mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
345055e3e6
Mount patched-ca-bundle (see ca-bundle/) over /etc/ssl/certs so it stops trusting the compromised eMudhra intermediates (https://emudhra.we-have-a-problem.com). Node uses its built-in roots, so also switch it to OpenSSL's store with --use-openssl-ca.
73 lines
2.0 KiB
YAML
73 lines
2.0 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
io.kompose.service: serpbear
|
|
name: serpbear
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
io.kompose.service: serpbear
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
io.kompose.service: serpbear
|
|
spec:
|
|
securityContext:
|
|
fsGroup: 1001
|
|
containers:
|
|
- env:
|
|
- name: USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: serpbear-secrets
|
|
key: user
|
|
- name: PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: serpbear-secrets
|
|
key: password
|
|
- name: SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: serpbear-secrets
|
|
key: secret
|
|
- name: APIKEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: serpbear-secrets
|
|
key: apikey
|
|
- name: NEXT_PUBLIC_APP_URL
|
|
value: https://serpbear.rubenhensen.nl
|
|
- name: TZ
|
|
value: Europe/Amsterdam
|
|
# Node trusts its built-in roots, which still include the ones
|
|
# above the compromised eMudhra intermediates. Use
|
|
# patched-ca-bundle through OpenSSL instead until Node ships a fix.
|
|
- name: NODE_OPTIONS
|
|
value: --use-openssl-ca
|
|
- name: SSL_CERT_FILE
|
|
value: /etc/ssl/certs/ca-certificates.crt
|
|
image: towfiqi/serpbear:3.1.0
|
|
name: serpbear
|
|
ports:
|
|
- containerPort: 3000
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- mountPath: /app/data
|
|
name: data
|
|
- mountPath: /etc/ssl/certs
|
|
name: patched-ca-bundle
|
|
readOnly: true
|
|
restartPolicy: Always
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: data
|
|
- name: patched-ca-bundle
|
|
configMap:
|
|
name: patched-ca-bundle
|