tikka/oracle/k8s/examples/aws-kms-deployment.yaml at master · AdeMi20/tikka · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
# Example Kubernetes deployment using AWS KMS with IRSA
# (IAM Roles for Service Accounts)

apiVersion: v1
kind: ServiceAccount
metadata:
  name: oracle-service
  namespace: production
  annotations:
    # IRSA: Associate IAM role with service account
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/oracle-kms-role

---
apiVersion: v1
kind: Secret
metadata:
  name: oracle-kms-config
  namespace: production
type: Opaque
stringData:
  key-provider: "aws-kms"
  aws-region: "us-east-1"
  # Store KMS key ID in secret for easy rotation
  aws-kms-key-id: "arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012"

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: oracle
  namespace: production
  labels:
    app: oracle
    version: v1
spec:
  replicas: 2
  selector:
    matchLabels:
      app: oracle
  template:
    metadata:
      labels:
        app: oracle
        version: v1
    spec:
      serviceAccountName: oracle-service

      containers:
      - name: oracle
        image: your-registry/oracle:latest
        imagePullPolicy: Always

        env:
        # Key provider configuration
        - name: KEY_PROVIDER
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: key-provider

        - name: AWS_REGION
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: aws-region

        - name: AWS_KMS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: aws-kms-key-id

        # Other oracle configuration
        - name: SOROBAN_RPC_URL
          value: "https://soroban-mainnet.stellar.org"

        - name: RAFFLE_CONTRACT_ID
          valueFrom:
            configMapKeyRef:
              name: oracle-config
              key: contract-id

        ports:
        - name: http
          containerPort: 3000
          protocol: TCP

        livenessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 30
          periodSeconds: 10

        readinessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 10
          periodSeconds: 5

        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"

        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL

---
# IAM Role Trust Policy (create separately in AWS)
# {
#   "Version": "2012-10-17",
#   "Statement": [
#     {
#       "Effect": "Allow",
#       "Principal": {
#         "Federated": "arn:aws:iam::123456789012:oidc-provider/oidc.eks.REGION.amazonaws.com/id/CLUSTER_ID"
#       },
#       "Action": "sts:AssumeRoleWithWebIdentity",
#       "Condition": {
#         "StringEquals": {
#           "oidc.eks.REGION.amazonaws.com/id/CLUSTER_ID:sub": "system:serviceaccount:production:oracle-service"
#         }
#       }
#     }
#   ]
# }