deployment.yaml

{{- if semverCompare "^1.9-0" .Capabilities.KubeVersion.GitVersion }}
apiVersion: apps/v1
{{- else }}
apiVersion: apps/v1beta1
{{- end }}
kind: Deployment
metadata:
  name: {{ template "traefik.fullname" . }}
  labels:
    app: {{ template "traefik.name" . }}
    chart: {{ template "traefik.chart" . }}
    release: {{ .Release.Name | quote }}
    heritage: {{ .Release.Service | quote }}
    {{- if .Values.deployment.labels }}
    {{- toYaml .Values.deployment.labels | nindent 4 }}
    {{- end }}
  {{- with .Values.deployment.annotations }}
  annotations:
    {{- toYaml . | nindent 4 }}
  {{- end }}
spec:
{{- if not .Values.autoscaling }}
  replicas: {{ default 1 .Values.replicas }}
{{- end }}
  selector:
    matchLabels:
      app: {{ template "traefik.name" . }}
      release: {{ .Release.Name }}
  {{- if .Values.deploymentStrategy }}
  strategy:
{{ toYaml .Values.deploymentStrategy | indent 4 }}
  {{- end }}
  template:
    metadata:
      annotations:
        checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
      {{- if and (.Values.tolerations) (semverCompare "<1.6-0" .Capabilities.KubeVersion.GitVersion) }}
        scheduler.alpha.kubernetes.io/tolerations: '{{ toJson .Values.tolerations }}'
      {{- end }}
      {{- range $key, $value := .Values.deployment.podAnnotations }}
        {{ $key }}: {{ $value | quote }}
      {{- end }}
      labels:
        app: {{ template "traefik.name" . }}
        chart: {{ template "traefik.chart" . }}
        release: {{ .Release.Name | quote }}
        heritage: {{ .Release.Service | quote }}
        {{- if .Values.deployment.podLabels }}
{{ toYaml .Values.deployment.podLabels | indent 8 }}
        {{- end }}
    spec:
      {{- if .Values.podSecurityContext }}
      securityContext:
{{ toYaml .Values.podSecurityContext | indent 8 }}
      {{- end }}
      {{- if .Values.rbac.enabled }}
      serviceAccountName: {{ template "traefik.fullname" . }}
      {{- else }}
      serviceAccountName: default
      {{- end }}
      terminationGracePeriodSeconds: 60
      {{- if .Values.nodeSelector }}
      nodeSelector:
{{ toYaml .Values.nodeSelector | indent 8 }}
      {{- end }}
      {{- if .Values.affinity }}
      affinity:
{{ toYaml .Values.affinity | indent 8 }}
      {{- end }}
      {{- if .Values.priorityClassName }}
      priorityClassName: {{ .Values.priorityClassName | quote }}
      {{- end }}
      {{- if .Values.imagePullSecrets }}
      imagePullSecrets:
      {{- range .Values.imagePullSecrets }}
        - name: {{ . }}
      {{- end }}
      {{- end }}
      containers:
      - image: {{ .Values.image }}:{{ .Values.imageTag }}
        imagePullPolicy: {{ .Values.imagePullPolicy }}
        name: {{ template "traefik.fullname" . }}
        resources:
        {{- if or .Values.cpuRequest .Values.memoryRequest .Values.cpuLimit .Values.memoryLimit }}
          requests:
            cpu: {{ .Values.cpuRequest | quote }}
            memory: {{ .Values.memoryRequest | quote }}
          limits:
            cpu: {{ .Values.cpuLimit | quote }}
            memory: {{ .Values.memoryLimit | quote }}
        {{- else }}
{{ toYaml .Values.resources | indent 10 }}
        {{- end }}
        readinessProbe:
          httpGet:
            path: /ping
            port: "{{ .Values.pingEntryPoint | default "http" }}"
          failureThreshold: 1
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        livenessProbe:
          httpGet:
            path: /ping
            port: "{{ .Values.pingEntryPoint | default "http" }}"
          failureThreshold: 3
          initialDelaySeconds: 10
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 2
        {{- if or (and .Values.acme.enabled (eq .Values.acme.challengeType "dns-01") .Values.acme.dnsProvider.name) .Values.env }}
        env:
        {{- range $k, $v := (index .Values.acme.dnsProvider .Values.acme.dnsProvider.name) }}
          {{- if or $v $.Values.acme.dnsProvider.existingSecretName }}
          - name: {{ $k }}
            valueFrom:
              secretKeyRef:
              {{- if $.Values.acme.dnsProvider.existingSecretName }}
                name: {{ $.Values.acme.dnsProvider.existingSecretName }}
              {{- else }}
