kubernetes/aai/components/aai-schema-service/templates/deployment.yaml

   1 {{/*
   2 # Copyright © 2017 Amdocs, Bell Canada
   3 # Modifications Copyright © 2018 AT&T
   4 # Modifications Copyright © 2020 Orange
   5 #
   6 # Licensed under the Apache License, Version 2.0 (the "License");
   7 # you may not use this file except in compliance with the License.
   8 # You may obtain a copy of the License at
   9 #
  10 #       http://www.apache.org/licenses/LICENSE-2.0
  11 #
  12 # Unless required by applicable law or agreed to in writing, software
  13 # distributed under the License is distributed on an "AS IS" BASIS,
  14 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  15 # See the License for the specific language governing permissions and
  16 # limitations under the License.
  17 */}}
  18
  19 apiVersion: apps/v1
  20 kind: Deployment
  21 metadata:
  22   name: {{ include "common.fullname" . }}
  23   namespace: {{ include "common.namespace" . }}
  24   labels:
  25     app: {{ include "common.name" . }}
  26     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
  27     release: {{ include "common.release" . }}
  28     heritage: {{ .Release.Service }}
  29 spec:
  30   replicas: {{ .Values.replicaCount }}
  31   selector:
  32     matchLabels:
  33       app: {{ include "common.name" . }}
  34   template:
  35     metadata:
  36       labels:
  37         app: {{ include "common.name" . }}
  38         release: {{ include "common.release" . }}
  39       name: {{ include "common.name" . }}
  40       annotations:
  41         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
  42     spec:
  43       {{- if .Values.global.aafEnabled }}
  44       initContainers: {{ include "common.certInitializer.initContainer" . | nindent 6 }}
  45       - command:
  46         - sh
  47         args:
  48         - -c
  49         - |
  50           echo "*** retrieve Truststore and Keystore password"
  51           export $(cat {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop | xargs -0)
  52           echo "*** obfuscate them "
  53           export KEYSTORE_PLAIN_PASSWORD=${KEYSTORE_PLAIN_PASSWORD}
  54           export TRUSTSTORE_PLAIN_PASSWORD=${TRUSTSTORE_PLAIN_PASSWORD}
  55           export KEYSTORE_PASSWORD=`java -cp /usr/local/jetty/lib/jetty-util-9.4.44.v20210927.jar org.eclipse.jetty.util.security.Password ${KEYSTORE_PLAIN_PASSWORD} 2>&1 | grep "OBF:"`
  56           export TRUSTSTORE_PASSWORD=`java -cp /usr/local/jetty/lib/jetty-util-9.4.44.v20210927.jar org.eclipse.jetty.util.security.Password ${TRUSTSTORE_PLAIN_PASSWORD} 2>&1 | grep "OBF:"`
  57           echo "KEYSTORE_PASSWORD=${KEYSTORE_PASSWORD}" >> {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop
  58           echo "TRUSTSTORE_PASSWORD=${TRUSTSTORE_PASSWORD}" >> {{ .Values.certInitializer.appMountPath }}/local/mycreds.prop
  59         image: {{ include "repositoryGenerator.image.jetty" . }}
  60         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  61         name: {{ include "common.name" . }}-obfuscate
  62         volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 8 }}
  63         securityContext:
  64           runAsUser: {{ .Values.securityContext.user_id }}
  65       {{- end }}
  66       containers:
  67       - name: {{ include "common.name" . }}
  68         image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
  69         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  70         {{- if .Values.global.aafEnabled }}
  71         command:
  72         - sh
  73         args:
  74         - -c
  75         - |
  76           echo "*** retrieve Truststore and Keystore password"
  77           export $(cat {{ .Values.certInitializer.credsPath }}/mycreds.prop | xargs -0)
  78           echo "keystore pass: $KEYSTORE_PASSWORD"
  79           echo "truststore pass: $TRUSTSTORE_PASSWORD"
  80           echo "*** actual launch of AAI Schema Service"
  81           /bin/bash /opt/app/aai-schema-service/docker-entrypoint.sh
