deployment.yaml

{{/* image-updater-bot detects *image variables so use print to disable it for main image */}}

{{ $main_image := print "container-registry.zalando.net/teapot/skipper-internal:" "v0.21.224-1047" }}
{{ $canary_image := "container-registry.zalando.net/teapot/skipper-internal:v0.21.224-1047" }}


{{/* Optional canary arguments separated by "[cf724afc]" to allow whitespaces, e.g. "-foo=has a whitespace[cf724afc]-baz=qux" */}}
{{ $canary_args := "" }}

{{ template "skipper-ingress" dict
  "name" "skipper-ingress"
  "image" $main_image

  "Cluster" .Cluster
  "Values" .Values
}}

{{ if eq .Cluster.ConfigItems.skipper_ingress_canary_enabled "true" }}
{{ template "skipper-ingress" dict
  "name" "skipper-ingress-canary"
  "image" $canary_image
  "replicas" 1
  "args" $canary_args

  "Cluster" .Cluster
  "Values" .Values
}}
{{ end }}

{{ define "skipper-ingress" }}
{{ $version := index (split (index (split .image ":") 1) "-") 0 }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: "{{ .name }}"
  namespace: kube-system
  labels:
    application: skipper-ingress
    version: {{ $version }}
    component: ingress
spec:
{{ if index . "replicas" }}
  replicas: {{ .replicas }}
{{ else if eq .Cluster.ConfigItems.skipper_ingress_test_single_pod "true" }}
  replicas: 0
{{ end }}
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      deployment: "{{ .name }}"
  template:
    metadata:
      labels:
        deployment: "{{ .name }}"
        application: skipper-ingress
        version: {{ $version }}
        component: ingress
        metrics/version: {{ $version }}
      annotations:
        kubernetes-log-watcher/scalyr-parser: |
          [{"container": "skipper-ingress", "parser": "skipper-access-log"}]
        config/hash: {{"secret.yaml" | manifestHash}}
        logging/destination: "{{ .Cluster.ConfigItems.log_destination_local }}"
        prometheus.io/path: /metrics
        prometheus.io/port: "9911"
        prometheus.io/scrape: "true"
{{- if and (eq .Cluster.ConfigItems.skipper_topology_spread_enabled "true") (ne .Cluster.ConfigItems.skipper_topology_spread_timeout "0")}}
        zalando.org/topology-spread-timeout: {{ .Cluster.ConfigItems.skipper_topology_spread_timeout }}
{{- end }}
    spec:
{{- if eq .Cluster.ConfigItems.skipper_topology_spread_enabled "true" }}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              component: ingress
              application: skipper-ingress
{{- end }}
      priorityClassName: "{{ .Cluster.ConfigItems.system_priority_class }}"
      serviceAccountName: skipper-ingress
      terminationGracePeriodSeconds: {{ .Cluster.ConfigItems.skipper_termination_grace_period }}
      dnsPolicy: ClusterFirstWithHostNet
      hostNetwork: true
      containers:
      - name: skipper-ingress
        image: "{{ .image }}"
        terminationMessagePolicy: FallbackToLogsOnError
        ports:
        - name: ingress-port
          containerPort: 9999
          hostPort: 9999
          protocol: TCP
{{ if or (eq .Cluster.ConfigItems.nlb_switch "pre") (eq .Cluster.ConfigItems.nlb_switch "exec") }}
        - name: http-redirect
          containerPort: 9998
          hostPort: 9998
          protocol: TCP
{{ end }}
        env:
        - name: LIGHTSTEP_TOKEN
          valueFrom:
            secretKeyRef:
              name: skipper-ingress
              key: lightstep-token
{{ if or (eq .Cluster.ConfigItems.skipper_local_tokeninfo "production") (eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge") }}
        - name: LOCAL_TOKENINFO
          value: "true"
        - name: ENABLE_OPENTRACING
          value: "true"
