mirror of
https://github.com/openappsec/openappsec.git
synced 2025-09-29 19:24:26 +03:00
Updating Kong helm chart
This commit is contained in:
Ned Wright
@@ -153,6 +153,9 @@ spec:
|
||||
- {{ $cidr }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .loadBalancerClass }}
|
||||
loadBalancerClass: {{ .loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .externalIPs }}
|
||||
externalIPs:
|
||||
@@ -316,6 +319,32 @@ Create a single listen (IP+port+parameter combo)
|
||||
{{- $listen | join " " -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the admin API service name for service discovery
|
||||
*/}}
|
||||
{{- define "kong.adminSvc" -}}
|
||||
{{- $gatewayDiscovery := .Values.ingressController.gatewayDiscovery -}}
|
||||
{{- if $gatewayDiscovery.enabled -}}
|
||||
{{- $adminApiService := $gatewayDiscovery.adminApiService -}}
|
||||
{{- $_ := required ".ingressController.gatewayDiscovery.adminApiService has to be provided when .Values.ingressController.gatewayDiscovery.enabled is set to true" $adminApiService -}}
|
||||
|
||||
{{- if (semverCompare "< 2.9.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
{{- fail (printf "Gateway discovery is available in controller versions 2.9 and up. Detected %s" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.deployment.kong.enabled }}
|
||||
{{- fail "deployment.kong.enabled and ingressController.gatewayDiscovery.enabled are mutually exclusive and cannot be enabled at once. Gateway discovery requires a split release installation of Gateways and Ingress Controller." }}
|
||||
{{- end }}
|
||||
|
||||
{{- $namespace := $adminApiService.namespace | default ( include "kong.namespace" . ) -}}
|
||||
{{- $name := $adminApiService.name -}}
|
||||
{{- $_ := required ".ingressController.gatewayDiscovery.adminApiService.name has to be provided when .Values.ingressController.gatewayDiscovery.enabled is set to true" $name -}}
|
||||
{{- printf "%s/%s" $namespace $name -}}
|
||||
{{- else -}}
|
||||
{{- fail "Can't use gateway discovery when .Values.ingressController.gatewayDiscovery.enabled is set to false." -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Return the local admin API URL, preferring HTTPS if available
|
||||
*/}}
|
||||
@@ -370,16 +399,61 @@ The name of the service used for the ingress controller's validation webhook
|
||||
*/}}
|
||||
|
||||
{{- $autoEnv := dict -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY" true -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_PUBLISH_SERVICE" (printf "%s/%s-proxy" ( include "kong.namespace" . ) (include "kong.fullname" .)) -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_INGRESS_CLASS" .Values.ingressController.ingressClass -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_ELECTION_ID" (printf "kong-ingress-controller-leader-%s" .Values.ingressController.ingressClass) -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_KONG_ADMIN_URL" (include "kong.adminLocalURL" .) -}}
|
||||
{{- if .Values.ingressController.admissionWebhook.enabled }}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_ADMISSION_WEBHOOK_LISTEN" (printf "0.0.0.0:%d" (int64 .Values.ingressController.admissionWebhook.port)) -}}
|
||||
{{- end }}
|
||||
{{- if (not (eq (len .Values.ingressController.watchNamespaces) 0)) }}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_WATCH_NAMESPACE" (.Values.ingressController.watchNamespaces | join ",") -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_KONG_ADMIN_TLS_SKIP_VERIFY" true -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_PUBLISH_SERVICE" (printf "%s/%s" ( include "kong.namespace" . ) ( .Values.proxy.nameOverride | default ( printf "%s-proxy" (include "kong.fullname" . )))) -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_INGRESS_CLASS" .Values.ingressController.ingressClass -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_ELECTION_ID" (printf "kong-ingress-controller-leader-%s" .Values.ingressController.ingressClass) -}}
|
||||
|
||||
{{- if .Values.ingressController.admissionWebhook.enabled }}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_ADMISSION_WEBHOOK_LISTEN" (printf "0.0.0.0:%d" (int64 .Values.ingressController.admissionWebhook.port)) -}}
|
||||
{{- end }}
|
||||
{{- if (not (eq (len .Values.ingressController.watchNamespaces) 0)) }}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_WATCH_NAMESPACE" (.Values.ingressController.watchNamespaces | join ",") -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
====== ADMIN API CONFIGURATION ======
|
||||
*/}}
|
||||
|
||||
{{- if .Values.ingressController.gatewayDiscovery.enabled -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_KONG_ADMIN_SVC" (include "kong.adminSvc" . ) -}}
|
||||
{{- else -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_KONG_ADMIN_URL" (include "kong.adminLocalURL" .) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- if .Values.ingressController.adminApi.tls.client.enabled }}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_KONG_ADMIN_TLS_CLIENT_CERT_FILE" "/etc/secrets/admin-api-cert/tls.crt" -}}
|
||||
{{- $_ := set $autoEnv "CONTROLLER_KONG_ADMIN_TLS_CLIENT_KEY_FILE" "/etc/secrets/admin-api-cert/tls.key" -}}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
====== KONNECT ENVIRONMENT VARIABLES ======
|
||||
*/}}
|
||||
|
||||
{{- if .Values.ingressController.konnect.enabled }}
|
||||
{{- if (semverCompare "< 2.9.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
{{- fail (printf "Konnect sync is available in controller versions 2.9 and up. Detected %s" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
{{- end }}
|
||||
|
||||
{{- if not .Values.ingressController.gatewayDiscovery.enabled }}
|
||||
{{- fail "ingressController.gatewayDiscovery.enabled has to be true when ingressController.konnect.enabled"}}
|
||||
{{- end }}
|
||||
|
||||
{{- $konnect := .Values.ingressController.konnect -}}
|
||||
{{- $_ := required "ingressController.konnect.runtimeGroupID is required when ingressController.konnect.enabled" $konnect.runtimeGroupID -}}
|
||||
|
||||
{{- $_ = set $autoEnv "CONTROLLER_KONNECT_SYNC_ENABLED" true -}}
|
||||
{{- $_ = set $autoEnv "CONTROLLER_KONNECT_RUNTIME_GROUP_ID" $konnect.runtimeGroupID -}}
|
||||
{{- $_ = set $autoEnv "CONTROLLER_KONNECT_ADDRESS" (printf "https://%s" .Values.ingressController.konnect.apiHostname) -}}
|
||||
|
||||
{{- $tlsCert := include "secretkeyref" (dict "name" $konnect.tlsClientCertSecretName "key" "tls.crt") -}}
|
||||
{{- $tlsKey := include "secretkeyref" (dict "name" $konnect.tlsClientCertSecretName "key" "tls.key") -}}
|
||||
{{- $_ = set $autoEnv "CONTROLLER_KONNECT_TLS_CLIENT_CERT" $tlsCert -}}
|
||||
{{- $_ = set $autoEnv "CONTROLLER_KONNECT_TLS_CLIENT_KEY" $tlsKey -}}
|
||||
|
||||
{{- if $konnect.license.enabled }}
|
||||
{{- $_ = set $autoEnv "CONTROLLER_KONNECT_LICENSING_ENABLED" true -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
@@ -420,10 +494,10 @@ The name of the service used for the ingress controller's validation webhook
