added repo
This commit is contained in:
Your Name
@@ -0,0 +1,26 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
# img folder
|
||||
img/
|
||||
# Changelog
|
||||
CHANGELOG.md
|
||||
@@ -0,0 +1,20 @@
|
||||
annotations:
|
||||
category: Infrastructure
|
||||
licenses: Apache-2.0
|
||||
apiVersion: v2
|
||||
appVersion: 1.33.3
|
||||
description: Contour is an open source Kubernetes ingress controller that works by
|
||||
deploying the Envoy proxy as a reverse proxy and load balancer.
|
||||
home: https://projectcontour.io/
|
||||
icon: https://raw.githubusercontent.com/cncf/artwork/master/projects/contour/icon/color/contour-icon-color.svg
|
||||
keywords:
|
||||
- ingress
|
||||
- envoy
|
||||
- contour
|
||||
maintainers:
|
||||
- name: Contour Team
|
||||
- name: Meesho DevOps
|
||||
name: contour
|
||||
sources:
|
||||
- https://github.com/projectcontour/helm-charts/tree/main/charts/contour
|
||||
version: 0.4.0-meesho
|
||||
@@ -0,0 +1,572 @@
|
||||
# Helm Chart for Contour
|
||||
|
||||
A Helm chart for installing Contour.
|
||||
|
||||
This chart is a fork of Contour chart from the [Bitnami charts](https://github.com/bitnami/charts) project, which has since been discontinued.
|
||||
|
||||
|
||||
## Introduction
|
||||
|
||||
This chart bootstraps a [Contour](https://projectcontour.io) Ingress Controller Deployment and an [Envoy Proxy](https://www.envoyproxy.io) DaemonSet on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Kubernetes 1.23+
|
||||
- Helm 3.8.0+
|
||||
- An Operator for `ServiceType: LoadBalancer` like [MetalLB](https://metallb.io/)
|
||||
|
||||
## Installing the Chart
|
||||
|
||||
To install the chart with the release name `my-release`:
|
||||
|
||||
```console
|
||||
helm repo add contour https://projectcontour.github.io/helm-charts/
|
||||
helm repo update
|
||||
helm install my-release contour/contour
|
||||
```
|
||||
|
||||
These commands deploy contour on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation.
|
||||
|
||||
> **Tip**: List all releases using `helm list` or `helm ls --all-namespaces`
|
||||
|
||||
## Configuration and installation details
|
||||
|
||||
### Resource requests and limits
|
||||
|
||||
The chart allows setting resource requests and limits for all containers inside the chart deployment. These are defined in the `resources` value (see the parameters table). Setting requests is essential for production workloads and these should be adapted to your specific use case.
|
||||
|
||||
To make this process easier, the chart contains the `resourcesPreset` values, which automatically sets the `resources` section according to different presets.
|
||||
However, in production workloads using `resourcesPreset` is discouraged as it may not fully adapt to your specific needs. Find more information on container resource management in the [official Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/).
|
||||
|
||||
### Prometheus metrics
|
||||
|
||||
This chart can be integrated with Prometheus by setting `metrics.enabled` to true. This will expose the Contour and Envoy (if `envoy.service.exposeMetrics=true`) native Prometheus ports in the containers. Additionally, it will deploy several `metrics` services. These `metrics` services will have the necessary annotations to be automatically scraped by Prometheus.
|
||||
|
||||
#### Prometheus requirements
|
||||
|
||||
It is necessary to have a working installation of Prometheus or Prometheus Operator for the integration to work.
|
||||
|
||||
#### Integration with Prometheus Operator
|
||||
|
||||
The chart can deploy `ServiceMonitor` objects for integration with Prometheus Operator installations. To do so, set the value `metrics.serviceMonitor.enabled=true`. Ensure that the Prometheus Operator `CustomResourceDefinitions` are installed in the cluster or it will fail with the following error:
|
||||
|
||||
```text
|
||||
no matches for kind "ServiceMonitor" in version "monitoring.coreos.com/v1"
|
||||
```
|
||||
|
||||
### Rolling VS Immutable tags
|
||||
|
||||
It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image.
|
||||
|
||||
A new chart will be released updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist.
|
||||
|
||||
To configure [Contour](https://projectcontour.io) please look into the configuration section [Contour Configuration](https://projectcontour.io/docs/main/configuration/).
|
||||
|
||||
### Example Quickstart Contour Configuration
|
||||
|
||||
```yaml
|
||||
configInline:
|
||||
# should contour expect to be running inside a k8s cluster
|
||||
# incluster: true
|
||||
#
|
||||
# path to kubeconfig (if not running inside a k8s cluster)
|
||||
# kubeconfig: /path/to/.kube/config
|
||||
#
|
||||
# Client request timeout to be passed to Envoy
|
||||
# as the connection manager request_timeout.
|
||||
# Defaults to 0, which Envoy interprets as disabled.
|
||||
# Note that this is the timeout for the whole request,
|
||||
# not an idle timeout.
|
||||
# request-timeout: 0s
|
||||
# disable ingressroute permitInsecure field
|
||||
disablePermitInsecure: false
|
||||
tls:
|
||||
# minimum TLS version that Contour will negotiate
|
||||
# minimum-protocol-version: "1.1"
|
||||
# Defines the Kubernetes name/namespace matching a secret to use
|
||||
# as the fallback certificate when requests which don't match the
|
||||
# SNI defined for a vhost.
|
||||
fallback-certificate:
|
||||
# name: fallback-secret-name
|
||||
# namespace: projectcontour
|
||||
# The following config shows the defaults for the leader election.
|
||||
# leaderelection:
|
||||
# configmap-name: leader-elect
|
||||
# configmap-namespace: projectcontour
|
||||
### Logging options
|
||||
# Default setting
|
||||
accesslog-format: envoy
|
||||
# To enable JSON logging in Envoy
|
||||
# accesslog-format: json
|
||||
# The default fields that will be logged are specified below.
|
||||
# To customise this list, just add or remove entries.
|
||||
# The canonical list is available at
|
||||
# https://godoc.org/github.com/projectcontour/contour/internal/envoy#JSONFields
|
||||
# json-fields:
|
||||
# - "@timestamp"
|
||||
# - "authority"
|
||||
# - "bytes_received"
|
||||
# - "bytes_sent"
|
||||
# - "downstream_local_address"
|
||||
# - "downstream_remote_address"
|
||||
# - "duration"
|
||||
# - "method"
|
||||
# - "path"
|
||||
# - "protocol"
|
||||
# - "request_id"
|
||||
# - "requested_server_name"
|
||||
# - "response_code"
|
||||
# - "response_flags"
|
||||
# - "uber_trace_id"
|
||||
# - "upstream_cluster"
|
||||
# - "upstream_host"
|
||||
# - "upstream_local_address"
|
||||
# - "upstream_service_time"
|
||||
# - "user_agent"
|
||||
# - "x_forwarded_for"
|
||||
#
|
||||
# default-http-versions:
|
||||
# - "HTTP/2"
|
||||
# - "HTTP/1.1"
|
||||
#
|
||||
# The following shows the default proxy timeout settings.
|
||||
# timeouts:
|
||||
# request-timeout: infinity
|
||||
# connection-idle-timeout: 60s
|
||||
# stream-idle-timeout: 5m
|
||||
# max-connection-duration: infinity
|
||||
# connection-shutdown-grace-period: 5s
|
||||
```
|
||||
|
||||
### Deploying Contour with an AWS NLB
|
||||
|
||||
By default, Contour is launched with an AWS Classic ELB. To launch contour backed by a NLB, please set [these settings](https://github.com/projectcontour/contour/tree/master/examples/contour#deploying-with-host-networking-enabled-for-envoy):
|
||||
|
||||
```yaml
|
||||
envoy:
|
||||
service:
|
||||
annotations:
|
||||
service.beta.kubernetes.io/aws-load-balancer-type: nlb
|
||||
service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
|
||||
service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600"
|
||||
service.beta.kubernetes.io/aws-load-balancer-ssl-cert: arn:aws:acm: arn:aws:acm:XX-XXXX-X:XXXXXXXXX:certificate/XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX
|
||||
|
||||
containerPorts:
|
||||
http: 80
|
||||
https: 80
|
||||
```
|
||||
|
||||
### Setting Pod's affinity
|
||||
|
||||
This chart allows you to set your custom affinity using the `XXX.affinity` parameter(s). Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity).
|
||||
|
||||
As an alternative, you can use the preset configurations for pod affinity, pod anti-affinity, and node affinity.
|
||||
To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters.
|
||||
|
||||
## Parameters
|
||||
|
||||
### Global parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `global.imageRegistry` | Global Docker image registry | `""` |
|
||||
| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` |
|
||||
| `global.defaultStorageClass` | Global default StorageClass for Persistent Volume(s) | `""` |
|
||||
| `global.storageClass` | DEPRECATED: use global.defaultStorageClass instead | `""` |
|
||||
| `global.compatibility.openshift.adaptSecurityContext` | Adapt the securityContext sections of the deployment to make them compatible with Openshift restricted-v2 SCC: remove runAsUser, runAsGroup and fsGroup and let the platform use their allowed default IDs. Possible values: auto (apply if the detected running cluster is Openshift), force (perform the adaptation always), disabled (do not perform adaptation) | `auto` |
|
||||
|
||||
### Common parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------ | --------------------------------------------------------------------------------------- | ------- |
|
||||
| `nameOverride` | String to partially override contour.fullname include (will maintain the release name) | `""` |
|
||||
| `fullnameOverride` | String to fully override contour.fullname template | `""` |
|
||||
| `namespaceOverride` | String to fully override common.names.namespace | `""` |
|
||||
| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` |
|
||||
| `extraDeploy` | Array of extra objects to deploy with the release | `[]` |
|
||||
| `commonLabels` | Labels to add to all deployed objects | `{}` |
|
||||
| `commonAnnotations` | Annotations to add to all deployed objects | `{}` |
|
||||
| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` |
|
||||
| `diagnosticMode.command` | Command to override all containers in the deployment | `[]` |
|
||||
| `diagnosticMode.args` | Args to override all containers in the deployment | `[]` |
|
||||
|
||||
### Contour parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
|
||||
| `existingConfigMap` | Specifies the name of an externally-defined ConfigMap to use as the configuration (this is mutually exclusive with `configInline`) | `""` |
|
||||
| `configInline` | Specifies Contour's configuration directly in YAML format | `{}` |
|
||||
| `contour.enabled` | Contour Deployment creation. | `true` |
|
||||
| `contour.image.registry` | Contour image registry | `REGISTRY_NAME` |
|
||||
| `contour.image.repository` | Contour image name | `REPOSITORY_NAME/contour` |
|
||||
| `contour.image.digest` | Contour image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `contour.image.pullPolicy` | Contour Image pull policy | `IfNotPresent` |
|
||||
| `contour.image.pullSecrets` | Contour Image pull secrets | `[]` |
|
||||
| `contour.image.debug` | Enable image debug mode | `false` |
|
||||
| `contour.contourConfigName` | Contour Deployment with ContourConfiguration CRD. | `contour` |
|
||||
| `contour.configPath` | Contour Deployment with configmap. | `true` |
|
||||
| `contour.replicaCount` | Number of Contour Pod replicas | `1` |
|
||||
| `contour.priorityClassName` | Priority class assigned to the pods | `""` |
|
||||
| `contour.schedulerName` | Name of the k8s scheduler (other than default) | `""` |
|
||||
| `contour.terminationGracePeriodSeconds` | In seconds, time the given to the Contour pod needs to terminate gracefully | `""` |
|
||||
| `contour.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` |
|
||||
| `contour.containerPorts.xds` | Set xds port inside Contour pod | `8001` |
|
||||
| `contour.containerPorts.metrics` | Set metrics port inside Contour pod | `8000` |
|
||||
| `contour.automountServiceAccountToken` | Mount Service Account token in pod | `true` |
|
||||
| `contour.hostAliases` | Add deployment host aliases | `[]` |
|
||||
| `contour.updateStrategy` | Strategy to use to update Pods | `{}` |
|
||||
| `contour.extraArgs` | Extra arguments passed to Contour container | `[]` |
|
||||
| `contour.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if contour.resources is set (contour.resources is recommended for production). | `nano` |
|
||||
| `contour.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `contour.manageCRDs` | Manage the creation, upgrade and deletion of Contour CRDs. | `true` |
|
||||
| `contour.envoyServiceNamespace` | Namespace of the envoy service to inspect for Ingress status details. | `""` |
|
||||
| `contour.envoyServiceName` | DEPRECATED: use envoy.service.name | `""` |
|
||||
| `contour.leaderElectionResourceName` | Name of the contour (Lease) leader election will lease. | `""` |
|
||||
| `contour.ingressStatusAddress` | Address to set in Ingress object status. It is exclusive with `envoyServiceName` and `envoyServiceNamespace`. | `""` |
|
||||
| `contour.podAffinityPreset` | Contour Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `contour.podAntiAffinityPreset` | Contour Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` |
|
||||
| `contour.podLabels` | Extra labels for Contour pods | `{}` |
|
||||
| `contour.lifecycleHooks` | lifecycleHooks for the container to automate configuration before or after startup. | `{}` |
|
||||
| `contour.customLivenessProbe` | Override default liveness probe | `{}` |
|
||||
| `contour.customReadinessProbe` | Override default readiness probe | `{}` |
|
||||
| `contour.customStartupProbe` | Override default startup probe | `{}` |
|
||||
| `contour.nodeAffinityPreset.type` | Contour Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `contour.nodeAffinityPreset.key` | Contour Node label key to match Ignored if `affinity` is set. | `""` |
|
||||
| `contour.nodeAffinityPreset.values` | Contour Node label values to match. Ignored if `affinity` is set. | `[]` |
|
||||
| `contour.command` | Override default command | `[]` |
|
||||
| `contour.args` | Override default args | `[]` |
|
||||
| `contour.affinity` | Affinity for Contour pod assignment | `{}` |
|
||||
| `contour.nodeSelector` | Node labels for Contour pod assignment | `{}` |
|
||||
| `contour.tolerations` | Tolerations for Contour pod assignment | `[]` |
|
||||
| `contour.podAnnotations` | Contour Pod annotations | `{}` |
|
||||
| `contour.serviceAccount.create` | Create a serviceAccount for the Contour pod | `true` |
|
||||
| `contour.serviceAccount.name` | Use the serviceAccount with the specified name, a name is generated using the fullname template | `""` |
|
||||
| `contour.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` |
|
||||
| `contour.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` |
|
||||
| `contour.podSecurityContext.enabled` | Default backend Pod securityContext | `true` |
|
||||
| `contour.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
|
||||
| `contour.podSecurityContext.sysctls` | Set kernel settings using the sysctl interface | `[]` |
|
||||
| `contour.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
|
||||
| `contour.podSecurityContext.fsGroup` | Set Default backend Pod's Security Context fsGroup | `1001` |
|
||||
| `contour.containerSecurityContext.enabled` | Enabled contour containers' Security Context | `true` |
|
||||
| `contour.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
|
||||
| `contour.containerSecurityContext.runAsUser` | Set contour containers' Security Context runAsUser | `1001` |
|
||||
| `contour.containerSecurityContext.runAsGroup` | Set contour containers' Security Context runAsGroup | `1001` |
|
||||
| `contour.containerSecurityContext.runAsNonRoot` | Set contour containers' Security Context runAsNonRoot | `true` |
|
||||
| `contour.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` |
|
||||
| `contour.containerSecurityContext.privileged` | Set contour container's Security Context privileged | `false` |
|
||||
| `contour.containerSecurityContext.allowPrivilegeEscalation` | Set contour container's Security Context allowPrivilegeEscalation | `false` |
|
||||
| `contour.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
|
||||
| `contour.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `contour.livenessProbe.enabled` | Enable/disable the Liveness probe | `true` |
