Add quic.yaml

quic.yaml

@@ -0,0 +1,76 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: quic-proxy
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: quic-client-secret
+  namespace: quic-proxy
+type: Opaque
+stringData:
+  token: "5$5O4QjRh#eOaM"
+  ca-cert-b64: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUZVekNDQXp1Z0F3SUJBZ0lVTlhENnExcCtxY1NrMTlhM29hejVHWHVPWFpnd0RRWUpLb1pJaHZjTkFRRUwKQlFBd09URWFNQmdHQTFVRUF3d1JkbmN1YlhKc2IydHZjQzVrWlhZZ1EwRXhEakFNQmdOVkJBb01CVkJ5YjNoNQpNUXN3Q1FZRFZRUUdFd0pWVXpBZUZ3MHlOakF4TVRJeE16STVORFZhRncweU56QXhNVEl4TXpJNU5EVmFNRGt4CkdqQVlCZ05WQkFNTUVYWjNMbTF5Ykc5cmIzQXVaR1YySUVOQk1RNHdEQVlEVlFRS0RBVlFjbTk0ZVRFTE1Ba0cKQTFVRUJoTUNWVk13Z2dJaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQ0R3QXdnZ0lLQW9JQ0FRQzRmMzZsWG1MZQphbXhDc1RPN1RWTXV3a1YybFIzTUpCSFU2TGJOK1R1STZEZHBOVFc3OFBUNndTOFk5S09Ha2pzZGdEcDJ6MVg2CjNVQitiUFlZVTdIRVhqZ05PRzRGdmE2RWt5b0NXbW83azZsSTgwVmM5cUVCb2hZL3d6QWhoMVEveUZ5Vk1DdWEKMVlrekUvRTlVbnIycndoMUVWb3ZJUThkTENpL3I5NDJHcndpK240Zm5CUFhGakdTSUR1dkdPanBKYXo4YlQveApxeGhWV0RUaXR5WWU2NkRvKzNmaC9EbmtPck5RVEJXY0dyaTF2WW84b3pGMzBGVHR1S0RsOWJucEt6TVBiT2dxClJROFNZaGEyc0lJMkZsYUxsMW1mViszWjl1UWZJU2hUM1pZbEJMeGJsc0hLUVQ5WnhYUVY0QVdjV1IxVVVBYnkKblpBdjdWOFdid3pmL1ozRllKelFMYk9kUlZuREIwa3VyR2JKS0RhcHpJSTJJcVNCVTJ6YWhOTi9RTnpPZDZ5QgpmMGZOWWJqWklPOHd2Z3VBRXhUaGRPSVoyM1l0N05NbzU4SFpzTlJVaUtkQ3kyZUdZc2ZXMlhBKy9yZDlsMENLCjNob2IwbWtxY0tyYXMvZGlXekxoa2NNVFhOMG9WZHhTdld2aDB4SFFrUWRGaGdPalJ5OG5ocnRnM3dKbDJXa2kKY2VCVEp4UzdlTiswRU1EYXl0ZVZTZ0N6QW9lTEJmaitCSTdHMDRnWktPMmErVFlqUFFvUC9reXpaQ2d6eXF2YgpZZFZMajBjeFhzcTRtVllxaU5OWTdwRDh6Sjg3MmpFcVlhY2tDL2tpUnBKRFcwalJCVlRjcnpvejZBa1J5VFhYCjBZaXV2bVNTcm1UN0FqdkhneXk4SzlISytOZHo0VVBkbVFJREFRQUJvMU13VVRBZEJnTlZIUTRFRmdRVUpySmwKVWs1a0NxSjMzTGJTNTQ1VC9DUXY3S0V3SHdZRFZSMGpCQmd3Rm9BVUpySmxVazVrQ3FKMzNMYlM1NDVUL0NRdgo3S0V3RHdZRFZSMFRBUUgvQkFVd0F3RUIvekFOQmdrcWhraUc5dzBCQVFzRkFBT0NBZ0VBcWdJenF2WHc3V3plCjVSck5GektnSEtQcGdIdjV0NWQ3V1V3Qy94U3pxUC9Ec0RxaHNMLzRhWmRBWnhrSWZXKzFwMTFDdFRCL1drQWoKZG0raDg0NTlObHJsaFdSaU45QThyQlZYejFLSitGazhTTWdtTEQyejllQldDWUNnL3RnV25qNU05UGU3d0x0UgpxQ3hHNkhSV3daOUZaVWJFb2FoWmF3UUU3eWJ6aGJTZUVJSlhaTDB3RnAweEtlckdhMXRmOG9GelhuNWVlWDlQCmlsSCthRVJuZ0dZYXl2YWM3dHZST25aNkQ3RjQzWkpJNXhiV3FCMTNQM3NZMGZ4R1RKd3RYZmlFQmZxcmU5QlAKNTE4UHRHWldQLzY1U0Z5U2NqK3k0SGRXbExPOXljSHVnQ0U3SXZxQ0FXSm84ZDFzOHFsODRmS2pYcU1Ib0NKVgpzaDBWampDSWh0OUJoZE9PbmFwVTh1MEV1TERFdWw0SWZTVnJCU1kwbHhZT0VReUFjbGQwd005Zy9LZlFONW5XCjBLaWdlZmlSdC9sR3NNM0hlSDNzeDExbGlQNFp6WUhSNjY0YzZNdjNOcTBKNk9xTjFVb1p0cnJOaEI1VVB0UGsKT2lNT1hub21NSEQzeTI4VVQ3OG5nRkpEaDBpMUNSbWRRb2VNelJJcm5yMGNJRmV6UmN3ekVhNWtQZFZUcDRXRApsdGVJTVNmNGxPRFlLb09BUXJzdDBqU2NoUXhKaFI0V1dzQlRLODEra3V1Y096Z1dSaExkMXNPODhidmF5OGdPCjg3NDFuZksyR2MrVUVjRmFpRXBtVTJ1Mi8wUFh4V3cvUCtaNEFwSkJqR1ZhM2RXQWcyd1RDYkhXR01LRWhzcjEKTFdNOUF6MGQwRW9zTngyY3ZHZ0paQnlkUE1nL1p5bz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: quic-client
+  namespace: quic-proxy
+  labels:
+    app: quic-client
+spec:
+  selector:
+    matchLabels:
+      app: quic-client
+  template:
+    metadata:
+      labels:
+        app: quic-client
+    spec:
+# TODO: Enable sysctls if needed
+#      securityContext:
+#        sysctls:
+#          - name: net.core.rmem_max
+#            value: "7500000"
+#          - name: net.core.wmem_max
+#            value: "7500000"
+      containers:
+        - name: quic-client
+          image: git.mrlokop.dev/images/quic-client:latest
+          imagePullPolicy: Always
+          env:
+            - name: PROXY_SERVER
+              value: "95.31.11.36:8443"
+            - name: PROXY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: quic-client-secret
+                  key: token
+            - name: PROXY_CA_CERT
+              valueFrom:
+                secretKeyRef:
+                  name: quic-client-secret
+                  key: ca-cert-b64
+          resources:
+            requests:
+              memory: "100Mi"
+              cpu: "50m" # 50 millicores (0.05 CPU)
+            limits:
+              memory: "256Mi"
+              cpu: "200m" # 200 millicores (0.2 CPU)
+          securityContext:
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65534
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      terminationGracePeriodSeconds: 30
+      tolerations:
+        - operator: Exists
+          effect: NoSchedule
+        - operator: Exists
+          effect: NoExecute