openstack-operator/openstack_operator/templates/heat/daemonset.yml.j2
okozachenko 809caecd82 Remove default service token from all pod spec
Change-Id: I3c182806245056bfc87c8737a7ffbf611614b2af
2020-07-24 16:50:56 +03:00

127 lines
3.4 KiB
Django/Jinja

---
# Copyright 2020 VEXXHOST, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
{% if component is defined %}
{% set component = component %}
{% else %}
{% set component = "api" %}
{% endif %}
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: heat-{{ component }}
namespace: openstack
labels:
{{ labels("heat", name, component) | indent(4) }}
spec:
updateStrategy:
rollingUpdate:
maxUnavailable: 1
type: RollingUpdate
selector:
matchLabels:
{{ labels("heat", name, component) | indent(6) }}
template:
metadata:
labels:
{{ labels("heat", name, component) | indent(8) }}
annotations:
checksum/config: "{{ config_hash }}"
spec:
automountServiceAccountToken: false
{% if 'engine' in component %}
terminationGracePeriodSeconds: 300
initContainers:
- name: db-sync
image: vexxhost/heat-{{ component }}:latest
imagePullPolicy: Always
command:
- heat-manage
- db_sync
volumeMounts:
- mountPath: /etc/heat
name: config
- name: service-clean
image: vexxhost/heat-{{ component }}:latest
imagePullPolicy: Always
command:
- heat-manage
- service
- clean
volumeMounts:
- mountPath: /etc/heat
name: config
{% endif %}
containers:
- name: heat-{{ component }}
image: vexxhost/heat-{{ component }}:latest
imagePullPolicy: Always
env:
- name: OS_DEFAULT__HOST
valueFrom:
fieldRef:
fieldPath: spec.nodeName
{% if env is defined %}
{% for v in env %}
- name: "{{ v.name }}"
value: "{{ v.value }}"
{% endfor %}
{% endif %}
{% if 'api' in component %}
ports:
- name: heat-{{ component }}
protocol: TCP
containerPort: {% if component == 'api' %}8004{% else %}8000{% endif%}
livenessProbe:
tcpSocket:
port: heat-{{ component }}
readinessProbe:
tcpSocket:
port: heat-{{ component }}
lifecycle:
preStop:
exec:
command: ["/bin/sleep", "5"]
{% endif %}
securityContext:
runAsUser: 65534
runAsGroup: 65534
volumeMounts:
- mountPath: /etc/heat
name: config
- name: uwsgi-config
mountPath: /etc/uwsgi
volumes:
- name: config
secret:
secretName: heat-config
- name: uwsgi-config
configMap:
defaultMode: 420
name: uwsgi-default
{% if 'nodeSelector' in spec %}
nodeSelector:
{{ spec.nodeSelector | to_yaml | indent(8) }}
{% endif %}
{% if 'tolerations' in spec %}
tolerations:
{{ spec.tolerations | to_yaml | indent(8) }}
{% endif %}
{% if 'hostAliases' in spec %}
hostAliases:
{{ spec.hostAliases | to_yaml | indent(8) }}
{% endif %}