rock
3630721366
key-rotation-controller / image (push) Failing after 5s
Three faults stopped the controller from running, each found by running it:
image arch the first build was arm64 and every node is amd64, so the pod died
with 'exec format error'. imagePullPolicy IfNotPresent kept the
cached wrong-arch layer, so it is now Always.
leases leader election needs coordination.k8s.io/leases. Without it the
controller never acquired its lock and never reconciled.
secrets list the manager caches Secrets, so it needs list and watch, not only
get, create, update and patch.
go.mod and go.sum gained the procfs entry the build needs.
67 lines
2.4 KiB
YAML
67 lines
2.4 KiB
YAML
# The controller. Its own machine key is the single bootstrap credential: it is
|
|
# created once and mounted here, and this process creates every other credential.
|
|
#
|
|
# The image must be built and pushed before this Deployment can start. Until then
|
|
# the object stays Pending, which is why no Argo CD Application is wired yet.
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: key-rotation-controller
|
|
namespace: iam
|
|
labels:
|
|
app: key-rotation-controller
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: key-rotation-controller
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: key-rotation-controller
|
|
spec:
|
|
serviceAccountName: key-rotation-controller
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: controller
|
|
image: forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller:0.1.0
|
|
imagePullPolicy: Always
|
|
args:
|
|
- --scan-interval=10m
|
|
env:
|
|
- {name: ZITADEL_ISSUER, value: "https://zitadel.riotpiao.com"}
|
|
- name: ZITADEL_CLIENT_ID
|
|
valueFrom: {secretKeyRef: {name: key-rotation-controller, key: client-id}}
|
|
- name: ZITADEL_USER_ID
|
|
valueFrom: {secretKeyRef: {name: key-rotation-controller, key: user-id}}
|
|
- name: ZITADEL_KEY_ID
|
|
valueFrom: {secretKeyRef: {name: key-rotation-controller, key: key-id}}
|
|
- {name: ZITADEL_KEY_FILE, value: "/var/run/keys/controller/key"}
|
|
ports:
|
|
- {name: metrics, containerPort: 8080}
|
|
- {name: health, containerPort: 8081}
|
|
readinessProbe:
|
|
httpGet: {path: /healthz, port: health}
|
|
initialDelaySeconds: 5
|
|
livenessProbe:
|
|
httpGet: {path: /healthz, port: health}
|
|
initialDelaySeconds: 15
|
|
volumeMounts:
|
|
- {name: controller-key, mountPath: /var/run/keys/controller, readOnly: true}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities: {drop: ["ALL"]}
|
|
resources:
|
|
requests: {cpu: 20m, memory: 64Mi}
|
|
limits: {cpu: 500m, memory: 256Mi}
|
|
volumes:
|
|
- name: controller-key
|
|
secret:
|
|
secretName: key-rotation-controller
|
|
items:
|
|
- {key: key, path: key}
|