b1cf89051a
This adds a previous version of the CRL sync functionality back to the repo, with some small adjustments. We now grab the CRLs directly from their DISA URLs. The CRL sync is handled by a kubernetes cronjob that sync the files to a persistent volume that is mounted into each Flask app container.
47 lines
924 B
YAML
47 lines
924 B
YAML
kind: StorageClass
|
|
apiVersion: storage.k8s.io/v1
|
|
metadata:
|
|
name: azurefile
|
|
provisioner: kubernetes.io/azure-file
|
|
mountOptions:
|
|
- dir_mode=0777
|
|
- file_mode=0777
|
|
- uid=1000
|
|
- gid=1000
|
|
parameters:
|
|
skuName: Standard_LRS
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: system:azure-cloud-provider
|
|
rules:
|
|
- apiGroups: ['']
|
|
resources: ['secrets']
|
|
verbs: ['get','create']
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: system:azure-cloud-provider
|
|
roleRef:
|
|
kind: ClusterRole
|
|
apiGroup: rbac.authorization.k8s.io
|
|
name: system:azure-cloud-provider
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: persistent-volume-binder
|
|
namespace: kube-system
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: crls-vol-claim
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteMany
|
|
storageClassName: azurefile
|
|
resources:
|
|
requests:
|
|
storage: 1Gi
|