7-gateway-proxy-deployment.yaml

{{- if .Values.gateway.updateValues -}}
{{- include "gloo.updatevalues" . -}}
{{- end -}}
{{- define "gatewayProxy.deploymentSpec" }}
{{- $name := (index . 1) }}
{{- $gatewaySpec := (index . 2) }}
{{- with (first .) }}
{{- $global := .Values.global }}
{{- $settings := .Values.settings }}
{{- $isUpgrade := .Values.gateway.upgrade }}
{{- $gatewayProxy := .Values.gatewayProxies.gatewayProxy -}}
{{- $spec := include "gloo.util.mergeOverwriteWithOmit" (list $gatewaySpec $gatewayProxy) | fromJson }}
{{- $ports := list }}
{{- if not (empty $spec.podTemplate) }}
  {{- $ports = (list $spec.podTemplate.httpPort $spec.podTemplate.httpsPort $spec.podTemplate.extraPorts) }}
{{- end }}
{{- if not (empty $gatewaySpec.podTemplate) }}
  {{- if not (empty $gatewaySpec.podTemplate.nodeSelector) }}
    {{- $_ := set $spec.podTemplate "nodeSelector" $gatewaySpec.podTemplate.nodeSelector }}
  {{- end }}
{{- end }}
{{- $image := $spec.podTemplate.image }}
{{- if $global }}
{{- $image = merge $spec.podTemplate.image $global.image }}
{{- end }}
{{- $statsConfig := coalesce $spec.stats $global.glooStats }}
{{- if not $spec.disabled }}
apiVersion: apps/v1
{{- if $spec.kind.deployment}}
kind: Deployment
{{- else }}
kind: DaemonSet
{{- end}}
metadata:
  labels:
{{ include "gloo.labels" . | indent 4}}
    gloo: gateway-proxy
    gateway-proxy-id: {{ $name | kebabcase }}
  name: {{ $name | kebabcase }}
  namespace: {{ $spec.namespace | default .Release.Namespace }}
spec:
  {{- if $spec.kind.deployment}}
  {{- if $spec.kind.deployment.replicas}}
  replicas: {{ $spec.kind.deployment.replicas }}
  {{- end}}
  {{- end}}
  selector:
    matchLabels:
      gloo: gateway-proxy
      gateway-proxy-id: {{ $name | kebabcase }}
  template:
    metadata:
      labels:
        gloo: gateway-proxy
        gateway-proxy-id: {{ $name | kebabcase }}
        {{- if not $isUpgrade }}
        gateway-proxy: live
        {{- end }}
        {{- if $spec.podTemplate.extraGatewayProxyLabels }}
        {{- range $key, $value := $spec.podTemplate.extraGatewayProxyLabels }}
        {{ $key }}: {{ $value | quote }}
        {{- end }}
        {{- end }}
        {{- if $global.istioIntegration.disableAutoinjection }}
        sidecar.istio.io/inject: "false" # this deployment has custom logic related to istio sidecars, and shouldn't be blanket-injected ever
        {{- else if $global.istioIntegration.enableIstioSidecarOnGateway }}
          {{- if $global.istioIntegration.istioSidecarRevTag }}
        istio.io/rev: {{ $global.istioIntegration.istioSidecarRevTag }}
          {{- else }}
        sidecar.istio.io/inject: "true"
          {{- end }}
        {{- end }}
      annotations:
        # This annotation was introduced to resolve https://github.com/solo-io/gloo/issues/8392
        # It triggers a new rollout of the gateway proxy if the values in this config map changes.
        checksum/{{ $name | kebabcase }}-envoy-config: {{ $gatewaySpec.checksum }}
      {{- range $key, $value := $spec.podTemplate.extraAnnotations }}
        {{ $key }}: {{ $value | quote }}
      {{- end }}
      {{- if $global.glooStats.setDatadogAnnotations }}
        ad.datadoghq.com/gateway-proxy.check_names: '["envoy"]'
        ad.datadoghq.com/gateway-proxy.init_configs: '[{}]'
        ad.datadoghq.com/gateway-proxy.instances: '[{"stats_url": "http://%%host%%:8081/stats"}]'
        ad.datadoghq.com/gateway-proxy.logs: '[{"source": "envoy", "service": "gloo","log_processing_rules":[{"type": "multi_line", "name": "log_start_with_date","pattern" : "^\\[[0-9]{4}-[0-9]{2}-[0-9]{2}"}]}]'
      {{- end }}
{{- if $statsConfig.enabled }}
        prometheus.io/path: /metrics
        prometheus.io/port: "8081"
        prometheus.io/scrape: "true"
        {{- if $global.istioIntegration.enableIstioSidecarOnGateway }}
        traffic.sidecar.istio.io/excludeInboundPorts: {{ join "," $ports }}
        {{- end }}
{{- end}}
{{- if $spec.readConfig }}
        readconfig-stats: /stats
        readconfig-ready: /ready
        readconfig-config_dump: /config_dump
        readconfig-port: "8082"
        {{- if $global.istioIntegration.enableIstioSidecarOnGateway }}
        traffic.sidecar.istio.io/excludeInboundPorts: {{ join "," $ports }}
        {{- end }}
{{- end}}
    spec:
{{ $securityDefaults := dict "fsGroup" $spec.podTemplate.fsGroup }}
{{- if not $spec.podTemplate.floatingUserId -}}
  {{- $_ := set $securityDefaults "runAsUser" $spec.podTemplate.runAsUser }}
{{ end -}}
{{- if $spec.podTemplate.enablePodSecurityContext -}}
{{ include "gloo.securityContext" (dict "values" $spec.podTemplate.podSecurityContext "defaults" $securityDefaults "indent" 6) -}}
{{- end -}}

{{- if $spec.kind.deployment }}
{{ if or ($spec.antiAffinity) ($spec.affinity) }}
      affinity:
{{- end }}
{{ if $spec.antiAffinity }}
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  gloo: gateway-proxy
              topologyKey: kubernetes.io/hostname
{{- end}}
{{- if $spec.affinity }}
      {{ toYaml $spec.affinity | nindent 8 }}
{{- end }}
{{- with $spec.topologySpreadConstraints }}
      topologySpreadConstraints:
{{- toYaml $spec.topologySpreadConstraints | nindent 6 }}
{{- end }}
{{- end}}
      {{- include "gloo.pullSecret" $image | nindent 6 -}}
      serviceAccountName: gateway-proxy
      {{- if $spec.kind.daemonSet }}
      {{- if $spec.kind.daemonSet.hostPort }}
      hostNetwork: {{ ne "false" ($spec.kind.daemonSet.hostNetwork | toString) }} {{/* defaults to true if undefined */}}
      dnsPolicy: ClusterFirstWithHostNet
      {{- end}}
      {{- end}}
      {{- if $spec.podTemplate.nodeName }}
      nodeName: {{$spec.podTemplate.nodeName}}
      {{- end }}
      {{- if $spec.podTemplate.nodeSelector }}
      nodeSelector:
      {{- range $key, $value := $spec.podTemplate.nodeSelector }}
        {{ $key }}: {{ $value | quote }}
      {{- end }}
      {{- end }}
      {{- if $spec.podTemplate.tolerations }}
      tolerations:
{{ toYaml $spec.podTemplate.tolerations | indent 6}}
      {{- end }}
      {{- if $spec.podTemplate.terminationGracePeriodSeconds }}
      terminationGracePeriodSeconds: {{ $spec.podTemplate.terminationGracePeriodSeconds }}
      {{- end }}
      {{- if (or $spec.podTemplate.extraInitContainers $spec.extraInitContainersHelper) }}
      initContainers:
      {{- if $spec.podTemplate.extraInitContainers }}
{{ toYaml $spec.podTemplate.extraInitContainers | indent 6 }}
      {{- end }}
      {{- if $spec.extraInitContainersHelper }}
      {{- include $spec.extraInitContainersHelper . | nindent 6 }}
      {{- end }}
      {{- end }}{{/* or */}}
      containers:
      {{- if $spec.podTemplate.extraContainers }}
{{ toYaml $spec.podTemplate.extraContainers | indent 6 }}
