Setting the file. One moment. templates/k8s/deployment.yaml
templates/k8s/deployment.yaml
YAML·112 lines·3 KB
12 # If HPA is enabled, remove this field or set it to the HPA minReplicas value
13 # to prevent kubectl apply from resetting the replica count on each deploy.
14 replicas: 2
15 selector:
16 matchLabels:
17 app: <app-name>
18 strategy:
19 type: RollingUpdate
20 rollingUpdate:
21 maxSurge: 1
22 maxUnavailable: 0
23 template:
24 metadata:
25 labels:
26 app: <app-name>
27 # Workload Identity: enables the mutating webhook to inject
28 # AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_FEDERATED_TOKEN_FILE
29 azure.workload.identity/use: "true"
30 spec:
31 serviceAccountName: <app-name>
32
33 # DS013: Do not auto-mount the default ServiceAccount token.
34 # Workload Identity uses a separate projected volume managed by its webhook.
35 automountServiceAccountToken: false
36
37 # DS004 (pod-level): Run as non-root
38 securityContext:
39 runAsNonRoot: true
40 runAsUser: 1000
41 runAsGroup: 1000
42 fsGroup: 1000
43 seccompProfile:
44 type: RuntimeDefault
45
46 containers:
47 - name: <app-name>
48 # DS009: Always use an explicit tag — never :latest or bare image
49 image: <image>
50 ports:
51 - name: http
52 containerPort: <port>
53 protocol: TCP
54
55 # DS001: Resource requests AND limits for cpu and memory
56 resources:
57 requests:
58 cpu: "<cpu-request>"
59 memory: "<memory-request>"
60 limits:
61 cpu: "<cpu-limit>"
62 memory: "<memory-limit>"
63
64 # DS002: Liveness probe
65 livenessProbe:
66 httpGet:
67 path: <health-path>
68 port: <port>
69 initialDelaySeconds: 10
70 periodSeconds: 15
71 timeoutSeconds: 3
72 failureThreshold: 3
73
74 # DS003: Readiness probe
75 readinessProbe:
76 httpGet:
77 path: <ready-path>
78 port: <port>
79 initialDelaySeconds: 5
80 periodSeconds: 10
81 timeoutSeconds: 3
82 failureThreshold: 3
83
84 # Startup probe — uncomment for slow-start frameworks (Java/Spring Boot,
85 # .NET with heavy DI). Prevents the liveness probe from killing the pod
86 # before it finishes initializing. The pod has up to 30 * 10s = 300s to start.
87 # startupProbe:
88 # httpGet:
89 # path: <health-path>
90 # port: <port>
91 # periodSeconds: 10
92 # failureThreshold: 30
93
94 # DS004, DS008, DS011, DS012
95 securityContext:
96 runAsNonRoot: true
97 privileged: false
98 allowPrivilegeEscalation: false
99 readOnlyRootFilesystem: true
100 capabilities:
101 drop:
102 - ALL
103
104 # If the app needs to write to specific paths (logs, tmp, cache),
105 # mount emptyDir volumes below instead of disabling readOnlyRootFilesystem.
106 volumeMounts:
107 - name: tmp
108 mountPath: /tmp
109
110 volumes:
111 - name: tmp
112 emptyDir: {}