api-gateway-controller-deployment.yaml

{{- if .Values.apiGateway.enabled }}
{{- if not .Values.client.grpc }}{{ fail "client.grpc must be true for api gateway" }}{{ end }}
{{- if not .Values.apiGateway.image}}{{ fail "apiGateway.image must be set to enable api gateway" }}{{ end }}
{{- if and .Values.global.adminPartitions.enabled (not .Values.global.enableConsulNamespaces) }}{{ fail "global.enableConsulNamespaces must be true if global.adminPartitions.enabled=true" }}{{ end }}
{{ template "consul.validateRequiredCloudSecretsExist" . }}
{{ template "consul.validateCloudSecretKeys" . }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "consul.fullname" . }}-api-gateway-controller
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "consul.name" . }}
    chart: {{ template "consul.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
    component: api-gateway-controller
spec:
  replicas: {{ .Values.apiGateway.controller.replicas }}
  selector:
    matchLabels:
      app: {{ template "consul.name" . }}
      chart: {{ template "consul.chart" . }}
      release: {{ .Release.Name }}
      component: api-gateway-controller
  template:
    metadata:
      annotations:
        consul.hashicorp.com/connect-inject: "false"
        {{- if (and .Values.global.secretsBackend.vault.enabled .Values.global.tls.enabled) }}
        "vault.hashicorp.com/agent-init-first": "true"
        "vault.hashicorp.com/agent-inject": "true"
        "vault.hashicorp.com/role": {{ .Values.global.secretsBackend.vault.consulCARole }}
        "vault.hashicorp.com/agent-inject-secret-serverca.crt": {{ .Values.global.tls.caCert.secretName }}
        "vault.hashicorp.com/agent-inject-template-serverca.crt": {{ template "consul.serverTLSCATemplate" . }}
        {{- if .Values.global.secretsBackend.vault.agentAnnotations }}
        {{ tpl .Values.global.secretsBackend.vault.agentAnnotations . | nindent 8 | trim }}
        {{- end }}
        {{- if and .Values.global.secretsBackend.vault.ca.secretName .Values.global.secretsBackend.vault.ca.secretKey }}
        "vault.hashicorp.com/agent-extra-secret": "{{ .Values.global.secretsBackend.vault.ca.secretName }}"
        "vault.hashicorp.com/ca-cert": "/vault/custom/{{ .Values.global.secretsBackend.vault.ca.secretKey }}"
        {{- end }}
        {{- end }}
      labels:
        app: {{ template "consul.name" . }}
        chart: {{ template "consul.chart" . }}
        release: {{ .Release.Name }}
        component: api-gateway-controller
    spec:
      serviceAccountName: {{ template "consul.fullname" . }}-api-gateway-controller
      containers:
      - name: api-gateway-controller
        image: {{ .Values.apiGateway.image }}
        ports:
        - containerPort: 9090
          name: sds
          protocol: TCP
        env:
        {{- if .Values.global.tls.enabled }}
        {{- if or (not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots)) .Values.client.enabled }}
        - name: CONSUL_CACERT
          value: /consul/tls/ca/tls.crt
        {{- end }}
        {{- end }}
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        {{- if .Values.global.acls.manageSystemACLs }}
        - name: CONSUL_HTTP_TOKEN_FILE
          value: "/consul/login/acl-token"
        - name: CONSUL_LOGIN_DATACENTER
          value: {{ .Values.global.datacenter }}
        {{- end }}
        - name: CONSUL_HTTP_ADDR
          {{- if .Values.client.enabled }}
          {{/*
            We use client agent nodes if we have them to support backwards compatibility for Consul API Gateway
            v0.4 and older, which requires connectivity between the registered Consul agent node and a
            deployment for health checking (originating from the Consul node). Always leveraging the agents in
            the case that they're explicitly opted into allows us to support users with agent node +
            "externalServers" configuration upgrading a Helm chart without upgrading API gateways.
