From 9796948bdfe5235ed65e0f1e5a0625c3d03f1f63 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Mon, 7 Jun 2021 16:38:25 -0500
Subject: [PATCH 01/12] initial code path

---
 templates/connect-inject-deployment.yaml      |  8 +++--
 templates/controller-deployment.yaml          |  6 +++-
 templates/create-federation-secret-job.yaml   | 24 +++++++-------
 templates/ingress-gateways-deployment.yaml    | 30 +++++++++++-------
 templates/mesh-gateway-deployment.yaml        | 20 +++++++-----
 templates/server-acl-init-cleanup-job.yaml    | 13 +++++---
 templates/server-acl-init-job.yaml            |  2 ++
 templates/sync-catalog-deployment.yaml        |  9 ++++--
 .../terminating-gateways-deployment.yaml      | 18 ++++++-----
 templates/tls-init-job.yaml                   |  2 ++
 .../webhook-cert-manager-deployment.yaml      |  2 ++
 test/unit/connect-inject-deployment.bats      |  4 +--
 test/unit/controller-deployment.bats          | 31 +++++++++++++++++++
 test/unit/ingress-gateways-deployment.bats    |  4 +++
 test/unit/mesh-gateway-deployment.bats        | 12 +++++++
 test/unit/server-acl-init-cleanup-job.bats    |  9 ++++--
 test/unit/server-acl-init-job.bats            |  3 +-
 test/unit/sync-catalog-deployment.bats        | 31 +++++++++++++++++++
 values.yaml                                   | 19 ++++++++++--
 19 files changed, 189 insertions(+), 58 deletions(-)

diff --git a/templates/connect-inject-deployment.yaml b/templates/connect-inject-deployment.yaml
index 1c0ae7006..d13a718f3 100644
--- a/templates/connect-inject-deployment.yaml
+++ b/templates/connect-inject-deployment.yaml
@@ -83,6 +83,11 @@ spec:
               CONSUL_FULLNAME="{{template "consul.fullname" . }}"
 
               consul-k8s inject-connect \
+                {{- if .Values.connectInject.logLevel }}
+                -log-level={{ .Values.connectInject.logLevel }} \
+                {{- else }}
+                -log-level={{ .Values.global.logLevel }} \
+                {{- end }}
                 -default-inject={{ .Values.connectInject.default }} \
                 -consul-image="{{ default .Values.global.image .Values.connectInject.imageConsul }}" \
                 -envoy-image="{{ .Values.global.imageEnvoy }}" \
@@ -106,9 +111,6 @@ spec:
                 {{- if .Values.global.openshift.enabled }}
                 -enable-openshift \
                 {{- end }}
-                {{- if .Values.connectInject.logLevel }}
-                -log-level={{ .Values.connectInject.logLevel }} \
-                {{- end }}
                 {{- if (or (and (ne (.Values.connectInject.metrics.defaultEnabled | toString) "-") .Values.connectInject.metrics.defaultEnabled) (and (eq (.Values.connectInject.metrics.defaultEnabled | toString) "-") .Values.global.metrics.enabled)) }}
                 -default-enable-metrics=true \
                 {{- else }}
diff --git a/templates/controller-deployment.yaml b/templates/controller-deployment.yaml
index 73c2aafb8..58a5afdf1 100644
--- a/templates/controller-deployment.yaml
+++ b/templates/controller-deployment.yaml
@@ -59,10 +59,14 @@ spec:
         - "-ec"
         - |
           consul-k8s controller \
+            {{- if .Values.controller.logLevel }}
+            -log-level={{ .Values.controller.logLevel }} \
+            {{- else }}
+            -log-level={{ .Values.global.logLevel }} \
+            {{- end }}
             -webhook-tls-cert-dir=/tmp/controller-webhook/certs \
             -datacenter={{ .Values.global.datacenter }} \
             -enable-leader-election \
-            -log-level={{ .Values.controller.logLevel | quote }} \
             {{- if .Values.global.enableConsulNamespaces }}
             -enable-namespaces=true \
             {{- if .Values.connectInject.consulNamespaces.consulDestinationNamespace }}
diff --git a/templates/create-federation-secret-job.yaml b/templates/create-federation-secret-job.yaml
index 5b0af8fa5..ecf163a84 100644
--- a/templates/create-federation-secret-job.yaml
+++ b/templates/create-federation-secret-job.yaml
@@ -116,17 +116,19 @@ spec:
             - "-ec"
             - |
                 consul-k8s create-federation-secret \
-                  {{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
-                  -gossip-key-file=/consul/gossip/gossip.key \
-                  {{- end }}
-                  {{- if .Values.global.acls.createReplicationToken }}
-                  -export-replication-token=true \
-                  {{- end }}
-                  -mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
-                  -k8s-namespace="${NAMESPACE}" \
-                  -resource-prefix="{{ template "consul.fullname" . }}" \
-                  -server-ca-cert-file=/consul/tls/ca/tls.crt \
-                  -server-ca-key-file=/consul/tls/server/ca/tls.key
+                -log-level={{ .Values.global.logLevel }} \
+                -log-json={{ .Values.global.logJSON }} \
+                {{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
+                -gossip-key-file=/consul/gossip/gossip.key \
+                {{- end }}
+                {{- if .Values.global.acls.createReplicationToken }}
+                -export-replication-token=true \
+                {{- end }}
+                -mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
+                -k8s-namespace="${NAMESPACE}" \
+                -resource-prefix="{{ template "consul.fullname" . }}" \
+                -server-ca-cert-file=/consul/tls/ca/tls.crt \
+                -server-ca-key-file=/consul/tls/server/ca/tls.key
           resources:
             requests:
               memory: "50Mi"
diff --git a/templates/ingress-gateways-deployment.yaml b/templates/ingress-gateways-deployment.yaml
index c3658cc4a..7a71f7100 100644
--- a/templates/ingress-gateways-deployment.yaml
+++ b/templates/ingress-gateways-deployment.yaml
@@ -166,6 +166,8 @@ spec:
                 WAN_ADDR="${HOST_IP}"
                 {{- else if (or (eq $serviceType "ClusterIP") (eq $serviceType "LoadBalancer")) }}
                 consul-k8s service-address \
+                  -log-level={{ $root.Values.global.logLevel }} \
+                  -log-json={{ $root.Values.global.logJSON }} \
                   -k8s-namespace={{ $root.Release.Namespace }} \
                   -name={{ template "consul.fullname" $root }}-{{ .name }} \
                   -output-file=/tmp/address.txt
@@ -368,11 +370,11 @@ spec:
                   - "/bin/sh"
                   - "-ec"
                   - |
-                      /consul-bin/consul services deregister \
-                      {{- if $root.Values.global.enableConsulNamespaces }}
-                      -namespace={{ default $defaults.consulNamespace .consulNamespace }} \
-                      {{- end }}
-                      -id="${POD_NAME}"
+                    /consul-bin/consul services deregister \
+                    {{- if $root.Values.global.enableConsulNamespaces }}
+                    -namespace={{ default $defaults.consulNamespace .consulNamespace }} \
+                    {{- end }}
+                    -id="${POD_NAME}"
 
