50 lines
1.9 KiB
YAML
50 lines
1.9 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: auth-server
|
|
spec:
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
vault.hashicorp.com/agent-cache-enable: "true"
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-service-account-token-volume-name: vault-token
|
|
vault.hashicorp.com/agent-inject-secret-runtime-env: kv/data/dev/systems/auth-system/postgres/auth-server
|
|
vault.hashicorp.com/agent-inject-template-runtime-env: |
|
|
{{ with secret "kv/data/dev/systems/auth-system/postgres/auth-server" }}
|
|
export APP_DATASOURCE_USERNAME={{ printf "%q" .Data.data.APP_DATASOURCE_USERNAME }}
|
|
export APP_DATASOURCE_PASSWORD={{ printf "%q" .Data.data.APP_DATASOURCE_PASSWORD }}
|
|
{{ end }}
|
|
|
|
{{ with secret "kv/data/dev/workloads/auth-server/keycloak-client" }}
|
|
export APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET={{ printf "%q" .Data.data.APP_SECURITY_OAUTH2_KEYCLOAK_CLIENT_SECRET }}
|
|
{{ end }}
|
|
vault.hashicorp.com/agent-inject-token: "true"
|
|
vault.hashicorp.com/agent-run-as-group: "10001"
|
|
vault.hashicorp.com/agent-run-as-user: "10001"
|
|
vault.hashicorp.com/role: auth-server-dev
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
volumes:
|
|
- name: vault-token
|
|
projected:
|
|
defaultMode: 0444
|
|
sources:
|
|
- serviceAccountToken:
|
|
audience: vault
|
|
expirationSeconds: 3600
|
|
path: token
|
|
containers:
|
|
- name: auth-server
|
|
command:
|
|
- /bin/sh
|
|
- -ec
|
|
args:
|
|
- |
|
|
. /vault/secrets/runtime-env
|
|
export APP_SECURITY_JWT_VAULT_TOKEN="$(cat /vault/secrets/token)"
|
|
exec java -jar /app/application.jar
|
|
envFrom:
|
|
- configMapRef:
|
|
name: auth-server-config
|