-
Notifications
You must be signed in to change notification settings - Fork 0
/
deployment.yml
170 lines (168 loc) · 5.42 KB
/
deployment.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
# see https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#serviceaccount-v1-core
apiVersion: v1
kind: ServiceAccount
metadata:
name: example-go-info
imagePullSecrets:
- name: pandora-rancher-test-5000
---
# see https://kubernetes.io/docs/reference/access-authn-authz/rbac/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#role-v1-rbac-authorization-k8s-io
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-read
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
---
# see https://kubernetes.io/docs/reference/access-authn-authz/rbac/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#rolebinding-v1-rbac-authorization-k8s-io
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: example-go-info-pod-read
subjects:
- kind: ServiceAccount
name: example-go-info
roleRef:
kind: Role
name: pod-read
apiGroup: rbac.authorization.k8s.io
---
# see https://kubernetes.io/docs/concepts/services-networking/ingress/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#ingress-v1beta1-networking-k8s-io
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
name: example-go-info
spec:
rules:
# NB due to the external-dns controller this will automatically configure the external DNS server (installed
# in the pandora box) based on this ingress rule.
# see https://github.com/kubernetes-incubator/external-dns
# NB you can use any other host, but you have to make sure DNS resolves to one of k8s cluster IP addresses.
# NB you could also use xip.io to make rancher automatically generate a host alike example-go-info.default.10.1.0.3.xip.io.
# NB you can see the configured server names on the nginx ingress with:
# kubectl --namespace ingress-nginx exec $(kubectl --namespace ingress-nginx get pods -l app=ingress-nginx -o name) cat /etc/nginx/nginx.conf | grep 'server_name '
- host: example-go-info.rancher.test
http:
paths:
- backend:
serviceName: example-go-info
servicePort: http
---
# see https://kubernetes.io/docs/concepts/services-networking/service/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#service-v1-core
apiVersion: v1
kind: Service
metadata:
name: example-go-info
spec:
selector:
app: example-go-info
type: ClusterIP
ports:
- name: http
protocol: TCP
port: 80
targetPort: http
---
# see https://kubernetes.io/docs/concepts/configuration/secret/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#secret-v1-core
apiVersion: v1
kind: Secret
type: Opaque
metadata:
name: example-go-info-secrets
stringData:
username: ali.baba
password: Open Sesame
---
# see https://kubernetes.io/docs/tasks/configure-pod-container/configure-pod-configmap/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#configmap-v1-core
apiVersion: v1
kind: ConfigMap
metadata:
name: example-go-info-configs
data:
example-config-a.toml: |
# a comment
[table1]
name = "example-config-a"
[table2]
key = "string value"
example-config-b.toml: |
# a comment
[table1]
name = "example-config-b"
[table2]
key = "string value"
---
# see https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
# see https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#daemonset-v1-apps
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#podtemplatespec-v1-core
# see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#container-v1-core
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: example-go-info
spec:
selector:
matchLabels:
app: example-go-info
template:
metadata:
labels:
app: example-go-info
spec:
serviceAccountName: example-go-info
nodeSelector:
kubernetes.io/arch: amd64
kubernetes.io/os: linux
containers:
- name: go-info
image: pandora.rancher.test:5000/go-info:1.0.0
ports:
- name: http
containerPort: 8000
resources:
requests:
memory: 20Mi
cpu: 0.1
limits:
memory: 20Mi
cpu: 0.1
env:
# see https://github.com/kubernetes/kubernetes/blob/master/test/e2e/common/downward_api.go
- name: POD_UID
valueFrom:
fieldRef:
fieldPath: metadata.uid
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
volumeMounts:
- name: secrets
readOnly: true
mountPath: /var/run/secrets/example
- name: configs
readOnly: true
mountPath: /var/run/configs/example
volumes:
- name: secrets
secret:
secretName: example-go-info-secrets
defaultMode: 0400
- name: configs
configMap:
name: example-go-info-configs
defaultMode: 0400