MarioGLealPandClaude Opus 5.5
b76c196ee0
eso.yaml: the eso ServiceAccount, the openbao SecretStore (role meru-zot-eso, wave -2) and the zot-htpasswd ExternalSecret (Owner - D68, wave -1); the Namespace moves to wave -3. ESO takes the hand-made Secret over with the same values (probed live: identical). Co-Authored-By: Claude Opus 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MdS1HcMerN6toVuLY5K4MR
67 lines
2.2 KiB
YAML
67 lines
2.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: zot
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate # one writer on a ReadWriteOnce volume
|
|
selector:
|
|
matchLabels:
|
|
app: zot
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: zot
|
|
app.kubernetes.io/name: zot
|
|
app.kubernetes.io/part-of: meru
|
|
meru.clockmost.com/owner: platform
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000710000 # the image defaults to root; it doesn't need it
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: zot
|
|
image: ghcr.io/project-zot/zot-linux-amd64:v2.1.22@sha256:46f688dc26315a35a247e1784368829e66a67bf91de94c7d8d1645044fac1d5b
|
|
args: ["serve", "/etc/zot/config.json"]
|
|
ports:
|
|
- name: registry
|
|
containerPort: 5000
|
|
startupProbe:
|
|
httpGet: { path: /startupz, port: registry }
|
|
periodSeconds: 5
|
|
failureThreshold: 24
|
|
livenessProbe:
|
|
httpGet: { path: /livez, port: registry }
|
|
periodSeconds: 20
|
|
readinessProbe:
|
|
httpGet: { path: /readyz, port: registry }
|
|
periodSeconds: 10
|
|
resources:
|
|
requests: { cpu: 50m, memory: 256Mi }
|
|
limits: { memory: 1536Mi } # CVE scans (Trivy) spike while they run
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
capabilities:
|
|
drop: [ALL]
|
|
volumeMounts:
|
|
- { name: config, mountPath: /etc/zot/config.json, subPath: config.json }
|
|
- { name: auth, mountPath: /etc/zot/auth, readOnly: true }
|
|
- { name: registry, mountPath: /var/lib/registry }
|
|
- { name: tmp, mountPath: /tmp }
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: zot-config
|
|
- name: auth
|
|
secret:
|
|
secretName: zot-htpasswd # ESO fills it (eso.yaml): one push login per app's builds (Meru/sindri), readers anonymous
|
|
- name: registry
|
|
persistentVolumeClaim:
|
|
claimName: registry
|
|
- name: tmp
|
|
emptyDir: {}
|