ic-builder
770298ef3e
ci / audit (pull_request) Successful in 20s
Incident pipeline: Kuma webhook -> GLPI ticket. Digest-pinned image, imperative Secret glpi-creds (not in git), non-root/read-only pod. CR: https://cmdb.knownelement.com/front/change.form.php?id=22 Ticket: https://projects.knownelement.com/issues/824
42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: kuma-glpi-bridge
|
|
namespace: kuma-glpi-bridge
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels: {app: kuma-glpi-bridge}
|
|
template:
|
|
metadata:
|
|
labels: {app: kuma-glpi-bridge}
|
|
spec:
|
|
containers:
|
|
- name: bridge
|
|
image: git.knownelement.com/knel/kuma-glpi-bridge@sha256:9810ba15517079df99d8921bbe6d48380898adbc8f9185865b74b44f9c234616
|
|
ports: [{containerPort: 8080}]
|
|
envFrom: [{secretRef: {name: glpi-creds}}]
|
|
resources:
|
|
requests: {cpu: 10m, memory: 16Mi}
|
|
limits: {memory: 64Mi}
|
|
livenessProbe:
|
|
httpGet: {path: /healthz, port: 8080}
|
|
initialDelaySeconds: 5
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
readOnlyRootFilesystem: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: [ALL]}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kuma-glpi-bridge
|
|
namespace: kuma-glpi-bridge
|
|
spec:
|
|
type: NodePort
|
|
selector: {app: kuma-glpi-bridge}
|
|
ports:
|
|
- port: 8080
|
|
nodePort: 30801
|