|
||||
| `contour.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | `120` |
|
||||
| `contour.livenessProbe.periodSeconds` | How often to perform the probe | `20` |
|
||||
| `contour.livenessProbe.timeoutSeconds` | When the probe times out | `5` |
|
||||
| `contour.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `6` |
|
||||
| `contour.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` |
|
||||
| `contour.readinessProbe.enabled` | Enable/disable the readiness probe | `true` |
|
||||
| `contour.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `15` |
|
||||
| `contour.readinessProbe.periodSeconds` | How often to perform the probe | `10` |
|
||||
| `contour.readinessProbe.timeoutSeconds` | When the probe times out | `5` |
|
||||
| `contour.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` |
|
||||
| `contour.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` |
|
||||
| `contour.startupProbe.enabled` | Enable/disable the startup probe | `false` |
|
||||
| `contour.startupProbe.initialDelaySeconds` | Delay before startup probe is initiated | `15` |
|
||||
| `contour.startupProbe.periodSeconds` | How often to perform the probe | `10` |
|
||||
| `contour.startupProbe.timeoutSeconds` | When the probe times out | `5` |
|
||||
| `contour.startupProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` |
|
||||
| `contour.startupProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` |
|
||||
| `contour.certgen.serviceAccount.create` | Create a serviceAccount for the Contour pod | `true` |
|
||||
| `contour.certgen.serviceAccount.name` | Use the serviceAccount with the specified name, a name is generated using the fullname template | `""` |
|
||||
| `contour.certgen.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` |
|
||||
| `contour.certgen.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` |
|
||||
| `contour.certgen.certificateLifetime` | Generated certificate lifetime (in days). | `365` |
|
||||
| `contour.certgen.automountServiceAccountToken` | Mount Service Account token in pod | `true` |
|
||||
| `contour.certgen.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `contour.certgen.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `contour.certgen.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `contour.certgen.networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` |
|
||||
| `contour.certgen.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `contour.certgen.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `contour.certgen.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `contour.certgen.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `contour.tlsExistingSecret` | Name of the existingSecret to be use in Contour deployment. If it is not nil `contour.certgen` will be disabled. | `""` |
|
||||
| `contour.service.type` | Service type | `ClusterIP` |
|
||||
| `contour.service.ports.xds` | Contour service xds port | `8001` |
|
||||
| `contour.service.ports.metrics` | Contour service xds port | `8000` |
|
||||
| `contour.service.nodePorts.xds` | Node port for HTTP | `""` |
|
||||
| `contour.service.clusterIP` | Contour service Cluster IP | `""` |
|
||||
| `contour.service.loadBalancerIP` | Contour service Load Balancer IP | `""` |
|
||||
| `contour.service.loadBalancerSourceRanges` | Contour service Load Balancer sources | `[]` |
|
||||
| `contour.service.loadBalancerClass` | Contour service Load Balancer Class | `""` |
|
||||
| `contour.service.externalTrafficPolicy` | Contour service external traffic policy | `Cluster` |
|
||||
| `contour.service.annotations` | Additional custom annotations for Contour service | `{}` |
|
||||
| `contour.service.extraPorts` | Extra port to expose on Contour service | `[]` |
|
||||
| `contour.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` |
|
||||
| `contour.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `contour.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `contour.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `contour.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `contour.networkPolicy.kubeAPIServerPorts` | List of possible endpoints to kube-apiserver (limit to your cluster settings to increase security) | `[]` |
|
||||
| `contour.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `contour.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `contour.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `contour.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `contour.initContainers` | Attach additional init containers to Contour pods | `[]` |
|
||||
| `contour.sidecars` | Add additional sidecar containers to the Contour pods | `[]` |
|
||||
| `contour.extraVolumes` | Array to add extra volumes | `[]` |
|
||||
| `contour.extraVolumeMounts` | Array to add extra mounts (normally used with extraVolumes) | `[]` |
|
||||
| `contour.extraEnvVars` | Array containing extra env vars to be added to all Contour containers | `[]` |
|
||||
| `contour.extraEnvVarsCM` | ConfigMap containing extra env vars to be added to all Contour containers | `""` |
|
||||
| `contour.extraEnvVarsSecret` | Secret containing extra env vars to be added to all Contour containers | `""` |
|
||||
| `contour.ingressClass.name` | Name of the ingress class to route through this controller. | `""` |
|
||||
| `contour.ingressClass.create` | Whether to create or not the IngressClass resource | `true` |
|
||||
| `contour.ingressClass.default` | Mark IngressClass resource as default for cluster | `true` |
|
||||
| `contour.debug` | Enable Contour debug log level | `false` |
|
||||
| `contour.logFormat` | Set contour log-format. Default text, either text or json. | `text` |
|
||||
| `contour.kubernetesDebug` | Contour kubernetes debug log level, Default 0, minimum 0, maximum 9. | `0` |
|
||||
| `contour.rootNamespaces` | Restrict Contour to searching these namespaces for root ingress routes. | `""` |
|
||||
| `contour.overloadManager.enabled` | Enable Overload Manager | `false` |
|
||||
| `contour.overloadManager.maxHeapBytes` | Overload Manager's maximum heap size in bytes | `2147483648` |
|
||||
| `contour.pdb.create` | Enable Pod Disruption Budget configuration | `true` |
|
||||
| `contour.pdb.minAvailable` | Minimum number/percentage of Default backend pods that should remain scheduled | `""` |
|
||||
| `contour.pdb.maxUnavailable` | Maximum number/percentage of Default backend pods that should remain scheduled | `""` |
|
||||
|
||||
### Envoy parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------- |
|
||||
| `envoy.enabled` | Envoy Proxy creation | `true` |
|
||||
| `envoy.image.registry` | Envoy Proxy image registry | `REGISTRY_NAME` |
|
||||
| `envoy.image.repository` | Envoy Proxy image repository | `REPOSITORY_NAME/envoy` |
|
||||
| `envoy.image.digest` | Envoy Proxy image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
|
||||
| `envoy.image.pullPolicy` | Envoy image pull policy | `IfNotPresent` |
|
||||
| `envoy.image.pullSecrets` | Envoy image pull secrets | `[]` |
|
||||
| `envoy.priorityClassName` | Priority class assigned to the pods | `""` |
|
||||
| `envoy.schedulerName` | Name of the k8s scheduler (other than default) | `""` |
|
||||
| `envoy.topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` |
|
||||
| `envoy.extraArgs` | Extra arguments passed to Envoy container | `[]` |
|
||||
| `envoy.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
|
||||
| `envoy.hostAliases` | Add deployment host aliases | `[]` |
|
||||
| `envoy.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if envoy.resources is set (envoy.resources is recommended for production). | `nano` |
|
||||
| `envoy.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `envoy.command` | Override default command | `[]` |
|
||||
| `envoy.args` | Override default args | `[]` |
|
||||
| `envoy.shutdownManager.enabled` | Contour shutdownManager sidecar | `true` |
|
||||
| `envoy.shutdownManager.extraArgs` | Extra arguments passed to shutdown container | `[]` |
|
||||
| `envoy.shutdownManager.resourcesPreset` | Set container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if envoy.shutdownManager.resources is set (envoy.shutdownManager.resources is recommended for production). | `nano` |
|
||||
| `envoy.shutdownManager.resources` | Set container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
| `envoy.shutdownManager.containerPorts.http` | Specify Port for shutdown container | `8090` |
|
||||
| `envoy.shutdownManager.lifecycleHooks` | lifecycleHooks for the container to automate configuration before or after startup. | `{}` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.enabled` | Enabled envoy shutdownManager containers' Security Context | `true` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.runAsUser` | Set envoy shutdownManager containers' Security Context runAsUser | `1001` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.runAsGroup` | Set contour containers' Security Context runAsGroup | `1001` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.runAsNonRoot` | Set envoy shutdownManager containers' Security Context runAsNonRoot | `true` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.privileged` | Set envoy.shutdownManager container's Security Context privileged | `false` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.allowPrivilegeEscalation` | Set envoy shutdownManager container's Security Context allowPrivilegeEscalation | `false` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
|
||||
| `envoy.shutdownManager.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `envoy.shutdownManager.livenessProbe.enabled` | Enable livenessProbe | `true` |
|
||||
| `envoy.shutdownManager.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `120` |
|
||||
| `envoy.shutdownManager.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` |
|
||||
| `envoy.shutdownManager.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `envoy.shutdownManager.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` |
|
||||
| `envoy.shutdownManager.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `envoy.shutdownManager.readinessProbe.enabled` | Enable/disable the readiness probe | `true` |
|
||||
| `envoy.shutdownManager.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `10` |
|
||||
| `envoy.shutdownManager.readinessProbe.periodSeconds` | How often to perform the probe | `3` |
|
||||
| `envoy.shutdownManager.readinessProbe.timeoutSeconds` | When the probe times out | `1` |
|
||||
| `envoy.shutdownManager.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` |
|
||||
| `envoy.shutdownManager.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` |
|
||||
| `envoy.shutdownManager.startupProbe.enabled` | Enable/disable the startup probe | `false` |
|
||||
| `envoy.shutdownManager.startupProbe.initialDelaySeconds` | Delay before startup probe is initiated | `15` |
|
||||
| `envoy.shutdownManager.startupProbe.periodSeconds` | How often to perform the probe | `10` |
|
||||
| `envoy.shutdownManager.startupProbe.timeoutSeconds` | When the probe times out | `5` |
|
||||
| `envoy.shutdownManager.startupProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` |
|
||||
| `envoy.shutdownManager.startupProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` |
|
||||
| `envoy.shutdownManager.customLivenessProbe` | Override default liveness probe | `{}` |
|
||||
| `envoy.shutdownManager.customReadinessProbe` | Override default readiness probe | `{}` |
|
||||
| `envoy.shutdownManager.customStartupProbe` | Override default startup probe | `{}` |
|
||||
| `envoy.kind` | Install as deployment or daemonset | `daemonset` |
|
||||
| `envoy.replicaCount` | Desired number of Controller pods | `1` |
|
||||
| `envoy.lifecycleHooks` | lifecycleHooks for the container to automate configuration before or after startup. | `{}` |
|
||||
| `envoy.updateStrategy` | Strategy to use to update Pods | `{}` |
|
||||
| `envoy.minReadySeconds` | The minimum number of seconds for which a newly created Pod should be ready | `0` |
|
||||
| `envoy.revisionHistoryLimit` | The number of old history to retain to allow rollback | `10` |
|
||||
| `envoy.autoscaling.enabled` | Enable autoscaling for Controller | `false` |
|
||||
| `envoy.autoscaling.minReplicas` | Minimum number of Controller replicas | `1` |
|
||||
| `envoy.autoscaling.maxReplicas` | Maximum number of Controller replicas | `11` |
|
||||
| `envoy.autoscaling.targetCPU` | Target CPU utilization percentage | `""` |
|
||||
| `envoy.autoscaling.targetMemory` | Target Memory utilization percentage | `""` |
|
||||
| `envoy.autoscaling.behavior` | HPA Behavior | `{}` |
|
||||
| `envoy.podAffinityPreset` | Envoy Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `envoy.podAntiAffinityPreset` | Envoy Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `envoy.nodeAffinityPreset.type` | Envoy Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` |
|
||||
| `envoy.nodeAffinityPreset.key` | Envoy Node label key to match Ignored if `affinity` is set. | `""` |
|
||||
| `envoy.nodeAffinityPreset.values` | Envoy Node label values to match. Ignored if `affinity` is set. | `[]` |
|
||||
| `envoy.affinity` | Affinity for Envoy pod assignment | `{}` |
|
||||
| `envoy.nodeSelector` | Node labels for Envoy pod assignment | `{}` |
|
||||
| `envoy.tolerations` | Tolerations for Envoy pod assignment | `[]` |
|
||||
| `envoy.podAnnotations` | Envoy Pod annotations | `{}` |
|
||||
| `envoy.podLabels` | Extra labels for Envoy pods | `{}` |
|
||||
| `envoy.podSecurityContext.enabled` | Envoy Pod securityContext | `true` |
|
||||
| `envoy.podSecurityContext.fsGroupChangePolicy` | Set filesystem group change policy | `Always` |
|
||||
| `envoy.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
|
||||
| `envoy.podSecurityContext.fsGroup` | User ID for the for the mounted volumes | `0` |
|
||||
| `envoy.podSecurityContext.sysctls` | Array of sysctl options to allow | `[]` |
|
||||
| `envoy.containerSecurityContext.enabled` | Enabled envoy containers' Security Context | `true` |
|
||||
| `envoy.containerSecurityContext.seLinuxOptions` | Set SELinux options in container | `{}` |
|
||||
| `envoy.containerSecurityContext.runAsUser` | Set envoy containers' Security Context runAsUser | `1001` |
|
||||
| `envoy.containerSecurityContext.runAsGroup` | Set envoy containers' Security Context runAsGroup | `1001` |
|
||||
| `envoy.containerSecurityContext.runAsNonRoot` | Set envoy containers' Security Context runAsNonRoot | `true` |
|
||||
| `envoy.containerSecurityContext.readOnlyRootFilesystem` | Set read only root file system pod's Security Conte | `true` |
|
||||
| `envoy.containerSecurityContext.privileged` | Set envoy container's Security Context privileged | `false` |
|
||||
| `envoy.containerSecurityContext.allowPrivilegeEscalation` | Set envoy container's Security Context allowPrivilegeEscalation | `false` |
|
||||
| `envoy.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped | `["ALL"]` |
|
||||
| `envoy.containerSecurityContext.seccompProfile.type` | Set container's Security Context seccomp profile | `RuntimeDefault` |
|
||||
| `envoy.hostNetwork` | Envoy Pod host network access | `false` |
|
||||
| `envoy.dnsPolicy` | Envoy Pod Dns Policy's DNS Policy | `ClusterFirst` |
|
||||
| `envoy.tlsExistingSecret` | Name of the existingSecret to be use in Envoy deployment | `""` |
|
||||
| `envoy.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
|
||||
| `envoy.serviceAccount.name` | The name of the ServiceAccount to use. If not set and create is true, a name is generated using the fullname template | `""` |
|
||||
| `envoy.serviceAccount.automountServiceAccountToken` | Whether to auto mount API credentials for a service account | `false` |
|
||||
| `envoy.serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` |
|
||||
| `envoy.livenessProbe.enabled` | Enable livenessProbe | `true` |
|
||||
| `envoy.livenessProbe.port` | LivenessProbe port | `8002` |
|
||||
| `envoy.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `120` |
|
||||
| `envoy.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `20` |
|
||||
| `envoy.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` |
|
||||
| `envoy.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `6` |
|
||||
| `envoy.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` |
|
