416 lines
16 KiB
YAML
416 lines
16 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "fullname" . }}
|
|
labels:
|
|
{{- include "athens.metaLabels" . | nindent 4 }}
|
|
spec:
|
|
{{- if not .Values.autoscaling.enabled }}
|
|
replicas: {{ .Values.replicaCount }}
|
|
{{- end }}
|
|
{{- with .Values.strategy }}
|
|
strategy:
|
|
{{- if eq .type "Recreate" }}
|
|
type: Recreate
|
|
{{- else }}
|
|
{{ toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
selector:
|
|
matchLabels:
|
|
app: {{ include "fullname" . }}
|
|
release: "{{ .Release.Name }}"
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{- include "athens.metaLabels" . | nindent 8 }}
|
|
annotations:
|
|
checksum/upstream: {{ include (print $.Template.BasePath "/config-upstream.yaml") . | sha256sum }}
|
|
checksum/ssh-config: {{ include (print $.Template.BasePath "/config-ssh-git-servers.yaml") . | sha256sum }}
|
|
checksum/ssh-secret: {{ include (print $.Template.BasePath "/secret-ssh-git-servers.yaml") . | sha256sum }}
|
|
{{- if .Values.annotations }}
|
|
{{- toYaml .Values.annotations | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- if .Values.priorityClassName }}
|
|
priorityClassName: {{ .Values.priorityClassName | quote }}
|
|
{{- end }}
|
|
{{- if .Values.terminationGracePeriodSeconds }}
|
|
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
|
{{- end }}
|
|
{{- if .Values.image.runAsNonRoot }}
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
{{- end }}
|
|
serviceAccountName: {{ include "serviceAccountName" . | quote }}
|
|
{{- if .Values.image.pullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml .Values.image.pullSecrets | nindent 8 }}
|
|
{{- end }}
|
|
{{- if or .Values.sshGitServers .Values.extraInitContainers }}
|
|
initContainers:
|
|
{{- if .Values.sshGitServers }}
|
|
- name: copy-key-files
|
|
image: alpine:3.9
|
|
command:
|
|
- sh
|
|
- -c
|
|
args: ["cp {{ include "home" . }}/.ssh/id_rsa* /ssh-keys && chmod 400 /ssh-keys/*"]
|
|
volumeMounts:
|
|
- name: ssh-keys
|
|
mountPath: /ssh-keys
|
|
{{- $dot := . -}}
|
|
{{- range $server := .Values.sshGitServers }}
|
|
{{- if $server.existingSecret }}
|
|
- name: ssh-git-servers-secret-{{ $server.host | replace "." "-" }}
|
|
mountPath: "{{ include "home" $dot }}/.ssh/id_rsa-{{ $server.host }}"
|
|
subPath: {{ $server.existingSecret.subPath | quote }}
|
|
{{- else }}
|
|
- name: ssh-git-servers-secret
|
|
mountPath: {{ include "home" $dot }}/.ssh/id_rsa-{{ $server.host }}
|
|
subPath: id_rsa-{{ $server.host }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.initContainerSecurityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- with (default .Values.intiContainerResources .Values.initContainerResources) }}
|
|
resources:
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.extraInitContainers }}
|
|
{{- toYaml .Values.extraInitContainers | nindent 6 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
containers:
|
|
- name: {{ include "fullname" . }}
|
|
image: "{{ .Values.image.registry }}/{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.image.pullPolicy | quote }}
|
|
livenessProbe:
|
|
failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
|
|
httpGet:
|
|
path: "/healthz"
|
|
port: 3000
|
|
periodSeconds: {{ .Values.livenessProbe.periodSeconds }}
|
|
successThreshold: {{ .Values.livenessProbe.successThreshold }}
|
|
