디렉토리 구조 및 각 서비스 추가
This commit is contained in:
dsk-minchulahn
321
helm/teleport-cluster/templates/auth/deployment.yaml
Normal file
321
helm/teleport-cluster/templates/auth/deployment.yaml
Normal file
@@ -0,0 +1,321 @@
|
||||
{{- $auth := mustMergeOverwrite (mustDeepCopy .Values) .Values.auth -}}
|
||||
{{- $replicated := gt (int $auth.highAvailability.replicaCount) 1 -}}
|
||||
{{- $projectedServiceAccountToken := semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: {{ .Release.Name }}-auth
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
{{- include "teleport-cluster.auth.labels" . | nindent 4 }}
|
||||
app: {{ .Release.Name }}
|
||||
{{- if $auth.annotations.deployment }}
|
||||
annotations: {{- toYaml $auth.annotations.deployment | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ $auth.highAvailability.replicaCount }}
|
||||
{{- if and $replicated $auth.highAvailability.minReadySeconds }}
|
||||
minReadySeconds: {{ $auth.highAvailability.minReadySeconds }}
|
||||
{{- end }}
|
||||
strategy:
|
||||
{{- if $replicated }}
|
||||
# some backends support a maximum amount of auth pods (e.g. DynamoDB),
|
||||
# we don't want to exceed this during a rollout.
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxSurge: 0
|
||||
maxUnavailable: 1
|
||||
{{- else }}
|
||||
# using a single replica can be because of a non-replicable storage or when applying upgrade migrations.
|
||||
# In those cases, we don't want a rolling update.
|
||||
type: Recreate
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels: {{- include "teleport-cluster.auth.selectorLabels" . | nindent 6 }}
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
# ConfigMap checksum, to recreate the pod on config changes.
|
||||
checksum/config: {{ include (print $.Template.BasePath "/auth/config.yaml") . | sha256sum }}
|
||||
{{- if $auth.annotations.pod }}
|
||||
{{- toYaml $auth.annotations.pod | nindent 8 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "teleport-cluster.auth.labels" . | nindent 8 }}
|
||||
app: {{ .Release.Name }}
|
||||
{{- if eq $auth.chartMode "azure"}}
|
||||
azure.workload.identity/use: "true"
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if $auth.nodeSelector }}
|
||||
nodeSelector: {{- toYaml $auth.nodeSelector | nindent 8 }}
|
||||
{{- end }}
|
||||
affinity:
|
||||
{{- if $auth.affinity }}
|
||||
{{- if $auth.highAvailability.requireAntiAffinity }}
|
||||
{{- fail "Cannot use highAvailability.requireAntiAffinity when affinity is also set in chart values - unset one or the other" }}
|
||||
{{- end }}
|
||||
{{- toYaml $auth.affinity | nindent 8 }}
|
||||
{{- else }}
|
||||
podAntiAffinity:
|
||||
{{- if $auth.highAvailability.requireAntiAffinity }}
|
||||
requiredDuringSchedulingIgnoredDuringExecution:
|
||||
- labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- {{ .Release.Name }}
|
||||
- key: app.kubernetes.io/component
|
||||
operator: In
|
||||
values:
|
||||
- auth
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
{{- else if $replicated }}
|
||||
preferredDuringSchedulingIgnoredDuringExecution:
|
||||
- weight: 50
|
||||
podAffinityTerm:
|
||||
labelSelector:
|
||||
matchExpressions:
|
||||
- key: app.kubernetes.io/instance
|
||||
operator: In
|
||||
values:
|
||||
- {{ .Release.Name }}
|
||||
- key: app.kubernetes.io/component
|
||||
operator: In
|
||||
values:
|
||||
- auth
|
||||
topologyKey: "kubernetes.io/hostname"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $auth.tolerations }}
|
||||
tolerations: {{- toYaml $auth.tolerations | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if $auth.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml $auth.imagePullSecrets | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if $auth.initContainers }}
|
||||
