initial commit
All checks were successful
Build and Publish TechDocs / build-and-publish (push) Successful in 1m15s
All checks were successful
Build and Publish TechDocs / build-and-publish (push) Successful in 1m15s
Change-Id: I2e2564a72b6be9af536235fc3795fd788fd9257b
This commit is contained in:
Scaffolder
283
kubernetes-ingress/templates/controller-proxy-deployment.yaml
Normal file
283
kubernetes-ingress/templates/controller-proxy-deployment.yaml
Normal file
@@ -0,0 +1,283 @@
|
||||
{{/*
|
||||
Copyright 2024 HAProxy Technologies LLC
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/}}
|
||||
|
||||
{{- if and (eq .Values.controller.sync.mode "fetch") (eq .Values.controller.sync.fetchParams.source "proxy") }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ include "kubernetes-ingress.serviceProxyName" . }}
|
||||
namespace: {{ include "kubernetes-ingress.namespace" . }}
|
||||
{{- with .Values.controller.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kubernetes-ingress.serviceProxyLabels" . | nindent 4 }}
|
||||
{{- if .Values.controller.extraLabels }}
|
||||
{{ toYaml .Values.controller.extraLabels | indent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if and (not .Values.controller.autoscaling.enabled) (not .Values.controller.keda.enabled) }}
|
||||
replicas: {{ .Values.controller.sync.proxyParams.replicaCount }}
|
||||
{{- end }}
|
||||
minReadySeconds: {{ .Values.controller.minReadySeconds }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kubernetes-ingress.serviceProxySelectorLabels" . | nindent 6 }}
|
||||
{{- with .Values.controller.strategy }}
|
||||
strategy:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "kubernetes-ingress.serviceProxySelectorLabels" . | nindent 8 }}
|
||||
{{- if .Values.controller.podLabels }}
|
||||
{{ toYaml .Values.controller.podLabels | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.podAnnotations }}
|
||||
annotations:
|
||||
{{- if eq "string" (printf "%T" .Values.controller.podAnnotations) }}
|
||||
{{ tpl .Values.controller.podAnnotations . | indent 8 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.controller.podAnnotations | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
enableServiceLinks: {{ .Values.controller.enableServiceLinks }}
|
||||
serviceAccountName: {{ include "kubernetes-ingress.serviceAccountName" . }}
|
||||
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
|
||||
{{- with .Values.controller.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{ toYaml .Values.controller.dnsConfig | indent 8 }}
|
||||
{{- end }}
|
||||
dnsPolicy: {{ .Values.controller.dnsPolicy }}
|
||||
{{- if .Values.controller.imageCredentials.registry }}
|
||||
imagePullSecrets:
|
||||
- name: {{ include "kubernetes-ingress.fullname" . }}
|
||||
{{- else if .Values.controller.existingImagePullSecret }}
|
||||
imagePullSecrets:
|
||||
- name: {{ .Values.controller.existingImagePullSecret }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.priorityClassName }}
|
||||
priorityClassName: {{ .Values.controller.priorityClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.runtimeClassName }}
|
||||
runtimeClassName: {{ .Values.controller.runtimeClassName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.unprivileged }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
{{- if .Values.controller.allowPrivilegedPorts }}
|
||||
sysctls:
|
||||
- name: net.ipv4.ip_unprivileged_port_start
|
||||
value: "0"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ include "kubernetes-ingress.name" . }}-{{ .Values.controller.name }}
|
||||
image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag | default .Chart.AppVersion }}"
|
||||
imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
|
||||
args:
|
||||
{{- if .Values.controller.defaultTLSSecret.enabled -}}
|
||||
{{- if and .Values.controller.defaultTLSSecret.secret .Values.controller.defaultTLSSecret.secretNamespace }}
|
||||
- --default-ssl-certificate={{ tpl .Values.controller.defaultTLSSecret.secretNamespace . }}/{{ .Values.controller.defaultTLSSecret.secret }}
|
||||
{{- else }}
|
||||
- --default-ssl-certificate={{ include "kubernetes-ingress.namespace" . }}/{{ include "kubernetes-ingress.defaultTLSSecret.fullname" . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- --configmap={{ include "kubernetes-ingress.namespace" . }}/{{ include "kubernetes-ingress.fullname" . }}
|
||||
- --http-bind-port={{ .Values.controller.containerPort.http }}
|
||||
- --https-bind-port={{ .Values.controller.containerPort.https }}
|
||||
{{- if and (semverCompare ">=1.24.0-0" .Capabilities.KubeVersion.Version) .Values.controller.service.enablePorts.quic }}
|
||||
- --quic-bind-port={{ .Values.controller.containerPort.https }}
|
||||
- --quic-announce-port={{ .Values.controller.service.ports.https }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.ingressClass }}
|
||||
- --ingress.class={{ .Values.controller.ingressClass }}
|
||||
{{- end }}
|
||||
{{- if and .Values.controller.kubernetesGateway.enabled .Values.controller.kubernetesGateway.gatewayControllerName }}
|
||||
- --gateway-controller-name={{ .Values.controller.kubernetesGateway.gatewayControllerName }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.publishService.enabled }}
