-
Notifications
You must be signed in to change notification settings - Fork 29
/
Copy pathdeployment.yaml
141 lines (124 loc) · 5.27 KB
/
deployment.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
{{- if not .Values.features.externalUserManagement.enabled }}
{{- include "ocis.basicServiceTemplates" (dict "scope" . "appName" "appNameIdm" "appNameSuffix" "") -}}
apiVersion: apps/v1
kind: Deployment
{{ include "ocis.metadata" . }}
spec:
{{- include "ocis.selector" . | nindent 2 }}
replicas: 1
strategy:
type: Recreate
template:
{{- include "ocis.templateMetadata" (dict "scope" $ "configCheck" false) | nindent 4 }}
spec:
{{- include "ocis.affinity" .Values.services.idm | nindent 6 }}
{{- include "ocis.securityContextAndtopologySpreadConstraints" . | nindent 6 }}
initContainers:
{{- if and $.Values.services.idm.persistence.enabled $.Values.services.idm.persistence.chownInitContainer }}
- name: init-chown-data
{{- include "ocis.initContainerImage" $ | nindent 10 }}
securityContext:
runAsNonRoot: false
runAsUser: 0
{{- include "ocis.initChownDataCommand" $ | nindent 10 }}
volumeMounts:
- name: {{ include "ocis.persistence.dataVolumeName" . }}
mountPath: /var/lib/ocis
{{ end }}
- name: init-dir #TODO: that should not be needed, needs fix in the idm service
{{- include "ocis.initContainerImage" $ | nindent 10 }}
{{- include "ocis.containerSecurityContext" . | nindent 10 }}
command: ["mkdir", "-p", "/var/lib/ocis/idm"]
resources: {{ toYaml .resources | nindent 12 }}
volumeMounts:
- name: {{ include "ocis.persistence.dataVolumeName" . }}
mountPath: /var/lib/ocis
{{- include "ocis.priorityClassName" $.priorityClassName | nindent 6 }}
{{- include "ocis.hostAliases" $ | nindent 6 }}
nodeSelector: {{ toYaml $.nodeSelector | nindent 8 }}
containers:
- name: {{ .appName }}
{{- include "ocis.image" $ | nindent 10 }}
command: ["ocis"]
args: ["idm", "server"]
{{- include "ocis.containerSecurityContext" . | nindent 10 }}
env:
{{- include "ocis.serviceRegistry" . | nindent 12 }}
- name: IDM_LOG_COLOR
value: {{ .Values.logging.color | quote }}
- name: IDM_LOG_LEVEL
value: {{ .Values.logging.level | quote }}
- name: IDM_LOG_PRETTY
value: {{ .Values.logging.pretty | quote }}
- name: IDM_TRACING_ENABLED
value: "{{ .Values.tracing.enabled }}"
- name: IDM_TRACING_TYPE
value: {{ .Values.tracing.type | quote }}
- name: IDM_TRACING_ENDPOINT
value: {{ .Values.tracing.endpoint | quote }}
- name: IDM_TRACING_COLLECTOR
value: {{ .Values.tracing.collector | quote }}
- name: IDM_DEBUG_PPROF
value: {{ .Values.debug.profiling | quote }}
- name: IDM_LDAPS_ADDR
value: 0.0.0.0:9235
- name: IDM_DEBUG_ADDR
value: 0.0.0.0:9239
- name: IDM_CREATE_DEMO_USERS
value: {{ .Values.features.demoUsers | quote }}
- name: IDM_ADMIN_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "secrets.adminUser" . }}
key: password
- name: IDM_ADMIN_USER_ID
valueFrom:
secretKeyRef:
name: {{ include "secrets.adminUser" . }}
key: user-id
- name: IDM_SVC_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "secrets.ldapBindSecret" . }}
key: graph-ldap-bind-password
- name: IDM_REVASVC_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "secrets.ldapBindSecret" . }}
key: reva-ldap-bind-password
- name: IDM_IDPSVC_PASSWORD
valueFrom:
secretKeyRef:
name: {{ include "secrets.ldapBindSecret" . }}
key: idp-ldap-bind-password
- name: IDM_LDAPS_CERT
value: /etc/ocis/ldap-cert/ldap.crt
- name: IDM_LDAPS_KEY
value: /etc/ocis/ldap-cert/ldap.key
{{- include "ocis.caEnv" . | nindent 12}}
{{- include "ocis.livenessProbe" . | nindent 10 }}
resources: {{ toYaml .resources | nindent 12 }}
ports:
- name: ldaps
containerPort: 9235
- name: metrics-debug
containerPort: 9239
volumeMounts:
- name: ocis-config-tmp
mountPath: /etc/ocis # we mount that volume only to apply fsGroup to that path
- name: ldap-cert
mountPath: /etc/ocis/ldap-cert
readOnly: true
- name: {{ include "ocis.persistence.dataVolumeName" . }}
mountPath: /var/lib/ocis
{{- include "ocis.caPath" . | nindent 12}}
{{- include "ocis.imagePullSecrets" $ | nindent 6 }}
volumes:
- name: ocis-config-tmp
emptyDir: {}
- name: ldap-cert
secret:
secretName: {{ include "secrets.ldapCertSecret" . }}
{{- include "ocis.caVolume" . | nindent 8}}
{{- include "ocis.persistence.dataVolume" . | nindent 8 }}
{{- end }}