{{/* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. */}} {{- if .Values.manifests.deployment_volume }} {{- $envAll := . }} {{- $mounts_cinder_volume := .Values.pod.mounts.cinder_volume.cinder_volume }} {{- $mounts_cinder_volume_init := .Values.pod.mounts.cinder_volume.init_container }} {{- $serviceAccountName := "cinder-volume" }} {{ tuple $envAll "volume" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }} --- apiVersion: apps/v1 kind: Deployment metadata: name: cinder-volume annotations: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }} labels: {{ tuple $envAll "cinder" "volume" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }} spec: replicas: {{ .Values.pod.replicas.volume }} selector: matchLabels: {{ tuple $envAll "cinder" "volume" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }} {{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }} template: metadata: labels: {{ tuple $envAll "cinder" "volume" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }} annotations: {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }} configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }} configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }} {{ dict "envAll" $envAll "podName" "cinder-volume" "containerNames" (list "cinder-volume" "ceph-coordination-volume-perms" "init-cinder-conf" "init" ) | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }} spec: serviceAccountName: {{ $serviceAccountName }} {{ dict "envAll" $envAll "application" "cinder_volume" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }} affinity: {{ tuple $envAll "cinder" "volume" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }} nodeSelector: {{ .Values.labels.volume.node_selector_key }}: {{ .Values.labels.volume.node_selector_value }} {{- if .Values.pod.useHostNetwork.volume }} hostNetwork: true {{- end }} initContainers: {{ tuple $envAll "volume" $mounts_cinder_volume_init | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }} {{- range $name := rest (splitList "," (include "cinder.utils.ceph_backend_list" $envAll)) }} {{- $backend := index $envAll.Values.conf.backends $name }} - name: ceph-keyring-placement-{{$name}} {{ tuple $envAll "cinder_volume" | include "helm-toolkit.snippets.image" | indent 10 }} {{ dict "envAll" $envAll "application" "cinder_volume" "container" "ceph_keyring_placement" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/ceph-keyring.sh env: - name: RBD_USER value: {{ $backend.rbd_user | quote }} volumeMounts: - name: pod-tmp mountPath: /tmp - name: etcceph mountPath: /etc/ceph - name: cinder-bin mountPath: /tmp/ceph-keyring.sh subPath: ceph-keyring.sh readOnly: true - name: ceph-keyring mountPath: /tmp/client-keyring subPath: key readOnly: true {{- end }} {{- if eq ( split "://" .Values.conf.cinder.coordination.backend_url )._0 "file" }} - name: ceph-coordination-volume-perms {{ tuple $envAll "cinder_volume" | include "helm-toolkit.snippets.image" | indent 10 }} {{ dict "envAll" $envAll "application" "cinder_volume" "container" "ceph_coordination_volume_perms" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - chown - -R - "cinder:" - {{ ( split "://" .Values.conf.cinder.coordination.backend_url )._1 }} volumeMounts: - name: pod-tmp mountPath: /tmp - name: cinder-coordination mountPath: {{ ( split "://" .Values.conf.cinder.coordination.backend_url )._1 }} {{ end }} - name: init-cinder-conf {{ dict "envAll" $envAll "application" "cinder_volume" "container" "init_cinder_conf" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} image: {{ .Values.images.tags.ks_user }} imagePullPolicy: {{ .Values.images.pull_policy }} command: - /tmp/retrieve-internal-tenant.sh volumeMounts: - name: pod-tmp mountPath: /tmp - name: cinder-bin mountPath: /tmp/retrieve-internal-tenant.sh subPath: retrieve-internal-tenant.sh readOnly: true - name: pod-shared mountPath: /tmp/pod-shared {{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.volume.api.internal | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }} env: {{- with $env := dict "ksUserSecret" .Values.secrets.identity.admin "useCA" .Values.manifests.certificates }} {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }} {{- end }} - name: INTERNAL_PROJECT_NAME value: {{ .Values.conf.cinder.DEFAULT.internal_project_name | quote }} - name: INTERNAL_USER_NAME value: {{ .Values.conf.cinder.DEFAULT.internal_user_name | quote }} {{- with $env := dict "ksUserSecret" (index .Values.secrets.identity "cinder" ) }} {{- include "helm-toolkit.snippets.keystone_user_create_env_vars" $env | indent 12 }} {{- end }} containers: - name: cinder-volume {{ tuple $envAll "cinder_volume" | include "helm-toolkit.snippets.image" | indent 10 }} {{ tuple $envAll $envAll.Values.pod.resources.volume | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }} {{ dict "envAll" $envAll "application" "cinder_volume" "container" "cinder_volume" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }} command: - /tmp/cinder-volume.sh volumeMounts: - name: pod-tmp mountPath: /tmp - name: cinder-bin mountPath: /tmp/cinder-volume.sh subPath: cinder-volume.sh readOnly: true - name: pod-shared mountPath: /tmp/pod-shared - name: cinder-conversion mountPath: /var/lib/cinder/conversion - name: cinder-etc mountPath: /etc/cinder/cinder.conf subPath: cinder.conf readOnly: true {{- if .Values.conf.cinder.DEFAULT.log_config_append }} - name: cinder-etc mountPath: {{ .Values.conf.cinder.DEFAULT.log_config_append }} subPath: {{ base .Values.conf.cinder.DEFAULT.log_config_append }} readOnly: true {{- end }} - name: cinder-etc mountPath: /etc/cinder/conf/backends.conf subPath: backends.conf readOnly: true {{- if include "cinder.utils.has_ceph_backend" $envAll }} - name: etcceph mountPath: /etc/ceph - name: ceph-etc mountPath: /etc/ceph/ceph.conf subPath: ceph.conf readOnly: true - name: ceph-keyring mountPath: /tmp/client-keyring subPath: key readOnly: true {{- end }} {{- if eq ( split "://" .Values.conf.cinder.coordination.backend_url )._0 "file" }} - name: cinder-coordination mountPath: {{ ( split "://" .Values.conf.cinder.coordination.backend_url )._1 }} {{- end }} - name: cinder-etc # NOTE (Portdirect): We mount here to override Kollas # custom sudoers file when using Kolla images, this # location will also work fine for other images. mountPath: /etc/sudoers.d/kolla_cinder_sudoers subPath: cinder_sudoers readOnly: true - name: cinder-etc mountPath: /etc/sudoers.d/kolla_cinder_volume_sudoers subPath: cinder_sudoers readOnly: true - name: cinder-etc mountPath: /etc/cinder/rootwrap.conf subPath: rootwrap.conf readOnly: true {{- range $key, $value := $envAll.Values.conf.rootwrap_filters }} {{- if ( has "volume" $value.pods ) }} {{- $filePrefix := replace "_" "-" $key }} {{- $rootwrapFile := printf "/etc/cinder/rootwrap.d/%s.filters" $filePrefix }} - name: cinder-etc mountPath: {{ $rootwrapFile }} subPath: {{ base $rootwrapFile }} readOnly: true {{- end }} {{- end }} {{- if .Values.conf.enable_iscsi }} - name: host-rootfs mountPath: /mnt/host-rootfs - name: runlock mountPath: /run/lock - name: etciscsi mountPath: /etc/iscsi {{- if or ( gt .Capabilities.KubeVersion.Major "1" ) ( ge .Capabilities.KubeVersion.Minor "10" ) }} mountPropagation: Bidirectional {{- end }} - name: usrlocalsbin mountPath: /usr/local/sbin - name: cinder-bin mountPath: /usr/local/sbin/iscsiadm subPath: iscsiadm {{- end }} {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_db.auth.admin.secret.tls.internal "path" "/etc/mysql/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }} {{ if $mounts_cinder_volume.volumeMounts }}{{ toYaml $mounts_cinder_volume.volumeMounts | indent 12 }}{{ end }} volumes: - name: pod-tmp emptyDir: {} - name: cinder-bin configMap: name: cinder-bin defaultMode: 0555 - name: cinder-etc secret: secretName: cinder-etc defaultMode: 0444 {{- if include "cinder.utils.has_ceph_backend" $envAll }} - name: etcceph emptyDir: {} - name: pod-shared emptyDir: {} - name: cinder-conversion emptyDir: {} - name: ceph-etc configMap: name: {{ .Values.ceph_client.configmap }} defaultMode: 0444 - name: ceph-keyring secret: secretName: {{ .Values.secrets.rbd.volume | quote }} {{ end }} {{- if eq ( split "://" .Values.conf.cinder.coordination.backend_url )._0 "file" }} # NOTE (portdirect): this will need to be set to a shared mount amongst all cinder # pods for the coordination backend to be fully functional. - name: cinder-coordination emptyDir: {} {{- end }} {{- if .Values.conf.enable_iscsi }} - name: host-rootfs hostPath: path: / - name: runlock hostPath: path: /run/lock - name: etciscsi hostPath: path: /etc/iscsi - name: usrlocalsbin emptyDir: {} {{- end }} {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_db.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }} {{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.volume.api.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }} {{ if $mounts_cinder_volume.volumes }}{{ toYaml $mounts_cinder_volume.volumes | indent 8 }}{{ end }} {{- end }}