deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ kiali_vars.deployment.instance_name }}
  namespace: {{ kiali_vars.deployment.namespace }}
  labels: {{ kiali_resource_metadata_labels }}
spec:
  replicas: {{ kiali_vars.deployment.replicas }}
  selector:
    matchLabels:
      app.kubernetes.io/name: kiali
      app.kubernetes.io/instance: {{ kiali_vars.deployment.instance_name }}
  template:
    metadata:
      name: {{ kiali_vars.deployment.instance_name }}
      labels: {{ kiali_resource_metadata_labels | combine(kiali_vars.deployment.pod_labels) }}
      annotations:
{% if kiali_vars.server.observability.metrics.enabled|bool == True %}
        prometheus.io/scrape: "true"
        prometheus.io/port: "{{ kiali_vars.server.observability.metrics.port }}"
{% else %}
        prometheus.io/scrape: "false"
        prometheus.io/port: null
{% endif %}
        kiali.io/dashboards: go,kiali
        operator.kiali.io/last-updated: "{{ deployment_last_updated }}"
{% if kiali_vars.deployment.pod_annotations|length > 0 %}
        {{ kiali_vars.deployment.pod_annotations | to_nice_yaml(indent=0) | trim | indent(8) }}
{% endif %}
    strategy:
      rollingUpdate:
        maxSurge: 1
        maxAvailable: 1
      type: RollingUpdate
    spec:
      serviceAccount: {{ kiali_vars.deployment.instance_name }}-service-account
{% if kiali_vars.deployment.priority_class_name != "" %}
      priorityClassName: "{{ kiali_vars.deployment.priority_class_name }}"
{% endif %}
{% if kiali_vars.deployment.image_pull_secrets | default([]) | length > 0 %}
      imagePullSecrets:
{% for n in kiali_vars.deployment.image_pull_secrets %}
      - name: {{ n }}
{% endfor %}
{% endif %}
{% if kiali_vars.deployment.host_aliases|length > 0 %}
      hostAliases:
        {{ kiali_vars.deployment.host_aliases | to_nice_yaml(indent=0) | trim | indent(8) }}
{% endif %}
      containers:
      - image: {{ kiali_vars.deployment.image_name }}{{ '@' + kiali_vars.deployment.image_digest if kiali_vars.deployment.image_digest != '' else '' }}:{{ kiali_vars.deployment.image_version }}
        imagePullPolicy: {{ kiali_vars.deployment.image_pull_policy }}
        name: kiali
        command:
        - "/opt/kiali/kiali"
        - "-config"
        - "/kiali-configuration/config.yaml"
        securityContext:
{% if kiali_vars.deployment.security_context|length > 0 %}
          {{ kiali_vars.deployment.security_context | to_nice_yaml(indent=0) | trim | indent(10) }}
{% endif %}
{% if kiali_vars.deployment.security_context|length == 0 or lookup('env', 'ALLOW_SECURITY_CONTEXT_OVERRIDE') != "true" %}
          allowPrivilegeEscalation: false
          privileged: false
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          capabilities:
            drop:
            - ALL
{% endif %}
        ports:
          - name: api-port
            containerPort: {{ kiali_vars.server.port }}
{% if kiali_vars.server.observability.metrics.enabled|bool == True %}
          - name: http-metrics
            containerPort: {{ kiali_vars.server.observability.metrics.port }}
{% endif %}
        readinessProbe:
          httpGet:
            path: {{ kiali_vars.server.web_root | regex_replace('\\/$', '') }}/healthz
            port: api-port
            scheme:  {{ 'HTTP' if kiali_vars.identity.cert_file == "" else 'HTTPS' }}
          initialDelaySeconds: 5
          periodSeconds: 30
        livenessProbe:
          httpGet:
            path: {{ kiali_vars.server.web_root | regex_replace('\\/$', '') }}/healthz
            port: api-port
            scheme:  {{ 'HTTP' if kiali_vars.identity.cert_file == "" else 'HTTPS' }}
          initialDelaySeconds: 5
          periodSeconds: 30
        env:
        - name: ACTIVE_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: LOG_FORMAT
          value: "{{ kiali_vars.deployment.logger.log_format }}"
        - name: LOG_LEVEL
          value: "{{ kiali_vars.deployment.verbose_mode if kiali_vars.deployment.verbose_mode is defined else kiali_vars.deployment.logger.log_level }}"
