76f7d6dc27
Split out the service account generation from the main nova.conf and into their own snippets which get mounted into the pods. OSLO reads these snippets and appends them to loaded configuration. This is a follow on to the spec [1] which has separate service accounts for accessing different services. The goal of separating this out is to allow users to provide these secrets via other means like Vault or External Secrets. [1] I12eb9341d5ff633ad4435f4938bf8c946ea388ee Change-Id: Ic05ed2886ce446803975124b755cbabe010680b6 Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
182 lines
9.1 KiB
YAML
182 lines
9.1 KiB
YAML
{{/*
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- define "novaApiOsapiLivenessProbeTemplate" }}
|
|
httpGet:
|
|
scheme: {{ tuple "compute" "service" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_scheme_lookup" | upper }}
|
|
path: /
|
|
port: {{ tuple "compute" "service" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
|
|
{{- end }}
|
|
|
|
{{- define "novaApiOsapiReadinessProbeTemplate" }}
|
|
httpGet:
|
|
scheme: {{ tuple "compute" "service" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_scheme_lookup" | upper }}
|
|
path: /
|
|
port: {{ tuple "compute" "service" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
|
|
{{- end }}
|
|
|
|
{{- if .Values.manifests.deployment_api_osapi }}
|
|
{{- $envAll := . }}
|
|
|
|
{{- $mounts_nova_api_osapi := .Values.pod.mounts.nova_api_osapi.nova_api_osapi }}
|
|
{{- $mounts_nova_api_osapi_init := .Values.pod.mounts.nova_api_osapi.init_container }}
|
|
|
|
{{- $serviceAccountName := "nova-api-osapi" }}
|
|
{{ tuple $envAll "api" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: nova-api-osapi
|
|
annotations:
|
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
|
|
labels:
|
|
{{ tuple $envAll "nova" "os-api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.pod.replicas.osapi }}
|
|
selector:
|
|
matchLabels:
|
|
{{ tuple $envAll "nova" "os-api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
|
|
{{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }}
|
|
template:
|
|
metadata:
|
|
labels:
|
|
{{ tuple $envAll "nova" "os-api" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
|
|
annotations:
|
|
{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
|
|
configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
|
|
configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
|
|
{{ tuple "nova_api_osapi" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
|
|
{{ dict "envAll" $envAll "podName" "nova-api-osapi" "containerNames" (list "nova-osapi" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
|
|
spec:
|
|
{{ tuple "nova_api_osapi" . | include "helm-toolkit.snippets.kubernetes_pod_priority_class" | indent 6 }}
|
|
{{ tuple "nova_api_osapi" . | include "helm-toolkit.snippets.kubernetes_pod_runtime_class" | indent 6 }}
|
|
serviceAccountName: {{ $serviceAccountName }}
|
|
{{ dict "envAll" $envAll "application" "nova" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
|
|
affinity:
|
|
{{ tuple $envAll "nova" "os-api" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
|
|
nodeSelector:
|
|
{{ .Values.labels.osapi.node_selector_key }}: {{ .Values.labels.osapi.node_selector_value }}
|
|
{{ if $envAll.Values.pod.tolerations.nova.enabled }}
|
|
{{ tuple $envAll "nova" | include "helm-toolkit.snippets.kubernetes_tolerations" | indent 6 }}
|
|
{{ end }}
|
|
terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.osapi.timeout | default "30" }}
|
|
initContainers:
|
|
{{ tuple $envAll "api" $mounts_nova_api_osapi_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
|
|
containers:
|
|
- name: nova-osapi
|
|
{{ tuple $envAll "nova_api" | include "helm-toolkit.snippets.image" | indent 10 }}
|
|
{{ tuple $envAll $envAll.Values.pod.resources.api | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
