tikka/oracle/k8s/examples/gcp-kms-deployment.yaml at master · AdeMi20/tikka · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
# Example Kubernetes deployment using Google Cloud KMS with Workload Identity

apiVersion: v1
kind: ServiceAccount
metadata:
  name: oracle-service
  namespace: production
  annotations:
    # Workload Identity: Associate GCP service account
    iam.gke.io/gcp-service-account: oracle-signer@my-project.iam.gserviceaccount.com

---
apiVersion: v1
kind: Secret
metadata:
  name: oracle-kms-config
  namespace: production
type: Opaque
stringData:
  key-provider: "gcp-kms"
  gcp-project-id: "my-project"
  gcp-location-id: "global"
  gcp-key-ring-id: "oracle-keys"
  gcp-key-id: "oracle-signing-key"
  gcp-key-version: "1"

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: oracle
  namespace: production
  labels:
    app: oracle
    version: v1
spec:
  replicas: 2
  selector:
    matchLabels:
      app: oracle
  template:
    metadata:
      labels:
        app: oracle
        version: v1
    spec:
      serviceAccountName: oracle-service

      containers:
      - name: oracle
        image: your-registry/oracle:latest
        imagePullPolicy: Always

        env:
        # Key provider configuration
        - name: KEY_PROVIDER
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: key-provider

        - name: GCP_PROJECT_ID
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: gcp-project-id

        - name: GCP_LOCATION_ID
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: gcp-location-id

        - name: GCP_KEY_RING_ID
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: gcp-key-ring-id

        - name: GCP_KEY_ID
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: gcp-key-id

        - name: GCP_KEY_VERSION
          valueFrom:
            secretKeyRef:
              name: oracle-kms-config
              key: gcp-key-version

        # Other oracle configuration
        - name: SOROBAN_RPC_URL
          value: "https://soroban-mainnet.stellar.org"

        - name: RAFFLE_CONTRACT_ID
          valueFrom:
            configMapKeyRef:
              name: oracle-config
              key: contract-id

        ports:
        - name: http
          containerPort: 3000
          protocol: TCP

        livenessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 30
          periodSeconds: 10

        readinessProbe:
          httpGet:
            path: /health
            port: http
          initialDelaySeconds: 10
          periodSeconds: 5

        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"

        securityContext:
          runAsNonRoot: true
          runAsUser: 1000
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL

---
# Workload Identity Binding (create separately in GCP)
# gcloud iam service-accounts add-iam-policy-binding \
#   oracle-signer@my-project.iam.gserviceaccount.com \
#   --role roles/iam.workloadIdentityUser \
#   --member "serviceAccount:my-project.svc.id.goog[production/oracle-service]"