||||
| `envoy.readinessProbe.enabled` | Enable/disable the readiness probe | `true` |
|
||||
| `envoy.readinessProbe.port` | ReadinessProbe port | `8002` |
|
||||
| `envoy.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated | `10` |
|
||||
| `envoy.readinessProbe.periodSeconds` | How often to perform the probe | `3` |
|
||||
| `envoy.readinessProbe.timeoutSeconds` | When the probe times out | `1` |
|
||||
| `envoy.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` |
|
||||
| `envoy.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` |
|
||||
| `envoy.startupProbe.enabled` | Enable/disable the startup probe | `false` |
|
||||
| `envoy.startupProbe.port` | StartupProbe port | `8002` |
|
||||
| `envoy.startupProbe.initialDelaySeconds` | Delay before startup probe is initiated | `15` |
|
||||
| `envoy.startupProbe.periodSeconds` | How often to perform the probe | `10` |
|
||||
| `envoy.startupProbe.timeoutSeconds` | When the probe times out | `5` |
|
||||
| `envoy.startupProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `3` |
|
||||
| `envoy.startupProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | `1` |
|
||||
| `envoy.customLivenessProbe` | Override default liveness probe | `{}` |
|
||||
| `envoy.customReadinessProbe` | Override default readiness probe | `{}` |
|
||||
| `envoy.customStartupProbe` | Override default startup probe | `{}` |
|
||||
| `envoy.terminationGracePeriodSeconds` | Envoy termination grace period in seconds | `300` |
|
||||
| `envoy.logLevel` | Envoy log level | `info` |
|
||||
| `envoy.service.name` | envoy service name | `""` |
|
||||
| `envoy.service.multiAz.enabled` | enables the rendering of the multiple services | `false` |
|
||||
| `envoy.service.multiAz.zones` | defines different zones their annotations and loadBalancerIPs | `[]` |
|
||||
| `envoy.service.targetPorts` | Map the controller service HTTP/HTTPS port | `{}` |
|
||||
| `envoy.service.type` | Type of Envoy service to create | `LoadBalancer` |
|
||||
| `envoy.service.externalTrafficPolicy` | Envoy Service external cluster policy. If `envoy.service.type` is NodePort or LoadBalancer | `Local` |
|
||||
| `envoy.service.labels` | Labels to add to te envoy service | `{}` |
|
||||
| `envoy.service.clusterIP` | Internal envoy cluster service IP | `""` |
|
||||
| `envoy.service.externalIPs` | Envoy service external IP addresses | `[]` |
|
||||
| `envoy.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` |
|
||||
| `envoy.service.loadBalancerSourceRanges` | List of IP CIDRs allowed access to load balancer (if supported) | `[]` |
|
||||
| `envoy.service.loadBalancerClass` | Envoy service Load Balancer Class | `""` |
|
||||
| `envoy.service.ipFamilyPolicy` | , support SingleStack, PreferDualStack and RequireDualStack | `""` |
|
||||
| `envoy.service.ipFamilies` | List of IP families (e.g. IPv4, IPv6) assigned to the service. | `[]` |
|
||||
| `envoy.service.annotations` | Annotations for Envoy service | `{}` |
|
||||
| `envoy.service.ports.http` | Sets service http port | `80` |
|
||||
| `envoy.service.ports.https` | Sets service https port | `443` |
|
||||
| `envoy.service.ports.metrics` | Sets service metrics port | `8002` |
|
||||
| `envoy.service.nodePorts.http` | HTTP Port. If `envoy.service.type` is NodePort and this is non-empty | `""` |
|
||||
| `envoy.service.nodePorts.https` | HTTPS Port. If `envoy.service.type` is NodePort and this is non-empty | `""` |
|
||||
| `envoy.service.nodePorts.metrics` | Metrics Port. If `envoy.service.type` is NodePort and this is non-empty | `""` |
|
||||
| `envoy.service.extraPorts` | Extra ports to expose (normally used with the `sidecar` value) | `[]` |
|
||||
| `envoy.service.sessionAffinity` | Session Affinity for Kubernetes service, can be "None" or "ClientIP" | `None` |
|
||||
| `envoy.service.sessionAffinityConfig` | Additional settings for the sessionAffinity | `{}` |
|
||||
| `envoy.service.exposeMetrics` | Setting to expose the metrics port in the service | `false` |
|
||||
| `envoy.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` |
|
||||
| `envoy.networkPolicy.allowExternal` | Don't require server label for connections | `true` |
|
||||
| `envoy.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` |
|
||||
| `envoy.networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `envoy.networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` |
|
||||
| `envoy.networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `envoy.networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` |
|
||||
| `envoy.useHostPort.http` | Enable/disable `hostPort` for TCP/80 | `false` |
|
||||
| `envoy.useHostPort.https` | Enable/disable `hostPort` TCP/443 | `false` |
|
||||
| `envoy.useHostPort.metrics` | Enable/disable `hostPort` for TCP/8002 | `false` |
|
||||
| `envoy.useHostIP` | Enable/disable `hostIP` | `false` |
|
||||
| `envoy.hostPorts.http` | Sets `hostPort` http port | `80` |
|
||||
| `envoy.hostPorts.https` | Sets `hostPort` https port | `443` |
|
||||
| `envoy.hostPorts.metrics` | Sets `hostPort` metrics port | `8002` |
|
||||
| `envoy.hostIPs.http` | Sets `hostIP` http IP | `127.0.0.1` |
|
||||
| `envoy.hostIPs.https` | Sets `hostIP` https IP | `127.0.0.1` |
|
||||
| `envoy.hostIPs.metrics` | Sets `hostIP` metrics IP | `127.0.0.1` |
|
||||
| `envoy.containerPorts.http` | Sets http port inside Envoy pod (change this to >1024 to run envoy as a non-root user) | `8080` |
|
||||
| `envoy.containerPorts.https` | Sets https port inside Envoy pod (change this to >1024 to run envoy as a non-root user) | `8443` |
|
||||
| `envoy.containerPorts.metrics` | Sets metrics port inside Envoy pod (change this to >1024 to run envoy as a non-root user) | `8002` |
|
||||
| `envoy.initContainers` | Attach additional init containers to Envoy pods | `[]` |
|
||||
| `envoy.sidecars` | Add additional sidecar containers to the Envoy pods | `[]` |
|
||||
| `envoy.extraVolumes` | Array to add extra volumes | `[]` |
|
||||
| `envoy.extraVolumeMounts` | Array to add extra mounts (normally used with extraVolumes) | `[]` |
|
||||
| `envoy.extraEnvVars` | Array containing extra env vars to be added to all Envoy containers | `[]` |
|
||||
| `envoy.extraEnvVarsCM` | ConfigMap containing extra env vars to be added to all Envoy containers | `""` |
|
||||
| `envoy.extraEnvVarsSecret` | Secret containing extra env vars to be added to all Envoy containers | `""` |
|
||||
| `envoy.pdb.create` | Enable Pod Disruption Budget configuration | `true` |
|
||||
| `envoy.pdb.minAvailable` | Minimum number/percentage of Default backend pods that should remain scheduled | `""` |
|
||||
| `envoy.pdb.maxUnavailable` | Maximum number/percentage of Default backend pods that should remain scheduled | `""` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.enabled` | Enabled "init-config" init-containers' Security Context | `true` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.seLinuxOptions` | Set SELinux options in "init-config" init-containers | `{}` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.runAsUser` | Set runAsUser in "init-config" init-containers' Security Context | `1001` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.runAsGroup` | Set runAsGroup in "init-config" init-containers' Security Context | `1001` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.runAsNonRoot` | Set runAsNonRoot in "init-config" init-containers' Security Context | `true` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.privileged` | Set privileged in "init-config" init-containers' Security Context | `false` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.readOnlyRootFilesystem` | Set readOnlyRootFilesystem in "init-config" init-containers' Security Context | `true` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.allowPrivilegeEscalation` | Set allowPrivilegeEscalation in "init-config" init-containers' Security Context | `false` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.capabilities.drop` | List of capabilities to be dropped in "init-config" init-containers | `["ALL"]` |
|
||||
| `envoy.defaultInitContainers.initConfig.containerSecurityContext.seccompProfile.type` | Set seccomp profile in "init-config" init-containers | `RuntimeDefault` |
|
||||
| `envoy.defaultInitContainers.initConfig.resourcesPreset` | Set Envoy "init-config" init container resources according to one common preset (allowed values: none, nano, micro, small, medium, large, xlarge, 2xlarge). This is ignored if envoy.defaultInitContainers.initConfig.resources is set (envoy.defaultInitContainers.initConfig.resources is recommended for production). | `nano` |
|
||||
| `envoy.defaultInitContainers.initConfig.resources` | Set Envoy "init-config" init container requests and limits for different resources like CPU or memory (essential for production workloads) | `{}` |
|
||||
|
||||
### Gateway API parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ----------------------- | -------------------------------------------------------------- | ------- |
|
||||
| `gatewayAPI.manageCRDs` | Manage the creation, upgrade and deletion of Gateway API CRDs. | `false` |
|
||||
|
||||
### Metrics parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ |
|
||||
| `metrics.serviceMonitor.namespace` | Specify if the servicemonitors will be deployed into a different namespace (blank deploys into same namespace as chart) | `""` |
|
||||
| `metrics.serviceMonitor.enabled` | Specify if a servicemonitor will be deployed for prometheus-operator. | `false` |
|
||||
| `metrics.serviceMonitor.jobLabel` | Specify the jobLabel to use for the prometheus-operator | `app.kubernetes.io/name` |
|
||||
| `metrics.serviceMonitor.interval` | Specify the scrape interval if not specified use default prometheus scrapeIntervall, the Prometheus default scrape interval is used. | `""` |
|
||||
| `metrics.serviceMonitor.metricRelabelings` | Specify additional relabeling of metrics. | `[]` |
|
||||
| `metrics.serviceMonitor.relabelings` | Specify general relabeling. | `[]` |
|
||||
| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` |
|
||||
| `metrics.serviceMonitor.scrapeTimeout` | The timeout after which the scrape is ended | `""` |
|
||||
| `metrics.serviceMonitor.selector` | Specify honorLabels parameter to add the scrape endpoint | `{}` |
|
||||
| `metrics.serviceMonitor.labels` | Extra labels for the ServiceMonitor | `{}` |
|
||||
| `metrics.prometheusRule.enabled` | Creates a Prometheus Operator prometheusRule | `false` |
|
||||
| `metrics.prometheusRule.namespace` | Namespace for the prometheusRule Resource (defaults to the Release Namespace) | `""` |
|
||||
| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so prometheusRule will be discovered by Prometheus | `{}` |
|
||||
| `metrics.prometheusRule.rules` | Prometheus Rule definitions | `[]` |
|
||||
|
||||
### Other parameters
|
||||
|
||||
| Name | Description | Value |
|
||||
| ------------------- | -------------------------------------------------------------------------------------------------------------------- | ------- |
|
||||
| `rbac.create` | Create the RBAC roles for API accessibility | `true` |
|
||||
| `rbac.rules` | Custom RBAC rules to set | `[]` |
|
||||
| `tlsExistingSecret` | Name of the existingSecret to be use in both contour and envoy. If it is not nil `contour.certgen` will be disabled. | `""` |
|
||||
| `useCertManager` | Use Cert-manager instead of Contour certgen to issue certificates for TLS connection between Contour and Envoy. | `false` |
|
||||
|
||||
Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example,
|
||||
|
||||
```console
|
||||
helm install my-release \
|
||||
--set envoy.readinessProbe.successThreshold=5 \
|
||||
contour/contour
|
||||
```
|
||||
|
||||
The above command sets the `envoy.readinessProbe.successThreshold` to `5`.
|
||||
@@ -0,0 +1,41 @@
|
||||
CHART NAME: {{ .Chart.Name }}
|
||||
CHART VERSION: {{ .Chart.Version }}
|
||||
APP VERSION: {{ .Chart.AppVersion }}
|
||||
|
||||
** Please be patient while the chart is being deployed **
|
||||
|
||||
{{- if eq .Values.envoy.service.type "LoadBalancer" }}
|
||||
1. Get Contours's load balancer IP/hostname:
|
||||
|
||||
NOTE: It may take a few minutes for this to become available.
|
||||
|
||||
You can watch the status by running:
|
||||
|
||||
$ kubectl get svc {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} --namespace {{ include "common.names.namespace" . }} -w
|
||||
|
||||
Once 'EXTERNAL-IP' is no longer '<pending>':
|
||||
|
||||
$ kubectl describe svc {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }} --namespace {{ include "common.names.namespace" . }} | grep Ingress | awk '{print $3}'
|
||||
|
||||
2. Configure DNS records corresponding to Kubernetes ingress resources to point to the load balancer IP/hostname found in step 1
|
||||
{{- end }}
|
||||
{{- if eq .Values.envoy.service.type "NodePort" }}
|
||||
{{- if (and (not (empty .Values.envoy.service.nodePorts.https)) (not (empty .Values.envoy.service.nodePorts.http))) }}
|
||||
1. Contour is listening on the following ports on the host machine:
|
||||
|
||||
http - {{ .Values.envoy.service.nodePorts.http }}
|
||||
https - {{ .Values.envoy.service.nodePorts.https }}
|
||||
{{- else }}
|
||||
1. Contour has been started. You can find out the port numbers being used by Contour by running:
|
||||
|
||||
$ kubectl describe svc {{ include "common.names.fullname" . }} --namespace {{ include "common.names.namespace" . }}
|
||||
|
||||
{{- end }}
|
||||
|
||||
2. Configure DNS records corresponding to Kubernetes ingress resources to point to the NODE_IP/NODE_HOST
|
||||
{{- end }}
|
||||
|
||||
{{- include "contour.validateValues" . }}
|
||||
{{- include "common.warnings.rollingTag" .Values.contour.image }}
|
||||
{{- include "common.warnings.rollingTag" .Values.envoy.image }}
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "contour" "envoy" "envoy.shutdownManager") "context" $) }}
|
||||
@@ -0,0 +1,612 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* This contains all the helper functions from bitnami/common */}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "common.names.fullname" -}}
|
||||
{{- if .Values.fullnameOverride -}}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride -}}
|
||||
{{- $releaseName := regexReplaceAll "(-?[^a-z\\d\\-])+-?" (lower .Release.Name) "-" -}}
|
||||
{{- if contains $name $releaseName -}}
|
||||
{{- $releaseName | trunc 63 | trimSuffix "-" -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s-%s" $releaseName $name | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Allow the release namespace to be overridden for multi-namespace deployments in combined charts.
|
||||
*/}}
|
||||
{{- define "common.names.namespace" -}}
|
||||
{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image version (ingores image revision/prerelease info & fallbacks to chart appVersion)
|
||||
{{ include "common.images.version" ( dict "imageRoot" .Values.path.to.the.image "chart" .Chart ) }}
|
||||
*/}}
|
||||
{{- define "common.images.version" -}}
|
||||
{{- $imageTag := .imageRoot.tag | toString -}}
|
||||
{{/* regexp from https://github.com/Masterminds/semver/blob/23f51de38a0866c5ef0bfc42b3f735c73107b700/version.go#L41-L44 */}}
|
||||
{{- if regexMatch `^([0-9]+)(\.[0-9]+)?(\.[0-9]+)?(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?$` $imageTag -}}
|
||||
{{- $version := semver $imageTag -}}
|
||||
{{- printf "%d.%d.%d" $version.Major $version.Minor $version.Patch -}}
|
||||
{{- else -}}
|
||||
{{- print .chart.AppVersion -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Merge a list of values that contains template after rendering them.
|
||||
Merge precedence is consistent with http://masterminds.github.io/sprig/dicts.html#merge-mustmerge
|
||||
Usage:
|
||||
{{ include "common.tplvalues.merge" ( dict "values" (list .Values.path.to.the.Value1 .Values.path.to.the.Value2) "context" $ ) }}
|
||||
*/}}
|
||||
{{- define "common.tplvalues.merge" -}}
|
||||
{{- $dst := dict -}}
|
||||
{{- range .values -}}
|
||||
{{- $dst = include "common.tplvalues.render" (dict "value" . "context" $.context "scope" $.scope) | fromYaml | merge $dst -}}
|
||||
{{- end -}}
|
||||
{{ $dst | toYaml }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Renders a value that contains template perhaps with scope if the scope is present.
