ziti-sidecar-tproxy.yaml

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: tunnel-sidecar-pv-claim
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 100Mi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ziti-tunnel-sidecar-demo
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ziti-tunnel-sidecar-demo
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: ziti-tunnel-sidecar-demo
    spec:
      containers:
      - image: centos
        name: testclient
        command: ["sh","-c","while true; set -x; do curl -sSf http://echo.netfoundry 2>&1; set +x; sleep 5; done"]
      - image: netfoundry/ziti-tunnel:latest
        name: ziti-tunnel
        env:
        - name: NF_REG_NAME
          value: tunnel-sidecar
        - name: PFXLOG_NO_JSON
          value: "true"
        volumeMounts:
        - name: tunnel-sidecar-jwt
          mountPath: "/var/run/secrets/kubernetes.io/enrollment-token"
          readOnly: true
        - name: ziti-tunnel-persistent-storage
          mountPath: /netfoundry
        # - name: lib-modules
        #   mountPath: /lib/modules
        #   readOnly: true
        securityContext:
          # privileged: true
          capabilities:
            add:
            # - ALL
            #- NET_RAW
            - NET_ADMIN
            # - SYS_ADMIN
            # - SYS_MODULE
      nodeSelector:
        kubernetes.io/hostname: ip-10-0-190-53
      dnsPolicy: "None"
      dnsConfig:
        nameservers:
        - 127.0.0.1
        - 8.8.8.8
      restartPolicy: Always
      volumes:
      - name: ziti-tunnel-persistent-storage
        persistentVolumeClaim:
          claimName: tunnel-sidecar-pv-claim
      - name: tunnel-sidecar-jwt
        secret:
          secretName: tunnel-sidecar.jwt
      # - name: lib-modules
      #   hostPath:
      #     path: /lib/modules