282 lines
13 KiB
YAML
282 lines
13 KiB
YAML
{{- if (or (and (ne (.Values.client.enabled | toString) "-") .Values.client.enabled) (and (eq (.Values.client.enabled | toString) "-") .Values.global.enabled)) }}
|
|
{{- if or (and .Values.client.snapshotAgent.configSecret.secretName (not .Values.client.snapshotAgent.configSecret.secretKey)) (and (not .Values.client.snapshotAgent.configSecret.secretName) .Values.client.snapshotAgent.configSecret.secretKey) }}{{fail "client.snapshotAgent.configSecret.secretKey and client.snapshotAgent.configSecret.secretName must both be specified." }}{{ end -}}
|
|
{{- if .Values.client.snapshotAgent.enabled }}
|
|
{{- if or (and .Values.client.snapshotAgent.configSecret.secretName (not .Values.client.snapshotAgent.configSecret.secretKey)) (and (not .Values.client.snapshotAgent.configSecret.secretName) .Values.client.snapshotAgent.configSecret.secretKey) }}{{fail "client.snapshotAgent.configSecret.secretKey and client.snapshotAgent.configSecret.secretName must both be specified." }}{{ end -}}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ template "consul.fullname" . }}-snapshot-agent
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
heritage: {{ .Release.Service }}
|
|
release: {{ .Release.Name }}
|
|
component: client-snapshot-agent
|
|
spec:
|
|
replicas: {{ .Values.client.snapshotAgent.replicas }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
release: {{ .Release.Name }}
|
|
component: client-snapshot-agent
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
release: {{ .Release.Name }}
|
|
component: client-snapshot-agent
|
|
annotations:
|
|
"consul.hashicorp.com/connect-inject": "false"
|
|
{{- if .Values.global.secretsBackend.vault.enabled }}
|
|
{{- if .Values.client.snapshotAgent.configSecret.secretName }}
|
|
"vault.hashicorp.com/role": {{ .Values.global.secretsBackend.vault.consulSnapshotAgentRole }}
|
|
{{- else if and .Values.global.tls.enabled }}
|
|
"vault.hashicorp.com/role": {{ .Values.global.secretsBackend.vault.consulCARole }}
|
|
{{- end }}
|
|
{{- if .Values.global.tls.enabled }}
|
|
"vault.hashicorp.com/agent-init-first": "true"
|
|
"vault.hashicorp.com/agent-inject": "true"
|
|
"vault.hashicorp.com/agent-inject-secret-serverca.crt": {{ .Values.global.tls.caCert.secretName }}
|
|
"vault.hashicorp.com/agent-inject-template-serverca.crt": {{ template "consul.serverTLSCATemplate" . }}
|
|
{{- if and .Values.global.secretsBackend.vault.ca.secretName .Values.global.secretsBackend.vault.ca.secretKey }}
|
|
"vault.hashicorp.com/agent-extra-secret": "{{ .Values.global.secretsBackend.vault.ca.secretName }}"
|
|
"vault.hashicorp.com/ca-cert": "/vault/custom/{{ .Values.global.secretsBackend.vault.ca.secretKey }}"
|
|
{{- end }}
|
|
{{- if .Values.global.secretsBackend.vault.agentAnnotations }}
|
|
{{ tpl .Values.global.secretsBackend.vault.agentAnnotations . | nindent 8 | trim }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.global.enterpriseLicense.secretName }}
|
|
{{- with .Values.global.enterpriseLicense }}
|
|
"vault.hashicorp.com/agent-inject-secret-enterpriselicense.txt": "{{ .secretName }}"
|
|
"vault.hashicorp.com/agent-inject-template-enterpriselicense.txt": {{ template "consul.vaultSecretTemplate" . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.client.snapshotAgent.configSecret.secretName }}
|
|
{{- with .Values.client.snapshotAgent.configSecret }}
|
|
"vault.hashicorp.com/agent-inject-secret-snapshot-agent-config.json": "{{ .secretName }}"
|
|
"vault.hashicorp.com/agent-inject-template-snapshot-agent-config.json": {{ template "consul.vaultSecretTemplate" . }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
