138 lines
3.6 KiB
YAML
138 lines
3.6 KiB
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: coturn
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: coturn
|
|
app.kubernetes.io/instance: coturn
|
|
automountServiceAccountToken: false
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: coturn
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: coturn
|
|
app.kubernetes.io/instance: coturn
|
|
app.kubernetes.io/version: {{ .Values.image.tag | quote }}
|
|
spec:
|
|
replicas: 1
|
|
revisionHistoryLimit: 3
|
|
strategy:
|
|
type: Recreate
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: coturn
|
|
app.kubernetes.io/instance: coturn
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: coturn
|
|
app.kubernetes.io/instance: coturn
|
|
spec:
|
|
serviceAccountName: coturn
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- name: coturn
|
|
image: {{ printf "%s:%s" .Values.image.repository .Values.image.tag }}
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- --listening-port=3478
|
|
- --tls-listening-port=5349
|
|
- --fingerprint
|
|
- --cert=/etc/ssl/certs/cert.pem
|
|
- --pkey=/etc/ssl/private/privkey.pem
|
|
- --realm={{ .Values.realm }}
|
|
- --log-file=stdout
|
|
- --no-software-attribute
|
|
- --no-cli
|
|
- --use-auth-secret
|
|
- --static-auth-secret=$(TURN_SHARED_SECRET)
|
|
- --external-ip={{ .Values.externalIP }}
|
|
- --min-port={{ .Values.relay.minPort }}
|
|
- --max-port={{ .Values.relay.maxPort }}
|
|
- --no-multicast-peers
|
|
env:
|
|
- name: TURN_SHARED_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ .Values.sharedSecret.name }}
|
|
key: {{ .Values.sharedSecret.key }}
|
|
ports:
|
|
- name: tcp
|
|
containerPort: 3478
|
|
protocol: TCP
|
|
- name: udp
|
|
containerPort: 3478
|
|
protocol: UDP
|
|
- name: tcp-tls
|
|
containerPort: 5349
|
|
protocol: TCP
|
|
- name: udp-tls
|
|
containerPort: 5349
|
|
protocol: UDP
|
|
readinessProbe:
|
|
tcpSocket:
|
|
port: tcp
|
|
livenessProbe:
|
|
tcpSocket:
|
|
port: tcp
|
|
initialDelaySeconds: 30
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 50Mi
|
|
limits:
|
|
cpu: 100m
|
|
memory: 50Mi
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
add: [NET_BIND_SERVICE]
|
|
drop: [ALL]
|
|
readOnlyRootFilesystem: true
|
|
runAsNonRoot: true
|
|
runAsUser: 65534
|
|
volumeMounts:
|
|
- name: certs
|
|
mountPath: /etc/ssl/certs
|
|
readOnly: true
|
|
- name: private
|
|
mountPath: /etc/ssl/private
|
|
readOnly: true
|
|
volumes:
|
|
- name: certs
|
|
secret:
|
|
secretName: {{ .Values.certificate.secretName }}
|
|
items:
|
|
- key: tls.crt
|
|
path: cert.pem
|
|
- name: private
|
|
secret:
|
|
secretName: {{ .Values.certificate.secretName }}
|
|
items:
|
|
- key: tls.key
|
|
path: privkey.pem
|
|
---
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: coturn
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app.kubernetes.io/name: coturn
|
|
app.kubernetes.io/instance: coturn
|
|
spec:
|
|
secretName: {{ .Values.certificate.secretName }}
|
|
dnsNames:
|
|
- {{ .Values.certificate.dnsName }}
|
|
issuerRef:
|
|
group: cert-manager.io
|
|
kind: ClusterIssuer
|
|
name: {{ .Values.certificate.issuerName }}
|
|
usages:
|
|
- digital signature
|
|
- key encipherment
|