|
||||
|
||||
{{- define "kong.volumes" -}}
|
||||
- name: {{ template "kong.fullname" . }}-prefix-dir
|
||||
emptyDir:
|
||||
emptyDir:
|
||||
sizeLimit: {{ .Values.deployment.prefixDir.sizeLimit }}
|
||||
- name: {{ template "kong.fullname" . }}-tmp
|
||||
emptyDir:
|
||||
emptyDir:
|
||||
sizeLimit: {{ .Values.deployment.tmpDir.sizeLimit }}
|
||||
{{- if and ( .Capabilities.APIVersions.Has "cert-manager.io/v1" ) .Values.certificates.enabled -}}
|
||||
{{- if .Values.certificates.cluster.enabled }}
|
||||
@@ -478,8 +552,9 @@ The name of the service used for the ingress controller's validation webhook
|
||||
|
||||
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
|
||||
{{- $dblessSourceCount := (add (.Values.dblessConfig.configMap | len | min 1) (.Values.dblessConfig.secret | len | min 1) (.Values.dblessConfig.config | len | min 1)) -}}
|
||||
{{- if gt $dblessSourceCount 1 -}}
|
||||
{{- fail "Ambiguous configuration: only one of of .Values.dblessConfig.configMap, .Values.dblessConfig.secret, and .Values.dblessConfig.config can be set." -}}
|
||||
{{- if gt $dblessSourceCount 1 -}}
|
||||
{{- fail "Ambiguous configuration: only one of of .Values.dblessConfig.configMap, .Values.dblessConfig.secret, and .Values.dblessConfig.config can be set." -}}
|
||||
{{- else if eq $dblessSourceCount 1 }}
|
||||
- name: kong-custom-dbless-config-volume
|
||||
{{- if .Values.dblessConfig.configMap }}
|
||||
configMap:
|
||||
@@ -494,7 +569,7 @@ The name of the service used for the ingress controller's validation webhook
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.ingressController.admissionWebhook.enabled }}
|
||||
{{- if and .Values.ingressController.enabled .Values.ingressController.admissionWebhook.enabled }}
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
{{- if .Values.ingressController.admissionWebhook.certificate.provided }}
|
||||
@@ -503,6 +578,11 @@ The name of the service used for the ingress controller's validation webhook
|
||||
secretName: {{ template "kong.fullname" . }}-validation-webhook-keypair
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or $.Values.admin.tls.client.secretName $.Values.admin.tls.client.caBundle }}
|
||||
- name: admin-client-ca
|
||||
configMap:
|
||||
name: {{ template "kong.fullname" . }}-admin-client-ca
|
||||
{{- end -}}
|
||||
{{- range $secretVolume := .Values.secretVolumes }}
|
||||
- name: {{ . }}
|
||||
secret:
|
||||
@@ -518,6 +598,19 @@ The name of the service used for the ingress controller's validation webhook
|
||||
secret:
|
||||
secretName: {{ .name }}
|
||||
{{- end }}
|
||||
{{- if and .Values.ingressController.adminApi.tls.client.enabled .Values.ingressController.enabled }}
|
||||
- name: admin-api-cert
|
||||
secret:
|
||||
secretName: {{ template "adminApiService.certSecretName" . }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "controller.adminApiCertVolumeMount" -}}
|
||||
{{- if and .Values.ingressController.adminApi.tls.client.enabled .Values.ingressController.enabled }}
|
||||
- name: admin-api-cert
|
||||
mountPath: /etc/secrets/admin-api-cert
|
||||
readOnly: true
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kong.userDefinedVolumeMounts" -}}
|
||||
@@ -552,12 +645,17 @@ The name of the service used for the ingress controller's validation webhook
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- $dblessSourceCount := (add (.Values.dblessConfig.configMap | len | min 1) (.Values.dblessConfig.secret | len | min 1) (.Values.dblessConfig.config | len | min 1)) -}}
|
||||
{{- if gt $dblessSourceCount 1 -}}
|
||||
{{- if eq $dblessSourceCount 1 -}}
|
||||
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
|
||||
- name: kong-custom-dbless-config-volume
|
||||
mountPath: /kong_dbless/
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if or $.Values.admin.tls.client.caBundle $.Values.admin.tls.client.secretName }}
|
||||
- name: admin-client-ca
|
||||
mountPath: /etc/admin-client-ca/
|
||||
readOnly: true
|
||||
{{- end -}}
|
||||
{{- range .Values.secretVolumes }}
|
||||
- name: {{ . }}
|
||||
mountPath: /etc/secrets/{{ . }}
|
||||
@@ -638,7 +736,7 @@ The name of the service used for the ingress controller's validation webhook
|
||||
{{- if .effectiveSemver -}}
|
||||
{{- .effectiveSemver -}}
|
||||
{{- else -}}
|
||||
{{- .tag -}}
|
||||
{{- (trimSuffix "-redhat" .tag) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -702,6 +800,7 @@ The name of the service used for the ingress controller's validation webhook
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- include "kong.userDefinedVolumeMounts" .Values.ingressController | nindent 2 }}
|
||||
{{- include "controller.adminApiCertVolumeMount" . | nindent 2 }}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "secretkeyref" -}}
|
||||
@@ -758,10 +857,18 @@ the template that it itself is using form the above sections.
|
||||
{{- $listenConfig := merge $listenConfig . -}}
|
||||
{{- $_ := set $listenConfig "address" $address -}}
|
||||
{{- $_ := set $autoEnv "KONG_ADMIN_LISTEN" (include "kong.listen" $listenConfig) -}}
|
||||
|
||||
{{- if or .tls.client.secretName .tls.client.caBundle -}}
|
||||
{{- $_ := set $autoEnv "KONG_NGINX_ADMIN_SSL_VERIFY_CLIENT" "on" -}}
|
||||
{{- $_ := set $autoEnv "KONG_NGINX_ADMIN_SSL_CLIENT_CERTIFICATE" "/etc/admin-client-ca/tls.crt" -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- end -}}
|
||||
|
||||
{{- if and ( .Capabilities.APIVersions.Has "cert-manager.io/v1" ) .Values.certificates.enabled -}}
|
||||
{{- if (and .Values.certificates.cluster.enabled .Values.cluster.enabled) -}}
|
||||
{{- $_ := set $autoEnv "KONG_CLUSTER_MTLS" "pki" -}}
|
||||
{{- $_ := set $autoEnv "KONG_CLUSTER_SERVER_NAME" .Values.certificates.cluster.commonName -}}
|
||||
{{- $_ := set $autoEnv "KONG_CLUSTER_CA_CERT" "/etc/cert-manager/cluster/ca.crt" -}}
|
||||
{{- $_ := set $autoEnv "KONG_CLUSTER_CERT" "/etc/cert-manager/cluster/tls.crt" -}}
|
||||
{{- $_ := set $autoEnv "KONG_CLUSTER_CERT_KEY" "/etc/cert-manager/cluster/tls.key" -}}
|
||||
@@ -914,7 +1021,7 @@ the template that it itself is using form the above sections.
|
||||
|
||||
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off")) }}
|
||||
{{- $dblessSourceCount := (add (.Values.dblessConfig.configMap | len | min 1) (.Values.dblessConfig.secret | len | min 1) (.Values.dblessConfig.config | len | min 1)) -}}
|
||||
{{- if gt $dblessSourceCount 1 -}}
|
||||
{{- if eq $dblessSourceCount 1 -}}
|
||||
{{- $_ := set $autoEnv "KONG_DECLARATIVE_CONFIG" "/kong_dbless/kong.yml" -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -1037,6 +1144,13 @@ role sets used in the charts. Updating these requires separating out cluster
|
||||
resource roles into their separate templates.
|
||||
*/}}
|
||||
{{- define "kong.kubernetesRBACRules" -}}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
{{- if (semverCompare "< 2.10.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
@@ -1044,20 +1158,7 @@ resource roles into their separate templates.
