helm-charts-hardened/examples/federation/server-pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: server
  labels:
    app.kubernetes.io/name: server
spec:
  containers:
  - name: nginx
    image: nginx
    command:
    - /bin/sh
    - -c
    - |
      cat > /etc/nginx/conf.d/default.conf <<EOF
      server {
          listen       127.0.0.1:8080;
          server_name  localhost;
          location / {
              root   /usr/share/nginx/html;
              index  index.html index.htm;
          }
      }
      EOF
      echo Hi there > /usr/share/nginx/html/index.html
      exec nginx -g "daemon off;"
  - name: ghostunnel
    image: ghostunnel/ghostunnel:v1.7.2
    command:
    - ghostunnel
    - server
    - --use-workload-api-addr
    - unix:/spire-workload-api/spire-agent.sock
    - --listen
    - 0.0.0.0:8443
    - --target
    - localhost:8080
    - --allow-uri
    - spiffe://a-org.local/ns/default/sa/default
    volumeMounts:
    - name: agent
      mountPath: /spire-workload-api
      readOnly: true
    ports:
    - containerPort: 8443
  volumes:
  - name: agent
    csi:
      driver: b.csi.spiffe.io
      readOnly: true