139 lines
6.0 KiB
YAML
139 lines
6.0 KiB
YAML
{{- if .Values.global.federation.createFederationSecret }}
|
|
{{- if not .Values.global.federation.enabled }}{{ fail "global.federation.enabled must be true when global.federation.createFederationSecret is true" }}{{ end }}
|
|
{{- if and (not .Values.global.acls.createReplicationToken) .Values.global.acls.manageSystemACLs }}{{ fail "global.acls.createReplicationToken must be true when global.acls.manageSystemACLs is true because the federation secret must include the replication token" }}{{ end }}
|
|
{{- if eq (int .Values.server.updatePartition) 0 }}
|
|
{{ template "consul.validateRequiredCloudSecretsExist" . }}
|
|
{{ template "consul.validateCloudSecretKeys" . }}
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ template "consul.fullname" . }}-create-federation-secret
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
heritage: {{ .Release.Service }}
|
|
release: {{ .Release.Name }}
|
|
component: create-federation-secret
|
|
annotations:
|
|
"helm.sh/hook": post-install,post-upgrade
|
|
{{- /* Hook weight needs to be 1 so that the service account is provisioned first */}}
|
|
"helm.sh/hook-weight": "1"
|
|
"helm.sh/hook-delete-policy": hook-succeeded
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: {{ template "consul.fullname" . }}-create-federation-secret
|
|
labels:
|
|
app: {{ template "consul.name" . }}
|
|
chart: {{ template "consul.chart" . }}
|
|
release: {{ .Release.Name }}
|
|
component: create-federation-secret
|
|
annotations:
|
|
"consul.hashicorp.com/connect-inject": "false"
|
|
spec:
|
|
restartPolicy: Never
|
|
serviceAccountName: {{ template "consul.fullname" . }}-create-federation-secret
|
|
{{- if .Values.client.tolerations }}
|
|
tolerations:
|
|
{{ tpl .Values.client.tolerations . | nindent 8 | trim }}
|
|
{{- end }}
|
|
{{- if .Values.client.priorityClassName }}
|
|
priorityClassName: {{ .Values.client.priorityClassName | quote }}
|
|
{{- end }}
|
|
{{- if .Values.client.nodeSelector }}
|
|
nodeSelector:
|
|
{{ tpl .Values.client.nodeSelector . | indent 8 | trim }}
|
|
{{- end }}
|
|
volumes:
|
|
{{- /* We can assume tls is enabled because there is a check in server-statefulset
|
|
that requires tls to be enabled if federation is enabled. */}}
|
|
- name: consul-ca-cert
|
|
secret:
|
|
{{- if .Values.global.tls.caCert.secretName }}
|
|
secretName: {{ .Values.global.tls.caCert.secretName }}
|
|
{{- else }}
|
|
secretName: {{ template "consul.fullname" . }}-ca-cert
|
|
{{- end }}
|
|
items:
|
|
- key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
|
|
path: tls.crt
|
|
- name: consul-ca-key
|
|
secret:
|
|
{{- if .Values.global.tls.caKey.secretName }}
|
|
secretName: {{ .Values.global.tls.caKey.secretName }}
|
|
{{- else }}
|
|
secretName: {{ template "consul.fullname" . }}-ca-key
|
|
{{- end }}
|
|
items:
|
|
- key: {{ default "tls.key" .Values.global.tls.caKey.secretKey }}
|
|
path: tls.key
|
|
{{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
|
|
- name: gossip-encryption-key
|
|
secret:
|
|
secretName: {{ .Values.global.gossipEncryption.secretName }}
|
|
items:
|
|
- key: {{ .Values.global.gossipEncryption.secretKey }}
|
|
path: gossip.key
|
|
{{- else if .Values.global.gossipEncryption.autoGenerate }}
|
|
- name: gossip-encryption-key
|
|
secret:
|
|
secretName: {{ template "consul.fullname" . }}-gossip-encryption-key
|
|
items:
|
|
- key: key
|
|
path: gossip.key
|
|
{{- end }}
|
|
|
|
containers:
|
|
- name: create-federation-secret
|
|
image: "{{ .Values.global.imageK8S }}"
|
|
env:
|
|
- name: NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: CONSUL_HTTP_ADDR
|
|
value: "https://{{ template "consul.fullname" . }}-server.{{ .Release.Namespace }}.svc:8501"
|
|
- name: CONSUL_CACERT
|
|
value: /consul/tls/ca/tls.crt
|
|
volumeMounts:
|
|
- name: consul-ca-cert
|
|
mountPath: /consul/tls/ca
|
|
readOnly: true
|
|
- name: consul-ca-key
|
|
mountPath: /consul/tls/server/ca
|
|
readOnly: true
|
|
{{- if (or .Values.global.gossipEncryption.autoGenerate (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey)) }}
|
|
- name: gossip-encryption-key
|
|
mountPath: /consul/gossip
|
|
readOnly: true
|
|
{{- end }}
|
|
command:
|
|
- "/bin/sh"
|
|
- "-ec"
|
|
- |
|
|
consul-k8s-control-plane create-federation-secret \
|
|
-log-level={{ .Values.global.logLevel }} \
|
|
-log-json={{ .Values.global.logJSON }} \
|
|
{{- if (or .Values.global.gossipEncryption.autoGenerate (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey)) }}
|
|
-gossip-key-file=/consul/gossip/gossip.key \
|
|
{{- end }}
|
|
{{- if .Values.global.acls.createReplicationToken }}
|
|
-export-replication-token=true \
|
|
{{- end }}
|
|
-mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
|
|
-k8s-namespace="${NAMESPACE}" \
|
|
-resource-prefix="{{ template "consul.fullname" . }}" \
|
|
-server-ca-cert-file=/consul/tls/ca/tls.crt \
|
|
-server-ca-key-file=/consul/tls/server/ca/tls.key \
|
|
-consul-api-timeout={{ .Values.global.consulAPITimeout }}
|
|
resources:
|
|
requests:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
limits:
|
|
memory: "50Mi"
|
|
cpu: "50m"
|
|
{{- end }}
|
|
{{- end }}
|