        - name: OPENTRACING_LIGHTSTEP_COMPONENT_NAME
          value: "tokeninfo-skipper-ingress"
        - name: OPENTRACING_LIGHTSTEP_ACCESS_TOKEN
          valueFrom:
            secretKeyRef:
              name: skipper-ingress
              key: lightstep-token
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge" }}
        - name: LOCAL_TOKENINFO_SANDBOX
          value: "true"
{{ end }}
{{ if or (eq .Cluster.ConfigItems.nlb_switch "pre") (eq .Cluster.ConfigItems.nlb_switch "exec") }}
        - name: HTTP_REDIRECT
          value: "true"
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_lua_scripts_enabled "true" }}
        - name: LUA_PATH
          value: /etc/skipper/lua/?.lua
        - name: DATADOME_API_KEY
          valueFrom:
            secretKeyRef:
              name: skipper-ingress
              key: datadome-api-key
        - name: KASADA_API_KEY
          valueFrom:
            secretKeyRef:
              name: skipper-ingress
              key: kasada-api-key
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
        - name: STYRA_TOKEN
          valueFrom:
            secretKeyRef:
              name: skipper-ingress
              key: styra-token
{{ end }}
        args:
          - "run.sh"
          - "skipper"
          - "-validate-query={{ .Cluster.ConfigItems.skipper_validate_query }}"
          - "-validate-query-log={{ .Cluster.ConfigItems.skipper_validate_query_log }}"
{{ if eq .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
          - "-routes-urls=http://skipper-ingress-routesrv.kube-system.svc.cluster.local/routes"
          - "-normalize-host"
{{ else }}
          - "-kubernetes"
          - "-kubernetes-in-cluster"
          - "-kubernetes-path-mode=path-prefix"
          - "-kubernetes-backend-traffic-algorithm={{ .Cluster.ConfigItems.skipper_ingress_backend_traffic_algorithm }}"
          - "-kubernetes-default-lb-algorithm={{ .Cluster.ConfigItems.skipper_ingress_default_lb_algorithm }}"
          - "-kubernetes-disable-catchall-routes={{ .Cluster.ConfigItems.skipper_ingress_disable_catchall_routes }}"
          - "-enable-kubernetes-endpointslices={{ .Cluster.ConfigItems.skipper_endpointslices_enabled }}"
{{ end }}
          - "-address=:9999"
          - "-wait-first-route-load"
          - "-wait-for-healthcheck-interval={{ .Cluster.ConfigItems.skipper_wait_for_healthcheck_interval }}"
{{ if ne .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
          - "-kubernetes-east-west-range-domains=ingress.cluster.local"
          - "-kubernetes-east-west-range-predicates=ClientIP(\"10.2.0.0/15\", \"{{ .Values.vpc_ipv4_cidr }}\")"
          - '-kubernetes-annotation-predicates={{ .Cluster.ConfigItems.skipper_kubernetes_annotation_predicates }}'
          - '-kubernetes-east-west-range-annotation-predicates={{ .Cluster.ConfigItems.skipper_kubernetes_east_west_range_annotation_predicates }}'
          - "-reverse-source-predicate"
{{ end }}
          - "-proxy-preserve-host"
          - "-compress-encodings={{ .Cluster.ConfigItems.skipper_compress_encodings }}"
          - "-serve-host-metrics"
          - "-serve-method-metric={{ .Cluster.ConfigItems.skipper_serve_method_metric }}"
          - "-serve-status-code-metric={{ .Cluster.ConfigItems.skipper_serve_status_code_metric }}"
          - "-serve-host-counter"
          - "-disable-metrics-compat"
          - "-enable-profile"
          - "-memory-profile-rate={{ .Cluster.ConfigItems.skipper_memory_profile_rate }}"
          - "-block-profile-rate={{ .Cluster.ConfigItems.skipper_block_profile_rate }}"
          - "-mutex-profile-fraction={{ .Cluster.ConfigItems.skipper_mutex_profile_fraction }}"
          - "-debug-listener=:9922"
          - "-enable-ratelimits"
          - "-experimental-upgrade"
          - "-metrics-exp-decay-sample"
          - "-metrics-flavour=prometheus"
          - "-enable-prometheus-start-label={{ .Cluster.ConfigItems.skipper_prometheus_start_label_enabled }}"
          - "-enable-connection-metrics"
          - "-enable-route-lifo-metrics"
          - "-enable-route-fifo-metrics"
          - "-enable-api-usage-monitoring"
          - "-api-usage-monitoring-realm-keys=https://identity.zalando.com/realm"
          - "-api-usage-monitoring-client-keys=https://identity.zalando.com/managed-id,sub"
{{ if ne .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
          - "-default-filters-dir=/etc/config/default-filters"
{{ end }}
          - "-max-audit-body=0"
{{ if eq .Cluster.ConfigItems.skipper_ingress_redis_swarm_enabled "true" }}
          - "-enable-swarm"
          - "-swarm-redis-dial-timeout={{ .Cluster.ConfigItems.skipper_redis_dial_timeout }}"
          - "-swarm-redis-pool-timeout={{ .Cluster.ConfigItems.skipper_redis_pool_timeout }}"
          - "-swarm-redis-read-timeout={{ .Cluster.ConfigItems.skipper_redis_read_timeout }}"
          - "-swarm-redis-write-timeout={{ .Cluster.ConfigItems.skipper_redis_write_timeout }}"
          - "-cluster-ratelimit-max-group-shards={{ .Cluster.ConfigItems.skipper_cluster_ratelimit_max_group_shards }}"
          - "-swarm-redis-min-conns={{ .Cluster.ConfigItems.skipper_redis_min_conns }}"
          - "-swarm-redis-max-conns={{ .Cluster.ConfigItems.skipper_redis_max_conns }}"
{{ if eq .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
          - "-swarm-redis-remote=http://skipper-ingress-routesrv.kube-system.svc.cluster.local/swarm/redis/shards"
{{ else }}
          - "-kubernetes-redis-service-namespace=kube-system"
          - "-kubernetes-redis-service-name=skipper-ingress-redis"
          - "-kubernetes-redis-service-port=6379"
{{ end }}
{{ end }}
          - "-histogram-metric-buckets=.0001,.00025,.0005,.00075,.001,.0025,.005,.0075,.01,.025,.05,.075,.1,.2,.3,.4,.5,.75,1,2,3,4,5,7,10,15,20,30,60,120,300,600"
          - >-
            -opentracing=lightstep
            component-name=skipper-ingress
            token=$(LIGHTSTEP_TOKEN)
            collector={{ .Cluster.ConfigItems.tracing_collector_host }}:8444
            cmd-line=skipper-ingress
            tag=application=skipper-ingress
            tag=account={{ .Cluster.Alias }}
            tag=cluster={{ .Cluster.Alias }}
            tag=artifact={{ .image }}
            max-buffered-spans={{ .Cluster.ConfigItems.skipper_ingress_tracing_buffer }}
            grpc-max-msg-size={{ .Cluster.ConfigItems.skipper_ingress_lightstep_grpc_max_msg_size }}
            max-period={{ .Cluster.ConfigItems.skipper_ingress_lightstep_max_period }}
            min-period={{ .Cluster.ConfigItems.skipper_ingress_lightstep_min_period }}
            max-log-key-len={{ .Cluster.ConfigItems.skipper_ingress_lightstep_max_log_key_len }}
            max-log-value-len={{ .Cluster.ConfigItems.skipper_ingress_lightstep_max_log_value_len }}
            max-logs-per-span={{ .Cluster.ConfigItems.skipper_ingress_lightstep_max_logs_per_span }}
            propagators={{ .Cluster.ConfigItems.skipper_ingress_lightstep_propagators }}
            {{ .Cluster.ConfigItems.skipper_ingress_lightstep_log_events }}
          - "-opentracing-excluded-proxy-tags={{ .Cluster.ConfigItems.skipper_ingress_opentracing_excluded_proxy_tags }}"
{{ if eq .Cluster.ConfigItems.skipper_ingress_opentracing_backend_name_tag "true" }}
