mward4
9dbe3749ba
- build chain: project, Gitea basic-auth source secret, output ImageStream, BuildConfig (Docker strategy, ubuntu:24.04 base), optional base-image ImageStream and Docker Hub pull secret - runtime: ServiceAccount + least-privilege SCC and its RoleBinding (VShell needs UID 0), PVC for config/certificate, Deployment with ImageStream trigger, ClusterIP Service, passthrough HTTPS Route - all manifests verified with 'oc create --dry-run=client' against the OpenShift 4.22 client scheme (12/12 decode cleanly)
28 lines
801 B
YAML
28 lines
801 B
YAML
# HTTPS access through the OpenShift router.
|
|
#
|
|
# Termination is passthrough: vshell-httpsd does its own TLS with the PKCS#12
|
|
# certificate the entrypoint generated, so the router must not decrypt. Clients
|
|
# therefore see the container's self-signed certificate unless you mount a real
|
|
# certificate at $VSHELL_TLS_P12.
|
|
#
|
|
# HTTP is not routed: VShell's port-80 listener only redirects to https://<host>:443
|
|
# and the redirect target uses the container's own hostname.
|
|
apiVersion: route.openshift.io/v1
|
|
kind: Route
|
|
metadata:
|
|
name: vshell-https
|
|
namespace: vshell
|
|
labels:
|
|
app.kubernetes.io/name: vshell
|
|
spec:
|
|
to:
|
|
kind: Service
|
|
name: vshell
|
|
weight: 100
|
|
port:
|
|
targetPort: https
|
|
tls:
|
|
termination: passthrough
|
|
insecureEdgeTerminationPolicy: None
|
|
wildcardPolicy: None
|