106 lines
3.3 KiB
YAML
106 lines
3.3 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: s3-proxy
|
|
namespace: postgresql
|
|
labels:
|
|
app: s3-proxy
|
|
service: s3proxy
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app: s3-proxy
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 25%
|
|
maxUnavailable: 25%
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: s3-proxy
|
|
service: s3proxy
|
|
annotations:
|
|
traffic.sidecar.istio.io/excludeOutboundPorts: "4317,4318,9411"
|
|
proxy.istio.io/config: |
|
|
tracing:
|
|
sampling: 100
|
|
zipkin:
|
|
address: signoz-otel-collector-external.signoz.svc.cluster.local:9411
|
|
custom_tags:
|
|
k8s.pod.name:
|
|
environment:
|
|
name: POD_NAME
|
|
k8s.namespace.name:
|
|
environment:
|
|
name: POD_NAMESPACE
|
|
k8s.pod.ip:
|
|
environment:
|
|
name: INSTANCE_IP
|
|
vault.hashicorp.com/agent-init-first: "true"
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/auth-path: "auth/kubernetes"
|
|
vault.hashicorp.com/role: "postgresql"
|
|
vault.hashicorp.com/agent-inject-secret-aws-credentials: "secrets/data/postgresql/s3"
|
|
vault.hashicorp.com/agent-inject-template-aws-credentials: |
|
|
{{- with secret "secrets/data/postgresql/s3" -}}
|
|
[default]
|
|
aws_access_key_id={{ .Data.data.access_key }}
|
|
aws_secret_access_key={{ .Data.data.secret_key }}
|
|
{{- end }}
|
|
spec:
|
|
serviceAccountName: postgresql
|
|
automountServiceAccountToken: true
|
|
imagePullSecrets:
|
|
- name: regcred
|
|
containers:
|
|
- name: s3proxy
|
|
image: cr.yandex/crp3ccidau046kdj8g9q/s3-proxy:stable
|
|
imagePullPolicy: Always
|
|
ports:
|
|
- containerPort: 80
|
|
name: http
|
|
protocol: TCP
|
|
env:
|
|
- name: K8S_POD_UID
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.uid
|
|
- name: K8S_POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.name
|
|
- name: K8S_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.namespace
|
|
- name: OTEL_RESOURCE_ATTRIBUTES
|
|
value: k8s.pod.uid=$(K8S_POD_UID),k8s.pod.name=$(K8S_POD_NAME),k8s.namespace.name=$(K8S_NAMESPACE)
|
|
- name: AWS_API_ENDPOINT
|
|
value: https://storage.yandexcloud.net
|
|
- name: AWS_S3_BUCKET
|
|
value: prod-pg-dumps
|
|
- name: AWS_REGION
|
|
value: ru-central1
|
|
- name: AWS_SHARED_CREDENTIALS_FILE
|
|
value: /vault/secrets/aws-credentials
|
|
- name: AWS_EC2_METADATA_DISABLED
|
|
value: "true"
|
|
- name: ACCESS_LOG
|
|
value: "true"
|
|
- name: CORS_ALLOW_HEADERS
|
|
value: Content-Type, Accept-Ranges, Content-Range, Content-Encoding
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 128Mi
|
|
limits:
|
|
cpu: 500m
|
|
memory: 512Mi
|