129 lines
4.2 KiB
YAML
129 lines
4.2 KiB
YAML
---
|
|
# Source: cilium/charts/cilium/templates/hubble-relay/deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: hubble-relay
|
|
namespace: kube-system
|
|
labels:
|
|
k8s-app: hubble-relay
|
|
app.kubernetes.io/name: hubble-relay
|
|
app.kubernetes.io/part-of: cilium
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
k8s-app: hubble-relay
|
|
strategy:
|
|
rollingUpdate:
|
|
maxUnavailable: 1
|
|
type: RollingUpdate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
labels:
|
|
k8s-app: hubble-relay
|
|
app.kubernetes.io/name: hubble-relay
|
|
app.kubernetes.io/part-of: cilium
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: hubble-relay
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
runAsGroup: 65532
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
image: "quay.io/cilium/hubble-relay:v1.18.4@sha256:6d350cb1c84b847adb152173debef1f774126c69de21a5921a1e6a23b8779723"
|
|
imagePullPolicy: IfNotPresent
|
|
command:
|
|
- hubble-relay
|
|
args:
|
|
- serve
|
|
ports:
|
|
- name: grpc
|
|
containerPort: 4245
|
|
readinessProbe:
|
|
grpc:
|
|
port: 4222
|
|
timeoutSeconds: 3
|
|
# livenessProbe will kill the pod, we should be very conservative
|
|
# here on failures since killing the pod should be a last resort, and
|
|
# we should provide enough time for relay to retry before killing it.
|
|
livenessProbe:
|
|
grpc:
|
|
port: 4222
|
|
timeoutSeconds: 10
|
|
# Give relay time to establish connections and make a few retries
|
|
# before starting livenessProbes.
|
|
initialDelaySeconds: 10
|
|
# 10 second * 12 failures = 2 minutes of failure.
|
|
# If relay cannot become healthy after 2 minutes, then killing it
|
|
# might resolve whatever issue is occurring.
|
|
#
|
|
# 10 seconds is a reasonable retry period so we can see if it's
|
|
# failing regularly or only sporadically.
|
|
periodSeconds: 10
|
|
failureThreshold: 12
|
|
startupProbe:
|
|
grpc:
|
|
port: 4222
|
|
# Give relay time to get it's certs and establish connections and
|
|
# make a few retries before starting startupProbes.
|
|
initialDelaySeconds: 10
|
|
# 20 * 3 seconds = 1 minute of failure before we consider startup as failed.
|
|
failureThreshold: 20
|
|
# Retry more frequently at startup so that it can be considered started more quickly.
|
|
periodSeconds: 3
|
|
volumeMounts:
|
|
- name: config
|
|
mountPath: /etc/hubble-relay
|
|
readOnly: true
|
|
- name: tls
|
|
mountPath: /var/lib/hubble-relay/tls
|
|
readOnly: true
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
restartPolicy: Always
|
|
priorityClassName:
|
|
serviceAccountName: "hubble-relay"
|
|
automountServiceAccountToken: false
|
|
terminationGracePeriodSeconds: 1
|
|
affinity:
|
|
podAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
k8s-app: cilium
|
|
topologyKey: kubernetes.io/hostname
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
volumes:
|
|
- name: config
|
|
configMap:
|
|
name: hubble-relay-config
|
|
items:
|
|
- key: config.yaml
|
|
path: config.yaml
|
|
- name: tls
|
|
projected:
|
|
# note: the leading zero means this number is in octal representation: do not remove it
|
|
defaultMode: 0400
|
|
sources:
|
|
- secret:
|
|
name: hubble-relay-client-certs
|
|
items:
|
|
- key: tls.crt
|
|
path: client.crt
|
|
- key: tls.key
|
|
path: client.key
|
|
- key: ca.crt
|
|
path: hubble-server-ca.crt
|