forked from ungleich-public/ungleich-user
Sajeyks
4eeb25a3ea
A kustomize base with a Deployment (2 replicas, migrate_locked init container, liveness, readiness and startup probes, uid 10001 with a read-only root filesystem, all capabilities dropped, RuntimeDefault seccomp, no service account token, resource requests and limits), plus a Service, an Ingress for account.ungleich.ch, a PodDisruptionBudget and a ConfigMap with every non-secret setting. The Secret is not part of the base, so credentials stay out of git; secret.example.yaml and the README show how to create it. The README also lists what the cluster must provide and what to confirm before going live (StartTLS on the LDAP servers, HSTS).
25 lines
710 B
YAML
25 lines
710 B
YAML
# Base manifests for the ungleich account webapp.
|
|
#
|
|
# kubectl apply -k deploy/k8s/base # after creating the Secret
|
|
#
|
|
# The Secret "ungleich-user" is not part of this base; create it from
|
|
# secret.example.yaml (or your secret manager) before applying.
|
|
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
labels:
|
|
- pairs:
|
|
app.kubernetes.io/name: ungleich-user
|
|
includeSelectors: true
|
|
|
|
resources:
|
|
- configmap.yaml
|
|
- deployment.yaml
|
|
- service.yaml
|
|
- ingress.yaml
|
|
- pdb.yaml
|
|
|
|
images:
|
|
- name: ungleich-user
|
|
newName: ungleich-user # set to your registry, e.g. registry.example.com/ungleich-user
|
|
newTag: latest # pin a release tag or digest in production
|