deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "comet-common.names.fullname" . }}
  labels:
    {{- include "comet-common.labels.base" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
  replicas: {{ .Values.replicaCount }}
{{- end }}
  selector:
    matchLabels:
      {{- include "s3proxy.selectorLabels" . | nindent 6 }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
        checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
{{- with .Values.podAnnotations }}
        {{- toYaml . | nindent 8 }}
{{- end }}
      labels:
        {{- include "s3proxy.selectorLabels" . | nindent 8 }}
{{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
{{- end }}
    spec:
{{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
{{- end }}
      serviceAccountName: {{ include "comet-common.names.serviceAccount" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      initContainers:
        - name: merge-configs
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: {{ include "comet-common.images.image" (dict "imageRoot" .Values.configMergeImage "chart" .Chart) | quote }}
          imagePullPolicy: {{ .Values.configMergeImage.pullPolicy }}
          command: ["sh", "-c"]
          args:
            - |
              set -e
              echo "Merging configuration files..."

              # secret-common.properties holds the client-facing auth and is
              # appended to every backend file. Each backend additionally gets
              # its own secret-<backend>.properties (its jclouds.credential), so
              # one backend's credential never leaks into another's file.
              COMMON_SECRET="/secret/secret-common.properties"

              # Loop through all properties files in the config directory
              for config_file in /config/*.properties
              do
                if [ -f "$config_file" ]
                then
                  # Get the filename, e.g. backend-s3.properties
                  filename=$(basename "$config_file")
                  output_file="/merged-config/$filename"

                  echo "Processing $filename..."

                  # Copy base config file to output
                  cp "$config_file" "$output_file"

                  # Append the shared client-auth secret, if present
                  if [ -f "$COMMON_SECRET" ]
                  then
                    echo "" >> "$output_file"  # Add newline separator
                    cat "$COMMON_SECRET" >> "$output_file"
                  fi

                  # Append this backend's own secret: backend-<name>.properties
                  # pairs with secret-<name>.properties
                  backend="${filename#backend-}"
                  backend="${backend%.properties}"
                  backend_secret="/secret/secret-${backend}.properties"
                  if [ -f "$backend_secret" ]
                  then
                    echo "" >> "$output_file"  # Add newline separator
                    cat "$backend_secret" >> "$output_file"
                  fi

                  # TLS keystore password from an existing Secret (kept out of the
                  # ConfigMap). Mounted only when config.tls.keystorePassword.existingSecret
                  # is set; an inline password arrives via secret-common.properties instead.
                  if [ -f "/tls-password/keystore-password" ]
                  then
                    echo "" >> "$output_file"  # Add newline separator
                    echo "s3proxy.keystore-password=$(cat /tls-password/keystore-password)" >> "$output_file"
                  fi
                fi
              done

