mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-03-04 12:49:34 -05:00
968cdc1a38
* cli: move internal packages Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: fix buildfiles Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * bazel: fix exclude dir Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * cli: move back libraries that will not be used by TF provider Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> --------- Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
421 lines
16 KiB
YAML
421 lines
16 KiB
YAML
{{- if (or .Values.externalWorkloads.enabled .Values.clustermesh.useAPIServer) }}
|
|
{{- if not (list "legacy" "migration" "cluster" | has .Values.clustermesh.apiserver.tls.authMode) -}}
|
|
{{- fail ".Values.clustermesh.apiserver.tls.authMode must be one of legacy, migration, cluster" -}}
|
|
{{- end -}}
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: clustermesh-apiserver
|
|
namespace: {{ .Release.Namespace }}
|
|
{{- with .Values.clustermesh.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
labels:
|
|
k8s-app: clustermesh-apiserver
|
|
app.kubernetes.io/part-of: cilium
|
|
app.kubernetes.io/name: clustermesh-apiserver
|
|
spec:
|
|
replicas: {{ .Values.clustermesh.apiserver.replicas }}
|
|
selector:
|
|
matchLabels:
|
|
k8s-app: clustermesh-apiserver
|
|
{{- with .Values.clustermesh.apiserver.updateStrategy }}
|
|
strategy:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
{{- with .Values.clustermesh.apiserver.podAnnotations }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
app.kubernetes.io/part-of: cilium
|
|
app.kubernetes.io/name: clustermesh-apiserver
|
|
k8s-app: clustermesh-apiserver
|
|
{{- with .Values.clustermesh.apiserver.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- with .Values.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.podSecurityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
initContainers:
|
|
- name: etcd-init
|
|
image: {{ include "cilium.image" .Values.clustermesh.apiserver.etcd.image | quote }}
|
|
imagePullPolicy: {{ .Values.clustermesh.apiserver.etcd.image.pullPolicy }}
|
|
command: ["/bin/sh", "-c"]
|
|
args:
|
|
- |
|
|
rm -rf /var/run/etcd/*;
|
|
/usr/local/bin/etcd --data-dir=/var/run/etcd --name=clustermesh-apiserver --listen-client-urls=http://127.0.0.1:2379 --advertise-client-urls=http://127.0.0.1:2379 --initial-cluster-token=clustermesh-apiserver --initial-cluster-state=new --auto-compaction-retention=1 &
|
|
|
|
# The following key needs to be created before that the cilium agents
|
|
# have the possibility of connecting to etcd.
|
|
etcdctl put cilium/.has-cluster-config true
|
|
|
|
etcdctl user add root --no-password;
|
|
etcdctl user grant-role root root;
|
|
etcdctl user add admin-{{ .Values.cluster.name }} --no-password;
|
|
etcdctl user grant-role admin-{{ .Values.cluster.name }} root;
|
|
etcdctl user add externalworkload --no-password;
|
|
etcdctl role add externalworkload;
|
|
etcdctl role grant-permission externalworkload --from-key read '';
|
|
etcdctl role grant-permission externalworkload readwrite --prefix cilium/state/noderegister/v1/;
|
|
etcdctl role grant-permission externalworkload readwrite --prefix cilium/.initlock/;
|
|
etcdctl user grant-role externalworkload externalworkload;
|
|
etcdctl user add remote --no-password;
|
|
etcdctl role add remote;
|
|
etcdctl role grant-permission remote --from-key read '';
|
|
etcdctl user grant-role remote remote;
|
|
etcdctl auth enable;
|
|
exit
|
|
env:
|
|
- name: ETCDCTL_API
|
|
value: "3"
|
|
- name: HOSTNAME_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
volumeMounts:
|
|
- name: etcd-data-dir
|
|
mountPath: /var/run/etcd
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
{{- with .Values.clustermesh.apiserver.etcd.init.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: etcd
|
|
image: {{ include "cilium.image" .Values.clustermesh.apiserver.etcd.image | quote }}
|
|
imagePullPolicy: {{ .Values.clustermesh.apiserver.etcd.image.pullPolicy }}
|
|
command:
|
|
- /usr/local/bin/etcd
|
|
args:
