1-gloo-deployment.yaml

{{ define "gloo.deploymentSpec" }}
{{- $image := .Values.gloo.deployment.image }}
{{- $statsConfig := coalesce .Values.gloo.deployment.stats .Values.global.glooStats -}}
{{- if .Values.global  }}
{{- $image = merge .Values.gloo.deployment.image .Values.global.image }}
{{- end }}
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
{{ include "gloo.labels" . | indent 4}}
    gloo: gloo
  name: gloo
  namespace: {{ .Release.Namespace }}
spec:
  replicas: {{ .Values.gloo.deployment.replicas }}
  selector:
    matchLabels:
      gloo: gloo
  template:
    metadata:
      labels:
        gloo: gloo
        {{- if .Values.gloo.deployment.extraGlooLabels }}
        {{- range $key, $value := .Values.gloo.deployment.extraGlooLabels }}
        {{ $key }}: {{ $value | quote }}
        {{- end }}
        {{- end }}
        {{- if .Values.global.istioIntegration.disableAutoinjection }}
        sidecar.istio.io/inject: "false"
        {{- end }}
      annotations:
        {{- if $statsConfig.enabled }}
        prometheus.io/path: /metrics
        prometheus.io/port: "9091"
        prometheus.io/scrape: "true"
        gloo.solo.io/oss-image-tag: {{ .Values.gloo.deployment.ossImageTag }}
        {{- end}}
        {{- if .Values.gloo.deployment.extraGlooAnnotations }}
        {{- range $key, $value := .Values.gloo.deployment.extraGlooAnnotations }}
        {{ $key }}: {{ $value | quote }}
        {{- end }}
        {{- end }}
    spec:
{{ with .Values.gloo.deployment.podSecurityContext }}
{{- include "gloo.securityContext" (dict "values" . "defaults" (dict)) | indent 6 -}}
{{- end }}
{{- include "gloo.pullSecret" $image | nindent 6 -}}
      serviceAccountName: gloo
      {{- include "gloo.podSpecStandardFields" .Values.gloo.deployment | nindent 6 -}}
      volumes:
{{- if .Values.global.glooMtls.enabled }}
      - name: gloo-mtls-certs
        secret:
          defaultMode: 420
          secretName: gloo-mtls-certs
      - name: envoy-sidecar-config
        configMap:
          name: envoy-sidecar-config
{{- end }}
      - name: labels-volume
        downwardAPI:
          items:
            - path: "labels"
              fieldRef:
                fieldPath: metadata.labels
      {{- if and .Values.gateway.enabled .Values.gateway.validation.enabled }}
      - name: validation-certs
        secret:
          defaultMode: 420
          secretName: {{ .Values.gateway.validation.secretName }}
      {{- end }}
      containers:
{{- if .Values.global.glooMtls.enabled }}
      {{- $sdsImage := merge .Values.global.glooMtls.sds.image .Values.global.image }}
      {{- $envoyImage := merge .Values.global.glooMtls.envoy.image .Values.global.image}}
      - env:
        - name: ENVOY_SIDECAR
          value: "true"
        name: envoy-sidecar
        image: {{ template "gloo.image" $envoyImage }}
        imagePullPolicy: {{ $envoyImage.pullPolicy }}
        {{- $securityDefaults := dict "runAsNonRoot" true }}
        {{- if not .Values.gloo.deployment.floatingUserId }}
          {{- $_ := set $securityDefaults "runAsUser" .Values.gloo.deployment.runAsUser }}
        {{- end }}
        {{- include "gloo.containerSecurityContext" (dict "values" .Values.global.glooMtls.envoy.securityContext "defaults" $securityDefaults "podSecurityStandards" .Values.global.podSecurityStandards "indent" 8) }}
        ports:
        - containerPort: {{ .Values.gloo.deployment.xdsPort }}
          name: grpc-xds
          protocol: TCP
        - containerPort: {{ .Values.gloo.deployment.restXdsPort }}
          name: rest-xds
          protocol: TCP
        readinessProbe:
          tcpSocket:
            port: {{ .Values.gloo.deployment.xdsPort }}
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
{{- if .Values.gloo.deployment.livenessProbeEnabled }}
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8765
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
{{- end}}
        volumeMounts:
        - mountPath: /etc/envoy
          name: envoy-sidecar-config
        - mountPath: /etc/envoy/ssl
          name: gloo-mtls-certs
          readOnly: true
{{- if .Values.global.glooMtls.envoySidecarResources }}
        resources:
{{ toYaml .Values.global.glooMtls.envoySidecarResources | indent 10}}
{{- end}}
      - name: sds
        image: {{ template "gloo.image" $sdsImage }}
        imagePullPolicy: {{ $sdsImage.pullPolicy }}
        env:
        - name: GLOO_MTLS_SDS_ENABLED
          value: "true"
        {{- $securityDefaults := dict "runAsNonRoot" true }}
        {{- if not .Values.gloo.deployment.floatingUserId -}}
          {{- $_ := set $securityDefaults "runAsUser" .Values.gloo.deployment.runAsUser}}
        {{- end -}}
        {{- include "gloo.containerSecurityContext" (dict "values" .Values.global.glooMtls.sds.securityContext "defaults" $securityDefaults "podSecurityStandards" .Values.global.podSecurityStandards "indent" 8) }}
        ports:
        - containerPort: {{ .Values.gloo.deployment.validationPort }}
          name: validation
          protocol: TCP
        readinessProbe:
          tcpSocket:
            port: {{ .Values.gloo.deployment.validationPort }}