|
||||
- --publish-service={{ include "kubernetes-ingress.publishServicePath" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.logging.level }}
|
||||
- --log={{ .Values.controller.logging.level }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.service.enablePorts.admin }}
|
||||
- --prometheus
|
||||
- --pprof
|
||||
{{- end }}
|
||||
- --proxy-server-mode
|
||||
- --k8s-api-sync-type=k8s
|
||||
- --proxy-svc-label-selector={{ .Values.controller.sync.proxyParams.proxySvcLabelSelector }}
|
||||
{{- if .Values.controller.sync.fetchParams.period }}
|
||||
- --proxy-k8s-fetch-period={{ .Values.controller.sync.fetchParams.period }}
|
||||
{{- end }}
|
||||
{{- range .Values.controller.extraArgs }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.unprivileged }}
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
allowPrivilegeEscalation: {{ .Values.controller.allowPrivilegeEscalation }}
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
{{- if .Values.controller.enableRuntimeDefaultSeccompProfile }}
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
{{- range $key, $value := .Values.controller.containerPort }}
|
||||
- name: {{ $key }}
|
||||
containerPort: {{ $value }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if and (semverCompare ">=1.24.0-0" .Capabilities.KubeVersion.Version) .Values.controller.service.enablePorts.quic }}
|
||||
- name: quic
|
||||
containerPort: {{ .Values.controller.containerPort.https }}
|
||||
protocol: UDP
|
||||
{{- end }}
|
||||
{{- range .Values.controller.service.tcpPorts }}
|
||||
- name: {{ .name | trunc 15 | trimSuffix "-" }}
|
||||
containerPort: {{ .targetPort }}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- with .Values.controller.livenessProbe }}
|
||||
livenessProbe:
|
||||
{{- toYaml . | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.readinessProbe }}
|
||||
readinessProbe:
|
||||
{{- toYaml . | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.startupProbe }}
|
||||
startupProbe:
|
||||
{{- toYaml . | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
{{- if .Values.aws.licenseConfigSecretName }}
|
||||
- name: AWS_WEB_IDENTITY_REFRESH_TOKEN_FILE
|
||||
value: "/var/run/secrets/product-license/license_token"
|
||||
- name: AWS_ROLE_ARN
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ .Values.aws.licenseConfigSecretName }}
|
||||
key: iam_role
|
||||
{{- end }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_IP
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: status.podIP
|
||||
{{- if .Values.controller.extraEnvs -}}
|
||||
{{- toYaml .Values.controller.extraEnvs | nindent 10 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{- toYaml .Values.controller.resources | nindent 12 }}
|
||||
{{- if .Values.controller.lifecycle }}
|
||||
lifecycle:
|
||||
{{- if eq "string" (printf "%T" .Values.controller.lifecycle) }}
|
||||
{{ tpl .Values.controller.lifecycle . | indent 12 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.controller.lifecycle | indent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
subPath: tmp
|
||||
- name: tmp
|
||||
mountPath: /run
|
||||
subPath: run
|
||||
{{- if .Values.aws.licenseConfigSecretName }}
|
||||
- name: aws-product-license
|
||||
readOnly: true
|
||||
mountPath: /var/run/secrets/product-license
|
||||
{{- end }}
|
||||
{{- if eq "string" (printf "%T" .Values.controller.extraVolumeMounts) }}
|
||||
{{ tpl .Values.controller.extraVolumeMounts . | indent 12 }}
|
||||
{{- else if gt (len .Values.controller.extraVolumeMounts) 0 }}
|
||||
{{ toYaml .Values.controller.extraVolumeMounts | indent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.extraContainers }}
|
||||
{{- if eq "string" (printf "%T" .Values.controller.extraContainers) }}
|
||||
{{ tpl .Values.controller.extraContainers . | indent 8 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.controller.extraContainers | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: tmp
|
||||
{{- if semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version }}
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
sizeLimit: 64Mi
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if .Values.aws.licenseConfigSecretName }}
|
||||
- name: aws-product-license
|
||||
secret:
|
||||
secretName: {{ .Values.aws.licenseConfigSecretName }}
|
||||
optional: true
|
||||
{{- end }}
|
||||
{{- if eq "string" (printf "%T" .Values.controller.extraVolumes) }}
|
||||
{{ tpl .Values.controller.extraVolumes . | indent 8 }}
|
||||
{{- else if gt (len .Values.controller.extraVolumes) 0 }}
|
||||
{{ toYaml .Values.controller.extraVolumes | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.initContainers }}
|
||||
initContainers:
|
||||
{{- if eq "string" (printf "%T" .Values.controller.initContainers) }}
|
||||
{{ tpl .Values.controller.initContainers . | indent 8 }}
|
||||
{{- else }}
|
||||
{{ toYaml .Values.controller.initContainers | indent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.affinity }}
|
||||
affinity:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.controller.tolerations }}
|
||||
tolerations:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user