19ade859c2
The patch makes it possible to pass restartPolicy for jobs which create different keystone resources. However default behaviour is still the same and if restartPolicy is undefined then it will be OnFailure as it was before. Change-Id: I0e355cfd6947db72f77d76a0f6696e9bcef175e9
112 lines
4.8 KiB
Smarty
112 lines
4.8 KiB
Smarty
{{/*
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
# This function creates a manifest for keystone user management.
|
|
# It can be used in charts dict created similar to the following:
|
|
# {- $ksUserJob := dict "envAll" . "serviceName" "senlin" }
|
|
# { $ksUserJob | include "helm-toolkit.manifests.job_ks_user" }
|
|
|
|
{{- define "helm-toolkit.manifests.job_ks_user" -}}
|
|
{{- $envAll := index . "envAll" -}}
|
|
{{- $serviceName := index . "serviceName" -}}
|
|
{{- $nodeSelector := index . "nodeSelector" | default ( dict $envAll.Values.labels.job.node_selector_key $envAll.Values.labels.job.node_selector_value ) -}}
|
|
{{- $configMapBin := index . "configMapBin" | default (printf "%s-%s" $serviceName "bin" ) -}}
|
|
{{- $serviceUser := index . "serviceUser" | default $serviceName -}}
|
|
{{- $secretBin := index . "secretBin" -}}
|
|
{{- $tlsSecret := index . "tlsSecret" | default "" -}}
|
|
{{- $backoffLimit := index . "backoffLimit" | default "1000" -}}
|
|
{{- $activeDeadlineSeconds := index . "activeDeadlineSeconds" -}}
|
|
{{- $serviceUserPretty := $serviceUser | replace "_" "-" -}}
|
|
{{- $restartPolicy_ := "OnFailure" -}}
|
|
{{- if hasKey $envAll.Values "jobs" -}}
|
|
{{- if hasKey $envAll.Values.jobs "ks_user" -}}
|
|
{{- $restartPolicy_ = $envAll.Values.jobs.ks_user.restartPolicy | default $restartPolicy_ }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- $restartPolicy := index . "restartPolicy" | default $restartPolicy_ -}}
|
|
|
|
{{- $serviceAccountName := printf "%s-%s" $serviceUserPretty "ks-user" }}
|
|
{{ tuple $envAll "ks_user" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ printf "%s-%s" $serviceUserPretty "ks-user" | quote }}
|
|
spec:
|
|
backoffLimit: {{ $backoffLimit }}
|
|
{{- if $activeDeadlineSeconds }}
|
|
activeDeadlineSeconds: {{ $activeDeadlineSeconds }}
|
|
{{- end }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{ tuple $envAll $serviceName "ks-user" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
|
annotations:
|
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
|
spec:
|
|
serviceAccountName: {{ $serviceAccountName | quote }}
|
|
restartPolicy: {{ $restartPolicy }}
|
|
nodeSelector:
|
|
{{ toYaml $nodeSelector | indent 8 }}
|
|
initContainers:
|
|
{{ tuple $envAll "ks_user" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
|
containers:
|
|
- name: ks-user
|
|
image: {{ $envAll.Values.images.tags.ks_user }}
|
|
imagePullPolicy: {{ $envAll.Values.images.pull_policy }}
|
|
{{ tuple $envAll $envAll.Values.pod.resources.jobs.ks_user | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
|
command:
|
|
- /bin/bash
|
|
- -c
|
|
- /tmp/ks-user.sh
|
|
volumeMounts:
|
|
- name: pod-tmp
|
|
mountPath: /tmp
|
|
- name: ks-user-sh
|
|
mountPath: /tmp/ks-user.sh
|
|
subPath: ks-user.sh
|
|
readOnly: true
|
|
{{ dict "enabled" true "name" $tlsSecret "ca" true | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
|
|
env:
|
|
{{- with $env := dict "ksUserSecret" $envAll.Values.secrets.identity.admin "useCA" (ne $tlsSecret "") }}
|
|
{{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }}
|
|
{{- end }}
|
|
- name: SERVICE_OS_SERVICE_NAME
|
|
value: {{ $serviceName | quote }}
|
|
{{- with $env := dict "ksUserSecret" (index $envAll.Values.secrets.identity $serviceUser ) }}
|
|
{{- include "helm-toolkit.snippets.keystone_user_create_env_vars" $env | indent 12 }}
|
|
{{- end }}
|
|
- name: SERVICE_OS_ROLES
|
|
{{- $serviceOsRoles := index $envAll.Values.endpoints.identity.auth $serviceUser "role" }}
|
|
{{- if kindIs "slice" $serviceOsRoles }}
|
|
value: {{ include "helm-toolkit.utils.joinListWithComma" $serviceOsRoles | quote }}
|
|
{{- else }}
|
|
value: {{ $serviceOsRoles | quote }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: pod-tmp
|
|
emptyDir: {}
|
|
- name: ks-user-sh
|
|
{{- if $secretBin }}
|
|
secret:
|
|
secretName: {{ $secretBin | quote }}
|
|
defaultMode: 0555
|
|
{{- else }}
|
|
configMap:
|
|
name: {{ $configMapBin | quote }}
|
|
defaultMode: 0555
|
|
{{- end }}
|
|
{{- dict "enabled" true "name" $tlsSecret | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
|
|
{{- end -}}
|