         # consul-sidecar ensures the ingress gateway is always registered with
         # the local Consul agent, even if it loses the initial registration.
@@ -417,13 +419,17 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - consul-k8s
-            - consul-sidecar
-            - -service-config=/consul/service/service.hcl
-            - -consul-binary=/consul-bin/consul
-            {{- if $root.Values.global.acls.manageSystemACLs }}
-            - -token-file=/consul/service/acl-token
-            {{- end }}
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s consul-sidecar \
+                  -log-level={{ $root.Values.global.logLevel }} \
+                  -log-json={{ $root.Values.global.logJSON }} \
+                  -service-config=/consul/service/service.hcl \
+                  {{- if $root.Values.global.acls.manageSystemACLs }}
+                  -token-file=/consul/service/acl-token \
+                  {{- end }}
+                  -consul-binary=/consul-bin/consul
       {{- if (default $defaults.priorityClassName .priorityClassName) }}
       priorityClassName: {{ default $defaults.priorityClassName .priorityClassName | quote }}
       {{- end }}
diff --git a/templates/mesh-gateway-deployment.yaml b/templates/mesh-gateway-deployment.yaml
index e81658198..b34df4d5c 100644
--- a/templates/mesh-gateway-deployment.yaml
+++ b/templates/mesh-gateway-deployment.yaml
@@ -147,6 +147,8 @@ spec:
                 WAN_ADDR="${NODE_NAME}"
                 {{- else if and (eq $source "Service") (or (eq $serviceType "ClusterIP") (eq $serviceType "LoadBalancer")) }}
                 consul-k8s service-address \
+                  -log-level={{ .Values.global.logLevel }} \
+                  -log-json={{ .Values.global.logJSON }} \
                   -k8s-namespace={{ .Release.Namespace }} \
                   -name={{ template "consul.fullname" . }}-mesh-gateway \
                   -output-file=/tmp/address.txt
@@ -363,13 +365,17 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - consul-k8s
-            - consul-sidecar
-            - -service-config=/consul/service/service.hcl
-            - -consul-binary=/consul-bin/consul
-            {{- if .Values.global.acls.manageSystemACLs }}
-            - -token-file=/consul/service/acl-token
-            {{- end }}
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s consul-sidecar \
+                  -log-level={{ .Values.global.logLevel }} \
+                  -log-json={{ .Values.global.logJSON }} \
+                  -service-config=/consul/service/service.hcl \
+                  {{- if .Values.global.acls.manageSystemACLs }}
+                  -token-file=/consul/service/acl-token \
+                  {{- end }}
+                  -consul-binary=/consul-bin/consul
       {{- if .Values.meshGateway.priorityClassName }}
       priorityClassName: {{ .Values.meshGateway.priorityClassName | quote }}
       {{- end }}
diff --git a/templates/server-acl-init-cleanup-job.yaml b/templates/server-acl-init-cleanup-job.yaml
index 4f13e4412..5f4b0ef13 100644
--- a/templates/server-acl-init-cleanup-job.yaml
+++ b/templates/server-acl-init-cleanup-job.yaml
@@ -47,11 +47,14 @@ spec:
         - name: server-acl-init-cleanup
           image: {{ .Values.global.imageK8S }}
           command:
-            - consul-k8s
-          args:
-            - delete-completed-job
-            - -k8s-namespace={{ .Release.Namespace }}
-            - {{ template "consul.fullname" . }}-server-acl-init
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s delete-completed-job \
+                -log-level={{ .Values.global.logLevel }} \
+                -log-json={{ .Values.global.logJSON }} \
+                -k8s-namespace={{ .Release.Namespace }} \
+                {{ template "consul.fullname" . }}-server-acl-init
           resources:
             requests:
               memory: "50Mi"
diff --git a/templates/server-acl-init-job.yaml b/templates/server-acl-init-job.yaml
index a5ed950f1..ef6fc6ad4 100644
--- a/templates/server-acl-init-job.yaml
+++ b/templates/server-acl-init-job.yaml
@@ -98,6 +98,8 @@ spec:
               CONSUL_FULLNAME="{{template "consul.fullname" . }}"
 
               consul-k8s server-acl-init \
+                -log-level={{ .Values.global.logLevel }} \
+                -log-json={{ .Values.global.logJSON }} \
                 -resource-prefix=${CONSUL_FULLNAME} \
                 -k8s-namespace={{ .Release.Namespace }} \
 
