zero: add kustomize #4
Conversation
| - name: pomerium | ||
| env: | ||
| - name: TMPDIR | ||
| value: "/tmp/pomerium" |
There was a problem hiding this comment.
Could you add a comment explaining the purpose of each tmp folder? Having multiple makes the structure unclear.
There was a problem hiding this comment.
various parts of stdlib and other libraries we use make use of TMPDIR and XDG_CACHE
| runAsGroup: 1000 | ||
| runAsUser: 1000 | ||
| sysctls: | ||
| - name: net.ipv4.ip_unprivileged_port_start |
There was a problem hiding this comment.
Would it make sense to include port 443 here as well? Consider adding a comment explaining why certain ports are prioritized.
| spec: | ||
| containers: | ||
| - name: pomerium | ||
| resources: |
There was a problem hiding this comment.
Could you provide additional context on these resources? A comment explaining their purpose and how they’re used here and why they are the defaults would be helpful.
| containers: | ||
| - name: pomerium | ||
| securityContext: | ||
| readOnlyRootFilesystem: true |
There was a problem hiding this comment.
Consider adding a comment explaining why this is important for security
| containerPort: 80 | ||
| protocol: TCP | ||
| - name: metrics | ||
| containerPort: 9090 |
There was a problem hiding this comment.
consider explaining what each port is for (especially 80 and 9090 being for redirect and metrics)
| automountServiceAccountToken: true | ||
| serviceAccountName: pomerium-zero | ||
| containers: | ||
| - name: pomerium |
There was a problem hiding this comment.
| - name: pomerium | |
| - name: pomerium | |
| readinessProbe: | |
| httpGet: | |
| path: /healthz | |
| port: 80 | |
| initialDelaySeconds: 10 | |
| periodSeconds: 5 | |
| livenessProbe: | |
| httpGet: | |
| path: /healthz | |
| port: 80 | |
| initialDelaySeconds: 15 | |
| periodSeconds: 10 |
Not sure this maps to true readyness /live however....
Co-authored-by: bobby <[email protected]>
Co-authored-by: bobby <[email protected]>
Summary
Adds Kustomization manifests that may be used to install Pomerium Zero directly via
kubectllike:Related issues
Checklist
improvement/bug/ etc)