{{/* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */}} {{- if .Values.manifests.deployment_ingress }} {{- $envAll := . }} {{- $serviceAccountName := printf "%s-%s" .Release.Name "ingress" }} {{ tuple $envAll "ingress" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ $serviceAccountName }} rules: - apiGroups: - "" resources: - configmaps - endpoints - nodes - pods - secrets verbs: - list - watch - apiGroups: - "" resources: - nodes verbs: - get - apiGroups: - "" resources: - services verbs: - get - list - watch - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - "extensions" - "networking.k8s.io" resources: - ingresses - ingressclasses verbs: - get - list - watch - apiGroups: - "extensions" - "networking.k8s.io" resources: - ingresses/status - ingressclasses/status verbs: - update - apiGroups: - discovery.k8s.io resources: - endpointslices verbs: - get - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: {{ $serviceAccountName }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: {{ $serviceAccountName }} subjects: - kind: ServiceAccount name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} rules: - apiGroups: - "" resources: - configmaps - pods - secrets - namespaces verbs: - get - apiGroups: - "" resources: - configmaps resourceNames: - {{ $envAll.Release.Name }} verbs: - get - update - apiGroups: - "" resources: - configmaps verbs: - create - apiGroups: - "" resources: - endpoints verbs: - get - create - update - apiGroups: - coordination.k8s.io resources: - leases verbs: - get - create - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: {{ $serviceAccountName }} subjects: - kind: ServiceAccount name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} --- {{- if eq .Values.deployment.type "Deployment" }} apiVersion: apps/v1 kind: Deployment {{- else if eq .Values.deployment.type "DaemonSet" }} apiVersion: apps/v1 kind: DaemonSet {{- end }} metadata: name: ingress annotations: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }} labels: {{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} app: ingress-api app.kubernetes.io/name: "ingress-api" app.kubernetes.io/instance: {{ $serviceAccountName }} app.kubernetes.io/component: "ingress" app.kubernetes.io/managed-by: {{ $envAll.Release.Service }} {{- if $envAll.Chart.AppVersion }} app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }} {{- end }} spec: {{- if eq .Values.deployment.type "Deployment" }} replicas: {{ .Values.pod.replicas.ingress }} {{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }} {{- end }} selector: matchLabels: {{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }} app: ingress-api template: metadata: labels: {{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} app: ingress-api app.kubernetes.io/name: "ingress-api" app.kubernetes.io/instance: {{ $serviceAccountName }} app.kubernetes.io/component: "ingress" app.kubernetes.io/managed-by: {{ $envAll.Release.Service }} {{- if $envAll.Chart.AppVersion }} app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }} {{- end }} annotations: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-conf.yaml" . | include "helm-toolkit.utils.hash" }} {{- $containers := "init ingress" }} {{- if and .Values.network.host_namespace .Values.network.vip.manage }} {{- $containers = printf "%s ingress-vip-kernel-modules ingress-vip-init ingress-vip" $containers }} {{- end }} {{- $containers = splitList " " $containers }} {{ dict "envAll" $envAll "podName" "ingress-server" "containerNames" $containers | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: {{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} shareProcessNamespace: true serviceAccountName: {{ $serviceAccountName }} {{- if eq .Values.deployment.type "Deployment" }} affinity: {{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{- end }} {{ if $envAll.Values.pod.tolerations.ingress.enabled }} {{ tuple $envAll "ingress" | include "helm-toolkit.snippets.kubernetes_tolerations" | indent 6 }} {{ end }} nodeSelector: {{ .Values.labels.server.node_selector_key }}: {{ .Values.labels.server.node_selector_value | quote }} {{- if .Values.network.host_namespace }} hostNetwork: true {{- end }} dnsPolicy: {{ .Values.pod.dns_policy }} terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.server.timeout | default "60" }} initContainers: {{ tuple $envAll "ingress" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} {{- if and .Values.network.host_namespace .Values.network.vip.manage }} - name: ingress-vip-kernel-modules {{ tuple $envAll "ingress_module_init" | include "helm-toolkit.snippets.image" | indent 10 }} {{ dict "envAll" $envAll "application" "server" "container" "ingress_vip_kernel_modules" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/nginx/ingress-vip.sh - kernel_modules volumeMounts: - name: pod-tmp mountPath: /tmp/nginx - name: ingress-bin mountPath: /tmp/nginx/ingress-vip.sh subPath: ingress-vip.sh readOnly: true - name: host-rootfs mountPath: /mnt/host-rootfs mountPropagation: HostToContainer readOnly: true - name: ingress-vip-init {{ tuple $envAll "ingress_routed_vip" | include "helm-toolkit.snippets.image" | indent 10 }} {{ dict "envAll" $envAll "application" "server" "container" "ingress_vip_init" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: {{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.network.vip | indent 12 }} command: - /tmp/nginx/ingress-vip.sh - start volumeMounts: - name: pod-tmp mountPath: /tmp/nginx - name: ingress-bin mountPath: /tmp/nginx/ingress-vip.sh subPath: ingress-vip.sh readOnly: true {{- end }} containers: - name: ingress {{ tuple $envAll "ingress" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ingress | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ dict "envAll" $envAll "application" "server" "container" "ingress" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} readinessProbe: httpGet: path: /healthz port: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} scheme: HTTP livenessProbe: httpGet: path: /healthz port: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} scheme: HTTP initialDelaySeconds: 10 timeoutSeconds: 1 env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: PORT_HTTP value: {{ tuple "ingress" "internal" "http" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} - name: PORT_HTTPS value: {{ tuple "ingress" "internal" "https" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} - name: PORT_STATUS value: {{ tuple "ingress" "internal" "status" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} - name: PORT_STREAM value: {{ tuple "ingress" "internal" "stream" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} - name: PORT_PROFILER value: {{ tuple "ingress" "internal" "profiler" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} - name: PORT_HEALTHZ value: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} - name: DEFAULT_SERVER_PORT value: {{ tuple "ingress" "internal" "server" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }} - name: RELEASE_NAME value: {{ .Release.Name | quote }} - name: ERROR_PAGE_SERVICE value: {{ tuple "ingress" "error_pages" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" | quote }} - name: INGRESS_CLASS value: "{{ .Values.deployment.cluster.class }}" {{- if .Values.deployment.cluster.ingressClassByName }} - name: INGRESS_CLASS_BY_NAME value: "{{ .Values.deployment.cluster.ingressClassByName }}" {{- end }} - name: CONTROLLER_CLASS value: "{{ .Values.deployment.cluster.controllerClass }}" ports: - containerPort: {{ tuple "ingress" "internal" "http" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- if .Values.network.host_namespace }} hostPort: {{ tuple "ingress" "internal" "http" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- end }} - containerPort: {{ tuple "ingress" "internal" "https" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- if .Values.network.host_namespace }} hostPort: {{ tuple "ingress" "internal" "https" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- end }} - containerPort: {{ tuple "ingress" "internal" "status" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- if .Values.network.host_namespace }} hostPort: {{ tuple "ingress" "internal" "status" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- end }} - containerPort: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- if .Values.network.host_namespace }} hostPort: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- end }} - containerPort: {{ tuple "ingress" "internal" "server" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- if .Values.network.host_namespace }} hostPort: {{ tuple "ingress" "internal" "server" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} {{- end }} command: - /tmp/nginx/ingress-controller.sh - start lifecycle: preStop: exec: command: - /tmp/nginx/ingress-controller.sh - stop volumeMounts: - name: pod-tmp mountPath: /tmp/nginx - name: ingress-bin mountPath: /tmp/nginx/ingress-controller.sh subPath: ingress-controller.sh readOnly: true {{- if and .Values.network.host_namespace .Values.network.vip.manage }} - name: ingress-vip {{- if eq .Values.network.vip.mode "routed" }} {{ tuple $envAll "ingress_routed_vip" | include "helm-toolkit.snippets.image" | indent 10 }} {{ dict "envAll" $envAll "application" "server" "container" "ingress_vip" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} env: {{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.network.vip | indent 12 }} command: - /tmp/nginx/ingress-vip.sh - sleep lifecycle: preStop: exec: command: - /tmp/nginx/ingress-vip.sh - stop volumeMounts: - name: pod-tmp mountPath: /tmp/nginx - name: ingress-bin mountPath: /tmp/nginx/ingress-vip.sh subPath: ingress-vip.sh readOnly: true {{- else if eq .Values.network.vip.mode "keepalived" }} {{ tuple $envAll "keepalived" | include "helm-toolkit.snippets.image" | indent 10 }} env: - name: KEEPALIVED_INTERFACE value: {{ .Values.network.vip.interface | quote }} - name: KEEPALIVED_VIRTUAL_IPS value: {{ ( .Values.network.vip.addr | split "/" )._0 | quote }} - name: KEEPALIVED_UNICAST_PEERS value: null - name: KEEPALIVED_ROUTER_ID value: {{ .Values.network.vip.keepalived_router_id | quote }} {{- end }} {{- end }} volumes: - name: pod-tmp emptyDir: {} - name: ingress-bin configMap: name: ingress-bin defaultMode: 0555 {{- if and .Values.network.host_namespace .Values.network.vip.manage }} - name: host-rootfs hostPath: path: / {{- end }} {{- end }}