deploy/server/oidc-deployment.yaml

Ref: main v0.0.5   Size: 1.8 KiB   History

# The bundled issuer runs from the SERVER's image, at the server's tag, as its
# own Deployment — so it cannot be a different version than the server it
# authenticates for, and it rolls in the same stage.
#
# Not hostNetwork, unlike the control plane: nothing here needs a raw socket on
# the node, so it reaches the world through the Service and leaves the node's
# port space to the three listeners that genuinely cannot use it.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: eitri-oidc
  namespace: ${NAMESPACE}
spec:
  replicas: 1
  strategy:
    type: Recreate            # single writer for the flat user file
  selector:
    matchLabels: {app: eitri-oidc}
  template:
    metadata:
      labels: {app: eitri-oidc}
    spec:
      # local-path binds the PVC to the node the pod first lands on, and the
      # issuer's state must land on the same node as the rest of the plane's.
      nodeSelector:
        kubernetes.io/hostname: ${NODE_NAME}
      imagePullSecrets:
        - name: regcred
      securityContext:
        fsGroup: 65532        # distroless nonroot; the user file must be writable
      containers:
        - name: eitri-oidc
          image: ${SERVER_IMAGE}:${TAG}
          imagePullPolicy: Always
          command: ["/eitri-oidc", "-config", "/etc/eitri/eitri-oidc.json"]
          ports:
            - {name: http, containerPort: ${OIDC_PORT}}
          volumeMounts:
            - {name: data, mountPath: /var/lib/eitri-oidc}
            - {name: config, mountPath: /etc/eitri, readOnly: true}
          readinessProbe:
            httpGet: {path: /.well-known/openid-configuration, port: ${OIDC_PORT}}
            periodSeconds: 10
      volumes:
        - name: data
          persistentVolumeClaim: {claimName: ${OIDC_PVC_NAME}}
        - name: config
          secret:
            secretName: ${OIDC_CONFIG_SECRET}
            defaultMode: 0400