tegwick
0b44cf12f5
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43
162 lines
6.5 KiB
YAML
162 lines
6.5 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "statehub.fullname" . }}
|
|
labels: {{- include "statehub.labels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.replicaCount }}
|
|
selector:
|
|
matchLabels: {{- include "statehub.selectorLabels" . | nindent 6 }}
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
|
|
labels: {{- include "statehub.labels" . | nindent 8 }}
|
|
spec:
|
|
{{- if .Values.serviceAccount.name }}
|
|
serviceAccountName: {{ .Values.serviceAccount.name | quote }}
|
|
{{- end }}
|
|
securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }}
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: runtime-tmp
|
|
emptyDir: {}
|
|
{{- if .Values.sweep.enabled }}
|
|
- name: sweep-repos
|
|
hostPath:
|
|
path: {{ .Values.sweep.hostPath | quote }}
|
|
type: Directory
|
|
- name: sweep-ssh
|
|
hostPath:
|
|
path: {{ .Values.sweep.sshHostPath | quote }}
|
|
type: DirectoryOrCreate
|
|
{{- end }}
|
|
{{- if .Values.classificationAllowed.enabled }}
|
|
- name: classification-allowed
|
|
configMap:
|
|
name: {{ .Values.classificationAllowed.name | quote }}
|
|
{{- end }}
|
|
{{- if .Values.forgeRead.enabled }}
|
|
# A projected token with an explicit audience, not the legacy
|
|
# auto-mounted one: the auto-mounted token has the API server as its
|
|
# audience, so a copy of it is a credential for the cluster. This one is
|
|
# only accepted by OpenBao, and the kubelet rotates it in place.
|
|
- name: openbao-token
|
|
projected:
|
|
sources:
|
|
- serviceAccountToken:
|
|
path: token
|
|
{{- with .Values.forgeRead.openbao.audience }}
|
|
audience: {{ . | quote }}
|
|
{{- end }}
|
|
expirationSeconds: {{ .Values.forgeRead.openbao.expirationSeconds }}
|
|
{{- end }}
|
|
containers:
|
|
- name: state-hub
|
|
image: {{ include "statehub.image" . | quote }}
|
|
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
|
securityContext: {{- toYaml .Values.securityContext | nindent 12 }}
|
|
ports:
|
|
- name: http
|
|
containerPort: {{ .Values.service.targetPort }}
|
|
protocol: TCP
|
|
{{- if .Values.sweep.enabled }}
|
|
lifecycle:
|
|
postStart:
|
|
exec:
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- git config --global --add safe.directory '*'
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: runtime-tmp
|
|
mountPath: /tmp
|
|
{{- if .Values.sweep.enabled }}
|
|
- name: sweep-repos
|
|
mountPath: {{ .Values.sweep.hostPath | quote }}
|
|
- name: sweep-ssh
|
|
mountPath: /root/.ssh
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.classificationAllowed.enabled }}
|
|
- name: classification-allowed
|
|
mountPath: {{ .Values.classificationAllowed.mountPath | quote }}
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.forgeRead.enabled }}
|
|
- name: openbao-token
|
|
mountPath: /var/run/secrets/openbao
|
|
readOnly: true
|
|
{{- end }}
|
|
env:
|
|
- name: HOME
|
|
value: /tmp
|
|
{{- if .Values.sweep.enabled }}
|
|
- name: STATE_HUB_SWEEP_HOSTNAME
|
|
value: {{ .Values.sweep.hostname | quote }}
|
|
- name: GIT_SSH_COMMAND
|
|
value: "ssh -o StrictHostKeyChecking=accept-new -F /root/.ssh/config"
|
|
{{- end }}
|
|
{{- if .Values.classificationAllowed.enabled }}
|
|
- name: REPO_CLASSIFICATION_ALLOWED_PATH
|
|
value: {{ printf "%s/repo-classification.allowed.yaml" .Values.classificationAllowed.mountPath | quote }}
|
|
{{- end }}
|
|
{{- if .Values.forgeRead.enabled }}
|
|
# Coordinates only. The token itself is never a chart value, never
|
|
# in the image, and never in a Kubernetes Secret in this release.
|
|
- name: OPENBAO_ADDR
|
|
value: {{ .Values.forgeRead.openbao.addr | quote }}
|
|
- name: OPENBAO_K8S_ROLE
|
|
value: {{ .Values.forgeRead.openbao.role | quote }}
|
|
- name: OPENBAO_K8S_AUTH_MOUNT
|
|
value: {{ .Values.forgeRead.openbao.authMount | quote }}
|
|
- name: OPENBAO_K8S_TOKEN_PATH
|
|
value: /var/run/secrets/openbao/token
|
|
- name: FORGE_READ_SECRET_PATH
|
|
value: {{ .Values.forgeRead.openbao.secretPath | quote }}
|
|
- name: FORGE_READ_SECRET_KEY
|
|
value: {{ .Values.forgeRead.openbao.secretKey | quote }}
|
|
{{- end }}
|
|
envFrom:
|
|
{{- if .Values.config.enabled }}
|
|
- configMapRef:
|
|
name: {{ .Values.config.name | quote }}
|
|
{{- end }}
|
|
- secretRef:
|
|
name: {{ .Values.secret.name | quote }}
|
|
{{- if .Values.probes.enabled }}
|
|
readinessProbe:
|
|
httpGet:
|
|
path: {{ .Values.probes.path }}
|
|
port: {{ .Values.probes.port }}
|
|
initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.probes.readiness.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.probes.readiness.failureThreshold }}
|
|
livenessProbe:
|
|
httpGet:
|
|
path: {{ .Values.probes.path }}
|
|
port: {{ .Values.probes.port }}
|
|
initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.probes.liveness.periodSeconds }}
|
|
timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }}
|
|
failureThreshold: {{ .Values.probes.liveness.failureThreshold }}
|
|
{{- end }}
|
|
resources: {{- toYaml .Values.resources | nindent 12 }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations: {{- toYaml . | nindent 8 }}
|
|
{{- end }}
|