Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-03-16 06:47:30 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
c4e23e0bed10742dfb4553773630da286c62b453
charts/bitnami/harbor/templates/trivy/trivy-sts.yaml
Juan Ariza Toledano 09e8b9c4cb [bitnami/harbor]: Use merge helper (#19049) 
Signed-off-by: juan131 <jariza@vmware.com>
2023-09-08 14:55:08 +02:00

222 lines
12 KiB
YAML
Raw Blame History

{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.trivy.enabled }}
apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }}
kind: StatefulSet
metadata:
name: {{ include "harbor.trivy" . }}
namespace: {{ .Release.Namespace | quote }}
labels: {{- include "common.labels.standard" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: trivy
{{- if .Values.commonAnnotations }}
annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
{{- end }}
spec:
replicas: {{ .Values.trivy.replicaCount }}
serviceName: {{ template "harbor.trivy" . }}
updateStrategy: {{- toYaml .Values.trivy.updateStrategy | nindent 4 }}
{{- $podLabels := include "common.tplvalues.merge" ( dict "values" ( list .Values.trivy.podLabels .Values.commonLabels ) "context" . ) }}
selector:
matchLabels: {{- include "common.labels.matchLabels" ( dict "customLabels" $podLabels "context" $ ) | nindent 6 }}
app.kubernetes.io/component: trivy
template:
metadata:
labels: {{- include "common.labels.standard" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }}
app.kubernetes.io/component: trivy
annotations:
checksum/configmap-env: {{ include (print $.Template.BasePath "/trivy/trivy-cm-envvars.yaml") . | sha256sum }}
checksum/secret-env: {{ include (print $.Template.BasePath "/trivy/trivy-secret-envvars.yaml") . | sha256sum }}
{{- if and .Values.internalTLS.enabled (not .Values.trivy.tls.existingSecret) }}
checksum/tls: {{ include (print $.Template.BasePath "/internal/internal-crt-secret.yaml") . | sha256sum }}
{{- end }}
{{- if .Values.trivy.podAnnotations }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.podAnnotations "context" $) | nindent 8 }}
{{- end }}
spec:
{{- include "harbor.imagePullSecrets" . | nindent 6 }}
{{- if .Values.trivy.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.hostAliases "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.trivy.affinity }}
affinity: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.affinity "context" $) | nindent 8 }}
{{- else }}
affinity:
podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.trivy.podAffinityPreset "component" "trivy" "customLabels" $podLabels "context" $) | nindent 10 }}
podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.trivy.podAntiAffinityPreset "component" "trivy" "customLabels" $podLabels "context" $) | nindent 10 }}
nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.trivy.nodeAffinityPreset.type "key" .Values.trivy.nodeAffinityPreset.key "values" .Values.trivy.nodeAffinityPreset.values) | nindent 10 }}
{{- end }}
{{- if .Values.trivy.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.nodeSelector "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.trivy.tolerations }}
tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.tolerations "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.trivy.topologySpreadConstraints }}
topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.topologySpreadConstraints "context" .) | nindent 8 }}
{{- end }}
{{- if .Values.trivy.priorityClassName }}
priorityClassName: {{ .Values.trivy.priorityClassName | quote }}
{{- end }}
{{- if .Values.trivy.schedulerName }}
schedulerName: {{ .Values.trivy.schedulerName }}
{{- end }}
{{- if .Values.trivy.podSecurityContext.enabled }}
securityContext: {{- omit .Values.trivy.podSecurityContext "enabled" | toYaml | nindent 8 }}
{{- end }}
automountServiceAccountToken: {{ .Values.trivy.automountServiceAccountToken }}
initContainers:
{{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
- name: volume-permissions
image: {{ include "harbor.volumePermissions.image" . }}
imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }}
command:
- /bin/bash
args:
- -ec
- |
mkdir -p {{ .Values.trivy.cacheDir }} {{ .Values.trivy.cacheDir }}/trivy {{ .Values.trivy.cacheDir }}/reports
find {{ .Values.trivy.cacheDir }} -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | xargs -r chown -R {{ .Values.trivy.containerSecurityContext.runAsUser }}:{{ .Values.trivy.podSecurityContext.fsGroup }}
{{- if .Values.volumePermissions.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.volumePermissions.resources }}
resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: data
mountPath: {{ .Values.trivy.cacheDir }}
{{- end }}
{{- if .Values.trivy.initContainers }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.initContainers "context" $) | nindent 8 }}
{{- end }}
containers:
- name: trivy
image: {{ include "harbor.trivy.image" . }}
imagePullPolicy: {{ .Values.trivy.image.pullPolicy | quote }}
{{- if .Values.trivy.containerSecurityContext.enabled }}
