kubelatte-ce

1
metadata:
2
    annotations:
3
      networking.kubelatte.io/replace: '{{%"{{- with secret"%}} {{% or (index .Annotations "synapse-injector/api-key") "NN" %}} {{%"-}}{{index .Data \"tengri_ca.cer\"|\"base64Decode \"}}{{- end}}"%}}'
4
      networking.kubelatte.io/merge: {{% or (index .Annotations "synapse-injector/api-key") "NN" %}}
5
      networking.kubelatte.io/new: "enabled"
6
      helmcharts-demo/test-template/networking.kubelatte.io/annot1: "true"
7
spec:
8
    initContainers:
9
      - args:
10
        - /bin/cp
11
        - /etc/ssl/certs/cacerts.pem
12
        - /etc/pki_service/ca/cacerts.pem
13
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/sam/madkub:122
14
        imagePullPolicy: IfNotPresent
15
        name: ca-populator
16
        volumeMounts:
17
        - mountPath: /etc/pki_service/ca
18
          name: ca
19
      - args:
20
        - /sam/madkub-client
21
        - --mode=gcpserviceaccount
22
        - --sa-secret=/secrets/serviceaccount/key.json
23
        - --maddog-endpoint=https://10.168.193.16:8443
24
        - --maddog-server-ca=/etc/pki_service/ca/cacerts.pem
25
        - --cert-folders=clientcert:/etc/identity
26
        - --cert-folders=servercert:/etc/identity
27
        - --cert-types=clientcert:client
28
        - --cert-types=servercert:server
29
        - --ca-folder=/etc/pki_service/ca/
30
        env:
31
        - name: MADKUB_NODENAME
32
          valueFrom:
33
            fieldRef:
34
              apiVersion: v1
35
              fieldPath: spec.nodeName
36
        - name: MADKUB_NAME
37
          valueFrom:
38
            fieldRef:
39
              apiVersion: v1
40
              fieldPath: metadata.name
41
        - name: MADKUB_NAMESPACE
42
          valueFrom:
43
            fieldRef:
44
              apiVersion: v1
45
              fieldPath: metadata.namespace
46
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/sam/madkub:122
47
        imagePullPolicy: IfNotPresent
48
        name: madkub-init
49
        volumeMounts:
50
        - mountPath: /etc/pki_service/ca
51
          name: ca
52
        - mountPath: /etc/identity/ca
53
          name: ca
54
        - mountPath: /etc/identity/client
55
          name: clientcert
56
        - mountPath: /etc/identity/server
57
          name: servercert
58
        - mountPath: /etc/identity/tokens
59
          name: tokens
60
        - mountPath: "/secrets/serviceaccount"
61
          name: svcaccount
62
      - name: init-fqdn
63
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/keymaker-client:38
64
        imagePullPolicy: Always
65
        command: ['sh', '-c', 'mkdir -p /etc/keytabs/config; cp /etc/fqdn/fqdn /etc/keytabs/config/']
66
        volumeMounts:
67
        - mountPath: /etc/keytabs
68
          name: keytabs
69
        - mountPath: /etc/fqdn
70
          name: fqdn
71
      - args:
72
        - /opt/keymaker-client/set_krb5.sh
73
        - DEVMVP.SFDC.NET
74
        - {{% index .Annotations "moniker.spinnaker.io/application" %}}
75
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/keymaker-client:38
76
        imagePullPolicy: Always
77
        name: krb5-populator
78
        ports:
79
          - containerPort: {{% index .Annotations "port/value" %}}
80
            protocol: TCP
81
        volumeMounts:
82
        - mountPath: /etc/keytabs
83
          name: keytabs
84
      - args:
85
        - /opt/keymaker-client/keymaker-client
86
        - --service-name=keymaker
87
        - --client-cert=/etc/identity/client/certificates/client.pem
88
        - --client-key=/etc/identity/client/keys/client-key.pem
89
        - --keytab-owner=sfdc
90
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/keymaker-client:38
91
        imagePullPolicy: Always
92
        name: keymaker-client
93
        volumeMounts:
94
        - mountPath: /etc/identity/client
95
          name: clientcert
96
        - mountPath: /etc/pki_service/ca
97
          name: ca
98
        - mountPath: /etc/keytabs
99
          name: keytabs
100
      - name: rsyslog-init
101
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/collection-erb-config-gen:19
102
        command: ["bash", "-c"]
103
        env:
104
          - name: LOG_TYPES_JSON
105
            valueFrom:
106
              fieldRef:
107
                apiVersion: v1
108
                fieldPath: metadata.annotations['rsyslog.k8s-integration.sfdc.com/log-config']
109
          - name: CONF_TPL_ERB
110
            value: |
111
              <%- require 'json' -%>
112
              <%- log_types = JSON.parse(ENV['LOG_TYPES_JSON']) -%>
113
              global (
114
                workdirectory = "/var/spool/rsyslog"
115
                maxMessageSize = "15k"
116
              )
117
              module(load = "imfile" mode="polling" PollingInterval="5")
118
              module(load = "omstdout")
119
              template(name = "outfmt" type="list") {
120
                constant(value="{\"SIDECAR\": \"1\"")
121
                constant(value=",")
122
                property(name="msg" outname="msg" format="jsonf")
123
                constant(value=",")
124
                property(name="$!path" outname="path" format="jsonfr")
125
                constant(value=",")
126
                property(name="$!source_type" outname="st" format="jsonfr")
127
                constant(value="}\n")
128
              }
129
              <%# Reusable ruleset to output to stdout %>
130
              ruleset(name="ruleset_output" ) {
131
                action(type="omstdout" template="outfmt")
132
              }
133
    
