tegwick
2456287e8c
The two flex-auth Deployments were applied from a YAML file that lived outside this repo, so the only surviving copy of their authored spec was the last-applied-configuration annotation on the live objects. That made rollback depend on a cluster annotation -- recovered them into deploy/ before the FLEX-WP-0010 rollout rather than after an incident. Covers Deployment, Service, and the default-deny NetworkPolicy for both flex-auth-tenant-engine and flex-auth-user-engine. Verified with kubectl apply --dry-run=server: Deployments and Services round-trip as unchanged. The NetworkPolicies report "configured" because the manifests keep an explicit egress: [] that the API server normalises away -- same deny-all semantics, documented so nobody chases it. The runbook records that policy packages are baked into the image with no hot reload, that both Deployments share one image repo at deliberately different digests (so roll only the one whose policy changed), and pins both last-known-good digests as rollback targets. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
95 lines
2.2 KiB
YAML
95 lines
2.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: flex-auth-tenant-engine
|
|
namespace: flex-auth
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: flex-auth-tenant-engine
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: flex-auth-tenant-engine
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- args:
|
|
- serve
|
|
- --addr
|
|
- 0.0.0.0:8080
|
|
- --registry
|
|
- /opt/flex-auth/examples/tenant-engine/registry_snapshot.json
|
|
- --policy
|
|
- /opt/flex-auth/examples/tenant-engine/policy_package.md
|
|
image: forgejo.coulomb.social/coulomb/flex-auth@sha256:c25fc34a6cd7e64d955f8723ec70e176a583d5ae71d76280c4e2d89fba0fe0aa
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
periodSeconds: 20
|
|
name: flex-auth
|
|
ports:
|
|
- containerPort: 8080
|
|
name: http
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: http
|
|
periodSeconds: 5
|
|
resources:
|
|
limits:
|
|
cpu: 300m
|
|
memory: 192Mi
|
|
requests:
|
|
cpu: 25m
|
|
memory: 32Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: flex-auth-tenant-engine
|
|
namespace: flex-auth
|
|
spec:
|
|
ports:
|
|
- name: http
|
|
port: 8080
|
|
targetPort: http
|
|
selector:
|
|
app.kubernetes.io/name: flex-auth-tenant-engine
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: flex-auth-tenant-engine
|
|
namespace: flex-auth
|
|
spec:
|
|
egress: []
|
|
ingress:
|
|
- from:
|
|
- namespaceSelector:
|
|
matchLabels:
|
|
kubernetes.io/metadata.name: tenant-engine
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: tenant-engine
|
|
ports:
|
|
- port: 8080
|
|
protocol: TCP
|
|
podSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: flex-auth-tenant-engine
|
|
policyTypes:
|
|
- Ingress
|
|
- Egress
|