133 lines
4.4 KiB
YAML
133 lines
4.4 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: stalwart-controller
|
|
namespace: stalwart
|
|
spec:
|
|
replicas: 2
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
maxSurge: 0
|
|
template:
|
|
spec:
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
minDomains: 2
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: DoNotSchedule
|
|
labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: stalwart-controller
|
|
app.kubernetes.io/instance: stalwart
|
|
containers:
|
|
- name: controller
|
|
args:
|
|
- --dsn-file
|
|
- /run/database/dsn
|
|
- --plan
|
|
- /desired/plan.json
|
|
- --secret-root
|
|
- /run/control
|
|
- --stalwart-url
|
|
- http://stalwart-admin.stalwart.svc.cluster.local:8080
|
|
- --certificate-san
|
|
- mail.quorate.dev
|
|
- --oidc-issuer-file
|
|
- /run/control/oidc_issuer_url
|
|
- --oidc-audience-file
|
|
- /run/control/oidc_audience
|
|
- --oidc-client-id-file
|
|
- /run/control/oidc_client_id
|
|
- --oidc-client-secret-file
|
|
- /run/control/oidc_client_secret
|
|
- --app-passwords
|
|
- /desired/app-passwords.json
|
|
- --vault-address
|
|
- https://vault.vault.svc.cluster.local:8200
|
|
- --vault-role
|
|
- stalwart-cred-writer
|
|
- --vault-token-file
|
|
- /run/vault/token
|
|
- --vault-ca-cert-file
|
|
- /run/control/internal_ca_cert
|
|
- --status-address
|
|
- 0.0.0.0:9090
|
|
- --interval
|
|
- 5m
|
|
- --initial-backoff
|
|
- 5s
|
|
- --max-backoff
|
|
- 5m
|
|
- --reconcile-timeout
|
|
- 2m
|
|
- --persistent-failure-after
|
|
- "5"
|
|
- --standby-ready
|
|
volumeMounts:
|
|
- name: control
|
|
mountPath: /run/control
|
|
readOnly: true
|
|
- name: vault-token
|
|
mountPath: /run/vault
|
|
readOnly: true
|
|
volumes:
|
|
- name: control
|
|
projected:
|
|
defaultMode: 0440
|
|
sources:
|
|
- secret:
|
|
name: stalwart-oidc
|
|
items:
|
|
- key: audience
|
|
path: oidc_audience
|
|
- key: client_id
|
|
path: oidc_client_id
|
|
- key: client_secret
|
|
path: oidc_client_secret
|
|
- key: controller_subject
|
|
path: oidc_controller_subject
|
|
- key: human_admin_subject
|
|
path: oidc_human_admin_subject
|
|
- key: issuer_url
|
|
path: oidc_issuer_url
|
|
- key: notifier_subject
|
|
path: oidc_notifier_subject
|
|
- key: notifier_client_id
|
|
path: notifier_client_id
|
|
- key: notifier_client_secret
|
|
path: notifier_client_secret
|
|
- key: sender_subject
|
|
path: oidc_sender_subject
|
|
- key: sender_client_id
|
|
path: sender_client_id
|
|
- key: sender_client_secret
|
|
path: sender_client_secret
|
|
- key: test_client_id
|
|
path: test_client_id
|
|
- key: test_client_secret
|
|
path: test_client_secret
|
|
- key: test_subject
|
|
path: oidc_test_subject
|
|
- secret:
|
|
name: stalwart-runtime
|
|
items:
|
|
- key: dragonfly_url
|
|
path: dragonfly_url
|
|
- key: internal_ca_cert
|
|
path: internal_ca_cert
|
|
- secret:
|
|
name: stalwart-delivery
|
|
items:
|
|
- key: relay_endpoint
|
|
path: relay_endpoint
|
|
- key: relay_username
|
|
path: relay_username
|
|
- name: vault-token
|
|
projected:
|
|
defaultMode: 0440
|
|
sources:
|
|
- serviceAccountToken:
|
|
path: token
|
|
expirationSeconds: 600
|