Skip to content

Commit baee522

Browse files
dominicbettsdominicbetts
committed
Add new PLC simulator definition
1 parent e9a2d8d commit baee522

File tree

1 file changed

+206
-0
lines changed

1 file changed

+206
-0
lines changed

‎samples/quickstarts/opc-plc-tutorial-deployment.yaml‎

Lines changed: 206 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: opc-plc-000000
5+
namespace: azure-iot-operations
6+
labels:
7+
app.kubernetes.io/component: opcplc-000000
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app.kubernetes.io/component: opcplc-000000
13+
template:
14+
metadata:
15+
labels:
16+
app.kubernetes.io/component: opcplc-000000
17+
spec:
18+
containers:
19+
- name: opc-plc
20+
image: mcr.microsoft.com/iotedge/opc-plc:latest
21+
args:
22+
- "--plchostname=opcplc-000000"
23+
- "--portnum=50000"
24+
- "--certdnsnames=opcplc-000000"
25+
- "--unsecuretransport"
26+
- "--showpnjsonph"
27+
- "--slownodes=5"
28+
- "--slowrate=10"
29+
- "--fastnodes=10"
30+
- "--fasttypelowerbound=212"
31+
- "--fasttypeupperbound=273"
32+
- "--fasttyperandomization=True"
33+
- "--veryfastrate=1000"
34+
- "--guidnodes=1"
35+
- "--appcertstoretype=FlatDirectory"
36+
- "--dontrejectunknownrevocationstatus"
37+
- "--disableanonymousauth"
38+
- "--defaultuser=contosouser"
39+
- "--defaultpassword=contosouserpassword"
40+
ports:
41+
- containerPort: 50000
42+
volumeMounts:
43+
- name: opc-plc-default-application-cert
44+
mountPath: /app/pki/own
45+
- name: opc-plc-trust-list
46+
mountPath: /app/pki/trusted
47+
volumes:
48+
- name: opc-plc-default-application-cert
49+
secret:
50+
secretName: opc-plc-default-application-cert
51+
- name: opc-plc-trust-list
52+
secret:
53+
secretName: opc-plc-trust-list
54+
serviceAccountName: opcplc-000000-service-account
55+
---
56+
apiVersion: v1
57+
kind: Service
58+
metadata:
59+
name: opcplc-000000
60+
namespace: azure-iot-operations
61+
labels:
62+
app.kubernetes.io/component: opcplc-000000
63+
spec:
64+
type: ClusterIP
65+
selector:
66+
app.kubernetes.io/component: opcplc-000000
67+
ports:
68+
- port: 50000
69+
protocol: TCP
70+
targetPort: 50000
71+
---
72+
apiVersion: cert-manager.io/v1
73+
kind: Issuer
74+
metadata:
75+
name: opc-plc-self-signed-issuer
76+
namespace: azure-iot-operations
77+
labels:
78+
app.kubernetes.io/component: opcplc-000000
79+
spec:
80+
selfSigned: {}
81+
---
82+
apiVersion: cert-manager.io/v1
83+
kind: Certificate
84+
metadata:
85+
name: opc-plc-default-application-cert
86+
namespace: azure-iot-operations
87+
labels:
88+
app.kubernetes.io/component: opcplc-000000
89+
spec:
90+
secretName: opc-plc-default-application-cert
91+
duration: 2160h # 90d
92+
renewBefore: 360h # 15d
93+
issuerRef:
94+
name: opc-plc-self-signed-issuer
95+
kind: Issuer
96+
commonName: OpcPlc
97+
dnsNames:
98+
- opcplc-000000
99+
- opcplc-000000.azure-iot-operations.svc.cluster.local
100+
- opcplc-000000.azure-iot-operations
101+
uris:
102+
- urn:OpcPlc:opcplc-000000
103+
usages:
104+
- digital signature
105+
- key encipherment
106+
- data encipherment
107+
- server auth
108+
- client auth
109+
privateKey:
110+
algorithm: RSA
111+
size: 2048
112+
encodeUsagesInRequest: true
