48 lines
1.5 KiB
YAML
48 lines
1.5 KiB
YAML
# services/vault/hermes-jenkins-build-token-seed-job.yaml
|
|
# Revisioned prerequisite: seed the job-scoped token before Jenkins/Hermes roll.
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: vault-hermes-jenkins-build-token-seed-1
|
|
namespace: vault
|
|
spec:
|
|
backoffLimit: 2
|
|
template:
|
|
spec:
|
|
serviceAccountName: vault-admin
|
|
restartPolicy: Never
|
|
nodeSelector:
|
|
hardware: rpi5
|
|
kubernetes.io/arch: arm64
|
|
node-role.kubernetes.io/worker: "true"
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values: [titan-04, titan-14, titan-18, titan-19, titan-24]
|
|
containers:
|
|
- name: seed
|
|
image: hashicorp/vault:1.21.4
|
|
imagePullPolicy: IfNotPresent
|
|
command: [sh, /scripts/vault_hermes_jenkins_build_token_ensure.sh]
|
|
env:
|
|
- name: VAULT_ADDR
|
|
value: http://vault.vault.svc.cluster.local:8200
|
|
- name: VAULT_K8S_ROLE
|
|
value: vault-admin
|
|
volumeMounts:
|
|
- name: scripts
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: 250m, memory: 128Mi}
|
|
volumes:
|
|
- name: scripts
|
|
configMap:
|
|
name: vault-k8s-auth-config-script
|
|
defaultMode: 0555
|