      {{- end }}
      - args:
          - --disable-hot-restart
        {{- if $spec.envoyLogLevel }}
          - --log-level {{ $spec.envoyLogLevel }}
        {{- end}}
          {{- with $spec.extraEnvoyArgs}}
            {{- range . }}
          - {{ . | quote }}
            {{- end }}
          {{- end}}
        env:
{{- if $spec.kind.deployment }}
{{- if $spec.kind.deployment.customEnv }}
{{ toYaml $spec.kind.deployment.customEnv | indent 8 }}
{{- end }}
{{- end }}
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: DISABLE_CORE_DUMPS
          value: {{ $spec.disableCoreDumps | quote }}
        image: {{ template "gloo.image" $image }}
        imagePullPolicy: {{ $image.pullPolicy }}
        {{- if $spec.podTemplate.gracefulShutdown }}
        {{- if $spec.podTemplate.gracefulShutdown.enabled }}
        lifecycle:
          preStop:
            exec:
              command:
              - /bin/sh
              - -c
              - wget --post-data "" -O /dev/null {{ $spec.loopBackAddress }}:19000/healthcheck/fail;
                sleep {{ $spec.podTemplate.gracefulShutdown.sleepTimeSeconds }}
        {{- end}}
        {{- end}}
        name: {{ $name | kebabcase }}
        {{- $capabilities := dict "drop" (list "ALL") }}
        {{- if not $spec.podTemplate.disableNetBind -}}
          {{- $_ := set $capabilities "add"  (list "NET_BIND_SERVICE") }}
        {{- end -}}
        {{- $securityDefaults := dict "runAsNonRoot" $spec.podTemplate.runUnprivileged "capabilities" $capabilities "readOnlyRootFilesystem" true "allowPrivilegeEscalation" false }}
        {{- if not $spec.podTemplate.floatingUserId -}}
          {{- $_ := set $securityDefaults "runAsUser" $spec.podTemplate.runAsUser }}
        {{- end -}}
        {{- include "gloo.containerSecurityContext" (dict "values" $spec.podTemplate.glooContainerSecurityContext "defaults" $securityDefaults "podSecurityStandards" .Values.global.podSecurityStandards "indent" 8) }}
        ports:
        - containerPort: {{ $spec.podTemplate.httpPort }}
          name: http
          protocol: TCP
          {{- if $spec.kind.daemonSet }}
          {{- if $spec.kind.daemonSet.hostPort}}
          hostPort: {{ $spec.podTemplate.httpPort }}
          {{- end}}
          {{- end}}
        - containerPort: {{ $spec.podTemplate.httpsPort }}
          name: https
          protocol: TCP
          {{- if  $spec.kind.daemonSet }}
          {{- if $spec.kind.daemonSet.hostPort}}
          hostPort: {{ $spec.podTemplate.httpsPort }}
          {{- end}}
          {{- end}}
       {{- if and $statsConfig.enabled $statsConfig.podMonitorEnabled }}
        - name: http-monitoring
          containerPort: 8081
       {{- end }}
{{- with $spec.podTemplate.extraPorts }}
{{toYaml . | indent 8}}{{- end }}
{{- if $spec.podTemplate.resources }}
        resources:
{{ toYaml $spec.podTemplate.resources | indent 10}}
{{- end}}
{{- if $spec.podTemplate.probes }}
        readinessProbe:
{{- if $spec.podTemplate.customReadinessProbe }}
{{ toYaml $spec.podTemplate.customReadinessProbe | indent 10}}
{{- else }}
          exec:
            command:
            - wget
            - -O
            - /dev/null
            - {{ $spec.loopBackAddress }}:19000/ready
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
{{- end}}
{{- if $spec.podTemplate.livenessProbeEnabled }}
        livenessProbe:
{{- if $spec.podTemplate.customLivenessProbe }}
{{ toYaml $spec.podTemplate.customLivenessProbe | indent 10}}
{{- else }}
          exec:
            command:
            - wget
            - -O
            - /dev/null
            - {{ $spec.loopBackAddress }}:19000/server_info
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
{{- end }}{{/*if $spec.podTemplate.customLivenessProbe*/}}
{{- end }}{{/*if $spec.podTemplate.livenessProbeEnabled*/}}
{{- end }}{{/*if $spec.podTemplate.probes*/}}
        volumeMounts:
        - mountPath: /etc/envoy
          name: envoy-config
{{- if $spec.extraProxyVolumeMounts }}
{{ toYaml $spec.extraProxyVolumeMounts | indent 8 }}
