257 lines
7.1 KiB
YAML
257 lines
7.1 KiB
YAML
---
|
|
# Source: gitlab-agent/templates/ocs/serviceaccount.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: release-name-gitlab-agent-ocs-scanning-pod-sa
|
|
namespace: gitlab
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
---
|
|
# Source: gitlab-agent/templates/serviceaccount.yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: release-name-gitlab-agent
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
---
|
|
# Source: gitlab-agent/templates/ocs/clusterrole.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: gitlab:release-name-gitlab-agent:ocs
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
rules:
|
|
- apiGroups:
|
|
- batch
|
|
resources:
|
|
- cronjobs
|
|
- jobs
|
|
verbs:
|
|
- list
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
- replicationcontrollers
|
|
- serviceaccounts
|
|
- namespaces
|
|
verbs:
|
|
- list
|
|
- get
|
|
- apiGroups:
|
|
- "apps"
|
|
resources:
|
|
- replicasets
|
|
- daemonsets
|
|
- statefulsets
|
|
- deployments
|
|
verbs:
|
|
- list
|
|
- get
|
|
---
|
|
# Source: gitlab-agent/templates/clusterrolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: gitlab:release-name-gitlab-agent-cluster-admin
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: cluster-admin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: release-name-gitlab-agent
|
|
namespace: gitlab
|
|
---
|
|
# Source: gitlab-agent/templates/ocs/clusterrolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: gitlab:release-name-gitlab-agent:ocs
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: gitlab:release-name-gitlab-agent:ocs
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: release-name-gitlab-agent-ocs-scanning-pod-sa
|
|
namespace: gitlab
|
|
---
|
|
# Source: gitlab-agent/templates/ocs/role.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
name: release-name-gitlab-agent:ocs
|
|
namespace: gitlab
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
verbs:
|
|
- create
|
|
---
|
|
# Source: gitlab-agent/templates/ocs/rolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: release-name-gitlab-agent:ocs
|
|
namespace: gitlab
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: release-name-gitlab-agent:ocs
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: release-name-gitlab-agent-ocs-scanning-pod-sa
|
|
namespace: gitlab
|
|
---
|
|
# Source: gitlab-agent/templates/deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
# NOTE: the `-v1` suffix was introduced as an epoch version to be able
|
|
# to gracefully recreate the deployment in case there is no upgrade
|
|
# path otherwise, e.g. when changing an immutable field.
|
|
# see https://gitlab.com/gitlab-org/charts/gitlab-agent/-/issues/38 for ctx
|
|
name: release-name-gitlab-agent-v2
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
replicas: 2
|
|
strategy:
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|
|
type: RollingUpdate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
prometheus.io/path: /metrics
|
|
prometheus.io/port: "8080"
|
|
prometheus.io/scrape: "true"
|
|
labels:
|
|
helm.sh/chart: gitlab-agent-2.2.0
|
|
app.kubernetes.io/name: gitlab-agent
|
|
app.kubernetes.io/instance: release-name
|
|
app.kubernetes.io/version: "v17.0.1"
|
|
app.kubernetes.io/managed-by: Helm
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
serviceAccountName: release-name-gitlab-agent
|
|
securityContext:
|
|
{}
|
|
containers:
|
|
- name: gitlab-agent
|
|
securityContext:
|
|
{}
|
|
image: registry.gitlab.com/gitlab-org/cluster-integration/gitlab-agent/agentk:v17.0.1
|
|
imagePullPolicy: IfNotPresent
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
args:
|
|
- --token-file=/etc/agentk/secrets/token
|
|
- --kas-address=wss://kas.gitlab.com
|
|
ports:
|
|
- name: observability
|
|
containerPort: 8080
|
|
protocol: TCP
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /liveness
|
|
port: 8080
|
|
initialDelaySeconds: 15
|
|
periodSeconds: 20
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /readiness
|
|
port: 8080
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 10
|
|
resources:
|
|
{}
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: SERVICE_ACCOUNT_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: spec.serviceAccountName
|
|
- name: OCS_ENABLED
|
|
value: "true"
|
|
- name: OCS_SERVICE_ACCOUNT_NAME
|
|
value: release-name-gitlab-agent-ocs-scanning-pod-sa
|
|
volumeMounts:
|
|
- name: service-account-token-volume
|
|
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
|
readOnly: true
|
|
volumes:
|
|
- name: service-account-token-volume
|
|
projected:
|
|
defaultMode: 0444
|
|
sources:
|
|
- configMap:
|
|
name: kube-root-ca.crt
|
|
- downwardAPI:
|
|
items:
|
|
- fieldRef:
|
|
apiVersion: v1
|
|
fieldPath: metadata.namespace
|
|
path: namespace
|
|
- serviceAccountToken:
|
|
expirationSeconds: 3600
|
|
path: token
|