Mercurial > code > home > repos > pomerium
annotate 20-kube/20-pom-deploy.yaml @ 20:021ddfa73806
try things to get sessions that don't quickly expire (fetch requests have CORS errors). these may not be working
| author | drewp@bigasterisk.com |
|---|---|
| date | Wed, 19 Apr 2023 16:36:55 -0700 |
| parents | 76e097b3e248 |
| children | c2e12ba4d0b2 |
| rev | line source |
|---|---|
| 0 | 1 apiVersion: apps/v1 |
| 2 kind: Deployment | |
| 3 metadata: | |
| 4 labels: { app.kubernetes.io/name: pomerium } | |
| 5 name: pomerium | |
| 6 namespace: pomerium | |
| 7 spec: | |
|
20
021ddfa73806
try things to get sessions that don't quickly expire (fetch requests have CORS errors). these may not be working
drewp@bigasterisk.com
parents:
19
diff
changeset
|
8 replicas: 1 |
| 19 | 9 strategy: { type: RollingUpdate } |
| 0 | 10 selector: |
| 11 matchLabels: { app.kubernetes.io/name: pomerium } | |
| 12 template: | |
| 13 metadata: | |
| 14 labels: { app.kubernetes.io/name: pomerium } | |
| 15 spec: | |
| 16 containers: | |
| 17 - args: | |
| 18 - all-in-one | |
| 19 - --pomerium-config=global | |
| 20 - --update-status-from-service=$(POMERIUM_NAMESPACE)/pomerium-proxy | |
| 21 - --metrics-bind-address=$(POD_IP):9090 | |
| 22 env: | |
| 23 - { name: TMPDIR, value: /tmp } | |
| 24 - { name: XDG_CACHE_HOME, value: /tmp } | |
| 25 - name: POMERIUM_NAMESPACE | |
| 26 valueFrom: | |
| 27 fieldRef: | |
| 28 apiVersion: v1 | |
| 29 fieldPath: metadata.namespace | |
| 30 - name: POD_IP | |
| 31 valueFrom: | |
| 32 fieldRef: | |
| 33 fieldPath: status.podIP | |
| 19 | 34 # see https://hub.docker.com/r/pomerium/ingress-controller/tags but idk how to get the version number! |
| 16 | 35 # It's not even in the startup logs, just this: "pomerium_version":"" |
| 36 # I think sha-2c8038a is v0.21.3 (by date, https://www.pomerium.com/docs/releases/changelog) | |
| 37 image: pomerium/ingress-controller:sha-2c8038a | |
| 0 | 38 imagePullPolicy: IfNotPresent |
| 39 name: pomerium | |
| 40 ports: | |
| 41 - { containerPort: 8443, name: https, protocol: TCP } | |
| 42 - { containerPort: 8080, name: http, protocol: TCP } | |
| 43 - { containerPort: 9090, name: metrics, protocol: TCP } | |
| 44 resources: | |
| 45 limits: { cpu: 5000m, memory: 1Gi } | |
| 46 requests: { cpu: 300m, memory: 200Mi } | |
| 47 securityContext: | |
| 48 allowPrivilegeEscalation: false | |
| 49 readOnlyRootFilesystem: true | |
| 50 runAsGroup: 1000 | |
| 51 runAsNonRoot: true | |
| 52 runAsUser: 1000 | |
| 53 volumeMounts: | |
| 54 - { mountPath: /tmp, name: tmp } | |
| 55 - { mountPath: /data/autocert, name: autocert } | |
| 9 | 56 - { mountPath: /.local, name: autocert } |
| 0 | 57 nodeSelector: |
| 58 kubernetes.io/os: linux | |
| 59 securityContext: | |
| 60 runAsNonRoot: true | |
| 61 serviceAccountName: pomerium-controller | |
| 62 terminationGracePeriodSeconds: 10 | |
| 63 volumes: | |
| 64 - { name: tmp, emptyDir: {} } | |
| 65 - { name: autocert, persistentVolumeClaim: { claimName: autocert-data } } | |
| 66 affinity: | |
| 67 nodeAffinity: | |
| 68 requiredDuringSchedulingIgnoredDuringExecution: | |
| 69 nodeSelectorTerms: | |
| 70 - matchExpressions: | |
| 71 - key: "kubernetes.io/hostname" | |
| 72 operator: In | |
| 14 | 73 values: ["ditto"] |
| 0 | 74 --- |
| 75 apiVersion: networking.k8s.io/v1 | |
| 76 kind: IngressClass | |
| 77 metadata: | |
| 78 labels: | |
| 79 app.kubernetes.io/name: pomerium | |
| 80 name: pomerium | |
| 81 spec: | |
| 82 controller: pomerium.io/ingress-controller |