diff --git a/templates/sync-catalog-deployment.yaml b/templates/sync-catalog-deployment.yaml
index 1e8fbd20d..9d34a941e 100644
--- a/templates/sync-catalog-deployment.yaml
+++ b/templates/sync-catalog-deployment.yaml
@@ -113,6 +113,12 @@ spec:
             - "-ec"
             - |
               consul-k8s sync-catalog \
+                {{- if .Values.syncCatalog.logLevel }}
+                -log-level={{ .Values.syncCatalog.logLevel }} \
+                {{- else }}
+                -log-level={{ .Values.global.logLevel }} \
+                {{- end }}
+                -log-json={{ .Values.global.logJSON }} \
                 -k8s-default-sync={{ .Values.syncCatalog.default }} \
                 {{- if (not .Values.syncCatalog.toConsul) }}
                 -to-consul=false \
@@ -143,9 +149,6 @@ spec:
                 {{- if .Values.syncCatalog.consulWriteInterval }}
                 -consul-write-interval={{ .Values.syncCatalog.consulWriteInterval }} \
                 {{- end }}
-                {{- if .Values.syncCatalog.logLevel }}
-                -log-level={{ .Values.syncCatalog.logLevel }} \
-                {{- end }}
                 {{- if .Values.syncCatalog.k8sTag }}
                 -consul-k8s-tag={{ .Values.syncCatalog.k8sTag }} \
                 {{- end }}
diff --git a/templates/terminating-gateways-deployment.yaml b/templates/terminating-gateways-deployment.yaml
index f58205a87..013f5266f 100644
--- a/templates/terminating-gateways-deployment.yaml
+++ b/templates/terminating-gateways-deployment.yaml
@@ -365,13 +365,17 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - consul-k8s
-            - consul-sidecar
-            - -service-config=/consul/service/service.hcl
-            - -consul-binary=/consul-bin/consul
-            {{- if $root.Values.global.acls.manageSystemACLs }}
-            - -token-file=/consul/service/acl-token
-            {{- end }}
+            - "/bin/sh"
+            - "-ec"
+            - |
+                consul-k8s consul-sidecar \
+                  -log-level={{ $root.Values.global.logLevel }} \
+                  -log-json={{ $root.Values.global.logJSON }} \
+                  -service-config=/consul/service/service.hcl \
+                  {{- if $root.Values.global.acls.manageSystemACLs }}
+                  -token-file=/consul/service/acl-token \
+                  {{- end }}
+                  -consul-binary=/consul-bin/consul
       {{- if (default $defaults.priorityClassName .priorityClassName) }}
       priorityClassName: {{ (default $defaults.priorityClassName .priorityClassName) | quote }}
       {{- end }}
diff --git a/templates/tls-init-job.yaml b/templates/tls-init-job.yaml
index ebd0e5f41..c402cb1f6 100644
--- a/templates/tls-init-job.yaml
+++ b/templates/tls-init-job.yaml
@@ -61,6 +61,8 @@ spec:
               # and use * at the start of the dns name when setting -additional-dnsname.
               set -o noglob
               consul-k8s tls-init \
+                -log-level={{ .Values.global.logLevel }} \
+                -log-json={{ .Values.global.logJSON }} \
                 -domain={{ .Values.global.domain }} \
                 -days=730 \
                 -name-prefix={{ template "consul.fullname" . }} \
diff --git a/templates/webhook-cert-manager-deployment.yaml b/templates/webhook-cert-manager-deployment.yaml
index 5b6733517..1ddb9fac1 100644
--- a/templates/webhook-cert-manager-deployment.yaml
+++ b/templates/webhook-cert-manager-deployment.yaml
@@ -36,6 +36,8 @@ spec:
         - "-ec"
         - |
           consul-k8s webhook-cert-manager \
+            -log-level={{ .Values.global.logLevel }} \
+            -log-json={{ .Values.global.logJSON }} \
             -config-file=/bootstrap/config/webhook-config.json
         image: {{ .Values.global.imageK8S }}
         name: webhook-cert-manager
diff --git a/test/unit/connect-inject-deployment.bats b/test/unit/connect-inject-deployment.bats
index 0c3a93cf6..2b6195090 100755
--- a/test/unit/connect-inject-deployment.bats
+++ b/test/unit/connect-inject-deployment.bats
@@ -1346,7 +1346,7 @@ EOF
 #--------------------------------------------------------------------
 # logLevel
 
-@test "connectInject/Deployment: logLevel info by default" {
+@test "connectInject/Deployment: logLevel info by default from global" {
   cd `chart_dir`
   local cmd=$(helm template \
       -s templates/connect-inject-deployment.yaml  \
@@ -1359,7 +1359,7 @@ EOF
   [ "${actual}" = "true" ]
 }
 
-@test "connectInject/Deployment: logLevel can be set" {
+@test "connectInject/Deployment: logLevel can be overridden" {
   cd `chart_dir`
   local cmd=$(helm template \
       -s templates/connect-inject-deployment.yaml  \
diff --git a/test/unit/controller-deployment.bats b/test/unit/controller-deployment.bats
index 13c7960d5..0a4ba9972 100644
--- a/test/unit/controller-deployment.bats
+++ b/test/unit/controller-deployment.bats
@@ -481,3 +481,34 @@ load _helpers
       yq '[.spec.template.spec.containers[0].env[].name] | any(contains("CONSUL_HTTP_TOKEN"))' | tee /dev/stderr)
   [ "${actual}" = "true" ]
 }
+
+#--------------------------------------------------------------------
+# logLevel
+
+@test "controller/Deployment: logLevel info by default from global" {
+  cd `chart_dir`
+  local cmd=$(helm template \
+      -s templates/controller-deployment.yaml  \
+      --set 'controller.enabled=true' \
+      . | tee /dev/stderr |
+      yq '.spec.template.spec.containers[0].command' | tee /dev/stderr)
+
+  local actual=$(echo "$cmd" |
+    yq 'any(contains("-log-level=info"))' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
+@test "controller/Deployment: logLevel can be overridden" {
+  cd `chart_dir`
+  local cmd=$(helm template \
+      -s templates/controller-deployment.yaml  \
+      --set 'controller.enabled=true' \
+      --set 'controller.logLevel=debug' \
+      . | tee /dev/stderr |
+      yq '.spec.template.spec.containers[0].command' | tee /dev/stderr)
+
+  local actual=$(echo "$cmd" |
+    yq 'any(contains("-log-level=debug"))' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
diff --git a/test/unit/ingress-gateways-deployment.bats b/test/unit/ingress-gateways-deployment.bats
index eb2c123b0..0ccd5e653 100644
--- a/test/unit/ingress-gateways-deployment.bats
+++ b/test/unit/ingress-gateways-deployment.bats
@@ -1173,6 +1173,8 @@ key2: value2' \
       yq -s -r '.[0].spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-ingress-gateway \
   -output-file=/tmp/address.txt
@@ -1239,6 +1241,8 @@ EOF
   -token-sink-file=/consul/service/acl-token
 
 consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-ingress-gateway \
   -output-file=/tmp/address.txt
diff --git a/test/unit/mesh-gateway-deployment.bats b/test/unit/mesh-gateway-deployment.bats
index 70001f02e..fdae83388 100755
--- a/test/unit/mesh-gateway-deployment.bats
+++ b/test/unit/mesh-gateway-deployment.bats
@@ -816,6 +816,8 @@ key2: value2' \
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -871,6 +873,8 @@ EOF
   -token-sink-file=/consul/service/acl-token
 
 consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -923,6 +927,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -1200,6 +1206,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -1317,6 +1325,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
@@ -1367,6 +1377,8 @@ EOF
       yq -r '.spec.template.spec.initContainers | map(select(.name == "service-init"))[0] | .command[2]' | tee /dev/stderr)
 
   exp='consul-k8s service-address \
+  -log-level=info \
+  -log-json=false \
   -k8s-namespace=default \
   -name=RELEASE-NAME-consul-mesh-gateway \
   -output-file=/tmp/address.txt
diff --git a/test/unit/server-acl-init-cleanup-job.bats b/test/unit/server-acl-init-cleanup-job.bats
index 0e61a5149..5602c7a62 100644
--- a/test/unit/server-acl-init-cleanup-job.bats
+++ b/test/unit/server-acl-init-cleanup-job.bats
@@ -54,8 +54,13 @@ load _helpers
       -s templates/server-acl-init-cleanup-job.yaml  \
       --set 'global.acls.manageSystemACLs=true' \
       . | tee /dev/stderr |
-      yq -c '.spec.template.spec.containers[0].args' | tee /dev/stderr)
-  [ "${actual}" = '["delete-completed-job","-k8s-namespace=default","RELEASE-NAME-consul-server-acl-init"]' ]
+      yq '.spec.template.spec.containers[0].command[2]' | tee /dev/stderr)
+  exp='consul-k8s delete-completed-job \
+-log-level=info \
+-log-json=false \
+-k8s-namespace=default \
+-RELEASE-NAME-consul-server-acl-init'
+  [ "${actual}" = "${exp}" ]
 }
 
 @test "serverACLInitCleanup/Job: enabled with externalServers.enabled=true and global.acls.manageSystemACLs=true, but server.enabled set to false" {
diff --git a/test/unit/server-acl-init-job.bats b/test/unit/server-acl-init-job.bats
index d513de7e4..7cec323f9 100644
--- a/test/unit/server-acl-init-job.bats
+++ b/test/unit/server-acl-init-job.bats
@@ -992,8 +992,7 @@ load _helpers
 
   local actual=$(echo $object |
     yq 'any(contains("inject-k8s-namespace-mirroring-prefix"))' | tee /dev/stderr)
-  [ "${actual}" = "true" ]
-}
+  [ "${actual}" = "true"
 
 #--------------------------------------------------------------------
 # global.acls.createReplicationToken
diff --git a/test/unit/sync-catalog-deployment.bats b/test/unit/sync-catalog-deployment.bats
index c87aeeb47..79da757a4 100755
--- a/test/unit/sync-catalog-deployment.bats
+++ b/test/unit/sync-catalog-deployment.bats
@@ -947,3 +947,34 @@ load _helpers
 
   [ "${actual}" = "bar" ]
 }
+
+#--------------------------------------------------------------------
+# logLevel
+
+@test "syncCatalog/Deployment: logLevel info by default from global" {
+  cd `chart_dir`
+  local cmd=$(helm template \
+      -s templates/sync-catalog-deployment.yaml  \
+      --set 'syncCatalog.enabled=true' \
+      . | tee /dev/stderr |
+      yq '.spec.template.spec.containers[0].command' | tee /dev/stderr)
+
+  local actual=$(echo "$cmd" |
+    yq 'any(contains("-log-level=info"))' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
+@test "syncCatalog/Deployment: logLevel can be overridden" {
+  cd `chart_dir`
+  local cmd=$(helm template \
+      -s templates/sync-catalog-deployment.yaml  \
+      --set 'syncCatalog.enabled=true' \
+      --set 'syncCatalog.logLevel=debug' \
+      . | tee /dev/stderr |
+      yq '.spec.template.spec.containers[0].command' | tee /dev/stderr)
+
+  local actual=$(echo "$cmd" |
+    yq 'any(contains("-log-level=debug"))' | tee /dev/stderr)
+  [ "${actual}" = "true" ]
+}
+
diff --git a/values.yaml b/values.yaml
index c3e3118fd..68d8945f0 100644
--- a/values.yaml
+++ b/values.yaml
@@ -9,6 +9,16 @@ global:
   # setting `server.enabled` to true.
   enabled: true
 
+  # The default log level to apply to all components which do not otherwise override this setting.
+  # It is recommended to generally not set this below "info" unless actively debugging due to logging verbosity.
+  # One of "trace", "debug", "info", "warn", or "error".
+  # @type: string
+  logLevel: "info"
+
+  # Enable all component logs to be output in JSON format.
+  # @type: boolean
+  logJSON: false
+
   # Set the prefix used for all resources in the Helm chart. If not set,
   # the prefix will be `<helm release name>-consul`.
   # @type: string
@@ -1324,7 +1334,8 @@ syncCatalog:
       cpu: "50m"
 
   # Log verbosity level. One of "trace", "debug", "info", "warn", or "error".
-  logLevel: info
+  # @type: string
+  logLevel: ""
 
   # Override the default interval to perform syncing operations creating Consul services.
   # @type: string
@@ -1429,7 +1440,8 @@ connectInject:
   imageConsul: null
 
   # Log verbosity level. One of "debug", "info", "warn", or "error".
-  logLevel: info
+  # @type: string
+  logLevel: ""
 
   serviceAccount:
     # This value defines additional annotations for the injector service account. This should be formatted as a 
@@ -1628,7 +1640,8 @@ controller:
   replicas: 1
 
   # Log verbosity level. One of "debug", "info", "warn", or "error".
-  logLevel: info
+  # @type: string
+  logLevel: ""
 
   serviceAccount:
     # This value defines additional annotations for the controller service account. This should be formatted as a 

From 24535edd85d9c465a6bc8ed1fc520f37d96af61e Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Tue, 8 Jun 2021 11:22:19 -0500
Subject: [PATCH 02/12] fix merge bug

---
 test/unit/server-acl-init-job.bats | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/test/unit/server-acl-init-job.bats b/test/unit/server-acl-init-job.bats
index 7cec323f9..d513de7e4 100644
--- a/test/unit/server-acl-init-job.bats
+++ b/test/unit/server-acl-init-job.bats
@@ -992,7 +992,8 @@ load _helpers
 
   local actual=$(echo $object |
     yq 'any(contains("inject-k8s-namespace-mirroring-prefix"))' | tee /dev/stderr)
-  [ "${actual}" = "true"
+  [ "${actual}" = "true" ]
+}
 
 #--------------------------------------------------------------------
 # global.acls.createReplicationToken

From c90c1f05937b6d9c9c2e3f5fb27d5ea738f39dd5 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Tue, 8 Jun 2021 12:07:20 -0500
Subject: [PATCH 03/12] fix test

---
 templates/server-acl-init-cleanup-job.yaml |  8 ++++----
 test/unit/server-acl-init-cleanup-job.bats | 10 +++++-----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/templates/server-acl-init-cleanup-job.yaml b/templates/server-acl-init-cleanup-job.yaml
index 5f4b0ef13..4d27c9d18 100644
--- a/templates/server-acl-init-cleanup-job.yaml
+++ b/templates/server-acl-init-cleanup-job.yaml
@@ -51,10 +51,10 @@ spec:
             - "-ec"
             - |
                 consul-k8s delete-completed-job \
-                -log-level={{ .Values.global.logLevel }} \
-                -log-json={{ .Values.global.logJSON }} \
-                -k8s-namespace={{ .Release.Namespace }} \
-                {{ template "consul.fullname" . }}-server-acl-init
+                  -log-level={{ .Values.global.logLevel }} \
+                  -log-json={{ .Values.global.logJSON }} \
+                  -k8s-namespace={{ .Release.Namespace }} \
+                  {{ template "consul.fullname" . }}-server-acl-init
           resources:
             requests:
               memory: "50Mi"
diff --git a/test/unit/server-acl-init-cleanup-job.bats b/test/unit/server-acl-init-cleanup-job.bats
index 5602c7a62..409bf370a 100644
--- a/test/unit/server-acl-init-cleanup-job.bats
+++ b/test/unit/server-acl-init-cleanup-job.bats
@@ -54,12 +54,12 @@ load _helpers
       -s templates/server-acl-init-cleanup-job.yaml  \
       --set 'global.acls.manageSystemACLs=true' \
       . | tee /dev/stderr |
-      yq '.spec.template.spec.containers[0].command[2]' | tee /dev/stderr)
+      yq -r '.spec.template.spec.containers[0].command[2]' | tee /dev/stderr)
   exp='consul-k8s delete-completed-job \
--log-level=info \
--log-json=false \
--k8s-namespace=default \
--RELEASE-NAME-consul-server-acl-init'
+  -log-level=info \
+  -log-json=false \
+  -k8s-namespace=default \
+  RELEASE-NAME-consul-server-acl-init'
   [ "${actual}" = "${exp}" ]
 }
 

From 7fcc5d39c6dd750165bd3daa3e4ee8d7aca35ba1 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Tue, 8 Jun 2021 13:18:40 -0500
Subject: [PATCH 04/12] use new image

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5a93b847e..c9bf03951 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -48,7 +48,7 @@ commands:
         type: string
       consul-k8s-image:
         type: string
-        default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s:latest"
+        default: "kschoche/consul-k8s-dev-logging"
     steps:
       - when:
           condition: << parameters.failfast >>

From 57cd116348780d9e5f3a42f423178756f5d41909 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Wed, 23 Jun 2021 09:36:08 -0700
Subject: [PATCH 05/12] add support for json logging to connect and crd
 controller

---
 templates/connect-inject-deployment.yaml | 1 +
 templates/controller-deployment.yaml     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/templates/connect-inject-deployment.yaml b/templates/connect-inject-deployment.yaml
index d13a718f3..16233c9b7 100644
--- a/templates/connect-inject-deployment.yaml
+++ b/templates/connect-inject-deployment.yaml
@@ -88,6 +88,7 @@ spec:
                 {{- else }}
                 -log-level={{ .Values.global.logLevel }} \
                 {{- end }}
+                -log-json={{ .Values.global.logJSON }} \
                 -default-inject={{ .Values.connectInject.default }} \
                 -consul-image="{{ default .Values.global.image .Values.connectInject.imageConsul }}" \
                 -envoy-image="{{ .Values.global.imageEnvoy }}" \
diff --git a/templates/controller-deployment.yaml b/templates/controller-deployment.yaml
index 58a5afdf1..072c337cb 100644
--- a/templates/controller-deployment.yaml
+++ b/templates/controller-deployment.yaml
@@ -64,6 +64,7 @@ spec:
             {{- else }}
             -log-level={{ .Values.global.logLevel }} \
             {{- end }}
+            -log-json={{ .Values.global.logJSON }} \
             -webhook-tls-cert-dir=/tmp/controller-webhook/certs \
             -datacenter={{ .Values.global.datacenter }} \
             -enable-leader-election \

From bc6b2f1f8f284cb930c598f8c425a96db2265c6a Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Mon, 28 Jun 2021 16:18:21 -0700
Subject: [PATCH 06/12] review comments

---
 templates/connect-inject-deployment.yaml    |  6 +----
 templates/controller-deployment.yaml        |  6 +----
 templates/create-federation-secret-job.yaml | 26 ++++++++++-----------
 templates/ingress-gateways-deployment.yaml  | 10 ++++----
 test/unit/controller-deployment.bats        |  4 ++--
 values.yaml                                 |  6 ++---
 6 files changed, 25 insertions(+), 33 deletions(-)

diff --git a/templates/connect-inject-deployment.yaml b/templates/connect-inject-deployment.yaml
index 16233c9b7..9c3572877 100644
--- a/templates/connect-inject-deployment.yaml
+++ b/templates/connect-inject-deployment.yaml
@@ -83,11 +83,7 @@ spec:
               CONSUL_FULLNAME="{{template "consul.fullname" . }}"
 
               consul-k8s inject-connect \
-                {{- if .Values.connectInject.logLevel }}
-                -log-level={{ .Values.connectInject.logLevel }} \
-                {{- else }}
-                -log-level={{ .Values.global.logLevel }} \
-                {{- end }}
+                -log-level={{ default .Values.global.logLevel .Values.connectInject.logLevel }} \
                 -log-json={{ .Values.global.logJSON }} \
                 -default-inject={{ .Values.connectInject.default }} \
                 -consul-image="{{ default .Values.global.image .Values.connectInject.imageConsul }}" \
diff --git a/templates/controller-deployment.yaml b/templates/controller-deployment.yaml
index 072c337cb..50d5d1328 100644
--- a/templates/controller-deployment.yaml
+++ b/templates/controller-deployment.yaml
@@ -59,11 +59,7 @@ spec:
         - "-ec"
         - |
           consul-k8s controller \
-            {{- if .Values.controller.logLevel }}
-            -log-level={{ .Values.controller.logLevel }} \
-            {{- else }}
-            -log-level={{ .Values.global.logLevel }} \
-            {{- end }}
+            -log-level={{ default .Values.global.logLevel .Values.controller.logLevel }} \
             -log-json={{ .Values.global.logJSON }} \
             -webhook-tls-cert-dir=/tmp/controller-webhook/certs \
             -datacenter={{ .Values.global.datacenter }} \
diff --git a/templates/create-federation-secret-job.yaml b/templates/create-federation-secret-job.yaml
index ecf163a84..0745a44e8 100644
--- a/templates/create-federation-secret-job.yaml
+++ b/templates/create-federation-secret-job.yaml
@@ -116,19 +116,19 @@ spec:
             - "-ec"
             - |
                 consul-k8s create-federation-secret \
-                -log-level={{ .Values.global.logLevel }} \
-                -log-json={{ .Values.global.logJSON }} \
-                {{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
-                -gossip-key-file=/consul/gossip/gossip.key \
-                {{- end }}
-                {{- if .Values.global.acls.createReplicationToken }}
-                -export-replication-token=true \
-                {{- end }}
-                -mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
-                -k8s-namespace="${NAMESPACE}" \
-                -resource-prefix="{{ template "consul.fullname" . }}" \
-                -server-ca-cert-file=/consul/tls/ca/tls.crt \
-                -server-ca-key-file=/consul/tls/server/ca/tls.key
+                  -log-level={{ .Values.global.logLevel }} \
+                  -log-json={{ .Values.global.logJSON }} \
+                  {{- if (and .Values.global.gossipEncryption.secretName .Values.global.gossipEncryption.secretKey) }}
+                  -gossip-key-file=/consul/gossip/gossip.key \
+                  {{- end }}
+                  {{- if .Values.global.acls.createReplicationToken }}
+                  -export-replication-token=true \
+                  {{- end }}
+                  -mesh-gateway-service-name={{ .Values.meshGateway.consulServiceName }} \
+                  -k8s-namespace="${NAMESPACE}" \
+                  -resource-prefix="{{ template "consul.fullname" . }}" \
+                  -server-ca-cert-file=/consul/tls/ca/tls.crt \
+                  -server-ca-key-file=/consul/tls/server/ca/tls.key
           resources:
             requests:
               memory: "50Mi"
diff --git a/templates/ingress-gateways-deployment.yaml b/templates/ingress-gateways-deployment.yaml
index 7a71f7100..44704e559 100644
--- a/templates/ingress-gateways-deployment.yaml
+++ b/templates/ingress-gateways-deployment.yaml
@@ -370,11 +370,11 @@ spec:
                   - "/bin/sh"
                   - "-ec"
                   - |
-                    /consul-bin/consul services deregister \
-                    {{- if $root.Values.global.enableConsulNamespaces }}
-                    -namespace={{ default $defaults.consulNamespace .consulNamespace }} \
-                    {{- end }}
-                    -id="${POD_NAME}"
+                      /consul-bin/consul services deregister \
+                        {{- if $root.Values.global.enableConsulNamespaces }}
+                        -namespace={{ default $defaults.consulNamespace .consulNamespace }} \
+                        {{- end }}
+                        -id="${POD_NAME}"
 
         # consul-sidecar ensures the ingress gateway is always registered with
         # the local Consul agent, even if it loses the initial registration.
diff --git a/test/unit/controller-deployment.bats b/test/unit/controller-deployment.bats
index 0a4ba9972..c7c649de3 100644
--- a/test/unit/controller-deployment.bats
+++ b/test/unit/controller-deployment.bats
@@ -503,12 +503,12 @@ load _helpers
   local cmd=$(helm template \
       -s templates/controller-deployment.yaml  \
       --set 'controller.enabled=true' \
-      --set 'controller.logLevel=debug' \
+      --set 'controller.logLevel=error' \
       . | tee /dev/stderr |
       yq '.spec.template.spec.containers[0].command' | tee /dev/stderr)
 
   local actual=$(echo "$cmd" |
-    yq 'any(contains("-log-level=debug"))' | tee /dev/stderr)
+    yq 'any(contains("-log-level=error"))' | tee /dev/stderr)
   [ "${actual}" = "true" ]
 }
 
diff --git a/values.yaml b/values.yaml
index 6b1c22bed..3bd08008b 100644
--- a/values.yaml
+++ b/values.yaml
@@ -11,7 +11,7 @@ global:
 
   # The default log level to apply to all components which do not otherwise override this setting.
   # It is recommended to generally not set this below "info" unless actively debugging due to logging verbosity.
-  # One of "trace", "debug", "info", "warn", or "error".
+  # One of "debug", "info", "warn", or "error".
   # @type: string
   logLevel: "info"
 
@@ -1340,7 +1340,7 @@ syncCatalog:
       memory: "50Mi"
       cpu: "50m"
 
-  # Log verbosity level. One of "trace", "debug", "info", "warn", or "error".
+  # Override global log verbosity level. One of "debug", "info", "warn", or "error".
   # @type: string
   logLevel: ""
 
@@ -1446,7 +1446,7 @@ connectInject:
   # @type: string
   imageConsul: null
 
-  # Log verbosity level. One of "debug", "info", "warn", or "error".
+  # Override global log verbosity level. One of "debug", "info", "warn", or "error".
   # @type: string
   logLevel: ""
 

From ca1ff03035cefb83a5cbbe54608605f12d0ec94d Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Mon, 28 Jun 2021 16:42:38 -0700
Subject: [PATCH 07/12] switch back to old command formatting

