75 lines
2.8 KiB
YAML
75 lines
2.8 KiB
YAML
# Static page plus numeric-only receipts; no media, installed credentials or egress.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: lesavka-av-observer
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 2
|
|
selector:
|
|
matchLabels: {app: lesavka-av-observer}
|
|
template:
|
|
metadata:
|
|
labels: {app: lesavka-av-observer}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
nodeSelector:
|
|
kubernetes.io/arch: arm64
|
|
node-role.kubernetes.io/worker: "true"
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 101
|
|
runAsGroup: 101
|
|
fsGroup: 101
|
|
seccompProfile: {type: RuntimeDefault}
|
|
containers:
|
|
- name: static
|
|
image: nginx:1.27.5-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
|
|
command: [/usr/sbin/nginx]
|
|
args: [-c, /etc/nginx/observer/nginx.conf, -g, "daemon off;"]
|
|
ports: [{name: http, containerPort: 8080}]
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: {drop: [ALL]}
|
|
resources:
|
|
requests: {cpu: 10m, memory: 16Mi}
|
|
limits: {cpu: 100m, memory: 64Mi}
|
|
readinessProbe:
|
|
httpGet: {path: /av-test/, port: http}
|
|
livenessProbe:
|
|
httpGet: {path: /av-test/, port: http}
|
|
initialDelaySeconds: 10
|
|
volumeMounts:
|
|
- {name: config, mountPath: /etc/nginx/observer, readOnly: true}
|
|
- {name: assets, mountPath: /usr/share/nginx/html/av-test, readOnly: true}
|
|
- {name: tmp, mountPath: /tmp}
|
|
- name: receipts
|
|
image: python:3.13-slim@sha256:9662417aace5ae7b8e2609cce472b72a8958e134ba372808abe9cc1a0c0125e6
|
|
command: [python, -u, -B, /app/server.py]
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities: {drop: [ALL]}
|
|
resources:
|
|
requests: {cpu: 10m, memory: 16Mi}
|
|
limits: {cpu: 100m, memory: 64Mi}
|
|
readinessProbe:
|
|
exec:
|
|
command: [python, -c, "import socket; socket.create_connection(('127.0.0.1', 8081), 2).close()"]
|
|
# Starting an interpreter under the ARM CPU quota can exceed the
|
|
# default one-second exec timeout, even when the listener is healthy.
|
|
timeoutSeconds: 5
|
|
periodSeconds: 15
|
|
volumeMounts:
|
|
- {name: receipts, mountPath: /app, readOnly: true}
|
|
volumes:
|
|
- name: config
|
|
configMap: {name: lesavka-av-observer-nginx}
|
|
- name: assets
|
|
configMap: {name: lesavka-av-observer-assets}
|
|
- name: tmp
|
|
emptyDir: {medium: Memory, sizeLimit: 8Mi}
|
|
- name: receipts
|
|
configMap: {name: lesavka-av-observer-receipts}
|