securityContext: {{- omit .Values.trivy.containerSecurityContext "enabled" | toYaml | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }}
{{- else if .Values.trivy.command }}
command: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.command "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.diagnosticMode.enabled }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }}
{{- else if .Values.trivy.args }}
args: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.args "context" $) | nindent 12 }}
{{- end }}
env:
- name: BITNAMI_DEBUG
value: {{ ternary "true" "false" .Values.trivy.image.debug | quote }}
{{- if .Values.trivy.extraEnvVars }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.extraEnvVars "context" $) | nindent 12 }}
{{- end }}
envFrom:
- configMapRef:
name: {{ printf "%s-envvars" (include "harbor.trivy" .) }}
- secretRef:
name: {{ printf "%s-envvars" (include "harbor.trivy" .) }}
{{- if .Values.trivy.extraEnvVarsCM }}
- configMapRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.trivy.extraEnvVarsCM "context" $) }}
{{- end }}
{{- if .Values.trivy.extraEnvVarsSecret }}
- secretRef:
name: {{ include "common.tplvalues.render" (dict "value" .Values.trivy.extraEnvVarsSecret "context" $) }}
{{- end }}
ports:
- name: api-server
containerPort: {{ ternary .Values.trivy.containerPorts.https .Values.trivy.containerPorts.http .Values.internalTLS.enabled }}
{{- if not .Values.diagnosticMode.enabled }}
{{- if .Values.trivy.customStartupProbe }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customStartupProbe "context" $) | nindent 12 }}
{{- else if .Values.trivy.startupProbe.enabled }}
startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.startupProbe "enabled") "context" $) | nindent 12 }}
tcpSocket:
port: api-server
{{- end }}
{{- if .Values.trivy.customLivenessProbe }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customLivenessProbe "context" $) | nindent 12 }}
{{- else if .Values.trivy.livenessProbe.enabled }}
livenessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.livenessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
path: /probe/healthy
port: api-server
{{- end }}
{{- if .Values.trivy.customReadinessProbe }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.customReadinessProbe "context" $) | nindent 12 }}
{{- else if .Values.trivy.readinessProbe.enabled }}
readinessProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.trivy.readinessProbe "enabled") "context" $) | nindent 12 }}
httpGet:
scheme: {{ ternary "https" "http" .Values.internalTLS.enabled | upper }}
path: /probe/ready
port: api-server
{{- end }}
{{- end }}
{{- if .Values.trivy.lifecycleHooks }}
lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.trivy.lifecycleHooks "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.resources }}
resources: {{- toYaml .Values.trivy.resources | nindent 12 }}
{{- end }}
volumeMounts:
- name: data
mountPath: {{ .Values.trivy.cacheDir }}
readOnly: false
{{- if .Values.internalTLS.enabled }}
- name: internal-tls-certs
mountPath: /etc/harbor/ssl/trivy
{{- end }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolumeMount" . | nindent 12 }}
{{- end }}
{{- if .Values.trivy.extraVolumeMounts }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.extraVolumeMounts "context" $) | nindent 12 }}
{{- end }}
{{- if .Values.trivy.sidecars }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.sidecars "context" $) | nindent 8 }}
{{- end }}
volumes:
{{- if .Values.internalTLS.enabled }}
- name: internal-tls-certs
secret:
secretName: {{ include "harbor.trivy.tls.secretName" . }}
{{- end }}
{{- if .Values.internalTLS.caBundleSecret }}
{{- include "harbor.caBundleVolume" . | nindent 8 }}
{{- end }}
{{- if not .Values.persistence.enabled }}
- name: data
emptyDir: {}
{{- end }}
{{- if .Values.trivy.extraVolumes }}
{{- include "common.tplvalues.render" (dict "value" .Values.trivy.extraVolumes "context" $) | nindent 8 }}
{{- end }}
{{- if .Values.persistence.enabled }}
volumeClaimTemplates:
- metadata:
name: data
labels: {{- include "common.labels.matchLabels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 10 }}
{{- if .Values.persistence.persistentVolumeClaim.trivy.annotations }}
annotations: {{- toYaml .Values.persistence.persistentVolumeClaim.trivy.annotations | nindent 10 }}
{{- end }}
spec:
accessModes:
{{- range .Values.persistence.persistentVolumeClaim.trivy.accessModes }}
- {{ . | quote }}
{{- end }}
resources:
requests:
storage: {{ .Values.persistence.persistentVolumeClaim.trivy.size | quote }}
{{- if .Values.persistence.persistentVolumeClaim.trivy.selector }}
selector: {{- include "common.tplvalues.render" (dict "value" .Values.persistence.persistentVolumeClaim.trivy.selector "context" $) | nindent 10 }}
{{- end }}
{{- include "common.storage.class" ( dict "persistence" .Values.persistence.persistentVolumeClaim.trivy "global" .Values.global ) | nindent 8 }}
{{- end }}
{{- end }}
Reference in New Issue View Git Blame Copy Permalink