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- namespaces
|
||||
verbs:
|
||||
- list
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
{{- end }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
@@ -1087,14 +1188,6 @@ resource roles into their separate templates.
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
@@ -1306,6 +1399,22 @@ resource roles into their separate templates.
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- grpcroutes
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
resources:
|
||||
- grpcroutes/status
|
||||
verbs:
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
{{- end }}
|
||||
{{- if (.Capabilities.APIVersions.Has "networking.internal.knative.dev/v1alpha1") }}
|
||||
- apiGroups:
|
||||
@@ -1341,6 +1450,14 @@ resource roles into their separate templates.
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
- apiGroups:
|
||||
- discovery.k8s.io
|
||||
resources:
|
||||
- endpointslices
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
- watch
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
@@ -1373,6 +1490,15 @@ Kubernetes Cluster-scoped resources it uses to build Kong configuration.
|
||||
- get
|
||||
- patch
|
||||
- update
|
||||
{{- if (semverCompare ">= 2.10.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
- apiGroups:
|
||||
- apiextensions.k8s.io
|
||||
resources:
|
||||
- customresourcedefinitions
|
||||
verbs:
|
||||
- list
|
||||
- watch
|
||||
{{- end }}
|
||||
{{- if or (.Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1alpha2") (.Capabilities.APIVersions.Has "gateway.networking.k8s.io/v1beta1") }}
|
||||
- apiGroups:
|
||||
- gateway.networking.k8s.io
|
||||
@@ -1411,9 +1537,9 @@ extensions/v1beta1
|
||||
{{- end -}}
|
||||
|
||||
{{- define "kong.autoscalingVersion" -}}
|
||||
{{- if (.Capabilities.APIVersions.Has "autoscaling/v2") -}}
|
||||
{{- if (.Capabilities.APIVersions.Has "autoscaling/v2/HorizontalPodAutoscaler") -}}
|
||||
autoscaling/v2
|
||||
{{- else if (.Capabilities.APIVersions.Has "autoscaling/v2beta2") -}}
|
||||
{{- else if (.Capabilities.APIVersions.Has "autoscaling/v2beta2/HorizontalPodAutoscaler") -}}
|
||||
autoscaling/v2beta2
|
||||
{{- else -}}
|
||||
autoscaling/v1
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if .Values.ingressController.admissionWebhook.enabled }}
|
||||
{{- if (and .Values.ingressController.admissionWebhook.enabled .Values.ingressController.enabled) }}
|
||||
{{- $certCert := "" -}}
|
||||
{{- $certKey := "" -}}
|
||||
{{- $caCert := "" -}}
|
||||
@@ -34,8 +34,18 @@ metadata:
|
||||
namespace: {{ template "kong.namespace" . }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 4 }}
|
||||
{{- if .Values.ingressController.admissionWebhook.annotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.ingressController.admissionWebhook.annotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
webhooks:
|
||||
- name: validations.kong.konghq.com
|
||||
{{- with .Values.ingressController.admissionWebhook.namespaceSelector }}
|
||||
namespaceSelector:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
objectSelector:
|
||||
matchExpressions:
|
||||
- key: owner
|
||||
@@ -89,6 +99,9 @@ metadata:
|
||||
namespace: {{ template "kong.namespace" . }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 4 }}
|
||||
{{- if .Values.ingressController.admissionWebhook.service.labels }}
|
||||
{{- toYaml .Values.ingressController.admissionWebhook.service.labels | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ports:
|
||||
- name: webhook
|
||||
|
||||
@@ -1,447 +1,438 @@
|
||||
{{- if and (not (eq .Values.kind "Vanilla")) (or .Values.deployment.kong.enabled .Values.ingressController.enabled) }}
|
||||
apiVersion: apps/v1
|
||||
{{- if (eq .Values.kind "AppSec") }}
|
||||
{{- if .Values.deployment.daemonset }}
|
||||
kind: DaemonSet
|
||||
{{- else }}
|
||||
kind: Deployment
|
||||
{{- end }}
|
||||
{{- else if eq .Values.kind "AppSecStateful" }}
|
||||
kind: StatefulSet
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "kong.fullname" . }}
|
||||
namespace: {{ template "kong.namespace" . }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: app
|
||||
{{- if .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.deploymentAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
{{- if eq .Values.kind "AppSecStateful" }}
|
||||
serviceName: "cp-appsec-stateful-set"
|
||||
{{- end }}
|
||||
{{- if or (not .Values.deployment.daemonset) (and (eq .Values.kind "AppSecStateful") ( .Values.deployment.daemonset )) }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kong.selectorLabels" . | nindent 6 }}
|
||||
{{- if .Values.updateStrategy }}
|
||||
{{- if .Values.deployment.daemonset }}
|
||||
updateStrategy:
|
||||
{{- else }}
|
||||
strategy:
|
||||
{{- end }}
|
||||
{{ toYaml .Values.updateStrategy | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.minReadySeconds }}
|
||||
minReadySeconds: {{ .Values.deployment.minReadySeconds }}
|
||||
{{- end }}
|
||||
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
|
||||
kuma.io/service-account-token-volume: {{ template "kong.serviceAccountTokenName" . }}
|
||||
{{- end }}
|
||||
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off" )) }}
|
||||
{{- if .Values.dblessConfig.config }}
|
||||
checksum/dbless.config: {{ toYaml .Values.dblessConfig.config | sha256sum }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.podAnnotations }}
|
||||
{{- range $key, $value := .Values.podAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: app
|
||||
app: {{ template "kong.fullname" . }}
|
||||
version: {{ .Chart.AppVersion | quote }}
|
||||
{{- if .Values.podLabels }}
|
||||
{{ toYaml .Values.podLabels | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.deployment.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
||||
{{- end }}
|
||||
{{- if or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name }}
|
||||
serviceAccountName: {{ template "kong.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
{{- if (and (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name) .Values.deployment.serviceAccount.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: true
|
||||
{{- else }}
|
||||
automountServiceAccountToken: false
|
||||
{{ end }}
|
||||
{{- if .Values.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
- name: clear-stale-pid
|
||||
image: {{ include "kong.getRepoTag" .Values.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
command:
|
||||
- "rm"
|
||||
- "-vrf"
|
||||
- "$KONG_PREFIX/pids"
|
||||
env:
|
||||
{{- include "kong.env" . | nindent 8 }}
|
||||
volumeMounts:
|
||||
{{- include "kong.volumeMounts" . | nindent 8 }}
|
||||
{{- if .Values.deployment.initContainers }}
|
||||
{{- toYaml .Values.deployment.initContainers | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if (and (not (eq .Values.env.database "off")) .Values.waitImage.enabled) }}
|
||||
{{- include "kong.wait-for-db" . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml .Values.deployment.hostAliases | nindent 6 }}
|
||||
{{- end}}
|
||||
{{- if .Values.dnsPolicy }}
|
||||
dnsPolicy: {{ .Values.dnsPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{ toYaml .Values.dnsConfig | indent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Values.appsec.name }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- '[ -f /etc/cp/HttpTransactionHandler/cp-nano-http-transaction-handler ] && exit 0 || exit 1'
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
failureThreshold: 120
|
||||
successThreshold: 1
|
||||
securityContext:
|
||||
{{ toYaml .Values.appsec.securityContext | nindent 12 }}
|
||||
{{- with .Values.appsec.image }}
|
||||
image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
|
||||
{{- end }}
|
||||
command:
|
||||
- {{ .Values.appsec.command }}
