148 lines
3.2 KiB
CUE
148 lines
3.2 KiB
CUE
package templates
|
|
|
|
import (
|
|
appsv1 "k8s.io/api/apps/v1"
|
|
corev1 "k8s.io/api/core/v1"
|
|
)
|
|
|
|
#StatefulSet: appsv1.#StatefulSet & {
|
|
#config: #Config
|
|
#name: string
|
|
#group: #NodeGroup
|
|
#cmName: string
|
|
apiVersion: "apps/v1"
|
|
kind: "StatefulSet"
|
|
metadata: (#config.#Meta & {name: #name}).out
|
|
spec: appsv1.#StatefulSetSpec & {
|
|
serviceName: #group.role
|
|
replicas: #group.replicas
|
|
selector: matchLabels: {
|
|
"app": "radicle-node"
|
|
"instance": #name
|
|
}
|
|
template: {
|
|
metadata: labels: {
|
|
"app": "radicle-node"
|
|
"role": #group.role
|
|
"instance": #name
|
|
}
|
|
spec: corev1.#PodSpec & {
|
|
securityContext: {
|
|
fsGroup: 11011
|
|
seccompProfile: type: "RuntimeDefault"
|
|
runAsNonRoot: true
|
|
runAsUser: 11011
|
|
runAsGroup: 11011
|
|
}
|
|
initContainers: [
|
|
{
|
|
name: "config-prep"
|
|
image: "busybox"
|
|
command: ["sh", "-c"]
|
|
args: [#group.scripts.init]
|
|
volumeMounts: [
|
|
{
|
|
name: "config-template"
|
|
mountPath: "/tmp/config-source"
|
|
},
|
|
{
|
|
name: "radicle-home"
|
|
mountPath: "/home/radicle/.radicle"
|
|
},
|
|
]
|
|
securityContext: {
|
|
runAsUser: 11011
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities: drop: ["ALL"]
|
|
seccompProfile: type: "RuntimeDefault"
|
|
}
|
|
},
|
|
]
|
|
containers: [
|
|
{
|
|
name: "node"
|
|
image: "\(#group.repository):\(#group.version)"
|
|
imagePullPolicy: #group.pullPolicy
|
|
command: ["/bin/sh", "-c"]
|
|
args: [#group.scripts.start]
|
|
env: [
|
|
{
|
|
name: "RAD_PASSPHRASE"
|
|
value: ""
|
|
},
|
|
{
|
|
name: "NODE_ID_SEED"
|
|
value: #group.nodeIdSeed
|
|
},
|
|
]
|
|
securityContext: {
|
|
allowPrivilegeEscalation: false
|
|
capabilities: drop: ["ALL"]
|
|
privileged: false
|
|
readOnlyRootFilesystem: false
|
|
}
|
|
ports: [
|
|
{
|
|
containerPort: 8776
|
|
name: "gossip"
|
|
},
|
|
]
|
|
volumeMounts: [
|
|
{
|
|
name: "radicle-home"
|
|
mountPath: "/home/radicle/.radicle"
|
|
},
|
|
]
|
|
},
|
|
if #group.sidecars.events {
|
|
{
|
|
name: "events"
|
|
image: "\(#group.repository):\(#group.version)"
|
|
command: ["/bin/sh", "-c"]
|
|
args: [#group.scripts.events]
|
|
securityContext: {
|
|
runAsNonRoot: true
|
|
runAsUser: 11011
|
|
runAsGroup: 11011
|
|
allowPrivilegeEscalation: false
|
|
capabilities: drop: ["ALL"]
|
|
readOnlyRootFilesystem: false
|
|
}
|
|
volumeMounts: [
|
|
{
|
|
name: "radicle-home"
|
|
mountPath: "/home/radicle/.radicle"
|
|
},
|
|
]
|
|
}
|
|
},
|
|
]
|
|
volumes: [
|
|
{
|
|
name: "config-template"
|
|
configMap: name: #cmName
|
|
},
|
|
]
|
|
}
|
|
}
|
|
volumeClaimTemplates: [
|
|
{
|
|
metadata: {
|
|
name: "radicle-home"
|
|
labels: {
|
|
"app": "radicle-node"
|
|
"role": #group.role
|
|
"instance": #name
|
|
}
|
|
}
|
|
spec: {
|
|
storageClassName: #group.storage.className
|
|
accessModes: ["ReadWriteOnce"]
|
|
resources: requests: storage: #group.storage.size
|
|
}
|
|
},
|
|
]
|
|
}
|
|
}
|