gateway/deploy/kubernetes/base/dataplane.yaml at 5bcc8af724274ab770dd0db7fed347c675fa682f · nantian-gw/gateway · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nantian-gw-dataplane
  namespace: nantian-gw
  labels:
    app.kubernetes.io/name: nantian-gw
    app.kubernetes.io/part-of: nantian-gw
    app.kubernetes.io/component: dataplane
spec:
  replicas: 2
  minReadySeconds: 5
  progressDeadlineSeconds: 600
  revisionHistoryLimit: 5
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: nantian-gw-dataplane
  template:
    metadata:
      labels:
        app: nantian-gw-dataplane
        app.kubernetes.io/name: nantian-gw
        app.kubernetes.io/part-of: nantian-gw
        app.kubernetes.io/component: dataplane
    spec:
      serviceAccountName: nantian-gw-dataplane
      automountServiceAccountToken: false
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
        sysctls:
          - name: net.ipv4.ip_unprivileged_port_start
            value: "0"
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: kubernetes.io/hostname
          whenUnsatisfiable: ScheduleAnyway
          labelSelector:
            matchLabels:
              app: nantian-gw-dataplane
      containers:
        - name: dataplane
          image: nantian-dataplane:dev
          imagePullPolicy: Always
          env:
            - name: AEG_NODE_ID
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
          args:
            - "--config"
            - "/etc/nantian-gw/config.yaml"
          ports:
            - name: http
              containerPort: 10080
            - name: https
              containerPort: 443
            - name: admin
              containerPort: 19080
          startupProbe:
            httpGet:
              path: /livez
              port: admin
            periodSeconds: 2
            failureThreshold: 45
          livenessProbe:
            httpGet:
              path: /livez
              port: admin
            periodSeconds: 10
            timeoutSeconds: 2
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /readyz
              port: admin
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 6
          resources:
            requests:
              cpu: 250m
              memory: 256Mi
            limits:
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]
              add: ["NET_BIND_SERVICE"]
          volumeMounts:
            - name: config
              mountPath: /etc/nantian-gw
              readOnly: true
            - name: xds-tls
              mountPath: /etc/nantian-gw/xds-tls
              readOnly: true
            - name: admin-auth
              mountPath: /etc/nantian-gw/admin-auth
              readOnly: true
            - name: tmp
              mountPath: /tmp
      volumes:
        - name: config
          configMap:
            name: nantian-gw-dataplane-config
        - name: xds-tls
          secret:
            secretName: nantian-gw-dataplane-xds-tls
            optional: true
        - name: admin-auth
          secret:
            secretName: nantian-gw-dataplane-admin-auth
            optional: true
        - name: tmp
          emptyDir:
            sizeLimit: 128Mi
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: nantian-gw-dataplane
  namespace: nantian-gw
  labels:
    app.kubernetes.io/name: nantian-gw
    app.kubernetes.io/part-of: nantian-gw
    app.kubernetes.io/component: dataplane
spec:
  minAvailable: 1
  selector:
    matchLabels:
      app: nantian-gw-dataplane