73 lines
1.7 KiB
Django/Jinja
Executable File
73 lines
1.7 KiB
Django/Jinja
Executable File
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: membership-config
|
|
namespace: {{ www_namespace }}
|
|
data:
|
|
{% for key, value in www_membership_environment | dictsort %}
|
|
{{ key }}: {{ value | string | to_json }}
|
|
{% endfor %}
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: membership-tiers
|
|
namespace: {{ www_namespace }}
|
|
data:
|
|
tiers.json: {{ www_membership_tiers | to_json | to_json }}
|
|
service-groups.json: {{ www_membership_service_groups | to_json | to_json }}
|
|
---
|
|
# Only Apache may assert the trusted proxy headers to the membership service.
|
|
# Requires a CNI which actually enforces NetworkPolicy.
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: membership-web
|
|
namespace: {{ www_namespace }}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: membership
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
app: httpd
|
|
ports:
|
|
- protocol: TCP
|
|
port: 8000
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: membership-worker
|
|
namespace: {{ www_namespace }}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: membership-worker
|
|
policyTypes: [Ingress]
|
|
ingress: []
|
|
{% if www_membership_postgres_managed %}
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: membership-db
|
|
namespace: {{ www_namespace }}
|
|
spec:
|
|
podSelector:
|
|
matchLabels:
|
|
app: membership-db
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
- from:
|
|
- podSelector:
|
|
matchLabels:
|
|
www-membership-client: "true"
|
|
ports:
|
|
- protocol: TCP
|
|
port: 5432
|
|
{% endif %}
|