unkinben
926f3b34ba
The privateHostnameGuard middleware blocks requests where the Host header is not in the allowlist. Kubelet httpGet probes use the pod IP as the Host header, which is never in the allowlist. Setting Host: localhost ensures probes are always permitted.
96 lines
2.8 KiB
YAML
96 lines
2.8 KiB
YAML
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: paperclip
|
|
namespace: paperclip
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: paperclip
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: paperclip
|
|
spec:
|
|
containers:
|
|
- name: paperclip
|
|
image: ghcr.io/paperclipai/paperclip:latest
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- containerPort: 3100
|
|
name: http
|
|
protocol: TCP
|
|
env:
|
|
- name: PORT
|
|
value: "3100"
|
|
- name: PAPERCLIP_BIND
|
|
value: custom
|
|
- name: PAPERCLIP_BIND_HOST
|
|
value: 0.0.0.0
|
|
- name: PAPERCLIP_API_URL
|
|
value: https://paperclip.k8s.syd1.au.unkin.net
|
|
- name: BETTER_AUTH_BASE_URL
|
|
value: https://paperclip.k8s.syd1.au.unkin.net
|
|
- name: PAPERCLIP_ALLOWED_HOSTNAMES
|
|
value: paperclip.k8s.syd1.au.unkin.net,localhost
|
|
- name: PAPERCLIP_HOME
|
|
value: /paperclip
|
|
- name: PAPERCLIP_INSTANCE_ID
|
|
value: default
|
|
- name: PAPERCLIP_DEPLOYMENT_MODE
|
|
value: authenticated
|
|
- name: PAPERCLIP_DEPLOYMENT_EXPOSURE
|
|
value: private
|
|
- name: SERVE_UI
|
|
value: "true"
|
|
- name: HEARTBEAT_SCHEDULER_ENABLED
|
|
value: "true"
|
|
- name: PAPERCLIP_MIGRATION_AUTO_APPLY
|
|
value: "true"
|
|
- name: PAPERCLIP_STORAGE_PROVIDER
|
|
value: s3
|
|
- name: PAPERCLIP_STORAGE_S3_BUCKET
|
|
value: paperclip
|
|
- name: PAPERCLIP_STORAGE_S3_REGION
|
|
value: us-east-1
|
|
- name: PAPERCLIP_STORAGE_S3_ENDPOINT
|
|
value: https://radosgw.service.consul
|
|
- name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
|
|
value: "true"
|
|
envFrom:
|
|
- secretRef:
|
|
name: paperclip-credentials
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3100
|
|
httpHeaders:
|
|
- name: Host
|
|
value: localhost
|
|
failureThreshold: 3
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 30
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/health
|
|
port: 3100
|
|
httpHeaders:
|
|
- name: Host
|
|
value: localhost
|
|
failureThreshold: 3
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 2Gi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
restartPolicy: Always
|