a094b7d70a
Configure myks env-data with global repoURL pointing to Forgejo repo, switch destination from cluster name to in-cluster server URL, and disable placeholder cluster Secret generation. Add deploy key init Job that generates an SSH keypair, registers it with Forgejo, and creates the ArgoCD repository secret. Switch job images from bitnami/kubectl to alpine/k8s. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
99 lines
3.1 KiB
YAML
99 lines
3.1 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
|
labels:
|
|
app: webhook
|
|
app.kubernetes.io/component: webhook
|
|
app.kubernetes.io/instance: cert-manager
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: webhook
|
|
app.kubernetes.io/version: v1.17.2
|
|
helm.sh/chart: cert-manager-v1.17.2
|
|
name: cert-manager-webhook
|
|
namespace: cert-manager
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: webhook
|
|
app.kubernetes.io/instance: cert-manager
|
|
app.kubernetes.io/name: webhook
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
prometheus.io/path: /metrics
|
|
prometheus.io/port: "9402"
|
|
prometheus.io/scrape: "true"
|
|
labels:
|
|
app: webhook
|
|
app.kubernetes.io/component: webhook
|
|
app.kubernetes.io/instance: cert-manager
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: webhook
|
|
app.kubernetes.io/version: v1.17.2
|
|
helm.sh/chart: cert-manager-v1.17.2
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- --v=2
|
|
- --secure-port=10250
|
|
- --dynamic-serving-ca-secret-namespace=$(POD_NAMESPACE)
|
|
- --dynamic-serving-ca-secret-name=cert-manager-webhook-ca
|
|
- --dynamic-serving-dns-names=cert-manager-webhook
|
|
- --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE)
|
|
- --dynamic-serving-dns-names=cert-manager-webhook.$(POD_NAMESPACE).svc
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
image: quay.io/jetstack/cert-manager-webhook:v1.17.2
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /livez
|
|
port: 6080
|
|
scheme: HTTP
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
name: cert-manager-webhook
|
|
ports:
|
|
- containerPort: 10250
|
|
name: https
|
|
protocol: TCP
|
|
- containerPort: 6080
|
|
name: healthcheck
|
|
protocol: TCP
|
|
- containerPort: 9402
|
|
name: http-metrics
|
|
protocol: TCP
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /healthz
|
|
port: 6080
|
|
scheme: HTTP
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
enableServiceLinks: false
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
serviceAccountName: cert-manager-webhook
|