-
-
Notifications
You must be signed in to change notification settings - Fork 367
/
secret-challenge-deployment.yml
108 lines (108 loc) · 3.22 KB
/
secret-challenge-deployment.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: secret-challenge
name: secret-challenge
namespace: $OKTETO_NAMESPACE
spec:
progressDeadlineSeconds: 600
replicas: 1
revisionHistoryLimit: 10
selector:
matchLabels:
app: secret-challenge
strategy:
rollingUpdate:
maxSurge: 25%
maxUnavailable: 25%
type: RollingUpdate
template:
metadata:
labels:
app: secret-challenge
name: secret-challenge
spec:
securityContext:
runAsUser: 2000
runAsGroup: 2000
fsGroup: 2000
containers:
- image: jeroenwillemsen/wrongsecrets:1.9.2-no-vault
name: secret-challenge
imagePullPolicy: IfNotPresent
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
runAsNonRoot: true
capabilities:
drop:
- ALL
seccompProfile:
type: RuntimeDefault
ports:
- containerPort: 8080
protocol: TCP
readinessProbe:
httpGet:
path: "/actuator/health/readiness"
port: 8080
initialDelaySeconds: 30
timeoutSeconds: 5
periodSeconds: 5
failureThreshold: 8
livenessProbe:
httpGet:
path: "/actuator/health/liveness"
port: 8080
initialDelaySeconds: 35
timeoutSeconds: 30
periodSeconds: 40
failureThreshold: 5
resources:
requests:
memory: "512Mi"
cpu: "200m"
ephemeral-storage: "1Gi"
limits:
memory: "512Mi"
cpu: "1000m"
ephemeral-storage: "2Gi"
volumeMounts:
- name: "ephemeral"
mountPath: "/tmp"
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
env:
- name: canarytokenURLs
value: "https://canarytokens.org/history?token=n0cnd92mavmv1m61tjmyj9of5&auth=6519be82ef910868529091527c3edb3f"
- name: challenge15ciphertext
value: "k9+HuPXEiFD6efujS5h1lOL1xgAC2OIgE2alg9Jwe0qQlT+RGDJH/otpFgUzixTbCndwPW3HOqOCQYY844MgxM0N+RRbclS1bpJnYd7BT2aj8v4iA9xR8DwAjU0tt2n84PFKN4vNKjyNATETwPE1GQKBTIi1"
- name: K8S_ENV
value: Okteto(k8s)
- name: SPRINGDOC_UI
value: "true"
- name: SPRINGDOC_DOC
value: "true"
- name: SPECIAL_K8S_SECRET
valueFrom:
configMapKeyRef:
name: secrets-file
key: funny.entry
- name: SPECIAL_SPECIAL_K8S_SECRET
valueFrom:
secretKeyRef:
name: funnystuff
key: funnier
- name: CHALLENGE33
valueFrom:
secretKeyRef:
name: challenge33
key: answer
volumes:
- name: "ephemeral"
emptyDir: {}
dnsPolicy: ClusterFirst
restartPolicy: Always
schedulerName: default-scheduler
terminationGracePeriodSeconds: 30