-
Notifications
You must be signed in to change notification settings - Fork 1
/
deploy.yaml
182 lines (182 loc) · 3.47 KB
/
deploy.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
---
apiVersion: v1
kind: Namespace
metadata:
name: "k3s-janitor"
labels:
app: "k3s-janitor"
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: "k3s-janitor"
namespace: "k3s-janitor"
labels:
app: "k3s-janitor"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app: k3s-janitor
name: k3s-janitor
rules:
- apiGroups:
- '*'
resources:
- '*'
verbs:
- '*'
- nonResourceURLs:
- '*'
verbs:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app: k3s-janitor
name: k3s-janitor
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: k3s-janitor
subjects:
- kind: ServiceAccount
name: k3s-janitor
namespace: k3s-janitor
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: k3s-janitor
namespace: "k3s-janitor"
labels:
app: k3s-janitor
spec:
allowPrivilegeEscalation: true
allowedCapabilities:
- '*'
fsGroup:
rule: RunAsAny
hostIPC: true
hostNetwork: true
hostPID: true
hostPorts:
- max: 65535
min: 0
privileged: true
runAsUser:
rule: RunAsAny
seLinux:
rule: RunAsAny
supplementalGroups:
rule: RunAsAny
volumes:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app: k3s-janitor
name: k3s-janitor-psp
namespace: "k3s-janitor"
rules:
- apiGroups:
- policy
resources:
- podsecuritypolicies
resourceNames:
- k3s-janitor
verbs:
- use
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: k3s-janitor-psp-binding
namespace: "k3s-janitor"
labels:
app: k3s-janitor
namespace: k3s-janitor
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: k3s-janitor-psp
subjects:
- kind: ServiceAccount
name: k3s-janitor
namespace: k3s-janitor
- kind: ServiceAccount
name: default
namespace: k3s-janitor
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
labels:
app: k3s-janitor
name: k3s-janitor
namespace: "k3s-janitor"
spec:
selector:
matchLabels:
app: k3s-janitor
template:
metadata:
labels:
app: k3s-janitor
spec:
containers:
- env:
- name: PERCENT_THRESHOLD
value: "90"
- name: SLEEP_BACKGROUND
value: "15"
- name: SLEEP_FOREGROUND
value: "5"
image: supporttools/k3s-janitor:latest
imagePullPolicy: Always
name: k3s-janitor
ports:
- containerPort: 8080
name: http
protocol: TCP
livenessProbe:
httpGet:
path: /liveness
port: 8080
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /readiness
port: 8080
securityContext:
allowPrivilegeEscalation: true
privileged: true
volumeMounts:
- mountPath: /var/lib/rancher/
name: var-lib-rancher
- mountPath: /run/k3s/
name: run-k3s
serviceAccount: k3s-janitor
serviceAccountName: k3s-janitor
tolerations:
- key: node-role.kubernetes.io/control-plane
operator: Exists
effect: NoSchedule
- key: node-role.kubernetes.io/master
operator: Exists
effect: NoSchedule
volumes:
- hostPath:
path: /var/lib/rancher/
type: ""
name: var-lib-rancher
- hostPath:
path: /run/k3s/
type: ""
name: run-k3s