Run SDC pods as non-root
[oom.git] / kubernetes / sdc / charts / sdc-dcae-tosca-lab / templates / deployment.yaml
1 # Copyright © 2017 Amdocs, AT&T, Bell Canada
2 #
3 # Licensed under the Apache License, Version 2.0 (the "License");
4 # you may not use this file except in compliance with the License.
5 # You may obtain a copy of the License at
6 #
7 #       http://www.apache.org/licenses/LICENSE-2.0
8 #
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS,
11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 # See the License for the specific language governing permissions and
13 # limitations under the License.
14
15 apiVersion: extensions/v1beta1
16 kind: Deployment
17 metadata:
18   name: {{ include "common.fullname" . }}
19   namespace: {{ include "common.namespace" . }}
20   labels:
21     app: {{ include "common.name" . }}
22     chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
23     release: {{ include "common.release" . }}
24     heritage: {{ .Release.Service }}
25 spec:
26   replicas: {{ .Values.replicaCount }}
27   template:
28     metadata:
29       labels:
30         app: {{ include "common.name" . }}
31         release: {{ include "common.release" . }}
32     spec:
33       initContainers:
34       - name: {{ include "common.name" . }}-readiness
35         command:
36         - /root/ready.py
37         args:
38         - --container-name
39         - "sdc-dcae-be"
40         env:
41         - name: NAMESPACE
42           valueFrom:
43             fieldRef:
44               apiVersion: v1
45               fieldPath: metadata.namespace
46         image: "{{ .Values.global.readinessRepository }}/{{ .Values.global.readinessImage }}"
47         imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
48
49       containers:
50         - name: {{ include "common.name" . }}
51           image: "{{ include "common.repository" . }}/{{ .Values.image }}"
52           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
53           ports:
54           - containerPort: {{ .Values.service.internalPort }}
55           - containerPort: {{ .Values.service.internalPort2 }}
56           {{ if eq .Values.liveness.enabled true }}
57           livenessProbe:
58             tcpSocket:
59               port: {{ .Values.service.internalPort2 }}
60             initialDelaySeconds: {{ .Values.liveness.initialDelaySeconds }}
61             periodSeconds: {{ .Values.liveness.periodSeconds }}
62           {{ end }}
63           readinessProbe:
64             httpGet:
65               path: /healthcheck
66               port: {{ .Values.service.internalPort }}
67             initialDelaySeconds: {{ .Values.readiness.initialDelaySeconds }}
68             periodSeconds: {{ .Values.readiness.periodSeconds }}
69           env:
70           - name: ENVNAME
71             value: {{ .Values.global.env.name }}
72           - name: JAVA_OPTIONS
73             value: {{ .Values.config.javaOptions }}
74           - name: HOST_IP
75             valueFrom:
76               fieldRef:
77                 fieldPath: status.podIP
78           volumeMounts:
79           - name: {{ include "common.fullname" . }}-environments
80             mountPath: /var/lib/jetty/chef-solo/environments/
81           - name: {{ include "common.fullname" . }}-localtime
82             mountPath: /etc/localtime
83             readOnly: true
84           - name: {{ include "common.fullname" . }}-logs
85             mountPath: /var/log/onap
86           resources:
87 {{ include "common.resources" . | indent 12 }}
88         {{- if .Values.nodeSelector }}
89         nodeSelector:
90 {{ toYaml .Values.nodeSelector | indent 10 }}
91         {{- end -}}
92         {{- if .Values.affinity }}
93         affinity:
94 {{ toYaml .Values.affinity | indent 10 }}
95         {{- end }}
96         # side car containers
97         - name: {{ include "common.name" . }}-filebeat-onap
98           image: "{{ .Values.global.loggingRepository }}/{{ .Values.global.loggingImage }}"
99           imagePullPolicy: {{ .Values.global.pullPolicy | default .Values.pullPolicy }}
100           volumeMounts:
101           - name: {{ include "common.fullname" . }}-filebeat-conf
102             mountPath: /usr/share/filebeat/filebeat.yml
103             subPath: filebeat.yml
104           - name: {{ include "common.fullname" . }}-logs
105             mountPath: /var/log/onap
106           - name: {{ include "common.fullname" . }}-data-filebeat
107             mountPath: /usr/share/filebeat/data
108       volumes:
109       - name: {{ include "common.fullname" . }}-localtime
110         hostPath:
111           path: /etc/localtime
112       - name: {{ include "common.fullname" . }}-filebeat-conf
113         configMap:
114           name: {{ include "common.release" . }}-sdc-filebeat-configmap
115       - name: {{ include "common.fullname" . }}-data-filebeat
116         emptyDir: {}
117       - name: {{ include "common.fullname" . }}-environments
118         configMap:
119           name: {{ include "common.release" . }}-sdc-environments-configmap
120           defaultMode: 0755
121       - name:  {{ include "common.fullname" . }}-logs
122         emptyDir: {}
123       imagePullSecrets:
124       - name: "{{ include "common.namespace" . }}-docker-registry-key"