controller-deployment.yaml

{{- if .Values.controller.enabled }}
{{- if and .Values.global.adminPartitions.enabled (not .Values.global.enableConsulNamespaces) }}{{ fail "global.enableConsulNamespaces must be true if global.adminPartitions.enabled=true" }}{{ end }}
{{ template "consul.validateVaultWebhookCertConfiguration" . }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "consul.fullname" . }}-controller
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "consul.name" . }}
    chart: {{ template "consul.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
    component: controller
spec:
  replicas: {{ .Values.controller.replicas }}
  selector:
    matchLabels:
      app: {{ template "consul.name" . }}
      chart: {{ template "consul.chart" . }}
      heritage: {{ .Release.Service }}
      release: {{ .Release.Name }}
      component: controller
  template:
    metadata:
      labels:
        app: {{ template "consul.name" . }}
        chart: {{ template "consul.chart" . }}
        heritage: {{ .Release.Service }}
        release: {{ .Release.Name }}
        component: controller
      annotations:
        "consul.hashicorp.com/connect-inject": "false"
        {{- if (and .Values.global.secretsBackend.vault.enabled .Values.global.tls.enabled) }}
        "vault.hashicorp.com/agent-init-first": "true"
        "vault.hashicorp.com/agent-inject": "true"
        {{- if .Values.global.secretsBackend.vault.controllerRole }}
        "vault.hashicorp.com/role": {{ .Values.global.secretsBackend.vault.controllerRole }}
        {{ else }}
        "vault.hashicorp.com/role": {{ .Values.global.secretsBackend.vault.consulCARole }}
        {{ end }}
        "vault.hashicorp.com/agent-inject-secret-serverca.crt": {{ .Values.global.tls.caCert.secretName }}
        "vault.hashicorp.com/agent-inject-template-serverca.crt": {{ template "consul.serverTLSCATemplate" . }}
        {{- if .Values.global.secretsBackend.vault.controller.caCert.secretName }}
        {{- with .Values.global.secretsBackend.vault.controller.caCert }}
        "vault.hashicorp.com/agent-inject-secret-ca.crt": {{ .secretName }}
        "vault.hashicorp.com/agent-inject-template-ca.crt": {{ template "consul.vaultCATemplate" . }}
        "vault.hashicorp.com/secret-volume-path-ca.crt": "/vault/secrets/controller-webhook/certs"
        {{- end }}
        {{- end }}
        {{- if .Values.global.secretsBackend.vault.controller.tlsCert.secretName }}
        "vault.hashicorp.com/agent-inject-secret-tls.crt": {{ .Values.global.secretsBackend.vault.controller.tlsCert.secretName }}
        "vault.hashicorp.com/agent-inject-template-tls.crt": {{ include "consul.controllerWebhookTLSCertTemplate" . }}
        "vault.hashicorp.com/secret-volume-path-tls.crt": "/vault/secrets/controller-webhook/certs"
        "vault.hashicorp.com/agent-inject-secret-tls.key": {{ .Values.global.secretsBackend.vault.controller.tlsCert.secretName }}
        "vault.hashicorp.com/agent-inject-template-tls.key": {{ include "consul.controllerWebhookTLSKeyTemplate" . }}
        "vault.hashicorp.com/secret-volume-path-tls.key": "/vault/secrets/controller-webhook/certs"
        {{- end }}
        {{- if and .Values.global.secretsBackend.vault.ca.secretName .Values.global.secretsBackend.vault.ca.secretKey }}
        "vault.hashicorp.com/agent-extra-secret": "{{ .Values.global.secretsBackend.vault.ca.secretName }}"
        "vault.hashicorp.com/ca-cert": "/vault/custom/{{ .Values.global.secretsBackend.vault.ca.secretKey }}"
        {{- end }}
        {{- if .Values.global.secretsBackend.vault.agentAnnotations }}
        {{ tpl .Values.global.secretsBackend.vault.agentAnnotations . | nindent 8 | trim }}
        {{- end }}
        {{- end }}
    spec:
      {{- if or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
      initContainers:
      {{- if and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt }}
      {{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
      {{- end }}
