hyperlight-on-kubernetes/deploy/manifests/examples/deployment-kvm.yaml at main · hyperlight-dev/hyperlight-on-kubernetes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
---
# Example Deployment using Hyperlight with KVM
# Demonstrates production-ready security hardening
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hyperlight-app-kvm
  namespace: default
  labels:
    app.kubernetes.io/name: hyperlight-app
    hyperlight.dev/hypervisor: kvm
spec:
  replicas: 2
  selector:
    matchLabels:
      app.kubernetes.io/name: hyperlight-app
      hyperlight.dev/hypervisor: kvm
  template:
    metadata:
      labels:
        app.kubernetes.io/name: hyperlight-app
        hyperlight.dev/hypervisor: kvm
    spec:
      nodeSelector:
        hyperlight.dev/hypervisor: kvm
      # Disable K8s API access
      automountServiceAccountToken: false
      # Explicitly disable host namespaces
      hostNetwork: false
      hostPID: false
      hostIPC: false
      securityContext:
        runAsNonRoot: true
        runAsUser: 65534
        runAsGroup: 65534
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: app
          image: your-hyperlight-app:latest  # Replace with your image
          resources:
            limits:
              hyperlight.dev/hypervisor: "1"
              memory: "256Mi"
              cpu: "500m"
            requests:
              memory: "128Mi"
              cpu: "100m"
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            procMount: Default
            capabilities:
              drop:
                - ALL