istio.io/istio@v0.0.0-20240520182934-d79c90f27776/manifests/charts/gateways/istio-egress/templates/injected-deployment.yaml (about)

     1  {{- $gateway := index .Values "gateways" "istio-egressgateway" }}
     2  {{- if ne $gateway.injectionTemplate "" }}
     3  {{/* This provides a minimal gateway, ready to be injected.
     4       Any settings from values.gateways should be here - these are options specific to the gateway.
     5       Global settings, like the image, various env vars and volumes, etc will be injected.
     6       The normal Deployment is not suitable for this, as the original pod spec will override the injection template. */}}
     7  apiVersion: apps/v1
     8  kind: Deployment
     9  metadata:
    10    name: {{ $gateway.name | default "istio-egressgateway" }}
    11    namespace: {{ .Release.Namespace }}
    12    labels:
    13  {{ $gateway.labels | toYaml | indent 4 }}
    14      release: {{ .Release.Name }}
    15      istio.io/rev: {{ .Values.revision | default "default" | quote }}
    16      install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    17      operator.istio.io/component: "EgressGateways"
    18  spec:
    19  {{- if not $gateway.autoscaleEnabled }}
    20  {{- if $gateway.replicaCount }}
    21    replicas: {{ $gateway.replicaCount }}
    22  {{- end }}
    23  {{- end }}
    24    selector:
    25      matchLabels:
    26  {{ $gateway.labels | toYaml | indent 6 }}
    27    strategy:
    28      rollingUpdate:
    29        maxSurge: {{ $gateway.rollingMaxSurge }}
    30        maxUnavailable: {{ $gateway.rollingMaxUnavailable }}
    31    template:
    32      metadata:
    33        labels:
    34  {{ $gateway.labels | toYaml | indent 8 }}
    35  {{- if eq .Release.Namespace "istio-system"}}
    36          heritage: Tiller
    37          release: istio
    38          chart: gateways
    39  {{- end }}
    40          install.operator.istio.io/owning-resource: {{ .Values.ownerName | default "unknown" }}
    41          operator.istio.io/component: "EgressGateways"
    42          sidecar.istio.io/inject: "true"
    43          {{- with .Values.revision }}
    44          istio.io/rev: {{ . }}
    45          {{- end }}
    46        annotations:
    47          {{- if .Values.meshConfig.enablePrometheusMerge }}
    48          prometheus.io/port: "15020"
    49          prometheus.io/scrape: "true"
    50          prometheus.io/path: "/stats/prometheus"
    51          {{- end }}
    52          sidecar.istio.io/inject: "true"
    53          inject.istio.io/templates: "{{ $gateway.injectionTemplate }}"
    54  {{- if $gateway.podAnnotations }}
    55  {{ toYaml $gateway.podAnnotations | indent 8 }}
    56  {{ end }}
    57      spec:
    58  {{- if not $gateway.runAsRoot }}
    59        securityContext:
    60  {{- if not (eq .Values.global.platform "openshift") }}
    61          runAsUser: 1337
    62          runAsGroup: 1337
    63  {{- end }}
    64          runAsNonRoot: true
    65  {{- end }}
    66        serviceAccountName: {{ $gateway.name | default "istio-egressgateway" }}-service-account
    67  {{- if .Values.global.priorityClassName }}
    68        priorityClassName: "{{ .Values.global.priorityClassName }}"
    69  {{- end }}
    70        containers:
    71          - name: istio-proxy
    72            image: auto
    73  {{- if .Values.global.imagePullPolicy }}
    74            imagePullPolicy: {{ .Values.global.imagePullPolicy }}
    75  {{- end }}
    76            ports:
    77              {{- range $key, $val := $gateway.ports }}
    78              - containerPort: {{ $val.targetPort | default $val.port }}
    79                protocol: {{ $val.protocol | default "TCP" }}
    80              {{- end }}
    81              - containerPort: 15090
    82                protocol: TCP
    83                name: http-envoy-prom
    84          {{- if not $gateway.runAsRoot }}
    85            securityContext:
    86              allowPrivilegeEscalation: false
    87              capabilities:
    88                drop:
    89                - ALL
    90              privileged: false
    91              readOnlyRootFilesystem: true
    92          {{- end }}
    93            resources:
    94  {{- if $gateway.resources }}
    95  {{ toYaml $gateway.resources | indent 12 }}
    96  {{- else }}
    97  {{ toYaml .Values.global.defaultResources | indent 12 }}
    98  {{- end }}
    99            env:
   100            {{- if not $gateway.runAsRoot }}
   101            - name: ISTIO_META_UNPRIVILEGED_POD
   102              value: "true"
   103            {{- end }}
   104            {{- range $key, $val := $gateway.env }}
   105            - name: {{ $key }}
   106              value: {{ $val | quote }}
   107            {{- end }}
   108            volumeMounts:
   109            {{- range $gateway.secretVolumes }}
   110            - name: {{ .name }}
   111              mountPath: {{ .mountPath | quote }}
   112              readOnly: true
   113            {{- end }}
   114            {{- range $gateway.configVolumes }}
   115            {{- if .mountPath }}
   116            - name: {{ .name }}
   117              mountPath: {{ .mountPath | quote }}
   118              readOnly: true
   119            {{- end }}
   120            {{- end }}
   121  {{- if $gateway.additionalContainers }}
   122  {{ toYaml $gateway.additionalContainers | indent 8 }}
   123  {{- end }}
   124        volumes:
   125        {{- range $gateway.secretVolumes }}
   126        - name: {{ .name }}
   127          secret:
   128            secretName: {{ .secretName | quote }}
   129            optional: true
   130        {{- end }}
   131        {{- range $gateway.configVolumes }}
   132        - name: {{ .name }}
   133          configMap:
   134            name: {{ .configMapName | quote }}
   135            optional: true
   136        {{- end }}
   137        affinity:
   138  {{ include "nodeaffinity" (dict "global" .Values.global "nodeSelector" $gateway.nodeSelector) | trim | indent 8 }}
   139        {{- include "podAntiAffinity" $gateway | indent 6 }}
   140  {{- if $gateway.tolerations }}
   141        tolerations:
   142  {{ toYaml $gateway.tolerations | indent 6 }}
   143  {{- else if .Values.global.defaultTolerations }}
   144        tolerations:
   145  {{ toYaml .Values.global.defaultTolerations | indent 6 }}
   146  {{- end }}
   147  {{- end }}