ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/layshaft/server.yaml

@@ -0,0 +1,133 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: layshaft
+  namespace: layshaft
+spec:
+  replicas: 2
+  selector:
+    matchLabels: &labels
+      app.kubernetes.io/name: layshaft
+      app.kubernetes.io/instance: layshaft
+  template:
+    metadata:
+      labels: *labels
+    spec:
+      serviceAccountName: layshaft
+      automountServiceAccountToken: false
+      imagePullSecrets:
+        - name: quay-cluster-pull
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels: *labels
+              topologyKey: kubernetes.io/hostname
+      dnsConfig:
+        options:
+          - name: ndots
+            value: "1"
+      initContainers:
+        - name: seed
+          image: &image registry.quorate.internal/quorate/layshaft@sha256:a35a0d0ef907fa1e15b586e65da9c6bc7daf923ad7507b79f6dc6a0745e23d16
+          args: [seed]
+          envFrom: &settings
+            - configMapRef:
+                name: settings
+          resources: &resources
+            requests: {cpu: 100m, memory: 64Mi}
+            limits: {memory: 256Mi}
+          securityContext: &restricted
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          volumeMounts:
+            - &kube-ca {name: kube-ca, mountPath: /ca/kube, readOnly: true}
+            - &vault-ca {name: vault-ca, mountPath: /ca/vault, readOnly: true}
+            - &vault-auth {name: vault-auth, mountPath: /auth/vault, readOnly: true}
+      containers:
+        - name: server
+          image: *image
+          args: [serve]
+          envFrom: *settings
+          resources: *resources
+          securityContext: *restricted
+          ports:
+            - {name: tls, containerPort: 8443}
+          readinessProbe:
+            tcpSocket: {port: tls}
+          volumeMounts:
+            - *kube-ca
+            - *vault-ca
+            - *vault-auth
+            - {name: kube-auth, mountPath: /auth/kube, readOnly: true}
+      volumes:
+        - name: kube-ca
+          configMap:
+            name: kube-root-ca.crt
+        - name: vault-ca
+          secret:
+            secretName: vault-ca
+            defaultMode: 0440
+        - name: kube-auth
+          projected:
+            defaultMode: 0440
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 1800
+        - name: vault-auth
+          projected:
+            defaultMode: 0440
+            sources:
+              - serviceAccountToken:
+                  path: token
+                  audience: layshaft-vault
+                  expirationSeconds: 1800
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: layshaft
+  namespace: layshaft
+  labels:
+    io.cilium/bgp-announce: "true"
+  annotations:
+    lbipam.cilium.io/ips: "10.232.82.173"
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  loadBalancerSourceRanges:
+    - 10.115.187.218/24
+    - 10.140.110.30/24
+    - 10.186.160.23/24
+    - 10.63.81.107/24
+    - 10.162.8.60/24
+  selector:
+    app.kubernetes.io/name: layshaft
+    app.kubernetes.io/instance: layshaft
+  ports:
+    - name: tls
+      port: 443
+      targetPort: tls
+      protocol: TCP
+      appProtocol: https
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: layshaft
+  namespace: layshaft
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: layshaft
+      app.kubernetes.io/instance: layshaft