Skip to content

Commit 046c055

Browse files
wasagawasaga
committed
Allowing to have 2 pomerium ICs in a same cluster
1 parent 3fddd34 commit 046c055

5 files changed

Lines changed: 156 additions & 0 deletions

File tree

‎config/pomerium-mcp/ingressclass.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: IngressClass
3+
metadata:
4+
name: pomerium-mcp
5+
spec:
6+
controller: pomerium.io/ingress-controller-mcp

‎config/pomerium-mcp/inner/kustomization.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#
2+
# Inner overlay: bundles the StatefulSet with the reused RBAC + gen-secrets
3+
# resources, applying namePrefix so the cluster-scoped resources don't collide
4+
# with the default install. Because the StatefulSet is in the same kustomize
5+
# unit as the renamed ServiceAccount, kustomize's name-reference transformer
6+
# rewrites the StatefulSet's serviceAccountName automatically.
7+
#
8+
apiVersion: kustomize.config.k8s.io/v1beta1
9+
kind: Kustomization
10+
namePrefix: pomerium-mcp-
11+
resources:
12+
- ../../pomerium/rbac
13+
- ../../gen_secrets
14+
- statefulset.yaml

‎config/pomerium-mcp/inner/statefulset.yaml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
#
2+
# StatefulSet variant of the all-in-one pomerium pod, with a PVC mounted at
3+
# /data so the file-based databroker survives pod restarts.
4+
#
5+
# Lives inside `inner/` so the inner kustomization's namePrefix rewrites
6+
# `serviceAccountName: pomerium-controller` to the renamed SA from
7+
# ../../pomerium/rbac. The top-level `images:` directive pins the image tag.
8+
#
9+
apiVersion: apps/v1
10+
kind: StatefulSet
11+
metadata:
12+
name: pomerium
13+
labels:
14+
app.kubernetes.io/component: proxy
15+
spec:
16+
serviceName: pomerium-proxy
17+
replicas: 1
18+
selector:
19+
matchLabels:
20+
app.kubernetes.io/component: proxy
21+
template:
22+
metadata:
23+
labels:
24+
app.kubernetes.io/component: proxy
25+
spec:
26+
serviceAccountName: pomerium-controller
27+
terminationGracePeriodSeconds: 10
28+
nodeSelector:
29+
kubernetes.io/os: linux
30+
securityContext:
31+
runAsNonRoot: true
32+
runAsUser: 65532
33+
runAsGroup: 65532
34+
fsGroup: 65532
35+
containers:
36+
- name: pomerium
37+
image: pomerium/ingress-controller
38+
imagePullPolicy: IfNotPresent
39+
args:
40+
- all-in-one
41+
- --name=pomerium.io/ingress-controller-mcp
42+
- --pomerium-config=global-mcp
43+
- --update-status-from-service=$(POMERIUM_NAMESPACE)/pomerium-proxy
44+
- --metrics-bind-address=$(POD_IP):9090
45+
- --health-probe-bind-address=$(POD_IP):28080
46+
env:
47+
- name: GOLANG_PROTOBUF_REGISTRATION_CONFLICT
48+
value: warn
49+
- name: POMERIUM_NAMESPACE
50+
valueFrom:
51+
fieldRef:
52+
fieldPath: metadata.namespace
53+
- name: POD_IP
54+
valueFrom:
55+
fieldRef:
56+
fieldPath: status.podIP
57+
- name: TMPDIR
58+
value: /tmp
59+
- name: XDG_CACHE_HOME
60+
value: /tmp
61+
ports:
62+
- { containerPort: 8443, name: https, protocol: TCP }
63+
- { containerPort: 8443, name: quic, protocol: UDP }
64+
- { containerPort: 8080, name: http, protocol: TCP }
65+
- { containerPort: 9090, name: metrics, protocol: TCP }
66+
resources:
67+
requests: { cpu: 300m, memory: 200Mi }
68+
limits: { cpu: 5000m, memory: 1Gi }
69+
securityContext:
70+
allowPrivilegeEscalation: false
71+
capabilities: { drop: [ALL] }
72+
readOnlyRootFilesystem: true
73+
runAsNonRoot: true
74+
runAsUser: 65532
75+
runAsGroup: 65532
76+
startupProbe:
77+
httpGet: { path: /startupz, port: 28080 }
78+
failureThreshold: 40
79+
periodSeconds: 15
80+
livenessProbe:
81+
httpGet: { path: /healthz, port: 28080 }
82+
initialDelaySeconds: 15
83+
periodSeconds: 60
84+
failureThreshold: 10
85+
readinessProbe:
86+
httpGet: { path: /readyz, port: 28080 }
87+
initialDelaySeconds: 15
88+
periodSeconds: 60
89+
failureThreshold: 5
90+
volumeMounts:
91+
- { name: tmp, mountPath: /tmp }
92+
- { name: data, mountPath: /data }
93+
volumes:
94+
- name: tmp
95+
emptyDir: {}
96+
volumeClaimTemplates:
97+
- metadata:
98+
name: data
99+
spec:
100+
accessModes: [ReadWriteOnce]
101+
resources:
102+
requests: { storage: 1Gi }

‎config/pomerium-mcp/kustomization.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#
2+
# Second Pomerium Ingress Controller instance, fully segregated from the default install:
3+
# namespace pomerium-mcp
4+
# IngressClass pomerium-mcp (controller: pomerium.io/ingress-controller-mcp)
5+
# StatefulSet + PVC for file-based databroker persistence
6+
# global config CR global-mcp (applied separately via pomerium-crd.yaml)
7+
#
8+
# Layout:
9+
# namespace.yaml + ingressclass.yaml are unique to this overlay (cluster-scoped names
10+
# must NOT be prefixed, so they live at the top level outside the namePrefix scope).
11+
# ../pomerium/service/proxy.yaml is reused as-is — commonLabels rewrites the selector
12+
# so it matches our renamed pods, and the metrics Service is intentionally skipped.
13+
# ./inner pulls in ../../pomerium/rbac and ../../gen_secrets and applies a namePrefix
14+
# so the cluster-scoped ClusterRole/Binding don't collide with the default install.
15+
# The image override is set once here so both the StatefulSet and the gen-secrets Job
16+
# pick up the same SHA.
17+
#
18+
apiVersion: kustomize.config.k8s.io/v1beta1
19+
kind: Kustomization
20+
namespace: pomerium-mcp
21+
commonLabels:
22+
app.kubernetes.io/name: pomerium-mcp
23+
images:
24+
- name: pomerium/ingress-controller
25+
newTag: sha-3fddd34
26+
resources:
27+
- namespace.yaml
28+
- ingressclass.yaml
29+
- ../pomerium/service
30+
- ./inner

‎config/pomerium-mcp/namespace.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: pomerium-mcp

0 commit comments

Comments
 (0)