viaduck/k8s/deployment.yaml at main · PostHog/viaduck · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
apiVersion: apps/v1
kind: Deployment
metadata:
  name: viaduck
  # wiz-scan: ResourceQuota and LimitRange are namespace-level policies (managed by platform team)
spec:
  replicas: 1  # scale by adding instances with different configs
  selector:
    matchLabels:
      app: viaduck
  template:
    metadata:
      labels:
        app: viaduck
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8000"
        prometheus.io/path: "/metrics"
    spec:
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 60
      containers:
      - name: viaduck
        image: ghcr.io/posthog/viaduck:latest
        args: ["--config", "/etc/viaduck/viaduck.yaml"]
        ports:
        - name: metrics
          containerPort: 8000
        env:
        - name: SOURCE_POSTGRES_URI
          valueFrom:
            secretKeyRef:
              name: viaduck-secrets
              key: SOURCE_POSTGRES_URI
        - name: DEST_POSTGRES_URI
          valueFrom:
            secretKeyRef:
              name: viaduck-secrets
              key: DEST_POSTGRES_URI
              optional: true
        - name: DEST_S3_POSTGRES_URI
          valueFrom:
            secretKeyRef:
              name: viaduck-secrets
              key: DEST_S3_POSTGRES_URI
              optional: true
        - name: S3_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: viaduck-secrets
              key: S3_ACCESS_KEY_ID
              optional: true
        - name: S3_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: viaduck-secrets
              key: S3_SECRET_ACCESS_KEY
              optional: true
        securityContext:
          runAsNonRoot: true
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          readOnlyRootFilesystem: true
        volumeMounts:
        - name: config
          mountPath: /etc/viaduck
          readOnly: true
        - name: tmp
          mountPath: /tmp  # DuckDB spill-to-disk under memory pressure
        resources:
          requests:
            memory: "128Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8000
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 5
          failureThreshold: 10
        readinessProbe:
          httpGet:
            path: /readyz
            port: 8000
          initialDelaySeconds: 10
          periodSeconds: 15
          timeoutSeconds: 5
          failureThreshold: 4
      volumes:
      - name: config
        configMap:
          name: viaduck-config
      - name: tmp
        emptyDir: {}  # disk-backed, not RAM — spill shouldn't count against memory limit