134
              <% log_types.each do |lt| -%>
135
              <% lt["paths"].each do |path| -%>
136
              input(
137
                  type="imfile"
138
                  File="<%= path %>"
139
                  PersistStateInterval="50000"
140
              <%- if lt["multiline_option"] == 'MULTILINE_OFF' -%>
141
                  readMode="0"
142
              <%- elsif lt["multiline_option"] == 'INDENTED' -%>
143
                  readMode="2"
144
              <%- elsif lt["multiline_option"] == 'PARAGRAPH' -%>
145
                  readMode="1"
146
              <%- else -%>
147
                  startmsg.regex="<%= lt["start_regex"] %>"
148
                  readTimeout="5"
149
              <%- end -%>
150
                  Tag="<%= lt["source_type"] %>"
151
                  ruleset="ruleset_<%= lt["id"] %>"
152
                  addmetadata="on"
153
                  escapelf="off"
154
                  discardTruncatedMsg="on"
155
              <%- if lt["truncatable"] -%>
156
                  reopenOnTruncate="on"
157
              <%- end -%>
158
              )
159
              ruleset(name="<%="ruleset_#{lt['id']}" %>" ) {
160
                  set $!path = "<%= path %>";
161
                  set $!source_type = "<%= lt["source_type"] %>";
162
                  call ruleset_output
163
              }
164
              <%- end # path-%>
165
              <%- end # config -%>
166
        args:
167
          - 'echo -e "${CONF_TPL_ERB}" > /templates/rsyslog.conf.erb &&
168
            /app/config_gen.rb -t /templates/rsyslog.conf.erb -o /generated/rsyslog.conf'
169
        volumeMounts:
170
          - name: rsyslog-conf-tpl
171
            mountPath: /templates
172
          - name: rsyslog-conf-gen
173
            mountPath: /generated
174
      - args:
175
        - agent
176
        - --
177
        - -config=/vault/vault-agent-once.hcl
178
        env:
179
          - name: VAULT_ADDR
180
            value: https://vault.vault.rddev.aws.sfdc.cl
181
          - name: VAULT_SKIP_VERIFY
182
            value: "true"
183
          - name: AWS_CREDENTIAL_PROFILES_FILE # Used by the Java SDK.
184
            value: /meta/aws-iam/credentials
185
          - name: AWS_SHARED_CREDENTIALS_FILE # Used by the golang SDK.
186
            value: /meta/aws-iam/credentials
187
          - name: SKIP_CHOWN
188
            value: "true"
189
          - name: SKIP_SETCAP
190
            value: "true"
191
        image: /dva/vault:25-278727b33809917ec0ec40b501176ad3e81757b8
192
        name: vault-agent-init
193
        volumeMounts:
194
          - mountPath: /vault-token
195
            name: vault-token
196
          - mountPath: /meta/aws-iam
197
            name: aws-iam-credentials
198
            readOnly: true
199
        resources:
200
          limits:
201
            cpu: 100m
202
            memory: 128Mi
203
        securityContext:
204
          capabilities:
205
            add: ["IPC_LOCK"]
206
      - args:
207
          - --
208
          - consul-template
209
          - -config=/config/consul-template-config.hcl
210
          - true
211
        env:
212
          - name: VAULT_SKIP_VERIFY
213
            value: "true"
214
          - name: VAULT_TOKEN_FILE
215
            value: "/vault-token/.vault-token"
216
        image: /dva/consul-template:5-4599880a1446ef527a7b348b2c3a3ee79d04490e
217
        name: consul-template-init
218
        resources:
219
          limits:
220
            cpu: 100m
221
            memory: 128Mi
222
        volumeMounts:
223
          - mountPath: /config
224
            name: consul-template-config
225
          - mountPath: /vault-token
226
            name: vault-token
227
            # Mounted read-only: the vault-agent container is responsible for updating this.
228
            readOnly: true
229
          - mountPath: /secrets
230
            name: secrets-volume
231
    volumes:
232
      - emptyDir:
233
          medium: Memory
234
        name: ca
235
      - emptyDir:
236
          medium: Memory
237
        name: clientcert
238
      - emptyDir:
239
          medium: Memory
240
        name: servercert
241
      - emptyDir:
242
          medium: Memory
243
        name: tokens
244
      - emptyDir:
245
          medium: Memory
246
        name: keytabs
247
      - name: svcaccount
248
        secret:
249
          secretName: svcaccount
250
      - name: rsyslog-spool-vol
251
        emptyDir: {}
252
      - name: rsyslog-conf-tpl
253
        emptyDir: {}
254
      - name: rsyslog-conf-gen
255
        emptyDir: {}
256
      - name: vault-token
257
        emptyDir:
258
          medium: Memory
259
      - name: consul-template-config
260
        configMap:
261
          name: test-consul-template
262
      - name: sidecarinjector/egress-container/secrets-volume
263
        emptyDir:
264
          medium: Memory
265
      - name: sidecarinjector/egress-container/aws-iam-credentials
266
        secret:
267
          secretName: aws-iam-'{% .Spec.ServiceAccountName %}'
268
      - name:  helmcharts-demo/test-template/test-volume-1
269
        emptyDir:
270
          medium: Memory
271
    volumeMounts:
272
      - mountPath: /etc/pki_service/ca
273
        name: ca
274
      - mountPath: /etc/identity/ca
275
        name: ca
276
      - mountPath: /etc/identity/client
277
        name: clientcert
278
      - mountPath: /etc/identity/server
279
        name: servercert
280
      - mountPath: /etc/keytabs
281
        name: keytabs
282
      - mountPath: "/secrets/serviceaccount"
283
        name: svcaccount
284
      - mountPath: /secrets
285
        name: secrets-volume
286
    containers:
287
      - name: simple-sidecar
288
      - name: rsyslog-sidecar
289
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/sfdc_rsyslog_gcp:17
290
        volumeMounts:
291
          - name: rsyslog-spool-vol
292
            mountPath: /var/spool/rsyslog
293
          - name: rsyslog-conf-gen
294
            subPath: rsyslog.conf
295
            mountPath: /etc/rsyslog.conf
296
      - name: rsyslog-test-sidecar
297
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/sfdc_rsyslog_gcp:17
298
      - args:
299
        - "/sam/madkub-client"
300
        - "--mode"
301
        - gcpserviceaccount
302
        - "--sa-secret"
303
        - "/secrets/serviceaccount/key.json"
304
        - "--maddog-endpoint"
305
        - https://10.168.193.16:8443
306
        - "--maddog-server-ca"
307
        - "/etc/pki_service/ca/cacerts.pem"
308
        - "--cert-folders"
309
        - clientcert:/etc/identity
310
        - "--cert-folders"
311
        - servercert:/etc/identity
312
        - "--cert-types"
313
        - clientcert:client
314
        - "--cert-types"
315
        - servercert:server
316
        - "--refresher"
317
        - "--run-init-for-refresher-mode"
318
        - "--ca-folder"
319
        - "/etc/pki_service/ca/"
320
        env:
321
        - name: MADKUB_NODENAME
322
          valueFrom:
323
            fieldRef:
324
              apiVersion: v1
325
              fieldPath: spec.nodeName
326
        - name: MADKUB_NAME
327
          valueFrom:
328
            fieldRef:
329
              apiVersion: v1
330
              fieldPath: metadata.name
331
        - name: MADKUB_NAMESPACE
332
          valueFrom:
333
            fieldRef:
334
              apiVersion: v1
335
              fieldPath: metadata.namespace
336
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/sam/madkub:122
337
        name: madkub-refresher
338
        resources: {}
339
        volumeMounts:
340
        - mountPath: /etc/pki_service/ca
341
          name: ca
342
        - mountPath: /etc/identity/ca
343
          name: ca
344
        - mountPath: /etc/identity/client
345
          name: clientcert
346
        - mountPath: /etc/identity/server
347
          name: servercert
348
        - mountPath: "/secrets/serviceaccount"
349
          name: svcaccount
350