initContainers:
|
||||
{{- range $initContainer := $auth.initContainers }}
|
||||
{{- if and (not $initContainer.resources) $auth.resources }}
|
||||
{{- $_ := set $initContainer "resources" $auth.resources }}
|
||||
{{- end }}
|
||||
{{- list $initContainer | toYaml | nindent 8 }}
|
||||
{{- /* Note: this will break if the user sets volumeMounts to its initContainer */}}
|
||||
volumeMounts:
|
||||
{{- if $auth.enterprise }}
|
||||
- mountPath: /var/lib/license
|
||||
name: "license"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if and ($auth.gcp.credentialSecretName) (eq $auth.chartMode "gcp") }}
|
||||
- mountPath: /etc/teleport-secrets
|
||||
name: "gcp-credentials"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- mountPath: /etc/teleport
|
||||
name: "config"
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: "data"
|
||||
{{- if $projectedServiceAccountToken }}
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $auth.extraVolumeMounts }}
|
||||
{{- toYaml $auth.extraVolumeMounts | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: "teleport"
|
||||
image: '{{ if $auth.enterprise }}{{ $auth.enterpriseImage }}{{ else }}{{ $auth.image }}{{ end }}:{{ include "teleport-cluster.version" . }}'
|
||||
imagePullPolicy: {{ $auth.imagePullPolicy }}
|
||||
{{- if or $auth.extraEnv $auth.tls.existingCASecretName }}
|
||||
env:
|
||||
{{- if (gt (len $auth.extraEnv) 0) }}
|
||||
{{- toYaml $auth.extraEnv | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if $auth.tls.existingCASecretName }}
|
||||
- name: SSL_CERT_FILE
|
||||
value: /etc/teleport-tls-ca/ca.pem
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
args:
|
||||
- "--diag-addr=0.0.0.0:3000"
|
||||
{{- if $auth.insecureSkipProxyTLSVerify }}
|
||||
- "--insecure"
|
||||
{{- end }}
|
||||
{{- if $auth.createProxyToken }}
|
||||
- "--apply-on-startup=/etc/teleport/apply-on-startup.yaml"
|
||||
{{- end }}
|
||||
{{- if $auth.extraArgs }}
|
||||
{{- toYaml $auth.extraArgs | nindent 8 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: diag
|
||||
containerPort: 3000
|
||||
protocol: TCP
|
||||
- name: auth
|
||||
containerPort: 3025
|
||||
protocol: TCP
|
||||
- name: kube
|
||||
containerPort: 3026
|
||||
protocol: TCP
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: diag
|
||||
initialDelaySeconds: 5 # wait 5s for agent to start
|
||||
periodSeconds: 5 # poll health every 5s
|
||||
failureThreshold: 6 # consider agent unhealthy after 30s (6 * 5s)
|
||||
timeoutSeconds: {{ .Values.probeTimeoutSeconds }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: diag
|
||||
initialDelaySeconds: 5 # wait 5s for agent to register
|
||||
periodSeconds: 5 # poll health every 5s
|
||||
failureThreshold: 12 # consider agent unhealthy after 60s (12 * 5s)
|
||||
timeoutSeconds: {{ .Values.probeTimeoutSeconds }}
|
||||
lifecycle:
|
||||
# waiting during preStop ensures no new request will hit the Terminating pod
|
||||
# on clusters using kube-proxy (kube-proxy syncs the node iptables rules every 30s)
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- teleport
|
||||
- wait
|
||||
- duration
|
||||
- 30s
|
||||
{{- if $auth.postStart.command }}
|
||||
postStart:
|
||||
exec:
|
||||
command: {{ toYaml $auth.postStart.command | nindent 14 }}
|
||||
{{- end }}
|
||||
{{- if $auth.resources }}
|
||||
resources:
|
||||
{{- toYaml $auth.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- if $auth.securityContext }}
|
||||
securityContext: {{- toYaml $auth.securityContext | nindent 10 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
{{- if $auth.enterprise }}
|
||||
- mountPath: /var/lib/license
|
||||
name: "license"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if and ($auth.gcp.credentialSecretName) (eq $auth.chartMode "gcp") }}
