| ---
|
|
|
|
|
|
|
| apiVersion: apps/v1
|
| kind: Deployment
|
| metadata:
|
| name: aegislm-api
|
| namespace: aegislm
|
| labels:
|
| app: aegislm
|
| component: api
|
| spec:
|
| replicas: 3
|
| selector:
|
| matchLabels:
|
| app: aegislm
|
| component: api
|
| template:
|
| metadata:
|
| labels:
|
| app: aegislm
|
| component: api
|
| spec:
|
| serviceAccountName: aegislm
|
| securityContext:
|
| runAsNonRoot: true
|
| runAsUser: 1000
|
| runAsGroup: 1000
|
| fsGroup: 1000
|
| seccompProfile:
|
| type: RuntimeDefault
|
| containers:
|
| - name: api
|
| image: aegislm/api:latest
|
| imagePullPolicy: IfNotPresent
|
| ports:
|
| - containerPort: 8000
|
| name: http
|
| protocol: TCP
|
| securityContext:
|
| allowPrivilegeEscalation: false
|
| readOnlyRootFilesystem: true
|
| capabilities:
|
| drop:
|
| - ALL
|
| runAsNonRoot: true
|
| runAsUser: 1000
|
| env:
|
| - name: PYTHONUNBUFFERED
|
| value: "1"
|
| - name: API_HOST
|
| value: "0.0.0.0"
|
| - name: API_PORT
|
| value: "8000"
|
| envFrom:
|
| - configMapRef:
|
| name: aegislm-config
|
| - secretRef:
|
| name: aegislm-secrets
|
| resources:
|
| requests:
|
| cpu: 500m
|
| memory: 1Gi
|
| limits:
|
| cpu: 1000m
|
| memory: 2Gi
|
| volumeMounts:
|
| - name: tmp
|
| mountPath: /tmp
|
| livenessProbe:
|
| httpGet:
|
| path: /health/live
|
| port: 8000
|
| initialDelaySeconds: 30
|
| periodSeconds: 10
|
| timeoutSeconds: 5
|
| failureThreshold: 3
|
| readinessProbe:
|
| httpGet:
|
| path: /health/ready
|
| port: 8000
|
| initialDelaySeconds: 10
|
| periodSeconds: 5
|
| timeoutSeconds: 3
|
| failureThreshold: 3
|
| volumes:
|
| - name: tmp
|
| emptyDir:
|
| medium: Memory
|
| sizeLimit: 64Mi
|
| affinity:
|
| podAntiAffinity:
|
| preferredDuringSchedulingIgnoredDuringExecution:
|
| - weight: 100
|
| podAffinityTerm:
|
| labelSelector:
|
| matchExpressions:
|
| - key: component
|
| operator: In
|
| values:
|
| - api
|
| topologyKey: kubernetes.io/hostname
|
|
|
