ironic.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ironic
spec:
  replicas: 1
  minReadySeconds: 10
  strategy:
    # We cannot run Ironic with more than one replica at a time. The recreate
    # strategy makes sure that the old pod is gone before a new is started.
    type: Recreate
  selector:
    matchLabels:
      name: ironic
  template:
    metadata:
      labels:
        name: ironic
    spec:
      hostNetwork: true
      containers:
      - name: ironic-dnsmasq
        image: quay.io/metal3-io/ironic
        imagePullPolicy: Always
        securityContext:
          # Must be true so dnsmasq may get the capabilities via file caps
          # KEP: https://github.com/kubernetes/enhancements/blob/master/keps/sig-security/2763-ambient-capabilities/README.md
          allowPrivilegeEscalation: true
          capabilities:
            drop:
            - ALL
            add:
            - NET_ADMIN
            - NET_BIND_SERVICE
            - NET_RAW
          privileged: false
          runAsUser: 997 # ironic
          runAsGroup: 994 # ironic
        command:
        - /bin/rundnsmasq
        livenessProbe:
          exec:
            command: ["sh", "-c", "ss -lun | grep :67 && ss -lun | grep :69"]
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
          successThreshold: 1
          failureThreshold: 10
        readinessProbe:
          exec:
            command: ["sh", "-c", "ss -lun | grep :67 && ss -lun | grep :69"]
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
          successThreshold: 1
          failureThreshold: 10
        volumeMounts:
        - mountPath: /shared
          name: ironic-data-volume
        envFrom:
        - configMapRef:
            name: ironic-bmo-configmap
      - name: ironic
        image: quay.io/metal3-io/ironic
        imagePullPolicy: Always
        command:
        - /bin/runironic
        livenessProbe:
          exec:
            command: ["/bin/ironic-liveness"]
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
          successThreshold: 1
          failureThreshold: 10
        readinessProbe:
          exec:
            command: ["/bin/ironic-readiness"]
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
          successThreshold: 1
          failureThreshold: 10
        volumeMounts:
        - mountPath: /shared
          name: ironic-data-volume
        envFrom:
        - configMapRef:
            name: ironic-bmo-configmap
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          runAsUser: 997 # ironic
          runAsGroup: 994 # ironic
      - name: ironic-log-watch
        image: quay.io/metal3-io/ironic
        imagePullPolicy: Always
        command:
        - /bin/runlogwatch.sh
        volumeMounts:
        - mountPath: /shared
          name: ironic-data-volume
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          runAsUser: 997 # ironic
          runAsGroup: 994 # ironic
      - name: ironic-httpd
        image: quay.io/metal3-io/ironic
        imagePullPolicy: Always
        command:
        - /bin/runhttpd
        livenessProbe:
          exec:
            command: ["sh", "-c", "curl -sSfk http://127.0.0.1:6180/images"]
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
          successThreshold: 1
          failureThreshold: 10
        readinessProbe:
          exec:
            command: ["sh", "-c", "curl -sSfk http://127.0.0.1:6180/images"]
          initialDelaySeconds: 30
          periodSeconds: 30
          timeoutSeconds: 10
          successThreshold: 1
          failureThreshold: 10
        volumeMounts:
        - mountPath: /shared
          name: ironic-data-volume
        envFrom:
        - configMapRef:
            name: ironic-bmo-configmap
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          runAsUser: 997 # ironic
          runAsGroup: 994 # ironic
      initContainers:
      - name: ironic-ipa-downloader
        image: quay.io/metal3-io/ironic-ipa-downloader
        imagePullPolicy: Always
        command:
        - /usr/local/bin/get-resource.sh
        envFrom:
        - configMapRef:
            name: ironic-bmo-configmap
        volumeMounts:
        - mountPath: /shared
          name: ironic-data-volume
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          runAsUser: 997 # ironic
          runAsGroup: 994 # ironic
      volumes:
      - name: ironic-data-volume
        emptyDir: {}
      securityContext:
        runAsNonRoot: true
        seccompProfile:
          type: RuntimeDefault
        fsGroup: 994