  82         {{- end }}
  83         env:
  84         - name: LOCAL_USER_ID
  85           value: {{ .Values.securityContext.user_id | quote }}
  86         - name: LOCAL_GROUP_ID
  87           value: {{ .Values.securityContext.group_id | quote }}
  88         volumeMounts: {{ include "common.certInitializer.volumeMount" . | nindent 8 }}
  89         - mountPath: /etc/localtime
  90           name: localtime
  91           readOnly: true
  92         - mountPath: /opt/app/aai-schema-service/resources/etc/appprops/aaiconfig.properties
  93           name: aaiconfig-conf
  94           subPath: aaiconfig.properties
  95         - mountPath: /opt/aai/logroot/AAI-SS
  96           name: logs
  97         - mountPath: /opt/app/aai-schema-service/resources/logback.xml
  98           name: log-conf
  99           subPath: logback.xml
 100         - mountPath: /opt/app/aai-schema-service/resources/localhost-access-logback.xml
 101           name: localhost-access-log-conf
 102           subPath: localhost-access-logback.xml
 103         - mountPath: /opt/app/aai-schema-service/resources/etc/auth/realm.properties
 104           name: realm-conf
 105           subPath: realm.properties
 106         - mountPath: /opt/app/aai-schema-service/resources/application.properties
 107           name: springapp-conf
 108           subPath: application.properties
 109         ports:
 110         - containerPort: {{ .Values.service.internalPort }}
 111         - containerPort: {{ .Values.service.internalPort2 }}
 112         # disable liveness probe when breakpoints set in debugger
 113         # so K8s doesn't restart unresponsive container
 114         {{ if .Values.liveness.enabled }}
 115         livenessProbe:
 116           tcpSocket:
 117             port: {{ .Values.service.internalPort }}
 118           initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
 119           periodSeconds: {{ .Values.liveness.periodSeconds }}
 120         {{ end }}
 121         readinessProbe:
 122           tcpSocket:
 123             port: {{ .Values.service.internalPort }}
 124           initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
 125           periodSeconds: {{ .Values.readiness.periodSeconds }}
 126         resources:
 127 {{ include "common.resources" . | indent 12 }}
 128       {{- if .Values.nodeSelector }}
 129       nodeSelector:
 130 {{ toYaml .Values.nodeSelector | indent 8 }}
 131       {{- end -}}
 132       {{- if .Values.affinity }}
 133       affinity:
 134 {{ toYaml .Values.affinity | indent 8 }}
 135       {{- end }}
 136
 137       # side car containers
 138       {{ include "common.log.sidecar" . | nindent 6 }}
 139       serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . )}}
 140       volumes: {{ include "common.certInitializer.volumes" . | nindent 6 }}
 141       - name: aai-common-aai-auth-mount
 142         secret:
 143           secretName: aai-common-aai-auth
 144       - name: localtime
 145         hostPath:
 146           path: /etc/localtime
 147       - name: logs
 148         emptyDir: {}
 149       {{ include "common.log.volumes" (dict "dot" . "configMapNamePrefix" (tpl .Values.logConfigMapNamePrefix .)) | nindent 6 }}
 150       - name: log-conf
 151         configMap:
 152           name: {{ include "common.fullname" . }}-log
 153       - name: localhost-access-log-conf
 154         configMap:
 155           name: {{ include "common.fullname" . }}-localhost-access-log
 156       - name: springapp-conf
 157         configMap:
 158           name: {{ include "common.fullname" . }}-springapp
 159       - name: aaiconfig-conf
 160         configMap:
 161           name: {{ include "common.fullname" . }}-aaiconfig
 162       - name: realm-conf
 163         configMap:
 164           name: {{ include "common.fullname" . }}-realm
 165       restartPolicy: {{ .Values.restartPolicy }}
 166       imagePullSecrets:
 167       - name: "{{ include "common.namespace" . }}-docker-registry-key"