{{/* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */}} {{- if (.Values.global).subchart_release_name }} {{- $_ := set . "deployment_name" .Chart.Name }} {{- else }} {{- $_ := set . "deployment_name" .Release.Name }} {{- end }} {{- if .Values.manifests.deployment_ingress }} {{- $envAll := . }} {{- $ingressClass := printf "%s-%s" .deployment_name "mariadb-ingress" }} {{- $serviceAccountName := printf "%s-%s" .deployment_name "ingress" }} {{ tuple $envAll "ingress" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: {{ $serviceAccountName }} rules: - apiGroups: - "" resources: - configmaps - endpoints - nodes - pods - secrets verbs: - list - watch - apiGroups: - "" resources: - nodes verbs: - get - apiGroups: - "" resources: - services verbs: - get - list - watch - update - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - "extensions" - "networking.k8s.io" resources: - ingresses verbs: - get - list - watch - apiGroups: - "extensions" - "networking.k8s.io" resources: - ingresses/status verbs: - update - apiGroups: - "networking.k8s.io" resources: - ingressclasses verbs: - get - list - watch --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: {{ $serviceAccountName }} roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: {{ $serviceAccountName }} subjects: - kind: ServiceAccount name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} rules: - apiGroups: - "" resources: - services verbs: - get - list - watch - apiGroups: - extensions - networking.k8s.io resources: - ingresses verbs: - get - list - watch - apiGroups: - "" resources: - events verbs: - create - patch - apiGroups: - extensions - networking.k8s.io resources: - ingresses/status verbs: - update - apiGroups: - "" resources: - configmaps - endpoints - nodes - pods - secrets verbs: - list - watch - apiGroups: - "" resources: - configmaps - pods - secrets - namespaces verbs: - get - apiGroups: - "" resourceNames: - {{ printf "%s-%s" .deployment_name $ingressClass | quote }} resources: - configmaps verbs: - get - update - apiGroups: - "" resources: - configmaps verbs: - create - apiGroups: - "" resources: - endpoints verbs: - get - create - update --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: {{ $serviceAccountName }} subjects: - kind: ServiceAccount name: {{ $serviceAccountName }} namespace: {{ $envAll.Release.Namespace }} --- apiVersion: apps/v1 kind: Deployment metadata: name: mariadb-ingress annotations: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }} labels: {{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} app.kubernetes.io/instance: {{ $serviceAccountName }} app.kubernetes.io/name: "mariadb" app.kubernetes.io/component: "ingress" app.kubernetes.io/managed-by: {{ $envAll.Release.Service }} {{- if $envAll.Chart.AppVersion }} app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }} {{- end }} spec: replicas: {{ .Values.pod.replicas.ingress }} selector: matchLabels: {{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }} {{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }} template: metadata: labels: {{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} app.kubernetes.io/instance: {{ $serviceAccountName }} app.kubernetes.io/name: "mariadb" app.kubernetes.io/component: "ingress" app.kubernetes.io/managed-by: {{ $envAll.Release.Service }} {{- if $envAll.Chart.AppVersion }} app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }} {{- end }} annotations: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-ingress-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "mariadb-ingress" "containerNames" (list "init" "ingress") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: shareProcessNamespace: true serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "ingress" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} affinity: {{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} {{ if $envAll.Values.pod.tolerations.mariadb.enabled }} {{ tuple $envAll "mariadb" | include "helm-toolkit.snippets.kubernetes_tolerations" | indent 6 }} {{ end }} nodeSelector: {{ .Values.labels.ingress.node_selector_key }}: {{ .Values.labels.ingress.node_selector_value }} terminationGracePeriodSeconds: 60 initContainers: {{ tuple $envAll "ingress" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} containers: - name: ingress {{ tuple $envAll "ingress" | include "helm-toolkit.snippets.image" | indent 10 }} {{ dict "envAll" $envAll "application" "ingress" "container" "server" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.ingress | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} readinessProbe: tcpSocket: port: {{ tuple "oslo_db" "internal" "mysql" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }} livenessProbe: httpGet: path: /healthz port: 10254 scheme: HTTP initialDelaySeconds: 10 timeoutSeconds: 1 env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: RELEASE_NAME value: {{ .deployment_name | quote }} - name: INGRESS_CLASS value: {{ $ingressClass | quote }} - name: ERROR_PAGE_SERVICE value: {{ tuple "oslo_db" "error_pages" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" | quote }} command: - /tmp/mariadb-ingress-controller.sh - start lifecycle: preStop: exec: command: - /tmp/mariadb-ingress-controller.sh - stop volumeMounts: - name: pod-tmp mountPath: /tmp - name: mariadb-bin mountPath: /tmp/mariadb-ingress-controller.sh subPath: mariadb-ingress-controller.sh readOnly: true - name: mariadb-ingress-etc mountPath: /etc/nginx/template/nginx.tmpl subPath: nginx.tmpl readOnly: true volumes: - name: pod-tmp emptyDir: {} - name: mariadb-bin configMap: name: mariadb-bin defaultMode: 0555 - name: mariadb-ingress-etc configMap: name: mariadb-ingress-etc defaultMode: 0444 {{- end }}