|
||||
imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
|
||||
args:
|
||||
{{- if (eq "standalone" .Values.appsec.mode) }}
|
||||
- --hybrid-mode
|
||||
- --token
|
||||
- cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0
|
||||
{{- else }}
|
||||
- --token
|
||||
- {{ .Values.appsec.agentToken }}
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.customFog.enabled }}
|
||||
- --fog
|
||||
- {{ .Values.appsec.customFog.fogAddress }}
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.proxy }}
|
||||
- --proxy
|
||||
- {{ .Values.appsec.proxy }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
|
||||
env:
|
||||
{{- if eq .Values.appsec.playground false }}
|
||||
- name: SHARED_STORAGE_HOST
|
||||
value: {{ .Values.appsec.storage.name }}-svc
|
||||
- name: LEARNING_HOST
|
||||
value: {{ .Values.appsec.learning.name }}-svc
|
||||
{{- else }}
|
||||
- name: PLAYGROUND
|
||||
value: "true"
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.email }}
|
||||
{{- if eq .Values.appsec.email "STUB" }}
|
||||
{{- fail "Please replace STUB with an email address" }}
|
||||
{{- end }}
|
||||
- name: user_email
|
||||
value: {{ .Values.appsec.email }}
|
||||
{{- end }}
|
||||
- name: registered_server
|
||||
value: "Kong Server"
|
||||
resources:
|
||||
{{ toYaml .Values.resources | nindent 12 }}
|
||||
{{- if eq .Values.kind "AppSecStateful" }}
|
||||
volumeMounts:
|
||||
- name: advanced-model
|
||||
mountPath: /advanced-model
|
||||
- name: appsec-conf
|
||||
mountPath: /etc/cp/conf
|
||||
- name: appsec-data
|
||||
mountPath: /etc/cp/data
|
||||
{{- end }}
|
||||
{{- if .Values.ingressController.enabled }}
|
||||
{{- include "kong.controller-container" . | nindent 6 }}
|
||||
{{ end }}
|
||||
{{- if .Values.deployment.sidecarContainers }}
|
||||
{{- toYaml .Values.deployment.sidecarContainers | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.kong.enabled }}
|
||||
- name: "proxy"
|
||||
{{- with .Values.appsec.kong.image }}
|
||||
image: "{{ .repository }}:{{ .tag }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
env:
|
||||
{{- include "kong.no_daemon_env" . | nindent 8 }}
|
||||
lifecycle:
|
||||
{{- toYaml .Values.lifecycle | nindent 10 }}
|
||||
ports:
|
||||
{{- if (and .Values.admin.http.enabled .Values.admin.enabled) }}
|
||||
- name: admin
|
||||
containerPort: {{ .Values.admin.http.containerPort }}
|
||||
{{- if .Values.admin.http.hostPort }}
|
||||
hostPort: {{ .Values.admin.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.admin.tls.enabled .Values.admin.enabled) }}
|
||||
- name: admin-tls
|
||||
containerPort: {{ .Values.admin.tls.containerPort }}
|
||||
{{- if .Values.admin.tls.hostPort }}
|
||||
hostPort: {{ .Values.admin.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.proxy.http.enabled .Values.proxy.enabled) }}
|
||||
- name: proxy
|
||||
containerPort: {{ .Values.proxy.http.containerPort }}
|
||||
{{- if .Values.proxy.http.hostPort }}
|
||||
hostPort: {{ .Values.proxy.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.proxy.tls.enabled .Values.proxy.enabled)}}
|
||||
- name: proxy-tls
|
||||
containerPort: {{ .Values.proxy.tls.containerPort }}
|
||||
{{- if .Values.proxy.tls.hostPort }}
|
||||
hostPort: {{ .Values.proxy.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- range .Values.proxy.stream }}
|
||||
- name: stream{{ if (eq (default "TCP" .protocol) "UDP") }}udp{{ end }}-{{ .containerPort }}
|
||||
containerPort: {{ .containerPort }}
|
||||
{{- if .hostPort }}
|
||||
hostPort: {{ .hostPort }}
|
||||
{{- end}}
|
||||
protocol: {{ .protocol }}
|
||||
{{- end }}
|
||||
{{- range .Values.udpProxy.stream }}
|
||||
- name: streamudp-{{ .containerPort }}
|
||||
containerPort: {{ .containerPort }}
|
||||
{{- if .hostPort }}
|
||||
hostPort: {{ .hostPort }}
|
||||
{{- end}}
|
||||
protocol: {{ .protocol }}
|
||||
{{- end }}
|
||||
{{- if (and .Values.status.http.enabled .Values.status.enabled)}}
|
||||
- name: status
|
||||
containerPort: {{ .Values.status.http.containerPort }}
|
||||
{{- if .Values.status.http.hostPort }}
|
||||
hostPort: {{ .Values.status.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.status.tls.enabled .Values.status.enabled) }}
|
||||
- name: status-tls
|
||||
containerPort: {{ .Values.status.tls.containerPort }}
|
||||
{{- if .Values.status.tls.hostPort }}
|
||||
hostPort: {{ .Values.status.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.cluster.tls.enabled .Values.cluster.enabled) }}
|
||||
- name: cluster-tls
|
||||
containerPort: {{ .Values.cluster.tls.containerPort }}
|
||||
{{- if .Values.cluster.tls.hostPort }}
|
||||
hostPort: {{ .Values.cluster.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.enterprise.enabled }}
|
||||
{{- if (and .Values.manager.http.enabled .Values.manager.enabled) }}
|
||||
- name: manager
|
||||
containerPort: {{ .Values.manager.http.containerPort }}
|
||||
{{- if .Values.manager.http.hostPort }}
|
||||
hostPort: {{ .Values.manager.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.manager.tls.enabled .Values.manager.enabled) }}
|
||||
- name: manager-tls
|
||||
containerPort: {{ .Values.manager.tls.containerPort }}
|
||||
{{- if .Values.manager.tls.hostPort }}
|
||||
hostPort: {{ .Values.manager.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portal.http.enabled .Values.portal.enabled) }}
|
||||
- name: portal
|
||||
containerPort: {{ .Values.portal.http.containerPort }}
|
||||
{{- if .Values.portal.http.hostPort }}
|
||||
hostPort: {{ .Values.portal.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portal.tls.enabled .Values.portal.enabled) }}
|
||||
- name: portal-tls
|
||||
containerPort: {{ .Values.portal.tls.containerPort }}
|
||||
{{- if .Values.portal.tls.hostPort }}
|
||||
hostPort: {{ .Values.portal.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portalapi.http.enabled .Values.portalapi.enabled) }}
|
||||
- name: portalapi
|
||||
containerPort: {{ .Values.portalapi.http.containerPort }}
|
||||
{{- if .Values.portalapi.http.hostPort }}
|
||||
hostPort: {{ .Values.portalapi.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portalapi.tls.enabled .Values.portalapi.enabled) }}
|
||||
- name: portalapi-tls
|
||||
containerPort: {{ .Values.portalapi.tls.containerPort }}
|
||||
{{- if .Values.portalapi.tls.hostPort }}
|
||||
hostPort: {{ .Values.portalapi.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.clustertelemetry.tls.enabled .Values.clustertelemetry.enabled) }}
|
||||
- name: clustert-tls
|
||||
containerPort: {{ .Values.clustertelemetry.tls.containerPort }}
|
||||
{{- if .Values.clustertelemetry.tls.hostPort }}
|
||||
hostPort: {{ .Values.clustertelemetry.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- include "kong.volumeMounts" . | nindent 10 }}
|
||||
{{- include "kong.userDefinedVolumeMounts" .Values.deployment | nindent 10 }}
|
||||
readinessProbe:
|
||||
{{ toYaml .Values.readinessProbe | indent 10 }}
|
||||
livenessProbe:
|
||||
{{ toYaml .Values.livenessProbe | indent 10 }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
{{- end }} {{/* End of Kong container spec */}}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{ toYaml .Values.topologySpreadConstraints | indent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- include "kong.podsecuritycontext" . | nindent 8 }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: advanced-model
|
||||
configMap:
|
||||
name: advanced-model-config
|
||||
optional: true
|
||||
{{- include "kong.volumes" . | nindent 8 -}}
|
||||
{{- include "kong.userDefinedVolumes" . | nindent 8 -}}
|
||||
{{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
|
||||
- name: {{ template "kong.serviceAccountTokenName" . }}
|
||||
{{- /* Due to GKE versions (e.g. v1.23.15-gke.1900) we need to handle pre-release part of the version as well.
