1apiVersion: apps/v1
2kind: Deployment
3metadata:
4 name: web
5 namespace: emojivoto
6spec:
7 replicas: 1
8 selector:
9 matchLabels:
10 app: web-svc
11 template:
12 metadata:
13 annotations:
14 linkerd.io/created-by: linkerd/cli dev-undefined
15 linkerd.io/proxy-version: test-inject-proxy-version
16 linkerd.io/trust-root-sha256: 8dc603abd4e755c25c94da05abbf29b9b283a784733651020d72f97ca8ab98e4
17 labels:
18 app: web-svc
19 linkerd.io/control-plane-ns: linkerd
20 linkerd.io/proxy-deployment: web
21 linkerd.io/workload-ns: emojivoto
22 spec:
23 containers:
24 - env:
25 - name: _pod_name
26 valueFrom:
27 fieldRef:
28 fieldPath: metadata.name
29 - name: _pod_ns
30 valueFrom:
31 fieldRef:
32 fieldPath: metadata.namespace
33 - name: _pod_nodeName
34 valueFrom:
35 fieldRef:
36 fieldPath: spec.nodeName
37 - name: LINKERD2_PROXY_LOG
38 value: warn,linkerd=info,trust_dns=error
39 - name: LINKERD2_PROXY_LOG_FORMAT
40 value: plain
41 - name: LINKERD2_PROXY_DESTINATION_SVC_ADDR
42 value: linkerd-dst-headless.linkerd.svc.cluster.local.:8086
43 - name: LINKERD2_PROXY_DESTINATION_PROFILE_NETWORKS
44 value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16,fd00::/8
45 - name: LINKERD2_PROXY_POLICY_SVC_ADDR
46 value: linkerd-policy.linkerd.svc.cluster.local.:8090
47 - name: LINKERD2_PROXY_POLICY_WORKLOAD
48 value: |
49 {"ns":"$(_pod_ns)", "pod":"$(_pod_name)"}
50 - name: LINKERD2_PROXY_INBOUND_DEFAULT_POLICY
51 value: all-unauthenticated
52 - name: LINKERD2_PROXY_POLICY_CLUSTER_NETWORKS
53 value: 10.0.0.0/8,100.64.0.0/10,172.16.0.0/12,192.168.0.0/16,fd00::/8
54 - name: LINKERD2_PROXY_CONTROL_STREAM_INITIAL_TIMEOUT
55 value: 3s
56 - name: LINKERD2_PROXY_CONTROL_STREAM_IDLE_TIMEOUT
57 value: 5m
58 - name: LINKERD2_PROXY_CONTROL_STREAM_LIFETIME
59 value: 1h
60 - name: LINKERD2_PROXY_INBOUND_CONNECT_TIMEOUT
61 value: 100ms
62 - name: LINKERD2_PROXY_OUTBOUND_CONNECT_TIMEOUT
63 value: 1000ms
64 - name: LINKERD2_PROXY_OUTBOUND_DISCOVERY_IDLE_TIMEOUT
65 value: 5s
66 - name: LINKERD2_PROXY_INBOUND_DISCOVERY_IDLE_TIMEOUT
67 value: 90s
68 - name: LINKERD2_PROXY_CONTROL_LISTEN_ADDR
69 value: '[::]:4190'
70 - name: LINKERD2_PROXY_ADMIN_LISTEN_ADDR
71 value: '[::]:4191'
72 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDR
73 value: 127.0.0.1:4140
74 - name: LINKERD2_PROXY_OUTBOUND_LISTEN_ADDRS
75 value: 127.0.0.1:4140
76 - name: LINKERD2_PROXY_INBOUND_LISTEN_ADDR
77 value: '[::]:4143'
78 - name: LINKERD2_PROXY_INBOUND_IPS
79 valueFrom:
80 fieldRef:
81 fieldPath: status.podIPs
82 - name: LINKERD2_PROXY_INBOUND_PORTS
83 value: "80"
84 - name: LINKERD2_PROXY_DESTINATION_PROFILE_SUFFIXES
85 value: svc.cluster.local.
