deploy kuma-glpi-bridge on pfv-k8s (NodePort 30801)

Incident pipeline: Kuma webhook -> GLPI ticket. Digest-pinned image, imperative Secret glpi-creds (not in git), non-root/read-only pod. CR: https://cmdb.knownelement.com/front/change.form.php?id=22 Ticket: https://projects.knownelement.com/issues/824
2026-09-06 12:33:52 -05:00
parent 83f9c7292c
commit 770298ef3e
4 changed files with 53 additions and 2 deletions
@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: kuma-glpi-bridge
+  namespace: kuma-glpi-bridge
+spec:
+  replicas: 1
+  selector:
+    matchLabels: {app: kuma-glpi-bridge}
+  template:
+    metadata:
+      labels: {app: kuma-glpi-bridge}
+    spec:
+      containers:
+        - name: bridge
+          image: git.knownelement.com/knel/kuma-glpi-bridge@sha256:9810ba15517079df99d8921bbe6d48380898adbc8f9185865b74b44f9c234616
+          ports: [{containerPort: 8080}]
+          envFrom: [{secretRef: {name: glpi-creds}}]
+          resources:
+            requests: {cpu: 10m, memory: 16Mi}
+            limits: {memory: 64Mi}
+          livenessProbe:
+            httpGet: {path: /healthz, port: 8080}
+            initialDelaySeconds: 5
+          securityContext:
+            runAsNonRoot: true
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities: {drop: [ALL]}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kuma-glpi-bridge
+  namespace: kuma-glpi-bridge
+spec:
+  type: NodePort
+  selector: {app: kuma-glpi-bridge}
+  ports:
+    - port: 8080
+      nodePort: 30801