ -0,0 +1,272 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: stalwart
|
||||
namespace: stalwart
|
||||
spec:
|
||||
replicas: 2
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 0
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: stalwart
|
||||
app.kubernetes.io/instance: stalwart
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
quorate.internal/configuration-revision: 712f9ab87e927320c07127aadb44f41bdbcce7f7e34c56b7c67179efefb80f0e
|
||||
labels:
|
||||
app.kubernetes.io/name: stalwart
|
||||
app.kubernetes.io/instance: stalwart
|
||||
quorate.dev/zitadel-relay: "true"
|
||||
spec:
|
||||
serviceAccountName: stalwart
|
||||
automountServiceAccountToken: false
|
||||
runtimeClassName: gvisor
|
||||
securityContext:
|
||||
fsGroup: 65532
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
topologySpreadConstraints:
|
||||
- maxSkew: 1
|
||||
minDomains: 2
|
||||
topologyKey: kubernetes.io/hostname
|
||||
whenUnsatisfiable: DoNotSchedule
|
||||
labelSelector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: stalwart
|
||||
app.kubernetes.io/instance: stalwart
|
||||
initContainers:
|
||||
- name: trust-bundle
|
||||
image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
|
||||
imagePullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
- -ec
|
||||
args:
|
||||
- cat /etc/ssl/certs/ca-certificates.crt /run/runtime/internal_ca_cert > /run/trust/ca-certificates.crt
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
runAsGroup: 2000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 5m
|
||||
memory: 8Mi
|
||||
limits:
|
||||
cpu: 50m
|
||||
memory: 16Mi
|
||||
volumeMounts:
|
||||
- name: runtime
|
||||
mountPath: /run/runtime
|
||||
readOnly: true
|
||||
- name: trust
|
||||
mountPath: /run/trust
|
||||
- name: wait-zitadel
|
||||
image: registry.quorate.internal/quorate/stalwart-controller:delivery-318c46b68e20be4d793a344ea1e5464e436edbaa@sha256:70704960a5bf3eb8398c8f26ecaefe7341faa2e7e65c16fa3c40a8e13c94b7dd
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- wait-oidc
|
||||
- /run/oidc/issuer_url
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 16Mi
|
||||
limits:
|
||||
cpu: 100m
|
||||
memory: 32Mi
|
||||
volumeMounts:
|
||||
- name: oidc
|
||||
mountPath: /run/oidc
|
||||
readOnly: true
|
||||
containers:
|
||||
- name: stalwart
|
||||
image: ghcr.io/stalwartlabs/stalwart:v1.0.1@sha256:b9da4df8b4efc06bc926dd6e990bdeb0ad7b9261a7c3893d74b0461a00bb389b
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --config
|
||||
- /etc/stalwart/config.json
|
||||
env:
|
||||
- name: SSL_CERT_FILE
|
||||
value: /run/trust/ca-certificates.crt
|
||||
- name: STALWART_DB_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: stalwart-db
|
||||
key: password
|
||||
- name: STALWART_S3_SECRET_KEY
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: stalwart-runtime
|
||||
key: s3_secret_key
|
||||
- name: STALWART_CACHE_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: stalwart-runtime
|
||||
key: dragonfly_password
|
||||
- name: STALWART_RELAY_PASSWORD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: stalwart-delivery
|
||||
key: relay_password
|
||||
ports:
|
||||
- name: management
|
||||
containerPort: 8080
|
||||
- name: user-http
|
||||
containerPort: 8081
|
||||
- name: smtp
|
||||
containerPort: 25
|
||||
- name: submissions
|
||||
containerPort: 465
|
||||
- name: submission
|
||||
containerPort: 587
|
||||
- name: imaps
|
||||
containerPort: 993
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /healthz/live
|
||||
port: management
|
||||
failureThreshold: 90
|
||||
periodSeconds: 2
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz/live
|
||||
port: management
|
||||
periodSeconds: 10
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz/live
|
||||
port: management
|
||||
periodSeconds: 5
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
runAsGroup: 2000
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
volumeMounts:
|
||||
- name: startup
|
||||
mountPath: /etc/stalwart/config.json
|
||||
subPath: config.json
|
||||
readOnly: true
|
||||
- name: runtime
|
||||
mountPath: /run/runtime
|
||||
readOnly: true
|
||||
- name: tls
|
||||
mountPath: /run/tls
|
||||
readOnly: true
|
||||
- name: trust
|
||||
mountPath: /run/trust
|
||||
readOnly: true
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: account-web
|
||||
image: registry.quorate.internal/quorate/mail-keys@sha256:447051628ca4aa92371acb83092f323047eab961a45140ef0877a3495ec2d98a
|
||||
imagePullPolicy: IfNotPresent
|
||||
ports:
|
||||
- name: account-http
|
||||
containerPort: 8082
|
||||
protocol: TCP
|
||||
- name: user-https
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
startupProbe:
|
||||
tcpSocket:
|
||||
port: user-https
|
||||
failureThreshold: 30
|
||||
periodSeconds: 2
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /account/oauth/callback
|
||||
port: 8443
|
||||
scheme: HTTPS
|
||||
httpHeaders:
|
||||
- name: Host
|
||||
value: mail.quorate.dev
|
||||
periodSeconds: 5
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: user-https
|
||||
periodSeconds: 15
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
runAsGroup: 65532
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
resources:
|
||||
requests:
|
||||
cpu: 25m
|
||||
memory: 32Mi
|
||||
limits:
|
||||
memory: 64Mi
|
||||
volumeMounts:
|
||||
- name: account-config
|
||||
mountPath: /run/config
|
||||
readOnly: true
|
||||
- name: tls
|
||||
mountPath: /run/tls
|
||||
readOnly: true
|
||||
- name: nginx-tmp
|
||||
mountPath: /tmp
|
||||
volumes:
|
||||
- name: account-config
|
||||
secret:
|
||||
secretName: mail-web
|
||||
defaultMode: 0440
|
||||
items:
|
||||
- key: config.json
|
||||
path: config.json
|
||||
- name: startup
|
||||
configMap:
|
||||
name: startup
|
||||
- name: runtime
|
||||
secret:
|
||||
secretName: stalwart-runtime
|
||||
defaultMode: 0440
|
||||
- name: tls
|
||||
secret:
|
||||
secretName: stalwart-tls
|
||||
defaultMode: 0440
|
||||
- name: oidc
|
||||
secret:
|
||||
secretName: stalwart-oidc
|
||||
defaultMode: 0440
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: nginx-tmp
|
||||
emptyDir: {}
|
||||
- name: trust
|
||||
emptyDir: {}
|
||||
Loading…
Reference in a new issue