Add example of mysql using spire (#164)

* Add example of mysql using spire Signed-off-by: Kevin Fox <[email protected]> * Finish up the implementation Signed-off-by: Kevin Fox <[email protected]> * Update the image Signed-off-by: Kevin Fox <[email protected]> * Apply suggestions from code review Signed-off-by: kfox1111 <[email protected]> * Update. Restested. Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]> Signed-off-by: kfox1111 <[email protected]>
2024-02-05 11:17:19 -08:00
parent 350ec89ff2
commit fce95cb443
5 changed files with 262 additions and 0 deletions
@@ -0,0 +1,78 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mysqlclient
+spec:
+  replicas: 1
+  #serviceName: mysqlclient
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: mysqlclient
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: mysqlclient
+    spec:
+      terminationGracePeriodSeconds: 0
+      initContainers:
+      - name: init-tls
+        image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
+        imagePullPolicy: Always
+        command:
+        - /spiffe-helper
+        - -config
+        - /etc/spiffe-helper.conf
+        - -exitWhenReady
+        securityContext:
+          runAsUser: 1001
+          runAsGroup: 1001
+        volumeMounts:
+        - name: spiffe-workload-api
+          mountPath: /spiffe-workload-api
+          readOnly: true
+        - name: spiffe-helper-configmap
+          mountPath: /etc/spiffe-helper.conf
+          subPath: spiffe-helper.conf
+          readOnly: true
+        - name: certdir
+          mountPath: /certs
+      containers:
+      - name: main
+        image: docker.io/bitnami/mysql:8.0.35-debian-11-r0
+        command: [sleep, inf]
+        securityContext:
+          runAsUser: 1001
+          runAsGroup: 1001
+        volumeMounts:
+        - name: certdir
+          mountPath: /certs
+      - name: refresh-tls
+        image: ghcr.io/spiffe/spiffe-helper:nightly@sha256:8cee346ffdcee5c996d394f1c3bb761c2c06834a0e779a78db6dc6a46fd13ae6
+        imagePullPolicy: Always
+        command:
+        - /spiffe-helper
+        - -config
+        - /etc/spiffe-helper.conf
+        securityContext:
+          runAsUser: 1001
+          runAsGroup: 1001
+        volumeMounts:
+        - name: spiffe-workload-api
+          mountPath: /spiffe-workload-api
+          readOnly: true
+        - name: spiffe-helper-configmap
+          mountPath: /etc/spiffe-helper.conf
+          subPath: spiffe-helper.conf
+          readOnly: true
+        - name: certdir
+          mountPath: /certs
+      volumes:
+      - name: certdir
+        emptyDir: {}
+      - name: spiffe-helper-configmap
+        configMap:
+          name: mysqlclient
+      - name: spiffe-workload-api
+        csi:
+          driver: "csi.spiffe.io"
+          readOnly: true