          */}}
          {{- if .Values.global.tls.enabled }}
          value: $(HOST_IP):8501
          {{- else }}
          value: $(HOST_IP):8500
          {{- end }}
          {{- else if .Values.externalServers.enabled }}
          {{/*
            "externalServers" specified and running in "agentless" mode, this will only work with
            Consul API Gateway v0.5 or newer
          */}}
          value: {{ first .Values.externalServers.hosts }}:{{ .Values.externalServers.httpsPort }}
          {{- else }}
          {{/*
            We have local network connectivity between deployments and the internal cluster, this
            should be supported in all versions of Consul API Gateway
          */}}
          {{- if .Values.global.tls.enabled }}
          value: {{ template "consul.fullname" . }}-server:8501
          {{- else }}
          value: {{ template "consul.fullname" . }}-server:8500
          {{- end }}
          {{- end }}
        - name: CONSUL_HTTP_SSL
          value: "{{ .Values.global.tls.enabled }}"
        {{- if and .Values.externalServers.enabled .Values.externalServers.tlsServerName }}
        - name: CONSUL_TLS_SERVER_NAME
          value: {{ .Values.externalServers.tlsServerName }}
        {{- end }}
        {{- if .Values.global.adminPartitions.enabled }}
        - name: CONSUL_PARTITION
          value: {{ .Values.global.adminPartitions.name }}
        {{- if .Values.global.acls.manageSystemACLs }}
        - name: CONSUL_LOGIN_PARTITION
          value: {{ .Values.global.adminPartitions.name }}
        {{- end }}
        {{- end }}
        {{- if not .Values.client.enabled }}
        - name: CONSUL_DYNAMIC_SERVER_DISCOVERY
          value: "true"
        {{- end }}
        command:
        - "/bin/sh"
        - "-ec"
        - |
          consul-api-gateway server \
            -sds-server-host {{ template "consul.fullname" . }}-api-gateway-controller.{{ .Release.Namespace }}.svc \
            -k8s-namespace {{ .Release.Namespace }} \
            {{- if .Values.global.enableConsulNamespaces }}
            {{- if .Values.connectInject.consulNamespaces.consulDestinationNamespace }}
            -consul-destination-namespace={{ .Values.connectInject.consulNamespaces.consulDestinationNamespace }} \
            {{- end }}
            {{- if .Values.connectInject.consulNamespaces.mirroringK8S }}
            -mirroring-k8s=true \
            {{- if .Values.connectInject.consulNamespaces.mirroringK8SPrefix }}
            -mirroring-k8s-prefix={{ .Values.connectInject.consulNamespaces.mirroringK8SPrefix }} \
            {{- end }}
            {{- end }}
            {{- end }}
            {{- if and .Values.global.federation.enabled .Values.global.federation.primaryDatacenter }}
            -primary-datacenter={{ .Values.global.federation.primaryDatacenter }} \
            {{- end }}
            -log-level {{ default .Values.global.logLevel .Values.apiGateway.logLevel }} \
            -log-json={{ .Values.global.logJSON }}
        volumeMounts:
        {{- if .Values.global.acls.manageSystemACLs }}
        - name: consul-bin
          mountPath: /consul-bin
        {{- end }}
        {{- if .Values.global.tls.enabled }}
        {{- if .Values.global.tls.enableAutoEncrypt }}
        - name: consul-auto-encrypt-ca-cert
        {{- else }}
        - name: consul-ca-cert
        {{- end }}
          mountPath: /consul/tls/ca
          readOnly: true
        {{- end }}
        - mountPath: /consul/login
          name: consul-data
          readOnly: true
        {{- if .Values.apiGateway.resources }}
        resources:
          {{- toYaml .Values.apiGateway.resources | nindent 12 }}
        {{- end }}
        {{- if .Values.global.acls.manageSystemACLs }}
        lifecycle:
          preStop:
            exec:
              command: [ "/bin/sh", "-ec", "/consul-bin/consul logout" ]
        {{- end }}
      volumes:
      {{- if .Values.global.acls.manageSystemACLs }}
      - name: consul-bin
        emptyDir: { }
