tuf.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tuf
  namespace: tuf-system
  labels:
    app.kubernetes.io/component: tuf
    app.kubernetes.io/instance: scaffold
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: tuf
    helm.sh/chart: tuf-0.1.4
spec:
  replicas: 1
  selector:
    matchLabels:
      app: tuf
  template:
    metadata:
      labels:
        app: tuf
        app.kubernetes.io/component: tuf
        app.kubernetes.io/instance: scaffold
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/name: tuf
        helm.sh/chart: tuf-0.1.4
    spec:
      containers:
        - name: tuf
          image: {{ tuf_image }}
          # image: ghcr.io/sigstore/scaffolding/server@sha256:719ea3fe44c52af5a5fedab2168429872e37e97b9f063977fc164d60a5a14b53
          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8082
              protocol: TCP
              hostPart: 8082
          env:
            - name: NAMESPACE
              value: tuf-system
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /var/run/tuf-secrets
              name: tuf-secrets
              readOnly: true
      dnsPolicy: ClusterFirst
      enableServiceLinks: true
      securityContext: {}
      serviceAccountName: tuf
      tolerations:
        - effect: NoExecute
          key: node.kubernetes.io/not-ready
          operator: Exists
          tolerationSeconds: 300
        - effect: NoExecute
          key: node.kubernetes.io/unreachable
          operator: Exists
          tolerationSeconds: 300
      volumes:
        - name: tuf-secrets
          secret:
            secretName: tuf-secret