|
|
- --data-dir=/var/run/etcd
|
|
- --name=clustermesh-apiserver
|
|
- --client-cert-auth
|
|
- --trusted-ca-file=/var/lib/etcd-secrets/ca.crt
|
|
- --cert-file=/var/lib/etcd-secrets/tls.crt
|
|
- --key-file=/var/lib/etcd-secrets/tls.key
|
|
# Surrounding the IPv4 address with brackets works in this case, since etcd
|
|
# uses net.SplitHostPort() internally and it accepts the that format.
|
|
- --listen-client-urls=https://127.0.0.1:2379,https://[$(HOSTNAME_IP)]:2379
|
|
- --advertise-client-urls=https://[$(HOSTNAME_IP)]:2379
|
|
- --initial-cluster-token=clustermesh-apiserver
|
|
- --auto-compaction-retention=1
|
|
{{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }}
|
|
- --listen-metrics-urls=http://[$(HOSTNAME_IP)]:{{ .Values.clustermesh.apiserver.metrics.etcd.port }}
|
|
- --metrics={{ .Values.clustermesh.apiserver.metrics.etcd.mode }}
|
|
{{- end }}
|
|
env:
|
|
- name: ETCDCTL_API
|
|
value: "3"
|
|
- name: HOSTNAME_IP
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: status.podIP
|
|
ports:
|
|
- name: etcd
|
|
containerPort: 2379
|
|
protocol: TCP
|
|
{{- if .Values.clustermesh.apiserver.metrics.etcd.enabled }}
|
|
- name: etcd-metrics
|
|
containerPort: {{ .Values.clustermesh.apiserver.metrics.etcd.port }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: etcd-server-secrets
|
|
mountPath: /var/lib/etcd-secrets
|
|
readOnly: true
|
|
- name: etcd-data-dir
|
|
mountPath: /var/run/etcd
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
{{- with .Values.clustermesh.apiserver.etcd.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.etcd.securityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.etcd.lifecycle }}
|
|
lifecycle:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
- name: apiserver
|
|
image: {{ include "cilium.image" .Values.clustermesh.apiserver.image | quote }}
|
|
imagePullPolicy: {{ .Values.clustermesh.apiserver.image.pullPolicy }}
|
|
command:
|
|
- /usr/bin/clustermesh-apiserver
|
|
args:
|
|
{{- if .Values.debug.enabled }}
|
|
- --debug
|
|
{{- end }}
|
|
- --cluster-name=$(CLUSTER_NAME)
|
|
- --cluster-id=$(CLUSTER_ID)
|
|
- --kvstore-opt
|
|
- etcd.config=/var/lib/cilium/etcd-config.yaml
|
|
{{- if ne .Values.clustermesh.apiserver.tls.authMode "legacy" }}
|
|
- --cluster-users-enabled
|
|
- --cluster-users-config-path=/var/lib/cilium/etcd-config/users.yaml
|
|
{{- end }}
|
|
- --enable-external-workloads={{ .Values.externalWorkloads.enabled }}
|
|
{{- if .Values.clustermesh.apiserver.metrics.enabled }}
|
|
- --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.port }}
|
|
- --controller-group-metrics=all
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.extraArgs }}
|
|
{{- toYaml . | trim | nindent 8 }}
|
|
{{- end }}
|
|
env:
|
|
- name: CLUSTER_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: cilium-config
|
|
key: cluster-name
|
|
- name: CLUSTER_ID
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: cilium-config
|
|
key: cluster-id
|
|
optional: true
|
|
- name: IDENTITY_ALLOCATION_MODE
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: cilium-config
|
|
key: identity-allocation-mode
|
|
- name: ENABLE_K8S_ENDPOINT_SLICE
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: cilium-config
|
|
key: enable-k8s-endpoint-slice
|
|
optional: true
|
|
{{- with .Values.clustermesh.apiserver.extraEnv }}
|
|
{{- toYaml . | trim | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.clustermesh.apiserver.metrics.enabled }}
|
|
ports:
|
|
- name: apiserv-metrics
