79 lines
2.6 KiB
YAML
79 lines
2.6 KiB
YAML
# Beispiel für OpenShift (Namespace, Registry und Hosts anpassen). Braucht keine Cluster-Admin-Rechte.
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: db-mcp-postgres
|
|
type: Opaque
|
|
stringData:
|
|
# name:geheimnis, kommagetrennt; Bifröst bekommt einen eigenen Schlüssel
|
|
DBMCP_API_KEYS: "bifroest:BITTE-ERSETZEN-mindestens-16-zeichen"
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: db-mcp-postgres
|
|
spec:
|
|
replicas: 2
|
|
selector:
|
|
matchLabels: {app: db-mcp-postgres}
|
|
template:
|
|
metadata:
|
|
labels: {app: db-mcp-postgres}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- name: dienst
|
|
image: registry.intern/db-mcp-postgres:0.1.0
|
|
ports: [{containerPort: 8080}]
|
|
env:
|
|
- {name: DBMCP_ALLOWED_HOSTS, value: "pg1.db.intern,.analytics.db.intern"}
|
|
- {name: DBMCP_HTTP_HOSTS, value: "db-mcp-postgres,db-mcp-postgres:8080"}
|
|
- {name: DBMCP_MAX_ROWS, value: "500"}
|
|
envFrom: [{secretRef: {name: db-mcp-postgres}}]
|
|
readinessProbe: {httpGet: {path: /ready, port: 8080}}
|
|
livenessProbe: {httpGet: {path: /live, port: 8080}}
|
|
resources:
|
|
requests: {cpu: 100m, memory: 128Mi}
|
|
limits: {cpu: "1", memory: 512Mi}
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
capabilities: {drop: [ALL]}
|
|
seccompProfile: {type: RuntimeDefault}
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: db-mcp-postgres
|
|
spec:
|
|
selector: {app: db-mcp-postgres}
|
|
ports: [{port: 8080, targetPort: 8080}]
|
|
---
|
|
# Nur Bifröst (bzw. freigegebene Clients) darf den Dienst aufrufen
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: db-mcp-postgres-ingress
|
|
spec:
|
|
podSelector: {matchLabels: {app: db-mcp-postgres}}
|
|
policyTypes: [Ingress]
|
|
ingress:
|
|
- from:
|
|
- podSelector: {matchLabels: {app: bifrost-web}}
|
|
- podSelector: {matchLabels: {app: bifrost-worker}}
|
|
ports: [{port: 8080}]
|
|
---
|
|
# Der Dienst darf nur zu den PostgreSQL-Servern (und DNS)
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: NetworkPolicy
|
|
metadata:
|
|
name: db-mcp-postgres-egress
|
|
spec:
|
|
podSelector: {matchLabels: {app: db-mcp-postgres}}
|
|
policyTypes: [Egress]
|
|
egress:
|
|
- to: [{ipBlock: {cidr: 10.20.30.0/24}}] # Netz der PostgreSQL-Server
|
|
ports: [{port: 5432}]
|
|
- to: [{namespaceSelector: {}, podSelector: {matchLabels: {dns.operator.openshift.io/daemonset-dns: default}}}]
|
|
ports: [{port: 5353, protocol: UDP}, {port: 5353, protocol: TCP}]
|