controller-deployment.yaml

{{- if .Values.controller.enabled }}
apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ template "consul.fullname" . }}-controller
  labels:
    app: {{ template "consul.name" . }}
    chart: {{ template "consul.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
    component: controller
spec:
  replicas: {{ .Values.controller.replicas }}
  selector:
    matchLabels:
      app: {{ template "consul.name" . }}
      chart: {{ template "consul.chart" . }}
      heritage: {{ .Release.Service }}
      release: {{ .Release.Name }}
      component: controller
  template:
    metadata:
      labels:
        app: {{ template "consul.name" . }}
        chart: {{ template "consul.chart" . }}
        heritage: {{ .Release.Service }}
        release: {{ .Release.Name }}
        component: controller
      annotations:
        "consul.hashicorp.com/connect-inject": "false"
    spec:
      {{- if or .Values.global.acls.manageSystemACLs (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
      initContainers:
      {{- if .Values.global.acls.manageSystemACLs }}
      - name: controller-acl-init
        image: {{ .Values.global.imageK8S }}
        command:
          - "/bin/sh"
          - "-ec"
          - |
            consul-k8s acl-init \
              -secret-name="{{ template "consul.fullname" . }}-controller-acl-token" \
              -k8s-namespace={{ .Release.Namespace }}
        resources:
          requests:
            memory: "25Mi"
            cpu: "50m"
          limits:
            memory: "25Mi"
            cpu: "50m"
      {{- end }}
      {{- if (and .Values.global.tls.enabled .Values.global.tls.enableAutoEncrypt) }}
      {{- include "consul.getAutoEncryptClientCA" . | nindent 6 }}
      {{- end }}
      {{- end }}
      containers:
      - command:
        - "/bin/sh"
        - "-ec"
        - |
          consul-k8s controller \
            -log-level={{ default .Values.global.logLevel .Values.controller.logLevel }} \
            -log-json={{ .Values.global.logJSON }} \
            -webhook-tls-cert-dir=/tmp/controller-webhook/certs \
            -datacenter={{ .Values.global.datacenter }} \
            -enable-leader-election \
            {{- if .Values.global.enableConsulNamespaces }}
            -enable-namespaces=true \
            {{- if .Values.connectInject.consulNamespaces.consulDestinationNamespace }}
            -consul-destination-namespace={{ .Values.connectInject.consulNamespaces.consulDestinationNamespace }} \
            {{- end }}
            {{- if .Values.connectInject.consulNamespaces.mirroringK8S }}
            -enable-k8s-namespace-mirroring=true \
            {{- if .Values.connectInject.consulNamespaces.mirroringK8SPrefix }}
            -k8s-namespace-mirroring-prefix={{ .Values.connectInject.consulNamespaces.mirroringK8SPrefix }} \
            {{- end }}
            {{- end }}
            {{- if .Values.global.acls.manageSystemACLs }}
            -consul-cross-namespace-acl-policy=cross-namespace-policy \
            {{- end }}
            {{- end }}
        env:
        - name: HOST_IP
          valueFrom:
            fieldRef:
              fieldPath: status.hostIP
        {{- if (and .Values.controller.aclToken.secretName .Values.controller.aclToken.secretKey) }}
        - name: CONSUL_HTTP_TOKEN
          valueFrom:
            secretKeyRef:
              name: {{ .Values.controller.aclToken.secretName }}
              key: {{ .Values.controller.aclToken.secretKey }}
        {{- end }}
        {{- if .Values.global.acls.manageSystemACLs }}
        - name: CONSUL_HTTP_TOKEN
          valueFrom:
            secretKeyRef:
              name: "{{ template "consul.fullname" . }}-controller-acl-token"
              key: "token"
        {{- end}}
        {{- if .Values.global.tls.enabled }}
        - name: CONSUL_CACERT
          value: /consul/tls/ca/tls.crt
        {{- end }}
        - name: CONSUL_HTTP_ADDR
          {{- if .Values.global.tls.enabled }}
          value: https://$(HOST_IP):8501
          {{- else }}
          value: http://$(HOST_IP):8500
          {{- end }}
        image: {{ .Values.global.imageK8S }}
        name: controller
        ports:
        - containerPort: 9443
          name: webhook-server
          protocol: TCP
        {{- with .Values.controller.resources }}
        resources:
          {{- toYaml . | nindent 12 }}
        {{- end }}
        volumeMounts:
        - mountPath: /tmp/controller-webhook/certs
          name: cert
          readOnly: true
        {{- if .Values.global.tls.enabled }}
        {{- if .Values.global.tls.enableAutoEncrypt }}
        - name: consul-auto-encrypt-ca-cert
        {{- else }}
        - name: consul-ca-cert
        {{- end }}
          mountPath: /consul/tls/ca
          readOnly: true
        {{- end }}
      terminationGracePeriodSeconds: 10
      volumes:
      - name: cert
        secret:
          defaultMode: 420
          secretName: {{ template "consul.fullname" . }}-controller-webhook-cert
      {{- if .Values.global.tls.enabled }}
      {{- if not (and .Values.externalServers.enabled .Values.externalServers.useSystemRoots) }}
      - name: consul-ca-cert
        secret:
          {{- if .Values.global.tls.caCert.secretName }}
          secretName: {{ .Values.global.tls.caCert.secretName }}
          {{- else }}
          secretName: {{ template "consul.fullname" . }}-ca-cert
          {{- end }}
          items:
            - key: {{ default "tls.crt" .Values.global.tls.caCert.secretKey }}
              path: tls.crt
      {{- end }}
      {{- if .Values.global.tls.enableAutoEncrypt }}
      - name: consul-auto-encrypt-ca-cert
        emptyDir:
          medium: "Memory"
      {{- end }}
      {{- end }}
      serviceAccountName: {{ template "consul.fullname" . }}-controller
      {{- if .Values.controller.nodeSelector }}
      nodeSelector:
        {{ tpl .Values.controller.nodeSelector . | indent 8 | trim }}
      {{- end }}
      {{- if .Values.controller.affinity }}
      affinity:
        {{ tpl .Values.controller.affinity . | indent 8 | trim }}
      {{- end }}
      {{- if .Values.controller.tolerations }}
      tolerations:
        {{ tpl .Values.controller.tolerations . | indent 8 | trim }}
      {{- end }}
      {{- if .Values.controller.priorityClassName }}
      priorityClassName: {{ .Values.controller.priorityClassName | quote }}
      {{- end }}
{{- end }}