deployment.yaml

{{ $hasKerberos := false  }}
{{ if .Values.kerberos  }}

{{ if .Values.kerberos.enabled  }}
{{ $hasKerberos = true }}
{{ else }}
{{ $hasKerberos = false }}
{{ end }}

{{ else }}
{{ $hasKerberos = false }}
{{ end }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: openunison-{{ .Release.Name }}
    app.kubernetes.io/name: openunison
    app.kubernetes.io/instance: openunison-{{ .Release.Name }}
    app.kubernetes.io/component: application
    app.kubernetes.io/part-of: openunison
  name: openunison-{{ .Release.Name }}
  namespace: {{ .Release.Namespace }}
  annotations:
    argocd.argoproj.io/sync-wave: "30"
spec:
  progressDeadlineSeconds: 600
  replicas: {{ .Values.openunison.replicas }}
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      application: openunison-{{ .Release.Name }}
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        application: openunison-{{ .Release.Name }}
        app: openunison-{{ .Release.Name }}
        app.kubernetes.io/name: openunison
        app.kubernetes.io/instance: openunison-{{ .Release.Name }}
        app.kubernetes.io/component: application
        app.kubernetes.io/part-of: openunison
    spec:
      {{ if .Values.network.enableHostNetwork }}
      hostNetwork: true
      {{ else }}
      hostNetwork: false
      {{ end }}

      containers:
      - env:
        {{ if $hasKerberos }}
        - name: JAVA_OPTS
          value: "-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -DunisonEnvironmentFile=/etc/openunison/ou.env -Djavax.net.ssl.trustStore=/etc/openunison/cacerts.jks -Dpolyglot.engine.WarnInterpreterOnly=false -Djava.security.krb5.conf=/etc/krb5-local/krb5.conf -Djava.security.krb5.debug=true -Djava.security.auth.login.config=/etc/krb5-local/SQLJDBCDriver.conf"
        {{ else }}
        - name: JAVA_OPTS
          value: "-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -DunisonEnvironmentFile=/etc/openunison/ou.env -Djavax.net.ssl.trustStore=/etc/openunison/cacerts.jks -Dpolyglot.engine.WarnInterpreterOnly=false"
        {{ end }}
        - name: fortriggerupdates
          value: changeme
        {{ if $hasKerberos }}
        - name: KRB5_CONFIG
          value: /etc/krb5-local/krb5.conf
        - name: KRB5RCACHEDIR
          value: /dev/shm
        - name: KRB5CCNAME
          value: /dev/shm/ccache
        {{ end }}
        {{ if .Values.openunison.env }}
        {{ range $k,$v := .Values.openunison.env }}
        - name: {{ $k }}
          value: "{{ $v }}"
        {{ end }}
        {{ end }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - "ALL"
          {{ if .Capabilities.APIVersions.Has "project.openshift.io/v1/Project" }}
          runAsNonRoot: true
          {{ else }}
          seccompProfile:
            type: RuntimeDefault
          runAsNonRoot: true
          runAsUser: 431
          runAsGroup: 433
          {{ end }}
        image: {{ .Values.image }}
        imagePullPolicy: {{ .Values.openunison.imagePullPolicy }}
        livenessProbe:
          exec:
            command:
            {{ if .Values.services.liveness_probe }}
            {{ range $line := .Values.services.liveness_probe }}
            - {{ $line }}
            {{ end }}
            {{ else }}
            - /usr/local/openunison/bin/check_alive.sh
            - "https://127.0.0.1:8443/auth/idp/k8sIdp/.well-known/openid-configuration"
            - "issuer"
            - "https://127.0.0.1:8443/check_alive"
            - "alive"
            {{ end }}
          failureThreshold: 10
          initialDelaySeconds: 30
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 10
        name: openunison-{{ .Release.Name }}
        ports:
        - containerPort: 8080
          name: http
          protocol: TCP
        - containerPort: 8443
          name: https
          protocol: TCP
        readinessProbe:
          exec:
            command:
            {{ if .Values.services.readiness_probe }}
            {{ range $line := .Values.services.readiness_probe }}
            - {{ $line }}
            {{ end }}
            {{ else }}
            - /usr/local/openunison/bin/check_alive.sh
            - "https://127.0.0.1:8443/auth/idp/k8sIdp/.well-known/openid-configuration"
            - "issuer"
            - "https://127.0.0.1:8443/check_alive"
            - "alive"
            {{ end }}
          failureThreshold: 3
          initialDelaySeconds: 15
          periodSeconds: 10
          successThreshold: 1
          timeoutSeconds: 10
        {{ if .Values.services.resources }}
        resources:
          {{ if .Values.services.resources.requests }}
          requests: 
            {{ if .Values.services.resources.requests.memory }}
            memory: {{ .Values.services.resources.requests.memory | quote }}
            {{ end }}
            
            {{ if .Values.services.resources.requests.cpu }}
            cpu: {{ .Values.services.resources.requests.cpu | quote }}
            {{ end }}
          
          {{ end }}

          {{ if .Values.services.resources.limits }}
          limits: 
            {{ if .Values.services.resources.limits.memory }}
            memory: {{ .Values.services.resources.limits.memory | quote }}
            {{ end }}
            
            {{ if .Values.services.resources.limits.cpu }}
            cpu: {{ .Values.services.resources.limits.cpu | quote }}
            {{ end }}
          
