mysql-client.yaml

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: mysql-client
  name: mysql-client
spec:
  serviceName: mysql-client
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: mysql-client
  template:
    metadata:
      labels:
        app: mysql-client
    spec:
      containers:
      - image: mtr.devops.telekom.de/mcsps/mysql-client:0.0.5
        imagePullPolicy: Always
        command: ['sh', '-c']
        args: ["tail -f /dev/null"]
        name: mysql-client
        resources:
          limits:
            cpu: 100m
            memory: 128Mi
          requests:
            cpu: 100m
            memory: 128Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          privileged: false
          readOnlyRootFilesystem: true
          runAsUser: 1000
          runAsGroup: 1000
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - name: workdir
          mountPath: /home/appuser
        - name: tmp
          mountPath: /tmp
      dnsPolicy: ClusterFirst
      hostNetwork: false
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext:
        fsGroup: 1000
        runAsNonRoot: true
        supplementalGroups:
        - 1000
      terminationGracePeriodSeconds: 3
      serviceAccountName: mysql-client
      volumes:
      - name: workdir
        emptyDir: {}
      - name: tmp
        emptyDir:
          medium: Memory
---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app: mysql-client
  name: mysql-client
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  labels:
    app: mysql-client
  name: mysql-client
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app: mysql-client
  name: mysql-client
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mysql-client
subjects:
  - kind: ServiceAccount
    name: mysql-client
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  annotations:
  name: np-mysql-client
spec:
  egress:
  - ports:
    - port: 3306
      protocol: TCP
    - port: 443
      protocol: TCP
    - port: 53
      protocol: TCP
    - port: 53
      protocol: UDP
  podSelector:
    matchLabels:
      app: mysql-client
  policyTypes:
  - Egress