spec:
|
|
{{- if .Values.client.tolerations }}
|
|
tolerations:
|
|
{{ tpl .Values.client.tolerations . | nindent 8 | trim }}
|
|
{{- end }}
|
|
terminationGracePeriodSeconds: 10
|
|
serviceAccountName: {{ template "consul.fullname" . }}-snapshot-agent
|
|
{{- if .Values.client.priorityClassName }}
|
|
priorityClassName: {{ .Values.client.priorityClassName | quote }}
|
|
{{- end }}
|
|
volumes:
|
|
{{- if .Values.client.snapshotAgent.caCert }}
|
|
- name: extra-ssl-certs
|
|
emptyDir:
|
|
medium: "Memory"
|
|
{{- end }}
|
|
{{- if (or .Values.global.acls.manageSystemACLs .Values.global.tls.enabled (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload)) }}
|
|
- name: consul-data
|
|
emptyDir:
|
|
medium: "Memory"
|
|
{{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey (not .Values.global.secretsBackend.vault.enabled)) }}
|
|
- name: snapshot-config
|
|
secret:
|
|
secretName: {{ .Values.client.snapshotAgent.configSecret.secretName }}
|
|
items:
|
|
- key: {{ .Values.client.snapshotAgent.configSecret.secretKey }}
|
|
path: snapshot-config.json
|
|
{{- end }}
|
|
{{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload (not .Values.global.secretsBackend.vault.enabled) (not .Values.global.acls.manageSystemACLs)) }}
|
|
- name: consul-license
|
|
secret:
|
|
secretName: {{ .Values.global.enterpriseLicense.secretName }}
|
|
{{- end }}
|
|
{{- if .Values.global.tls.enabled }}
|
|
{{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
|
|
- name: consul-ca-cert
|
|
secret:
|
|
{{- if .Values.global.tls.caCert.secretName }}
|
|
secretName: {{ .Values.global.tls.caCert.secretName }}
|
|
{{- else }}
|
|
secretName: {{ template "consul.fullname" . }}-ca-cert
|
|
{{- end }}
|
|
items:
|
|
- key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
|
|
path: tls.crt
|
|
{{- end }}
|
|
{{- if .Values.global.tls.enableAutoEncrypt }}
|
|
- name: consul-auto-encrypt-ca-cert
|
|
emptyDir:
|
|
medium: "Memory"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
containers:
|
|
- name: consul-snapshot-agent
|
|
image: "{{ default .Values.global.image .Values.client.image }}"
|
|
env:
|
|
{{- if .Values.client.snapshotAgent.caCert }}
|
|
- name: SSL_CERT_DIR
|
|
value: "/etc/ssl/certs:/extra-ssl-certs"
|
|
{{- end }}
|
|
- name: HOST_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.hostIP
|
|
{{- if .Values.global.tls.enabled }}
|
|
- name: CONSUL_HTTP_ADDR
|
|
value: https://$(HOST_IP):8501
|
|
- name: CONSUL_CACERT
|
|
value: /consul/tls/ca/tls.crt
|
|
{{- else }}
|
|
- name: CONSUL_HTTP_ADDR
|
|
value: http://$(HOST_IP):8500
|
|
{{- end }}
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: CONSUL_HTTP_TOKEN_FILE
|
|
value: /consul/login/acl-token
|
|
{{- else }}
|
|
{{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload) }}
|
|
- name: CONSUL_LICENSE_PATH
|
|
{{- if .Values.global.secretsBackend.vault.enabled }}
|
|
value: /vault/secrets/enterpriselicense.txt
|
|
{{- else }}
|
|
value: /consul/license/{{ .Values.global.enterpriseLicense.secretKey }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
command:
|
|
- "/bin/sh"
|
|
- "-ec"
|
|
- |
|
|
{{- if .Values.client.snapshotAgent.caCert }}
|
|
cat <<EOF > /extra-ssl-certs/custom-ca.pem
|
|
{{- .Values.client.snapshotAgent.caCert | nindent 14 }}
|
|
EOF
|
|
{{- end }}
|
|
exec /bin/consul snapshot agent \
|
|
-interval={{ .Values.client.snapshotAgent.interval }} \
|
|
{{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) }}
|
|
{{- if .Values.global.secretsBackend.vault.enabled }}
|
|
-config-file=/vault/secrets/snapshot-agent-config.json \
