kubernetes/policy/components/policy-api/templates/deployment.yaml

   1 apiVersion: apps/v1
   2 kind: Deployment
   3 metadata:
   4   name: {{ include "common.fullname" . }}
   5   namespace: {{ include "common.namespace" . }}
   6   labels:
   7     app: {{ include "common.name" . }}
   8     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
   9     release: {{ include "common.release" . }}
  10     heritage: {{ .Release.Service }}
  11 spec:
  12   selector:
  13     matchLabels:
  14       app: {{ include "common.name" . }}
  15   replicas: {{ .Values.replicaCount }}
  16   template:
  17     metadata:
  18       labels:
  19         app: {{ include "common.name" . }}
  20         release: {{ include "common.release" . }}
  21     spec:
  22       initContainers:
  23         - command:
  24           - /app/ready.py
  25           args:
  26           - --job-name
  27           - {{ include "common.release" . }}-policy-galera-config
  28           env:
  29           - name: NAMESPACE
  30             valueFrom:
  31               fieldRef:
  32                 apiVersion: v1
  33                 fieldPath: metadata.namespace
  34           image: {{ include "repositoryGenerator.image.readiness" . }}
  35           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  36           name: {{ include "common.name" . }}-readiness
  37         - command:
  38           - sh
  39           args:
  40           - -c
  41           - "cd /config-input && for PFILE in `ls -1`; do envsubst <${PFILE} >/config/${PFILE}; done"
  42           env:
  43           - name: SQL_USER
  44             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-creds" "key" "login") | indent 12 }}
  45           - name: SQL_PASSWORD
  46             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "db-creds" "key" "password") | indent 12 }}
  47           - name: RESTSERVER_USER
  48             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "login") | indent 12 }}
  49           - name: RESTSERVER_PASSWORD
  50             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "restserver-creds" "key" "password") | indent 12 }}
  51           volumeMounts:
  52           - mountPath: /config-input
  53             name: apiconfig
  54           - mountPath: /config
  55             name: apiconfig-processed
  56           image: {{ include "repositoryGenerator.image.envsubst" . }}
  57           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  58           name: {{ include "common.name" . }}-update-config
  59 {{ include "common.certInitializer.initContainer" . | indent 8 }}
  60       containers:
  61         - name: {{ include "common.name" . }}
  62           image: {{ include "repositoryGenerator.repository" . }}/{{ .Values.image }}
  63           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
  64 {{- if .Values.global.aafEnabled }}
  65           command: ["sh","-c"]
  66           args: ["source {{ .Values.certInitializer.credsPath }}/.ci;\
  67                   /opt/app/policy/api/bin/policy-api.sh /opt/app/policy/api/etc/mounted/apiParameters.yaml"]
  68 {{- else }}
  69           command: ["/opt/app/policy/api/bin/policy-api.sh"]
  70           args: ["/opt/app/policy/api/etc/mounted/apiParameters.yaml"]
  71           env:
  72           - name: KEYSTORE_PASSWD
  73             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "keystore-password" "key" "password") | indent 12 }}
  74           - name: TRUSTSTORE_PASSWD
  75             {{- include "common.secret.envFromSecretFast" (dict "global" . "uid" "truststore-password" "key" "password") | indent 12 }}
  76 {{- end }}
  77           ports:
  78           - containerPort: {{ .Values.service.internalPort }}
  79           # disable liveness probe when breakpoints set in debugger
  80           # so K8s doesn't restart unresponsive container
  81           {{- if eq .Values.liveness.enabled true }}
  82           livenessProbe:
  83             tcpSocket:
  84               port: {{ .Values.service.internalPort }}
  85             initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
  86             periodSeconds: {{ .Values.liveness.periodSeconds }}
  87           {{ end -}}
  88           readinessProbe:
  89             httpGet:
  90               path: {{ .Values.readiness.api }}
  91               port: {{ .Values.service.internalPort }}
  92               httpHeaders:
  93                 - name: Authorization
  94                   value: Basic {{ printf "%s:%s" .Values.restServer.user .Values.restServer.password | b64enc }}
  95               scheme: {{ .Values.readiness.scheme }}
  96             successThreshold: {{ .Values.readiness.successThreshold }}
  97             failureThreshold: {{ .Values.readiness.failureThreshold }}
  98             initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
  99             periodSeconds: {{ .Values.readiness.periodSeconds }}
 100             timeoutSeconds: {{ .Values.readiness.timeout }}
 101           volumeMounts:
 102 {{ include "common.certInitializer.volumeMount" . | indent 10 }}
 103           - mountPath: /etc/localtime
 104             name: localtime
 105             readOnly: true
 106           - mountPath: /opt/app/policy/api/etc/mounted
 107             name: apiconfig-processed
 108           resources:
 109 {{ include "common.resources" . }}
 110         {{- if .Values.nodeSelector }}
 111         nodeSelector:
 112 {{ toYaml .Values.nodeSelector | indent 10 }}
 113         {{- end -}}
 114         {{- if .Values.affinity }}
 115         affinity:
 116 {{ toYaml .Values.affinity | indent 10 }}
 117         {{- end }}
 118       serviceAccountName: {{ include "common.fullname" (dict "suffix" "read" "dot" . )}}
 119       volumes:
 120 {{ include "common.certInitializer.volumes" . | indent 8 }}
 121         - name: localtime
 122           hostPath:
 123              path: /etc/localtime
 124         - name: apiconfig
 125           configMap:
 126             name: {{ include "common.fullname" . }}-configmap
 127             defaultMode: 0755
 128         - name: apiconfig-processed
 129           emptyDir:
 130             medium: Memory
 131       imagePullSecrets:
 132       - name: "{{ include "common.namespace" . }}-docker-registry-key"