ce7cb702218693d08ea6d83464d2457c9250027c

vendor/workloads/tier-o-canary/configmap.yaml

@@ -0,0 +1,38 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tier-o-canary
+  namespace: tier-o-canary
+data:
+  nginx.conf: |
+    pid /tmp/nginx.pid;
+
+    events {}
+
+    http {
+      access_log /dev/stdout;
+      error_log /dev/stderr notice;
+      client_body_temp_path /tmp/client_body;
+      proxy_temp_path /tmp/proxy;
+      fastcgi_temp_path /tmp/fastcgi;
+      uwsgi_temp_path /tmp/uwsgi;
+      scgi_temp_path /tmp/scgi;
+
+      server {
+        listen 8080;
+        server_name _;
+
+        add_header Cache-Control "no-store" always;
+        add_header X-Quorate-Canary "tier-o" always;
+
+        location = /healthz {
+          default_type text/plain;
+          return 200 "ok\n";
+        }
+
+        location / {
+          default_type text/plain;
+          return 200 "tier-o-canary\n";
+        }
+      }
+    }

vendor/workloads/tier-o-canary/deployment.yaml

@@ -0,0 +1,91 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tier-o-canary
+  namespace: tier-o-canary
+  labels:
+    app.kubernetes.io/name: tier-o-canary
+    app.kubernetes.io/instance: tier-o-canary
+    app.kubernetes.io/component: canary
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tier-o-canary
+      app.kubernetes.io/instance: tier-o-canary
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tier-o-canary
+        app.kubernetes.io/instance: tier-o-canary
+        app.kubernetes.io/component: canary
+    spec:
+      runtimeClassName: gvisor
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        fsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: tier-o-canary
+                  app.kubernetes.io/instance: tier-o-canary
+              topologyKey: kubernetes.io/hostname
+      containers:
+        - name: nginx
+          image: cgr.dev/chainguard/nginx@sha256:0b4de0f60ae2295fdc852564d178b5473109baf9fc826fa5eb38a59f930e218e
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 25m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 1
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          volumeMounts:
+            - name: nginx-conf
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: nginx-conf
+          configMap:
+            name: tier-o-canary
+            items:
+              - key: nginx.conf
+                path: nginx.conf
+        - name: tmp
+          emptyDir: {}

vendor/workloads/tier-o-canary/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - configmap.yaml
+  - deployment.yaml
+  - service.yaml
+  - poddisruptionbudget.yaml
+  - network-policies.yaml

vendor/workloads/tier-o-canary/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tier-o-canary
+  labels:
+    security.quorate.internal/public-runtime: gvisor

vendor/workloads/tier-o-canary/network-policies.yaml

@@ -0,0 +1,61 @@
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: tier-o-canary
+  namespace: tier-o-canary
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: tier-o-canary
+      app.kubernetes.io/instance: tier-o-canary
+  ingress:
+    - fromEntities:
+        - host
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: cloudflare-tunnel
+            app.kubernetes.io/name: cloudflared
+            app.kubernetes.io/instance: cloudflare-tunnel
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-egress-tier-o-canary-probes
+spec:
+  nodeSelector: {}
+  egress:
+    - toEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: tier-o-canary
+            app.kubernetes.io/name: tier-o-canary
+            app.kubernetes.io/instance: tier-o-canary
+      toPorts:
+        - ports:
+            - port: "8080"
+              protocol: TCP
+---
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata:
+  name: host-ingress-tier-o-canary-probe-replies
+spec:
+  nodeSelector: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: tier-o-canary
+            app.kubernetes.io/name: tier-o-canary
+            app.kubernetes.io/instance: tier-o-canary
+      toPorts:
+        - ports:
+            - port: "32768"
+              endPort: 60999
+              protocol: TCP

vendor/workloads/tier-o-canary/poddisruptionbudget.yaml

@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: tier-o-canary
+  namespace: tier-o-canary
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tier-o-canary
+      app.kubernetes.io/instance: tier-o-canary

vendor/workloads/tier-o-canary/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tier-o-canary
+  namespace: tier-o-canary
+  labels:
+    app.kubernetes.io/name: tier-o-canary
+    app.kubernetes.io/instance: tier-o-canary
+spec:
+  selector:
+    app.kubernetes.io/name: tier-o-canary
+    app.kubernetes.io/instance: tier-o-canary
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP