mirror of
https://github.com/YuzuZensai/netbird-kubernetes-operator.git
synced 2026-09-13 18:59:09 +00:00
David FryandGitHub
18a5b55839
The reason for this PR is that currently if the secret doesn’t have the key NB_API_KEY yet at deployment time, the deployment will still run and pull in an env list that doesn’t include NB_API_KEY since the envFrom will just pull any and all keys it finds in the secret and makes env vars out of them. then at a later point, once the NB_API_KEY key is populated in the secret, one has to bounce the pod to get the key to be picked up. if you use the env: valueFrom syntax using a named key, if that named key doesn’t exist, the deployment should give an error and retry until the secret key is available
131 lines
5.2 KiB
YAML
131 lines
5.2 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "kubernetes-operator.fullname" . }}
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
{{- include "kubernetes-operator.labels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.operator.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "kubernetes-operator.selectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
{{- with .Values.operator.podAnnotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
{{- include "kubernetes-operator.labels" . | nindent 8 }}
|
|
{{- with .Values.operator.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- with .Values.operator.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
|
|
securityContext:
|
|
{{- toYaml .Values.operator.podSecurityContext | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}
|
|
securityContext:
|
|
{{- toYaml .Values.operator.securityContext | nindent 12 }}
|
|
image: "{{ .Values.operator.image.registry }}/{{ .Values.operator.image.repository }}:{{ .Values.operator.image.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
|
|
command:
|
|
- /manager
|
|
args:
|
|
{{- if .Values.operator.metrics.enabled }}
|
|
- --metrics-bind-address=:{{ .Values.operator.metrics.port}}
|
|
{{- end }}
|
|
- --leader-elect
|
|
- --health-probe-bind-address=:{{ .Values.operator.livenessProbe.port }}
|
|
- --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
|
|
{{- if .Values.managementURL }}
|
|
- --netbird-management-url={{.Values.managementURL}}
|
|
{{- end }}
|
|
{{- if .Values.cluster.name }}
|
|
- --cluster-name={{.Values.cluster.name}}
|
|
{{- end }}
|
|
{{- if .Values.ingress.namespacedNetworks }}
|
|
- --namespaced-networks={{.Values.ingress.namespacedNetworks}}
|
|
{{- end }}
|
|
{{- if .Values.cluster.dns }}
|
|
- --cluster-dns={{.Values.cluster.dns}}
|
|
{{- end }}
|
|
{{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
|
|
- --netbird-api-key=$(NB_API_KEY)
|
|
{{- end }}
|
|
{{- if .Values.ingress.allowAutomaticPolicyCreation }}
|
|
- --allow-automatic-policy-creation
|
|
{{- end }}
|
|
ports:
|
|
- name: webhook-server
|
|
containerPort: {{ .Values.webhook.service.port }}
|
|
protocol: TCP
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /healthz
|
|
port: {{ .Values.operator.livenessProbe.port }}
|
|
scheme: HTTP
|
|
initialDelaySeconds: {{ .Values.operator.livenessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.operator.livenessProbe.periodSeconds }}
|
|
successThreshold: {{ .Values.operator.livenessProbe.successThreshold }}
|
|
timeoutSeconds: {{ .Values.operator.livenessProbe.timeoutSeconds }}
|
|
{{- if or .Values.netbirdAPI.key .Values.netbirdAPI.keyFromSecret }}
|
|
env:
|
|
- name: NB_API_KEY
|
|
valueFrom:
|
|
{{- if .Values.netbirdAPI.keyFromSecret }}
|
|
name: {{.Values.netbirdAPI.keyFromSecretName}}
|
|
key: {{.Values.netbirdAPI.keyFromSecretKey}}
|
|
{{- else }}
|
|
name: {{ include "kubernetes-operator.fullname" . }}
|
|
key: NB_API_KEY
|
|
{{- end }}
|
|
{{- end }}
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /readyz
|
|
port: {{ .Values.operator.readinessProbe.port }}
|
|
scheme: HTTP
|
|
initialDelaySeconds: {{ .Values.operator.readinessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.operator.readinessProbe.periodSeconds }}
|
|
successThreshold: {{ .Values.operator.readinessProbe.successThreshold }}
|
|
timeoutSeconds: {{ .Values.operator.readinessProbe.timeoutSeconds }}
|
|
resources:
|
|
{{- toYaml .Values.operator.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
|
name: webhook-certs
|
|
readOnly: true
|
|
{{- with .Values.operator.volumeMounts }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: webhook-certs
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: {{ template "kubernetes-operator.webhookCertSecret" . }}
|
|
{{- with .Values.operator.volumes }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operator.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operator.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operator.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|