---
 templates/ingress-gateways-deployment.yaml | 20 +++++++++-----------
 templates/mesh-gateway-deployment.yaml     | 20 +++++++++-----------
 2 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/templates/ingress-gateways-deployment.yaml b/templates/ingress-gateways-deployment.yaml
index 44704e559..49a92d922 100644
--- a/templates/ingress-gateways-deployment.yaml
+++ b/templates/ingress-gateways-deployment.yaml
@@ -419,17 +419,15 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - "/bin/sh"
-            - "-ec"
-            - |
-                consul-k8s consul-sidecar \
-                  -log-level={{ $root.Values.global.logLevel }} \
-                  -log-json={{ $root.Values.global.logJSON }} \
-                  -service-config=/consul/service/service.hcl \
-                  {{- if $root.Values.global.acls.manageSystemACLs }}
-                  -token-file=/consul/service/acl-token \
-                  {{- end }}
-                  -consul-binary=/consul-bin/consul
+            - consul-k8s
+            - consul-sidecar
+            - -log-level={{ $root.Values.global.logLevel }}
+            - -log-json={{ $root.Values.global.logJSON }}
+            - -service-config=/consul/service/service.hcl
+            {{- if $root.Values.global.acls.manageSystemACLs }}
+            - -token-file=/consul/service/acl-token
+            {{- end }}
+            - -consul-binary=/consul-bin/consul
       {{- if (default $defaults.priorityClassName .priorityClassName) }}
       priorityClassName: {{ default $defaults.priorityClassName .priorityClassName | quote }}
       {{- end }}
diff --git a/templates/mesh-gateway-deployment.yaml b/templates/mesh-gateway-deployment.yaml
index b34df4d5c..293dd0831 100644
--- a/templates/mesh-gateway-deployment.yaml
+++ b/templates/mesh-gateway-deployment.yaml
@@ -365,17 +365,15 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - "/bin/sh"
-            - "-ec"
-            - |
-                consul-k8s consul-sidecar \
-                  -log-level={{ .Values.global.logLevel }} \
-                  -log-json={{ .Values.global.logJSON }} \
-                  -service-config=/consul/service/service.hcl \
-                  {{- if .Values.global.acls.manageSystemACLs }}
-                  -token-file=/consul/service/acl-token \
-                  {{- end }}
-                  -consul-binary=/consul-bin/consul
+            - consul-k8s
+            - consul-sidecar
+            - -log-level={{ .Values.global.logLevel }}
+            - -log-json={{ .Values.global.logJSON }}
+            - -service-config=/consul/service/service.hcl
+            {{- if .Values.global.acls.manageSystemACLs }}
+            - -token-file=/consul/service/acl-token
+            {{- end }}
+            - -consul-binary=/consul-bin/consul
       {{- if .Values.meshGateway.priorityClassName }}
       priorityClassName: {{ .Values.meshGateway.priorityClassName | quote }}
       {{- end }}

From 2174a4fffc56c22a7f72f7fbe4c031a7e9e8a1d6 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Mon, 28 Jun 2021 16:44:42 -0700
Subject: [PATCH 08/12] update changelog

---
 CHANGELOG.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c01895239..6d0804b7d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ## UNRELEASED
 
 IMPROVEMENTS:
+* Allow setting global.logLevel and global.logJSON and propogate this to all consul-k8s commands. [[GH-980](https://github.com/hashicorp/consul-helm/pull/980)]
 * Allow setting annotations on service accounts for: server, client, client
   snapshot agent, connect inject, controller, ingressGateways, meshGateway,
   syncCatalog, and terminatingGateways. [[GH-964](https://github.com/hashicorp/consul-helm/pull/964)]

From e9fab4ee432aeec811eb7aa3a1d5f253d1a10ccb Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Tue, 29 Jun 2021 09:45:44 -0700
Subject: [PATCH 09/12] review comments

---
 templates/ingress-gateways-deployment.yaml    |  2 +-
 templates/mesh-gateway-deployment.yaml        |  2 +-
 templates/server-acl-init-cleanup-job.yaml    | 15 +++++++-------
 templates/sync-catalog-deployment.yaml        |  6 +-----
 .../terminating-gateways-deployment.yaml      | 20 +++++++++----------
 test/unit/server-acl-init-cleanup-job.bats    |  9 ++-------
 6 files changed, 21 insertions(+), 33 deletions(-)

