jklein
1bca98b9ef
A changed ConfigMap did not restart any pod in this repo: no chart carries a checksum/config annotation, so the pod template stays identical and the running container keeps its old config. With subPath mounts (the usual form here) the kubelet never refreshes the file either, so the change is silently ineffective - see #82, where this caused a real outage while every bundle was green and the pod Ready. template-chart is the reference implementation, so it gets the annotation on both pod templates (Deployment and StatefulSet), and the README style guide gets a new binding section 9 covering the rule, the reason, and the limit for 1Password-backed Secrets. Major bump: runtime behavior changes - a config change now costs a restart.
67 lines
2.8 KiB
YAML
67 lines
2.8 KiB
YAML
apiVersion: apps/v1
|
|
kind: StatefulSet
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
spec:
|
|
replicas: {{ include "xxx.replicas" (dict "scaleDown" .Values.scaleDown "replicas" .Values.xxx.replicas) }}
|
|
serviceName: {{ .Release.Name }}-{{ .Chart.Name }}-service
|
|
selector:
|
|
matchLabels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
template:
|
|
metadata:
|
|
name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
labels:
|
|
app: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
annotations:
|
|
# Hash of the rendered ConfigMap: a changed ConfigMap changes the pod
|
|
# template and thus restarts the pods. Without it a config change stays
|
|
# invisible to the running container - subPath mounts are never
|
|
# updated by the kubelet, and most apps read their config only at
|
|
# start. Add one line per ConfigMap the workload consumes.
|
|
checksum/config: {{ include (print $.Template.BasePath "/xxx.configmap.yaml") . | sha256sum }}
|
|
spec:
|
|
automountServiceAccountToken: false
|
|
securityContext:
|
|
{{- toYaml .Values.xxx.securityContext.pod | nindent 8 }}
|
|
containers:
|
|
- name: {{ .Release.Name }}-{{ .Chart.Name }}-sfs
|
|
image: "registry/image:{{ .Chart.AppVersion }}"
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
{{- range $value := .Values.xxx.env }}
|
|
{{- if $value.value }}
|
|
- name: {{ $value.name }}
|
|
value: {{ tpl $value.value $ }}
|
|
{{- else if $value.valueFrom }}
|
|
{{- if $value.valueFrom.secretKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: {{ tpl $value.valueFrom.secretKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.secretKeyRef.key $ }}
|
|
{{- else if $value.valueFrom.configMapKeyRef }}
|
|
- name: {{ $value.name }}
|
|
valueFrom:
|
|
configMapKeyRef:
|
|
name: {{ tpl $value.valueFrom.configMapKeyRef.name $ }}
|
|
key: {{ tpl $value.valueFrom.configMapKeyRef.key $ }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
ports:
|
|
{{- toYaml .Values.xxx.ports | nindent 12 }}
|
|
livenessProbe:
|
|
{{- toYaml .Values.xxx.livenessProbe | nindent 12 }}
|
|
readinessProbe:
|
|
{{- toYaml .Values.xxx.readinessProbe | nindent 12 }}
|
|
startupProbe:
|
|
{{- toYaml .Values.xxx.startupProbe | nindent 12 }}
|
|
resources:
|
|
{{- include "xxx.resources" .Values.xxx.resources | nindent 12 }}
|
|
securityContext:
|
|
{{- toYaml .Values.xxx.securityContext.container | nindent 12 }}
|
|
restartPolicy: Always
|