86 - name: LINKERD2_PROXY_INBOUND_ACCEPT_KEEPALIVE
87 value: 10000ms
88 - name: LINKERD2_PROXY_OUTBOUND_CONNECT_KEEPALIVE
89 value: 10000ms
90 - name: LINKERD2_PROXY_INBOUND_SERVER_HTTP2_KEEP_ALIVE_INTERVAL
91 value: 10s
92 - name: LINKERD2_PROXY_INBOUND_SERVER_HTTP2_KEEP_ALIVE_TIMEOUT
93 value: 3s
94 - name: LINKERD2_PROXY_OUTBOUND_SERVER_HTTP2_KEEP_ALIVE_INTERVAL
95 value: 10s
96 - name: LINKERD2_PROXY_OUTBOUND_SERVER_HTTP2_KEEP_ALIVE_TIMEOUT
97 value: 3s
98 - name: LINKERD2_PROXY_INBOUND_PORTS_DISABLE_PROTOCOL_DETECTION
99 value: 25,587,3306,4444,5432,6379,9300,11211
100 - name: LINKERD2_PROXY_DESTINATION_CONTEXT
101 value: |
102 {"ns":"$(_pod_ns)", "nodeName":"$(_pod_nodeName)", "pod":"$(_pod_name)"}
103 - name: _pod_sa
104 valueFrom:
105 fieldRef:
106 fieldPath: spec.serviceAccountName
107 - name: _l5d_ns
108 value: linkerd
109 - name: _l5d_trustdomain
110 value: cluster.local
111 - name: LINKERD2_PROXY_IDENTITY_DIR
112 value: /var/run/linkerd/identity/end-entity
113 - name: LINKERD2_PROXY_IDENTITY_TRUST_ANCHORS
114 value: |
115 -----BEGIN CERTIFICATE-----
116 MIIBwTCCAWagAwIBAgIQeDZp5lDaIygQ5UfMKZrFATAKBggqhkjOPQQDAjApMScw
117 JQYDVQQDEx5pZGVudGl0eS5saW5rZXJkLmNsdXN0ZXIubG9jYWwwHhcNMjAwODI4
118 MDcxMjQ3WhcNMzAwODI2MDcxMjQ3WjApMScwJQYDVQQDEx5pZGVudGl0eS5saW5r
119 ZXJkLmNsdXN0ZXIubG9jYWwwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARqc70Z
120 l1vgw79rjB5uSITICUA6GyfvSFfcuIis7B/XFSkkwAHU5S/s1AAP+R0TX7HBWUC4
121 uaG4WWsiwJKNn7mgo3AwbjAOBgNVHQ8BAf8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB
122 /wIBATAdBgNVHQ4EFgQU5YtjVVPfd7I7NLHsn2C26EByGV0wKQYDVR0RBCIwIIIe
123 aWRlbnRpdHkubGlua2VyZC5jbHVzdGVyLmxvY2FsMAoGCCqGSM49BAMCA0kAMEYC
124 IQCN7lBFLDDvjx6V0+XkjpKERRsJYf5adMvnloFl48ilJgIhANtxhndcr+QJPuC8
125 vgUC0d2/9FMueIVMb+46WTCOjsqr
126 -----END CERTIFICATE-----
127 - name: LINKERD2_PROXY_IDENTITY_TOKEN_FILE
128 value: /var/run/secrets/tokens/linkerd-identity-token
129 - name: LINKERD2_PROXY_IDENTITY_SVC_ADDR
130 value: linkerd-identity-headless.linkerd.svc.cluster.local.:8080
131 - name: LINKERD2_PROXY_IDENTITY_LOCAL_NAME
132 value: $(_pod_sa).$(_pod_ns).serviceaccount.identity.linkerd.cluster.local
133 - name: LINKERD2_PROXY_IDENTITY_SVC_NAME
134 value: linkerd-identity.linkerd.serviceaccount.identity.linkerd.cluster.local
135 - name: LINKERD2_PROXY_DESTINATION_SVC_NAME
136 value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local
137 - name: LINKERD2_PROXY_POLICY_SVC_NAME
138 value: linkerd-destination.linkerd.serviceaccount.identity.linkerd.cluster.local
139 image: cr.l5d.io/linkerd/proxy:test-inject-proxy-version
140 imagePullPolicy: IfNotPresent
141 lifecycle:
142 postStart:
143 exec:
144 command:
145 - /usr/lib/linkerd/linkerd-await
