kubernetes/policy/charts/policy-xacml-pdp/templates/deployment.yaml

   1 apiVersion: apps/v1
   2 kind: Deployment
   3 metadata:
   4   name: {{ include "common.fullname" . }}
   5   namespace: {{ include "common.namespace" . }}
   6   labels:
   7     app: {{ include "common.name" . }}
   8     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
   9     release: {{ include "common.release" . }}
  10     heritage: {{ .Release.Service }}
  11 spec:
  12   selector:
  13     matchLabels:
  14       app: {{ include "common.name" . }}
  15   replicas: {{ .Values.replicaCount }}
  16   template:
  17     metadata:
  18       labels:
  19         app: {{ include "common.name" . }}
  20         release: {{ include "common.release" . }}
  21     spec:
  22       initContainers:
  23       - command:
  24         - /root/ready.py
  25         args:
  26         - --container-name
  27         - {{ include "common.release" . }}-galera-config
  28         env:
  29         - name: NAMESPACE
  30           valueFrom:
  31             fieldRef:
  32               apiVersion: v1
  33               fieldPath: metadata.namespace
  34         image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
  35         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  36         name: {{ include "common.name" . }}-readiness
  37       - command:
  38         - sh
  39         args:
  40         - -c
  41         - "export SQL_PASSWORD_BASE64=`echo -n ${SQL_PASSWORD} | base64`; cd /config-input && for PFILE in `ls -1 .`; do envsubst <${PFILE} >/config/${PFILE}; done"
  42         env:
  43         - name: RESTSERVER_USER
  44           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "login") | indent 10 }}
  45         - name: RESTSERVER_PASSWORD
  46           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "password") | indent 10 }}
  47         - name: API_USER
  48           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "api-creds" "key" "login") | indent 10 }}
  49         - name: API_PASSWORD
  50           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "api-creds" "key" "password") | indent 10 }}
  51         - name: SQL_USER
  52           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "login") | indent 10 }}
  53         - name: SQL_PASSWORD
  54           {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-secret" "key" "password") | indent 10 }}
  55         volumeMounts:
  56         - mountPath: /config-input
  57           name: pdpxconfig
  58         - mountPath: /config
  59           name: pdpxconfig-processed
  60         image: "{{ .Values.global.envsubstImage }}"
  61         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  62         name: {{ include "common.name" . }}-update-config
  63       containers:
  64         - name: {{ include "common.name" . }}
  65           image: "{{ include "common.repository" . }}/{{ .Values.image }}"
  66           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  67           command: ["/opt/app/policy/pdpx/bin/policy-pdpx.sh"]
  68           args: ["/opt/app/policy/pdpx/etc/mounted/config.json"]
  69           ports:
  70           - containerPort: {{ .Values.service.internalPort }}
  71           # disable liveness probe when breakpoints set in debugger
  72           # so K8s doesn't restart unresponsive container
  73           {{- if eq .Values.liveness.enabled true }}
  74           livenessProbe:
  75             tcpSocket:
  76               port: {{ .Values.service.internalPort }}
  77             initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
  78             periodSeconds: {{ .Values.liveness.periodSeconds }}
  79           {{ end -}}
  80           readinessProbe:
  81             tcpSocket:
  82               port: {{ .Values.service.internalPort }}
  83             initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
  84             periodSeconds: {{ .Values.readiness.periodSeconds }}
  85           volumeMounts:
  86           - mountPath: /etc/localtime
  87             name: localtime
  88             readOnly: true
  89           - mountPath: /opt/app/policy/pdpx/etc/mounted
  90             name: pdpxconfig-processed
  91             emptyDir:
  92               medium: Memory
  93           resources:
  94 {{ include "common.resources" . | indent 12 }}
  95         {{- if .Values.nodeSelector }}
  96         nodeSelector:
  97 {{ toYaml .Values.nodeSelector | indent 10 }}
  98         {{- end -}}
  99         {{- if .Values.affinity }}
 100         affinity:
 101 {{ toYaml .Values.affinity | indent 10 }}
 102         {{- end }}
 103       volumes:
 104         - name: localtime
 105           hostPath:
 106              path: /etc/localtime
 107         - name: pdpxconfig
 108           configMap:
 109             name: {{ include "common.fullname" . }}-configmap
 110             defaultMode: 0755
 111         - name: pdpxconfig-processed
 112           emptyDir:
 113             medium: Memory
 114       imagePullSecrets:
 115       - name: "{{ include "common.namespace" . }}-docker-registry-key"