          - "-opentracing-backend-name-tag"
{{ end }}
          - "-opentracing-disable-filter-spans={{ .Cluster.ConfigItems.skipper_opentracing_disable_filter_spans }}"
          - "-expect-continue-timeout-backend={{ .Cluster.ConfigItems.skipper_expect_continue_timeout_backend }}"
          - "-keepalive-backend={{ .Cluster.ConfigItems.skipper_keepalive_backend }}"
          - "-max-idle-connection-backend={{ .Cluster.ConfigItems.skipper_max_idle_connection_backend }}"
          - "-response-header-timeout-backend={{ .Cluster.ConfigItems.skipper_response_header_timeout_backend }}"
          - "-timeout-backend={{ .Cluster.ConfigItems.skipper_timeout_backend }}"
          - "-tls-timeout-backend={{ .Cluster.ConfigItems.skipper_tls_timeout_backend }}"
          - "-close-idle-conns-period={{ .Cluster.ConfigItems.skipper_close_idle_conns_period }}"
          - "-idle-timeout-server={{ .Cluster.ConfigItems.skipper_idle_timeout_server }}"
          - "-read-timeout-server={{ .Cluster.ConfigItems.skipper_read_timeout_server }}"
          - "-write-timeout-server={{ .Cluster.ConfigItems.skipper_write_timeout_server }}"
          - "-keepalive-server={{ .Cluster.ConfigItems.skipper_keepalive_server }}"
          - "-keepalive-requests-server={{ .Cluster.ConfigItems.skipper_keepalive_requests_server }}"
          - "-lua-sources={{ .Cluster.ConfigItems.skipper_lua_sources }}"
          - "-disabled-filters={{ .Cluster.ConfigItems.skipper_disabled_filters }}"
{{ if ne .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
          - '-default-filters-prepend={{ .Cluster.ConfigItems.skipper_default_filters }}'
          - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_authentication }}'
          - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_append }}'
  {{ if .Cluster.ConfigItems.skipper_edit_route_placeholders }}
          {{ range $placeholder := split .Cluster.ConfigItems.skipper_edit_route_placeholders "[cf724afc]" }}
          - '-edit-route={{ $placeholder }}'
          {{ end }}
  {{ end }}
{{ end }}
          - "-suppress-route-update-logs={{ .Cluster.ConfigItems.skipper_suppress_route_update_logs }}"
{{ if eq .Cluster.ConfigItems.skipper_enable_tcp_queue "true" }}
          - "-enable-tcp-queue"
          - "-expected-bytes-per-request={{ .Cluster.ConfigItems.skipper_expected_bytes_per_request }}"
          - "-max-tcp-listener-concurrency={{ .Cluster.ConfigItems.skipper_max_tcp_listener_concurrency }}"
          - "-max-tcp-listener-queue={{ .Cluster.ConfigItems.skipper_max_tcp_listener_queue }}"
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge" }}
          - "-oauth2-tokeninfo-url=http://127.0.0.1:9000/oauth2/tokeninfo"
          - "-status-checks=http://127.0.0.1:9021/health,http://127.0.0.1:9121/health,http://127.0.0.1:9000/healthz"
{{ else if eq .Cluster.ConfigItems.skipper_local_tokeninfo "production" }}
          - "-oauth2-tokeninfo-url=http://127.0.0.1:9021/oauth2/tokeninfo"
          - "-status-checks=http://127.0.0.1:9021/health"
{{ end }}
          - "-oauth2-tokeninfo-cache-size={{ .Cluster.ConfigItems.skipper_tokeninfo_cache_size }}"
          - "-oauth2-tokeninfo-cache-ttl={{ .Cluster.ConfigItems.skipper_tokeninfo_cache_ttl }}"
{{ if eq .Cluster.ConfigItems.skipper_oauth2_ui_login "true" }}
          - "-enable-oauth2-grant-flow"
          - "-oauth2-auth-url={{ .Cluster.ConfigItems.skipper_oauth2_auth_url }}"
          - "-oauth2-token-url={{ .Cluster.ConfigItems.skipper_oauth2_token_url }}"
          - "-oauth2-secret-file=/etc/skipper/secret/encryption-key"
          - "-oauth2-client-id-file=/etc/skipper/hostname-credentials/{host}-grant-credentials-employee-client-id"