146 - --timeout=2m
147 - --port=4191
148 livenessProbe:
149 httpGet:
150 path: /live
151 port: 4191
152 initialDelaySeconds: 10
153 timeoutSeconds: 1
154 name: linkerd-proxy
155 ports:
156 - containerPort: 4143
157 name: linkerd-proxy
158 - containerPort: 4191
159 name: linkerd-admin
160 readinessProbe:
161 httpGet:
162 path: /ready
163 port: 4191
164 initialDelaySeconds: 2
165 timeoutSeconds: 1
166 securityContext:
167 allowPrivilegeEscalation: false
168 capabilities:
169 add:
170 - NET_BIND_SERVICE
171 drop:
172 - ALL
173 readOnlyRootFilesystem: true
174 runAsNonRoot: true
175 runAsUser: 2102
176 seccompProfile:
177 type: RuntimeDefault
178 terminationMessagePolicy: FallbackToLogsOnError
179 volumeMounts:
180 - mountPath: /var/run/linkerd/identity/end-entity
181 name: linkerd-identity-end-entity
182 - mountPath: /var/run/secrets/tokens
183 name: linkerd-identity-token
184 - env:
185 - name: WEB_PORT
186 value: "80"
187 - name: EMOJISVC_HOST
188 value: emoji-svc.emojivoto:8080
189 - name: VOTINGSVC_HOST
190 value: voting-svc.emojivoto:8080
191 - name: INDEX_BUNDLE
192 value: dist/index_bundle.js
193 image: buoyantio/emojivoto-web:v10
194 name: web-svc
195 ports:
196 - containerPort: 80
197 name: http
198 securityContext:
199 allowPrivilegeEscalation: true
200 capabilities:
201 add:
202 - NET_BIND_SERVICE
203 drop:
204 - ALL
205 runAsGroup: 33
206 runAsUser: 33
207 initContainers:
208 - args:
209 - --ipv6=false
210 - --incoming-proxy-port
211 - "4143"
212 - --outgoing-proxy-port
213 - "4140"
214 - --proxy-uid
215 - "2102"
216 - --inbound-ports-to-ignore
217 - 4190,4191,4567,4568
218 - --outbound-ports-to-ignore
219 - 4567,4568
220 image: cr.l5d.io/linkerd/proxy-init:v2.4.0
221 imagePullPolicy: IfNotPresent
222 name: linkerd-init
223 resources:
224 limits:
225 cpu: 100m
226 memory: 20Mi
227 requests:
228 cpu: 100m
229 memory: 20Mi
230 securityContext:
231 allowPrivilegeEscalation: false
232 capabilities:
233 add:
234 - NET_ADMIN
235 - NET_RAW
236 - NET_BIND_SERVICE
237 drop:
238 - ALL
239 privileged: false
240 readOnlyRootFilesystem: true
241 runAsGroup: 65534
242 runAsNonRoot: true
243 runAsUser: 65534
244 seccompProfile:
245 type: RuntimeDefault
246 terminationMessagePolicy: FallbackToLogsOnError
247 volumeMounts:
248 - mountPath: /run
249 name: linkerd-proxy-init-xtables-lock
250 volumes:
251 - emptyDir: {}
252 name: linkerd-proxy-init-xtables-lock
253 - emptyDir:
254 medium: Memory
255 name: linkerd-identity-end-entity
256 - name: linkerd-identity-token
257 projected:
258 sources:
259 - serviceAccountToken:
260 audience: identity.l5d.io
261 expirationSeconds: 86400
262 path: linkerd-identity-token
263---
View as plain text