timeoutSeconds: {{ .Values.livenessProbe.timeoutSeconds }}
|
|
readinessProbe:
|
|
failureThreshold: {{ .Values.readinessProbe.failureThreshold }}
|
|
httpGet:
|
|
path: "/readyz"
|
|
port: 3000
|
|
periodSeconds: {{ .Values.readinessProbe.periodSeconds }}
|
|
successThreshold: {{ .Values.readinessProbe.successThreshold }}
|
|
timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }}
|
|
env:
|
|
- name: ATHENS_GOGET_WORKERS
|
|
value: {{ .Values.goGetWorkers | quote }}
|
|
- name: ATHENS_STORAGE_TYPE
|
|
value: {{ .Values.storage.type | quote }}
|
|
{{- if eq .Values.storage.type "disk"}}
|
|
- name: ATHENS_DISK_STORAGE_ROOT
|
|
value: {{ .Values.storage.disk.storageRoot | quote }}
|
|
{{- else if eq .Values.storage.type "mongo"}}
|
|
- name: ATHENS_MONGO_STORAGE_URL
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: ATHENS_MONGO_STORAGE_URL
|
|
{{- else if eq .Values.storage.type "s3" }}
|
|
- name: AWS_REGION
|
|
value: {{ .Values.storage.s3.region | quote }}
|
|
- name: ATHENS_S3_BUCKET_NAME
|
|
value: {{ .Values.storage.s3.bucket | quote }}
|
|
- name: AWS_USE_DEFAULT_CONFIGURATION
|
|
value: {{ .Values.storage.s3.useDefaultConfiguration | quote }}
|
|
- name: AWS_FORCE_PATH_STYLE
|
|
value: {{ .Values.storage.s3.forcePathStyle | quote }}
|
|
{{- if .Values.storage.s3.accessKey }}
|
|
- name: AWS_ACCESS_KEY_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: AWS_ACCESS_KEY_ID
|
|
{{- end }}
|
|
{{- if .Values.storage.s3.secretKey }}
|
|
- name: AWS_SECRET_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: AWS_SECRET_ACCESS_KEY
|
|
{{- end }}
|
|
{{- if .Values.storage.s3.sessionToken }}
|
|
- name: AWS_SESSION_TOKEN
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: AWS_SESSION_TOKEN
|
|
{{- end }}
|
|
{{- else if eq .Values.storage.type "gcp"}}
|
|
- name: GOOGLE_CLOUD_PROJECT
|
|
value: {{ .Values.storage.gcp.projectID | quote }}
|
|
- name: ATHENS_STORAGE_GCP_BUCKET
|
|
value: {{ .Values.storage.gcp.bucket | quote }}
|
|
{{- if .Values.storage.gcp.serviceAccount }}
|
|
- name: ATHENS_STORAGE_GCP_JSON_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: ATHENS_STORAGE_GCP_JSON_KEY
|
|
{{- end }}
|
|
{{- else if eq .Values.storage.type "minio" }}
|
|
{{- if .Values.storage.minio.endpoint }}
|
|
- name: ATHENS_MINIO_ENDPOINT
|
|
value: {{ .Values.storage.minio.endpoint | quote }}
|
|
{{- end }}
|
|
{{- if .Values.storage.minio.accessKey }}
|
|
- name: ATHENS_MINIO_ACCESS_KEY_ID
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: ATHENS_MINIO_ACCESS_KEY_ID
|
|
{{- end }}
|
|
{{- if .Values.storage.minio.secretKey }}
|
|
- name: ATHENS_MINIO_SECRET_ACCESS_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: ATHENS_MINIO_SECRET_ACCESS_KEY
|
|
{{- end }}
|
|
{{- if .Values.storage.minio.bucket }}
|
|
- name: ATHENS_MINIO_BUCKET_NAME
|
|
value: {{ .Values.storage.minio.bucket | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.singleFlight.type }}
|
|
- name: ATHENS_SINGLE_FLIGHT_TYPE
|
|
value: {{ .Values.singleFlight.type | quote }}
|
|
{{- end }}
|
|
{{- if eq .Values.singleFlight.type "etcd"}}
|
|
{{- if .Values.singleFlight.etcd.endpoints }}
|
|
- name: ATHENS_ETCD_ENDPOINTS
|
|
value: {{ .Values.singleFlight.etcd.endpoints | quote }}
|
|
{{- end }}
|
|
{{- else if eq .Values.singleFlight.type "redis"}}
|
|
{{- if .Values.singleFlight.redis.endpoint }}
|
|
