pod.yaml

api: 1.0.0-beta2
runtime: podman
podVersion: 0.2.0

volumes:
      # conf name hardcoded into the ingress generator and cannot be changed.
      # The generated haproxy.cfg file is written to it inside the cluster project `cluster_dir/_config/ingress/conf` directory.
#ifntrue ${devmode}
    - name: conf
      type: config
#endif
#iftrue ${devmode}
    # In devmode we have to use a already existing haproxy.cfg
    - name: _devconf
      type: config
#endif

      # Certs provided by the auto issuer pod (letsencrypt pod) are fetched to this volume.
      # If these auto certs are not used, this volume must still be present otherwise the haproxy.cfg will fail.
    - name: autocerts
      type: ramdisk
      size: 28M

      # User provided certs, such as Extended Validation certificates which include human validation.
      # Certs are to be placed here (`cluster_dir/_config/ingress/usercerts`) manually by the user and synced.
    - name: usercerts
      type: config
      # We can make this into an encrypted secret (when that feature is implemented in sns).
      encrypted: false
containers:
#iftrue ${useFetcher}
    - name: fetcher
      image: ghcr.io/simplenetes-io/ingress-fetcher:${podVersion}
      # Restart this container once each 12 hours to fetch any updated certificates.
      restart: on-interval:43200
      env:
            # This is the cluster port the Letsencrypt pod is listening to.
            # Set it as en env variable which our "fetcher" program will use.
          - name: autoCertClusterPort
            value: 64000
      mounts:
          # This is the RAMDISK defined above, to here fetched certificates are written.
          # The destination is hardcoded into the fetcher program.
          - volume: autocerts
            dest: /mnt/autocerts
      startupProbe:
          # Allow 20 seconds for the container to get started.
          timeout: 20

          # Our probe is simply that we wait for the container to exit with code 0.
          exit: true

          # Signal the haproxy container to reload when we exit successfully.
          # This will make the haproxy container reload once every 12 h, regardless of there are new certs or not. But there's no harm in doing this so instead
          # of complicating the logic of not reloading when there are no new certs, we KISS it and only provide this simpler path.
          # Since we have a startup probe, that means that the pod creation process will fail if this container does not exit properly.
          signal:
              - container: haproxy
#endif
    - name: haproxy
      image: haproxy:2.1.3-alpine
      restart: always
      # Using the host network means that haproxy will bind directly to the host interface,
      # and no port mappings need to be done.
      network: host
      signal:
          - sig: USR2
      command:
          - haproxy
          - -f
          - /mnt/conf/haproxy.cfg
          - -W
      mounts:
            # The destinations for mounting certs are hardcoded into the ingress haproxy.cfg generator and must not be changed.
          - volume: usercerts
            dest: /mnt/usercerts
          - volume: autocerts
            dest: /mnt/autocerts
#iftrue ${devmode}
          - volume: _devconf
            dest: /mnt/conf
#endif
#ifntrue ${devmode}
          - volume: conf
            dest: /mnt/conf
#endif