03-envoy.yaml

apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: envoy
  name: envoy
  namespace: heptio-contour
spec:
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
  selector:
    matchLabels:
      app: envoy
  template:
    metadata:
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "8002"
        prometheus.io/path: "/stats/prometheus"
      labels:
        app: envoy
    spec:
      containers:
      - args:
        - -c
        - /config/contour.json
        - --service-cluster
        - cluster0
        - --service-node
        - node0
        command:
        - envoy
        image: docker.io/envoyproxy/envoy:v1.10.0
        imagePullPolicy: IfNotPresent
        name: envoy
        ports:
        - containerPort: 80
          hostPort: 80
          name: http
          protocol: TCP
        - containerPort: 443
          hostPort: 443
          name: https
          protocol: TCP
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8002
          initialDelaySeconds: 3
          periodSeconds: 3
        volumeMounts:
          - name: contour-config
            mountPath: /config
          - name: envoycert
            mountPath: /certs
          - name: cacert
            mountPath: /ca
        lifecycle:
          preStop:
            exec:
              command: ["wget", "-qO-", "--post-data=''", "http://localhost:9001/healthcheck/fail"] 
      dnsPolicy: ClusterFirstWithHostNet
      hostNetwork: true
      initContainers:
      - args:
        - bootstrap
        - /config/contour.json
        - --xds-address
        - contour
        - --xds-port
        - "8001"
        - --envoy-cafile=/ca/cacert.pem
        - --envoy-cert-file=/certs/tls.crt
        - --envoy-key-file=/certs/tls.key
        command:
        - contour
        image: gcr.io/heptio-images/contour:v0.14.1
        imagePullPolicy: Always
        name: envoy-initconfig
        volumeMounts:
        - name: contour-config
          mountPath: /config
        - name: envoycert
          mountPath: /certs
          readOnly: true
        - name: cacert
          mountPath: /ca
          readOnly: true
        env:
        - name: CONTOUR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
      automountServiceAccountToken: false
      volumes:
        - name: contour-config
          emptyDir: {}
        - name: envoycert
          secret:
            secretName: envoycert
        - name: cacert
          secret:
            secretName:   cacert
      restartPolicy: Always