rancher-partner-charts/charts/hashicorp/consul/templates/create-federation-secret-job.yaml

{{- if .Values.global.federation.createFederationSecret }}
{{- if not .Values.global.federation.enabled }}{{ fail "global.federation.enabled must be true when global.federation.createFederationSecret is true" }}{{ end }}
{{- if and (not .Values.global.acls.createReplicationToken) .Values.global.acls.manageSystemACLs }}{{ fail "global.acls.createReplicationToken must be true when global.acls.manageSystemACLs is true because the federation secret must include the replication token" }}{{ end }}
{{- if eq (int .Values.server.updatePartition) 0 }}
{{ template "consul.validateRequiredCloudSecretsExist" . }}
{{ template "consul.validateCloudSecretKeys" . }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "consul.fullname" . }}-create-federation-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "consul.name" . }}
    chart: {{ template "consul.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
    component: create-federation-secret
    {{- if .Values.global.extraLabels }}
      {{- toYaml .Values.global.extraLabels | nindent 4 }}
    {{- end }}
  annotations:
    "helm.sh/hook": post-install,post-upgrade
    {{- /* Hook weight needs to be 1 so that the service account is provisioned first */}}
    "helm.sh/hook-weight": "1"
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    metadata:
      name: {{ template "consul.fullname" . }}-create-federation-secret
      labels:
        app: {{ template "consul.name" . }}
        chart: {{ template "consul.chart" . }}
        release: {{ .Release.Name }}
        component: create-federation-secret
        {{- if .Values.global.extraLabels }}
          {{- toYaml .Values.global.extraLabels | nindent 8 }}
        {{- end }}
      annotations:
        "consul.hashicorp.com/connect-inject": "false"
    spec:
      restartPolicy: Never
      serviceAccountName: {{ template "consul.fullname" . }}-create-federation-secret
      {{- if .Values.client.tolerations }}
      tolerations:
        {{ tpl .Values.client.tolerations . | nindent 8 | trim }}
      {{- end }}
      {{- if .Values.client.priorityClassName }}
      priorityClassName: {{ .Values.client.priorityClassName | quote }}
      {{- end }}
      {{- if .Values.client.nodeSelector }}
      nodeSelector:
        {{ tpl .Values.client.nodeSelector . | indent 8 | trim }}
      {{- end }}
      volumes:
        {{- /* We can assume tls is enabled because there is a check in server-statefulset
          that requires tls to be enabled if federation is enabled. */}}
        - name: consul-ca-cert
          secret:
            {{- if .Values.global.tls.caCert.secretName }}
            secretName: {{ .Values.global.tls.caCert.secretName }}
            {{- else }}
            secretName: {{ template "consul.fullname" . }}-ca-cert
            {{- end }}
            items:
              - key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
                path: tls.crt
        - name: consul-ca-key
          secret:
            {{- if .Values.global.tls.caKey.secretName }}
            secretName: {{ .Values.global.tls.caKey.secretName }}
            {{- else }}
            secretName: {{ template "consul.fullname" . }}-ca-key
            {{- end }}
            items:
              - key: {{ default "tls.key" .Values.global.tls.caKey.secretKey }}
                path: tls.key
        {{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
        - name: gossip-encryption-key
          secret:
            secretName: {{ .Values.global.gossipEncryption.secretName }}
            items:
              - key: {{ .Values.global.gossipEncryption.secretKey }}
                path: gossip.key
        {{- else if .Values.global.gossipEncryption.autoGenerate }}
        - name: gossip-encryption-key
          secret:
            secretName: {{ template "consul.fullname" . }}-gossip-encryption-key
            items:
              - key: key
                path: gossip.key
        {{- end }}

      containers:
        - name: create-federation-secret
          image: "{{ .Values.global.imageK8S }}"
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
            - name: CONSUL_HTTP_ADDR
              value: "https://{{ template "consul.fullname" . }}-server.{{ .Release.Namespace }}.svc:8501"
            - name: CONSUL_CACERT
              value: /consul/tls/ca/tls.crt
          volumeMounts:
            - name: consul-ca-cert
              mountPath: /consul/tls/ca
              readOnly: true
            - name: consul-ca-key
              mountPath: /consul/tls/server/ca
              readOnly: true
            {{- if (or .Values.global.gossipEncryption.autoGenerate (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey)) }}
            - name: gossip-encryption-key
              mountPath: /consul/gossip
              readOnly: true
            {{- end }}
          command:
            - "/bin/sh"
            - "-ec"
            - |
                consul-k8s-control-plane create-federation-secret \
                  -log-level={{ .Values.global.logLevel }} \
                  -log-json={{ .Values.global.logJSON }} \
                  {{- if (or .Values.global.gossipEncryption.autoGenerate (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey)) }}
                  -gossip-key-file=/consul/gossip/gossip.key \
                  {{- end }}
                  {{- if .Values.global.acls.createReplicationToken }}
                  -export-replication-token=true \
                  {{- end }}
                  -mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
                  -k8s-namespace="${NAMESPACE}" \
                  -resource-prefix="{{ template "consul.fullname" . }}" \
                  -server-ca-cert-file=/consul/tls/ca/tls.crt \
                  -server-ca-key-file=/consul/tls/server/ca/tls.key \
                  -consul-api-timeout={{ .Values.global.consulAPITimeout }}
          resources:
            requests:
              memory: "50Mi"
              cpu: "50m"
            limits:
              memory: "50Mi"
              cpu: "50m"
{{- end }}
{{- end }}