|
|
containerPort: {{ .Values.clustermesh.apiserver.metrics.port }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: etcd-admin-client
|
|
mountPath: /var/lib/cilium/etcd-secrets
|
|
readOnly: true
|
|
{{- if ne .Values.clustermesh.apiserver.tls.authMode "legacy" }}
|
|
- name: etcd-users-config
|
|
mountPath: /var/lib/cilium/etcd-config
|
|
readOnly: true
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.extraVolumeMounts }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
{{- with .Values.clustermesh.apiserver.securityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.lifecycle }}
|
|
lifecycle:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- if .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
|
- name: kvstoremesh
|
|
image: {{ include "cilium.image" .Values.clustermesh.apiserver.kvstoremesh.image | quote }}
|
|
imagePullPolicy: {{ .Values.clustermesh.apiserver.kvstoremesh.image.pullPolicy }}
|
|
command:
|
|
- /usr/bin/kvstoremesh
|
|
args:
|
|
{{- if .Values.debug.enabled }}
|
|
- --debug
|
|
{{- end }}
|
|
- --cluster-name=$(CLUSTER_NAME)
|
|
- --cluster-id=$(CLUSTER_ID)
|
|
- --kvstore-opt=etcd.config=/var/lib/cilium/etcd-config.yaml
|
|
- --kvstore-opt=etcd.qps=100
|
|
- --kvstore-opt=etcd.maxInflight=10
|
|
- --clustermesh-config=/var/lib/cilium/clustermesh
|
|
{{- if .Values.clustermesh.apiserver.metrics.kvstoremesh.enabled }}
|
|
- --prometheus-serve-addr=:{{ .Values.clustermesh.apiserver.metrics.kvstoremesh.port }}
|
|
- --controller-group-metrics=all
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.kvstoremesh.extraArgs }}
|
|
{{- toYaml . | trim | nindent 8 }}
|
|
{{- end }}
|
|
env:
|
|
- name: CLUSTER_NAME
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: cilium-config
|
|
key: cluster-name
|
|
- name: CLUSTER_ID
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: cilium-config
|
|
key: cluster-id
|
|
{{- with .Values.clustermesh.apiserver.kvstoremesh.extraEnv }}
|
|
{{- toYaml . | trim | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.clustermesh.apiserver.metrics.kvstoremesh.enabled }}
|
|
ports:
|
|
- name: kvmesh-metrics
|
|
containerPort: {{ .Values.clustermesh.apiserver.metrics.kvstoremesh.port }}
|
|
protocol: TCP
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.kvstoremesh.resources }}
|
|
resources:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
volumeMounts:
|
|
- name: etcd-admin-client
|
|
mountPath: /var/lib/cilium/etcd-secrets
|
|
readOnly: true
|
|
- name: kvstoremesh-secrets
|
|
mountPath: /var/lib/cilium/clustermesh
|
|
readOnly: true
|
|
{{- with .Values.clustermesh.apiserver.kvstoremesh.extraVolumeMounts }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
terminationMessagePolicy: FallbackToLogsOnError
|
|
{{- with .Values.clustermesh.apiserver.kvstoremesh.securityContext }}
|
|
securityContext:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.kvstoremesh.lifecycle }}
|
|
lifecycle:
|
|
{{- toYaml . | nindent 10 }}
|
|
{{- end }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: etcd-server-secrets
|
|
projected:
|
|
# note: the leading zero means this number is in octal representation: do not remove it
|
|
defaultMode: 0400
|
|
sources:
|
|
- secret:
|
|
name: clustermesh-apiserver-server-cert
|
|
items:
|
|
- key: tls.crt
|
|
path: tls.crt
|
|
- key: tls.key
|
|
path: tls.key
|
|
{{- if not .Values.tls.caBundle.enabled }}
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
{{- else }}
|
|
