apiVersion: apps/v1 kind: Deployment metadata: name: netchecker-server namespace: {{ netcheck_namespace }} labels: app: netchecker-server spec: replicas: 1 selector: matchLabels: app: netchecker-server template: metadata: name: netchecker-server labels: app: netchecker-server spec: priorityClassName: {% if netcheck_namespace == 'kube-system' %}system-cluster-critical{% else %}k8s-cluster-critical{% endif %}{{''}} volumes: - name: etcd-data emptyDir: {} containers: - name: netchecker-server image: "{{ netcheck_server_image_repo }}:{{ netcheck_server_image_tag }}" imagePullPolicy: {{ k8s_image_pull_policy }} resources: limits: cpu: {{ netchecker_server_cpu_limit }} memory: {{ netchecker_server_memory_limit }} requests: cpu: {{ netchecker_server_cpu_requests }} memory: {{ netchecker_server_memory_requests }} securityContext: allowPrivilegeEscalation: false capabilities: drop: ['ALL'] runAsUser: {{ netchecker_server_user | default('0') }} runAsGroup: {{ netchecker_server_group | default('0') }} runAsNonRoot: true seccompProfile: type: RuntimeDefault ports: - containerPort: 8081 args: - -v=5 - -logtostderr - -kubeproxyinit=false - -endpoint=0.0.0.0:8081 - -etcd-endpoints=http://127.0.0.1:2379 - name: etcd image: "{{ etcd_image_repo }}:{{ netcheck_etcd_image_tag }}" imagePullPolicy: {{ k8s_image_pull_policy }} command: - etcd - --listen-client-urls=http://127.0.0.1:2379 - --advertise-client-urls=http://127.0.0.1:2379 - --data-dir=/var/lib/etcd - --enable-v2 - --force-new-cluster volumeMounts: - mountPath: /var/lib/etcd name: etcd-data resources: limits: cpu: {{ netchecker_etcd_cpu_limit }} memory: {{ netchecker_etcd_memory_limit }} requests: cpu: {{ netchecker_etcd_cpu_requests }} memory: {{ netchecker_etcd_memory_requests }} securityContext: allowPrivilegeEscalation: false capabilities: drop: ['ALL'] runAsUser: {{ netchecker_server_user | default('0') }} runAsGroup: {{ netchecker_server_group | default('0') }} runAsNonRoot: true seccompProfile: type: RuntimeDefault tolerations: - effect: NoSchedule operator: Exists serviceAccountName: netchecker-server