|
||||
Usage:
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ ) }}
|
||||
{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $ "scope" $app ) }}
|
||||
*/}}
|
||||
{{- define "common.tplvalues.render" -}}
|
||||
{{- $value := typeIs "string" .value | ternary .value (.value | toYaml) }}
|
||||
{{- if contains "{{" (toJson .value) }}
|
||||
{{- if .scope }}
|
||||
{{- tpl (cat "{{- with $.RelativeScope -}}" $value "{{- end }}") (merge (dict "RelativeScope" .scope) .context) }}
|
||||
{{- else }}
|
||||
{{- tpl $value .context }}
|
||||
{{- end }}
|
||||
{{- else }}
|
||||
{{- $value }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Kubernetes standard labels
|
||||
{{ include "common.labels.standard" (dict "customLabels" .Values.commonLabels "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.labels.standard" -}}
|
||||
{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
|
||||
{{- $default := dict "app.kubernetes.io/name" (include "common.names.name" .context) "helm.sh/chart" (include "common.names.chart" .context) "app.kubernetes.io/instance" .context.Release.Name "app.kubernetes.io/managed-by" .context.Release.Service -}}
|
||||
{{- with .context.Chart.AppVersion -}}
|
||||
{{- $_ := set $default "app.kubernetes.io/version" . -}}
|
||||
{{- end -}}
|
||||
{{ template "common.tplvalues.merge" (dict "values" (list .customLabels $default) "context" .context) }}
|
||||
{{- else -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
helm.sh/chart: {{ include "common.names.chart" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- with .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "common.names.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "common.names.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Labels used on immutable fields such as deploy.spec.selector.matchLabels or svc.spec.selector
|
||||
{{ include "common.labels.matchLabels" (dict "customLabels" .Values.podLabels "context" $) -}}
|
||||
|
||||
We don't want to loop over custom labels appending them to the selector
|
||||
since it's very likely that it will break deployments, services, etc.
|
||||
However, it's important to overwrite the standard labels if the user
|
||||
overwrote them on metadata.labels fields.
|
||||
*/}}
|
||||
{{- define "common.labels.matchLabels" -}}
|
||||
{{- if and (hasKey . "customLabels") (hasKey . "context") -}}
|
||||
{{ merge (pick (include "common.tplvalues.render" (dict "value" .customLabels "context" .context) | fromYaml) "app.kubernetes.io/name" "app.kubernetes.io/instance") (dict "app.kubernetes.io/name" (include "common.names.name" .context) "app.kubernetes.io/instance" .context.Release.Name ) | toYaml }}
|
||||
{{- else -}}
|
||||
app.kubernetes.io/name: {{ include "common.names.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for networkpolicy.
|
||||
*/}}
|
||||
{{- define "common.capabilities.networkPolicy.apiVersion" -}}
|
||||
{{- print "networking.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead)
|
||||
{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }}
|
||||
*/}}
|
||||
{{- define "common.images.pullSecrets" -}}
|
||||
{{- $pullSecrets := list }}
|
||||
|
||||
{{- range ((.global).imagePullSecrets) -}}
|
||||
{{- if kindIs "map" . -}}
|
||||
{{- $pullSecrets = append $pullSecrets .name -}}
|
||||
{{- else -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- range .images -}}
|
||||
{{- range .pullSecrets -}}
|
||||
{{- if kindIs "map" . -}}
|
||||
{{- $pullSecrets = append $pullSecrets .name -}}
|
||||
{{- else -}}
|
||||
{{- $pullSecrets = append $pullSecrets . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if (not (empty $pullSecrets)) -}}
|
||||
imagePullSecrets:
|
||||
{{- range $pullSecrets | uniq }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.pods.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.pods.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a soft nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.soft" -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- preference:
|
||||
matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
weight: 1
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard nodeAffinity definition
|
||||
{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes.hard" -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
nodeSelectorTerms:
|
||||
- matchExpressions:
|
||||
- key: {{ .key }}
|
||||
operator: In
|
||||
values:
|
||||
{{- range .values }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a nodeAffinity definition
|
||||
{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.nodes" -}}
|
||||
{{- if eq .type "soft" }}
|
||||
{{- include "common.affinities.nodes.soft" . -}}
|
||||
{{- else if eq .type "hard" }}
|
||||
{{- include "common.affinities.nodes.hard" . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Render a compatible securityContext depending on the platform. By default it is maintained as it is. In other platforms like Openshift we remove default user/group values that do not work out of the box with the restricted-v1 SCC
|
||||
Usage:
|
||||
{{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.containerSecurityContext "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.compatibility.renderSecurityContext" -}}
|
||||
{{- $adaptedContext := .secContext -}}
|
||||
|
||||
{{- if (((.context.Values.global).compatibility).openshift) -}}
|
||||
{{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "common.compatibility.isOpenshift" .context)) -}}
|
||||
{{/* Remove incompatible user/group values that do not work in Openshift out of the box */}}
|
||||
{{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}}
|
||||
{{- if not .secContext.seLinuxOptions -}}
|
||||
{{/* If it is an empty object, we remove it from the resulting context because it causes validation issues */}}
|
||||
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{/* Remove empty seLinuxOptions object if global.compatibility.omitEmptySeLinuxOptions is set to true */}}
|
||||
{{- if and (((.context.Values.global).compatibility).omitEmptySeLinuxOptions) (not .secContext.seLinuxOptions) -}}
|
||||
{{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
|
||||
{{- end -}}
|
||||
{{/* Remove fields that are disregarded when running the container in privileged mode */}}
|
||||
{{- if $adaptedContext.privileged -}}
|
||||
{{- $adaptedContext = omit $adaptedContext "capabilities" -}}
|
||||
{{- end -}}
|
||||
{{- omit $adaptedContext "enabled" | toYaml -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return true if the detected platform is Openshift
|
||||
Usage:
|
||||
{{- include "common.compatibility.isOpenshift" . -}}
|
||||
*/}}
|
||||
{{- define "common.compatibility.isOpenshift" -}}
|
||||
{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
|
||||
{{- true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the proper image name.
|
||||
If image tag and digest are not defined, termination fallbacks to chart appVersion.
|
||||
{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" .Values.global "chart" .Chart ) }}
|
||||
*/}}
|
||||
{{- define "common.images.image" -}}
|
||||
{{- $registryName := default .imageRoot.registry ((.global).imageRegistry) -}}
|
||||
{{- $repositoryName := .imageRoot.repository -}}
|
||||
{{- $separator := ":" -}}
|
||||
{{- $termination := .imageRoot.tag | toString -}}
|
||||
|
||||
{{- if not .imageRoot.tag }}
|
||||
{{- if .chart }}
|
||||
{{- $termination = .chart.AppVersion | toString -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if .imageRoot.digest }}
|
||||
{{- $separator = "@" -}}
|
||||
{{- $termination = .imageRoot.digest | toString -}}
|
||||
{{- end -}}
|
||||
{{- if $registryName }}
|
||||
{{- printf "%s/%s%s%s" $registryName $repositoryName $separator $termination -}}
|
||||
{{- else -}}
|
||||
{{- printf "%s%s%s" $repositoryName $separator $termination -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Return a resource request/limit object based on a given preset.
|
||||
These presets are for basic testing and not meant to be used in production
|
||||
{{ include "common.resources.preset" (dict "type" "nano") -}}
|
||||
*/}}
|
||||
{{- define "common.resources.preset" -}}
|
||||
{{/* The limits are the requests increased by 50% (except ephemeral-storage and xlarge/2xlarge sizes)*/}}
|
||||
{{- $presets := dict
|
||||
"nano" (dict
|
||||
"requests" (dict "cpu" "100m" "memory" "128Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "150m" "memory" "192Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"micro" (dict
|
||||
"requests" (dict "cpu" "250m" "memory" "256Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "375m" "memory" "384Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"small" (dict
|
||||
"requests" (dict "cpu" "500m" "memory" "512Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "750m" "memory" "768Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"medium" (dict
|
||||
"requests" (dict "cpu" "500m" "memory" "1024Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "750m" "memory" "1536Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"large" (dict
|
||||
"requests" (dict "cpu" "1.0" "memory" "2048Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "1.5" "memory" "3072Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"xlarge" (dict
|
||||
"requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "3.0" "memory" "6144Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
"2xlarge" (dict
|
||||
"requests" (dict "cpu" "1.0" "memory" "3072Mi" "ephemeral-storage" "50Mi")
|
||||
"limits" (dict "cpu" "6.0" "memory" "12288Mi" "ephemeral-storage" "2Gi")
|
||||
)
|
||||
}}
|
||||
{{- if hasKey $presets .type -}}
|
||||
{{- index $presets .type | toYaml -}}
|
||||
{{- else -}}
|
||||
{{- printf "ERROR: Preset key '%s' invalid. Allowed values are %s" .type (join "," (keys $presets)) | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for RBAC resources.
|
||||
*/}}
|
||||
{{- define "common.capabilities.rbac.apiVersion" -}}
|
||||
{{- print "rbac.authorization.k8s.io/v1" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for deployment.
|
||||
*/}}
|
||||
{{- define "common.capabilities.deployment.apiVersion" -}}
|
||||
{{- print "apps/v1" -}}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Return a soft podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.soft" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.soft" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $customLabels := default (dict) .customLabels -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
|
||||
{{- $extraNamespaces := default (list) .extraNamespaces -}}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 10 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if $extraNamespaces }}
|
||||
namespaces:
|
||||
- {{ .context.Release.Namespace }}
|
||||
{{- with $extraNamespaces }}
|
||||
{{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
weight: 1
|
||||
{{- range $extraPodAffinityTerms }}
|
||||
- podAffinityTerm:
|
||||
labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 10 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .namespaces }}
|
||||
namespaces:
|
||||
- {{ $.context.Release.Namespace }}
|
||||
{{- with .namespaces }}
|
||||
{{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
weight: {{ .weight | default 1 -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a hard podAffinity/podAntiAffinity definition
|
||||
{{ include "common.affinities.pods.hard" (dict "component" "FOO" "customLabels" .Values.podLabels "extraMatchLabels" .Values.extraMatchLabels "topologyKey" "BAR" "extraPodAffinityTerms" .Values.extraPodAffinityTerms "extraNamespaces" (list "namespace1" "namespace2") "context" $) -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.pods.hard" -}}
|
||||
{{- $component := default "" .component -}}
|
||||
{{- $customLabels := default (dict) .customLabels -}}
|
||||
{{- $extraMatchLabels := default (dict) .extraMatchLabels -}}
|
||||
{{- $extraPodAffinityTerms := default (list) .extraPodAffinityTerms -}}
|
||||
{{- $extraNamespaces := default (list) .extraNamespaces -}}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" .context )) | nindent 8 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := $extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if $extraNamespaces }}
|
||||
namespaces:
|
||||
- {{ .context.Release.Namespace }}
|
||||
{{- with $extraNamespaces }}
|
||||
{{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
{{- range $extraPodAffinityTerms }}
|
||||
- labelSelector:
|
||||
matchLabels: {{- (include "common.labels.matchLabels" ( dict "customLabels" $customLabels "context" $.context )) | nindent 8 }}
|
||||
{{- if not (empty $component) }}
|
||||
{{ printf "app.kubernetes.io/component: %s" $component }}
|
||||
{{- end }}
|
||||
{{- range $key, $value := .extraMatchLabels }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .namespaces }}
|
||||
namespaces:
|
||||
- {{ $.context.Release.Namespace }}
|
||||
{{- with .namespaces }}
|
||||
{{- include "common.tplvalues.render" (dict "value" . "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
topologyKey: {{ include "common.affinities.topologyKey" (dict "topologyKey" .topologyKey) }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return a topologyKey definition
|
||||
{{ include "common.affinities.topologyKey" (dict "topologyKey" "BAR") -}}
|
||||
*/}}
|
||||
{{- define "common.affinities.topologyKey" -}}
|
||||
{{ .topologyKey | default "kubernetes.io/hostname" -}}
|
||||
{{- end -}}
|
||||
{{/*
|
||||
Warning about using rolling tag.
|
||||
Usage:
|
||||
{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }}
|
||||
*/}}
|
||||
{{- define "common.warnings.rollingTag" -}}
|
||||
|
||||
{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }}
|
||||
WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
|
||||
+info https://techdocs.broadcom.com/us/en/vmware-tanzu/application-catalog/tanzu-application-catalog/services/tac-doc/apps-tutorials-understand-rolling-tags-containers-index.html
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
|
||||
{{/*
|
||||
Warning about not setting the resource object in all deployments.
|
||||
Usage:
|
||||
{{ include "common.warnings.resources" (dict "sections" (list "path1" "path2") context $) }}
|
||||
Example:
|
||||
{{- include "common.warnings.resources" (dict "sections" (list "csiProvider.provider" "server" "volumePermissions" "") "context" $) }}
|
||||
The list in the example assumes that the following values exist:
|
||||
- csiProvider.provider.resources
|
||||
- server.resources
|
||||
- volumePermissions.resources
|
||||
- resources
|
||||
*/}}
|
||||
{{- define "common.warnings.resources" -}}
|
||||
{{- $values := .context.Values -}}
|
||||
{{- $printMessage := false -}}
|
||||
{{ $affectedSections := list -}}
|
||||
{{- range .sections -}}
|
||||
{{- if eq . "" -}}
|
||||
{{/* Case where the resources section is at the root (one main deployment in the chart) */}}
|
||||
{{- if not (index $values "resources") -}}
|
||||
{{- $affectedSections = append $affectedSections "resources" -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{/* Case where the are multiple resources sections (more than one main deployment in the chart) */}}
|
||||
{{- $keys := split "." . -}}
|
||||
{{/* We iterate through the different levels until arriving to the resource section. Example: a.b.c.resources */}}
|
||||
{{- $section := $values -}}
|
||||
{{- range $keys -}}
|
||||
{{- $section = index $section . -}}
|
||||
{{- end -}}
|
||||
{{- if not (index $section "resources") -}}
|
||||
{{/* If the section has enabled=false or replicaCount=0, do not include it */}}
|
||||
{{- if and (hasKey $section "enabled") -}}
|
||||
{{- if index $section "enabled" -}}
|
||||
{{/* enabled=true */}}
|
||||
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- else if and (hasKey $section "replicaCount") -}}
|
||||
{{/* We need a casting to int because number 0 is not treated as an int by default */}}
|
||||
{{- if (gt (index $section "replicaCount" | int) 0) -}}
|
||||
{{/* replicaCount > 0 */}}
|
||||
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{/* Default case, add it to the affected sections */}}
|
||||
{{- $affectedSections = append $affectedSections (printf "%s.resources" .) -}}
|
||||
{{- $printMessage = true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if $printMessage }}
|
||||
|
||||
WARNING: There are "resources" sections in the chart not set. Using "resourcesPreset" is not recommended for production. For production installations, please set the following values according to your workload needs:
|
||||
{{- range $affectedSections }}
|
||||
- {{ . }}
|
||||
{{- end }}
|
||||
+info https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for Horizontal Pod Autoscaler.
|
||||
*/}}
|
||||
{{- define "common.capabilities.hpa.apiVersion" -}}
|
||||
{{- $kubeVersion := include "common.capabilities.kubeVersion" .context -}}
|
||||
{{- print "autoscaling/v2" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the appropriate apiVersion for poddisruptionbudget.
|
||||
*/}}
|
||||
{{- define "common.capabilities.policy.apiVersion" -}}
|
||||
{{- print "policy/v1" -}}
|
||||
{{- end -}}
|
||||
{{/*
|
||||
Generate backend entry that is compatible with all Kubernetes API versions.
|
||||
|
||||
Usage:
|
||||
{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }}
|
||||
|
||||
Params:
|
||||
- serviceName - String. Name of an existing service backend
|
||||
- servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer.
|
||||
- context - Dict - Required. The context for the template evaluation.
|
||||
*/}}
|
||||
{{- define "common.ingress.backend" -}}
|
||||
service:
|
||||
name: {{ .serviceName }}
|
||||
port:
|
||||
{{- if typeIs "string" .servicePort }}
|
||||
name: {{ .servicePort }}
|
||||
{{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }}
|
||||
number: {{ .servicePort | int }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Reuses the value from an existing secret, otherwise sets its value to a default value.
