openstack-helm-infra/ingress/templates/deployment-ingress.yaml

{{/*
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/}}

{{- if .Values.manifests.deployment_ingress }}
{{- $envAll := . }}

{{- $serviceAccountName := printf "%s-%s" .Release.Name "ingress" }}
{{ tuple $envAll "ingress" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: {{ $serviceAccountName }}
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - endpoints
      - nodes
      - pods
      - secrets
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"
    resources:
      - ingresses
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - "extensions"
      - "networking.k8s.io"
    resources:
      - ingresses/status
      - ingressclasses/status
    verbs:
      - update
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ $serviceAccountName }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: {{ $serviceAccountName }}
subjects:
  - kind: ServiceAccount
    name: {{ $serviceAccountName }}
    namespace: {{ $envAll.Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: {{ $serviceAccountName }}
  namespace: {{ $envAll.Release.Namespace }}
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - pods
      - secrets
      - namespaces
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - configmaps
    resourceNames:
      - {{ $envAll.Release.Name }}
    verbs:
      - get
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - endpoints
    verbs:
      - get
      - create
      - update
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - get
      - create
      - update
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: {{ $serviceAccountName }}
  namespace: {{ $envAll.Release.Namespace }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: {{ $serviceAccountName }}
subjects:
  - kind: ServiceAccount
    name: {{ $serviceAccountName }}
    namespace: {{ $envAll.Release.Namespace }}
---
{{- if eq .Values.deployment.type "Deployment" }}
apiVersion: apps/v1
kind: Deployment
{{- else if eq .Values.deployment.type "DaemonSet" }}
apiVersion: apps/v1
kind: DaemonSet
{{- end }}
metadata:
  name: ingress
  annotations:
    {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
  labels:
{{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
    app: ingress-api
    app.kubernetes.io/name: "ingress-api"
    app.kubernetes.io/instance: {{ $serviceAccountName }}
    app.kubernetes.io/component: "ingress"
    app.kubernetes.io/managed-by: {{ $envAll.Release.Service }}
{{- if $envAll.Chart.AppVersion }}
    app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }}
{{- end }}
spec:
{{- if eq .Values.deployment.type "Deployment" }}
  replicas: {{ .Values.pod.replicas.ingress }}
{{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }}
{{- end }}
  selector:
    matchLabels:
{{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
      app: ingress-api
  template:
    metadata:
      labels:
{{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
        app: ingress-api
        app.kubernetes.io/name: "ingress-api"
        app.kubernetes.io/instance: {{ $serviceAccountName }}
        app.kubernetes.io/component: "ingress"
        app.kubernetes.io/managed-by: {{ $envAll.Release.Service }}
{{- if $envAll.Chart.AppVersion }}
        app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }}
{{- end }}
      annotations:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
        configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
        configmap-etc-hash: {{ tuple "configmap-conf.yaml" . | include "helm-toolkit.utils.hash" }}
{{- $containers := "init ingress" }}
{{- if and .Values.network.host_namespace .Values.network.vip.manage }}
{{- $containers = printf "%s ingress-vip-kernel-modules ingress-vip-init ingress-vip" $containers }}
{{- end }}
{{- $containers = splitList " " $containers }}
{{ dict "envAll" $envAll "podName" "ingress-server" "containerNames" $containers | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
    spec:
{{ dict "envAll" $envAll "application" "server" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
      shareProcessNamespace: true
      serviceAccountName: {{ $serviceAccountName }}
{{- if eq .Values.deployment.type "Deployment" }}
      affinity:
{{ tuple $envAll "ingress" "server" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
{{- end }}
{{ if $envAll.Values.pod.tolerations.ingress.enabled }}
{{ tuple $envAll "ingress" | include "helm-toolkit.snippets.kubernetes_tolerations" | indent 6 }}
{{ end }}
      nodeSelector:
        {{ .Values.labels.server.node_selector_key }}: {{ .Values.labels.server.node_selector_value | quote }}
{{- if .Values.network.host_namespace }}
      hostNetwork: true
{{- end }}
      dnsPolicy: {{ .Values.pod.dns_policy }}
      terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.server.timeout | default "60" }}
      initContainers:
{{ tuple $envAll "ingress" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
{{- if and .Values.network.host_namespace .Values.network.vip.manage }}
        - name: ingress-vip-kernel-modules
{{ tuple $envAll "ingress_module_init" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ dict "envAll" $envAll "application" "server" "container" "ingress_vip_kernel_modules" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
          command:
            - /tmp/nginx/ingress-vip.sh
            - kernel_modules
          volumeMounts:
            - name: pod-tmp
              mountPath: /tmp/nginx
            - name: ingress-bin
              mountPath: /tmp/nginx/ingress-vip.sh
              subPath: ingress-vip.sh
              readOnly: true
            - name: host-rootfs
              mountPath: /mnt/host-rootfs
              mountPropagation: HostToContainer
              readOnly: true
        - name: ingress-vip-init
{{ tuple $envAll "ingress_routed_vip" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ dict "envAll" $envAll "application" "server" "container" "ingress_vip_init" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
          env:
{{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.network.vip | indent 12 }}
          command:
            - /tmp/nginx/ingress-vip.sh
            - start
          volumeMounts:
            - name: pod-tmp
              mountPath: /tmp/nginx
