80 lines
2.5 KiB
Django/Jinja
Executable File
80 lines
2.5 KiB
Django/Jinja
Executable File
# Shared pod spec for web, worker and migration Job.
|
|
automountServiceAccountToken: false
|
|
restartPolicy: {{ 'OnFailure' if component == 'migrate' else 'Always' }}
|
|
{% if www_image_pull_secrets | length %}
|
|
imagePullSecrets:
|
|
{{ www_image_pull_secrets | to_nice_yaml | indent(2, true) }}
|
|
{% endif %}
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 10001
|
|
runAsGroup: 10001
|
|
fsGroup: 10001
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: {{ component }}
|
|
image: {{ www_membership_image | to_json }}
|
|
imagePullPolicy: {{ www_membership_image_pull_policy }}
|
|
{% if component == 'migrate' %}
|
|
command: [python, manage.py, migrate, --noinput]
|
|
{% elif component == 'worker' %}
|
|
command: [python, manage.py, sync_memberships, --loop, --interval, {{ www_membership_worker_interval | string | to_json }}]
|
|
{% endif %}
|
|
envFrom:
|
|
- configMapRef:
|
|
name: membership-config
|
|
- secretRef:
|
|
name: {{ www_membership_secret_name }}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
resources:
|
|
{{ (www_membership_worker_resources if component == 'worker' else www_membership_resources) | to_nice_yaml | indent(6, true) }}
|
|
{% if component == 'web' %}
|
|
ports:
|
|
- name: http
|
|
containerPort: 8000
|
|
startupProbe:
|
|
tcpSocket: {port: http}
|
|
periodSeconds: 5
|
|
failureThreshold: 24
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- python
|
|
- -c
|
|
- {{ ("import http.client; c=http.client.HTTPConnection('127.0.0.1',8000,timeout=3); c.request('GET','/members/',headers={'Host': '" ~ www_hostname ~ "', 'X-Forwarded-Proto': 'https'}); r=c.getresponse(); assert r.status==200; c.close()") | to_json }}
|
|
timeoutSeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
tcpSocket: {port: http}
|
|
periodSeconds: 20
|
|
{% endif %}
|
|
volumeMounts:
|
|
- name: tiers
|
|
mountPath: /etc/membership/tiers
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
{% if www_membership_ca_secret_name | length %}
|
|
- name: ca
|
|
mountPath: /etc/membership/ca
|
|
readOnly: true
|
|
{% endif %}
|
|
volumes:
|
|
- name: tiers
|
|
configMap:
|
|
name: membership-tiers
|
|
- name: tmp
|
|
emptyDir:
|
|
sizeLimit: 64Mi
|
|
{% if www_membership_ca_secret_name | length %}
|
|
- name: ca
|
|
secret:
|
|
secretName: {{ www_membership_ca_secret_name }}
|
|
defaultMode: 0444
|
|
{% endif %}
|