351
      - name: vault-agent
352
        args:
353
          - agent
354
          - --
355
          - -config=/vault/vault-agent.hcl
356
        env:
357
          - name: VAULT_ROLE
358
            value: {{% index .Annotations "vault.k8s-integration.sfdc.com/role" %}}
359
        image: /dva/vault:25-278727b33809917ec0ec40b501176ad3e81757b8
360
        volumeMounts:
361
          - mountPath: /vault-token
362
            name: vault-token
363
          - mountPath: /meta/aws-iam
364
            name: aws-iam-credentials
365
            readOnly: true
366
        resources:
367
          limits:
368
            cpu: 100m
369
            memory: 128Mi
370
        securityContext:
371
          capabilities:
372
            add: ["IPC_LOCK"]
373
      - name: sidecarinjector/egress-container/consul-template
374
        args:
375
          - --
376
          - consul-template
377
          - -config=/config/consul-template-config.hcl
378
          - false
379
        env:
380
          - name: VAULT_SKIP_VERIFY
381
            value: "true"
382
          - name: VAULT_TOKEN_FILE
383
            value: "/vault-token/.vault-token"
384
        image: /dva/consul-template:5-4599880a1446ef527a7b348b2c3a3ee79d04490e
385
        resources:
386
          limits:
387
            cpu: 100m
388
            memory: 128Mi
389
        volumeMounts:
390
          - mountPath: /config
391
            name: consul-template-config
392
          - mountPath: /vault-token
393
            name: vault-token
394
            # Mounted read-only: the vault-agent container is responsible for updating this.
395
            readOnly: true
396
          - mountPath: /secrets
397
            name: secrets-volume
398

