ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/short-canary/deployment.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata: {name: canary, namespace: short}
+spec:
+  replicas: 2
+  selector:
+    matchLabels: {app.kubernetes.io/name: short-canary}
+  template:
+    metadata:
+      labels: {app.kubernetes.io/name: short-canary, app.kubernetes.io/instance: short}
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        seccompProfile: {type: RuntimeDefault}
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              labelSelector:
+                matchLabels: {app.kubernetes.io/name: short-canary, app.kubernetes.io/instance: short}
+      containers:
+        - name: nginx
+          image: docker.io/nginx/nginx-unprivileged@sha256:2daef144b574804198caccc4041819fa1801ecd5df2252a39646bfa2b1ff3bea
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities: {drop: [ALL]}
+          resources:
+            requests: {cpu: 25m, memory: 16Mi}
+            limits: {memory: 64Mi}
+          ports: [{name: http, containerPort: 8080}]
+          readinessProbe:
+            httpGet: {path: /, port: http}
+          volumeMounts:
+            - {name: temp, mountPath: /tmp}
+            - {name: nginx, mountPath: /etc/nginx/nginx.conf, subPath: nginx.conf, readOnly: true}
+      volumes:
+        - {name: temp, emptyDir: {}}
+        - {name: nginx, configMap: {name: nginx}}
+---
+apiVersion: v1
+kind: Service
+metadata: {name: canary, namespace: short}
+spec:
+  selector: {app.kubernetes.io/name: short-canary}
+  ports: [{name: http, port: 80, targetPort: http}]

vendor/workloads/short-canary/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - deployment.yaml
+  - pdb.yaml
+  - routes.yaml
+  - policy.yaml
+  - probes.yaml
+configMapGenerator:
+  - name: nginx
+    namespace: short
+    files: [nginx.conf]

vendor/workloads/short-canary/nginx.conf

@@ -0,0 +1,19 @@
+worker_processes 1;
+pid /tmp/nginx.pid;
+error_log /dev/stderr;
+events {}
+http {
+  access_log /dev/stdout;
+  client_body_temp_path /tmp/client;
+  proxy_temp_path /tmp/proxy;
+  fastcgi_temp_path /tmp/fastcgi;
+  uwsgi_temp_path /tmp/uwsgi;
+  scgi_temp_path /tmp/scgi;
+  server {
+    listen 8080;
+    default_type text/plain;
+    location / {
+      return 200 "Tier S canary\n";
+    }
+  }
+}

vendor/workloads/short-canary/pdb.yaml

@@ -0,0 +1,7 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata: {name: canary, namespace: short}
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels: {app.kubernetes.io/name: short-canary, app.kubernetes.io/instance: short}

vendor/workloads/short-canary/policy.yaml

@@ -0,0 +1,39 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata: {name: canary, namespace: short}
+spec:
+  endpointSelector:
+    matchLabels: {app.kubernetes.io/name: short-canary, app.kubernetes.io/instance: short}
+  ingress:
+    - fromEntities: [host, ingress]
+      toPorts:
+        - ports: [{port: "8080", protocol: TCP}]
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata: {name: short-canary-egress}
+spec:
+  endpointSelector:
+    matchLabels: {"reserved:ingress": ""}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: short-canary
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "8080", protocol: TCP}]
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata: {name: short-canary-replies}
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: short-canary
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "32768", endPort: 60999, protocol: TCP}]

vendor/workloads/short-canary/probes.yaml

@@ -0,0 +1,13 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata: {name: short-probes}
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: short-canary
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "8080", protocol: TCP}]

vendor/workloads/short-canary/routes.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata: {name: redirect, namespace: short}
+spec:
+  parentRefs: [{name: gateway-short, namespace: kube-system, sectionName: http}]
+  hostnames: [nlb-canary.quorate.dev]
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect: {scheme: https, statusCode: 301}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata: {name: canary, namespace: short}
+spec:
+  parentRefs: [{name: gateway-short, namespace: kube-system, sectionName: https}]
+  hostnames: [nlb-canary.quorate.dev]
+  rules:
+    - backendRefs: [{name: canary, port: 80}]