      {{- if .Values.global.acls.manageSystemACLs }}
      - name: controller-acl-init
        env:
          - name: HOST_IP
            valueFrom:
              fieldRef:
                fieldPath: status.hostIP
          {{- if .Values.global.tls.enabled }}
          - name: CONSUL_CACERT
            value: /consul/tls/ca/tls.crt
          {{- end }}
          - name: CONSUL_HTTP_ADDR
            {{- if .Values.global.tls.enabled }}
            value: https://$(HOST_IP):8501
            {{- else }}
            value: http://$(HOST_IP):8500
            {{- end }}
        image: {{ .Values.global.imageK8S }}
        volumeMounts:
        - mountPath: /consul/login
          name: consul-data
          readOnly: false
        {{- if .Values.global.tls.enabled }}
        {{- if .Values.global.tls.enableAutoEncrypt }}
        - name: consul-auto-encrypt-ca-cert
        {{- else }}
        - name: consul-ca-cert
        {{- end }}
          mountPath: /consul/tls/ca
          readOnly: true
        {{- end }}
        command:
          - "/bin/sh"
          - "-ec"
          - |
            consul-k8s-control-plane acl-init \
              -component-name=controller \
              {{- if and .Values.global.federation.enabled .Values.global.federation.primaryDatacenter }}
              -acl-auth-method={{ template "consul.fullname" . }}-k8s-component-auth-method-{{ .Values.global.datacenter }} \
              -primary-datacenter={{ .Values.global.federation.primaryDatacenter }} \
              {{- else }}
              -acl-auth-method={{ template "consul.fullname" . }}-k8s-component-auth-method \
              {{- end }}
              {{- if .Values.global.adminPartitions.enabled }}
              -partition={{ .Values.global.adminPartitions.name }} \
              {{- end }}
              -consul-api-timeout={{ .Values.global.consulAPITimeout }} \
              -log-level={{ default .Values.global.logLevel .Values.controller.logLevel }} \
              -log-json={{ .Values.global.logJSON }}
        resources:
          requests:
            memory: "25Mi"
            cpu: "50m"
          limits:
            memory: "25Mi"
            cpu: "50m"
      {{- end }}
      {{- end }}
      containers:
      - command:
        - "/bin/sh"
        - "-ec"
        - |
          consul-k8s-control-plane controller \
            -consul-api-timeout={{ .Values.global.consulAPITimeout }} \
            -log-level={{ default .Values.global.logLevel .Values.controller.logLevel }} \
            -log-json={{ .Values.global.logJSON }} \
            -resource-prefix={{ template "consul.fullname" . }} \
            {{- if and .Values.global.secretsBackend.vault.enabled .Values.global.secretsBackend.vault.controller.tlsCert.secretName }}
            -enable-webhook-ca-update \
            -webhook-tls-cert-dir=/vault/secrets/controller-webhook/certs \
            {{- else }}
            -webhook-tls-cert-dir=/tmp/controller-webhook/certs \
            {{- end }}
            -datacenter={{ .Values.global.datacenter }} \
            {{- if .Values.global.adminPartitions.enabled }}
            -partition={{ .Values.global.adminPartitions.name }} \
            {{- end }}
            -enable-leader-election \
            {{- if .Values.global.enableConsulNamespaces }}
            -enable-namespaces=true \
            {{- if .Values.connectInject.consulNamespaces.consulDestinationNamespace }}
            -consul-destination-namespace={{ .Values.connectInject.consulNamespaces.consulDestinationNamespace }} \
            {{- end }}
            {{- if .Values.connectInject.consulNamespaces.mirroringK8S }}
            -enable-k8s-namespace-mirroring=true \
            {{- if .Values.connectInject.consulNamespaces.mirroringK8SPrefix }}
            -k8s-namespace-mirroring-prefix={{ .Values.connectInject.consulNamespaces.mirroringK8SPrefix }} \
            {{- end }}
            {{- end }}
            {{- if .Values.global.acls.manageSystemACLs }}
