akka-cluster-443.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: appka
  name: appka
  namespace: default
spec:
  replicas: 3
  selector:
    matchLabels:
      app: appka
  template:
    metadata:
      annotations:
        traffic.sidecar.istio.io/excludeOutboundPorts: "2552, 8558, 443"
        traffic.sidecar.istio.io/excludeInboundPorts: "2552, 8558"
      labels:
        app: appka
        actorSystemName: appka
    spec:
      containers:
      - name: appka
        image: lightbend/akka-sample-cluster-kubernetes:latest
        imagePullPolicy: Always
        readinessProbe:
          httpGet:
            path: /ready
            port: management
          periodSeconds: 10
          failureThreshold: 3
          initialDelaySeconds: 10
        livenessProbe:
          httpGet:
            path: "/alive"
            port: management
          periodSeconds: 10
          failureThreshold: 5
          initialDelaySeconds: 20
        ports:
        # akka-management and bootstrap
        - name: management
          containerPort: 8558
          protocol: TCP
        - name: akka
          containerPort: 2552
          protocol: TCP
        - name: http
          containerPort: 8080
          protocol: TCP
        env:
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: REQUIRED_CONTACT_POINT_NR
          value: "1"
        - name: REMOTING_PORT
          value: "2552"
        - name: MANAGEMENT_PORT
          value: "8558"
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
# Note the `name` line below. The first default refers to the namespace. The second refers to the service account name.
# For instance, `name: system:serviceaccount:myns:default` would refer to the default service account in namespace `myns`
- kind: User
  name: system:serviceaccount:default:default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io