helm-charts/charts/zrok2/templates/frontend-deployment.yaml at 04a85121b5d866271936f4d171a49031314d0437 · openziti/helm-charts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "zrok2.fullname" . }}-frontend
  labels:
    {{- include "zrok2.labelsFrontend" . | nindent 4 }}
spec:
  replicas: {{ .Values.frontend.replicaCount | default 1 }}
  selector:
    matchLabels:
      {{- include "zrok2.selectorLabelsFrontend" . | nindent 6 }}
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "zrok2.selectorLabelsFrontend" . | nindent 8 }}
    spec:
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "zrok2.serviceAccountName" . }}
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      initContainers:
        - name: {{ .Chart.Name }}-bootstrap-frontend
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          command: ["bootstrap-frontend.bash"]
          env:
            - name: ZROK2_ADMIN_TOKEN
              valueFrom:
                secretKeyRef:
                  name: {{ include "zrok2.fullname" . }}-admin-secret
                  key: admin-token
            - name: ZROK2_API_ENDPOINT
              value: http://{{ include "zrok2.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.controller.service.advertisedPort }}
            - name: ZITI_MGMT_API
              value: {{ .Values.ziti.advertisedHost }}:{{ .Values.ziti.advertisedPort }}
            - name: ZITI_ADMIN_USER
              valueFrom:
                secretKeyRef:
                  name:  {{ include "zrok2.fullname" . }}-ziti-mgmt-secret
                  key: admin-username
            - name: ZITI_ADMIN_PASSWORD
              valueFrom:
                secretKeyRef:
                  name:  {{ include "zrok2.fullname" . }}-ziti-mgmt-secret
                  key: admin-password
            - name: HOME
              value: /tmp
          volumeMounts:
            - name: frontend-config
              mountPath: /etc/zrok2
              subPath: frontend.yaml
              readOnly: true
            - name: bootstrap-frontend
              mountPath: /usr/local/bin/bootstrap-frontend.bash
              readOnly: true
              subPath: bootstrap-frontend.bash
            - name: ziti-ctrl-plane-cas
              mountPath: {{ .Values.ziti.ca_cert_dir }}/{{ .Values.ziti.ca_cert_file }}
              subPath: {{ .Values.ziti.ca_cert_file }}
              readOnly: true
            - name: frontend-config
              mountPath: /usr/local/bin/zitiLogin
              subPath: zitiLogin
      containers:
        - name: {{ .Chart.Name }}-frontend
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          args: ["access", "public", "/etc/zrok2/frontend.yaml"]
          env:
            - name: ZROK2_API_ENDPOINT
              value: http://{{ include "zrok2.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.controller.service.advertisedPort }}
            - name: HOME
              value: {{ .Values.frontend.homeDir }}
          volumeMounts:
            - name: frontend-config
              mountPath: /etc/zrok2
              readOnly: true
            - name: frontend-identity
              mountPath: {{ .Values.frontend.homeDir }}/.zrok2/identities
              readOnly: true
            - name: persistence
              mountPath: /var/lib/zrok2
              readOnly: false
          ports:
            - name: http
              containerPort: {{ .Values.frontend.service.containerPort }}
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 10
          readinessProbe:
            httpGet:
              path: /
              port: http
            initialDelaySeconds: 5
          resources:
            {{- toYaml .Values.resources | nindent 12 }}
      {{- with .Values.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      volumes:
        - name: frontend-config
          configMap:
            name: {{ include "zrok2.fullname" . }}-frontend-config
            defaultMode: 0444
            items:
              - key: frontend.yaml
                path: frontend.yaml
              - key: zitiLogin
                path: zitiLogin
                mode: 0555
        - name: bootstrap-frontend
          configMap:
            name: {{ include "zrok2.fullname" . }}-frontend-config
            defaultMode: 0555
            items:
              - key: bootstrap-frontend.bash
                path: bootstrap-frontend.bash
        - name: ziti-ctrl-plane-cas
          configMap:
            name: {{ .Values.ziti.ca_cert_configmap }}
            defaultMode: 0444
            items:
              - key: {{ .Values.ziti.ca_cert_file }}
                path: {{ .Values.ziti.ca_cert_file }}
        - name: frontend-identity
          secret:
            secretName: {{ include "zrok2.fullname" . }}-frontend-identity
            defaultMode: 0444
            items:
              - key: public.json
                path: public.json
        {{- if .Values.controller.persistence.enabled }}
        - name: persistence
          persistentVolumeClaim:
            claimName: {{ include "zrok2.fullname" . }}-persistence
        {{- end }}