services.yaml

{{- range $name, $service := .Values.services }}
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: {{ template "agentEnv.fullname" $ -}}-{{ $name }}
  labels:
    {{- include "agentEnv.labels" $ | nindent 4 }}
    inspect/service: {{ $name }}
  annotations:
    {{- toYaml $.Values.annotations | nindent 4 }}
spec:
  serviceName: {{ $name }}-service
  replicas: 1
  selector:
    matchLabels:
      {{- include "agentEnv.selectorLabels" $ | nindent 6 }}
      inspect/service: {{ $name }}
  template:
    metadata:
      labels:
        {{- include "agentEnv.selectorLabels" $ | nindent 8 }}
        {{- if $service.networks }}
        {{- range $service.networks }}
        aisi.gov.uk/network-{{ . }}: "true"
        {{- end }}
        {{- end }}
        inspect/service: {{ $name }}
      annotations:
        {{- toYaml $.Values.annotations | nindent 8 }}
    spec:
      runtimeClassName: {{ $service.runtimeClassName | default "gvisor" }}
      {{- /* Do not leak info on services via env vars */}}
      enableServiceLinks: false
      terminationGracePeriodSeconds: 0
      containers:
      - name: {{ $name }}
        image: {{ $service.image }}
        {{- if $service.imagePullPolicy }}
        imagePullPolicy: {{ $service.imagePullPolicy }}
        {{- end }}
        {{- if $service.command }}
        command:
          {{- toYaml $service.command | nindent 10 }}
        {{- end }}
        {{- if $service.args }}
        args: {{ $service.args }}
        {{- end }}
        {{- if $service.workingDir }}
        workingDir: {{ $service.workingDir }}
        {{- end }}
        env:
          # Retained for service resolution backwards compatibility.
          - name: AGENT_ENV
            value: "{{ template "agentEnv.fullname" $ -}}"
        {{- if $service.env }}
          {{ range $service.env }}
          - name: {{ .name }}
            value: {{ .value | quote }}
          {{- end }}
        {{- end }}
        {{- with $service.readinessProbe }}
        readinessProbe:
          {{- toYaml . | nindent 10 }}
        {{- end }}
        {{- with $service.livenessProbe }}
        livenessProbe:
          {{- toYaml . | nindent 10 }}
        {{- end }}
        resources:
        {{- if $service.resources }}
          {{- toYaml $service.resources | nindent 10 }}
        {{- else }}
          # Equal limits and requests for Guaranteed QoS class.
          limits:
            memory: "2Gi"
            cpu: "500m"
          requests:
            memory: "2Gi"
            cpu: "500m"
        {{- end }}
        volumeMounts:
        {{- with $service.volumeMounts }}
          {{- toYaml . | nindent 10 }}
        {{- end }}
        {{- range $key, $value := $service.volumes }}
          {{- if kindIs "string" $value }}
            {{- $parts := split ":" $value }}
            {{- $volumeName := $parts._0 }}
            {{- $mountPath := $parts._1 }}
          - mountPath: {{ $mountPath | quote }}
            name: {{ template "agentEnv.fullname" $ -}}-{{ $volumeName }}
          {{- end }}
        {{- end }}
          - name: resolv-conf
            mountPath: /etc/resolv.conf
            subPath: resolv.conf
        {{- with $service.securityContext }}
        securityContext:
          {{- toYaml . | nindent 10 }}
        {{- end }}
      - name: coredns
        image: coredns/coredns:1.8.3
        command:
          - /coredns
          - -conf
          - /etc/coredns/Corefile
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"
        ports:
          - containerPort: 53
            protocol: UDP
            name: dns
          - containerPort: 53
            protocol: TCP
            name: dns-tcp
        volumeMounts:
          - name: coredns-config
            mountPath: /etc/coredns/Corefile
            subPath: Corefile
      {{- with $service.tolerations }}
      tolerations:
        {{- toYaml . | nindent 10 }}
      {{- end }}
      {{- with $service.nodeSelector }}
      nodeSelector:
        {{- toYaml . | nindent 10 }}
      {{- end }}
      volumes:
        - name: coredns-config
          configMap:
            name: {{ template "agentEnv.fullname" $ -}}-coredns-configmap
        - name: resolv-conf
          configMap:
            name: {{ template "agentEnv.fullname" $ -}}-resolv-conf
      {{- range $key, $value := $service.volumes }}
        {{- if kindIs "string" $value }}
          {{- $parts := split ":" $value }}
          {{- $volumeName := $parts._0 }}
        - name: {{ template "agentEnv.fullname" $ -}}-{{ $volumeName }}
          persistentVolumeClaim:
            claimName: {{ template "agentEnv.fullname" $ -}}-{{ $volumeName }}
        {{- else }}
        -  {{- toYaml . | nindent 10 }}
        {{- end }}
      {{- end }}
      {{- with $.Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
---
{{- if include "shouldCreateDnsRecord" $service }}
apiVersion: v1
kind: Service
metadata:
  name: {{ template "agentEnv.fullname" $ -}}-{{ $name }}
  annotations:
    {{- toYaml $.Values.annotations | nindent 4 }}
spec:
  # Make this a headless service: other pods in this agent-env may connect directly to
  # the pod on all ports. This enables the use of tools like `nc` on any port or `ping`
  # without Cilium blocking the traffic.
  clusterIP: None
  selector:
    {{- include "agentEnv.selectorLabels" $ | nindent 4 }}
    inspect/service: {{ $name }}
  {{- if $service.ports }}
  # ports are deprecated within this Helm chart. Maintained for backwards compatibility.
  ports:
    {{- range $service.ports }}
    - protocol: {{ .protocol }}
      port: {{ .port }}
      {{- /* A name is required when multiple ports are exposed. */}}
      name: port-{{ .port }}
    {{- end }}
  {{- end }}
---
{{- end }}
{{- end }}