|
|
{{ dict "envAll" $envAll "application" "nova" "container" "nova_osapi" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
|
|
{{- if or .Values.manifests.certificates .Values.tls.identity }}
|
|
env:
|
|
- name: REQUESTS_CA_BUNDLE
|
|
value: "/etc/nova/certs/ca.crt"
|
|
{{- end }}
|
|
command:
|
|
- /tmp/nova-api.sh
|
|
- start
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command:
|
|
- /tmp/nova-api.sh
|
|
- stop
|
|
ports:
|
|
- name: n-api
|
|
containerPort: {{ tuple "compute" "service" "api" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
|
|
{{ dict "envAll" $envAll "component" "api-osapi" "container" "default" "type" "liveness" "probeTemplate" (include "novaApiOsapiLivenessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
|
|
{{ dict "envAll" $envAll "component" "api-osapi" "container" "default" "type" "readiness" "probeTemplate" (include "novaApiOsapiReadinessProbeTemplate" $envAll | fromYaml) | include "helm-toolkit.snippets.kubernetes_probe" | indent 10 }}
|
|
volumeMounts:
|
|
- name: pod-tmp
|
|
mountPath: /tmp
|
|
- name: pod-var-nova
|
|
mountPath: /var/lib/nova
|
|
- name: nova-bin
|
|
mountPath: /tmp/nova-api.sh
|
|
subPath: nova-api.sh
|
|
readOnly: true
|
|
- name: nova-etc
|
|
mountPath: /etc/nova/nova.conf
|
|
subPath: nova.conf
|
|
readOnly: true
|
|
- name: nova-etc-snippets
|
|
mountPath: /etc/nova/nova.conf.d/
|
|
readOnly: true
|
|
- name: nova-etc
|
|
mountPath: /etc/nova/nova-api-uwsgi.ini
|
|
subPath: nova-api-uwsgi.ini
|
|
readOnly: true
|
|
{{- if .Values.conf.nova.DEFAULT.log_config_append }}
|
|
- name: nova-etc
|
|
mountPath: {{ .Values.conf.nova.DEFAULT.log_config_append }}
|
|
subPath: {{ base .Values.conf.nova.DEFAULT.log_config_append }}
|
|
readOnly: true
|
|
{{- end }}
|
|
- name: nova-etc
|
|
mountPath: /etc/nova/api-paste.ini
|
|
subPath: api-paste.ini
|
|
readOnly: true
|
|
- name: nova-etc
|
|
mountPath: /etc/nova/policy.yaml
|
|
subPath: policy.yaml
|
|
readOnly: true
|
|
- name: nova-etc
|
|
mountPath: /etc/nova/api_audit_map.conf
|
|
subPath: api_audit_map.conf
|
|
readOnly: true
|
|
{{- if .Values.manifests.certificates }}
|
|
- name: wsgi-nova
|
|
mountPath: /var/www/cgi-bin/nova
|
|
- name: nova-etc
|
|
mountPath: {{ .Values.conf.software.apache2.conf_dir }}/wsgi-api.conf
|
|
subPath: wsgi-api.conf
|
|
readOnly: true
|
|
- name: nova-etc
|
|
mountPath: {{ .Values.conf.software.apache2.mods_dir }}/mpm_event.conf
|
|
subPath: mpm_event.conf
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal "path" "/etc/mysql/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
|
|
{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.compute.osapi.internal "path" "/etc/nova/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
|
|
{{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal "path" "/etc/rabbitmq/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
|
|
{{ if $mounts_nova_api_osapi.volumeMounts }}{{ toYaml $mounts_nova_api_osapi.volumeMounts | indent 12 }}{{ end }}
|
|
volumes:
|
|
- name: pod-tmp
|
|
emptyDir: {}
|
|
{{- if .Values.manifests.certificates }}
|
|
- name: wsgi-nova
|
|
emptyDir: {}
|
|
{{- end }}
|
|
- name: pod-var-nova
|
|
emptyDir: {}
|
|
- name: nova-bin
|
|
configMap:
|
|
name: nova-bin
|
|
defaultMode: 0555
|
|
- name: nova-etc
|
|
secret:
|
|
secretName: nova-etc
|
|
defaultMode: 0444
|
|
- name: nova-etc-snippets
|
|
projected:
|
|
sources:
|
|
- secret:
|
|
name: nova-ks-etc
|
|
{{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
|
|
{{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.compute.osapi.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
|
|
{{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
|
|
{{ if $mounts_nova_api_osapi.volumes}}{{ toYaml $mounts_nova_api_osapi.volumes | indent 8 }}{{ end }}
|
|
{{- end }}
|