openstack-helm/magnum/templates/statefulset-conductor.yaml
Mohammed Naser 8596470609 Added cluster/temp_cache_dir
When using Barbican with a large number of clusters, this option can
allow Magnum to cache the certificates locally to avoid hitting
the API excessively. It is enabled out of the box however since
we don't have that folder, it is not working.

Change-Id: I63cb35798b82460f7addd4ec719c157e2c1c4fd9
2021-12-02 12:43:32 +04:00

135 lines
5.5 KiB
YAML

{{/*
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/}}
{{- if .Values.manifests.statefulset_conductor }}
{{- $envAll := . }}
{{- $mounts_magnum_conductor := .Values.pod.mounts.magnum_conductor.magnum_conductor }}
{{- $mounts_magnum_conductor_init := .Values.pod.mounts.magnum_conductor.init_container }}
{{- $serviceAccountName := "magnum-conductor" }}
{{ tuple $envAll "conductor" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: magnum-conductor
annotations:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
labels:
{{ tuple $envAll "magnum" "conductor" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
spec:
serviceName: magnum-conductor
podManagementPolicy: "Parallel"
replicas: {{ .Values.pod.replicas.conductor }}
selector:
matchLabels:
{{ tuple $envAll "magnum" "conductor" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
template:
metadata:
labels:
{{ tuple $envAll "magnum" "conductor" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
annotations:
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
spec:
serviceAccountName: {{ $serviceAccountName }}
affinity:
{{ tuple $envAll "magnum" "conductor" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
nodeSelector:
{{ .Values.labels.conductor.node_selector_key }}: {{ .Values.labels.conductor.node_selector_value }}
initContainers:
{{ tuple $envAll "conductor" $mounts_magnum_conductor_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
- name: magnum-conductor-init
{{ tuple $envAll "magnum_conductor" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.conductor | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.magnum.uid }}
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
command:
- /tmp/magnum-conductor-init.sh
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: magnum-bin
mountPath: /tmp/magnum-conductor-init.sh
subPath: magnum-conductor-init.sh
readOnly: true
- name: pod-shared
mountPath: /tmp/pod-shared
containers:
- name: magnum-conductor
{{ tuple $envAll "magnum_conductor" | include "helm-toolkit.snippets.image" | indent 10 }}
{{ tuple $envAll $envAll.Values.pod.resources.conductor | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
securityContext:
runAsUser: {{ .Values.pod.user.magnum.uid }}
command:
- /tmp/magnum-conductor.sh
volumeMounts:
- name: pod-tmp
mountPath: /tmp
- name: magnum-bin
mountPath: /tmp/magnum-conductor.sh
subPath: magnum-conductor.sh
readOnly: true
- name: pod-etc-magnum
mountPath: /etc/magnum
- name: magnum-etc
mountPath: /etc/magnum/magnum.conf
subPath: magnum.conf
readOnly: true
{{- if .Values.conf.magnum.DEFAULT.log_config_append }}
- name: magnum-etc
mountPath: {{ .Values.conf.magnum.DEFAULT.log_config_append }}
subPath: {{ base .Values.conf.magnum.DEFAULT.log_config_append }}
readOnly: true
{{- end }}
- name: magnum-etc
mountPath: /etc/magnum/policy.yaml
subPath: policy.yaml
readOnly: true
- name: pod-shared
mountPath: /tmp/pod-shared
- name: magnum-lock-path
mountPath: {{ .Values.conf.magnum.oslo_concurrency.lock_path }}
- name: magnum-certificate-cache
mountPath: {{ .Values.conf.magnum.cluster.temp_cache_dir }}
{{ if $mounts_magnum_conductor.volumeMounts }}{{ toYaml $mounts_magnum_conductor.volumeMounts | indent 12 }}{{ end }}
volumes:
- name: pod-tmp
emptyDir: {}
- name: pod-etc-magnum
emptyDir: {}
- name: pod-shared
emptyDir: {}
- name: magnum-bin
configMap:
name: magnum-bin
defaultMode: 0555
- name: magnum-etc
secret:
secretName: magnum-etc
defaultMode: 0444
- name: magnum-lock-path
emptyDir: {}
- name: magnum-certificate-cache
emptyDir: {}
{{ if $mounts_magnum_conductor.volumes }}{{ toYaml $mounts_magnum_conductor.volumes | indent 8 }}{{ end }}
{{- end }}