{{- end }}
{{- if $spec.extraProxyVolumeMountHelper }}
{{- include $spec.extraProxyVolumeMountHelper . | nindent 8 }}
{{- end }}
{{- if $global.glooMtls.enabled }}
        - mountPath: /etc/envoy/ssl
          name: gloo-mtls-certs
          readOnly: true
{{- end}} {{- /* $global.glooMtls.enabled */}}
{{- if $spec.extraContainersHelper }}
        - mountPath: /usr/share/shared-data
          name: shared-data
{{- include $spec.extraContainersHelper . | nindent 6 }}
{{- end }} {{- /* $spec.extraContainersHelper */}}
{{- if or $global.glooMtls.enabled (or $global.istioSDS.enabled $global.istioIntegration.enabled) }}
      {{- $sdsImage := merge $global.glooMtls.sds.image $global.image }}
      - name: sds
        image: {{ template "gloo.image" $sdsImage }}
        {{- include "gloo.containerSecurityContext" (dict "values" $global.glooMtls.sds.securityContext "defaults" (dict) "podSecurityStandards" .Values.global.podSecurityStandards "indent" 8) }}
        imagePullPolicy: {{ $sdsImage.pullPolicy }}
{{- if $global.glooMtls.sdsResources }}
        resources:
{{ toYaml $global.glooMtls.sdsResources | indent 10}}
{{- end}}
        env:
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
{{- if $global.glooMtls.enabled }}
          - name: GLOO_MTLS_SDS_ENABLED
            value: "true"
{{- end }}
{{- if or $global.istioSDS.enabled $global.istioIntegration.enabled }}
          - name: ISTIO_MTLS_SDS_ENABLED
            value: "true"
{{- end }}
{{- if $global.glooMtls.sds.logLevel }}
          - name: LOG_LEVEL
            value: {{ $global.glooMtls.sds.logLevel }}
{{- end}}
{{- if $statsConfig.enabled }}
          - name: START_STATS_SERVER
            value: "true"
{{- end}}
        volumeMounts:
{{- if $global.glooMtls.enabled }}
        - mountPath: /etc/envoy/ssl
          name: gloo-mtls-certs
          readOnly: true
{{- end }}
{{- if or $global.istioSDS.enabled $global.istioIntegration.enabled }}
        - mountPath: /etc/istio-certs/
          name: istio-certs
        - mountPath: /etc/envoy
          name: envoy-config
{{- end }}
        ports:
        - containerPort: 8234
          name: sds
          protocol: TCP
        {{- if and $statsConfig.enabled $statsConfig.podMonitorEnabled }}
        - name: http-monitoring
          containerPort: 9091
        {{- end }}
        readinessProbe:
          tcpSocket:
            port: 8234
          initialDelaySeconds: 3
          periodSeconds: 10
          failureThreshold: 3
{{- end }} {{- /* or $global.glooMtls.enabled (or $.Values.istioSDS.enabled $global.istioIntegration.enabled) */}}
{{- if or $global.istioSDS.enabled $global.istioIntegration.enabled }}
{{- if $global.istioSDS.customSidecars }}
{{ toYaml $global.istioSDS.customSidecars | indent 6}}
{{- end }}
{{- if not $global.istioSDS.customSidecars }}
      - name: istio-proxy
        {{- include "gloo.containerSecurityContext" (dict "values" $global.glooMtls.istioProxy.securityContext "defaults" (dict) "podSecurityStandards" .Values.global.podSecurityStandards "indent" 8) }}
        {{- $istioProxyImage := merge $global.glooMtls.istioProxy.image $global.image }}
        image: {{ template "gloo.image" $istioProxyImage }}
        imagePullPolicy: {{ $istioProxyImage.pullPolicy }}
        {{- if $global.glooMtls.envoySidecarResources }}
        resources:
{{ toYaml $global.glooMtls.envoySidecarResources | indent 10}}
        {{- end}}
        args:
        - proxy
        - sidecar
        - --domain
        - $(POD_NAMESPACE).svc.cluster.local
        - --configPath
        - /etc/istio/proxy
        - --serviceCluster
        - istio-proxy-prometheus
        - --drainDuration
        - 45s
        - --parentShutdownDuration
        - 1m0s
        - --proxyLogLevel={{ $global.glooMtls.istioProxy.logLevel }}
        - --proxyComponentLogLevel=misc:error
        - --connectTimeout
        - 10s
        - --controlPlaneAuthPolicy
        - NONE
        - --dnsRefreshRate
        - 300s
        - --trust-domain=cluster.local
