111 lines
3.4 KiB
Django/Jinja
Executable File
111 lines
3.4 KiB
Django/Jinja
Executable File
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ luanti_wasm_name | to_json }}
|
|
namespace: {{ luanti_wasm_namespace | to_json }}
|
|
spec:
|
|
replicas: {{ luanti_wasm_replicas }}
|
|
revisionHistoryLimit: 2
|
|
selector:
|
|
matchLabels:
|
|
app: {{ luanti_wasm_name | to_json }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ luanti_wasm_name | to_json }}
|
|
annotations:
|
|
checksum/config: {{ lookup('ansible.builtin.template', 'configmap.yml.j2') | hash('sha256') | to_json }}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
fsGroup: 101
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
imagePullSecrets: {{ luanti_wasm_image_pull_secrets | to_json }}
|
|
nodeSelector: {{ luanti_wasm_node_selector | to_json }}
|
|
tolerations: {{ luanti_wasm_tolerations | to_json }}
|
|
containers:
|
|
- name: web
|
|
image: {{ luanti_wasm_web_image | to_json }}
|
|
imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
ports:
|
|
- name: http
|
|
containerPort: 8080
|
|
protocol: TCP
|
|
startupProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 2
|
|
failureThreshold: 30
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /
|
|
port: http
|
|
periodSeconds: 20
|
|
resources: {{ luanti_wasm_web_resources | to_json }}
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/nginx/nginx.conf
|
|
subPath: nginx.conf
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
- name: proxy
|
|
image: {{ luanti_wasm_proxy_image | to_json }}
|
|
imagePullPolicy: {{ luanti_wasm_image_pull_policy | to_json }}
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
runAsGroup: 65532
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: [ALL]
|
|
ports:
|
|
- name: proxy
|
|
containerPort: 7777
|
|
protocol: TCP
|
|
startupProbe:
|
|
tcpSocket:
|
|
port: proxy
|
|
periodSeconds: 2
|
|
failureThreshold: 30
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: proxy
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: proxy
|
|
periodSeconds: 20
|
|
resources: {{ luanti_wasm_proxy_resources | to_json }}
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/lwproxy.toml
|
|
subPath: lwproxy.toml
|
|
readOnly: true
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: {{ (luanti_wasm_name ~ '-config') | to_json }}
|
|
defaultMode: 0444
|
|
- name: tmp
|
|
emptyDir:
|
|
medium: Memory
|
|
sizeLimit: {{ luanti_wasm_tmp_size_limit | to_json }}
|