|
||||
|
||||
Usage:
|
||||
{{ include "common.secrets.lookup" (dict "secret" "secret-name" "key" "keyName" "defaultValue" .Values.myValue "context" $) }}
|
||||
|
||||
Params:
|
||||
- secret - String - Required - Name of the 'Secret' resource where the password is stored.
|
||||
- key - String - Required - Name of the key in the secret.
|
||||
- defaultValue - String - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value.
|
||||
- context - Context - Required - Parent context.
|
||||
|
||||
*/}}
|
||||
{{- define "common.secrets.lookup" -}}
|
||||
{{- $value := "" -}}
|
||||
{{- $secretData := (lookup "v1" "Secret" (include "common.names.namespace" .context) .secret).data -}}
|
||||
{{- if and $secretData (hasKey $secretData .key) -}}
|
||||
{{- $value = index $secretData .key -}}
|
||||
{{- else if .defaultValue -}}
|
||||
{{- $value = .defaultValue | toString | b64enc -}}
|
||||
{{- end -}}
|
||||
{{- if $value -}}
|
||||
{{- printf "%s" $value -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the target Kubernetes version
|
||||
*/}}
|
||||
{{- define "common.capabilities.kubeVersion" -}}
|
||||
{{- default (default .Capabilities.KubeVersion.Version .Values.kubeVersion) ((.Values.global).kubeVersion) -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,132 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Create the name of the envoy service account to use
|
||||
*/}}
|
||||
{{- define "envoy.envoyServiceAccountName" -}}
|
||||
{{- if .Values.contour.serviceAccount.create -}}
|
||||
{{ default (printf "%s-envoy" (include "common.names.fullname" .)) .Values.envoy.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.envoy.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the contour service account to use
|
||||
*/}}
|
||||
{{- define "contour.contourServiceAccountName" -}}
|
||||
{{- if .Values.contour.serviceAccount.create -}}
|
||||
{{ default (printf "%s-contour" (include "common.names.fullname" .)) .Values.contour.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.contour.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the contour-certgen service account to use
|
||||
*/}}
|
||||
{{- define "contour.contourCertGenServiceAccountName" -}}
|
||||
{{- if .Values.contour.certgen.serviceAccount.create -}}
|
||||
{{ default (printf "%s-contour-certgen" (include "common.names.fullname" .)) .Values.contour.certgen.serviceAccount.name }}
|
||||
{{- else -}}
|
||||
{{ default "default" .Values.contour.certgen.serviceAccount.name }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Whether to enabled contour-certgen or not
|
||||
*/}}
|
||||
{{- define "contour.contour-certgen.enabled" -}}
|
||||
{{- if and (not .Values.tlsExistingSecret) (or (not .Values.contour.tlsExistingSecret) (not .Values.envoy.tlsExistingSecret)) (not .Values.useCertManager) -}}
|
||||
true
|
||||
{{- else -}}{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Contour certs secret name
|
||||
*/}}
|
||||
{{- define "contour.contour.certs-secret.name" -}}
|
||||
{{- $name := "" -}}
|
||||
{{- if .Values.useCertManager -}}
|
||||
{{- $name = "contourcert" -}}
|
||||
{{- else -}}
|
||||
{{- $existingSecret := default .Values.tlsExistingSecret .Values.contour.tlsExistingSecret -}}
|
||||
{{- $name = default "contourcert" $existingSecret -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $name -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Envoy certs secret name
|
||||
*/}}
|
||||
{{- define "contour.envoy.certs-secret.name" -}}
|
||||
{{- $name := "" -}}
|
||||
{{- if .Values.useCertManager -}}
|
||||
{{- $name = "envoycert" -}}
|
||||
{{- else -}}
|
||||
{{- $existingSecret := default .Values.tlsExistingSecret .Values.envoy.tlsExistingSecret -}}
|
||||
{{- $name = default "envoycert" $existingSecret -}}
|
||||
{{- end -}}
|
||||
{{- printf "%s" $name -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the name of the settings ConfigMap to use.
|
||||
*/}}
|
||||
{{- define "contour.configMapName" -}}
|
||||
{{- if .Values.configInline -}}
|
||||
{{ include "common.names.fullname" . }}
|
||||
{{- else -}}
|
||||
{{ .Values.existingConfigMap }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Compile all warnings into a single message, and call fail.
|
||||
*/}}
|
||||
{{- define "contour.validateValues" -}}
|
||||
{{- $messages := list -}}
|
||||
{{- $messages := append $messages (include "contour.validateValues.envoy.kind" .) -}}
|
||||
{{- $messages := without $messages "" -}}
|
||||
{{- $message := join "\n" $messages -}}
|
||||
|
||||
{{- if $message -}}
|
||||
{{- printf "\nVALUES VALIDATION:\n%s" $message | fail -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Validate values of Contour - must provide a valid Envoy kind */}}
|
||||
{{- define "contour.validateValues.envoy.kind" -}}
|
||||
{{- if and .Values.envoy.enabled (ne .Values.envoy.kind "deployment") (ne .Values.envoy.kind "daemonset") -}}
|
||||
contour: envoy.kind
|
||||
Invalid envoy.kind selected. Valid values are "daemonset" and
|
||||
"deployment". Please set a valid kind (--set envoy.kind="xxxx")
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Create the name of the IngressClass to use. */}}
|
||||
{{- define "contour.ingressClassName" -}}
|
||||
{{- $ingressClass := .Values.contour.ingressClass }}
|
||||
{{- if kindIs "string" $ingressClass -}}
|
||||
{{ default "contour" $ingressClass }}
|
||||
{{- else if kindIs "map" $ingressClass -}}
|
||||
{{ default "contour" $ingressClass.name }}
|
||||
{{- else -}}
|
||||
contour
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Whether the name of the ingress class is defined or not */}}
|
||||
{{- define "contour.isIngressClassNameDefined" -}}
|
||||
{{- $ingressClass := .Values.contour.ingressClass -}}
|
||||
{{- if kindIs "string" $ingressClass -}}
|
||||
true
|
||||
{{- else if and (kindIs "map" $ingressClass) ($ingressClass.name) -}}
|
||||
true
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,58 @@
|
||||
{{- /*
|
||||
Root CA for Contour mTLS.
|
||||
Supports two modes:
|
||||
1. "external" (default) — Root CA secret is pre-created (e.g., via ESO from Vault)
|
||||
2. "generate" — cert-manager creates a self-signed Root CA (for dev/testing)
|
||||
|
||||
Chain: Root CA → Leaf Certs (contourcert, envoycert)
|
||||
*/}}
|
||||
|
||||
{{- if .Values.useCertManager }}
|
||||
|
||||
{{- if eq .Values.certManager.rootCA.mode "generate" }}
|
||||
## Self-Signed Issuer (only used to bootstrap Root CA in "generate" mode)
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ printf "%s-selfsigned" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
spec:
|
||||
selfSigned: {}
|
||||
---
|
||||
## Root CA Certificate (self-signed, long-lived)
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
spec:
|
||||
secretName: {{ .Values.certManager.rootCA.secretName }}
|
||||
commonName: "Contour Root CA"
|
||||
duration: {{ .Values.certManager.rootCA.duration }}
|
||||
isCA: true
|
||||
usages:
|
||||
- cert sign
|
||||
- crl sign
|
||||
privateKey:
|
||||
algorithm: RSA
|
||||
size: 4096
|
||||
issuerRef:
|
||||
name: {{ printf "%s-selfsigned" (include "common.names.fullname" .) }}
|
||||
kind: Issuer
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
## Root CA Issuer (signs leaf certs directly)
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Issuer
|
||||
metadata:
|
||||
name: {{ printf "%s-root-ca-issuer" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
spec:
|
||||
ca:
|
||||
secretName: {{ .Values.certManager.rootCA.secretName }}
|
||||
|
||||
{{- end }}
|
||||
@@ -0,0 +1,36 @@
|
||||
{{- /*
|
||||
Contour server leaf certificate.
|
||||
Signed by Root CA directly.
|
||||
Used for Contour's xDS gRPC server — Envoy connects to this.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.useCertManager }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ printf "%s-contour-cert" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
spec:
|
||||
secretName: contourcert
|
||||
commonName: "contour"
|
||||
dnsNames:
|
||||
- "contour"
|
||||
- {{ include "common.names.fullname" . | quote }}
|
||||
- {{ printf "%s-contour" (include "common.names.fullname" .) | quote }}
|
||||
- {{ printf "%s.%s.svc" (include "common.names.fullname" .) (include "common.names.namespace" .) | quote }}
|
||||
- {{ printf "%s.%s.svc.cluster.local" (include "common.names.fullname" .) (include "common.names.namespace" .) | quote }}
|
||||
duration: {{ .Values.certManager.leafCerts.duration }}
|
||||
renewBefore: {{ .Values.certManager.leafCerts.renewBefore }}
|
||||
usages:
|
||||
- server auth
|
||||
- digital signature
|
||||
- key encipherment
|
||||
privateKey:
|
||||
algorithm: {{ .Values.certManager.leafCerts.algorithm }}
|
||||
size: {{ .Values.certManager.leafCerts.size }}
|
||||
issuerRef:
|
||||
name: {{ printf "%s-root-ca-issuer" (include "common.names.fullname" .) }}
|
||||
kind: Issuer
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Envoy client leaf certificate.
|
||||
Signed by Root CA directly.
|
||||
Used for Envoy's mTLS client identity when connecting to Contour's xDS server.
|
||||
*/}}
|
||||
|
||||
{{- if .Values.useCertManager }}
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy-cert" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
spec:
|
||||
secretName: envoycert
|
||||
commonName: "envoy"
|
||||
duration: {{ .Values.certManager.leafCerts.duration }}
|
||||
renewBefore: {{ .Values.certManager.leafCerts.renewBefore }}
|
||||
usages:
|
||||
- client auth
|
||||
- digital signature
|
||||
- key encipherment
|
||||
privateKey:
|
||||
algorithm: {{ .Values.certManager.leafCerts.algorithm }}
|
||||
size: {{ .Values.certManager.leafCerts.size }}
|
||||
issuerRef:
|
||||
name: {{ printf "%s-root-ca-issuer" (include "common.names.fullname" .) }}
|
||||
kind: Issuer
|
||||
{{- end }}
|
||||
@@ -0,0 +1,36 @@
|
||||
{{- /*
|
||||
ExternalSecret to sync Root CA from Vault via ESO.
|
||||
Creates the Root CA K8s Secret that cert-manager's Root CA Issuer references.
|
||||
Only needed when rootCA.mode is "external" and externalSecret.enabled is true.
|
||||
Uses dataFrom.extract to pull all keys from a single Vault path.
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.useCertManager (eq .Values.certManager.rootCA.mode "external") .Values.certManager.externalSecret.enabled }}
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: {{ printf "%s-root-ca" (include "common.names.fullname" .) }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-5"
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
spec:
|
||||
dataFrom:
|
||||
- extract:
|
||||
conversionStrategy: Default
|
||||
key: {{ .Values.certManager.externalSecret.vaultPath }}
|
||||
{{- if .Values.certManager.externalSecret.vaultVersion }}
|
||||
version: {{ .Values.certManager.externalSecret.vaultVersion | quote }}
|
||||
{{- end }}
|
||||
refreshInterval: {{ .Values.certManager.externalSecret.refreshInterval | quote }}
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: {{ .Values.certManager.externalSecret.secretStoreRef.name }}
|
||||
target:
|
||||
name: {{ .Values.certManager.rootCA.secretName }}
|
||||
creationPolicy: Owner
|
||||
deletionPolicy: Retain
|
||||
{{- end }}
|
||||
@@ -0,0 +1,131 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.contour.enabled (include "contour.contour-certgen.enabled" .) }}
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install,pre-upgrade"
|
||||
"helm.sh/hook-weight": "1"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour-certgen
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: contour-certgen
|
||||
spec:
|
||||
{{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image) "global" .Values.global) | nindent 6 }}
|
||||
{{- if .Values.contour.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.contour.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.contour.affinity "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.contour.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.contour.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: contour
|
||||
image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.contour.image.pullPolicy }}
|
||||
command:
|
||||
- contour
|
||||
args:
|
||||
- certgen
|
||||
- --kube
|
||||
- --incluster
|
||||
- --overwrite
|
||||
- --secrets-format=compact
|
||||
- --namespace=$(CONTOUR_NAMESPACE)
|
||||
- --certificate-lifetime={{ .Values.contour.certgen.certificateLifetime }}
|
||||
env:
|
||||
- name: CONTOUR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- if .Values.contour.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.contour.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.contour.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.resources }}
|
||||
resources: {{ toYaml .Values.contour.resources | nindent 12 }}
|
||||
{{- else if ne .Values.contour.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.contour.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- contour
|
||||
initialDelaySeconds: {{ .Values.contour.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.contour.startupProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.contour.startupProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.contour.startupProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.contour.startupProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- contour
|
||||
initialDelaySeconds: {{ .Values.contour.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.contour.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.contour.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.contour.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.contour.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- contour
|
||||
initialDelaySeconds: {{ .Values.contour.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.contour.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.contour.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.contour.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.contour.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
restartPolicy: Never
|
||||
serviceAccountName: {{ include "contour.contourCertGenServiceAccountName" . }}
|
||||
automountServiceAccountToken: {{ .Values.contour.certgen.automountServiceAccountToken }}
|
||||
parallelism: 1
|
||||
completions: 1
|
||||
backoffLimit: 1
|
||||
{{- end }}
|
||||
@@ -0,0 +1,46 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.contour.enabled (include "contour.contour-certgen.enabled" .) .Values.contour.certgen.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour-certgen
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: contour-certgen
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.contour.certgen.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $port := .Values.contour.certgen.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.certgen.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.contour.certgen.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
{{- if .Values.contour.certgen.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.contour.certgen.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.rbac.create .Values.contour.enabled (include "contour.contour-certgen.enabled" .) }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install,pre-upgrade"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour-certgen
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- create
|
||||
- update
|
||||
---
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install,pre-upgrade"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour-certgen
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ printf "%s-contour-certgen" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "contour.contourCertGenServiceAccountName" . }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,24 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.contour.certgen.serviceAccount.create (include "contour.contour-certgen.enabled" .) }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "contour.contourCertGenServiceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour-certgen
|
||||
annotations:
|
||||
"helm.sh/hook": "pre-install,pre-upgrade"
|
||||
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
||||
{{- if or .Values.contour.certgen.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $mergedAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.certgen.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $mergedAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.contour.certgen.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,22 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.configInline }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
data:
|
||||
contour.yaml: |-
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.configInline "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,256 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.contour.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
replicas: {{ .Values.contour.replicaCount }}
|
||||
{{- if .Values.contour.updateStrategy }}
|
||||
strategy: {{- toYaml .Values.contour.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: contour
|
||||
template:
|
||||
metadata:
|
||||
{{- if or .Values.configInline .Values.contour.podAnnotations .Values.commonAnnotations }}
|
||||
annotations:
|
||||
{{- if .Values.contour.podAnnotations }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.configInline }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/contour/configmap.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: contour
|
||||
spec:
|
||||
{{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image) "global" .Values.global) | nindent 6 }}
|
||||
{{- if .Values.contour.priorityClassName }}
|
||||
priorityClassName: {{ .Values.contour.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.contour.automountServiceAccountToken }}
|
||||
{{- if .Values.contour.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.contour.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.contour.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.contour.podAffinityPreset "component" "contour" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.contour.podAntiAffinityPreset "component" "contour" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.contour.nodeAffinityPreset.type "key" .Values.contour.nodeAffinityPreset.key "values" .Values.contour.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.contour.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.contour.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.schedulerName }}
|
||||
schedulerName: {{ .Values.contour.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.contour.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.terminationGracePeriodSeconds }}
|
||||
terminationGracePeriodSeconds: {{ .Values.contour.terminationGracePeriodSeconds }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.initContainers }}
|
||||
initContainers: {{- include "common.tplvalues.render" ( dict "value" .Values.contour.initContainers "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: contour
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.contour.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- contour
|
||||
{{- end }}
|
||||
{{- if .Values.diagnosticMode.enabled }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.contour.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args:
|
||||
- serve
|
||||
- --incluster
|
||||
- --xds-address=0.0.0.0
|
||||
- --xds-port={{ .Values.contour.containerPorts.xds }}
|
||||
- --http-port={{ .Values.contour.containerPorts.metrics }}
|
||||
