unkin-agent
200a241d42
Add apps/base/repospawner with namespace, service account, job-spawning RBAC, the server Deployment, oauth2-proxy front door, internal and external gateways, and the VaultStaticSecrets backing them. Register the overlay in the platform ApplicationSet and AppProject.
124 lines
4.1 KiB
YAML
124 lines
4.1 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: repospawner
|
|
namespace: repospawner
|
|
annotations:
|
|
secret.reloader.stakater.com/reload: "repospawner-woodpecker"
|
|
spec:
|
|
# Request state lives in memory and is rebuilt from Job labels on startup, so
|
|
# exactly one replica may exist at a time.
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: repospawner
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: repospawner
|
|
spec:
|
|
serviceAccountName: repospawner
|
|
automountServiceAccountToken: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: repospawner
|
|
image: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0
|
|
imagePullPolicy: IfNotPresent
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
protocol: TCP
|
|
env:
|
|
- name: REPOSPAWNER_NAMESPACE
|
|
value: repospawner
|
|
# The server passes its own image down to the Jobs, so this must
|
|
# match the image above exactly.
|
|
- name: REPOSPAWNER_IMAGE
|
|
value: artifactapi.k8s.syd1.au.unkin.net/docker-internal/repospawner:v0.1.0
|
|
- name: REPOSPAWNER_JOB_SERVICE_ACCOUNT
|
|
value: repospawner
|
|
- name: GITEA_URL
|
|
value: https://git.unkin.net
|
|
- name: REPOSPAWNER_TFGIT_REPO
|
|
value: unkin/terraform-git
|
|
- name: VAULT_ADDR
|
|
value: https://vault.service.consul:8200
|
|
- name: WOODPECKER_SERVER
|
|
value: https://ci.k8s.syd1.au.unkin.net
|
|
# Name only: the enablement Job mounts this Secret itself.
|
|
- name: REPOSPAWNER_WOODPECKER_SECRET
|
|
value: repospawner-woodpecker
|
|
- name: REPOSPAWNER_WOODPECKER_TOKEN_FILE
|
|
value: /etc/repospawner/woodpecker/token
|
|
# oauth2-proxy --pass-user-headers forwards the Authentik groups as a
|
|
# comma-joined X-Forwarded-Groups; X-Auth-Request-Groups is
|
|
# auth_request-response-only and never reaches a proxied upstream.
|
|
- name: REPOSPAWNER_GROUPS_HEADER
|
|
value: X-Forwarded-Groups
|
|
- name: REPOSPAWNER_ALLOWED_GROUPS
|
|
value: akP-repospawner-admin
|
|
volumeMounts:
|
|
- name: vault-token
|
|
mountPath: /var/run/secrets/vault
|
|
readOnly: true
|
|
- name: woodpecker-token
|
|
mountPath: /etc/repospawner/woodpecker
|
|
readOnly: true
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /livez
|
|
port: http
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 30
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readyz
|
|
port: http
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
timeoutSeconds: 5
|
|
failureThreshold: 3
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 64Mi
|
|
limits:
|
|
cpu: 300m
|
|
memory: 256Mi
|
|
volumes:
|
|
# Native Vault kubernetes login: the default kubernetes.io token has the
|
|
# wrong audience, so the app reads this audience-vault projection.
|
|
- name: vault-token
|
|
projected:
|
|
sources:
|
|
- serviceAccountToken:
|
|
path: token
|
|
audience: vault
|
|
expirationSeconds: 600
|
|
# Optional: absent, the server starts and refuses woodpecker requests.
|
|
- name: woodpecker-token
|
|
secret:
|
|
secretName: repospawner-woodpecker
|
|
optional: true
|
|
items:
|
|
- key: token
|
|
path: token
|
|
restartPolicy: Always
|