rollout.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: jarvis
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jarvis
  template:
    metadata:
      labels:
        app: jarvis
    spec:
      nodeSelector:
        "kubernetes.io/os": linux
      containers:
      - name: jarvis
        image: ghcr.io/joshspicer/jarvis:latest
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 250m
            memory: 256Mi
        ports:
        - containerPort: 80
        volumeMounts:
        - name: secrets-store01-inline
          mountPath: "/mnt/secrets-store"
          readOnly: true
        env:
        - name: PORT
          value: "80"
        - name: GIN_MODE
          value: "release"
        - name: TELEGRAM_BOT_TOKEN
          valueFrom:
            secretKeyRef:
              name: env-secrets
              key: TelegramBotToken
        - name: VALID_TELEGRAM_SENDERS
          valueFrom:
            secretKeyRef:
              name: env-secrets
              key: ValidTelegramSenders
        - name: VALID_TELEGRAM_GROUPS
          valueFrom:
            secretKeyRef:
              name: env-secrets
              key: ValidTelegramGroups
        - name: TRUSTED_ACTORS
          valueFrom:
            secretKeyRef:
              name: env-secrets
              key: TrustedActors
      volumes:
        - name: secrets-store01-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "azure-jarviskv-secrets"
---
apiVersion: v1
kind: Service
metadata:
  name: jarvis
spec:
  type: ClusterIP
  ports:
  - port: 80
  selector:
    app: jarvis
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: azure-jarviskv-secrets
spec:
  provider: azure
  parameters:
    usePodIdentity: "false"
    useVMManagedIdentity: "true"                                   # Set to true for using managed identity
    userAssignedIdentityID: 334bf547-5989-4300-be4d-ed7a90894a03   # Set the clientID of the user-assigned managed identity to use
    keyvaultName: secret-store-5h7SuPk389                          # Set to the name of your key vault
    objects:  |
      array:
        - |
          objectName: TelegramBotToken
          objectType: secret
        - |
          objectName: ValidTelegramSenders
          objectType: secret
        - |
          objectName: ValidTelegramGroups
          objectType: secret
        - |
          objectName: TrustedActors
          objectType: secret
    tenantId: 0ad1a6ca-bf0b-4eea-b39d-a0a369403977   # The tenant ID of the key vault
  secretObjects:
  - data:
    - key: TelegramBotToken                           # data field to populate
      objectName: TelegramBotToken                    # name of the mounted content to sync; this could be the object name or the object alias
    - key: ValidTelegramSenders
      objectName: ValidTelegramSenders
    - key: ValidTelegramGroups
      objectName: ValidTelegramGroups
    - key: TrustedActors
      objectName: TrustedActors
    secretName: env-secrets
    type: Opaque
---
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: jarvis@spicer.dev
    privateKeySecretRef:
      name: letsencrypt
    solvers:
    - http01:
        ingress:
          class: nginx
          podTemplate:
            spec:
              nodeSelector:
                "kubernetes.io/os": linux
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jarvis-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/limit-rpm: "5"
    nginx.ingress.kubernetes.io/limit-rps: "2"
    nginx.ingress.kubernetes.io/limit-burst-multiplier: "1"
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  ingressClassName: nginx
  rules:
  - host: jarvis.spicer.dev
    http:
      paths:
      - pathType: Prefix
        backend:
          service:
            name: jarvis
            port:
              number: 80
        path: /(.*)
  tls:
  - hosts:
    - jarvis.spicer.dev
    secretName: tls-secret