- --envoy-service-http-port={{ .Values.envoy.containerPorts.http }}
|
||||
- --envoy-service-https-port={{ .Values.envoy.containerPorts.https }}
|
||||
- --contour-cafile=/certs/ca.crt
|
||||
- --contour-cert-file=/certs/tls.crt
|
||||
- --contour-key-file=/certs/tls.key
|
||||
{{- if .Values.contour.configPath }}
|
||||
- --config-path=/config/contour.yaml
|
||||
{{- else }}
|
||||
- --contour-config-name={{ .Values.contour.contourConfigName }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.ingressStatusAddress }}
|
||||
- --ingress-status-address={{ .Values.contour.ingressStatusAddress }}
|
||||
{{- else }}
|
||||
- --envoy-service-namespace={{ default .Release.Namespace .Values.contour.envoyServiceNamespace }}
|
||||
{{- $envoyServiceName := coalesce .Values.envoy.service.name .Values.contour.envoyServiceName }}
|
||||
{{- if .Values.envoy.service.multiAz.enabled }}
|
||||
- --envoy-service-name={{ default (printf "%s-%s-envoy" (include "common.names.fullname" .) (index .Values.envoy.service.multiAz.zones 0).name | trunc 63 | trimSuffix "-") $envoyServiceName }}
|
||||
{{- else }}
|
||||
- --envoy-service-name={{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") $envoyServiceName }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- --leader-election-resource-name={{ default (printf "%s-%s" (include "common.names.namespace" .) (printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-")) .Values.contour.leaderElectionResourceName }}
|
||||
{{- if .Values.contour.debug }}
|
||||
- --debug
|
||||
{{- end }}
|
||||
- --log-format={{ .Values.contour.logFormat }}
|
||||
- --kubernetes-debug={{ .Values.contour.kubernetesDebug }}
|
||||
{{- if (include "contour.isIngressClassNameDefined" .) }}
|
||||
- --ingress-class-name={{ include "contour.ingressClassName" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.rootNamespaces }}
|
||||
- --root-namespaces={{ .Values.contour.rootNamespaces }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.extraArgs }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.extraArgs "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.contour.image.pullPolicy }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.contour.containerPorts.xds }}
|
||||
name: xds
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.contour.containerPorts.metrics }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- if not .Values.diagnosticMode.enabled }}
|
||||
{{- if .Values.contour.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.contour.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: {{ .Values.contour.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.contour.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.contour.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.contour.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.contour.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.contour.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ .Values.contour.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.contour.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.contour.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.contour.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.contour.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.contour.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.contour.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.contour.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: {{ .Values.contour.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.contour.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.contour.startupProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.contour.startupProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.contour.startupProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.contour.startupProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.resources }}
|
||||
resources: {{ toYaml .Values.contour.resources | nindent 12 }}
|
||||
{{- else if ne .Values.contour.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.contour.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: contourcert
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
- name: contour-config
|
||||
mountPath: /config
|
||||
readOnly: true
|
||||
{{- if .Values.contour.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.contour.extraVolumeMounts "context" $ ) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: CONTOUR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
- name: BITNAMI_DEBUG
|
||||
value: {{ ternary "true" "false" (or .Values.contour.image.debug .Values.diagnosticMode.enabled) | quote }}
|
||||
{{- if .Values.contour.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.contour.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.contour.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.contour.sidecars "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
dnsPolicy: ClusterFirst
|
||||
serviceAccountName: {{ include "contour.contourServiceAccountName" . }}
|
||||
{{- if .Values.contour.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.contour.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: contourcert
|
||||
secret:
|
||||
secretName: {{ include "contour.contour.certs-secret.name" . }}
|
||||
- name: contour-config
|
||||
configMap:
|
||||
name: {{ include "contour.configMapName" . }}
|
||||
defaultMode: 0644
|
||||
items:
|
||||
- key: contour.yaml
|
||||
path: contour.yaml
|
||||
{{- if .Values.contour.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.contour.extraVolumes "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,25 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{ $ingressClass := .Values.contour.ingressClass }}
|
||||
{{- if kindIs "map" $ingressClass }}
|
||||
{{- if $ingressClass.create }}
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: IngressClass
|
||||
metadata:
|
||||
name: {{ include "contour.ingressClassName" . }}
|
||||
annotations:
|
||||
{{- if $ingressClass.default }}
|
||||
ingressclass.kubernetes.io/is-default-class: "true"
|
||||
{{- end }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
spec:
|
||||
controller: {{ printf "projectcontour.io/%s/%s-contour" (include "common.names.namespace" .) (include "common.names.fullname" .) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,90 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.contour.enabled .Values.contour.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: contour
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.contour.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
{{- range $port := .Values.contour.networkPolicy.kubeAPIServerPorts }}
|
||||
- port: {{ $port }}
|
||||
{{- end }}
|
||||
# Allow outbound connections to other contour pods
|
||||
- ports:
|
||||
- port: {{ .Values.contour.containerPorts.xds }}
|
||||
- port: {{ .Values.contour.containerPorts.metrics }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.envoy.enabled }}
|
||||
# Allow outbound connections to envoy
|
||||
- ports:
|
||||
- port: {{ .Values.envoy.containerPorts.http }}
|
||||
- port: {{ .Values.envoy.containerPorts.https }}
|
||||
- port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- end }}
|
||||
{{- if .Values.contour.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.contour.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.contour.containerPorts.xds }}
|
||||
- port: {{ .Values.contour.containerPorts.metrics }}
|
||||
{{- if not .Values.contour.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- if .Values.contour.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.contour.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.contour.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.contour.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,30 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
{{- $replicaCount := int .Values.contour.replicaCount }}
|
||||
{{- if and .Values.contour.enabled .Values.contour.pdb.create (gt $replicaCount 1) }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.contour.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.contour.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.contour.pdb.maxUnavailable ( not .Values.contour.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.contour.pdb.maxUnavailable | default 1 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- end }}
|
||||
@@ -0,0 +1,237 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.rbac.create .Values.contour.enabled }}
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- list
|
||||
- update
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingressclasses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
resources:
|
||||
- ingresses/status
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- networking.x-k8s.io
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- gatewayclasses
|
||||
- gateways
|
||||
- grpcroutes
|
||||
- httproutes
|
||||
- tcproutes
|
||||
- tlsroutes
|
||||
- udproutes
|
||||
- referencepolicies
|
||||
- referencegrants
|
||||
- backendtlspolicies
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- networking.x-k8s.io
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- gatewayclasses/status
|
||||
- gateways/status
|
||||
- grpcroutes/status
|
||||
- httproutes/status
|
||||
- tcproutes/status
|
||||
- tlsroutes/status
|
||||
- udproutes/status
|
||||
verbs:
|
||||
- update
|
||||
- apiGroups:
|
||||
- projectcontour.io
|
||||
resources:
|
||||
- contourconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- projectcontour.io
|
||||
resources:
|
||||
- contourconfigurations/status
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- projectcontour.io
|
||||
resources:
|
||||
- extensionservices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- projectcontour.io
|
||||
resources:
|
||||
- extensionservices/status
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- projectcontour.io
|
||||
resources:
|
||||
- httpproxies
|
||||
- tlscertificatedelegations
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- projectcontour.io
|
||||
resources:
|
||||
- httpproxies/status
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- if .Values.rbac.rules }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "contour.contourServiceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
---
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- events
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resources:
|
||||
- leases
|
||||
verbs:
|
||||
- create
|
||||
- get
|
||||
- update
|
||||
---
|
||||
apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }}
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: {{ printf "%s-contour-role" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: {{ include "contour.contourServiceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,29 @@
|
||||
{{- /*
|
||||
Meesho Custom: GCP Internal Load Balancer for Contour xDS service
|
||||
*/}}
|
||||
|
||||
{{- if .Values.contour.enabled }}
|
||||
{{- if .Values.contour.service.tcpLB }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}-tcp-lb
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
annotations:
|
||||
cloud.google.com/load-balancer-type: "Internal"
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
spec:
|
||||
type: LoadBalancer
|
||||
ports:
|
||||
- port: {{ .Values.contour.service.ports.xds }}
|
||||
name: tcp-xds
|
||||
protocol: TCP
|
||||
targetPort: xds
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,80 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if .Values.contour.enabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if or .Values.contour.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
type: {{ .Values.contour.service.type }}
|
||||
{{- if or (eq .Values.contour.service.type "LoadBalancer") (eq .Values.contour.service.type "NodePort") }}
|
||||
externalTrafficPolicy: {{ .Values.contour.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if and .Values.contour.service.clusterIP (eq .Values.contour.service.type "ClusterIP") }}
|
||||
clusterIP: {{ .Values.contour.service.clusterIP }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.contour.service.type "LoadBalancer") (not (empty .Values.contour.service.loadBalancerSourceRanges)) }}
|
||||
loadBalancerSourceRanges: {{ .Values.contour.service.loadBalancerSourceRanges }}
|
||||
{{- end }}
|
||||
{{- if and (eq .Values.contour.service.type "LoadBalancer") (not (empty .Values.contour.service.loadBalancerIP)) }}
|
||||
loadBalancerIP: {{ .Values.contour.service.loadBalancerIP }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.contour.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.contour.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.contour.service.loadBalancerClass (eq .Values.contour.service.type "LoadBalancer") }}
|
||||
loadBalancerClass: {{ .Values.contour.service.loadBalancerClass }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- port: {{ .Values.contour.service.ports.xds }}
|
||||
name: tcp-xds
|
||||
protocol: TCP
|
||||
targetPort: xds
|
||||
{{- if (and (or (eq .Values.contour.service.type "NodePort") (eq .Values.contour.service.type "LoadBalancer")) (not (empty .Values.contour.service.nodePorts.xds))) }}
|
||||
nodePort: {{ .Values.contour.service.nodePorts.xds }}
|
||||
{{- else if eq .Values.contour.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- if .Values.contour.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.metrics.serviceMonitor.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-contour-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
ports:
|
||||
- name: metrics
|
||||
port: {{ .Values.contour.service.ports.metrics }}
|
||||
protocol: TCP
|
||||
targetPort: metrics
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.contour.serviceAccount.create .Values.contour.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "contour.contourServiceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- $mergedAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.contour.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- if $mergedAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $mergedAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.contour.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.serviceMonitor.enabled .Values.contour.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ printf "%s-contour" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.contour.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel | quote }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . | quote }}
|
||||
endpoints:
|
||||
- port: metrics
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{ toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{ toYaml .Values.metrics.serviceMonitor.relabelings | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,64 @@
|
||||
{{/*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/*
|
||||
Returns an init-container that bootstraps Envoy configuration so it's ready to be consumed by Envoy "main" container
|
||||
*/}}
|
||||
{{- define "contour.envoy.defaultInitContainers.initConfig" -}}
|
||||
- name: envoy-initconfig
|
||||
image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.contour.image.pullPolicy }}
|
||||
{{- if .Values.envoy.defaultInitContainers.initConfig.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.envoy.defaultInitContainers.initConfig.containerSecurityContext "context" .) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.defaultInitContainers.initConfig.resources }}
|
||||
resources: {{- toYaml .Values.envoy.defaultInitContainers.initConfig.resources | nindent 4 }}
|
||||
{{- else if ne .Values.envoy.defaultInitContainers.initConfig.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.envoy.defaultInitContainers.initConfig.resourcesPreset) | nindent 4 }}
|
||||
{{- end }}
|
||||
command:
|
||||
- contour
|
||||
args:
|
||||
- bootstrap
|
||||
- /config/envoy.json
|
||||
- --xds-address={{ include "common.names.fullname" . }}
|
||||
- --xds-port={{ .Values.contour.service.ports.xds }}
|
||||
- --resources-dir=/config/resources
|
||||
- --envoy-cafile=/certs/ca.crt
|
||||
- --envoy-cert-file=/certs/tls.crt
|
||||
- --envoy-key-file=/certs/tls.key
|
||||
{{- if .Values.contour.overloadManager.enabled }}
|
||||
- --overload-max-heap={{ int .Values.contour.overloadManager.maxHeapBytes }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: CONTOUR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- if .Values.contour.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.contour.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ tpl .Values.contour.extraEnvVarsCM . }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ tpl .Values.contour.extraEnvVarsSecret . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /config
|
||||
subPath: app-conf-dir
|
||||
- name: envoycert
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
- name: empty-dir
|
||||
mountPath: /admin
|
||||
subPath: app-admin-dir
|
||||
{{- end -}}
|
||||
@@ -0,0 +1,314 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.envoy.enabled (eq .Values.envoy.kind "daemonset") }}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.envoy.updateStrategy }}
|
||||
updateStrategy: {{- toYaml .Values.envoy.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
template:
|
||||
metadata:
|
||||
{{- if or .Values.envoy.podAnnotations .Values.commonAnnotations }}
|
||||
{{- $podAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podAnnotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
spec:
|
||||
{{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image .Values.envoy.image) "global" .Values.global) | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.envoy.automountServiceAccountToken }}
|
||||
{{- if .Values.envoy.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.priorityClassName }}
|
||||
priorityClassName: {{ .Values.envoy.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAntiAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.envoy.nodeAffinityPreset.type "key" .Values.envoy.nodeAffinityPreset.key "values" .Values.envoy.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.envoy.terminationGracePeriodSeconds }}
|
||||
hostNetwork: {{ .Values.envoy.hostNetwork }}
|
||||
dnsPolicy: {{ .Values.envoy.dnsPolicy }}
|
||||
{{- if .Values.envoy.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.envoy.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.envoy.shutdownManager.enabled }}
|
||||
- command:
|
||||
- contour
|
||||
args:
|
||||
- envoy
|
||||
- shutdown-manager
|
||||
- --serve-port={{ .Values.envoy.shutdownManager.containerPorts.http }}
|
||||
{{- if .Values.envoy.shutdownManager.extraArgs }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.extraArgs "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.contour.image.pullPolicy }}
|
||||
{{- if .Values.contour.extraEnvVars }}
|
||||
env:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.contour.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.envoy.shutdownManager.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- contour
|
||||
- envoy
|
||||
- shutdown
|
||||
{{- end }}
|
||||
name: shutdown-manager
|
||||
{{- if .Values.envoy.shutdownManager.resources }}
|
||||
resources: {{- toYaml .Values.envoy.shutdownManager.resources | nindent 12 }}
|
||||
{{- else if ne .Values.envoy.shutdownManager.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.envoy.shutdownManager.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.shutdownManager.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- contour
|
||||