          {{ end }}
        {{ end }}
        terminationMessagePath: "/dev/termination-log"
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: "/usr/local/openunison/.config"
          name: local-config
        - mountPath: "/etc/openunison"
          name: secret-volume
          readOnly: true
        {{ if .Values.saml }}
        {{ if .Values.saml.metadata_xml_b64 }}
        - mountPath: "/etc/saml2"
          name: "saml2-metadata"
          readOnly: true
        {{ end }}
        {{ end }}
        {{ if .Values.myvd_configmap }}
        - mountPath: "/etc/myvd"
          name: "myvd-volume"
          readOnly: true
        {{ end }}
        {{ if .Values.services.enable_tokenrequest | default false }}
        - mountPath: /var/run/secrets/tokens
          name: ou-token
        {{ end }}
        {{ if .Values.openunison.html.logosConfigMap }}
        - mountPath: /usr/local/openunison/work/webapp/auth/forms/logos
          name: custom-logos
          readOnly: true
        - mountPath: /usr/local/openunison/work/webapp/auth/forms/images
          name: custom-logos-2
          readOnly: true
        {{ end }}
        {{ if .Values.openunison.debugConfigMap }}
        - mountPath: /usr/local/openunison/work/webapp/WEB-INF/classes
          name: custom-debug
          readOnly: true
        {{ end }}
        {{ if $hasKerberos }}
        - mountPath: /etc/krb5-local
          name: krb
          readOnly: true
        {{ end }}
      {{ if $hasKerberos }}
      - image: {{ .Values.kerberos.sidecar_image }}
        name: krb-sidecar
        {{ if not .Values.kerberos.keytab }}
        command:
          - /reinit-pwd.sh
        {{ end }}
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - "ALL"
          {{ if .Capabilities.APIVersions.Has "project.openshift.io/v1/Project" }}
          runAsNonRoot: true
          {{ else }}
          seccompProfile:
            type: RuntimeDefault
          runAsNonRoot: true
          runAsUser: 431
          runAsGroup: 433
          {{ end }}
        env:
        - name: KRB5CCNAME
          value: /dev/shm/ccache
        - name: KRB5_CONFIG
          value: /etc/krb5-local/krb5.conf
        - name: REKINIT_PERIOD
          value: "3600"
        - name: SECRETS
          value: /etc/krb5-keytabs
        {{ if .Values.kerberos.keytab }}
        - name: KEYTAB
          value: {{ .Values.kerberos.keytab }}
        {{ end }}
        - name: PRINCIPAL
          value: {{ .Values.kerberos.principal }}
        - name: KRB5RCACHEDIR
          value: /dev/shm
        volumeMounts:
          - mountPath: /etc/krb5-local
            name: krb
            readOnly: true
          - mountPath: /etc/krb5-keytabs
            name: krb-keytab
            readOnly: true
      {{ end }}  
      automountServiceAccountToken: {{ not (.Values.services.enable_tokenrequest | default false) }}
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      serviceAccount: openunison-{{ .Release.Name }}
      {{ if .Capabilities.APIVersions.Has "project.openshift.io/v1/Project" }}
      securityContext:
        runAsNonRoot: true
      {{ else }}
      securityContext:
        fsGroup: 433
        supplementalGroups: [433]
        seccompProfile:
          type: RuntimeDefault
        runAsNonRoot: true
        runAsUser: 431
        runAsGroup: 433
      {{ end }}
      volumes:
      - name: local-config
        emptyDir: {}
      - name: secret-volume
        secret:
          defaultMode: 420
          secretName: {{ .Release.Name }}
      {{ if .Values.saml }}
      {{ if .Values.saml.metadata_xml_b64 }}
      - name: saml2-metadata
        configMap:
          name: saml2-metadata
      {{ end }}
      {{ end }}
      {{ if .Values.myvd_configmap }}
      - name: myvd-volume
        configMap:
          name: {{ .Values.myvd_configmap | quote }}
      {{ end }}
      {{ if .Values.services.enable_tokenrequest | default false }}
      - name: ou-token
        projected:
          defaultMode: 420
          sources:
          - serviceAccountToken:
              audience: {{ .Values.services.token_request_audience | default "https://kubernetes.default.svc.cluster.local" }}
              expirationSeconds: {{ .Values.services.token_request_expiration_seconds | default 60000 }}
              path: "ou-token"
          - configMap:
              items:
              - key: "ca.crt"
                path: "ca.crt"
              name: "kube-root-ca.crt"
      {{ end }}
      {{ if .Values.openunison.html.logosConfigMap }}
      - name: custom-logos
        configMap:
          name: {{ .Values.openunison.html.logosConfigMap | quote }}
      - name: custom-logos-2
        configMap:
          name: {{ .Values.openunison.html.logosConfigMap | quote }}
      {{ end }}
      {{ if .Values.openunison.debugConfigMap }}
      - name: custom-debug
        configMap:
          name: {{ .Values.openunison.debugConfigMap | quote }}
      {{ end }}
      {{ if $hasKerberos }}
      - name: krb
        configMap:
          name: kerb-config
      - name: krb-keytab
        secret:
          secretName: kerb-keytab{{ .Values.openunison.secret_ext }}
      {{ end }}
      {{- if .Values.services.tolerations }}
      tolerations:
      {{- range .Values.services.tolerations }}
      - {{- if .key }}
        key: {{ .key }}
        {{- end }}
        {{- if .effect }}
        effect: {{ .effect }}
        {{- end }}
        {{- if .operator }}
        operator: {{ .operator }}
        {{- end }}
        {{- if .value }}
        value: {{ .value }}
        {{- end }}
      {{- end }}
      {{- end }}
      {{ $length := len .Values.services.node_selectors }}
      {{ if eq $length 0  }}
      nodeSelector: {}
      {{ else }}
      nodeSelector: {{ range $key,$value := .Values.services.node_selectors }}
        {{ $key }}: {{ $value | quote }}
      {{ end }}
      {{ end }}
      {{ if .Values.services.pullSecret }}
      imagePullSecrets:
      - name: {{  .Values.services.pullSecret | quote }}
      {{ end }}