336 lines
9.1 KiB
YAML
336 lines
9.1 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
- configmaps
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- argoproj.io
|
|
resources:
|
|
- applications
|
|
verbs:
|
|
- get
|
|
- list
|
|
- update
|
|
- patch
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: argocd-image-updater
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: argocd-image-updater
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: argocd-image-updater
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: argocd-image-updater
|
|
namespace: argocd
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: argocd-image-updater-config
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater-config
|
|
---
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: argocd-image-updater-ssh-config
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater-ssh-config
|
|
---
|
|
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: argocd-image-updater-secret
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater-secret
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/component: controller
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
app.kubernetes.io/part-of: argocd-image-updater
|
|
name: argocd-image-updater
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: argocd-image-updater
|
|
spec:
|
|
containers:
|
|
- args:
|
|
- run
|
|
env:
|
|
- name: APPLICATIONS_API
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: applications_api
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: ARGOCD_GRPC_WEB
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: argocd.grpc_web
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: ARGOCD_SERVER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: argocd.server_addr
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: ARGOCD_INSECURE
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: argocd.insecure
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: ARGOCD_PLAINTEXT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: argocd.plaintext
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: ARGOCD_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: argocd.token
|
|
name: argocd-image-updater-secret
|
|
optional: true
|
|
- name: IMAGE_UPDATER_INTERVAL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: interval
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: IMAGE_UPDATER_LOGLEVEL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: log.level
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: GIT_COMMIT_USER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: git.user
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: GIT_COMMIT_EMAIL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: git.email
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: GIT_COMMIT_SIGNING_KEY
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: git.commit-signing-key
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: GIT_COMMIT_SIGNING_METHOD
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: git.commit-signing-method
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: GIT_COMMIT_SIGN_OFF
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: git.commit-sign-off
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: IMAGE_UPDATER_KUBE_EVENTS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: kube.events
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: ARGOCD_LOGLEVEL
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: log.level
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: ENABLE_WEBHOOK
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: webhook.enable
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: WEBHOOK_PORT
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: webhook.port
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
- name: QUAY_WEBHOOK_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: webhook.quay-secret
|
|
name: argocd-image-updater-secret
|
|
optional: true
|
|
- name: DOCKER_WEBHOOK_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: webhook.docker-secret
|
|
name: argocd-image-updater-secret
|
|
optional: true
|
|
- name: GHCR_WEBHOOK_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: webhook.ghcr-secret
|
|
name: argocd-image-updater-secret
|
|
optional: true
|
|
- name: HARBOR_WEBHOOK_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: webhook.harbor-secret
|
|
name: argocd-image-updater-secret
|
|
optional: true
|
|
- name: WEBHOOK_RATELIMIT_ALLOWED
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: webhook.ratelimit-allowed
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
image: quay.io/argoprojlabs/argocd-image-updater:v0.18.0
|
|
imagePullPolicy: Always
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 30
|
|
name: argocd-image-updater
|
|
ports:
|
|
- containerPort: 8080
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /healthz
|
|
port: 8080
|
|
initialDelaySeconds: 3
|
|
periodSeconds: 30
|
|
resources:
|
|
limits:
|
|
cpu: 500m
|
|
memory: 1024Mi
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- mountPath: /app/config
|
|
name: image-updater-conf
|
|
- mountPath: /app/config/ssh
|
|
name: ssh-known-hosts
|
|
- mountPath: /app/.ssh
|
|
name: ssh-config
|
|
- mountPath: /tmp
|
|
name: tmp
|
|
- mountPath: /app/ssh-keys/id_rsa
|
|
name: ssh-signing-key
|
|
readOnly: true
|
|
subPath: sshPrivateKey
|
|
serviceAccountName: argocd-image-updater
|
|
volumes:
|
|
- configMap:
|
|
items:
|
|
- key: registries.conf
|
|
path: registries.conf
|
|
- key: git.commit-message-template
|
|
path: commit.template
|
|
name: argocd-image-updater-config
|
|
optional: true
|
|
name: image-updater-conf
|
|
- configMap:
|
|
name: argocd-ssh-known-hosts-cm
|
|
optional: true
|
|
name: ssh-known-hosts
|
|
- configMap:
|
|
name: argocd-image-updater-ssh-config
|
|
optional: true
|
|
name: ssh-config
|
|
- name: ssh-signing-key
|
|
secret:
|
|
optional: true
|
|
secretName: ssh-git-creds
|
|
- emptyDir: {}
|
|
name: tmp
|