initialDelaySeconds: {{ .Values.envoy.shutdownManager.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.shutdownManager.startupProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.shutdownManager.startupProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.shutdownManager.startupProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.shutdownManager.startupProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.shutdownManager.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: http-shutdown
|
||||
initialDelaySeconds: {{ .Values.envoy.shutdownManager.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.shutdownManager.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.shutdownManager.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.shutdownManager.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.shutdownManager.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.shutdownManager.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
port: http-shutdown
|
||||
path: /healthz
|
||||
initialDelaySeconds: {{ .Values.envoy.shutdownManager.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.shutdownManager.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.shutdownManager.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.shutdownManager.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.shutdownManager.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.envoy.shutdownManager.containerPorts.http }}
|
||||
name: http-shutdown
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /admin
|
||||
subPath: app-admin-dir
|
||||
{{- if .Values.envoy.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: envoy
|
||||
{{- if .Values.envoy.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- envoy
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args:
|
||||
- -c
|
||||
- /config/envoy.json
|
||||
- --service-cluster $(CONTOUR_NAMESPACE)
|
||||
- --service-node $(ENVOY_POD_NAME)
|
||||
- --log-level {{ .Values.envoy.logLevel }}
|
||||
{{- if .Values.envoy.extraArgs }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraArgs "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
image: {{ include "common.images.image" ( dict "imageRoot" .Values.envoy.image "global" .Values.global ) }}
|
||||
imagePullPolicy: {{ .Values.envoy.image.pullPolicy }}
|
||||
{{- if .Values.envoy.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.envoy.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: CONTOUR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: ENVOY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
{{- if .Values.envoy.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.envoy.extraEnvVarsCM .Values.envoy.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.envoy.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsCM "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsSecret "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.envoy.containerPorts.http }}
|
||||
{{- if .Values.envoy.useHostPort.http }}
|
||||
hostPort: {{ .Values.envoy.hostPorts.http }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.useHostIP }}
|
||||
hostIP: {{ .Values.envoy.hostIPs.http }}
|
||||
{{- end }}
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.envoy.containerPorts.https }}
|
||||
{{- if .Values.envoy.useHostPort.https }}
|
||||
hostPort: {{ .Values.envoy.hostPorts.https }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.useHostIP }}
|
||||
hostIP: {{ .Values.envoy.hostIPs.https }}
|
||||
{{- end }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.envoy.containerPorts.metrics }}
|
||||
{{- if .Values.envoy.useHostPort.metrics }}
|
||||
hostPort: {{ .Values.envoy.hostPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.useHostIP }}
|
||||
hostIP: {{ .Values.envoy.hostIPs.metrics }}
|
||||
{{- end }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- if .Values.envoy.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.envoy.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.envoy.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.resources }}
|
||||
resources: {{- toYaml .Values.envoy.resources | nindent 12 }}
|
||||
{{- else if ne .Values.envoy.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.envoy.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /config
|
||||
subPath: app-conf-dir
|
||||
- name: envoycert
|
||||
mountPath: /certs
|
||||
readOnly: true
|
||||
- name: empty-dir
|
||||
mountPath: /admin
|
||||
subPath: app-admin-dir
|
||||
{{- if .Values.envoy.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }}
|
||||
{{- end }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
{{- if .Values.envoy.shutdownManager.enabled }}
|
||||
httpGet:
|
||||
path: /shutdown
|
||||
port: {{ coalesce .Values.envoy.shutdownManager.port .Values.envoy.shutdownManager.containerPorts.http }}
|
||||
scheme: HTTP
|
||||
{{- else }}
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- '-c'
|
||||
- sleep {{ .Values.envoy.terminationGracePeriodSeconds }}; kill 1
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.sidecars "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- include "contour.envoy.defaultInitContainers.initConfig" . | nindent 8 }}
|
||||
{{- if .Values.envoy.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "envoy.envoyServiceAccountName" . }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
- name: envoycert
|
||||
secret:
|
||||
secretName: {{ include "contour.envoy.certs-secret.name" . }}
|
||||
{{- if .Values.envoy.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumes "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Always
|
||||
{{- end }}
|
||||
@@ -0,0 +1,347 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.envoy.enabled (eq .Values.envoy.kind "deployment") }}
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.envoy.autoscaling.enabled }}
|
||||
replicas: {{ .Values.envoy.replicaCount }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: {{ .Values.envoy.revisionHistoryLimit }}
|
||||
{{- if .Values.envoy.updateStrategy }}
|
||||
strategy: {{- toYaml .Values.envoy.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
minReadySeconds: {{ .Values.envoy.minReadySeconds }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
template:
|
||||
metadata:
|
||||
{{- if or .Values.envoy.podAnnotations .Values.commonAnnotations }}
|
||||
{{- $podAnnotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podAnnotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" (dict "value" $podAnnotations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
spec:
|
||||
{{- include "common.images.pullSecrets" ( dict "images" (list .Values.contour.image .Values.envoy.image) "global" .Values.global) | nindent 6 }}
|
||||
automountServiceAccountToken: {{ .Values.envoy.automountServiceAccountToken }}
|
||||
{{- if .Values.envoy.hostAliases }}
|
||||
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.hostAliases "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.affinity }}
|
||||
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.affinity "context" $) | nindent 8 }}
|
||||
{{- else }}
|
||||
affinity:
|
||||
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.envoy.podAntiAffinityPreset "component" "envoy" "customLabels" $podLabels "context" $) | nindent 10 }}
|
||||
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.envoy.nodeAffinityPreset.type "key" .Values.envoy.nodeAffinityPreset.key "values" .Values.envoy.nodeAffinityPreset.values) | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.priorityClassName }}
|
||||
priorityClassName: {{ .Values.envoy.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.schedulerName }}
|
||||
schedulerName: {{ .Values.envoy.schedulerName | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.topologySpreadConstraints }}
|
||||
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.topologySpreadConstraints "context" .) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.nodeSelector }}
|
||||
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.nodeSelector "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.tolerations }}
|
||||
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.tolerations "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.envoy.terminationGracePeriodSeconds }}
|
||||
hostNetwork: {{ .Values.envoy.hostNetwork }}
|
||||
dnsPolicy: {{ .Values.envoy.dnsPolicy }}
|
||||
{{- if .Values.envoy.podSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.envoy.podSecurityContext "context" $) | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
{{- if .Values.envoy.shutdownManager.enabled }}
|
||||
- command:
|
||||
- contour
|
||||
args:
|
||||
- envoy
|
||||
- shutdown-manager
|
||||
- --serve-port={{ coalesce .Values.envoy.shutdownManager.port .Values.envoy.shutdownManager.containerPorts.http }}
|
||||
{{- if .Values.envoy.shutdownManager.extraArgs }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.extraArgs "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
image: {{ include "common.images.image" ( dict "imageRoot" .Values.contour.image "global" .Values.global) }}
|
||||
imagePullPolicy: {{ .Values.contour.image.pullPolicy }}
|
||||
{{- if .Values.contour.extraEnvVars }}
|
||||
env:
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.contour.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.contour.extraEnvVarsCM .Values.contour.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.contour.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsCM "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- if .Values.contour.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.contour.extraEnvVarsSecret "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ coalesce .Values.envoy.shutdownManager.containerPorts.http .Values.envoy.shutdownManager.port }}
|
||||
name: http-shutdown
|
||||
protocol: TCP
|
||||
{{- if .Values.envoy.shutdownManager.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.envoy.shutdownManager.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.shutdownManager.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
exec:
|
||||
command:
|
||||
- pgrep
|
||||
- contour
|
||||
initialDelaySeconds: {{ .Values.envoy.shutdownManager.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.shutdownManager.startupProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.shutdownManager.startupProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.shutdownManager.startupProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.shutdownManager.startupProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.shutdownManager.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: http-shutdown
|
||||
initialDelaySeconds: {{ .Values.envoy.shutdownManager.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.shutdownManager.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.shutdownManager.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.shutdownManager.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.shutdownManager.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.shutdownManager.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
port: http-shutdown
|
||||
path: /healthz
|
||||
initialDelaySeconds: {{ .Values.envoy.shutdownManager.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.shutdownManager.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.shutdownManager.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.shutdownManager.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.shutdownManager.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.shutdownManager.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.shutdownManager.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- contour
|
||||
- envoy
|
||||
- shutdown
|
||||
{{- end }}
|
||||
name: shutdown-manager
|
||||
{{- if .Values.envoy.shutdownManager.resources }}
|
||||
resources: {{- toYaml .Values.envoy.shutdownManager.resources | nindent 12 }}
|
||||
{{- else if ne .Values.envoy.shutdownManager.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.envoy.shutdownManager.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /admin
|
||||
subPath: app-admin-dir
|
||||
{{- if .Values.envoy.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: envoy
|
||||
{{- if .Values.envoy.command }}
|
||||
command: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.command "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
command:
|
||||
- envoy
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.args }}
|
||||
args: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.args "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
args:
|
||||
- -c
|
||||
- /config/envoy.json
|
||||
- --service-cluster $(CONTOUR_NAMESPACE)
|
||||
- --service-node $(ENVOY_POD_NAME)
|
||||
- --log-level {{ .Values.envoy.logLevel }}
|
||||
{{- if .Values.envoy.extraArgs }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraArgs "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
image: {{ include "common.images.image" ( dict "imageRoot" .Values.envoy.image "global" .Values.global ) }}
|
||||
imagePullPolicy: {{ .Values.envoy.image.pullPolicy }}
|
||||
{{- if .Values.envoy.containerSecurityContext.enabled }}
|
||||
securityContext: {{- include "common.compatibility.renderSecurityContext" (dict "secContext" .Values.envoy.containerSecurityContext "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: CONTOUR_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
- name: ENVOY_POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.name
|
||||
{{- if .Values.envoy.extraEnvVars }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.extraEnvVars "context" $) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.envoy.extraEnvVarsCM .Values.envoy.extraEnvVarsSecret }}
|
||||
envFrom:
|
||||
{{- if .Values.envoy.extraEnvVarsCM }}
|
||||
- configMapRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsCM "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.extraEnvVarsSecret }}
|
||||
- secretRef:
|
||||
name: {{ include "common.tplvalues.render" ( dict "value" .Values.envoy.extraEnvVarsSecret "context" $ ) }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: {{ .Values.envoy.containerPorts.http }}
|
||||
# Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions.
|
||||
{{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.http) }}
|
||||
hostPort: {{ .Values.envoy.hostPorts.http }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.useHostIP }}
|
||||
hostIP: {{ .Values.envoy.hostIPs.http }}
|
||||
{{- end }}
|
||||
name: http
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.envoy.containerPorts.https }}
|
||||
# Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions.
|
||||
{{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.https) }}
|
||||
hostPort: {{ .Values.envoy.hostPorts.https }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.useHostIP }}
|
||||
hostIP: {{ .Values.envoy.hostIPs.https }}
|
||||
{{- end }}
|
||||
name: https
|
||||
protocol: TCP
|
||||
- containerPort: {{ .Values.envoy.containerPorts.metrics }}
|
||||
# Use of .Values.envoy.useHostPort as boolean is DEPRECATED. Support will be removed in upcoming versions.
|
||||
{{- if or (and (kindIs "boolean" .Values.envoy.useHostPort) .Values.envoy.useHostPort) (and (kindIs "map" .Values.envoy.useHostPort) .Values.envoy.useHostPort.metrics) }}
|
||||
hostPort: {{ .Values.envoy.hostPorts.metrics }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.useHostIP }}
|
||||
hostIP: {{ .Values.envoy.hostIPs.metrics }}
|
||||
{{- end }}
|
||||
name: metrics
|
||||
protocol: TCP
|
||||
{{- if .Values.envoy.customReadinessProbe }}
|
||||
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.customReadinessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.readinessProbe.enabled }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.envoy.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.readinessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.readinessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.readinessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.readinessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.customLivenessProbe }}
|
||||
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.customLivenessProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.livenessProbe.enabled }}
|
||||
livenessProbe:
|
||||
tcpSocket:
|
||||
port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.envoy.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.livenessProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.livenessProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.livenessProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.livenessProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.customStartupProbe }}
|
||||
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.customStartupProbe "context" $) | nindent 12 }}
|
||||
{{- else if .Values.envoy.startupProbe.enabled }}
|
||||
startupProbe:
|
||||
httpGet:
|
||||
path: /ready
|
||||
port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
initialDelaySeconds: {{ .Values.envoy.startupProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.envoy.startupProbe.periodSeconds }}
|
||||
timeoutSeconds: {{ .Values.envoy.startupProbe.timeoutSeconds }}
|
||||
successThreshold: {{ .Values.envoy.startupProbe.successThreshold }}
|
||||
failureThreshold: {{ .Values.envoy.startupProbe.failureThreshold }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.resources }}
|
||||
resources: {{- toYaml .Values.envoy.resources | nindent 12 }}
|
||||
{{- else if ne .Values.envoy.resourcesPreset "none" }}
|
||||
resources: {{- include "common.resources.preset" (dict "type" .Values.envoy.resourcesPreset) | nindent 12 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: empty-dir
|
||||
mountPath: /config
|
||||
subPath: app-conf-dir
|
||||
- name: envoycert
|
||||
mountPath: /certs
|
||||
- name: empty-dir
|
||||
mountPath: /admin
|
||||
subPath: app-admin-dir
|
||||
{{- if .Values.envoy.extraVolumeMounts }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumeMounts "context" $ ) | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.lifecycleHooks }}
|
||||
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.lifecycleHooks "context" $) | nindent 12 }}
|
||||
{{- else }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
{{- if .Values.envoy.shutdownManager.enabled }}
|
||||
httpGet:
|
||||
path: /shutdown
|
||||
port: {{ coalesce .Values.envoy.shutdownManager.port .Values.envoy.shutdownManager.containerPorts.http }}
|
||||
scheme: HTTP
|
||||
{{- else }}
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- '-c'
|
||||
- sleep {{ .Values.envoy.terminationGracePeriodSeconds }}; kill 1
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.sidecars }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.sidecars "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
{{- include "contour.envoy.defaultInitContainers.initConfig" . | nindent 8 }}
|
||||
{{- if .Values.envoy.initContainers }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.initContainers "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "envoy.envoyServiceAccountName" . }}
|
||||
volumes:
|
||||
- name: empty-dir
|
||||
emptyDir: {}
|
||||
- name: envoycert
|
||||
secret:
|
||||
secretName: {{ include "contour.envoy.certs-secret.name" . }}
|
||||
{{- if .Values.envoy.extraVolumes }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.extraVolumes "context" $ ) | nindent 8 }}
|
||||
{{- end }}
|
||||
restartPolicy: Always
|
||||
{{- end }}
|
||||
@@ -0,0 +1,9 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- range .Values.extraDeploy }}
|
||||
---
|
||||
