mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
de7ca770a0
Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). whishper also gets --use-openssl-ca for Node, and both point requests at the bundle instead of certifi.
98 lines
2.9 KiB
YAML
98 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: translate
|
|
name: translate
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
io.kompose.service: translate
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: translate
|
|
spec:
|
|
containers:
|
|
- image: libretranslate/libretranslate:latest
|
|
securityContext:
|
|
runAsUser: 0
|
|
runAsGroup: 0
|
|
runAsNonRoot: false
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- ./venv/bin/python scripts/healthcheck.py
|
|
failureThreshold: 5
|
|
periodSeconds: 2
|
|
timeoutSeconds: 3
|
|
name: whisper-libretranslate
|
|
ports:
|
|
- containerPort: 5000
|
|
protocol: TCP
|
|
tty: true
|
|
volumeMounts:
|
|
- mountPath: /home/libretranslate/.local/share
|
|
name: translate-claim0
|
|
- mountPath: /home/libretranslate/.local/cache
|
|
name: translate-claim1
|
|
- mountPath: /etc/ssl/certs
|
|
name: patched-ca-bundle
|
|
readOnly: true
|
|
env:
|
|
# Trust store without the compromised eMudhra intermediates, see
|
|
# ca-bundle/. requests would otherwise use certifi.
|
|
- name: SSL_CERT_FILE
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
- name: REQUESTS_CA_BUNDLE
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
- name: DB_PASS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: DB_PASS
|
|
name: env
|
|
- name: DB_USER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: DB_USER
|
|
name: env
|
|
- name: LT_DISABLE_WEB_UI
|
|
value: "true"
|
|
- name: LT_LOAD_ONLY
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: LT_LOAD_ONLY
|
|
name: env
|
|
- name: LT_UPDATE_MODELS
|
|
value: "true"
|
|
- name: WHISHPER_HOST
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: WHISHPER_HOST
|
|
name: env
|
|
- name: WHISPER_MODELS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: WHISPER_MODELS
|
|
name: env
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
- name: translate-claim0
|
|
persistentVolumeClaim:
|
|
claimName: translate-claim0
|
|
- name: translate-claim1
|
|
persistentVolumeClaim:
|
|
claimName: translate-claim1
|