                name: {{ template "traefik.fullname" $ }}-dnsprovider-config
              {{- end }}
                key: {{ $k }}
          {{- end }}
        {{- end }}
        {{- if .Values.env }}
{{ toYaml .Values.env | indent 10 }}
        {{- end }}
        {{- end }}
        volumeMounts:
        {{- if .Values.extraVolumeMounts }}{{ toYaml .Values.extraVolumeMounts | trim | nindent 8 }}{{ end }}
        - mountPath: /config
          name: config
        {{- if .Values.ssl.enabled }}
        {{- if not .Values.ssl.upstream }}
        - mountPath: /ssl
          name: ssl
        {{- end }}
        {{- if .Values.ssl.mtls }}
        {{- if .Values.ssl.mtls.enabled }}
        - mountPath: /mtls
          name: mtls
        {{- end }}
        {{- end }}
        {{- end }}
        {{- if and (.Values.acme.enabled) (not .Values.kvprovider.storeAcme) }}
        - mountPath: /acme
          name: acme
        {{- end }}
        {{- if .Values.configFiles }}
        - mountPath: /configs
          name: {{ template "traefik.fullname" $ }}-configs
        {{ end }}
        {{- if .Values.secretFiles }}
        - mountPath: /secrets
          name: {{ template "traefik.fullname" $ }}-secrets
        {{- end }}
        ports:
        - name: http
          containerPort: {{ template "traefik.containerPort.http" . }}
          {{- if .Values.deployment.hostPort.httpEnabled }}
          hostPort: {{ default 80 .Values.deployment.hostPort.httpPort }}
          {{- end }}
          protocol: TCP
        - name: httpn
          containerPort: 8880
          protocol: TCP
        - name: https
          containerPort: {{ template "traefik.containerPort.https" . }}
          {{- if .Values.deployment.hostPort.httpsEnabled }}
          hostPort: {{ default 443 .Values.deployment.hostPort.httpsPort }}
          {{- end }}
          protocol: TCP
        {{- if or .Values.dashboard.enabled .Values.metrics.prometheus.enabled }}
        - name: dash
          containerPort: 8080
          {{- if .Values.deployment.hostPort.dashboardEnabled }}
          hostPort: {{ default 8080 .Values.deployment.hostPort.dashboardPort }}
          {{- end }}
          protocol: TCP
        {{- end }}
        {{- if .Values.metrics.prometheus.enabled }}
        - name: metrics
          containerPort: 9100
          protocol: TCP
        {{- end }}
        args:
        - --configfile=/config/traefik.toml
        {{- range .Values.startupArguments }}
        - {{ . }}
        {{- end }}
        {{- if .Values.containerSecurityContext }}
        securityContext:
{{ toYaml .Values.containerSecurityContext | indent 10 }}
        {{- end }}

      volumes:
      {{- if .Values.extraVolumes  }}{{ toYaml .Values.extraVolumes | trim | nindent 6 }}{{ end }}
      - name: config
        configMap:
          name: {{ template "traefik.fullname" . }}
      {{- if .Values.ssl.enabled }}
      {{- if not .Values.ssl.upstream }}
      - name: ssl
        secret:
          secretName: {{ template "traefik.fullname" . }}-default-cert
      {{- end }}
      {{- if .Values.ssl.mtls }}
      {{- if .Values.ssl.mtls.enabled }}
      - name: mtls
        configMap:
          name: {{ template "traefik.fullname" . }}-client-ca-certs
      {{- end }}
      {{- end }}
      {{- end }}
      {{- if and (.Values.acme.enabled) (not .Values.kvprovider.storeAcme) }}
      - name: acme
      {{- if .Values.acme.persistence.enabled }}
        persistentVolumeClaim:
          claimName: {{ .Values.acme.persistence.existingClaim | default (printf "%s-acme" (include "traefik.fullname" .)) }}
      {{- else }}
        emptyDir: {}
      {{- end }}
      {{- end }}
      {{- if .Values.configFiles }}
      - name: {{ template "traefik.fullname" $ }}-configs
        configMap:
          name: {{ template "traefik.fullname" $ }}-configs
      {{ end }}
      {{- if .Values.secretFiles }}
      - name: {{ template "traefik.fullname" $ }}-secrets
        secret:
          secretName: {{ template "traefik.fullname" $ }}-secrets
      {{- end }}
      {{- if and (.Values.tolerations) (semverCompare "^1.6-0" .Capabilities.KubeVersion.GitVersion) }}
      tolerations:
{{ toYaml .Values.tolerations | indent 6 }}
      {{- end }}