mirror of https://github.com/linkerd/linkerd2.git
181 lines
6.2 KiB
YAML
181 lines
6.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: web
|
|
namespace: emojivoto
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: web-svc
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
config.linkerd.io/admin-port: "9998"
|
|
config.linkerd.io/disable-tap: "true"
|
|
config.linkerd.io/proxy-cpu-limit: "1"
|
|
config.linkerd.io/proxy-cpu-request: "0.5"
|
|
config.linkerd.io/proxy-memory-limit: 256Mi
|
|
config.linkerd.io/proxy-memory-request: 64Mi
|
|
config.linkerd.io/proxy-version: override
|
|
config.linkerd.io/skip-inbound-ports: 7777,8888
|
|
config.linkerd.io/skip-outbound-ports: "9999"
|
|
linkerd.io/created-by: linkerd/cli dev-undefined
|
|
linkerd.io/identity-mode: default
|
|
linkerd.io/proxy-version: override
|
|
labels:
|
|
app: web-svc
|
|
linkerd.io/control-plane-ns: linkerd
|
|
linkerd.io/proxy-deployment: web
|
|
linkerd.io/workload-ns: emojivoto
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: WEB_PORT
|
|
value: "80"
|
|
- name: EMOJISVC_HOST
|
|
value: emoji-svc.emojivoto:8080
|
|
- name: VOTINGSVC_HOST
|
|
value: voting-svc.emojivoto:8080
|
|
- name: INDEX_BUNDLE
|
|
value: dist/index_bundle.js
|
|
image: buoyantio/emojivoto-web:v3
|
|
name: web-svc
|
|
ports:
|
|
- containerPort: 80
|
|
name: http
|
|
- env:
|
|
- name: LINKERD2_PROXY_LOG
|
|
value: warn,linkerd=info
|
|
- name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
|
|
value: linkerd-dst.linkerd.svc.cluster.local:8086
|
|
- name: LINKERD2_PROXY_DESTINATION_GET_NETWORKS
|
|
value: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
|
|
- name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
|
|
value: 0.0.0.0:4190
|
|
- name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
|
|
value: 0.0.0.0:9998
|
|
- name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
|
|
value: 127.0.0.1:4140
|
|
- name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
|
|
value: 0.0.0.0:4143
|
|
- name: LINKERD2_PROXY_DESTINATION_GET_SUFFIXES
|
|
value: svc.cluster.local.
|
|
- name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES
|
|
value: svc.cluster.local.
|
|
- name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE
|
|
value: 10000ms
|
|
- name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
|
|
value: 10000ms
|
|
- name: _pod_ns
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: LINKERD2_PROXY_DESTINATION_CONTEXT
|
|
value: ns:$(_pod_ns)
|
|
- name: LINKERD2_PROXY_IDENTITY_DIR
|
|
value: /var/run/linkerd/identity/end-entity
|
|
- name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS
|
|
value: |
|
|
-----BEGIN CERTIFICATE-----
|
|
MIIBYDCCAQegAwIBAgIBATAKBggqhkjOPQQDAjAYMRYwFAYDVQQDEw1jbHVzdGVy
|
|
LmxvY2FsMB4XDTE5MDMwMzAxNTk1MloXDTI5MDIyODAyMDM1MlowGDEWMBQGA1UE
|
|
AxMNY2x1c3Rlci5sb2NhbDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABAChpAt0
|
|
xtgO9qbVtEtDK80N6iCL2Htyf2kIv2m5QkJ1y0TFQi5hTVe3wtspJ8YpZF0pl364
|
|
6TiYeXB8tOOhIACjQjBAMA4GA1UdDwEB/wQEAwIBBjAdBgNVHSUEFjAUBggrBgEF
|
|
BQcDAQYIKwYBBQUHAwIwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNHADBE
|
|
AiBQ/AAwF8kG8VOmRSUTPakSSa/N4mqK2HsZuhQXCmiZHwIgZEzI5DCkpU7w3SIv
|
|
OLO4Zsk1XrGZHGsmyiEyvYF9lpY=
|
|
-----END CERTIFICATE-----
|
|
- name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE
|
|
value: /var/run/secrets/kubernetes.io/serviceaccount/token
|
|
- name: LINKERD2_PROXY_IDENTITY_SVC_ADDR
|
|
value: linkerd-identity.linkerd.svc.cluster.local:8080
|
|
- name: _pod_sa
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.serviceAccountName
|
|
- name: _l5d_ns
|
|
value: linkerd
|
|
- name: _l5d_trustdomain
|
|
value: cluster.local
|
|
- name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME
|
|
value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
|
|
- name: LINKERD2_PROXY_IDENTITY_SVC_NAME
|
|
value: linkerd-identity.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
|
|
- name: LINKERD2_PROXY_DESTINATION_SVC_NAME
|
|
value: linkerd-destination.$(_l5d_ns).serviceaccount.identity.$(_l5d_ns).$(_l5d_trustdomain)
|
|
- name: LINKERD2_PROXY_TAP_DISABLED
|
|
value: "true"
|
|
image: gcr.io/linkerd-io/proxy:override
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /live
|
|
port: 9998
|
|
initialDelaySeconds: 10
|
|
name: linkerd-proxy
|
|
ports:
|
|
- containerPort: 4143
|
|
name: linkerd-proxy
|
|
- containerPort: 9998
|
|
name: linkerd-admin
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /ready
|
|
port: 9998
|
|
initialDelaySeconds: 2
|
|
resources:
|
|
limits:
|
|
cpu: "1"
|
|
memory: 256Mi
|
|
requests:
|
|
cpu: 500m
|
|
memory: 64Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsUser: 2102
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
volumeMounts:
|
|
- mountPath: /var/run/linkerd/identity/end-entity
|
|
name: linkerd-identity-end-entity
|
|
initContainers:
|
|
- args:
|
|
- --incoming-proxy-port
|
|
- "4143"
|
|
- --outgoing-proxy-port
|
|
- "4140"
|
|
- --proxy-uid
|
|
- "2102"
|
|
- --inbound-ports-to-ignore
|
|
- 4190,9998,7777,8888
|
|
- --outbound-ports-to-ignore
|
|
- "9999"
|
|
image: gcr.io/linkerd-io/proxy-init:v1.3.3
|
|
imagePullPolicy: IfNotPresent
|
|
name: linkerd-init
|
|
resources:
|
|
limits:
|
|
cpu: 100m
|
|
memory: 50Mi
|
|
requests:
|
|
cpu: 10m
|
|
memory: 10Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
add:
|
|
- NET_ADMIN
|
|
- NET_RAW
|
|
privileged: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: false
|
|
runAsUser: 0
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
volumes:
|
|
- emptyDir:
|
|
medium: Memory
|
|
name: linkerd-identity-end-entity
|
|
---
|