{{ include "common.tplvalues.render" (dict "value" . "context" $) }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,39 @@
|
||||
{{- /*
|
||||
Meesho Custom: Headless service for Envoy DNS-based discovery
|
||||
*/}}
|
||||
|
||||
{{- if .Values.envoy.enabled }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}-headless
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.labels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
spec:
|
||||
clusterIP: None
|
||||
{{- if .Values.envoy.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.envoy.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.envoy.service.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.envoy.service.ports.http }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.envoy.service.targetPorts.http }}
|
||||
nodePort: null
|
||||
{{- if .Values.envoy.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
type: ClusterIP
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.envoy.enabled .Values.envoy.autoscaling.enabled (eq .Values.envoy.kind "deployment") (not .Values.envoy.autoscaling.keda.enabled) }}
|
||||
apiVersion: {{ include "common.capabilities.hpa.apiVersion" ( dict "context" $ ) }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.envoy.autoscaling.behavior }}
|
||||
behavior:
|
||||
{{- toYaml .Values.envoy.autoscaling.behavior | nindent 4 }}
|
||||
{{- end }}
|
||||
scaleTargetRef:
|
||||
apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }}
|
||||
kind: Deployment
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
minReplicas: {{ .Values.envoy.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.envoy.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- if .Values.envoy.autoscaling.targetCPU }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.envoy.autoscaling.targetCPU }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.autoscaling.targetMemory }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ .Values.envoy.autoscaling.targetMemory }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,88 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.envoy.enabled .Values.envoy.networkPolicy.enabled }}
|
||||
kind: NetworkPolicy
|
||||
apiVersion: {{ include "common.capabilities.networkPolicy.apiVersion" . }}
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
{{- if .Values.envoy.networkPolicy.allowExternalEgress }}
|
||||
egress:
|
||||
- {}
|
||||
{{- else }}
|
||||
egress:
|
||||
- ports:
|
||||
- port: 53
|
||||
protocol: UDP
|
||||
- port: 53
|
||||
protocol: TCP
|
||||
# Allow outbound connections to envoy
|
||||
- ports:
|
||||
- port: {{ .Values.envoy.containerPorts.http }}
|
||||
- port: {{ .Values.envoy.containerPorts.https }}
|
||||
- port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.contour.enabled }}
|
||||
# Allow outbound connections to other contour pods
|
||||
- ports:
|
||||
- port: {{ .Values.contour.containerPorts.xds }}
|
||||
- port: {{ .Values.contour.containerPorts.metrics }}
|
||||
to:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 14 }}
|
||||
app.kubernetes.io/component: contour
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.networkPolicy.extraEgress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.networkPolicy.extraEgress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ingress:
|
||||
- ports:
|
||||
- port: {{ .Values.envoy.containerPorts.http }}
|
||||
- port: {{ .Values.envoy.containerPorts.https }}
|
||||
- port: {{ .Values.envoy.containerPorts.metrics }}
|
||||
{{- if not .Values.envoy.networkPolicy.allowExternal }}
|
||||
from:
|
||||
- podSelector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 14 }}
|
||||
- podSelector:
|
||||
matchLabels:
|
||||
{{ template "common.names.fullname" . }}-client: "true"
|
||||
{{- if .Values.envoy.networkPolicy.ingressNSMatchLabels }}
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.envoy.networkPolicy.ingressNSMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.networkPolicy.ingressNSPodMatchLabels }}
|
||||
podSelector:
|
||||
matchLabels:
|
||||
{{- range $key, $value := .Values.envoy.networkPolicy.ingressNSPodMatchLabels }}
|
||||
{{ $key | quote }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.networkPolicy.extraIngress }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.envoy.networkPolicy.extraIngress "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,31 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $replicaCount := int .Values.envoy.replicaCount }}
|
||||
{{- if and .Values.envoy.enabled (eq .Values.envoy.kind "deployment") .Values.envoy.pdb.create (or (gt $replicaCount 1) .Values.envoy.autoscaling.enabled) }}
|
||||
apiVersion: {{ include "common.capabilities.policy.apiVersion" . }}
|
||||
kind: PodDisruptionBudget
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.envoy.pdb.minAvailable }}
|
||||
minAvailable: {{ .Values.envoy.pdb.minAvailable }}
|
||||
{{- end }}
|
||||
{{- if or .Values.envoy.pdb.maxUnavailable ( not .Values.envoy.pdb.minAvailable ) }}
|
||||
maxUnavailable: {{ .Values.envoy.pdb.maxUnavailable | default 0 }}
|
||||
{{- end }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- end }}
|
||||
@@ -0,0 +1,26 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.prometheusRule.enabled .Values.envoy.enabled .Values.metrics.enabled}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: PrometheusRule
|
||||
metadata:
|
||||
name: {{ include "common.names.fullname" . }}
|
||||
namespace: {{ default .Release.Namespace .Values.metrics.prometheusRule.namespace | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: metrics
|
||||
{{- if .Values.metrics.prometheusRule.additionalLabels }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
groups:
|
||||
- name: {{ include "common.names.fullname" . }}
|
||||
rules: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.prometheusRule.rules "context" $ ) | nindent 6 }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,60 @@
|
||||
{{- /*
|
||||
Meesho Custom: KEDA ScaledObject for Envoy autoscaling
|
||||
*/}}
|
||||
|
||||
{{- if .Values.envoy.autoscaling.keda.enabled }}
|
||||
apiVersion: keda.sh/v1alpha1
|
||||
kind: ScaledObject
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
pollingInterval: {{ .Values.envoy.autoscaling.keda.pollingInterval }}
|
||||
minReplicaCount: {{ .Values.envoy.autoscaling.minReplicas }}
|
||||
maxReplicaCount: {{ .Values.envoy.autoscaling.maxReplicas }}
|
||||
advanced:
|
||||
horizontalPodAutoscalerConfig:
|
||||
behavior:
|
||||
scaleDown:
|
||||
stabilizationWindowSeconds: {{ .Values.envoy.autoscaling.keda.stabilizationWindowSeconds | default "300" }}
|
||||
policies:
|
||||
{{- range .Values.envoy.autoscaling.keda.scaledown.policies }}
|
||||
- type: {{ .type }}
|
||||
value: {{ .value }}
|
||||
periodSeconds: {{ .periodseconds }}
|
||||
{{- end }}
|
||||
selectPolicy: {{ .Values.envoy.autoscaling.keda.scaledown.selectpolicy }}
|
||||
scaleUp:
|
||||
stabilizationWindowSeconds: {{ .Values.envoy.autoscaling.keda.scaleup.stabilizationWindowSeconds }}
|
||||
policies:
|
||||
{{- range .Values.envoy.autoscaling.keda.scaleup.policies }}
|
||||
- type: {{ .type }}
|
||||
value: {{ .value }}
|
||||
periodSeconds: {{ .periodseconds }}
|
||||
{{- end }}
|
||||
selectPolicy: {{ .Values.envoy.autoscaling.keda.scaleup.selectpolicy }}
|
||||
triggers:
|
||||
- metadata:
|
||||
value: {{ .Values.envoy.autoscaling.targetCPU | quote }}
|
||||
metricType: Utilization
|
||||
type: cpu
|
||||
- metadata:
|
||||
value: {{ .Values.envoy.autoscaling.targetMemory | quote }}
|
||||
metricType: Utilization
|
||||
type: memory
|
||||
{{- if .Values.envoy.autoscaling.keda.triggers }}
|
||||
{{- toYaml .Values.envoy.autoscaling.keda.triggers | nindent 2 }}
|
||||
{{- end }}
|
||||
|
||||
{{- end }}
|
||||
@@ -0,0 +1,17 @@
|
||||
{{- /*
|
||||
Meesho Custom: GKE ServiceExport for multi-cluster networking
|
||||
*/}}
|
||||
|
||||
{{- if .Values.envoy.service.export.enabled }}
|
||||
kind: ServiceExport
|
||||
apiVersion: net.gke.io/v1
|
||||
metadata:
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
name: {{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") .Values.envoy.service.name }}
|
||||
---
|
||||
kind: ServiceExport
|
||||
apiVersion: net.gke.io/v1
|
||||
metadata:
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
name: {{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") .Values.envoy.service.name }}-headless
|
||||
{{- end }}
|
||||
@@ -0,0 +1,47 @@
|
||||
{{- /*
|
||||
Meesho Custom: GCP Internal Load Balancer for Envoy service
|
||||
*/}}
|
||||
|
||||
{{- if .Values.envoy.enabled }}
|
||||
{{- if .Values.envoy.service.tcpLB }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}-tcp-lb
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
annotations:
|
||||
networking.gke.io/load-balancer-type: "Internal"
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.labels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
spec:
|
||||
{{- if .Values.envoy.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.envoy.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.envoy.service.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.envoy.service.ports.http }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.envoy.service.targetPorts.http }}
|
||||
{{- if .Values.envoy.service.ports.grpc }}
|
||||
- name: grpc
|
||||
port: {{ .Values.envoy.service.ports.grpc }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.envoy.service.targetPorts.http }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
type: LoadBalancer
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,36 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
{{- if and .Values.envoy.service.multiAz.enabled .Values.envoy.service.multiAz.zones .Values.envoy.enabled }}
|
||||
{{ include "envoy.envoyServiceMultiAZ" . }}
|
||||
{{- else if .Values.envoy.enabled }}
|
||||
{{ include "envoy.envoyService" . }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.enabled }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy-metrics" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
spec:
|
||||
type: ClusterIP
|
||||
clusterIP: None
|
||||
{{- if not .Values.envoy.shutdownManager.enabled }}
|
||||
publishNotReadyAddresses: true
|
||||
{{- end }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
ports:
|
||||
- name: metrics
|
||||
port: {{ .Values.envoy.service.ports.metrics }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.envoy.service.targetPorts.metrics }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,21 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.envoy.serviceAccount.create .Values.envoy.enabled }}
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: {{ include "envoy.envoyServiceAccountName" . }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if or .Values.envoy.serviceAccount.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
automountServiceAccountToken: {{ .Values.envoy.serviceAccount.automountServiceAccountToken }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,48 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{- if and .Values.metrics.serviceMonitor.enabled .Values.envoy.enabled }}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: {{ printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ default (include "common.names.namespace" .) .Values.metrics.serviceMonitor.namespace | quote }}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.metrics.serviceMonitor.labels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.commonAnnotations }}
|
||||
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
jobLabel: {{ .Values.metrics.serviceMonitor.jobLabel | quote }}
|
||||
selector:
|
||||
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 6 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
{{- if .Values.metrics.serviceMonitor.selector }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.selector "context" $) | nindent 6 }}
|
||||
{{- end }}
|
||||
namespaceSelector:
|
||||
matchNames:
|
||||
- {{ include "common.names.namespace" . | quote }}
|
||||
endpoints:
|
||||
- port: metrics
|
||||
path: /stats/prometheus
|
||||
{{- if .Values.metrics.serviceMonitor.interval }}
|
||||
interval: {{ .Values.metrics.serviceMonitor.interval }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.honorLabels }}
|
||||
honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.metricRelabelings }}
|
||||
metricRelabelings: {{ toYaml .Values.metrics.serviceMonitor.metricRelabelings | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.metrics.serviceMonitor.relabelings }}
|
||||
relabelings: {{ toYaml .Values.metrics.serviceMonitor.relabelings | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,145 @@
|
||||
{{- /*
|
||||
Copyright Broadcom, Inc. All Rights Reserved.
|
||||
SPDX-License-Identifier: APACHE-2.0
|
||||
*/}}
|
||||
|
||||
{{/* vim: set filetype=mustache: */}}
|
||||
|
||||
{{/*
|
||||
Create the standalone envoyService
|
||||
*/}}
|
||||
{{- define "envoy.envoyService" -}}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ default (printf "%s-envoy" (include "common.names.fullname" .) | trunc 63 | trimSuffix "-") .Values.envoy.service.name }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.labels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
annotations:
|
||||
{{- if (ne (index .Values.envoy.service.annotations "service.beta.kubernetes.io/aws-load-balancer-type" | toString ) "nlb") }}
|
||||
# This annotation puts the AWS ELB into "TCP" mode so that it does not
|
||||
# do HTTP negotiation for HTTPS connections at the ELB edge.
|
||||
# The downside of this is the remote IP address of all connections will
|
||||
# appear to be the internal address of the ELB. See docs/proxy-proto.md
|
||||
# for information about enabling the PROXY protocol on the ELB to recover
|
||||
# the original remote IP address.
|
||||
# We don't set this for nlb, per the contour docs.
|
||||
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
|
||||
{{- end }}
|
||||
{{- if or .Values.envoy.service.annotations .Values.commonAnnotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.annotations .Values.commonAnnotations ) "context" . ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.envoy.service.loadBalancerIP }}
|
||||
loadBalancerIP: {{ .Values.envoy.service.loadBalancerIP | quote }}
|
||||
{{- end }}
|
||||
{{- include "envoy.envoyServiceSpec" . }}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Create the multi az envoyService
|
||||
*/}}
|
||||
{{- define "envoy.envoyServiceMultiAZ" -}}
|
||||
{{- range $azArray := .Values.envoy.service.multiAz.zones }}
|
||||
{{- with $ -}}
|
||||
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.envoy.image "chart" .Chart ) ) }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ default (printf "%s-%s-envoy" (include "common.names.fullname" .) $azArray.name | trunc 63 | trimSuffix "-") .Values.envoy.service.name }}
|
||||
namespace: {{ include "common.names.namespace" . | quote }}
|
||||
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.labels .Values.commonLabels $versionLabel ) "context" . ) }}
|
||||
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
annotations:
|
||||
{{- if (ne (index .Values.envoy.service.annotations "service.beta.kubernetes.io/aws-load-balancer-type" | toString ) "nlb") }}
|
||||
# This annotation puts the AWS ELB into "TCP" mode so that it does not
|
||||
# do HTTP negotiation for HTTPS connections at the ELB edge.
|
||||
# The downside of this is the remote IP address of all connections will
|
||||
# appear to be the internal address of the ELB. See docs/proxy-proto.md
|
||||
# for information about enabling the PROXY protocol on the ELB to recover
|
||||
# the original remote IP address.
|
||||
# We don't set this for nlb, per the contour docs.
|
||||
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
|
||||
{{- end }}
|
||||
{{- if or .Values.envoy.service.annotations .Values.commonAnnotations $azArray.annotations }}
|
||||
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.service.annotations .Values.commonAnnotations $azArray.annotations ) "context" . ) }}
|
||||
{{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if $azArray.loadBalancerIP }}
|
||||
loadBalancerIP: {{ $azArray.loadBalancerIP | quote }}
|
||||
{{- end }}
|
||||
{{- include "envoy.envoyServiceSpec" . }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The default envoy service spec
|
||||
*/}}
|
||||
{{- define "envoy.envoyServiceSpec" -}}
|
||||
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.envoy.podLabels .Values.commonLabels ) "context" . ) }}
|
||||
{{- if .Values.envoy.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.envoy.service.externalTrafficPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if not (empty .Values.envoy.service.clusterIP) }}
|
||||
clusterIP: {{ .Values.envoy.service.clusterIP | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.sessionAffinity }}
|
||||
sessionAffinity: {{ .Values.envoy.service.sessionAffinity }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.sessionAffinityConfig }}
|
||||
sessionAffinityConfig: {{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.sessionAffinityConfig "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.externalIPs }}
|
||||
externalIPs: {{- toYaml .Values.envoy.service.externalIPs | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{- toYaml .Values.envoy.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.ipFamilyPolicy }}
|
||||
ipFamilyPolicy: {{ .Values.envoy.service.ipFamilyPolicy }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.ipFamilies }}
|
||||
ipFamilies: {{ toYaml .Values.envoy.service.ipFamilies | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if and .Values.envoy.service.loadBalancerClass (eq .Values.envoy.service.type "LoadBalancer") }}
|
||||
loadBalancerClass: {{ .Values.envoy.service.loadBalancerClass }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: http
|
||||
port: {{ .Values.envoy.service.ports.http }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.envoy.service.targetPorts.http }}
|
||||
{{- if and (or (eq .Values.envoy.service.type "NodePort") (eq .Values.envoy.service.type "LoadBalancer")) (not (empty .Values.envoy.service.nodePorts.http)) }}
|
||||
nodePort: {{ .Values.envoy.service.nodePorts.http }}
|
||||
{{- else if eq .Values.envoy.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{/* HTTPS port intentionally not rendered in Service to match old chart behavior.
|
||||
Old Bitnami chart never rendered https port even when configured in values.
|
||||
Rendering it causes GKE NEG controller to auto-add 443 to NEG annotation. */}}
|
||||
{{- if .Values.envoy.service.exposeMetrics }}
|
||||
- name: metrics
|
||||
port: {{ .Values.envoy.service.ports.metrics }}
|
||||
protocol: TCP
|
||||
targetPort: {{ .Values.envoy.service.targetPorts.metrics }}
|
||||
{{- if and (or (eq .Values.envoy.service.type "NodePort") (eq .Values.envoy.service.type "LoadBalancer")) (not (empty .Values.envoy.service.nodePorts.metrics)) }}
|
||||
nodePort: {{ .Values.envoy.service.nodePorts.metrics }}
|
||||
{{- else if eq .Values.envoy.service.type "ClusterIP" }}
|
||||
nodePort: null
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.envoy.service.extraPorts }}
|
||||
{{- include "common.tplvalues.render" (dict "value" .Values.envoy.service.extraPorts "context" $) | nindent 4 }}
|
||||
{{- end }}
|
||||
selector: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 4 }}
|
||||
app.kubernetes.io/component: envoy
|
||||
type: {{ .Values.envoy.service.type }}
|
||||
{{- end -}}
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user