디렉토리 구조 및 각 서비스 추가
This commit is contained in:
dsk-minchulahn
157
helm/vault/templates/csi-daemonset.yaml
Normal file
157
helm/vault/templates/csi-daemonset.yaml
Normal file
@@ -0,0 +1,157 @@
|
||||
{{/*
|
||||
Copyright (c) HashiCorp, Inc.
|
||||
SPDX-License-Identifier: MPL-2.0
|
||||
*/}}
|
||||
|
||||
{{- template "vault.csiEnabled" . -}}
|
||||
{{- if .csiEnabled -}}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: {{ template "vault.fullname" . }}-csi-provider
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- if .Values.csi.daemonSet.extraLabels -}}
|
||||
{{- toYaml .Values.csi.daemonSet.extraLabels | nindent 4 -}}
|
||||
{{- end -}}
|
||||
{{ template "csi.daemonSet.annotations" . }}
|
||||
spec:
|
||||
updateStrategy:
|
||||
type: {{ .Values.csi.daemonSet.updateStrategy.type }}
|
||||
{{- if .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
|
||||
rollingUpdate:
|
||||
maxUnavailable: {{ .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
|
||||
{{- end }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: {{ template "vault.name" . }}-csi-provider
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- if .Values.csi.pod.extraLabels -}}
|
||||
{{- toYaml .Values.csi.pod.extraLabels | nindent 8 -}}
|
||||
{{- end -}}
|
||||
{{ template "csi.pod.annotations" . }}
|
||||
spec:
|
||||
{{ template "csi.daemonSet.securityContext.pod" . }}
|
||||
{{- if .Values.csi.priorityClassName }}
|
||||
priorityClassName: {{ .Values.csi.priorityClassName }}
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "vault.fullname" . }}-csi-provider
|
||||
{{- template "csi.pod.tolerations" . }}
|
||||
{{- template "csi.pod.nodeselector" . }}
|
||||
{{- template "csi.pod.affinity" . }}
|
||||
containers:
|
||||
- name: {{ include "vault.name" . }}-csi-provider
|
||||
{{ template "csi.resources" . }}
|
||||
{{ template "csi.daemonSet.securityContext.container" . }}
|
||||
image: "{{ .Values.csi.image.repository }}:{{ .Values.csi.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.csi.image.pullPolicy }}
|
||||
args:
|
||||
- --endpoint=/provider/vault.sock
|
||||
- --debug={{ .Values.csi.debug }}
|
||||
{{- if .Values.csi.hmacSecretName }}
|
||||
- --hmac-secret-name={{ .Values.csi.hmacSecretName }}
|
||||
{{- else }}
|
||||
- --hmac-secret-name={{- include "vault.name" . }}-csi-provider-hmac-key
|
||||
{{- end }}
|
||||
{{- if .Values.csi.extraArgs }}
|
||||
{{- toYaml .Values.csi.extraArgs | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: VAULT_ADDR
|
||||
{{- if eq (.Values.csi.agent.enabled | toString) "true" }}
|
||||
value: "unix:///var/run/vault/agent.sock"
|
||||
{{- else if .Values.global.externalVaultAddr }}
|
||||
value: "{{ .Values.global.externalVaultAddr }}"
|
||||
{{- else }}
|
||||
value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.server.service.port }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
- name: providervol
|
||||
mountPath: "/provider"
|
||||
{{- if eq (.Values.csi.agent.enabled | toString) "true" }}
|
||||
- name: agent-unix-socket
|
||||
mountPath: /var/run/vault
|
||||
{{- end }}
|
||||
{{- if .Values.csi.volumeMounts }}
|
||||
{{- toYaml .Values.csi.volumeMounts | nindent 12}}
|
||||
{{- end }}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /health/ready
|
||||
port: 8080
|
||||
failureThreshold: {{ .Values.csi.livenessProbe.failureThreshold }}
|
||||
initialDelaySeconds: {{ .Values.csi.livenessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.csi.livenessProbe.periodSeconds }}
|
||||
successThreshold: {{ .Values.csi.livenessProbe.successThreshold }}
|
||||
timeoutSeconds: {{ .Values.csi.livenessProbe.timeoutSeconds }}
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /health/ready
|
||||
port: 8080
|
||||
failureThreshold: {{ .Values.csi.readinessProbe.failureThreshold }}
|
||||
initialDelaySeconds: {{ .Values.csi.readinessProbe.initialDelaySeconds }}
|
||||
periodSeconds: {{ .Values.csi.readinessProbe.periodSeconds }}
|
||||
successThreshold: {{ .Values.csi.readinessProbe.successThreshold }}
|
||||
timeoutSeconds: {{ .Values.csi.readinessProbe.timeoutSeconds }}
|
||||
{{- if eq (.Values.csi.agent.enabled | toString) "true" }}
|
||||
- name: {{ include "vault.name" . }}-agent
|
||||
image: "{{ .Values.csi.agent.image.repository }}:{{ .Values.csi.agent.image.tag }}"
|
||||
imagePullPolicy: {{ .Values.csi.agent.image.pullPolicy }}
|
||||
{{ template "csi.agent.resources" . }}
|
||||
command:
|
||||
- vault
|
||||
args:
|
||||
- agent
|
||||
- -config=/etc/vault/config.hcl
|
||||
{{- if .Values.csi.agent.extraArgs }}
|
||||
{{- toYaml .Values.csi.agent.extraArgs | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 8200
|
||||
env:
|
||||
- name: VAULT_LOG_LEVEL
|
||||
value: "{{ .Values.csi.agent.logLevel }}"
|
||||
- name: VAULT_LOG_FORMAT
|
||||
value: "{{ .Values.csi.agent.logFormat }}"
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
runAsUser: 100
|
||||
runAsGroup: 1000
|
||||
volumeMounts:
|
||||
- name: agent-config
|
||||
mountPath: /etc/vault/config.hcl
|
||||
subPath: config.hcl
|
||||
readOnly: true
|
||||
- name: agent-unix-socket
|
||||
mountPath: /var/run/vault
|
||||
{{- if .Values.csi.volumeMounts }}
|
||||
{{- toYaml .Values.csi.volumeMounts | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
volumes:
|
||||
- name: providervol
|
||||
hostPath:
|
||||
path: {{ .Values.csi.daemonSet.providersDir }}
|
||||
{{- if eq (.Values.csi.agent.enabled | toString) "true" }}
|
||||
- name: agent-config
|
||||
configMap:
|
||||
name: {{ template "vault.fullname" . }}-csi-provider-agent-config
|
||||
- name: agent-unix-socket
|
||||
emptyDir:
|
||||
medium: Memory
|
||||
{{- end }}
|
||||
{{- if .Values.csi.volumes }}
|
||||
{{- toYaml .Values.csi.volumes | nindent 8}}
|
||||
{{- end }}
|
||||
{{- include "imagePullSecrets" . | nindent 6 }}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user