kdeps-k8s-manifests

version: 1.0.0
files:
    deployment.yaml.tmpl: |
        apiVersion: apps/v1
        kind: Deployment
        metadata:
          name: {{ .Name }}
          labels:
            app: {{ .Name }}
            version: {{ .Version }}
            kdeps-component: "true"
        spec:
          replicas: {{ .Replicas }}
          selector:
            matchLabels:
              app: {{ .Name }}
          template:
            metadata:
              labels:
                app: {{ .Name }}
            spec:
              automountServiceAccountToken: false  # kdeps workloads never call the Kubernetes API
              securityContext:
                runAsNonRoot: true
                seccompProfile:
                  type: RuntimeDefault
              containers:
              - name: {{ .Name }}
                image: {{ .Image }}
                securityContext:
                  allowPrivilegeEscalation: false
                  readOnlyRootFilesystem: false
                  capabilities:
                    drop: ["ALL"]
                ports:
                {{- if .APIPort }}
                - containerPort: {{ .APIPort }}
                  name: api
                {{- end }}
                {{- if .WebServerPort }}
                - containerPort: {{ .WebServerPort }}
                  name: web
                {{- end }}
                {{- if .BackendPort }}
                - containerPort: {{ .BackendPort }}
                  name: backend
                {{- end }}
                env:
                {{- if .HasAPIServer }}
                - name: KDEPS_API_AUTH_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: {{ .Name }}-auth
                      key: api-token
                - name: KDEPS_MANAGEMENT_TOKEN
                  valueFrom:
                    secretKeyRef:
                      name: {{ .Name }}-auth
                      key: management-token
                      optional: true
                {{- end }}
                {{- range $key, $value := .Env }}
                - name: {{ $key }}
                  value: "{{ $value }}"
                {{- end }}
                {{- range $key := .SecretEnv }}
                - name: {{ $key }}
                  valueFrom:
                    secretKeyRef:
                      name: {{ $.Name }}-env
                      key: {{ $key }}
                {{- end }}
                {{- if .Resources }}
                resources:
                  limits:
                    cpu: "{{ .Resources.CPULimit }}"
                    memory: "{{ .Resources.MemoryLimit }}"
                  requests:
                    cpu: "{{ .Resources.CPURequest }}"
                    memory: "{{ .Resources.MemoryRequest }}"
                {{- end }}
                {{- if .HasAPIServer }}
                readinessProbe:
                  httpGet:
                    path: /health
                    port: api
                  initialDelaySeconds: 10
                  periodSeconds: 10
                livenessProbe:
                  httpGet:
                    path: /health
                    port: api
                  initialDelaySeconds: 30
                  periodSeconds: 30
                {{- else if .WebServerPort }}
                # Web server has no /health endpoint; probe the TCP socket instead.
                readinessProbe:
                  tcpSocket:
                    port: web
                  initialDelaySeconds: 10
                  periodSeconds: 10
                livenessProbe:
                  tcpSocket:
                    port: web
                  initialDelaySeconds: 30
                  periodSeconds: 30
                {{- end }}
    networkpolicy.yaml.tmpl: |
        apiVersion: networking.k8s.io/v1
        kind: NetworkPolicy
        metadata:
          name: {{ .Name }}
          labels:
            app: {{ .Name }}
            kdeps-component: "true"
        spec:
          podSelector:
            matchLabels:
              app: {{ .Name }}
          # Ingress is restricted to the ports this workflow actually serves.
          # Egress is deliberately unrestricted: chat/httpClient/searchWeb/sql
          # resources must reach external services.
          policyTypes:
          - Ingress
        {{- if or .APIPort .WebServerPort }}
          ingress:
          - ports:
        {{- if .APIPort }}
            - protocol: TCP
              port: {{ .APIPort }}
        {{- end }}
        {{- if .WebServerPort }}
            - protocol: TCP
              port: {{ .WebServerPort }}
        {{- end }}
        {{- end }}
    service.yaml.tmpl: |
        apiVersion: v1
        kind: Service
        metadata:
          name: {{ .Name }}
          labels:
            app: {{ .Name }}
        spec:
          selector:
            app: {{ .Name }}
          ports:
          {{- if .APIPort }}
          - name: api
            port: {{ .APIPort }}
            targetPort: api
          {{- end }}
          {{- if .WebServerPort }}
          - name: web
            port: {{ .WebServerPort }}
            targetPort: web
          {{- end }}
          {{- if .BackendPort }}
          - name: backend
            port: {{ .BackendPort }}
            targetPort: backend
          {{- end }}
          type: ClusterIP