Further auth and authz configuration

k8s/deployment.yaml

@@ -95,3 +95,108 @@ metadata:
   name: notifier
   labels:
     app: notifier
+---
+# Example deployment with API key authentication and Kubernetes bootstrap enabled
+# Uncomment and apply this deployment instead of the one above to enable auth
+#
+# apiVersion: apps/v1
+# kind: Deployment
+# metadata:
+#   name: notifier-with-auth
+#   labels:
+#     app: notifier
+#     version: v1
+# spec:
+#   replicas: 3
+#   selector:
+#     matchLabels:
+#       app: notifier
+#   template:
+#     metadata:
+#       labels:
+#         app: notifier
+#         version: v1
+#     spec:
+#       serviceAccountName: notifier
+#       containers:
+#       - name: notifier
+#         image: notifier:latest
+#         imagePullPolicy: Always
+#         ports:
+#         - name: rest
+#           containerPort: 8080
+#           protocol: TCP
+#         - name: grpc
+#           containerPort: 50051
+#           protocol: TCP
+#         - name: metrics
+#           containerPort: 9090
+#           protocol: TCP
+#         - name: health
+#           containerPort: 8081
+#           protocol: TCP
+#         env:
+#         - name: NOTIFIER_SERVER_MODE
+#           value: "both"
+#         - name: NOTIFIER_LOGGING_LEVEL
+#           value: "info"
+#         - name: NOTIFIER_LOGGING_FORMAT
+#           value: "json"
+#         - name: NOTIFIER_QUEUE_TYPE
+#           value: "local"
+#         # Optional: set auth config via environment variables instead of config.yaml
+#         # - name: NOTIFIER_AUTH_ENABLED
+#         #   value: "true"
+#         # - name: NOTIFIER_AUTH_DEFAULT_RATE_LIMIT
+#         #   value: "100"
+#         # - name: NOTIFIER_AUTH_BOOTSTRAP_ENABLED
+#         #   value: "true"
+#         # - name: NOTIFIER_AUTH_BOOTSTRAP_KUBERNETES_SECRET_NAME
+#         #   value: "notifier-admin-key"
+#         # - name: NOTIFIER_AUTH_BOOTSTRAP_KUBERNETES_SECRET_KEY
+#         #   value: "admin-key"
+#         volumeMounts:
+#         - name: config
+#           mountPath: /app/config.yaml
+#           subPath: config.yaml
+#           readOnly: true
+#         - name: queue-storage
+#           mountPath: /var/lib/notifier
+#         resources:
+#           requests:
+#             cpu: 100m
+#             memory: 128Mi
+#           limits:
+#             cpu: 500m
+#             memory: 512Mi
+#         livenessProbe:
+#           httpGet:
+#             path: /health
+#             port: health
+#           initialDelaySeconds: 30
+#           periodSeconds: 10
+#           timeoutSeconds: 5
+#           failureThreshold: 3
+#         readinessProbe:
+#           httpGet:
+#             path: /health
+#             port: health
+#           initialDelaySeconds: 10
+#           periodSeconds: 5
+#           timeoutSeconds: 3
+#           failureThreshold: 3
+#         securityContext:
+#           runAsNonRoot: true
+#           runAsUser: 1000
+#           allowPrivilegeEscalation: false
+#           readOnlyRootFilesystem: false
+#           capabilities:
+#             drop:
+#             - ALL
+#       volumes:
+#       - name: config
+#         configMap:
+#           name: notifier-config
+#       - name: queue-storage
+#         emptyDir: {}
+#       restartPolicy: Always