284 lines
12 KiB
YAML
284 lines
12 KiB
YAML
{{- if .Values.apiGateway.enabled }}
|
|
{{- if not .Values.client.grpc }}{{ fail "client.grpc must be true for api gateway" }}{{ end }}
|
|
{{- if not .Values.apiGateway.image}}{{ fail "apiGateway.image must be set to enable api gateway" }}{{ end }}
|
|
{{- if and .Values.global.adminPartitions.enabled (not .Values.global.enableConsulNamespaces) }}{{ fail "global.enableConsulNamespaces must be true if global.adminPartitions.enabled=true" }}{{ end }}
|
|
{{ template "consul.validateRequiredCloudSecretsExist" . }}
|
|
{{ template "consul.validateCloudSecretKeys" . }}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ template "consul.fullname" . }}-api-gateway-controller
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
heritage: {{ .Release.Service }}
|
|
release: {{ .Release.Name }}
|
|
component: api-gateway-controller
|
|
spec:
|
|
replicas: {{ .Values.apiGateway.controller.replicas }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
release: {{ .Release.Name }}
|
|
component: api-gateway-controller
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
consul.hashicorp.com/connect-inject: "false"
|
|
{{- if (and .Values.global.secretsBackend.vault.enabled .Values.global.tls.enabled) }}
|
|
"vault.hashicorp.com/agent-init-first": "true"
|
|
"vault.hashicorp.com/agent-inject": "true"
|
|
"vault.hashicorp.com/role": {{ .Values.global.secretsBackend.vault.consulCARole }}
|
|
"vault.hashicorp.com/agent-inject-secret-serverca.crt": {{ .Values.global.tls.caCert.secretName }}
|
|
"vault.hashicorp.com/agent-inject-template-serverca.crt": {{ template "consul.serverTLSCATemplate" . }}
|
|
{{- if .Values.global.secretsBackend.vault.agentAnnotations }}
|
|
{{ tpl .Values.global.secretsBackend.vault.agentAnnotations . | nindent 8 | trim }}
|
|
{{- end }}
|
|
{{- if and .Values.global.secretsBackend.vault.ca.secretName .Values.global.secretsBackend.vault.ca.secretKey }}
|
|
"vault.hashicorp.com/agent-extra-secret": "{{ .Values.global.secretsBackend.vault.ca.secretName }}"
|
|
"vault.hashicorp.com/ca-cert": "/vault/custom/{{ .Values.global.secretsBackend.vault.ca.secretKey }}"
|
|
{{- end }}
|
|
{{- end }}
|
|
labels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
release: {{ .Release.Name }}
|
|
component: api-gateway-controller
|
|
spec:
|
|
serviceAccountName: {{ template "consul.fullname" . }}-api-gateway-controller
|
|
containers:
|
|
- name: api-gateway-controller
|
|
image: {{ .Values.apiGateway.image }}
|
|
ports:
|
|
- containerPort: 9090
|
|
name: sds
|
|
protocol: TCP
|
|
env:
|
|
{{- if or (not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots)) .Values.client.enabled }}
|
|
{{- if .Values.global.tls.enabled }}
|
|
- name: CONSUL_CACERT
|
|
value: /consul/tls/ca/tls.crt
|
|
{{- end }}
|
|
{{- end }}
|
|
- name: HOST_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.hostIP
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: CONSUL_HTTP_TOKEN_FILE
|
|
value: "/consul/login/acl-token"
|
|
- name: CONSUL_LOGIN_DATACENTER
|
|
value: {{ .Values.global.datacenter }}
|
|
{{- end }}
|
|
- name: CONSUL_HTTP_ADDR
|
|
{{- if .Values.client.enabled }}
|
|
{{/*
|
|
We use client agent nodes if we have them to support backwards compatibility for Consul API Gateway
|
|
v0.4 and older, which requires connectivity between the registered Consul agent node and a
|
|
deployment for health checking (originating from the Consul node). Always leveraging the agents in
|
|
the case that they're explicitly opted into allows us to support users with agent node +
|
|
"externalServers" configuration upgrading a Helm chart without upgrading API gateways.