|
||||
See the related documentation of semver module that Helm depends on for semverCompare:
|
||||
https://github.com/Masterminds/semver#working-with-prerelease-versions
|
||||
Related Helm issue: https://github.com/helm/helm/issues/3810 */}}
|
||||
{{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }}
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
{{- else }}
|
||||
secret:
|
||||
secretName: {{ template "kong.serviceAccountTokenName" . }}
|
||||
items:
|
||||
- key: token
|
||||
path: token
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- key: namespace
|
||||
path: namespace
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- if eq .Values.kind "AppSecStateful" }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: appsec-conf
|
||||
spec:
|
||||
accessModes: [ "ReadWriteOnce" ]
|
||||
# Need to create a storage class resource.
|
||||
{{- if .Values.appsec.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.appsec.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.appsec.persistence.storageClass }}"
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.appsec.persistence.conf.size | quote }}
|
||||
- metadata:
|
||||
name: appsec-data
|
||||
spec:
|
||||
accessModes: [ "ReadWriteOnce" ]
|
||||
# Need to create a storage class resource.
|
||||
{{- if .Values.appsec.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.appsec.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.appsec.persistence.storageClass }}"
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.appsec.persistence.data.size | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if and (not (eq .Values.kind "Vanilla")) (or .Values.deployment.kong.enabled .Values.ingressController.enabled) }}
|
||||
apiVersion: apps/v1
|
||||
{{- if (eq .Values.kind "AppSec") }}
|
||||
{{- if .Values.deployment.daemonset }}
|
||||
kind: DaemonSet
|
||||
{{- else }}
|
||||
kind: Deployment
|
||||
{{- end }}
|
||||
{{- else if eq .Values.kind "AppSecStateful" }}
|
||||
kind: StatefulSet
|
||||
{{- end }}
|
||||
metadata:
|
||||
name: {{ template "kong.fullname" . }}
|
||||
namespace: {{ template "kong.namespace" . }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: app
|
||||
{{- if .Values.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- range $key, $value := .Values.deploymentAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if not .Values.autoscaling.enabled }}
|
||||
{{- if eq .Values.kind "AppSecStateful" }}
|
||||
serviceName: "cp-appsec-stateful-set"
|
||||
{{- end }}
|
||||
{{- if or (not .Values.deployment.daemonset) (and (eq .Values.kind "AppSecStateful") ( .Values.deployment.daemonset )) }}
|
||||
replicas: {{ .Values.replicaCount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "kong.selectorLabels" . | nindent 6 }}
|
||||
{{- if .Values.updateStrategy }}
|
||||
{{- if .Values.deployment.daemonset }}
|
||||
updateStrategy:
|
||||
{{- else }}
|
||||
strategy:
|
||||
{{- end }}
|
||||
{{ toYaml .Values.updateStrategy | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.minReadySeconds }}
|
||||
minReadySeconds: {{ .Values.deployment.minReadySeconds }}
|
||||
{{- end }}
|
||||
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
{{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
|
||||
kuma.io/service-account-token-volume: {{ template "kong.serviceAccountTokenName" . }}
|
||||
{{- end }}
|
||||
{{- if (and (not .Values.ingressController.enabled) (eq .Values.env.database "off" )) }}
|
||||
{{- if .Values.dblessConfig.config }}
|
||||
checksum/dbless.config: {{ toYaml .Values.dblessConfig.config | sha256sum }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.podAnnotations }}
|
||||
{{- range $key, $value := .Values.podAnnotations }}
|
||||
{{ $key }}: {{ $value | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 8 }}
|
||||
app.kubernetes.io/component: app
|
||||
app: {{ template "kong.fullname" . }}
|
||||
version: {{ .Chart.AppVersion | quote }}
|
||||
{{- if .Values.podLabels }}
|
||||
{{ toYaml .Values.podLabels | nindent 8 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.deployment.hostNetwork }}
|
||||
hostNetwork: true
|
||||
{{- end }}
|
||||
{{- if .Values.priorityClassName }}
|
||||
priorityClassName: "{{ .Values.priorityClassName }}"
|
||||
{{- end }}
|
||||
{{- if or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name }}
|
||||
serviceAccountName: {{ template "kong.serviceAccountName" . }}
|
||||
{{- end }}
|
||||
{{- if (and (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name) .Values.deployment.serviceAccount.automountServiceAccountToken) }}
|
||||
automountServiceAccountToken: true
|
||||
{{- else }}
|
||||
automountServiceAccountToken: false
|
||||
{{ end }}
|
||||
{{- if .Values.image.pullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- range .Values.image.pullSecrets }}
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
initContainers:
|
||||
- name: clear-stale-pid
|
||||
image: {{ include "kong.getRepoTag" .Values.image }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
command:
|
||||
- "rm"
|
||||
- "-vrf"
|
||||
- "$KONG_PREFIX/pids"
|
||||
env:
|
||||
{{- include "kong.env" . | nindent 8 }}
|
||||
volumeMounts:
|
||||
{{- include "kong.volumeMounts" . | nindent 8 }}
|
||||
{{- if .Values.deployment.initContainers }}
|
||||
{{- toYaml .Values.deployment.initContainers | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if (and (not (eq .Values.env.database "off")) .Values.waitImage.enabled) }}
|
||||
{{- include "kong.wait-for-db" . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml .Values.deployment.hostAliases | nindent 6 }}
|
||||
{{- end}}
|
||||
{{- if .Values.dnsPolicy }}
|
||||
dnsPolicy: {{ .Values.dnsPolicy | quote }}
|
||||
{{- end }}
|
||||
{{- if .Values.dnsConfig }}
|
||||
dnsConfig:
|
||||
{{ toYaml .Values.dnsConfig | indent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Values.appsec.name }}
|
||||
readinessProbe:
|
||||
exec:
|
||||
command:
|
||||
- sh
|
||||
- -c
|
||||
- '[ -f /etc/cp/HttpTransactionHandler/cp-nano-http-transaction-handler ] && exit 0 || exit 1'
|
||||
initialDelaySeconds: 30
|
||||
periodSeconds: 5
|
||||
failureThreshold: 120
|
||||
successThreshold: 1
|
||||
securityContext:
|
||||
{{ toYaml .Values.appsec.securityContext | nindent 12 }}
|
||||
{{- with .Values.appsec.image }}
|
||||
image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
|
||||
{{- end }}
|
||||
command:
|
||||
- {{ .Values.appsec.command }}
|
||||
imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
|
||||
args:
|
||||
{{- if (eq "standalone" .Values.appsec.mode) }}
|
||||
- --hybrid-mode
|
||||
- --token
|
||||
- cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0
|
||||
{{- else }}
|
||||
- --token
|
||||
- {{ .Values.appsec.agentToken }}
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.customFog.enabled }}
|
||||
- --fog
|
||||
- {{ .Values.appsec.customFog.fogAddress }}
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.proxy }}
|
||||
- --proxy
|
||||
- {{ .Values.appsec.proxy }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
|
||||
env:
|
||||
{{- if eq .Values.appsec.playground false }}
|
||||
- name: SHARED_STORAGE_HOST
|
||||
value: {{ .Values.appsec.storage.name }}-svc
|
||||