|
|
{{- else }}
|
|
-config-dir=/consul/config \
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
-config-dir=/consul/login \
|
|
{{- end }}
|
|
volumeMounts:
|
|
{{- if .Values.client.snapshotAgent.caCert }}
|
|
- name: extra-ssl-certs
|
|
mountPath: /extra-ssl-certs
|
|
readOnly: false
|
|
{{- end }}
|
|
{{- if (or .Values.global.acls.manageSystemACLs .Values.global.tls.enabled (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey) (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload)) }}
|
|
{{- if (and .Values.client.snapshotAgent.configSecret.secretName .Values.client.snapshotAgent.configSecret.secretKey (not .Values.global.secretsBackend.vault.enabled)) }}
|
|
- name: snapshot-config
|
|
mountPath: /consul/config
|
|
readOnly: true
|
|
{{- end }}
|
|
- mountPath: /consul/login
|
|
name: consul-data
|
|
readOnly: true
|
|
{{- if (and .Values.global.enterpriseLicense.secretName .Values.global.enterpriseLicense.secretKey .Values.global.enterpriseLicense.enableLicenseAutoload (not .Values.global.secretsBackend.vault.enabled) (not .Values.global.acls.manageSystemACLs))}}
|
|
- name: consul-license
|
|
mountPath: /consul/license
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.global.tls.enabled }}
|
|
{{- if .Values.global.tls.enableAutoEncrypt}}
|
|
- name: consul-auto-encrypt-ca-cert
|
|
{{- else }}
|
|
- name: consul-ca-cert
|
|
{{- end }}
|
|
mountPath: /consul/tls/ca
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command:
|
|
- "/bin/sh"
|
|
- "-ec"
|
|
- |
|
|
/bin/consul logout
|
|
{{- end }}
|
|
{{- with .Values.client.snapshotAgent.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- if (or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt)) }}
|
|
initContainers:
|
|
{{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
|
|
{{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
|
|
{{- end }}
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: snapshot-agent-acl-init
|
|
env:
|
|
- name: HOST_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.hostIP
|
|
{{- if .Values.global.tls.enabled }}
|
|
- name: CONSUL_CACERT
|
|
value: /consul/tls/ca/tls.crt
|
|
{{- end }}
|
|
- name: CONSUL_HTTP_ADDR
|
|
{{- if .Values.global.tls.enabled }}
|
|
value: https://$(HOST_IP):8501
|
|
{{- else }}
|
|
value: http://$(HOST_IP):8500
|
|
{{- end }}
|
|
image: {{ .Values.global.imageK8S }}
|
|
volumeMounts:
|
|
- mountPath: /consul/login
|
|
name: consul-data
|
|
readOnly: false
|
|
{{- if .Values.global.tls.enabled }}
|
|
{{- if .Values.global.tls.enableAutoEncrypt }}
|
|
- name: consul-auto-encrypt-ca-cert
|
|
{{- else }}
|
|
- name: consul-ca-cert
|
|
{{- end }}
|
|
mountPath: /consul/tls/ca
|
|
readOnly: true
|
|
{{- end }}
|
|
command:
|
|
- "/bin/sh"
|
|
- "-ec"
|
|
- |
|
|
consul-k8s-control-plane acl-init \
|
|
-component-name=snapshot-agent \
|
|
-acl-auth-method={{ template "consul.fullname" . }}-k8s-component-auth-method \
|
|
{{- if .Values.global.adminPartitions.enabled }}
|
|
-partition={{ .Values.global.adminPartitions.name }} \
|
|
{{- end }}
|
|
-token-sink-file=/consul/login/acl-token \
|
|
-consul-api-timeout={{ .Values.global.consulAPITimeout }} \
|
|
-log-level={{ default .Values.global.logLevel }} \
|
|
-log-json={{ .Values.global.logJSON }}
|
|
resources:
|
|
requests:
|
|
memory: "25Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "25Mi"
|
|
cpu: "50m"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.client.nodeSelector }}
|
|
nodeSelector:
|
|
{{ tpl .Values.client.nodeSelector . | indent 8 | trim }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|