113+
isCA: false
114+
---
115+
apiVersion: v1
116+
kind: Secret
117+
metadata:
118+
name: opc-plc-trust-list
119+
namespace: azure-iot-operations
120+
labels:
121+
app.kubernetes.io/component: opcplc-000000
122+
data: {}
123+
---
124+
apiVersion: batch/v1
125+
kind: Job
126+
metadata:
127+
name: opcplc-000000-execute-mutual-trust
128+
namespace: azure-iot-operations
129+
labels:
130+
app.kubernetes.io/component: opcplc-000000
131+
spec:
132+
backoffLimit: 1
133+
template:
134+
spec:
135+
containers:
136+
- name: kubectl
137+
image: mcr.microsoft.com/oss/kubernetes/kubectl:v1.27.1
138+
imagePullPolicy: Always
139+
command: ["/bin/sh"]
140+
args: ["/scripts/execute-commands.sh"]
141+
volumeMounts:
142+
- name: scripts
143+
mountPath: /scripts
144+
readOnly: true
145+
restartPolicy: Never
146+
serviceAccountName: opcplc-000000-service-account
147+
volumes:
148+
- name: scripts
149+
configMap:
150+
name: opcplc-000000-execute-commands-script
151+
---
152+
apiVersion: v1
153+
kind: ConfigMap
154+
metadata:
155+
name: opcplc-000000-execute-commands-script
156+
namespace: azure-iot-operations
157+
labels:
158+
app.kubernetes.io/component: opcplc-000000
159+
data:
160+
execute-commands.sh: |
161+
#!/bin/sh
162+
163+
# wait 20 seconds for the resources to be created
164+
sleep 20
165+
166+
# Extract the OPC UA connector application instance certificate and add it to the OPC PLC trust list
167+
cert=$(kubectl -n azure-iot-operations get secret aio-opc-opcuabroker-default-application-cert -o jsonpath='{.data.tls\.crt}' | base64 -d)
168+
data=$(kubectl create secret generic temp --from-literal=opcuabroker.crt="$cert" --dry-run=client -o jsonpath='{.data}')
169+
kubectl patch secret opc-plc-trust-list -n azure-iot-operations -p "{\"data\": $data}"
170+
171+
# Extract the OPC PLC application instance certificate and add it to the OPC UA connector trust list
172+
cert=$(kubectl -n azure-iot-operations get secret opc-plc-default-application-cert -o jsonpath='{.data.tls\.crt}' | base64 -d)
173+
data=$(kubectl create secret generic temp --from-literal=opcplc-000000.crt="$cert" --dry-run=client -o jsonpath='{.data}')
174+
kubectl patch secret aio-opc-ua-broker-trust-list -n azure-iot-operations -p "{\"data\": $data}"
175+
---
176+
apiVersion: v1
177+
kind: ServiceAccount
178+
metadata:
179+
name: opcplc-000000-service-account
180+
namespace: azure-iot-operations
181+
labels:
182+
app.kubernetes.io/component: opcplc-000000
183+
---
184+
apiVersion: rbac.authorization.k8s.io/v1
185+
kind: Role
186+
metadata:
187+
name: opc-plc-000000-secret-access-role
188+
namespace: azure-iot-operations
189+
rules:
190+
- apiGroups: [""]
191+
resources: ["secrets"]
192+
verbs: ["get", "patch"]
193+
---
194+
apiVersion: rbac.authorization.k8s.io/v1
195+
kind: RoleBinding
196+
metadata:
197+
name: opc-plc-000000-secret-access-rolebinding
198+
namespace: azure-iot-operations
199+
subjects:
200+
- kind: ServiceAccount
201+
name: opcplc-000000-service-account
202+
namespace: azure-iot-operations
203+
roleRef:
204+
kind: Role
205+
name: opc-plc-000000-secret-access-role
206+
apiGroup: rbac.authorization.k8s.io

0 commit comments

Comments
 (0)