diff --git a/templates/ingress-gateways-deployment.yaml b/templates/ingress-gateways-deployment.yaml
index 49a92d922..116d62a8e 100644
--- a/templates/ingress-gateways-deployment.yaml
+++ b/templates/ingress-gateways-deployment.yaml
@@ -424,10 +424,10 @@ spec:
             - -log-level={{ $root.Values.global.logLevel }}
             - -log-json={{ $root.Values.global.logJSON }}
             - -service-config=/consul/service/service.hcl
+            - -consul-binary=/consul-bin/consul
             {{- if $root.Values.global.acls.manageSystemACLs }}
             - -token-file=/consul/service/acl-token
             {{- end }}
-            - -consul-binary=/consul-bin/consul
       {{- if (default $defaults.priorityClassName .priorityClassName) }}
       priorityClassName: {{ default $defaults.priorityClassName .priorityClassName | quote }}
       {{- end }}
diff --git a/templates/mesh-gateway-deployment.yaml b/templates/mesh-gateway-deployment.yaml
index 293dd0831..e4032231e 100644
--- a/templates/mesh-gateway-deployment.yaml
+++ b/templates/mesh-gateway-deployment.yaml
@@ -370,10 +370,10 @@ spec:
             - -log-level={{ .Values.global.logLevel }}
             - -log-json={{ .Values.global.logJSON }}
             - -service-config=/consul/service/service.hcl
+            - -consul-binary=/consul-bin/consul
             {{- if .Values.global.acls.manageSystemACLs }}
             - -token-file=/consul/service/acl-token
             {{- end }}
-            - -consul-binary=/consul-bin/consul
       {{- if .Values.meshGateway.priorityClassName }}
       priorityClassName: {{ .Values.meshGateway.priorityClassName | quote }}
       {{- end }}
diff --git a/templates/server-acl-init-cleanup-job.yaml b/templates/server-acl-init-cleanup-job.yaml
index 4d27c9d18..c5c901f25 100644
--- a/templates/server-acl-init-cleanup-job.yaml
+++ b/templates/server-acl-init-cleanup-job.yaml
@@ -47,14 +47,13 @@ spec:
         - name: server-acl-init-cleanup
           image: {{ .Values.global.imageK8S }}
           command:
-            - "/bin/sh"
-            - "-ec"
-            - |
-                consul-k8s delete-completed-job \
-                  -log-level={{ .Values.global.logLevel }} \
-                  -log-json={{ .Values.global.logJSON }} \
-                  -k8s-namespace={{ .Release.Namespace }} \
-                  {{ template "consul.fullname" . }}-server-acl-init
+            - consul-k8s
+          args:
+            - delete-completed-job
+            - -log-level={{ .Values.global.logLevel }}
+            - -log-json={{ .Values.global.logJSON }}
+            - -k8s-namespace={{ .Release.Namespace }}
+            - {{ template "consul.fullname" . }}-server-acl-init
           resources:
             requests:
               memory: "50Mi"
diff --git a/templates/sync-catalog-deployment.yaml b/templates/sync-catalog-deployment.yaml
index 9d34a941e..43792e2d8 100644
--- a/templates/sync-catalog-deployment.yaml
+++ b/templates/sync-catalog-deployment.yaml
@@ -113,11 +113,7 @@ spec:
             - "-ec"
             - |
               consul-k8s sync-catalog \
-                {{- if .Values.syncCatalog.logLevel }}
-                -log-level={{ .Values.syncCatalog.logLevel }} \
-                {{- else }}
-                -log-level={{ .Values.global.logLevel }} \
-                {{- end }}
+                -log-level={{ default .Values.global.logLevel .Values.syncCatalog.logLevel }} \
                 -log-json={{ .Values.global.logJSON }} \
                 -k8s-default-sync={{ .Values.syncCatalog.default }} \
                 {{- if (not .Values.syncCatalog.toConsul) }}
diff --git a/templates/terminating-gateways-deployment.yaml b/templates/terminating-gateways-deployment.yaml
index 013f5266f..1a685730f 100644
--- a/templates/terminating-gateways-deployment.yaml
+++ b/templates/terminating-gateways-deployment.yaml
@@ -365,17 +365,15 @@ spec:
               value: http://$(HOST_IP):8500
             {{- end }}
           command:
-            - "/bin/sh"
-            - "-ec"
-            - |
-                consul-k8s consul-sidecar \
-                  -log-level={{ $root.Values.global.logLevel }} \
-                  -log-json={{ $root.Values.global.logJSON }} \
-                  -service-config=/consul/service/service.hcl \
-                  {{- if $root.Values.global.acls.manageSystemACLs }}
-                  -token-file=/consul/service/acl-token \
-                  {{- end }}
-                  -consul-binary=/consul-bin/consul
+            - consul-k8s
+            - consul-sidecar
+            - -log-level={{ $root.Values.global.logLevel }}
+            - -log-json={{ $root.Values.global.logJSON }}
+            - -service-config=/consul/service/service.hcl
+            - -consul-binary=/consul-bin/consul
+            {{- if $root.Values.global.acls.manageSystemACLs }}
+            - -token-file=/consul/service/acl-token
+            {{- end }}
       {{- if (default $defaults.priorityClassName .priorityClassName) }}
       priorityClassName: {{ (default $defaults.priorityClassName .priorityClassName) | quote }}
       {{- end }}
diff --git a/test/unit/server-acl-init-cleanup-job.bats b/test/unit/server-acl-init-cleanup-job.bats
index 409bf370a..8b885ba03 100644
--- a/test/unit/server-acl-init-cleanup-job.bats
+++ b/test/unit/server-acl-init-cleanup-job.bats
@@ -54,13 +54,8 @@ load _helpers
       -s templates/server-acl-init-cleanup-job.yaml  \
       --set 'global.acls.manageSystemACLs=true' \
       . | tee /dev/stderr |
-      yq -r '.spec.template.spec.containers[0].command[2]' | tee /dev/stderr)
-  exp='consul-k8s delete-completed-job \
-  -log-level=info \
-  -log-json=false \
-  -k8s-namespace=default \
-  RELEASE-NAME-consul-server-acl-init'
-  [ "${actual}" = "${exp}" ]
+       yq -c '.spec.template.spec.containers[0].args' | tee /dev/stderr)
+       [ "${actual}" = '["delete-completed-job","-log-level=info","-log-json=false","-k8s-namespace=default","RELEASE-NAME-consul-server-acl-init"]' ]
 }
 
 @test "serverACLInitCleanup/Job: enabled with externalServers.enabled=true and global.acls.manageSystemACLs=true, but server.enabled set to false" {

From 5447edb30801f9f00b6dcd8e9ef2d69b5d8ae5f0 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Tue, 29 Jun 2021 14:03:15 -0700
Subject: [PATCH 10/12] use consul-k8s:latest

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index ac013549e..00b5a0d2e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -55,7 +55,7 @@ commands:
         type: string
       consul-k8s-image:
         type: string
-        default: "kschoche/consul-k8s-dev-logging"
+        default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s:latest"
     steps:
       - when:
           condition: << parameters.failfast >>

From 8ac900490a651a0db818b8b1bdaf663d2618c162 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Tue, 29 Jun 2021 15:25:44 -0700
Subject: [PATCH 11/12] update image

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 00b5a0d2e..c5189cdd7 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -55,7 +55,7 @@ commands:
         type: string
       consul-k8s-image:
         type: string
-        default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s:latest"
+        default: "kschoche/consul-k8s-logging"
     steps:
       - when:
           condition: << parameters.failfast >>

From 1a7fec29660520497bd7850b83c885df118b3a05 Mon Sep 17 00:00:00 2001
From: Kyle Schochenmaier <kschoche@gmail.com>
Date: Tue, 29 Jun 2021 16:08:24 -0700
Subject: [PATCH 12/12] try this again

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index c5189cdd7..00b5a0d2e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -55,7 +55,7 @@ commands:
         type: string
       consul-k8s-image:
         type: string
-        default: "kschoche/consul-k8s-logging"
+        default: "docker.mirror.hashicorp.services/hashicorpdev/consul-k8s:latest"
     steps:
       - when:
           condition: << parameters.failfast >>