unkin-agent
5faaff8d19
Drop the bespoke ghp SA/role/policy (terraform-vault#120 closed). The default
k8s auth role, bound to SA default in every namespace, already has a templated
read grant on kv/kubernetes/namespace/<ns>/default/*, so ghp needs zero
terraform-vault change.
- Remove the custom ServiceAccount; run as the namespace default SA.
- Deployment + migrate Job: serviceAccountName default.
- VaultAuth: role/serviceAccount default (mirrors artifactapi).
- VaultStaticSecrets: source paths move to the templated location
kubernetes/namespace/ghp/default/{github-app,app}; Secret names unchanged.
146 lines
4.4 KiB
YAML
146 lines
4.4 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: ghp
|
|
namespace: ghp
|
|
annotations:
|
|
# Wave 2: serve only after the wave-1 migrate Job completes.
|
|
argocd.argoproj.io/sync-wave: "2"
|
|
configmap.reloader.stakater.com/auto: "true"
|
|
secret.reloader.stakater.com/reload: "ghp-github-app,ghp-app,ghp-tls,postgres-app"
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels:
|
|
app: ghp
|
|
strategy:
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: ghp
|
|
spec:
|
|
serviceAccountName: default
|
|
automountServiceAccountToken: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: ghp
|
|
image: artifactapi.k8s.syd1.au.unkin.net/ghcr/goodtune/ghp:0.20.0
|
|
imagePullPolicy: IfNotPresent
|
|
# Drop the image's default --migrate so replicas never race migrations;
|
|
# schema is applied by the wave-1 migrate hook Job instead.
|
|
command: ["/ghp", "serve"]
|
|
ports:
|
|
- containerPort: 8443
|
|
name: https
|
|
protocol: TCP
|
|
- containerPort: 8080
|
|
name: http
|
|
protocol: TCP
|
|
- containerPort: 9136
|
|
name: metrics
|
|
protocol: TCP
|
|
envFrom:
|
|
- configMapRef:
|
|
name: ghp-env
|
|
optional: false
|
|
env:
|
|
# DSN assembled from the CNPG-generated postgres-app Secret; $(VAR)
|
|
# expansion resolves the two env entries defined above it.
|
|
- name: GHP_DB_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-app
|
|
key: username
|
|
- name: GHP_DB_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: postgres-app
|
|
key: password
|
|
- name: GHP_DATABASE_DSN
|
|
value: "postgres://$(GHP_DB_USER):$(GHP_DB_PASSWORD)@postgres-rw.ghp.svc:5432/ghp?sslmode=require"
|
|
- name: GHP_GITHUB_APP_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-github-app
|
|
key: app_id
|
|
- name: GHP_GITHUB_CLIENT_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-github-app
|
|
key: client_id
|
|
- name: GHP_GITHUB_CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-github-app
|
|
key: client_secret
|
|
- name: GHP_ENCRYPTION_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ghp-app
|
|
key: encryption_key
|
|
volumeMounts:
|
|
- name: github-app
|
|
mountPath: /etc/ghp/github-app
|
|
readOnly: true
|
|
- name: tls
|
|
mountPath: /etc/ghp/tls
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /metrics
|
|
port: metrics
|
|
scheme: HTTP
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /metrics
|
|
port: metrics
|
|
scheme: HTTP
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
resources:
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: "1"
|
|
memory: 512Mi
|
|
volumes:
|
|
- name: github-app
|
|
secret:
|
|
secretName: ghp-github-app
|
|
- name: tls
|
|
secret:
|
|
secretName: ghp-tls
|
|
# Writable scratch: root FS is read-only. Disk-backed (not memory medium)
|
|
# so codeload tarball staging doesn't count against the pod memory limit.
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 2Gi
|
|
restartPolicy: Always
|