118 lines
3.5 KiB
Django/Jinja
118 lines
3.5 KiB
Django/Jinja
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ taskserv.deployment }}
|
|
namespace: {{ taskserv.namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: {{ taskserv.deployment }}
|
|
app.kubernetes.io/managed-by: provisioning
|
|
spec:
|
|
replicas: {{ taskserv.replicas }}
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: {{ taskserv.deployment }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: {{ taskserv.deployment }}
|
|
spec:
|
|
containers:
|
|
- name: buildkitd
|
|
image: {{ taskserv.image }}
|
|
args:
|
|
- --config
|
|
- /etc/buildkit/buildkitd.toml
|
|
- --addr
|
|
- unix:///run/buildkit/buildkitd.sock
|
|
{% if taskserv.mtls.enabled %}
|
|
- --addr
|
|
- tcp://0.0.0.0:{{ taskserv.port }}
|
|
- --tlscacert
|
|
- {{ taskserv.mtls.cert_mount_path }}/ca.crt
|
|
- --tlscert
|
|
- {{ taskserv.mtls.cert_mount_path }}/tls.crt
|
|
- --tlskey
|
|
- {{ taskserv.mtls.cert_mount_path }}/tls.key
|
|
{% else %}
|
|
- --addr
|
|
- tcp://0.0.0.0:{{ taskserv.port }}
|
|
{% endif %}
|
|
env:
|
|
- name: DOCKER_CONFIG
|
|
value: /root/.docker
|
|
ports:
|
|
- containerPort: {{ taskserv.port }}
|
|
protocol: TCP
|
|
resources:
|
|
requests:
|
|
cpu: "{{ taskserv.resources.requests.cpu }}"
|
|
memory: "{{ taskserv.resources.requests.memory }}"
|
|
limits:
|
|
cpu: "{{ taskserv.resources.limits.cpu }}"
|
|
memory: "{{ taskserv.resources.limits.memory }}"
|
|
securityContext:
|
|
privileged: {{ taskserv.privileged }}
|
|
seccompProfile:
|
|
type: Unconfined
|
|
volumeMounts:
|
|
- name: docker-config
|
|
mountPath: /root/.docker/config.json
|
|
subPath: config.json
|
|
readOnly: true
|
|
- name: buildkit-socket
|
|
mountPath: /run/buildkit
|
|
- name: buildkitd-config
|
|
mountPath: /etc/buildkit/buildkitd.toml
|
|
subPath: buildkitd.toml
|
|
readOnly: true
|
|
{% if taskserv.cache.enabled %}
|
|
- name: buildkit-cache
|
|
mountPath: {{ taskserv.cache.mount_path }}
|
|
{% endif %}
|
|
{% if taskserv.mtls.enabled %}
|
|
- name: buildkit-mtls-ca
|
|
mountPath: {{ taskserv.mtls.cert_mount_path }}/ca.crt
|
|
subPath: ca.crt
|
|
readOnly: true
|
|
- name: buildkit-mtls-server
|
|
mountPath: {{ taskserv.mtls.cert_mount_path }}/tls.crt
|
|
subPath: tls.crt
|
|
readOnly: true
|
|
- name: buildkit-mtls-server
|
|
mountPath: {{ taskserv.mtls.cert_mount_path }}/tls.key
|
|
subPath: tls.key
|
|
readOnly: true
|
|
{% endif %}
|
|
volumes:
|
|
- name: docker-config
|
|
secret:
|
|
secretName: {{ taskserv.registry_secret | default(value="zot-credentials") }}
|
|
items:
|
|
- key: config.json
|
|
path: config.json
|
|
- name: buildkit-socket
|
|
emptyDir: {}
|
|
{% if taskserv.cache.enabled %}
|
|
- name: buildkit-cache
|
|
persistentVolumeClaim:
|
|
claimName: {{ taskserv.deployment }}-cache
|
|
{% endif %}
|
|
- name: buildkitd-config
|
|
configMap:
|
|
name: buildkitd-config
|
|
{% if taskserv.mtls.enabled %}
|
|
- name: buildkit-mtls-ca
|
|
secret:
|
|
secretName: {{ taskserv.mtls.ca_secret }}
|
|
items:
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
- name: buildkit-mtls-server
|
|
secret:
|
|
secretName: {{ taskserv.mtls.server_cert_secret }}
|
|
items:
|
|
- key: tls.crt
|
|
path: tls.crt
|
|
- key: tls.key
|
|
path: tls.key
|
|
{% endif %}
|