server-acl-init-job.yaml

{{- if (or (and (ne (.Values.server.enabled | toString) "-") .Values.server.enabled) (and (eq (.Values.server.enabled | toString) "-") .Values.global.enabled)) }}
{{- if (or (and (ne (.Values.client.enabled | toString) "-") .Values.client.enabled) (and (eq (.Values.client.enabled | toString) "-") .Values.global.enabled)) }}
{{- if .Values.global.bootstrapACLs }}
apiVersion: batch/v1
kind: Job
metadata:
  name: {{ template "consul.fullname" . }}-server-acl-init
  namespace: {{ .Release.Namespace }}
  labels:
    app: {{ template "consul.name" . }}
    chart: {{ template "consul.chart" . }}
    heritage: {{ .Release.Service }}
    release: {{ .Release.Name }}
  annotations:
    "helm.sh/hook": post-install
    "helm.sh/hook-weight": "0"
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    metadata:
      name: {{ template "consul.fullname" . }}-server-acl-init
      labels:
        app: {{ template "consul.name" . }}
        chart: {{ template "consul.chart" . }}
        release: {{ .Release.Name }}
        component: server-acl-init
      annotations:
        "consul.hashicorp.com/connect-inject": "false"
    spec:
      restartPolicy: Never
      serviceAccountName: {{ template "consul.fullname" . }}-server-acl-init
      containers:
        - name: post-install-job
          image: {{ .Values.global.imageK8S }}
          env:
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          command:
            - "/bin/sh"
            - "-ec"
            - |
              consul-k8s server-acl-init \
                -release-name={{ .Release.Name }} \
                -k8s-namespace={{ .Release.Namespace }} \
                {{- if .Values.syncCatalog.enabled }}
                -create-sync-token=true \
                {{- end }}
                {{- if (or (and (ne (.Values.dns.enabled | toString) "-") .Values.dns.enabled) (and (eq (.Values.dns.enabled | toString) "-") .Values.global.enabled)) }}
                -allow-dns=true \
                {{- end }}
                {{- if .Values.connectInject.enabled }}
                -create-inject-token=true \
                {{- end }}
                {{- if .Values.meshGateway.enabled }}
                -create-mesh-gateway-token=true \
                {{- end }}
                {{- if .Values.connectInject.aclBindingRuleSelector }}
                -acl-binding-rule-selector={{ .Values.connectInject.aclBindingRuleSelector }} \
                {{- end }}
                {{- if (and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey) }}
                -create-enterprise-license-token=true \
                {{- end }}
                {{- if .Values.client.snapshotAgent.enabled }}
                -create-snapshot-agent-token=true \
                {{- end }}
                -expected-replicas={{ .Values.server.replicas }}
{{- end }}
{{- end }}
{{- end }}