        - name: LOG_SAMPLER_RATE
          value: "{{ kiali_vars.deployment.logger.sampler_rate }}"
        - name: LOG_TIME_FIELD_FORMAT
          value: "{{ kiali_vars.deployment.logger.time_field_format }}"
        volumeMounts:
        - name: kiali-configuration
          mountPath: "/kiali-configuration"
{% if kiali_vars.identity.cert_file == "/kiali-cert/tls.crt" %}
        - name: kiali-cert
          mountPath: "/kiali-cert"
{% endif %}
        - name: kiali-secret
          mountPath: "/kiali-secret"
        - name: kiali-cabundle
          mountPath: "/kiali-cabundle"
{% for sec in kiali_deployment_secret_volumes %}
        - name: {{ sec }}
          mountPath: "/kiali-override-secrets/{{ sec }}"
          readOnly: true
{% endfor %}
{% for secret in kiali_vars.deployment.custom_secrets %}
        - name: {{ secret.name }}
          mountPath: "{{ secret.mount }}"
{% endfor %}
{% for sec in kiali_deployment_remote_cluster_secret_volumes %}
        - name: {{ sec }}
          mountPath: "/kiali-remote-cluster-secrets/{{ sec }}"
          readOnly: true
{% endfor %}
{% if kiali_vars.deployment.resources|length > 0 %}
        resources:
          {{ kiali_vars.deployment.resources | to_nice_yaml(indent=0) | trim | indent(10) }}
{% else %}
        resources: null
{% endif %}
      volumes:
      - name: kiali-configuration
        configMap:
          name: {{ kiali_vars.deployment.instance_name }}
{% if kiali_vars.identity.cert_file == "/kiali-cert/tls.crt" %}
      - name: kiali-cert
        secret:
          secretName: {{ kiali_vars.deployment.instance_name }}-cert-secret
{% endif %}
      - name: kiali-secret
        secret:
          secretName: {{ kiali_vars.deployment.secret_name }}
          optional: true
      - name: kiali-cabundle
        configMap:
          name: {{ kiali_vars.deployment.instance_name }}-cabundle
{% for sec in kiali_deployment_secret_volumes %}
      - name: {{ sec }}
        secret:
          secretName: {{ kiali_deployment_secret_volumes[sec].secret_name }}
          items:
          - key: {{ kiali_deployment_secret_volumes[sec].secret_key }}
            path: value.txt
          optional: false
{% endfor %}
{% for secret in kiali_vars.deployment.custom_secrets %}
      - name: {{ secret.name }}
        secret:
          secretName: {{ secret.name }}
{% if secret.optional is defined %}
          optional: {{ secret.optional }}
{% endif %}
{% endfor %}
{% for sec in kiali_deployment_remote_cluster_secret_volumes %}
      - name: {{ sec }}
        secret:
          secretName: {{ kiali_deployment_remote_cluster_secret_volumes[sec].secret_name }}
{% endfor %}
{% if kiali_vars.deployment.affinity.node|length > 0 or kiali_vars.deployment.affinity.pod|length > 0 or kiali_vars.deployment.affinity.pod_anti|length > 0 %}
      affinity:
{% if kiali_vars.deployment.affinity.node|length > 0 %}
        nodeAffinity:
          {{ kiali_vars.deployment.affinity.node | to_nice_yaml(indent=0) | trim | indent(10) }}
{% else %}
        nodeAffinity: null
{% endif %}
{% if kiali_vars.deployment.affinity.pod|length > 0 %}
        podAffinity:
          {{ kiali_vars.deployment.affinity.pod | to_nice_yaml(indent=0) | trim | indent(10) }}
{% else %}
        podAffinity: null
{% endif %}
{% if kiali_vars.deployment.affinity.pod_anti|length > 0 %}
        podAntiAffinity:
          {{ kiali_vars.deployment.affinity.pod_anti | to_nice_yaml(indent=0) | trim | indent(10) }}
{% else %}
        podAntiAffinity: null
{% endif %}
{% else %}
      affinity: null
{% endif %}
{% if kiali_vars.deployment.tolerations|length > 0 %}
      tolerations:
      {{ kiali_vars.deployment.tolerations | to_nice_yaml(indent=0) | trim | indent(6) }}
{% else %}
      tolerations: null
{% endif %}
{% if kiali_vars.deployment.node_selector|length > 0 %}
      nodeSelector:
        {{ kiali_vars.deployment.node_selector | to_nice_yaml(indent=0) | trim | indent(8) }}
{% else %}
      nodeSelector: null
{% endif %}