- name: ATHENS_REDIS_ENDPOINT
|
|
value: {{ .Values.singleFlight.redis.endpoint | quote }}
|
|
{{- end }}
|
|
{{- if .Values.singleFlight.redis.password }}
|
|
- name: ATHENS_REDIS_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: ATHENS_SINGLE_FLIGHT_REDIS_PASSWORD
|
|
{{- end }}
|
|
{{- with .Values.singleFlight.redis.lockConfig }}
|
|
{{- if .ttl }}
|
|
- name: ATHENS_REDIS_LOCK_TTL
|
|
value: {{ .ttl | quote }}
|
|
{{- end }}
|
|
{{- if .timeout }}
|
|
- name: ATHENS_REDIS_LOCK_TIMEOUT
|
|
value: {{ .timeout | quote }}
|
|
{{- end }}
|
|
{{- if .maxRetries }}
|
|
- name: ATHENS_REDIS_LOCK_MAX_RETRIES
|
|
value: {{ .maxRetries | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- else if eq .Values.singleFlight.type "redis-sentinel"}}
|
|
{{- if .Values.singleFlight.redisSentinel.endpoints }}
|
|
- name: ATHENS_REDIS_SENTINEL_ENDPOINTS
|
|
value: {{ .Values.singleFlight.redisSentinel.endpoints | quote }}
|
|
{{- end }}
|
|
{{- if .Values.singleFlight.redisSentinel.masterName }}
|
|
- name: ATHENS_REDIS_SENTINEL_MASTER_NAME
|
|
value: {{ .Values.singleFlight.redisSentinel.masterName | quote }}
|
|
{{- end }}
|
|
{{- if .Values.singleFlight.redisSentinel.sentinelPassword }}
|
|
- name: ATHENS_REDIS_SENTINEL_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: ATHENS_SINGLE_FLIGHT_REDIS_SENTINEL_SENTINEL_PASSWORD
|
|
{{- end }}
|
|
{{- if .Values.singleFlight.redisSentinel.redisUsername }}
|
|
- name: ATHENS_REDIS_USERNAME
|
|
value: {{ .Values.singleFlight.redisSentinel.redisUsername | quote }}
|
|
{{- end }}
|
|
{{- if .Values.singleFlight.redisSentinel.redisPassword }}
|
|
- name: ATHENS_REDIS_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ include "fullname" . }}-secret
|
|
key: ATHENS_SINGLE_FLIGHT_REDIS_SENTINEL_REDIS_PASSWORD
|
|
{{- end }}
|
|
{{- with .Values.singleFlight.redisSentinel.lockConfig }}
|
|
{{- if .ttl }}
|
|
- name: ATHENS_REDIS_LOCK_TTL
|
|
value: {{ .ttl | quote }}
|
|
{{- end }}
|
|
{{- if .timeout }}
|
|
- name: ATHENS_REDIS_LOCK_TIMEOUT
|
|
value: {{ .timeout | quote }}
|
|
{{- end }}
|
|
{{- if .maxRetries }}
|
|
- name: ATHENS_REDIS_LOCK_MAX_RETRIES
|
|
value: {{ .maxRetries | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.netrc.enabled }}
|
|
- name: ATHENS_NETRC_PATH
|
|
value: "/etc/netrc/.netrc"
|
|
{{- end }}
|
|
{{- if .Values.upstreamProxy.enabled }}
|
|
- name: ATHENS_FILTER_FILE
|
|
value: "/usr/local/lib/FilterForUpstreamProxy"
|
|
- name: ATHENS_GLOBAL_ENDPOINT
|
|
value: {{ .Values.upstreamProxy.url | quote }}
|
|
{{- end }}
|
|
{{- if .Values.jaeger.enabled }}
|
|
- name: ATHENS_TRACE_EXPORTER_URL
|
|
value: {{ .Values.jaeger.url | default (print "http://" (include "fullname" .) "-jaeger:14268" ) | quote }}
|
|
- name: ATHENS_TRACE_EXPORTER
|
|
value: "jaeger"
|
|
{{- end }}
|
|
{{- if and .Values.tracing.enabled (not .Values.jaeger.enabled) }}
|
|
- name: ATHENS_TRACE_EXPORTER_URL
|
|
value: {{ .Values.tracing.url }}
|
|
- name: ATHENS_TRACE_EXPORTER
|
|
value: {{ .Values.tracing.type }}
|
|
{{- end }}
|
|
{{- if .Values.basicAuth.enabled }}
|
|
- name: BASIC_AUTH_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
|
|
key: {{ default "username" .Values.basicAuth.usernameSecretKey | quote }}
|
|
- name: BASIC_AUTH_PASS
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ default "athens-proxy-basic-auth" .Values.basicAuth.secretName | quote }}