|
|
*/}}
|
|
{{- if .Values.global.tls.enabled }}
|
|
value: $(HOST_IP):8501
|
|
{{- else }}
|
|
value: $(HOST_IP):8500
|
|
{{- end }}
|
|
{{- else if .Values.externalServers.enabled }}
|
|
{{/*
|
|
"externalServers" specified and running in "agentless" mode, this will only work with
|
|
Consul API Gateway v0.5 or newer
|
|
*/}}
|
|
value: {{ first .Values.externalServers.hosts }}:{{ .Values.externalServers.httpsPort }}
|
|
{{- else }}
|
|
{{/*
|
|
We have local network connectivity between deployments and the internal cluster, this
|
|
should be supported in all versions of Consul API Gateway
|
|
*/}}
|
|
{{- if .Values.global.tls.enabled }}
|
|
value: {{ template "consul.fullname" . }}-server:8501
|
|
{{- else }}
|
|
value: {{ template "consul.fullname" . }}-server:8500
|
|
{{- end }}
|
|
{{- end }}
|
|
- name: CONSUL_HTTP_SSL
|
|
value: "{{ .Values.global.tls.enabled }}"
|
|
{{- if and .Values.externalServers.enabled .Values.externalServers.tlsServerName }}
|
|
- name: CONSUL_TLS_SERVER_NAME
|
|
value: {{ .Values.externalServers.tlsServerName }}
|
|
{{- end }}
|
|
{{- if .Values.global.adminPartitions.enabled }}
|
|
- name: CONSUL_PARTITION
|
|
value: {{ .Values.global.adminPartitions.name }}
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: CONSUL_LOGIN_PARTITION
|
|
value: {{ .Values.global.adminPartitions.name }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if not .Values.client.enabled }}
|
|
- name: CONSUL_DYNAMIC_SERVER_DISCOVERY
|
|
value: "true"
|
|
{{- end }}
|
|
command:
|
|
- "/bin/sh"
|
|
- "-ec"
|
|
- |
|
|
consul-api-gateway server \
|
|
-sds-server-host {{ template "consul.fullname" . }}-api-gateway-controller.{{ .Release.Namespace }}.svc \
|
|
-k8s-namespace {{ .Release.Namespace }} \
|
|
{{- if .Values.global.enableConsulNamespaces }}
|
|
{{- if .Values.connectInject.consulNamespaces.consulDestinationNamespace }}
|
|
-consul-destination-namespace={{ .Values.connectInject.consulNamespaces.consulDestinationNamespace }} \
|
|
{{- end }}
|
|
{{- if .Values.connectInject.consulNamespaces.mirroringK8S }}
|
|
-mirroring-k8s=true \
|
|
{{- if .Values.connectInject.consulNamespaces.mirroringK8SPrefix }}
|
|
-mirroring-k8s-prefix={{ .Values.connectInject.consulNamespaces.mirroringK8SPrefix }} \
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if and .Values.global.federation.enabled .Values.global.federation.primaryDatacenter }}
|
|
-primary-datacenter={{ .Values.global.federation.primaryDatacenter }} \
|
|
{{- end }}
|
|
-log-level {{ default .Values.global.logLevel .Values.apiGateway.logLevel }} \
|
|
-log-json={{ .Values.global.logJSON }}
|
|
volumeMounts:
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: consul-bin
|
|
mountPath: /consul-bin
|
|
{{- end }}
|
|
{{- if or (not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots)) .Values.client.enabled }}
|
|
{{- if .Values.global.tls.enabled }}
|
|
{{- if and .Values.client.enabled .Values.global.tls.enableAutoEncrypt }}
|
|
- name: consul-auto-encrypt-ca-cert
|
|
{{- else }}
|
|
- name: consul-ca-cert
|
|
{{- end }}
|
|
mountPath: /consul/tls/ca
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- end }}
|
|
- mountPath: /consul/login
|
|
name: consul-data
|
|
readOnly: true
|
|
{{- if .Values.apiGateway.resources }}
|
|
resources:
|
|
{{- toYaml .Values.apiGateway.resources | nindent 12 }}
|
|
{{- end }}
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command: [ "/bin/sh", "-ec", "/consul-bin/consul logout" ]
