hermes
55c5de9d61
The cluster objects for the beer namespace were created by hand. This puts them in the repo so they can be applied and reviewed like everything else. - `beer-deployment.yaml` — the Deployment, with the security context, the resource limits, and both probes wired up (`/healthz` liveness, `/readyz` readiness). - `beer-service.yaml` — the NodePort service. - `beer_namespace.yaml` — the namespace. The credentials are NOT in these files. `MONGO_PASS` and `SECRET_KEY` come from the live `beer-db` and `beer-app` Secrets, so applying the manifests cannot clobber a hand-provisioned credential. Notes on the pod security context --------------------------------- `runAsNonRoot: true` cannot be set on the container when the image's user is a *named* user - kubelet can only verify a numeric UID. The pod-level security context therefore sets `runAsUser: 999`, which matches the `beer` user the image creates (verified with `id` in the built image). The container also drops all capabilities and refuses privilege escalation.
18 lines
267 B
YAML
18 lines
267 B
YAML
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: beer-service
|
|
namespace: beer
|
|
labels:
|
|
app: beer-data
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
app: beer-data
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: 5000
|
|
nodePort: 30015
|
|
protocol: TCP
|