|
|
key: {{ default "password" .Values.basicAuth.passwordSecretKey | quote }}
|
|
{{- end }}
|
|
{{- if .Values.configEnvVars }}
|
|
{{- toYaml .Values.configEnvVars | nindent 8 }}
|
|
{{- end }}
|
|
ports:
|
|
- containerPort: 3000
|
|
{{- if or (eq .Values.storage.type "disk") .Values.upstreamProxy.enabled .Values.netrc.enabled .Values.sshGitServers .Values.gitconfig.enabled .Values.extraVolumeMounts }}
|
|
volumeMounts:
|
|
{{- end }}
|
|
{{- if eq .Values.storage.type "disk" }}
|
|
- name: storage-volume
|
|
mountPath: {{ .Values.storage.disk.storageRoot | quote }}
|
|
{{- end }}
|
|
{{- if .Values.upstreamProxy.enabled }}
|
|
- name: upstream-config
|
|
mountPath: "/usr/local/lib"
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.netrc.enabled }}
|
|
- name: netrc
|
|
mountPath: "/etc/netrc"
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- if .Values.sshGitServers }}
|
|
- name: ssh-git-servers-config
|
|
mountPath: {{ include "home" . }}/.ssh/config
|
|
subPath: ssh_config
|
|
- name: ssh-git-servers-config
|
|
mountPath: {{ include "home" . }}/.gitconfig
|
|
subPath: git_config
|
|
- name: ssh-keys
|
|
mountPath: /ssh-keys
|
|
{{- end }}
|
|
{{- if .Values.gitconfig.enabled }}
|
|
- name: gitconfig
|
|
mountPath: "/etc/gitconfig"
|
|
subPath: "gitconfig"
|
|
{{- end }}
|
|
{{- range $server := .Values.sshGitServers }}
|
|
{{- if $server.existingSecret }}
|
|
- name: ssh-git-servers-secret-{{ $server.host | replace "." "-" }}
|
|
mountPath: {{ include "home" $ }}/.ssh/id_rsa-{{ $server.host }}
|
|
subPath: {{ $server.existingSecret.subPath | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.extraVolumeMounts }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.securityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- with .Values.lifecycle }}
|
|
lifecycle:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- with .Values.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: storage-volume
|
|
{{- if .Values.storage.disk.persistence.enabled }}
|
|
persistentVolumeClaim:
|
|
claimName: {{ include "fullname" . }}-storage
|
|
{{- else }}
|
|
emptyDir: {}
|
|
{{- end }}
|
|
{{- if .Values.upstreamProxy.enabled }}
|
|
- name: upstream-config
|
|
configMap:
|
|
name: {{ include "fullname" . }}-upstream
|
|
{{- end }}
|
|
{{- if .Values.netrc.enabled }}
|
|
- name: netrc
|
|
secret:
|
|
secretName: {{ .Values.netrc.existingSecret }}
|
|
{{- end }}
|
|
{{- if .Values.sshGitServers }}
|
|
- name: ssh-keys
|
|
emptyDir: {}
|
|
- name: ssh-git-servers-config
|
|
configMap:
|
|
name: {{ include "fullname" . }}-ssh-git-servers
|
|
- name: ssh-git-servers-secret
|
|
secret:
|
|
secretName: {{ include "fullname" . }}-ssh-git-servers
|
|
{{- range $server := .Values.sshGitServers }}
|
|
{{- if $server.existingSecret }}
|
|
- name: ssh-git-servers-secret-{{ $server.host | replace "." "-" }}
|
|
secret:
|
|
secretName: {{ $server.existingSecret.name | quote }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if .Values.gitconfig.enabled }}
|
|
- name: gitconfig
|
|
secret:
|
|
secretName: {{ .Values.gitconfig.secretName }}
|
|
items:
|
|
- key: {{ .Values.gitconfig.secretKey }}
|
|
path: "gitconfig"
|
|
{{- end }}
|
|
{{- with .Values.extraVolumes }}
|
|
{{- toYaml . | nindent 6 }}
|
|
{{- end }}
|
|
{{- with .Values.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|