Use command and args

With recent k8s-keystone-auth images startup by shell script is not
possible.

This PS uses command/args in the deployment instead.

Change-Id: Iabd0d190c2461dbcdc8576f4a597384f46967daa

charts/apiserver-webhook/templates/bin/_webhook_start.sh.tpl

@@ -1,37 +0,0 @@
-#!/bin/sh
-
-{{/*
-Copyright 2018 The Openstack-Helm Authors.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/}}
-
-set -xe
-
-SERVER_CERT_FILE=${SERVER_CERT_FILE:-"/etc/webhook_apiserver/pki/tls.crt"}
-SERVER_KEY_FILE=${SERVER_KEY_FILE:-"/etc/webhook_apiserver/pki/tls.key"}
-POLICY_FILE=${POLICY_FILE:-"/etc/webhook_apiserver/policy.json"}
-SERVER_PORT=${SERVER_PORT:-"8443"}
-KEYSTONE_CA_FILE=${KEYSTONE_CA_FILE:-"/etc/webhook_apiserver/pki/keystone.pem"}
-
-exec /bin/k8s-keystone-auth \
-  --v 5 \
-  --tls-cert-file "${SERVER_CERT_FILE}" \
-  --tls-private-key-file "${SERVER_KEY_FILE}" \
-  --keystone-policy-file "${POLICY_FILE}" \
-  --listen "127.0.0.1:${SERVER_PORT}" \
-{{- if hasKey .Values.certificates "keystone" }}
-  --keystone-ca-file "${KEYSTONE_CA_FILE}" \
-{{- end }}
-  --keystone-url {{ tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" }}
-

charts/apiserver-webhook/templates/configmap-bin.yaml

@@ -24,7 +24,4 @@ metadata:
 data:
   ks-user.sh: |-
 {{- include "helm-toolkit.scripts.keystone_user" $envAll | indent 4 }}
-  webhook_start.sh: |-
-{{ tuple "bin/_webhook_start.sh.tpl" $envAll | include "helm-toolkit.utils.template" | indent 4 }}
-...
 {{- end }}

charts/apiserver-webhook/templates/deployment.yaml

@@ -121,7 +121,6 @@ spec:
       annotations:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "apiserver-webhook" "containerNames" (list "apiserver" "webhook") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
-        configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
         dynamic-config-hash: {{ tuple "config-dynamic-config.yaml" . | include "helm-toolkit.utils.hash" }}
     spec:
@@ -226,22 +225,27 @@ spec:
 {{ tuple $envAll $envAll.Values.pod.resources.server | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
 {{ dict "envAll" $envAll "application" "apiserver_webhook" "container" "webhook" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
           command:
-            - /tmp/webhook_start.sh
+            - "/bin/k8s-keystone-auth"
+          args:
+            - "--v"
+            - {{ .Values.apiserver_webhook.logging.log_level | quote }}
+            - "--tls-cert-file"
+            - {{ tuple "keystone_webhook" "server" $envAll.Values.conf.paths.pki "cert" $envAll | include "local.cert_bundle_path" | quote }}
+            - "--tls-private-key-file"
+            - {{ tuple "keystone_webhook" "server" $envAll.Values.conf.paths.pki "key" $envAll | include "local.cert_bundle_path" | quote }}
+            - "--keystone-policy-file"
+            - {{ $envAll.Values.conf.paths.policy | quote }}
+            - "--listen"
+            - "127.0.0.1:{{ tuple "webhook_apiserver" "podport" "webhook" $envAll | include "helm-toolkit.endpoints.endpoint_port_lookup" }}"
+{{- if hasKey .Values.certificates "keystone" }}
+            - "--keystone-ca-file"
+            - {{ tuple "keystone" "server" $envAll.Values.conf.paths.pki "ca" $envAll | include "local.cert_bundle_path" | quote }}
+{{- end }}
+            - "--keystone-url"
+            - {{ tuple "identity" "internal" "api" . | include "helm-toolkit.endpoints.keystone_endpoint_uri_lookup" | quote }}
           env:
 {{- with $env := dict "ksUserSecret" .Values.secrets.identity.webhook }}
 {{- include "helm-toolkit.snippets.keystone_openrc_env_vars" $env | indent 12 }}
-{{- end }}
-            - name: SERVER_CERT_FILE
-              value: {{ tuple "keystone_webhook" "server" $envAll.Values.conf.paths.pki "cert" $envAll | include "local.cert_bundle_path" | quote }}
-            - name: SERVER_KEY_FILE
-              value: {{ tuple "keystone_webhook" "server" $envAll.Values.conf.paths.pki "key" $envAll | include "local.cert_bundle_path" | quote }}
-            - name: POLICY_FILE
-              value: {{ $envAll.Values.conf.paths.policy | quote }}
-            - name: SERVER_PORT
-              value: {{ tuple "webhook_apiserver" "podport" "webhook" $envAll | include "helm-toolkit.endpoints.endpoint_port_lookup" | quote }}
-{{- if hasKey .Values.certificates "keystone" }}
-            - name: KEYSTONE_CA_FILE
-              value: {{ tuple "keystone" "server" $envAll.Values.conf.paths.pki "ca" $envAll | include "local.cert_bundle_path" | quote }}
 {{- end }}
           volumeMounts:
             - name: etc-webhook
@@ -252,10 +256,6 @@ spec:
               mountPath: {{ $envAll.Values.conf.paths.policy }}
               subPath: policy.json
               readOnly: true
-            - name: configmap-bin
-              mountPath: /tmp/webhook_start.sh
-              subPath: webhook_start.sh
-              readOnly: true
 {{ tuple "keystone_webhook" "server" $envAll.Values.conf.paths.pki $envAll | include "local.mount_cert_bundle" | indent 12 }}
 {{ if $mounts_webhook.volumeMounts }}{{ toYaml $mounts_webhook.volumeMounts | indent 12 }}{{ end }}
       volumes:
@@ -283,10 +283,6 @@ spec:
           secret:
             secretName: {{ .Release.Name }}-keys
             defaultMode: 0444
-        - name: configmap-bin
-          configMap:
-            name: {{ .Release.Name }}-bin
-            defaultMode: 0555
         - name: tls-apiserver-webhook-public-server
           secret:
             defaultMode: 292