- {{ .Values.tls.caBundle.useSecret | ternary "secret" "configMap" }}:
|
|
name: {{ .Values.tls.caBundle.name }}
|
|
items:
|
|
- key: {{ .Values.tls.caBundle.key }}
|
|
path: ca.crt
|
|
{{- end }}
|
|
- name: etcd-admin-client
|
|
projected:
|
|
# note: the leading zero means this number is in octal representation: do not remove it
|
|
defaultMode: 0400
|
|
sources:
|
|
- secret:
|
|
name: clustermesh-apiserver-admin-cert
|
|
items:
|
|
- key: tls.crt
|
|
path: tls.crt
|
|
- key: tls.key
|
|
path: tls.key
|
|
{{- if not .Values.tls.caBundle.enabled }}
|
|
- key: ca.crt
|
|
path: ca.crt
|
|
{{- else }}
|
|
- {{ .Values.tls.caBundle.useSecret | ternary "secret" "configMap" }}:
|
|
name: {{ .Values.tls.caBundle.name }}
|
|
items:
|
|
- key: {{ .Values.tls.caBundle.key }}
|
|
path: ca.crt
|
|
{{- end }}
|
|
{{- if ne .Values.clustermesh.apiserver.tls.authMode "legacy" }}
|
|
- name: etcd-users-config
|
|
configMap:
|
|
name: clustermesh-remote-users
|
|
# note: the leading zero means this number is in octal representation: do not remove it
|
|
defaultMode: 0400
|
|
{{- end }}
|
|
- name: etcd-data-dir
|
|
emptyDir: {}
|
|
{{- if .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
|
- name: kvstoremesh-secrets
|
|
projected:
|
|
# note: the leading zero means this number is in octal representation: do not remove it
|
|
defaultMode: 0400
|
|
sources:
|
|
- secret:
|
|
name: cilium-kvstoremesh
|
|
optional: true
|
|
# note: items are not explicitly listed here, since the entries of this secret
|
|
# depend on the peers configured, and that would cause a restart of this pod
|
|
# at every addition/removal. Leaving the field empty makes each secret entry
|
|
# to be automatically projected into the volume as a file whose name is the key.
|
|
- secret:
|
|
name: clustermesh-apiserver-remote-cert
|
|
optional: true
|
|
items:
|
|
- key: tls.key
|
|
path: common-etcd-client.key
|
|
- key: tls.crt
|
|
path: common-etcd-client.crt
|
|
- key: ca.crt
|
|
path: common-etcd-client-ca.crt
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.extraVolumes }}
|
|
{{- toYaml . | nindent 6 }}
|
|
{{- end }}
|
|
restartPolicy: Always
|
|
priorityClassName: {{ include "cilium.priorityClass" (list $ .Values.clustermesh.apiserver.priorityClassName "system-cluster-critical") }}
|
|
serviceAccount: {{ .Values.serviceAccounts.clustermeshApiserver.name | quote }}
|
|
serviceAccountName: {{ .Values.serviceAccounts.clustermeshApiserver.name | quote }}
|
|
terminationGracePeriodSeconds: {{ .Values.clustermesh.apiserver.terminationGracePeriodSeconds }}
|
|
automountServiceAccountToken: {{ .Values.serviceAccounts.clustermeshApiserver.automount }}
|
|
{{- with .Values.clustermesh.apiserver.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.topologySpreadConstraints }}
|
|
topologySpreadConstraints:
|
|
{{- range $constraint := . }}
|
|
- {{ toYaml $constraint | nindent 8 | trim }}
|
|
{{- if not $constraint.labelSelector }}
|
|
labelSelector:
|
|
matchLabels:
|
|
k8s-app: clustermesh-apiserver
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.clustermesh.apiserver.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- if and .Values.clustermesh.config.enabled .Values.clustermesh.apiserver.kvstoremesh.enabled }}
|
|
hostAliases:
|
|
{{- range $cluster := .Values.clustermesh.config.clusters }}
|
|
{{- range $ip := $cluster.ips }}
|
|
- ip: {{ $ip }}
|
|
hostnames: [ "{{ $cluster.name }}.{{ $.Values.clustermesh.config.domain }}" ]
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|