|
|
{{- end }}
|
|
volumes:
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: consul-bin
|
|
emptyDir: { }
|
|
{{- end }}
|
|
{{- if .Values.global.tls.enabled }}
|
|
{{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
|
|
- name: consul-ca-cert
|
|
secret:
|
|
{{- if .Values.global.tls.caCert.secretName }}
|
|
secretName: {{ .Values.global.tls.caCert.secretName }}
|
|
{{- else }}
|
|
secretName: {{ template "consul.fullname" . }}-ca-cert
|
|
{{- end }}
|
|
items:
|
|
- key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
|
|
path: tls.crt
|
|
{{- end }}
|
|
{{- if .Values.global.tls.enableAutoEncrypt }}
|
|
- name: consul-auto-encrypt-ca-cert
|
|
emptyDir:
|
|
medium: "Memory"
|
|
{{- end }}
|
|
{{- end }}
|
|
- name: consul-data
|
|
emptyDir:
|
|
medium: "Memory"
|
|
{{- if or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
|
|
initContainers:
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: copy-consul-bin
|
|
image: {{ .Values.global.image | quote }}
|
|
command:
|
|
- cp
|
|
- /bin/consul
|
|
- /consul-bin/consul
|
|
volumeMounts:
|
|
- name: consul-bin
|
|
mountPath: /consul-bin
|
|
{{- if .Values.apiGateway.initCopyConsulContainer }}
|
|
{{- if .Values.apiGateway.initCopyConsulContainer.resources }}
|
|
resources: {{ toYaml .Values.apiGateway.initCopyConsulContainer.resources | nindent 12 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
|
|
{{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
|
|
{{- end }}
|
|
{{- if .Values.global.acls.manageSystemACLs }}
|
|
- name: api-gateway-controller-acl-init
|
|
env:
|
|
- name: NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: CONSUL_LOGIN_META
|
|
value: "component=api-gateway-controller,pod=$(NAMESPACE)/$(POD_NAME)"
|
|
{{- include "consul.consulK8sConsulServerEnvVars" . | nindent 8 }}
|
|
image: {{ .Values.global.imageK8S }}
|
|
volumeMounts:
|
|
- mountPath: /consul/login
|
|
name: consul-data
|
|
readOnly: false
|
|
{{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
|
|
{{- if .Values.global.tls.enabled }}
|
|
- name: consul-ca-cert
|
|
mountPath: /consul/tls/ca
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- end }}
|
|
command:
|
|
- "/bin/sh"
|
|
- "-ec"
|
|
- |
|
|
consul-k8s-control-plane acl-init \
|
|
{{- if and .Values.global.federation.enabled .Values.global.federation.primaryDatacenter }}
|
|
-auth-method-name={{ template "consul.fullname" . }}-k8s-component-auth-method-{{ .Values.global.datacenter }} \
|
|
-datacenter={{ .Values.global.federation.primaryDatacenter }} \
|
|
{{- else }}
|
|
-auth-method-name={{ template "consul.fullname" . }}-k8s-component-auth-method \
|
|
{{- end }}
|
|
-log-level={{ default .Values.global.logLevel .Values.apiGateway.logLevel }} \
|
|
-log-json={{ .Values.global.logJSON }}
|
|
resources:
|
|
requests:
|
|
memory: "25Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "25Mi"
|
|
cpu: "50m"
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.apiGateway.controller.priorityClassName }}
|
|
priorityClassName: {{ .Values.apiGateway.controller.priorityClassName | quote }}
|
|
{{- end }}
|
|
{{- if .Values.apiGateway.controller.nodeSelector }}
|
|
nodeSelector:
|
|
{{ tpl .Values.apiGateway.controller.nodeSelector . | indent 8 | trim }}
|
|
{{- end }}
|
|
{{- if .Values.apiGateway.controller.tolerations }}
|
|
tolerations:
|
|
{{ tpl .Values.apiGateway.controller.tolerations . | indent 8 | trim }}
|
|
{{- end }}
|
|
{{- end }}
|