tegwick
1321361d85
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
250 lines
7.5 KiB
JSON
250 lines
7.5 KiB
JSON
{
|
|
"apiVersion": "v1",
|
|
"kind": "List",
|
|
"items": [
|
|
{
|
|
"apiVersion": "v1",
|
|
"kind": "PersistentVolumeClaim",
|
|
"metadata": {
|
|
"name": "state-hub-memo-dispatch",
|
|
"namespace": "state-hub",
|
|
"annotations": {
|
|
"state-hub.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
|
}
|
|
},
|
|
"spec": {
|
|
"accessModes": [
|
|
"ReadWriteOnce"
|
|
],
|
|
"storageClassName": "local-path",
|
|
"resources": {
|
|
"requests": {
|
|
"storage": "1Gi"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "apps/v1",
|
|
"kind": "Deployment",
|
|
"metadata": {
|
|
"name": "state-hub-memo-dispatch",
|
|
"namespace": "state-hub",
|
|
"annotations": {
|
|
"state-hub.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
|
}
|
|
},
|
|
"spec": {
|
|
"replicas": 1,
|
|
"strategy": {
|
|
"type": "Recreate"
|
|
},
|
|
"selector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "state-hub",
|
|
"app.kubernetes.io/component": "memo-dispatch"
|
|
}
|
|
},
|
|
"template": {
|
|
"metadata": {
|
|
"labels": {
|
|
"app.kubernetes.io/name": "state-hub",
|
|
"app.kubernetes.io/component": "memo-dispatch"
|
|
}
|
|
},
|
|
"spec": {
|
|
"serviceAccountName": "state-hub",
|
|
"automountServiceAccountToken": false,
|
|
"terminationGracePeriodSeconds": 15,
|
|
"securityContext": {
|
|
"runAsNonRoot": true,
|
|
"runAsUser": 10001,
|
|
"runAsGroup": 10001,
|
|
"fsGroup": 10001,
|
|
"fsGroupChangePolicy": "OnRootMismatch",
|
|
"seccompProfile": {
|
|
"type": "RuntimeDefault"
|
|
}
|
|
},
|
|
"containers": [
|
|
{
|
|
"name": "dispatcher",
|
|
"image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
|
|
"securityContext": {
|
|
"allowPrivilegeEscalation": false,
|
|
"readOnlyRootFilesystem": true,
|
|
"capabilities": {
|
|
"drop": [
|
|
"ALL"
|
|
]
|
|
}
|
|
},
|
|
"resources": {
|
|
"requests": {
|
|
"cpu": "5m",
|
|
"memory": "24Mi"
|
|
},
|
|
"limits": {
|
|
"cpu": "100m",
|
|
"memory": "96Mi"
|
|
}
|
|
},
|
|
"volumeMounts": [
|
|
{
|
|
"name": "queue",
|
|
"mountPath": "/data"
|
|
},
|
|
{
|
|
"name": "intake-caller",
|
|
"mountPath": "/var/run/secrets/state-hub/informed-decision",
|
|
"readOnly": true
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"volumes": [
|
|
{
|
|
"name": "queue",
|
|
"persistentVolumeClaim": {
|
|
"claimName": "state-hub-memo-dispatch"
|
|
}
|
|
},
|
|
{
|
|
"name": "intake-caller",
|
|
"projected": {
|
|
"defaultMode": 288,
|
|
"sources": [
|
|
{
|
|
"serviceAccountToken": {
|
|
"audience": "informed-decision-intake",
|
|
"expirationSeconds": 600,
|
|
"path": "intake-token"
|
|
}
|
|
},
|
|
{
|
|
"serviceAccountToken": {
|
|
"audience": "informed-decision-lifecycle",
|
|
"expirationSeconds": 600,
|
|
"path": "lifecycle-token"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"initContainers": [
|
|
{
|
|
"name": "prepare-private-queue",
|
|
"image": "forgejo.coulomb.social/coulomb/state-hub-memo-dispatch@sha256:410fb6b6c9fd7a7ee0b63d727fd3249fb3ae13943421d6a5ce88b7ad2520bd2f",
|
|
"command": [
|
|
"python",
|
|
"-c",
|
|
"import os, stat\np='/data/private'\ntry:\n os.mkdir(p, 0o700)\nexcept FileExistsError:\n pass\nfd=os.open(p, os.O_RDONLY | os.O_DIRECTORY | os.O_NOFOLLOW)\ntry:\n info=os.fstat(fd)\n if info.st_uid != os.getuid():\n raise SystemExit('queue owner refused')\n mode=stat.S_IMODE(info.st_mode)\n if mode == 0o2700 and not os.listdir(fd):\n os.fchmod(fd, 0o700)\n elif mode != 0o700:\n raise SystemExit('queue mode refused')\nfinally:\n os.close(fd)\n"
|
|
],
|
|
"securityContext": {
|
|
"allowPrivilegeEscalation": false,
|
|
"readOnlyRootFilesystem": true,
|
|
"capabilities": {
|
|
"drop": [
|
|
"ALL"
|
|
]
|
|
}
|
|
},
|
|
"resources": {
|
|
"requests": {
|
|
"cpu": "5m",
|
|
"memory": "24Mi"
|
|
},
|
|
"limits": {
|
|
"cpu": "100m",
|
|
"memory": "96Mi"
|
|
}
|
|
},
|
|
"volumeMounts": [
|
|
{
|
|
"name": "queue",
|
|
"mountPath": "/data"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"apiVersion": "networking.k8s.io/v1",
|
|
"kind": "NetworkPolicy",
|
|
"metadata": {
|
|
"name": "state-hub-memo-dispatch",
|
|
"namespace": "state-hub",
|
|
"annotations": {
|
|
"state-hub.coulomb.social/admission": "approved; INFD-WP-0007 cutover"
|
|
}
|
|
},
|
|
"spec": {
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "state-hub",
|
|
"app.kubernetes.io/component": "memo-dispatch"
|
|
}
|
|
},
|
|
"policyTypes": [
|
|
"Ingress",
|
|
"Egress"
|
|
],
|
|
"ingress": [],
|
|
"egress": [
|
|
{
|
|
"to": [
|
|
{
|
|
"namespaceSelector": {
|
|
"matchLabels": {
|
|
"kubernetes.io/metadata.name": "kube-system"
|
|
}
|
|
},
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"k8s-app": "kube-dns"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"ports": [
|
|
{
|
|
"protocol": "UDP",
|
|
"port": 53
|
|
},
|
|
{
|
|
"protocol": "TCP",
|
|
"port": 53
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"to": [
|
|
{
|
|
"namespaceSelector": {
|
|
"matchLabels": {
|
|
"kubernetes.io/metadata.name": "informed-decision"
|
|
}
|
|
},
|
|
"podSelector": {
|
|
"matchLabels": {
|
|
"app.kubernetes.io/name": "informed-decision"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"ports": [
|
|
{
|
|
"protocol": "TCP",
|
|
"port": 8081
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|