- name: LEARNING_HOST
|
||||
value: {{ .Values.appsec.learning.name }}-svc
|
||||
{{- else }}
|
||||
- name: PLAYGROUND
|
||||
value: "true"
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | nindent 12 }}
|
||||
{{- if eq .Values.kind "AppSecStateful" }}
|
||||
volumeMounts:
|
||||
- name: advanced-model
|
||||
mountPath: /advanced-model
|
||||
- name: appsec-conf
|
||||
mountPath: /etc/cp/conf
|
||||
- name: appsec-data
|
||||
mountPath: /etc/cp/data
|
||||
{{- end }}
|
||||
{{- if .Values.ingressController.enabled }}
|
||||
{{- include "kong.controller-container" . | nindent 6 }}
|
||||
{{ end }}
|
||||
{{- if .Values.deployment.sidecarContainers }}
|
||||
{{- toYaml .Values.deployment.sidecarContainers | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.kong.enabled }}
|
||||
- name: "proxy"
|
||||
{{- with .Values.appsec.kong.image }}
|
||||
image: "{{ .repository }}:{{ .tag }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.image.pullPolicy }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.containerSecurityContext | nindent 10 }}
|
||||
env:
|
||||
{{- include "kong.no_daemon_env" . | nindent 8 }}
|
||||
lifecycle:
|
||||
{{- toYaml .Values.lifecycle | nindent 10 }}
|
||||
ports:
|
||||
{{- if (and .Values.admin.http.enabled .Values.admin.enabled) }}
|
||||
- name: admin
|
||||
containerPort: {{ .Values.admin.http.containerPort }}
|
||||
{{- if .Values.admin.http.hostPort }}
|
||||
hostPort: {{ .Values.admin.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.admin.tls.enabled .Values.admin.enabled) }}
|
||||
- name: admin-tls
|
||||
containerPort: {{ .Values.admin.tls.containerPort }}
|
||||
{{- if .Values.admin.tls.hostPort }}
|
||||
hostPort: {{ .Values.admin.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.proxy.http.enabled .Values.proxy.enabled) }}
|
||||
- name: proxy
|
||||
containerPort: {{ .Values.proxy.http.containerPort }}
|
||||
{{- if .Values.proxy.http.hostPort }}
|
||||
hostPort: {{ .Values.proxy.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.proxy.tls.enabled .Values.proxy.enabled)}}
|
||||
- name: proxy-tls
|
||||
containerPort: {{ .Values.proxy.tls.containerPort }}
|
||||
{{- if .Values.proxy.tls.hostPort }}
|
||||
hostPort: {{ .Values.proxy.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- range .Values.proxy.stream }}
|
||||
- name: stream{{ if (eq (default "TCP" .protocol) "UDP") }}udp{{ end }}-{{ .containerPort }}
|
||||
containerPort: {{ .containerPort }}
|
||||
{{- if .hostPort }}
|
||||
hostPort: {{ .hostPort }}
|
||||
{{- end}}
|
||||
protocol: {{ .protocol }}
|
||||
{{- end }}
|
||||
{{- range .Values.udpProxy.stream }}
|
||||
- name: streamudp-{{ .containerPort }}
|
||||
containerPort: {{ .containerPort }}
|
||||
{{- if .hostPort }}
|
||||
hostPort: {{ .hostPort }}
|
||||
{{- end}}
|
||||
protocol: {{ .protocol }}
|
||||
{{- end }}
|
||||
{{- if (and .Values.status.http.enabled .Values.status.enabled)}}
|
||||
- name: status
|
||||
containerPort: {{ .Values.status.http.containerPort }}
|
||||
{{- if .Values.status.http.hostPort }}
|
||||
hostPort: {{ .Values.status.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.status.tls.enabled .Values.status.enabled) }}
|
||||
- name: status-tls
|
||||
containerPort: {{ .Values.status.tls.containerPort }}
|
||||
{{- if .Values.status.tls.hostPort }}
|
||||
hostPort: {{ .Values.status.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.cluster.tls.enabled .Values.cluster.enabled) }}
|
||||
- name: cluster-tls
|
||||
containerPort: {{ .Values.cluster.tls.containerPort }}
|
||||
{{- if .Values.cluster.tls.hostPort }}
|
||||
hostPort: {{ .Values.cluster.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if .Values.enterprise.enabled }}
|
||||
{{- if (and .Values.manager.http.enabled .Values.manager.enabled) }}
|
||||
- name: manager
|
||||
containerPort: {{ .Values.manager.http.containerPort }}
|
||||
{{- if .Values.manager.http.hostPort }}
|
||||
hostPort: {{ .Values.manager.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.manager.tls.enabled .Values.manager.enabled) }}
|
||||
- name: manager-tls
|
||||
containerPort: {{ .Values.manager.tls.containerPort }}
|
||||
{{- if .Values.manager.tls.hostPort }}
|
||||
hostPort: {{ .Values.manager.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portal.http.enabled .Values.portal.enabled) }}
|
||||
- name: portal
|
||||
containerPort: {{ .Values.portal.http.containerPort }}
|
||||
{{- if .Values.portal.http.hostPort }}
|
||||
hostPort: {{ .Values.portal.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portal.tls.enabled .Values.portal.enabled) }}
|
||||
- name: portal-tls
|
||||
containerPort: {{ .Values.portal.tls.containerPort }}
|
||||
{{- if .Values.portal.tls.hostPort }}
|
||||
hostPort: {{ .Values.portal.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portalapi.http.enabled .Values.portalapi.enabled) }}
|
||||
- name: portalapi
|
||||
containerPort: {{ .Values.portalapi.http.containerPort }}
|
||||
{{- if .Values.portalapi.http.hostPort }}
|
||||
hostPort: {{ .Values.portalapi.http.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.portalapi.tls.enabled .Values.portalapi.enabled) }}
|
||||
- name: portalapi-tls
|
||||
containerPort: {{ .Values.portalapi.tls.containerPort }}
|
||||
{{- if .Values.portalapi.tls.hostPort }}
|
||||
hostPort: {{ .Values.portalapi.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- if (and .Values.clustertelemetry.tls.enabled .Values.clustertelemetry.enabled) }}
|
||||
- name: clustert-tls
|
||||
containerPort: {{ .Values.clustertelemetry.tls.containerPort }}
|
||||
{{- if .Values.clustertelemetry.tls.hostPort }}
|
||||
hostPort: {{ .Values.clustertelemetry.tls.hostPort }}
|
||||
{{- end}}
|
||||
protocol: TCP
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- include "kong.volumeMounts" . | nindent 10 }}
|
||||
{{- include "kong.userDefinedVolumeMounts" .Values.deployment | nindent 10 }}
|
||||
readinessProbe:
|
||||
{{ toYaml .Values.readinessProbe | indent 10 }}
|
||||
livenessProbe:
|
||||
{{ toYaml .Values.livenessProbe | indent 10 }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
{{- end }} {{/* End of Kong container spec */}}
|
||||
{{- if .Values.affinity }}
|
||||
affinity:
|
||||
{{ toYaml .Values.affinity | indent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{ toYaml .Values.topologySpreadConstraints | indent 8 }}
|
||||
{{- end }}
|
||||
securityContext:
|
||||
{{- include "kong.podsecuritycontext" . | nindent 8 }}
|
||||
{{- if .Values.nodeSelector }}
|
||||
nodeSelector:
|
||||
{{ toYaml .Values.nodeSelector | indent 8 }}
|
||||
{{- end }}
|
||||
terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.tolerations }}
|
||||
tolerations:
|
||||
{{ toYaml .Values.tolerations | indent 8 }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: advanced-model
|
||||
configMap:
|
||||
name: advanced-model-config
|
||||
optional: true
|
||||
{{- include "kong.volumes" . | nindent 8 -}}
|
||||
{{- include "kong.userDefinedVolumes" . | nindent 8 -}}
|
||||
{{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
|
||||
- name: {{ template "kong.serviceAccountTokenName" . }}
|
||||
{{- /* Due to GKE versions (e.g. v1.23.15-gke.1900) we need to handle pre-release part of the version as well.
