helm-charts-hardened/charts/spiffe-step-ssh/templates/fetchca-deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
  labels:
    {{- include "spiffe-step-ssh.labels" . | nindent 4 }}
    app: spiffe-step-ssh
    component: fetchca
spec:
  {{- if not .Values.fetchCA.autoscaling.enabled }}
  replicas: {{ .Values.fetchCA.replicaCount }}
  {{- end }}
  selector:
    matchLabels:
      {{- include "spiffe-step-ssh.selectorLabels" . | nindent 6 }}
      app: spiffe-step-ssh
      component: fetchca
  template:
    metadata:
      {{- with .Values.podAnnotations }}
      annotations:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      labels:
        {{- include "spiffe-step-ssh.labels" . | nindent 8 }}
        {{- with .Values.podLabels }}
        {{- toYaml . | nindent 8 }}
        {{- end }}
        app: spiffe-step-ssh
        component: fetchca
    spec:
      shareProcessNamespace: true
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      serviceAccountName: {{ include "spiffe-step-ssh.serviceAccountName" . }}-fetchca
      securityContext:
        {{- toYaml .Values.podSecurityContext | nindent 8 }}
      initContainers:
        - name: busybox-volume
          image: {{ template "spire-lib.image" (dict "image" .Values.busybox.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.busybox.image.pullPolicy }}
          command:
          - sh
          - -c
          - 'cp -a /bin/busybox /busybox'
          volumeMounts:
          - name: busybox
            mountPath: /busybox
          resources:
            {{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
        - name: init-tls
          image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
          command:
          - /spiffe-helper
          - -config
          - /etc/spiffe-helper.conf
          - -daemon-mode=false
          volumeMounts:
          - name: spiffe-workload-api
            mountPath: /spiffe-workload-api
            readOnly: true
          - name: config
            mountPath: /etc/spiffe-helper.conf
            subPath: spiffe-helper-init.conf
            readOnly: true
          - name: certs
            mountPath: /certs
          resources:
            {{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
      containers:
        - name: {{ .Chart.Name }}-fetchca
          securityContext:
            {{- toYaml .Values.securityContext | nindent 12 }}
          image: {{ template "spire-lib.image" (dict "image" .Values.nginx.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.nginx.image.pullPolicy }}
          command:
          - /bin/sh
          - -c
          - |
            echo $$$$ > /pid/pid
            cat > /etc/nginx/conf.d/ssl.conf <<EOF
            server {
                listen       8443 ssl;
                server_name  localhost;
                ssl_certificate     /certs/tls.crt;
                ssl_certificate_key /certs/tls.key;
                location / {
                    root   /usr/share/nginx/html;
                    index  root_ca.crt index.html index.htm;
                }
                error_page   500 502 503 504  /50x.html;
                location = /50x.html {
                    root   /usr/share/nginx/html;
                }
            }
            EOF
            exec nginx -g "daemon off;"
          ports:
            - name: http
              containerPort: 8443
              protocol: TCP
          livenessProbe:
            httpGet:
              path: /
              port: http
              scheme: HTTPS
          readinessProbe:
            httpGet:
              path: /
              port: http
              scheme: HTTPS
          resources:
            {{- toYaml .Values.fetchCA.resources | nindent 12 }}
          volumeMounts:
          - name: certs
            mountPath: /certs
            readOnly: true
          - name: pid
            mountPath: /pid
          - name: share
            mountPath: /usr/share/nginx/html
        - name: update-tls
          image: {{ template "spire-lib.image" (dict "image" .Values.spiffeHelper.image "global" .Values.global) }}
          imagePullPolicy: {{ .Values.spiffeHelper.image.pullPolicy }}
          command:
          - /spiffe-helper
          - -config
          - /etc/spiffe-helper.conf
          volumeMounts:
          - name: certs
            mountPath: /certs
          - name: spiffe-workload-api
            mountPath: /spiffe-workload-api
            readOnly: true
          - name: config
            mountPath: /etc/spiffe-helper.conf
            subPath: spiffe-helper-sidecar.conf
            readOnly: true
          - name: config
            mountPath: /update.sh
            subPath: update.sh
            readOnly: true
          - name: pid
            mountPath: /pid
            readOnly: true
          - name: busybox
            mountPath: /busybox
            readOnly: true
          resources:
            {{- toYaml .Values.fetchCA.spiffeHelper.resources | nindent 12 }}
      volumes:
      - name: certs
        emptyDir: {}
      - name: pid
        emptyDir: {}
      - name: busybox
        emptyDir: {}
      - name: config
        configMap:
          name: {{ include "spiffe-step-ssh.fullname" . }}-fetchca
      - name: spiffe-workload-api
        csi:
          driver: {{ .Values.csiDriver | quote }}
          readOnly: true
      - name: share
        configMap:
          name: {{ include "spiffe-step-ssh.fullname" . }}-certs
      {{- with .Values.fetchCA.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.fetchCA.affinity }}
      affinity:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      {{- with .Values.fetchCA.tolerations }}
      tolerations:
        {{- toYaml . | nindent 8 }}
      {{- end }}