mward4
eab245f61d
- runtime/03-deployment.yaml: image is now att-gitlab.apps.evd.geaerospace.net:5050/att/infrastructure/vshell:latest with imagePullSecrets; the internal ImageStream trigger is gone - runtime/00-serviceaccount.yaml: carries att-gitlab-pull - runtime/06-att-gitlab-pull-secret.yaml: registry credentials (placeholders) - cluster/00-insecure-registry.yaml: Image/cluster insecureRegistries entry, the cluster-side equivalent of 'podman pull -k' - 02/03 build manifests marked optional, with the GitLab push-output variant documented inline - openshift/README.md split into run-from-registry and build-in-cluster paths - all 14 manifests decode cleanly with 'oc create --dry-run=client'
87 lines
2.5 KiB
YAML
87 lines
2.5 KiB
YAML
# VShell runtime, pulling the image from the internal ATT GitLab registry.
|
|
#
|
|
# Single replica: the daemons own fixed ports and one host key, so they are not
|
|
# horizontally scalable.
|
|
#
|
|
# This registry is outside OpenShift, so three things make the pull work:
|
|
# 1. 06-att-gitlab-pull-secret.yaml (credentials, linked via the ServiceAccount)
|
|
# 2. cluster/00-insecure-registry.yaml on the nodes - the registry equivalent
|
|
# of `podman pull -k`, since a pod spec cannot opt out of TLS verification
|
|
# 3. DNS/route reachability of att-gitlab.apps.evd.geaerospace.net:5050 from
|
|
# every node
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: vshell
|
|
namespace: vshell
|
|
labels:
|
|
app.kubernetes.io/name: vshell
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: vshell
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: vshell
|
|
spec:
|
|
serviceAccountName: vshell
|
|
imagePullSecrets:
|
|
- name: att-gitlab-pull
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
fsGroup: 0
|
|
containers:
|
|
- name: vshell
|
|
image: att-gitlab.apps.evd.geaerospace.net:5050/att/infrastructure/vshell:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: VSHELL_CONFIG
|
|
value: /data/vshelld_config
|
|
- name: VSHELL_TLS_P12
|
|
value: /data/vshell-https.p12
|
|
ports:
|
|
- name: ssh
|
|
containerPort: 22
|
|
protocol: TCP
|
|
- name: ftps
|
|
containerPort: 21
|
|
protocol: TCP
|
|
- name: ftps-implicit
|
|
containerPort: 990
|
|
protocol: TCP
|
|
- name: http
|
|
containerPort: 80
|
|
protocol: TCP
|
|
- name: https
|
|
containerPort: 443
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: ssh
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: ssh
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 20
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "2"
|
|
memory: 2Gi
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: vshell-data
|