      {{- end }}
      {{- if .Values.global.tls.enabled }}
      {{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
      - name: consul-ca-cert
        secret:
          {{- if .Values.global.tls.caCert.secretName }}
          secretName: {{ .Values.global.tls.caCert.secretName }}
          {{- else }}
          secretName: {{ template "consul.fullname" . }}-ca-cert
          {{- end }}
          items:
          - key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
            path: tls.crt
      {{- end }}
      {{- if .Values.global.tls.enableAutoEncrypt }}
      - name: consul-auto-encrypt-ca-cert
        emptyDir:
          medium: "Memory"
      {{- end }}
      {{- end }}
      - name: consul-data
        emptyDir:
          medium: "Memory"
      {{- if or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
      initContainers:
      {{- if .Values.global.acls.manageSystemACLs }}
      - name: copy-consul-bin
        image: {{ .Values.global.image | quote }}
        command:
        - cp
        - /bin/consul
        - /consul-bin/consul
        volumeMounts:
        - name: consul-bin
          mountPath: /consul-bin
        {{- if .Values.apiGateway.initCopyConsulContainer }}
        {{- if .Values.apiGateway.initCopyConsulContainer.resources }}
        resources: {{ toYaml .Values.apiGateway.initCopyConsulContainer.resources | nindent 12 }}
        {{- end }}
        {{- end }}
      {{- end }}
      {{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
      {{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
      {{- end }}
      {{- if .Values.global.acls.manageSystemACLs }}
      - name: api-gateway-controller-acl-init
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: CONSUL_LOGIN_META  
          value: "component=api-gateway-controller,pod=$(NAMESPACE)/$(POD_NAME)"
        {{- include "consul.consulK8sConsulServerEnvVars" . | nindent 8 }}
        image: {{ .Values.global.imageK8S }}
        volumeMounts:
        - mountPath: /consul/login
          name: consul-data
          readOnly: false
        {{- if .Values.global.tls.enabled }}
        {{- if .Values.global.tls.enableAutoEncrypt }}
        - name: consul-auto-encrypt-ca-cert
        {{- else }}
        - name: consul-ca-cert
        {{- end }}
          mountPath: /consul/tls/ca
          readOnly: true
        {{- end }}
        command:
        - "/bin/sh"
        - "-ec"
        - |
          consul-k8s-control-plane acl-init \
            {{- if and .Values.global.federation.enabled .Values.global.federation.primaryDatacenter }}
            -auth-method-name={{ template "consul.fullname" . }}-k8s-component-auth-method-{{ .Values.global.datacenter }} \
            -datacenter={{ .Values.global.federation.primaryDatacenter }} \
            {{- else }}
            -auth-method-name={{ template "consul.fullname" . }}-k8s-component-auth-method \
            {{- end }}
            {{- if .Values.global.adminPartitions.enabled }}
            -partition={{ .Values.global.adminPartitions.name }} \
            {{- end }}
            -api-timeout={{ .Values.global.consulAPITimeout }} \
            -log-level={{ default .Values.global.logLevel .Values.apiGateway.logLevel }} \
            -log-json={{ .Values.global.logJSON }}
        resources:
          requests:
            memory: "25Mi"
            cpu: "50m"
          limits:
            memory: "25Mi"
            cpu: "50m"
      {{- end }}
      {{- end }}
      {{- if .Values.apiGateway.controller.priorityClassName }}
      priorityClassName: {{ .Values.apiGateway.controller.priorityClassName | quote }}
      {{- end }}
      {{- if .Values.apiGateway.controller.nodeSelector }}
      nodeSelector:
        {{ tpl .Values.apiGateway.controller.nodeSelector . | indent 8 | trim }}
      {{- end }}
      {{- if .Values.apiGateway.controller.tolerations }}
      tolerations:
        {{ tpl .Values.apiGateway.controller.tolerations . | indent 8 | trim }}
      {{- end }}
{{- end }}