            - name: ingress-bin
              mountPath: /tmp/nginx/ingress-vip.sh
              subPath: ingress-vip.sh
              readOnly: true
{{- end }}
      containers:
        - name: ingress
{{ tuple $envAll "ingress" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.ingress | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
{{ dict "envAll" $envAll "application" "server" "container" "ingress" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
          readinessProbe:
            httpGet:
              path: /healthz
              port: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
              scheme: HTTP
          livenessProbe:
            httpGet:
              path: /healthz
              port: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
              scheme: HTTP
            initialDelaySeconds: 10
            timeoutSeconds: 1
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: PORT_HTTP
              value: {{ tuple "ingress" "internal" "http" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
            - name: PORT_HTTPS
              value: {{ tuple "ingress" "internal" "https" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
            - name: PORT_STATUS
              value: {{ tuple "ingress" "internal" "status" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
            - name: PORT_STREAM
              value: {{ tuple "ingress" "internal" "stream" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
            - name: PORT_PROFILER
              value: {{ tuple "ingress" "internal" "profiler" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
            - name: PORT_HEALTHZ
              value: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
            - name: DEFAULT_SERVER_PORT
              value: {{ tuple "ingress" "internal" "server" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
            - name: RELEASE_NAME
              value: {{ .Release.Name | quote }}
            - name: ERROR_PAGE_SERVICE
              value: {{ tuple "ingress" "error_pages" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" | quote }}
            - name: INGRESS_CLASS
              value: "{{ .Values.deployment.cluster.class }}"
              {{- if .Values.deployment.cluster.ingressClassByName }}
            - name: INGRESS_CLASS_BY_NAME
              value: "{{ .Values.deployment.cluster.ingressClassByName }}"
              {{- end }}
            - name: CONTROLLER_CLASS
              value: "{{ .Values.deployment.cluster.controllerClass }}"
          ports:
            - containerPort: {{ tuple "ingress" "internal" "http" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- if .Values.network.host_namespace }}
              hostPort: {{ tuple "ingress" "internal" "http" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- end }}
            - containerPort: {{ tuple "ingress" "internal" "https" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- if .Values.network.host_namespace }}
              hostPort: {{ tuple "ingress" "internal" "https" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- end }}
            - containerPort: {{ tuple "ingress" "internal" "status" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- if .Values.network.host_namespace }}
              hostPort: {{ tuple "ingress" "internal" "status" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- end }}
            - containerPort: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- if .Values.network.host_namespace }}
              hostPort: {{ tuple "ingress" "internal" "healthz" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- end }}
            - containerPort: {{ tuple "ingress" "internal" "server" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- if .Values.network.host_namespace }}
              hostPort: {{ tuple "ingress" "internal" "server" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
            {{- end }}
          command:
            - /tmp/nginx/ingress-controller.sh
            - start
          lifecycle:
            preStop:
              exec:
                command:
                  - /tmp/nginx/ingress-controller.sh
                  - stop
          volumeMounts:
            - name: pod-tmp
              mountPath: /tmp/nginx
            - name: ingress-bin
              mountPath: /tmp/nginx/ingress-controller.sh
              subPath: ingress-controller.sh
              readOnly: true
{{- if and .Values.network.host_namespace .Values.network.vip.manage }}
        - name: ingress-vip
{{- if eq .Values.network.vip.mode "routed" }}
{{ tuple $envAll "ingress_routed_vip" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ dict "envAll" $envAll "application" "server" "container" "ingress_vip" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
          env:
{{ include "helm-toolkit.utils.to_k8s_env_vars" .Values.network.vip | indent 12 }}
          command:
            - /tmp/nginx/ingress-vip.sh
            - sleep
          lifecycle:
            preStop:
              exec:
                command:
                  - /tmp/nginx/ingress-vip.sh
                  - stop
          volumeMounts:
            - name: pod-tmp
              mountPath: /tmp/nginx
            - name: ingress-bin
              mountPath: /tmp/nginx/ingress-vip.sh
              subPath: ingress-vip.sh
              readOnly: true
{{- else if eq .Values.network.vip.mode "keepalived" }}
{{ tuple $envAll "keepalived" | include "helm-toolkit.snippets.image" | indent 10 }}
          env:
          - name: KEEPALIVED_INTERFACE
            value: {{ .Values.network.vip.interface | quote }}
          - name: KEEPALIVED_VIRTUAL_IPS
            value: {{ ( .Values.network.vip.addr | split "/" )._0  | quote }}
          - name: KEEPALIVED_UNICAST_PEERS
            value: null
          - name: KEEPALIVED_ROUTER_ID
            value: {{ .Values.network.vip.keepalived_router_id | quote }}
{{- end }}
{{- end }}
      volumes:
        - name: pod-tmp
          emptyDir: {}
        - name: ingress-bin
          configMap:
            name: ingress-bin
            defaultMode: 0555
      {{- if and .Values.network.host_namespace .Values.network.vip.manage }}
        - name: host-rootfs
          hostPath:
            path: /
      {{- end }}
{{- end }}