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
        volumeMounts:
        - mountPath: /etc/envoy/ssl
          name: gloo-mtls-certs
          readOnly: true
{{- if .Values.global.glooMtls.sdsResources }}
        resources:
{{ toYaml .Values.global.glooMtls.sdsResources | indent 10}}
{{- end}}
{{- end }}
      - image: {{template "gloo.image" $image }}
        imagePullPolicy: {{ $image.pullPolicy }}
        name: gloo
{{- if .Values.gloo.deployment.resources }}
        resources:
{{ toYaml .Values.gloo.deployment.resources | indent 10}}
{{- else}}
        resources:
          requests:
            cpu: 500m
            memory: 256Mi
{{- end -}}
        {{- $capabilities := dict "drop" (list "ALL") -}}
        {{- $securityDefaults := dict "runAsNonRoot" true "capabilities" $capabilities "readOnlyRootFilesystem" true "allowPrivilegeEscalation" false -}}
        {{- /* set floatingUserId to true in the helm install to let the pod be assigned a dynamic user ID */ -}}
        {{- /* see https://github.com/helm/helm/issues/1707#issuecomment-520357573 */ -}}
        {{- /* the user id may be set quite high -- openshift wants userids that may get printed as scientific notation */ -}}
        {{- /* If you specify your own securityContext, floatingUserId will have no effect  */ -}}
        {{- if not .Values.gloo.deployment.floatingUserId -}}
          {{- $_ := set $securityDefaults "runAsUser" .Values.gloo.deployment.runAsUser }}
        {{- end -}}
        {{- include "gloo.containerSecurityContext" (dict "values" .Values.gloo.deployment.glooContainerSecurityContext "defaults" $securityDefaults "podSecurityStandards" .Values.global.podSecurityStandards "indent" 8) }}
        ports:
{{- if not .Values.global.glooMtls.enabled }}
        - containerPort: {{ .Values.gloo.deployment.xdsPort }}
          name: grpc-xds
          protocol: TCP
        - containerPort: {{ .Values.gloo.deployment.restXdsPort }}
          name: rest-xds
          protocol: TCP
{{- end }}
        - containerPort: {{ .Values.gloo.deployment.validationPort }}
          name: grpc-validation
          protocol: TCP
        - containerPort: {{ .Values.gloo.deployment.proxyDebugPort }}
          name: grpc-proxydebug
          protocol: TCP
        - containerPort: 9979
          name: wasm-cache
          protocol: TCP
        {{- if and $statsConfig.enabled $statsConfig.podMonitorEnabled }}
        - name: http-monitoring
          containerPort: 9091
        {{- end }}
        {{- if .Values.settings.devMode }}
        - containerPort: 10010
          name: dev-admin
          protocol: TCP
        {{- end }}
        volumeMounts:
        {{- if and .Values.gateway.validation.enabled .Values.gateway.enabled }}
        - mountPath: /etc/gateway/validation-certs
          name: validation-certs
        {{- end }}
        - name: labels-volume
          mountPath: /etc/gloo
          readOnly: true
        env:
{{- if .Values.license_secret_name }}
          - name: GLOO_LICENSE_KEY
            valueFrom:
              secretKeyRef:
                name: {{ .Values.license_secret_name }}
                key: license-key
{{- end }}
{{- if .Values.gloo.deployment.customEnv }}
{{ toYaml .Values.gloo.deployment.customEnv | indent 10 }}
{{- end }}
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
        {{- if .Values.kubeGateway.enabled }}
          - name: GG_EXPERIMENTAL_K8S_GW_CONTROLLER
            value: "true"
        {{- end }}{{/* if .Values.kubeGateway.enabled */}}
        {{- if .Values.gloo.splitLogOutput }}
          - name: SPLIT_LOG_OUTPUT
            value: "true"
        {{- end}}
        {{- if $statsConfig.enabled }}
          - name: START_STATS_SERVER
            value: "true"
        {{- end}}
        {{- if .Values.gateway.validation.enabled }}
          - name: VALIDATION_MUST_START
            value: "true"
        {{- end}}
        {{- if .Values.gloo.logLevel }}
          - name: LOG_LEVEL
            value: {{ .Values.gloo.logLevel }}
        {{- end}}
        {{- if .Values.global.istioIntegration.enableIstioSidecarOnGateway }}
          - name: ENABLE_ISTIO_SIDECAR_ON_GATEWAY
            value: "true"
        {{- end}}
        {{- if .Values.gloo.disableLeaderElection }}
          - name: DISABLE_LEADER_ELECTION
            value: "true"
        {{- end}}
        {{- if .Values.gloo.headerSecretRefNsMatchesUs }}
          - name: HEADER_SECRET_REF_NS_MATCHES_US
            value: "true"
        {{- end}}
{{- if not .Values.global.glooMtls.enabled }}
        readinessProbe:
          tcpSocket:
            port: {{ .Values.gloo.deployment.xdsPort }}
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
{{- if .Values.gloo.deployment.livenessProbeEnabled }}
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8765
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
{{- end }}
{{- end }}{{/* if not .Values.global.glooMtls.enabled */}}
{{- end }} {{/* define "gloo.deploymentSpec "*/}}

{{/* Render template with yaml overrides */}}
{{- include "gloo.util.merge" (list . .Values.gloo.deployment.kubeResourceOverride "gloo.deploymentSpec") -}}