Spaces:
Running
Running
File size: 3,164 Bytes
a6a5d8e | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 | apiVersion: apps/v1
kind: Deployment
metadata:
name: a11oy
namespace: a11oy
labels:
app.kubernetes.io/name: a11oy
app.kubernetes.io/part-of: szl-mesh
spec:
replicas: 1
selector:
matchLabels:
app.kubernetes.io/name: a11oy
template:
metadata:
labels:
app.kubernetes.io/name: a11oy
app.kubernetes.io/part-of: szl-mesh
spec:
# PSS restricted: non-root, non-privileged.
# uid 1000 matches the 'a11oy' user created in the Dockerfile.
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
seccompProfile:
type: RuntimeDefault
containers:
- name: a11oy
image: ghcr.io/szl-holdings/a11oy:v1.0.0-alpha
imagePullPolicy: IfNotPresent
# Run the container in HTTP serve mode (the entrypoint also supports
# `a11oy <subcommand>` for CLI use). The probes below target the
# routes this server provides.
args: ["serve", "--port", "8080"]
ports:
- name: http
containerPort: 8080
protocol: TCP
env:
- name: A11OY_PROOF_LEDGER_PATH
value: /var/lib/a11oy/proof.jsonl
- name: A11OY_DOCTRINE_LAMBDA_FLOOR
value: "0.90"
- name: A11OY_PORT
value: "8080"
# PSS restricted: drop all capabilities, disallow privilege escalation.
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]
# startupProbe gives the serve subcommand time to initialise before
# liveness kicks in (avoids crashloop on slow cold starts).
startupProbe:
httpGet:
path: /readyz
port: http
failureThreshold: 10
periodSeconds: 5
# Readiness gates on /readyz, which returns 503 until the proof
# ledger is readable. Liveness gates on /healthz, which reports
# process health regardless of ledger state.
readinessProbe:
httpGet:
path: /readyz
port: http
initialDelaySeconds: 3
periodSeconds: 10
timeoutSeconds: 3
failureThreshold: 3
livenessProbe:
httpGet:
path: /healthz
port: http
initialDelaySeconds: 15
periodSeconds: 20
timeoutSeconds: 5
failureThreshold: 3
resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 500m
memory: 256Mi
volumeMounts:
- name: proof-ledger
mountPath: /var/lib/a11oy
# /tmp must be writable even with readOnlyRootFilesystem=true
- name: tmp
mountPath: /tmp
volumes:
- name: proof-ledger
persistentVolumeClaim:
claimName: a11oy-proof-ledger
- name: tmp
emptyDir: {}
|