        - --controlPlaneBootstrap=false
        env:
          - name: OUTPUT_CERTS
            value: "/etc/istio-certs"
          - name: JWT_POLICY
            value: third-party-jwt
          - name: PILOT_CERT_PROVIDER
            value: istiod
          - name: CA_ADDR
            value: {{ $spec.istioDiscoveryAddress | default "istiod.istio-system.svc:15012" }}
          - name: ISTIO_META_MESH_ID
            value: {{ $spec.istioMetaMeshId | default "cluster.local"}}
          - name: ISTIO_META_CLUSTER_ID
            value: {{ $spec.istioMetaClusterId | default "Kubernetes"}}
          - name: PROXY_CONFIG
            value: |
              {"discoveryAddress": {{ $spec.istioDiscoveryAddress | default "istiod.istio-system.svc:15012" }}}
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: INSTANCE_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
          - name: SERVICE_ACCOUNT
            valueFrom:
              fieldRef:
                fieldPath: spec.serviceAccountName
          - name: HOST_IP
            valueFrom:
              fieldRef:
                fieldPath: status.hostIP
          - name: ISTIO_META_POD_NAME
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.name
          - name: ISTIO_META_CONFIG_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          - name: DISABLE_ENVOY
            value: "true"
        volumeMounts:
        - mountPath: /var/run/secrets/istio
          name: istiod-ca-cert
        - mountPath: /etc/istio/proxy
          name: istio-envoy
        - mountPath: /etc/istio-certs/
          name: istio-certs
        - mountPath: /var/run/secrets/tokens
          name: istio-token
        - mountPath: /var/run/secrets/credential-uds
          name: credential-socket
        - mountPath: /var/run/secrets/workload-spiffe-uds
          name: workload-socket
        - mountPath: /var/run/secrets/workload-spiffe-credentials
          name: workload-certs
{{- end }} {{/* if not $global.istioSDS.customSidecars */}}
{{- end }}{{/* if or $global.istioSDS.enabled $global.istioIntegration.enabled */}}
      volumes:
      - configMap:
          name: {{ $name | kebabcase }}-envoy-config
        name: envoy-config
{{- if or $global.istioSDS.enabled $global.istioIntegration.enabled }}
      - name: istio-certs
        emptyDir:
          medium: Memory
      - name: istiod-ca-cert
        configMap:
          defaultMode: 420
          name: istio-ca-root-cert
      - emptyDir:
          medium: Memory
        name: istio-envoy
      - name: istio-token
        projected:
          defaultMode: 420
          sources:
          - serviceAccountToken:
              audience: istio-ca
              expirationSeconds: 43200
              path: istio-token
      - name: credential-socket
        emptyDir: {}
      - name: workload-socket
        emptyDir: {}
      - name: workload-certs
        emptyDir: {}
{{- end}}

{{- if $global.glooMtls.enabled }}
      - name: gloo-mtls-certs
        secret:
          defaultMode: 420
          secretName: gloo-mtls-certs
{{- end }} {{/* if $global.glooMtls.enabled */}}
      {{- if $spec.extraContainersHelper }}
      - name: shared-data
        emptyDir: {}
      {{- end }}
      {{- if $spec.extraVolumes }}
      {{ toYaml $spec.extraVolumes | nindent 6 }}
      {{- end }}
      {{- if $spec.extraVolumeHelper }}
      {{- include $spec.extraVolumeHelper . | nindent 6 }}
      {{- end }}
{{- end }}
{{- end }} {{/* with */}}
{{- end }} {{/* define gatewayProxy.deploymentSpec*/}}

{{- if .Values.gateway.enabled }}
{{- range $name, $gatewaySpec := .Values.gatewayProxies }}
{{- /* Render each gatewayProxy template with it's yaml overrides */}}
---
{{- $kubeResourceOverride := $gatewaySpec.kubeResourceOverride  }}
{{- $ctx := (list $ $name $gatewaySpec)}}
{{- include "gloo.util.merge" (list $ctx $kubeResourceOverride "gatewayProxy.deploymentSpec") -}}
{{- end }} {{/* range $name, $gatewaySpec := .Values.gatewayProxies */}}
{{- end }} {{/* if .Values.gateway.enabled */}}