              echo "Configuration files merged successfully."
          volumeMounts:
            - name: config
              mountPath: /config
              readOnly: true
            - name: secret-config
              mountPath: /secret
              readOnly: true
            - name: merged-config
              mountPath: /merged-config
{{- if and .Values.config.tls.enabled .Values.config.tls.keystorePassword.existingSecret }}
            - name: tls-keystore-password
              mountPath: /tls-password
              readOnly: true
{{- end }}
      containers:
        - name: {{ .Chart.Name }}
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: {{ include "comet-common.images.image" (dict "imageRoot" .Values.image "chart" .Chart) | quote }}
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command:
            - java
          args:
            - -DLOG_LEVEL={{ .Values.config.logLevel | upper }}
            - -jar
            - /opt/s3proxy/s3proxy
{{- if .Values.config.backends.filesystem.enabled }}
            - "--properties"
            - "/merged-config/backend-filesystem.properties"
{{- end }}
{{- if .Values.config.backends.transient.enabled }}
            - "--properties"
            - "/merged-config/backend-transient.properties"
{{- end }}
{{- if .Values.config.backends.s3.enabled }}
            - "--properties"
            - "/merged-config/backend-s3.properties"
{{- end }}
{{- if .Values.config.backends.azureblob.enabled }}
            - "--properties"
            - "/merged-config/backend-azureblob.properties"
{{- end }}
{{- if .Values.config.backends.googleCloudStorage.enabled }}
            - "--properties"
            - "/merged-config/backend-google-cloud-storage.properties"
{{- end }}
{{- if .Values.config.backends.b2.enabled }}
            - "--properties"
            - "/merged-config/backend-b2.properties"
{{- end }}
{{- if .Values.config.backends.openstackSwift.enabled }}
            - "--properties"
            - "/merged-config/backend-openstack-swift.properties"
{{- end }}
{{- if .Values.config.backends.rackspaceCloudfiles.enabled }}
            - "--properties"
            - "/merged-config/backend-rackspace-cloudfiles.properties"
{{- end }}
{{- with .Values.extraEnvVars }}
          env:
            {{- toYaml . | nindent 12 }}
{{- end }}
          ports:
            - name: {{ include "s3proxy.portName" . }}
              containerPort: {{ .Values.service.targetPort }}
              protocol: TCP
          # tcpSocket probes only check the TCP accept, so they work unchanged
          # against a TLS-only port (no handshake performed).
          livenessProbe:
            tcpSocket:
              port: {{ include "s3proxy.portName" . }}
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            successThreshold: 1
            failureThreshold: 3
          readinessProbe:
            tcpSocket:
              port: {{ include "s3proxy.portName" . }}
            initialDelaySeconds: 10
            periodSeconds: 5
            timeoutSeconds: 3
            successThreshold: 1
            failureThreshold: 3
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
          volumeMounts:
            - name: merged-config
              mountPath: /merged-config
              readOnly: true
{{- if .Values.config.tls.enabled }}
            - name: tls-keystore
              mountPath: /tls
              readOnly: true
{{- end }}
{{- if .Values.config.backends.filesystem.enabled }}
  {{- if .Values.persistence.enabled }}
            - name: data
              mountPath: {{ .Values.config.backends.filesystem.basedir }}
  {{- end }}
{{- end }}
{{- if and .Values.config.backends.googleCloudStorage.enabled .Values.config.backends.googleCloudStorage.privateKey.existingSecret }}
            - name: gcp-private-key
              mountPath: /credentials/gcs-private.key
              subPath: gcs-private.key
              readOnly: true
{{- end }}
{{- with .Values.extraVolumeMounts }}
            {{- toYaml . | nindent 12 }}
{{- end }}
      volumes:
        - name: config
          configMap:
            name: {{ include "comet-common.names.fullname" . }}
        - name: secret-config
          secret:
            secretName: {{ include "comet-common.names.fullname" . }}
        - name: merged-config
          emptyDir: {}
{{- if .Values.config.tls.enabled }}
        - name: tls-keystore
          secret:
  {{- if .Values.config.tls.keystore.existingSecret }}
            secretName: {{ .Values.config.tls.keystore.existingSecret }}
            items:
              - key: {{ .Values.config.tls.keystore.secretKey }}
                path: keystore.p12
  {{- else }}
            secretName: {{ include "comet-common.names.fullname" . }}
            items:
              - key: {{ .Values.config.tls.keystore.secretKey }}
                path: keystore.p12
  {{- end }}
  {{- if .Values.config.tls.keystorePassword.existingSecret }}
        - name: tls-keystore-password
          secret:
            secretName: {{ .Values.config.tls.keystorePassword.existingSecret }}
            items:
              - key: {{ .Values.config.tls.keystorePassword.secretKey }}
                path: keystore-password
  {{- end }}
{{- end }}
{{- if .Values.config.backends.filesystem.enabled }}
  {{- if .Values.persistence.enabled }}
        - name: data
          persistentVolumeClaim:
            claimName: {{ .Values.persistence.existingClaim | default (include "comet-common.names.fullname" .) }}
  {{- end }}
{{- end }}
{{- if and .Values.config.backends.googleCloudStorage.enabled .Values.config.backends.googleCloudStorage.privateKey.existingSecret }}
        - name: gcp-private-key
          secret:
            secretName: {{ .Values.config.backends.googleCloudStorage.privateKey.existingSecret }}
            items:
              - key: {{ .Values.config.backends.googleCloudStorage.privateKey.secretKey }}
                path: gcs-private.key
{{- end }}
{{- with .Values.extraVolumes }}
        {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
{{- end }}