James E. Blair 9afaed4d37 Add option to manage secrets outside of helm
So that a user can manage the nodepool config file (which is a secret)
outside of helm, add an option where the user can specify the name
of that secret as a value, and if it's set, helm will not write the
secret and will tell k8s to mount that secret as the nodepool config
instead.

Change-Id: Ifa1b5e81b6c7700faef82f3b18aab157d042e735
2020-01-10 14:50:01 -08:00

66 lines
1.8 KiB
YAML

---
{{ if .Values.builder.enabled }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
namespace: {{ .Release.Namespace }}
name: {{ include "nodepool.fullname" . }}-builder
labels:
{{- include "nodepool.builder.labels" . | indent 4 }}
spec:
replicas: {{ .Values.builder.replicas }}
serviceName: nodepool-builder
selector:
matchLabels:
{{- include "nodepool.builder.labels" . | indent 6 }}
template:
metadata:
labels:
{{- include "nodepool.builder.labels" . | indent 8 }}
annotations:
checksum/config: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }}
spec:
containers:
- name: builder
image: zuul/nodepool-builder:latest
env:
- name: OS_CLIENT_CONFIG_FILE
value: /etc/nodepool/clouds.yaml
volumeMounts:
- name: nodepool-config
mountPath: /etc/nodepool
- name: nodepool-logs
mountPath: /var/log/nodepool
- name: {{ include "nodepool.fullname" . }}-images-dir
mountPath: {{ index .Values.config "images-dir" }}
- name: dev
mountPath: /dev
securityContext:
privileged: true
volumes:
- name: nodepool-config
secret:
secretName: {{ (empty .Values.config.secret) | ternary (include "nodepool.fullname" .) .Values.config.secret }}
- name: nodepool-logs
emptyDir: {}
- name: dev
hostPath:
path: /dev
{{- with .Values.tolerations }}
tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
volumeClaimTemplates:
- metadata:
name: {{ include "nodepool.fullname" . }}-images-dir
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 80G
{{ end }}