          - "-oauth2-client-secret-file=/etc/skipper/hostname-credentials/{host}-grant-credentials-employee-client-secret"
          - "-credentials-update-interval=1m"
          - "-oauth2-token-cookie-name={{ .Cluster.ConfigItems.skipper_oauth2_cookie_name }}"
          - "-oauth2-token-cookie-remove-subdomains=0"
          - "-oauth2-callback-path={{ .Cluster.ConfigItems.skipper_oauth2_redirect_uri_path }}"
          - "-oauth2-grant-tokeninfo-keys={{ .Cluster.ConfigItems.skipper_oauth2_ui_login_tokeninfo_keys }}"
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
          - "-enable-open-policy-agent"
          - "-open-policy-agent-config-template=/etc/skipper/open-policy-agent/opaconfig.yaml"
          - "-open-policy-agent-envoy-metadata=/etc/skipper/open-policy-agent/envoymetadata.json"
{{ end }}
{{ if or (eq .Cluster.ConfigItems.nlb_switch "pre") (eq .Cluster.ConfigItems.nlb_switch "exec") }}
          - "-forwarded-headers=X-Forwarded-For,X-Forwarded-Proto=https,X-Forwarded-Port=443"
          - "-forwarded-headers-exclude-cidrs=10.2.0.0/15,{{ .Values.vpc_ipv4_cidr}}"
{{ end }}
{{ if .Cluster.ConfigItems.skipper_ingress_inline_routes }}
          - "-inline-routes={{ .Cluster.ConfigItems.skipper_ingress_inline_routes }}"
{{ end }}
{{ if .Cluster.ConfigItems.skipper_ingress_health_check_options }}
          - "-passive-health-check={{ .Cluster.ConfigItems.skipper_ingress_health_check_options }}"
{{ end }}
{{ if .Cluster.ConfigItems.skipper_ingress_refuse_payload }}
          {{ range $pattern := split .Cluster.ConfigItems.skipper_ingress_refuse_payload "[cf724afc]" }}
          - "-refuse-payload={{ $pattern }}"
          {{ end }}
{{ end }}
{{ if index . "args" }}
          {{ range $arg := split .args "[cf724afc]" }}
          - "{{ $arg }}"
          {{ end }}
{{ end }}
        resources:
{{ if and (eq .Cluster.ConfigItems.enable_dedicate_nodepool_skipper "true") (eq .Cluster.ConfigItems.skipper_ingress_binpack "true") }}
{{ $cpu_requests := sumQuantities .Cluster.ConfigItems.skipper_ingress_cpu (printf "-%s" .Cluster.ConfigItems.teapot_admission_controller_daemonset_reserved_cpu) (printf "-%s" .Cluster.ConfigItems.kubelet_system_reserved_cpu) (printf "-%s" .Cluster.ConfigItems.kubelet_kube_reserved_cpu) }}
          limits:
            cpu: "{{ $cpu_requests }}"
            memory: "{{ .Cluster.ConfigItems.skipper_ingress_memory }}"
          requests:
            cpu: "{{ $cpu_requests }}"
            memory: "{{ .Cluster.ConfigItems.skipper_ingress_memory }}"
{{ else }}
          limits:
            cpu: "{{ .Cluster.ConfigItems.skipper_ingress_cpu }}"
            memory: "{{ .Cluster.ConfigItems.skipper_ingress_memory }}"
          requests:
            cpu: "{{ .Cluster.ConfigItems.skipper_ingress_cpu }}"
            memory: "{{ .Cluster.ConfigItems.skipper_ingress_memory }}"
{{ end }}
        readinessProbe:
          httpGet:
            path: /kube-system/healthz
            port: 9999
          initialDelaySeconds: {{ .Cluster.ConfigItems.skipper_readiness_init_delay_seconds }}
          timeoutSeconds: 5
{{ if eq .Cluster.ConfigItems.skipper_local_tokeninfo "production" }}
        livenessProbe:
          httpGet:
            path: /health
            port: 9021
            host: 127.0.0.1
            scheme: HTTP
          initialDelaySeconds: {{ .Cluster.ConfigItems.skipper_liveness_init_delay_seconds }}
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
{{ else if eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge" }}
        livenessProbe:
          exec:
            command:
            - /bin/sh
            - -ce
            # Check all sub processes in the container and fail if one of them fails.
            # curl will exit with non-zero status code if the HTTP code is no 2xx.
            # production tokeninfo, sandbox tokeninfo, bridge
            - "curl --max-time 1 -fs -o /dev/null http://127.0.0.1:9021/health; curl --max-time 1 -fs -o /dev/null http://127.0.0.1:9121/health; curl --max-time 1 -fs -o /dev/null http://127.0.0.1:9000/healthz"
          initialDelaySeconds: {{ .Cluster.ConfigItems.skipper_liveness_init_delay_seconds }}
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 1
          failureThreshold: 5
{{ end }}
        securityContext:
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
        volumeMounts:
          - name: routes-cache
            mountPath: /tmp
{{ if eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge"}}
          - name: routes
            mountPath: /etc/routes
{{ end }}
{{ if ne .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
          - name: filters
            mountPath: /etc/config/default-filters
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_lua_scripts_enabled "true" }}
          - name: lua
            mountPath: /etc/skipper/lua
            readOnly: true
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_oauth2_ui_login "true"}}
          - name: hostname-credentials
            mountPath: /etc/skipper/hostname-credentials
            readOnly: true
          - name: encryption-key
            mountPath: /etc/skipper/secret
            readOnly: true
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
          - name: open-policy-agent-config
            mountPath: /etc/skipper/open-policy-agent
            readOnly: true
{{ end }}
      volumes:
        - name: routes-cache
          emptyDir: {}
{{ if eq .Cluster.ConfigItems.skipper_local_tokeninfo "bridge"}}
        - name: routes
          configMap:
            name: sandbox-tokeninfo-bridge-conf
{{ end }}
{{ if ne .Cluster.ConfigItems.skipper_routesrv_enabled "exec" }}
        - name: filters
          configMap:
            name: skipper-default-filters
            optional: true
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_lua_scripts_enabled "true" }}
        - name: lua
          configMap:
            name: skipper-ingress-lua
            optional: true
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_oauth2_ui_login "true"}}
        - name: hostname-credentials
          secret:
            secretName: hostname-credentials
        - name: encryption-key
          secret:
            secretName: skipper-ingress
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_open_policy_agent_enabled "true" }}
        - name: open-policy-agent-config
          configMap:
            name: open-policy-agent-config
{{ end }}
{{ if eq .Cluster.ConfigItems.enable_dedicate_nodepool_skipper "true"}}
      nodeSelector:
        dedicated: skipper-ingress
      tolerations:
      - effect: NoSchedule
        key: dedicated
        value: skipper-ingress
{{ end }}
{{ end }}

{{ if ne .Cluster.ConfigItems.skipper_routesrv_enabled "false" }}
{{ $main_version := index (split (index (split $main_image ":") 1) "-") 0 }}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: skipper-ingress-routesrv
  namespace: kube-system
  labels:
    application: skipper-ingress
    version: "{{ $main_version }}"
    component: routesrv
spec:
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      application: skipper-ingress