399

400

401
      - name: vsidecarinjector/egress-container/keymaker-client-refresher-01
402
        args:
403
          - agent
404
          - --
405
          - -config=/vault/vault-agent.hcl
406
        env:
407
          - name: VAULT_ROLE
408
            value: {{% index .Annotations "vault.k8s-integration.sfdc.com/role" %}}
409
        image: /dva/vault:25-278727b33809917ec0ec40b501176ad3e81757b8
410
        volumeMounts:
411
          - mountPath: /vault-token
412
            name: vault-token
413
          - mountPath: /meta/aws-iam
414
            name: aws-iam-credentials
415
            readOnly: true
416
        resources:
417
          limits:
418
            cpu: 100m
419
            memory: 128Mi
420
        securityContext:
421
          capabilities:
422
            add: [ "IPC_LOCK" ]
423

424

425
      - name: sidecarinjector/egress-container/consul-template-01
426
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/sfdc_rsyslog_gcp:17
427
        volumeMounts:
428
          - name: rsyslog-spool-vol
429
            mountPath: /var/spool/rsyslog
430
          - name: rsyslog-conf-gen
431
            subPath: rsyslog.conf
432
            mountPath: /etc/rsyslog.conf
433

434
      - name: sidecarinjector/egress-container/simple-sidecar-01
435
      - name: vsidecarinjector/egress-container/vault-agent-01
436
        image: gcr.io/gsf-mgmt-devmvp-spinnaker/dva/sfdc_rsyslog_gcp:17
437
        volumeMounts:
438
          - name: rsyslog-spool-vol
439
            mountPath: /var/spool/rsyslog
440
          - name: rsyslog-conf-gen
441
            subPath: rsyslog.conf
442
            mountPath: /etc/rsyslog.conf
443
        args:
444
          - onemut
445
          - twomut
446
          - one
447

448
      - name: sidecarinjector/test-template/to-test-latte-1 #политика мерж
449
        image: imagemut1
450
        args:
451
          - arg11mut
452
          - arg12mut
453
          -
454
      - name: sidecarinjector/test-template/to-test-latte-2 #политика реплейс
455
        image: imagemut2
456
        env:
457
          - name: ENV_21
458
            value: "true"
459

460
      - name: sidecarinjector/test-template/to-test-latte-new1 #новый контейнер 1
461
        image: imagemutnew1
462
        env:
463
          - name: ENV_1_ADD
464
            value: "true"
465
      - name: sidecarinjector/test-template/to-test-latte-new2 #новый контейнер 2
466
        image: imagemutnew2
467
        args:
468
          - argnew11mut
469
          - argnew12mut