feat: [sc-19068] Support isolated gofer fire-drill sidecars

charts/gofer/Chart.yaml

@@ -23,7 +23,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.4.3
+version: 0.4.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/gofer/README.md

@@ -1,6 +1,6 @@
 # gofer
 
-![Version: 0.4.3](https://img.shields.io/badge/Version-0.4.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.61](https://img.shields.io/badge/AppVersion-0.61-informational?style=flat-square)
+![Version: 0.4.4](https://img.shields.io/badge/Version-0.4.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.61](https://img.shields.io/badge/AppVersion-0.61-informational?style=flat-square)
 
 A Helm chart for deploying gofer to Kubernetes
 
@@ -17,6 +17,7 @@ A Helm chart for deploying gofer to Kubernetes
 |-----|------|---------|-------------|
 | affinity | object | `{}` |  |
 | argsOverride | list | `[]` | Note: If you want to override the default command and args, use `argsOverride` and `entryPointOverride`. |
+| automountServiceAccountToken | string | `nil` | Override whether Kubernetes mounts the service-account token into gofer pods. |
 | autoscaling.enabled | bool | `false` |  |
 | autoscaling.maxReplicas | int | `100` |  |
 | autoscaling.minReplicas | int | `1` |  |
@@ -26,7 +27,9 @@ A Helm chart for deploying gofer to Kubernetes
 | env | object | `{"normal":{},"raw":{}}` | Environment variable listing |
 | env.normal | object | `{}` | un-encrypted env vars passed to the pod |
 | extraArgs | list | `[]` |  |
+| extraContainers | list | `[]` | Additional containers to run in the gofer pod. |
 | extraObjects | list | `[]` | Extra K8s manifests to deploy |
+| extraVolumes | list | `[]` | Additional volumes to make available to containers in the gofer pod. |
 | fullnameOverride | string | `""` |  |
 | goferMode | string | `"run"` | can be `run`, `models`, `data`, or `proxy` |
 | image.pullPolicy | string | `"IfNotPresent"` |  |

charts/gofer/ci/pod-extensions-values.yaml

@@ -0,0 +1,28 @@
+automountServiceAccountToken: false
+
+extraContainers:
+  - name: auxiliary
+    image: registry.k8s.io/pause:3.10.1@sha256:278fb9dbcca9518083ad1e11276933a2e96f23de604a3a08cc3c80002767d24c
+    imagePullPolicy: IfNotPresent
+    securityContext:
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop:
+          - ALL
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 65532
+    resources:
+      requests:
+        cpu: 1m
+        memory: 4Mi
+      limits:
+        cpu: 10m
+        memory: 16Mi
+    volumeMounts:
+      - name: auxiliary-data
+        mountPath: /var/run/auxiliary
+
+extraVolumes:
+  - name: auxiliary-data
+    emptyDir: {}

charts/gofer/ci/proxy-values.yaml

@@ -7,14 +7,14 @@ env:
 
 livenessProbe:
   httpGet:
-    path: /livez
-    port: gofer
+    path: /healthz
+    port: healthcheck
   initialDelaySeconds: 60
   periodSeconds: 120
 
 readinessProbe:
   httpGet:
-    path: /readyz
-    port: gofer
+    path: /healthz
+    port: healthcheck
   initialDelaySeconds: 60
   periodSeconds: 60

charts/gofer/templates/deployment.yaml

@@ -28,6 +28,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "gofer.serviceAccountName" . }}
+      {{- if not (eq .Values.automountServiceAccountToken nil) }}
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+      {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
@@ -80,6 +83,13 @@ spec:
           {{- if .Values.env.raw }}
             {{- toYaml .Values.env.raw | nindent 12 }}
           {{- end }}
+        {{- with .Values.extraContainers }}
+        {{- toYaml . | nindent 8 }}
+        {{- end }}
+      {{- with .Values.extraVolumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

charts/gofer/values.yaml

@@ -48,6 +48,15 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+# -- Override whether Kubernetes mounts the service-account token into gofer pods.
+automountServiceAccountToken: null
+
+# -- Additional containers to run in the gofer pod.
+extraContainers: []
+
+# -- Additional volumes to make available to containers in the gofer pod.
+extraVolumes: []
+
 serviceAccount:
   # Specifies whether a service account should be created
   create: true
@@ -105,7 +114,7 @@ livenessProbe: {}
   # -- for proxy mode:
   # httpGet:
   #   path: /healthz
-  #   port: gofer
+  #   port: healthcheck
   # initialDelaySeconds: 60
   # periodSeconds: 120
 
@@ -118,7 +127,7 @@ readinessProbe: {}
   # -- for proxy mode:
   # httpGet:
   #   path: /healthz
-  #   port: gofer
+  #   port: healthcheck
   # initialDelaySeconds: 60
   # periodSeconds: 60