mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
de7ca770a0
Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). whishper also gets --use-openssl-ca for Node, and both point requests at the bundle instead of certifi.
97 lines
2.9 KiB
YAML
97 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: whishper
|
|
name: whishper
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
io.kompose.service: whishper
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
kompose.cmd: kompose convert
|
|
kompose.version: 1.34.0 (cbf2835db)
|
|
labels:
|
|
io.kompose.service: whishper
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: CPU_THREADS
|
|
value: "4"
|
|
- name: DB_PASS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: DB_PASS
|
|
name: env
|
|
- name: DB_USER
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: DB_USER
|
|
name: env
|
|
- name: LT_LOAD_ONLY
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: LT_LOAD_ONLY
|
|
name: env
|
|
- name: PUBLIC_API_HOST
|
|
- name: PUBLIC_INTERNAL_API_HOST
|
|
value: http://127.0.0.1:80
|
|
- name: PUBLIC_TRANSLATION_API_HOST
|
|
- name: PUBLIC_WHISHPER_PROFILE
|
|
value: cpu
|
|
- name: UPLOAD_DIR
|
|
value: /app/uploads
|
|
- name: WHISHPER_HOST
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: WHISHPER_HOST
|
|
name: env
|
|
- name: WHISPER_MODELS
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
key: WHISPER_MODELS
|
|
name: env
|
|
- name: WHISPER_MODELS_DIR
|
|
value: /app/models
|
|
# Trust store without the compromised eMudhra intermediates, see
|
|
# ca-bundle/. Node needs --use-openssl-ca to stop using its
|
|
# built-in roots; requests would otherwise use certifi.
|
|
- name: NODE_OPTIONS
|
|
value: --use-openssl-ca
|
|
- name: SSL_CERT_FILE
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
- name: REQUESTS_CA_BUNDLE
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
image: pluja/whishper:latest
|
|
name: whishper
|
|
ports:
|
|
- containerPort: 80
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- mountPath: /app/uploads
|
|
name: whishper-claim0
|
|
- mountPath: /var/log/whishper
|
|
name: whishper-claim1
|
|
- mountPath: /etc/ssl/certs
|
|
name: patched-ca-bundle
|
|
readOnly: true
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|
|
- name: whishper-claim0
|
|
persistentVolumeClaim:
|
|
claimName: whishper-claim0
|
|
- name: whishper-claim1
|
|
persistentVolumeClaim:
|
|
claimName: whishper-claim1
|