      component: routesrv
  template:
    metadata:
      labels:
        deployment: skipper-ingress-routesrv
        application: skipper-ingress
        version: "{{ $main_version }}"
        component: routesrv
      annotations:
        config/hash: {{"secret.yaml" | manifestHash}}
        kubernetes-log-watcher/scalyr-parser: |
          [{"container": "routesrv", "parser": "keyValue"}]
        logging/destination: "{{ .Cluster.ConfigItems.log_destination_local }}"
        prometheus.io/path: /metrics
        prometheus.io/port: "9911"
        prometheus.io/scrape: "true"
{{- if eq .Cluster.ConfigItems.skipper_topology_spread_enabled "true" }}
        zalando.org/topology-spread-timeout: 7m
{{- end }}
    spec:
{{- if eq .Cluster.ConfigItems.skipper_topology_spread_enabled "true" }}
      topologySpreadConstraints:
        - maxSkew: 1
          topologyKey: topology.kubernetes.io/zone
          whenUnsatisfiable: DoNotSchedule
          labelSelector:
            matchLabels:
              deployment: skipper-ingress-routesrv
{{- end }}
      priorityClassName: "{{ .Cluster.ConfigItems.system_priority_class }}"
      serviceAccountName: skipper-ingress-routesrv
      terminationGracePeriodSeconds: {{ .Cluster.ConfigItems.skipper_termination_grace_period }}
{{- if eq .Cluster.ConfigItems.skipper_routesrv_node_affinity_enabled "true" }}
      affinity:
       podAntiAffinity:
         requiredDuringSchedulingIgnoredDuringExecution:
         - labelSelector:
             matchExpressions:
             - key: application
               operator: In
               values:
               - skipper-ingress
             - key: component
               operator: In
               values:
               - routesrv
           topologyKey: kubernetes.io/hostname
{{- end }}
      containers:
      - name: routesrv
        image: container-registry.zalando.net/teapot/skipper:{{ $main_version }}
        terminationMessagePolicy: FallbackToLogsOnError
        ports:
        - name: ingress-port
          containerPort: 9990
          protocol: TCP
        args:
          - "routesrv"
          - "-application-log-level={{ .Cluster.ConfigItems.skipper_routesrv_log_level }}"
          - "-enable-profile"
          - "-kubernetes"
          - "-kubernetes-in-cluster"
          - "-kubernetes-path-mode=path-prefix"
          - "-kubernetes-backend-traffic-algorithm={{ .Cluster.ConfigItems.skipper_ingress_backend_traffic_algorithm }}"
          - "-kubernetes-default-lb-algorithm={{ .Cluster.ConfigItems.skipper_ingress_default_lb_algorithm }}"
          - "-kubernetes-disable-catchall-routes={{ .Cluster.ConfigItems.skipper_ingress_disable_catchall_routes }}"
          - "-enable-kubernetes-endpointslices={{ .Cluster.ConfigItems.skipper_endpointslices_enabled }}"
          - "-address=:9990"
          - "-wait-for-healthcheck-interval={{ .Cluster.ConfigItems.skipper_wait_for_healthcheck_interval }}"
          - "-kubernetes-east-west-range-domains=ingress.cluster.local"
          - "-kubernetes-east-west-range-predicates=ClientIP(\"10.2.0.0/15\", \"{{ .Values.vpc_ipv4_cidr }}\")"
          - '-kubernetes-annotation-predicates={{ .Cluster.ConfigItems.skipper_kubernetes_annotation_predicates }}'
          - '-kubernetes-east-west-range-annotation-predicates={{ .Cluster.ConfigItems.skipper_kubernetes_east_west_range_annotation_predicates }}'
          - "-reverse-source-predicate"
          - "-default-filters-dir=/etc/config/default-filters"