            -consul-cross-namespace-acl-policy=cross-namespace-policy \
            {{- end }}
            {{- end }}
        {{- if .Values.global.acls.manageSystemACLs }}
        lifecycle:
          preStop:
            exec:
              command:
                - "/bin/sh"
                - "-ec"
                - |
                  consul-k8s-control-plane consul-logout -consul-api-timeout={{ .Values.global.consulAPITimeout }}
        {{- end }}
        env:
        {{- if .Values.global.acls.manageSystemACLs }}
        - name: CONSUL_HTTP_TOKEN_FILE
          value: "/consul/login/acl-token"
        {{- end }}
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        {{- if (and .Values.controller.aclToken.secretName .Values.controller.aclToken.secretKey) }}
        - name: CONSUL_HTTP_TOKEN
          valueFrom:
            secretKeyRef:
              name: {{ .Values.controller.aclToken.secretName }}
              key: {{ .Values.controller.aclToken.secretKey }}
        {{- end }}
        {{- if .Values.global.tls.enabled }}
        - name: CONSUL_CACERT
          value: /consul/tls/ca/tls.crt
        {{- end }}
        - name: CONSUL_HTTP_ADDR
          {{- if .Values.global.tls.enabled }}
          value: https://$(HOST_IP):8501
          {{- else }}
          value: http://$(HOST_IP):8500
          {{- end }}
        image: {{ .Values.global.imageK8S }}
        name: controller
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        {{- with .Values.controller.resources }}
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
        volumeMounts:
        - mountPath: /consul/login
          name: consul-data
          readOnly: true
        {{- if not (and .Values.global.secretsBackend.vault.enabled .Values.global.secretsBackend.vault.controller.tlsCert.secretName) }}
        - mountPath: /tmp/controller-webhook/certs
          name: cert
          readOnly: true
        {{- end }}
        {{- if .Values.global.tls.enabled }}
        {{- if .Values.global.tls.enableAutoEncrypt }}
        - name: consul-auto-encrypt-ca-cert
        {{- else }}
        - name: consul-ca-cert
        {{- end }}
          mountPath: /consul/tls/ca
          readOnly: true
        {{- end }}
      terminationGracePeriodSeconds: 10
      volumes:
      {{- if not (and .Values.global.secretsBackend.vault.enabled .Values.global.secretsBackend.vault.controller.tlsCert.secretName) }}
      - name: cert
        secret:
          defaultMode: 420
          secretName: {{ template "consul.fullname" . }}-controller-webhook-cert
      {{- end }}
      {{- if .Values.global.tls.enabled }}
      {{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
      - name: consul-ca-cert
        secret:
          {{- if .Values.global.tls.caCert.secretName }}
          secretName: {{ .Values.global.tls.caCert.secretName }}
          {{- else }}
          secretName: {{ template "consul.fullname" . }}-ca-cert
          {{- end }}
          items:
            - key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
              path: tls.crt
      {{- end }}
      {{- if .Values.global.tls.enableAutoEncrypt }}
      - name: consul-auto-encrypt-ca-cert
        emptyDir:
          medium: "Memory"
      {{- end }}
      {{- end }}
      - name: consul-data
        emptyDir:
          medium: "Memory"
      serviceAccountName: {{ template "consul.fullname" . }}-controller
      {{- if .Values.controller.nodeSelector }}
      nodeSelector:
        {{ tpl .Values.controller.nodeSelector . | indent 8 | trim }}
      {{- end }}
      {{- if .Values.controller.affinity }}
      affinity:
        {{ tpl .Values.controller.affinity . | indent 8 | trim }}
      {{- end }}
      {{- if .Values.controller.tolerations }}
      tolerations:
        {{ tpl .Values.controller.tolerations . | indent 8 | trim }}
      {{- end }}
      {{- if .Values.controller.priorityClassName }}
      priorityClassName: {{ .Values.controller.priorityClassName | quote }}
      {{- end }}
{{- end }}