147 lines
4.4 KiB
YAML
147 lines
4.4 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: oci-l4-relay
|
|
spec:
|
|
replicas: 2
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: oci-l4-relay
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: oci-l4-relay
|
|
spec:
|
|
serviceAccountName: oci-l4-relay
|
|
automountServiceAccountToken: true
|
|
hostNetwork: true
|
|
dnsPolicy: ClusterFirstWithHostNet
|
|
affinity:
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: oci-l4-relay
|
|
topologyKey: kubernetes.io/hostname
|
|
priorityClassName: system-node-critical
|
|
terminationGracePeriodSeconds: 35
|
|
containers:
|
|
- name: relay-agent
|
|
image: registry.quorate.internal/quorate/oci-l4-relay-agent@sha256:c5d82adbde80a5a3c3e3ecbbc5aebf53d449474cbcfc2e7a7988576edf068dfc
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_UID
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.uid
|
|
- name: POD_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
- name: POD_NODE_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.nodeName
|
|
- name: RELAY_TUNNEL_ADDRESS
|
|
value: 10.153.238.225/30
|
|
- name: RELAY_TARGETS
|
|
value: '[{"address":"10.104.40.127","ports":[80,443]}]'
|
|
- name: RELAY_MAIL_UPSTREAM
|
|
value: stalwart-relay.stalwart.svc.cluster.local
|
|
- name: RELAY_LOCAL_RETURN_CIDRS
|
|
value: 10.63.81.107/24,10.162.8.60/24
|
|
- name: RELAY_METRICS_LISTEN_ADDRESS
|
|
value: :19100
|
|
- name: OCI_RELAY_METRICS_URL
|
|
value: http://10.40.68.115:19100/metrics
|
|
- name: OCI_RELAY_ENDPOINT_IP
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: oci-l4-relay-oci-wireguard
|
|
key: endpoint_ip
|
|
- name: OCI_RELAY_LISTEN_PORT
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: oci-l4-relay-oci-wireguard
|
|
key: listen_port
|
|
- name: OCI_RELAY_PUBLIC_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: oci-l4-relay-oci-wireguard
|
|
key: public_key
|
|
ports:
|
|
- name: metrics
|
|
containerPort: 19100
|
|
protocol: TCP
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- NET_ADMIN
|
|
- NET_BIND_SERVICE
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- /oci-l4-relay-agent
|
|
- health
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
failureThreshold: 3
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- /oci-l4-relay-agent
|
|
- health
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 10
|
|
failureThreshold: 3
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 32Mi
|
|
limits:
|
|
memory: 128Mi
|
|
volumeMounts:
|
|
- name: home-wireguard
|
|
mountPath: /run/secrets/wireguard
|
|
readOnly: true
|
|
- name: runtime
|
|
mountPath: /run/relay-agent
|
|
volumes:
|
|
- name: home-wireguard
|
|
secret:
|
|
secretName: oci-l4-relay-home-wireguard
|
|
defaultMode: 0400
|
|
- name: runtime
|
|
emptyDir:
|
|
medium: Memory
|
|
---
|
|
apiVersion: policy/v1
|
|
kind: PodDisruptionBudget
|
|
metadata:
|
|
name: oci-l4-relay
|
|
spec:
|
|
minAvailable: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: oci-l4-relay
|