          - '-default-filters-prepend={{ .Cluster.ConfigItems.skipper_default_filters }}'
          - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_authentication }}'
          - '-default-filters-append={{ .Cluster.ConfigItems.skipper_default_filters_append }}'
{{ if eq .Cluster.ConfigItems.skipper_ingress_redis_swarm_enabled "true" }}
          - "-enable-swarm"
          - "-kubernetes-redis-service-namespace=kube-system"
          - "-kubernetes-redis-service-name=skipper-ingress-redis"
          - "-kubernetes-redis-service-port=6379"
{{ end }}
{{ if eq .Cluster.ConfigItems.skipper_oauth2_ui_login "true" }}
          - "-enable-oauth2-grant-flow"
          - "-oauth2-callback-path={{ .Cluster.ConfigItems.skipper_oauth2_redirect_uri_path }}"
{{ end }}
{{ if .Cluster.ConfigItems.skipper_edit_route_placeholders }}
          {{ range $placeholder := split .Cluster.ConfigItems.skipper_edit_route_placeholders "[cf724afc]" }}
          - '-edit-route={{ $placeholder }}'
          {{ end }}
{{ end }}
{{ if or (eq .Cluster.ConfigItems.nlb_switch "pre") (eq .Cluster.ConfigItems.nlb_switch "exec") }}
          - "-forwarded-headers=X-Forwarded-For,X-Forwarded-Proto=https,X-Forwarded-Port=443"
          - "-forwarded-headers-exclude-cidrs=10.2.0.0/15,{{ .Values.vpc_ipv4_cidr}}"
{{ end }}
          - >-
            -opentracing=lightstep
            component-name=routesrv
            token=$(LIGHTSTEP_TOKEN)
            collector={{ .Cluster.ConfigItems.tracing_collector_host }}:8444
            cmd-line=routesrv
            tag=application=skipper-ingress
            tag=component=routesrv
            tag=account={{ .Cluster.Alias }}
            tag=cluster={{ .Cluster.Alias }}
            tag=artifact=container-registry.zalando.net/teapot/skipper:{{ $main_version }}
            max-buffered-spans={{ .Cluster.ConfigItems.skipper_ingress_tracing_buffer }}
            grpc-max-msg-size={{ .Cluster.ConfigItems.skipper_ingress_lightstep_grpc_max_msg_size }}
            max-period=2500ms
            min-period=500ms
            max-log-key-len={{ .Cluster.ConfigItems.skipper_ingress_lightstep_max_log_key_len }}
            max-log-value-len={{ .Cluster.ConfigItems.skipper_ingress_lightstep_max_log_value_len }}
            max-logs-per-span={{ .Cluster.ConfigItems.skipper_ingress_lightstep_max_logs_per_span }}
            propagators={{ .Cluster.ConfigItems.skipper_ingress_lightstep_propagators }}
            {{ .Cluster.ConfigItems.skipper_ingress_lightstep_log_events }}
        env:
        - name: LIGHTSTEP_TOKEN
          valueFrom:
            secretKeyRef:
              name: skipper-ingress
              key: lightstep-token
        resources:
          limits:
            cpu: "{{ .Cluster.ConfigItems.skipper_routesrv_cpu }}"
            memory: "{{ .Cluster.ConfigItems.skipper_routesrv_memory }}"
          requests:
            cpu: "{{ .Cluster.ConfigItems.skipper_routesrv_cpu }}"
            memory: "{{ .Cluster.ConfigItems.skipper_routesrv_memory }}"
        readinessProbe:
          httpGet:
            path: /health
            port: 9990
          timeoutSeconds: 5
        securityContext:
          readOnlyRootFilesystem: true
          runAsNonRoot: true
          runAsUser: 1000
        volumeMounts:
          - name: filters
            mountPath: /etc/config/default-filters
      volumes:
        - name: filters
          configMap:
            name: skipper-default-filters
            optional: true
{{ end }}