|
||||
See the related documentation of semver module that Helm depends on for semverCompare:
|
||||
https://github.com/Masterminds/semver#working-with-prerelease-versions
|
||||
Related Helm issue: https://github.com/helm/helm/issues/3810 */}}
|
||||
{{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }}
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
expirationSeconds: 3607
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- fieldRef:
|
||||
apiVersion: v1
|
||||
fieldPath: metadata.namespace
|
||||
path: namespace
|
||||
{{- else }}
|
||||
secret:
|
||||
secretName: {{ template "kong.serviceAccountTokenName" . }}
|
||||
items:
|
||||
- key: token
|
||||
path: token
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
- key: namespace
|
||||
path: namespace
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- if eq .Values.kind "AppSecStateful" }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: appsec-conf
|
||||
spec:
|
||||
accessModes: [ "ReadWriteOnce" ]
|
||||
# Need to create a storage class resource.
|
||||
{{- if .Values.appsec.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.appsec.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.appsec.persistence.storageClass }}"
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.appsec.persistence.conf.size | quote }}
|
||||
- metadata:
|
||||
name: appsec-data
|
||||
spec:
|
||||
accessModes: [ "ReadWriteOnce" ]
|
||||
# Need to create a storage class resource.
|
||||
{{- if .Values.appsec.persistence.storageClass }}
|
||||
{{- if (eq "-" .Values.appsec.persistence.storageClass) }}
|
||||
storageClassName: ""
|
||||
{{- else }}
|
||||
storageClassName: "{{ .Values.appsec.persistence.storageClass }}"
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
resources:
|
||||
requests:
|
||||
storage: {{ .Values.appsec.persistence.data.size | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -6,6 +6,8 @@
|
||||
{{- $_ := set $genericCertificateConfig "metaLabels" (include "kong.metaLabels" .) -}}
|
||||
{{- $_ := set $genericCertificateConfig "globalIssuer" .Values.certificates.issuer -}}
|
||||
{{- $_ := set $genericCertificateConfig "globalClusterIssuer" .Values.certificates.clusterIssuer -}}
|
||||
{{- $_ := set $genericCertificateConfig "globalSubject" .Values.certificates.subject -}}
|
||||
{{- $_ := set $genericCertificateConfig "globalPrivateKey" .Values.certificates.privateKey -}}
|
||||
{{- $_ := set $genericCertificateConfig "defaultIssuer" (printf "%s-%s-%s" .Release.Name .Chart.Name "selfsigned-issuer") -}}
|
||||
|
||||
{{- if .Values.certificates.admin.enabled }}
|
||||
@@ -28,10 +30,7 @@
|
||||
|
||||
{{- if .Values.certificates.cluster.enabled }}
|
||||
{{- $certificateConfig := dict -}}
|
||||
{{- $certificateConfig = mustMerge (mustDeepCopy $genericCertificateConfig) $certificateConfig -}}
|
||||
{{- $_ := set $certificateConfig "dnsNames" (list) -}}
|
||||
{{- $_ := set $certificateConfig "commonName" "kong_cluster" -}}
|
||||
{{- $certificateConfig = (mustMerge $certificateConfig .Values.certificates.cluster) -}}
|
||||
{{- $certificateConfig = mustMerge (mustDeepCopy $genericCertificateConfig) .Values.certificates.cluster -}}
|
||||
{{- $_ := set $certificateConfig "serviceName" "cluster" -}}
|
||||
{{- include "kong.certificate" $certificateConfig -}}
|
||||
{{- end }}
|
||||
@@ -54,9 +53,22 @@ spec:
|
||||
{{- range (append .dnsNames .commonName) }}
|
||||
- {{ . | quote }}
|
||||
{{- end }}
|
||||
renewBefore: 360h
|
||||
duration: 2160h
|
||||
isCA: false
|
||||
renewBefore: 360h0m0s
|
||||
duration: 2160h0m0s
|
||||
{{ if .subject -}}
|
||||
subject:
|
||||
{{- toYaml .subject | nindent 4 }}
|
||||
{{ else if .globalSubject -}}
|
||||
subject:
|
||||
{{- toYaml .globalSubject | nindent 4 }}
|
||||
{{- end }}
|
||||
{{ if .privateKey -}}
|
||||
privateKey:
|
||||
{{- toYaml .privateKey | nindent 4 }}
|
||||
{{ else if .globalPrivateKey -}}
|
||||
privateKey:
|
||||
{{- toYaml .globalPrivateKey | nindent 4 }}
|
||||
{{- end }}
|
||||
{{ if .clusterIssuer -}}
|
||||
issuerRef:
|
||||
name: {{ .clusterIssuer }}
|
||||
|
||||
@@ -35,12 +35,14 @@ rules:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
{{- if (semverCompare "< 2.10.0" (include "kong.effectiveVersion" .Values.ingressController.image)) }}
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
{{- end }}
|
||||
# Begin KIC 2.x leader permissions
|
||||
- apiGroups:
|
||||
- ""
|
||||
@@ -67,7 +69,6 @@ rules:
|
||||
- ""
|
||||
resources:
|
||||
- services
|
||||
- endpoints
|
||||
verbs:
|
||||
- get
|
||||
---
|
||||
|
||||
@@ -83,6 +83,7 @@ spec:
|
||||
- name: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.kong.enabled }}
|
||||
initContainers:
|
||||
- name: clear-stale-pid
|
||||
image: {{ include "kong.getRepoTag" .Values.image }}
|
||||
@@ -105,6 +106,7 @@ spec:
|
||||
{{- if (and (not (eq .Values.env.database "off")) .Values.waitImage.enabled) }}
|
||||
{{- include "kong.wait-for-db" . | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.deployment.hostAliases }}
|
||||
hostAliases:
|
||||
{{- toYaml .Values.deployment.hostAliases | nindent 6 }}
|
||||
@@ -271,6 +273,10 @@ spec:
|
||||
{{ toYaml .Values.readinessProbe | indent 10 }}
|
||||
livenessProbe:
|
||||
{{ toYaml .Values.livenessProbe | indent 10 }}
|
||||
{{- if .Values.startupProbe }}
|
||||
startupProbe:
|
||||
{{ toYaml .Values.startupProbe | indent 10 }}
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | indent 10 }}
|
||||
