176 lines
7 KiB
YAML
176 lines
7 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "remora.fullname" . }}-worker
|
|
labels:
|
|
{{- include "remora.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: worker
|
|
spec:
|
|
replicas: {{ .Values.worker.replicas }}
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxUnavailable: 0
|
|
maxSurge: 1
|
|
selector:
|
|
matchLabels:
|
|
{{- include "remora.selectorLabels" . | nindent 6 }}
|
|
app.kubernetes.io/component: worker
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "remora.selectorLabels" . | nindent 8 }}
|
|
app.kubernetes.io/component: worker
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
|
|
checksum/vault: {{ include (print $.Template.BasePath "/vault-agent.yaml") . | sha256sum }}
|
|
spec:
|
|
serviceAccountName: {{ include "remora.fullname" . }}-worker
|
|
automountServiceAccountToken: false
|
|
enableServiceLinks: false
|
|
dnsPolicy: {{ .Values.podDnsPolicy }}
|
|
{{- with .Values.podDnsConfig }}
|
|
dnsConfig:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
terminationGracePeriodSeconds: 60
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
topologySpreadConstraints:
|
|
- maxSkew: 1
|
|
topologyKey: kubernetes.io/hostname
|
|
whenUnsatisfiable: ScheduleAnyway
|
|
labelSelector:
|
|
matchLabels:
|
|
{{- include "remora.selectorLabels" . | nindent 14 }}
|
|
app.kubernetes.io/component: worker
|
|
containers:
|
|
- name: worker
|
|
image: {{ include "remora.image" .Values.worker.image | quote }}
|
|
imagePullPolicy: {{ .Values.worker.image.pullPolicy }}
|
|
command: [sh, -ec]
|
|
args:
|
|
- until test -s /vault/token/token; do sleep 0.2; done; exec /usr/local/bin/remora-worker
|
|
envFrom:
|
|
- configMapRef:
|
|
name: {{ include "remora.fullname" . }}-config
|
|
env:
|
|
- name: DATABASE_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.database.urlSecret.name }}
|
|
key: {{ .Values.database.urlSecret.key }}
|
|
- name: REMORA_COORDINATION_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.coordination.urlSecret.name }}
|
|
key: {{ .Values.coordination.urlSecret.key }}
|
|
- name: REMORA_TARGET_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.target.credentialsSecret.name }}
|
|
key: {{ .Values.target.credentialsSecret.accessKey }}
|
|
- name: REMORA_TARGET_SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.target.credentialsSecret.name }}
|
|
key: {{ .Values.target.credentialsSecret.secretKey }}
|
|
- {name: REMORA_DATABASE_MAX_CONNECTIONS, value: {{ .Values.database.maxWorkerConnections | quote }}}
|
|
- {name: REMORA_WORKER_LOCAL_ATTEMPT_LIMIT, value: {{ .Values.runtime.workerLocalAttemptLimit | quote }}}
|
|
- {name: REMORA_WORKER_API_URL, value: "https://{{ include "remora.fullname" . }}-worker:8443"}
|
|
- {name: REMORA_MANAGEMENT_BIND, value: "0.0.0.0:9090"}
|
|
- {name: REMORA_WORKER_TLS_CERT_FILE, value: /run/remora/tls/client.crt}
|
|
- {name: REMORA_WORKER_TLS_KEY_FILE, value: /run/remora/tls/client.key}
|
|
- {name: REMORA_WORKER_TLS_SERVER_CA_FILE, value: /run/remora/tls/ca.crt}
|
|
- {name: REMORA_VAULT_TOKEN_FILE, value: /vault/token/token}
|
|
- {name: TMPDIR, value: /run/remora/tmp}
|
|
ports:
|
|
- {name: management, containerPort: 9090}
|
|
readinessProbe:
|
|
httpGet: {path: /health/ready, port: management}
|
|
periodSeconds: 5
|
|
timeoutSeconds: 2
|
|
failureThreshold: 6
|
|
livenessProbe:
|
|
httpGet: {path: /health/live, port: management}
|
|
periodSeconds: 10
|
|
timeoutSeconds: 2
|
|
failureThreshold: 3
|
|
startupProbe:
|
|
httpGet: {path: /health/live, port: management}
|
|
periodSeconds: 2
|
|
failureThreshold: 90
|
|
resources:
|
|
{{- toYaml .Values.worker.resources | nindent 12 }}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- {name: worker-tls, mountPath: /run/remora/tls, readOnly: true}
|
|
- {name: temporary, mountPath: /run/remora/tmp}
|
|
- {name: vault-token, mountPath: /vault/token, readOnly: true}
|
|
- name: vault-agent
|
|
image: {{ .Values.vault.image | quote }}
|
|
imagePullPolicy: IfNotPresent
|
|
args: [agent, -config=/vault/config/config.hcl]
|
|
resources:
|
|
requests: {cpu: 10m, memory: 32Mi}
|
|
limits: {cpu: 250m, memory: 128Mi}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- {name: vault-config, mountPath: /vault/config, readOnly: true}
|
|
- {name: vault-token, mountPath: /vault/token}
|
|
- {name: vault-service-account, mountPath: /var/run/secrets/vault, readOnly: true}
|
|
{{- if .Values.vault.caSecret.name }}
|
|
- {name: vault-ca, mountPath: /vault/ca, readOnly: true}
|
|
{{- end }}
|
|
{{- if .Values.vault.caSecret.name }}
|
|
env:
|
|
- {name: VAULT_CACERT, value: /vault/ca/{{ .Values.vault.caSecret.key }}}
|
|
{{- end }}
|
|
volumes:
|
|
- name: worker-tls
|
|
secret:
|
|
secretName: {{ include "remora.fullname" . }}-worker-tls
|
|
items:
|
|
- {key: ca.crt, path: ca.crt}
|
|
- {key: client.crt, path: client.crt}
|
|
- {key: client.key, path: client.key}
|
|
- name: vault-config
|
|
configMap:
|
|
name: {{ include "remora.fullname" . }}-vault-worker
|
|
- name: vault-token
|
|
emptyDir:
|
|
medium: Memory
|
|
- name: temporary
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
- name: vault-service-account
|
|
projected:
|
|
sources:
|
|
- serviceAccountToken:
|
|
path: token
|
|
audience: {{ .Values.vault.audience | quote }}
|
|
expirationSeconds: 3600
|
|
{{- if .Values.vault.caSecret.name }}
|
|
- name: vault-ca
|
|
secret:
|
|
secretName: {{ .Values.vault.caSecret.name }}
|
|
items:
|
|
- {key: {{ .Values.vault.caSecret.key }}, path: {{ .Values.vault.caSecret.key }}}
|
|
{{- end }}
|