|
||||
- mountPath: /etc/teleport-secrets
|
||||
name: "gcp-credentials"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $auth.tls.existingCASecretName }}
|
||||
- mountPath: /etc/teleport-tls-ca
|
||||
name: "teleport-tls-ca"
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
- mountPath: /etc/teleport
|
||||
name: "config"
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: "data"
|
||||
{{- if $projectedServiceAccountToken }}
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $auth.extraVolumeMounts }}
|
||||
{{- toYaml $auth.extraVolumeMounts | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- /* Operator uses '.Values' instead of '$auth' as it will likely be moved out of the auth pods */}}
|
||||
{{- if .Values.operator.enabled }}
|
||||
- name: "operator"
|
||||
image: '{{ .Values.operator.image }}:{{ include "teleport-cluster.version" . }}'
|
||||
imagePullPolicy: {{ .Values.imagePullPolicy }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 8081
|
||||
initialDelaySeconds: 15
|
||||
periodSeconds: 20
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /readyz
|
||||
port: 8081
|
||||
initialDelaySeconds: 5
|
||||
periodSeconds: 10
|
||||
{{- if .Values.operator.resources }}
|
||||
resources: {{- toYaml .Values.operator.resources | nindent 10 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- mountPath: /etc/teleport
|
||||
name: "config"
|
||||
readOnly: true
|
||||
- mountPath: /var/lib/teleport
|
||||
name: "data"
|
||||
{{- if $projectedServiceAccountToken }}
|
||||
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
|
||||
name: auth-serviceaccount-token
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
{{- if $projectedServiceAccountToken }}
|
||||
automountServiceAccountToken: false
|
||||
{{- end }}
|
||||
volumes:
|
||||
{{- if $projectedServiceAccountToken }}
|
||||
# This projected token volume mimics the `automountServiceAccountToken`
|
||||
# behaviour but defaults to a 1h TTL instead of 1y.
|
||||
- name: auth-serviceaccount-token
|
||||
projected:
|
||||
sources:
|
||||
- serviceAccountToken:
|
||||
path: token
|
||||
- configMap:
|
||||
items:
|
||||
- key: ca.crt
|
||||
path: ca.crt
|
||||
name: kube-root-ca.crt
|
||||
- downwardAPI:
|
||||
items:
|
||||
- path: "namespace"
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
{{- end }}
|
||||
{{- if $auth.enterprise }}
|
||||
- name: license
|
||||
secret:
|
||||
secretName: "license"
|
||||
{{- end }}
|
||||
{{- if and ($auth.gcp.credentialSecretName) (eq $auth.chartMode "gcp") }}
|
||||
- name: gcp-credentials
|
||||
secret:
|
||||
secretName: {{ $auth.gcp.credentialSecretName | quote }}
|
||||
{{- end }}
|
||||
{{- if $auth.tls.existingCASecretName }}
|
||||
- name: teleport-tls-ca
|
||||
secret:
|
||||
secretName: {{ $auth.tls.existingCASecretName }}
|
||||
{{- end }}
|
||||
- name: "config"
|
||||
configMap:
|
||||
name: {{ .Release.Name }}-auth
|
||||
- name: "data"
|
||||
{{- if and ($auth.persistence.enabled) ( and (not (eq $auth.chartMode "gcp")) (not (eq $auth.chartMode "aws")) (not (eq $auth.chartMode "azure"))) }}
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ if $auth.persistence.existingClaimName }}{{ $auth.persistence.existingClaimName }}{{ else }}{{ .Release.Name }}{{ end }}
|
||||
{{- else }}
|
||||
emptyDir: {}
|
||||
{{- end }}
|
||||
{{- if $auth.extraVolumes }}
|
||||
{{- toYaml $auth.extraVolumes | nindent 6 }}
|
||||
{{- end }}
|
||||
{{- if $auth.priorityClassName }}
|
||||
priorityClassName: {{ $auth.priorityClassName }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ include "teleport-cluster.auth.serviceAccountName" . }}
|
||||
terminationGracePeriodSeconds: {{ $auth.terminationGracePeriodSeconds }}
|
||||
Reference in New Issue
Block a user