mirror of
https://github.com/YuzuZensai/netbird-kubernetes-operator.git
synced 2026-09-13 18:59:09 +00:00
Philip LaineandGitHub
fe715ae40c
The majority of users are using the operator with an API key, so the default should be to look for the secret. This change also removes the option to set the api key in plain text as that is just bad practice. Also bumps the chart version to prepare for a minor release.
150 lines
5.8 KiB
YAML
150 lines
5.8 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: {{ include "kubernetes-operator.fullname" . }}
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
{{- include "kubernetes-operator.labels" . | nindent 4 }}
|
|
spec:
|
|
replicas: {{ .Values.operator.replicaCount }}
|
|
selector:
|
|
matchLabels:
|
|
{{- include "kubernetes-operator.selectorLabels" . | nindent 6 }}
|
|
template:
|
|
metadata:
|
|
{{- with .Values.operator.podAnnotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
app.kubernetes.io/component: operator
|
|
{{- include "kubernetes-operator.labels" . | nindent 8 }}
|
|
{{- with .Values.operator.podLabels }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
spec:
|
|
{{- with .Values.operator.imagePullSecrets }}
|
|
imagePullSecrets:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
serviceAccountName: {{ include "kubernetes-operator.serviceAccountName" . }}
|
|
securityContext:
|
|
{{- toYaml .Values.operator.podSecurityContext | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Chart.Name }}
|
|
securityContext:
|
|
{{- toYaml .Values.operator.securityContext | nindent 12 }}
|
|
image: "{{ .Values.operator.image.registry }}/{{ .Values.operator.image.repository }}:{{ .Values.operator.image.tag | default .Chart.AppVersion }}"
|
|
imagePullPolicy: {{ .Values.operator.image.pullPolicy }}
|
|
command:
|
|
- /manager
|
|
args:
|
|
{{- if .Values.operator.metrics.enabled }}
|
|
- --metrics-bind-address=:{{ .Values.operator.metrics.port}}
|
|
{{- end }}
|
|
- --leader-elect
|
|
- --health-probe-bind-address=:{{ .Values.operator.livenessProbe.port }}
|
|
- --webhook-cert-path=/tmp/k8s-webhook-server/serving-certs
|
|
- --runtime-namespace=$(POD_NAMESPACE)
|
|
{{- if .Values.gatewayAPI.enabled }}
|
|
- --gateway-api-enabled=true
|
|
{{- end }}
|
|
{{- if .Values.managementURL }}
|
|
- --netbird-management-url={{.Values.managementURL}}
|
|
{{- end }}
|
|
{{- if .Values.cluster.name }}
|
|
- --cluster-name={{.Values.cluster.name}}
|
|
{{- end }}
|
|
{{- if .Values.ingress.namespacedNetworks }}
|
|
- --namespaced-networks={{.Values.ingress.namespacedNetworks}}
|
|
{{- end }}
|
|
{{- if .Values.cluster.dns }}
|
|
- --cluster-dns={{.Values.cluster.dns}}
|
|
{{- end }}
|
|
{{- if .Values.netbirdAPI.keyFromSecret }}
|
|
- --netbird-api-key=$(NB_API_KEY)
|
|
{{- end }}
|
|
{{- if .Values.ingress.allowAutomaticPolicyCreation }}
|
|
- --allow-automatic-policy-creation
|
|
{{- end }}
|
|
{{- if .Values.routingClientImage }}
|
|
- --netbird-client-image={{.Values.routingClientImage}}
|
|
{{- end }}
|
|
{{- if .Values.general.labels }}
|
|
{{- $list := list }}
|
|
{{- range $k, $v := .Values.general.labels }}
|
|
{{- $list = append $list (printf "%s=%s" $k $v) }}
|
|
{{- end }}
|
|
- --default-labels="{{ join ", " $list }}"
|
|
{{- end }}
|
|
ports:
|
|
- name: webhook-server
|
|
containerPort: {{ .Values.webhook.service.port }}
|
|
protocol: TCP
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /healthz
|
|
port: {{ .Values.operator.livenessProbe.port }}
|
|
scheme: HTTP
|
|
initialDelaySeconds: {{ .Values.operator.livenessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.operator.livenessProbe.periodSeconds }}
|
|
successThreshold: {{ .Values.operator.livenessProbe.successThreshold }}
|
|
timeoutSeconds: {{ .Values.operator.livenessProbe.timeoutSeconds }}
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
{{- if .Values.netbirdAPI.keyFromSecret }}
|
|
- name: NB_API_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
{{- if .Values.netbirdAPI.keyFromSecret }}
|
|
name: {{ .Values.netbirdAPI.keyFromSecret.name }}
|
|
key: {{ .Values.netbirdAPI.keyFromSecret.key }}
|
|
{{- else }}
|
|
name: {{ include "kubernetes-operator.fullname" . }}
|
|
key: NB_API_KEY
|
|
{{- end }}
|
|
{{- end }}
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /readyz
|
|
port: {{ .Values.operator.readinessProbe.port }}
|
|
scheme: HTTP
|
|
initialDelaySeconds: {{ .Values.operator.readinessProbe.initialDelaySeconds }}
|
|
periodSeconds: {{ .Values.operator.readinessProbe.periodSeconds }}
|
|
successThreshold: {{ .Values.operator.readinessProbe.successThreshold }}
|
|
timeoutSeconds: {{ .Values.operator.readinessProbe.timeoutSeconds }}
|
|
resources:
|
|
{{- toYaml .Values.operator.resources | nindent 12 }}
|
|
volumeMounts:
|
|
- mountPath: /tmp/k8s-webhook-server/serving-certs
|
|
name: webhook-certs
|
|
readOnly: true
|
|
{{- with .Values.operator.volumeMounts }}
|
|
{{- toYaml . | nindent 12 }}
|
|
{{- end }}
|
|
volumes:
|
|
- name: webhook-certs
|
|
secret:
|
|
defaultMode: 420
|
|
secretName: {{ template "kubernetes-operator.webhookCertSecret" . }}
|
|
{{- with .Values.operator.volumes }}
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operator.nodeSelector }}
|
|
nodeSelector:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operator.affinity }}
|
|
affinity:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|
|
{{- with .Values.operator.tolerations }}
|
|
tolerations:
|
|
{{- toYaml . | nindent 8 }}
|
|
{{- end }}
|