mirror of
https://github.com/whyour/qinglong.git
synced 2026-09-20 16:07:11 +08:00
59 lines
2.1 KiB
YAML
59 lines
2.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: ql3-cluster-control
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: cluster-control
|
|
env:
|
|
- name: QL3_WORKER_SECRET_PROVIDER
|
|
value: vault-kv-v2
|
|
- name: QL3_WORKER_SECRET_ROOT_DIRECTORY
|
|
$patch: delete
|
|
- name: QL3_WORKER_SECRET_VAULT_ENDPOINT
|
|
value: https://vault.vault.svc.cluster.local:8200
|
|
- name: QL3_WORKER_SECRET_VAULT_CA_FILE
|
|
value: /var/run/secrets/qinglong3/worker-vault-trust/ca.pem
|
|
- name: QL3_WORKER_SECRET_VAULT_TOKEN_FILE
|
|
value: /var/run/secrets/qinglong3/worker-vault-auth/token
|
|
- name: QL3_WORKER_SECRET_VAULT_KV_MOUNT
|
|
value: worker-secrets
|
|
- name: QL3_WORKER_SECRET_VAULT_PATH_PREFIX
|
|
value: values/production
|
|
- name: QL3_WORKER_SECRET_VAULT_EXPECTED_POLICY
|
|
value: ql3-worker-secret-read
|
|
- name: QL3_WORKER_SECRET_VAULT_MAX_TOKEN_TTL_SECONDS
|
|
value: '900'
|
|
- name: QL3_WORKER_SECRET_VAULT_REQUEST_TIMEOUT_MS
|
|
value: '5000'
|
|
- name: QL3_WORKER_SECRET_VAULT_MAX_CONCURRENCY
|
|
value: '4'
|
|
volumeMounts:
|
|
- name: worker-secret-values
|
|
$patch: delete
|
|
- name: worker-vault-trust
|
|
mountPath: /var/run/secrets/qinglong3/worker-vault-trust
|
|
readOnly: true
|
|
- name: worker-vault-auth
|
|
mountPath: /var/run/secrets/qinglong3/worker-vault-auth
|
|
readOnly: true
|
|
volumes:
|
|
- name: worker-secret-values
|
|
$patch: delete
|
|
- name: worker-vault-trust
|
|
secret:
|
|
secretName: ql3-cluster-worker-vault-trust
|
|
defaultMode: 292
|
|
items:
|
|
- key: ca.pem
|
|
path: ca.pem
|
|
- name: worker-vault-auth
|
|
secret:
|
|
secretName: ql3-cluster-worker-vault-auth
|
|
defaultMode: 288
|
|
items:
|
|
- key: token
|
|
path: token
|