{{- end }} {{/* End of Kong container spec */}}
|
||||
|
||||
@@ -17,10 +17,10 @@ spec:
|
||||
behavior:
|
||||
{{- toYaml .Values.autoscaling.behavior | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if not (.Capabilities.APIVersions.Has "autoscaling/v2beta2") }}
|
||||
targetCPUUtilizationPercentage: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default 80 }}
|
||||
{{- else }}
|
||||
{{- if contains "autoscaling/v2" (include "kong.autoscalingVersion" . ) }}
|
||||
metrics:
|
||||
{{- toYaml .Values.autoscaling.metrics | nindent 4 }}
|
||||
{{- else }}
|
||||
targetCPUUtilizationPercentage: {{ .Values.autoscaling.targetCPUUtilizationPercentage | default 80 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -59,7 +59,7 @@ spec:
|
||||
{{- toYaml .Values.migrations.sidecarContainers | nindent 6 }}
|
||||
{{- end }}
|
||||
- name: {{ template "kong.name" . }}-post-upgrade-migrations
|
||||
{{- if eq .Values.kind "Vanilla" }}
|
||||
{{- if eq .Values.kind "Vanilla" }}
|
||||
image: {{ include "kong.getRepoTag" .Values.image }}
|
||||
{{- else }}
|
||||
image: {{ include "kong.getRepoTag" .Values.appsec.kong.image }}
|
||||
|
||||
@@ -59,7 +59,7 @@ spec:
|
||||
{{- toYaml .Values.migrations.sidecarContainers | nindent 6 }}
|
||||
{{- end }}
|
||||
- name: {{ template "kong.name" . }}-upgrade-migrations
|
||||
{{- if eq .Values.kind "Vanilla" }}
|
||||
{{- if eq .Values.kind "Vanilla" }}
|
||||
image: {{ include "kong.getRepoTag" .Values.image }}
|
||||
{{- else }}
|
||||
image: {{ include "kong.getRepoTag" .Values.appsec.kong.image }}
|
||||
|
||||
@@ -15,3 +15,99 @@
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "adminApiService.certSecretName" -}}
|
||||
{{- default (printf "%s-admin-api-keypair" (include "kong.fullname" .)) .Values.ingressController.adminApi.tls.client.secretName -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "adminApiService.caSecretName" -}}
|
||||
{{- default (printf "%s-admin-api-ca-keypair" (include "kong.fullname" .)) .Values.ingressController.adminApi.tls.client.caSecretName -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- $clientVerifyEnabled := .Values.ingressController.adminApi.tls.client.enabled -}}
|
||||
{{- $clientCertProvided := .Values.ingressController.adminApi.tls.client.certProvided -}}
|
||||
|
||||
{{/* If the client verification is enabled but no secret was provided by the user, let's generate certificates. */ -}}
|
||||
{{- if and $clientVerifyEnabled (not $clientCertProvided) }}
|
||||
{{- $certCert := "" -}}
|
||||
{{- $certKey := "" -}}
|
||||
|
||||
{{- $cn := printf "admin.%s.svc" ( include "kong.namespace" . ) -}}
|
||||
{{- $ca := genCA "admin-api-ca" 3650 -}}
|
||||
{{- $cert := genSignedCert $cn nil (list $cn) 3650 $ca -}}
|
||||
|
||||
{{- $certCert = $cert.Cert -}}
|
||||
{{- $certKey = $cert.Key -}}
|
||||
{{/* Verify whether a secret with a given name already exists. If it does, let's use its cert and key data. */}}
|
||||
{{- $certSecret := (lookup "v1" "Secret" (include "kong.namespace" .) (include "adminApiService.certSecretName" .)) -}}
|
||||
{{- if $certSecret }}
|
||||
{{- $certCert = (b64dec (get $certSecret.data "tls.crt")) -}}
|
||||
{{- $certKey = (b64dec (get $certSecret.data "tls.key")) -}}
|
||||
{{- end }}
|
||||
|
||||
{{- $caCert := $ca.Cert -}}
|
||||
{{- $caKey := $ca.Key -}}
|
||||
{{/* Verify whether a secret with a given name already exists. If it does, let's use its cert and key data. */ -}}
|
||||
{{- $caSecret := (lookup "v1" "Secret" (include "kong.namespace" .) (include "adminApiService.caSecretName" .))}}
|
||||
{{- if $caSecret }}
|
||||
{{- $caCert = (b64dec (get $caSecret.data "tls.crt")) -}}
|
||||
{{- $caKey = (b64dec (get $caSecret.data "tls.key")) -}}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "adminApiService.certSecretName" . }}
|
||||
namespace: {{ template "kong.namespace" . }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ b64enc $certCert }}
|
||||
tls.key: {{ b64enc $certKey }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ template "adminApiService.caSecretName" . }}
|
||||
namespace: {{ template "kong.namespace" . }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 4 }}
|
||||
type: kubernetes.io/tls
|
||||
data:
|
||||
tls.crt: {{ b64enc $caCert }}
|
||||
tls.key: {{ b64enc $caKey }}
|
||||
{{- end }}
|
||||
|
||||
{{- /* Create a CA ConfigMap for Kong. */ -}}
|
||||
{{- $secretProvided := $.Values.admin.tls.client.secretName -}}
|
||||
{{- $bundleProvided := $.Values.admin.tls.client.caBundle -}}
|
||||
|
||||
{{- if or $secretProvided $bundleProvided -}}
|
||||
{{- $cert := "" -}}
|
||||
|
||||
{{- if $secretProvided -}}
|
||||
{{- $certSecret := (lookup "v1" "Secret" (include "kong.namespace" .) $.Values.admin.tls.client.secretName) -}}
|
||||
{{- if $certSecret }}
|
||||
{{- $cert = (b64dec (get $certSecret.data "tls.crt")) -}}
|
||||
{{- else -}}
|
||||
{{- fail (printf "%s/%s secret not found" (include "kong.namespace" .) $.Values.admin.tls.client.secretName) -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- if $bundleProvided -}}
|
||||
{{- $cert = $.Values.admin.tls.client.caBundle -}}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ template "kong.fullname" . }}-admin-client-ca
|
||||
namespace: {{ template "kong.namespace" . }}
|
||||
labels:
|
||||
{{- include "kong.metaLabels" . | nindent 4 }}
|
||||
data:
|
||||
tls.crt: {{ $cert | quote }}
|
||||
{{- end -}}
|
||||
|
||||
Reference in New Issue
Block a user