cfssl-server.yaml

apiVersion: v1
kind: Service
metadata:
  name: cfssl-server
  labels:
    app: cfssl-server
spec:
  selector:
    app: cfssl-server
  ports:
  - name: https
    protocol: TCP
    port: 8888
    targetPort: 8888
  externalIPs:
  - 192.168.0.164
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: cfssl-server
  labels:
    app: cfssl-server
spec:
  replicas: 2
  template:
    metadata:
      labels:
        app: cfssl-server
    spec:
      containers:
      - name: cfssl-server
        image: ghcr.io/wuvt/cfssl:latest
        command:
        - multirootca
        - -tls-cert
        - /etc/cfssl/cfssl.pem
        - -tls-key
        - /etc/cfssl/cfssl-key.pem
        - -roots
        - /etc/cfssl/roots.conf
        securityContext:
          runAsUser: 1000
        ports:
        - containerPort: 8888
        volumeMounts:
        - name: cfssl-data
          mountPath: /etc/cfssl
          readOnly: true
      volumes:
      - name: cfssl-data
        cephfs:
          monitors:
            - 192.168.0.234:6789
          path: /cfssl-data
          user: k8s
          secretRef:
            name: ceph-k8s