immutable-harness-delegate.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: delegate_ns

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: delegate_ns-cluster-admin
subjects:
  - kind: ServiceAccount
    name: default
    namespace: delegate_ns
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: v1
kind: Secret
metadata:
  name: delegate_name-account-token
  namespace: delegate_ns
type: Opaque
data:
  DELEGATE_TOKEN: "delegate_token"

---

# If delegate needs to use a proxy, please follow instructions available in the documentation
# https://ngdocs.harness.io/article/5ww21ewdt8-configure-delegate-proxy-settings

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    harness.io/name: delegate_name
  name: delegate_name
  namespace: delegate_ns
spec:
  replicas: delegate_replica
  selector:
    matchLabels:
      harness.io/name: delegate_name
  template:
    metadata:
      labels:
        harness.io/name: delegate_name
      annotations:
        prometheus.io/scrape: "true"
        prometheus.io/port: "3460"
        prometheus.io/path: "/api/metrics"
    spec:
      terminationGracePeriodSeconds: 600
      restartPolicy: Always
      containers:
      - image: harness/delegate-immutable:delegate_image
        imagePullPolicy: Always
        name: delegate
        securityContext:
          allowPrivilegeEscalation: false
          runAsUser: 0
        ports:
          - containerPort: 8080
        resources:
          limits:
            memory: "delegate_memory"
          requests:
            cpu: "delegate_cpu"
            memory: "delegate_memory"
        livenessProbe:
          httpGet:
            path: /api/health
            port: 3460
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          failureThreshold: 2
        startupProbe:
          httpGet:
            path: /api/health
            port: 3460
            scheme: HTTP
          initialDelaySeconds: 30
          periodSeconds: 10
          failureThreshold: 15
        envFrom:
        - secretRef:
            name: delegate_name-account-token
        env:
        - name: JAVA_OPTS
          value: "-Xms64M"
        - name: ACCOUNT_ID
          value: delegate_accountId
        - name: MANAGER_HOST_AND_PORT
          value: delegate_manager_host
        - name: DEPLOY_MODE
          value: KUBERNETES
        - name: DELEGATE_NAME
          value: delegate_name
        - name: DELEGATE_TYPE
          value: "KUBERNETES"
        - name: DELEGATE_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: INIT_SCRIPT
          value: "delegate_init_script"
        - name: DELEGATE_DESCRIPTION
          value: ""
        - name: DELEGATE_TAGS
          value: "delegate_tags"
        - name: NEXT_GEN
          value: "true"
        - name: CLIENT_TOOLS_DOWNLOAD_DISABLED
          value: "true"
        - name: LOG_STREAMING_SERVICE_URL
          value: "delegate_manager_host/log-service/"

---

apiVersion: v1
kind: Service
metadata:
  name: delegate-service
  namespace: delegate_ns
spec:
  type: ClusterIP
  selector:
    harness.io/name: delegate_name
  ports:
    - port: 8080

---

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: upgrader-cronjob
  namespace: delegate_ns
rules:
  - apiGroups: ["batch", "apps", "extensions"]
    resources: ["cronjobs"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: ["extensions", "apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]

---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: delegate_name-upgrader-cronjob
  namespace: delegate_ns
subjects:
  - kind: ServiceAccount
    name: upgrader-cronjob-sa
    namespace: delegate_ns
roleRef:
  kind: Role
  name: upgrader-cronjob
  apiGroup: ""

---

apiVersion: v1
kind: ServiceAccount
metadata:
  name: upgrader-cronjob-sa
  namespace: delegate_ns

---

apiVersion: v1
kind: Secret
metadata:
  name: delegate_name-upgrader-token
  namespace: delegate_ns
type: Opaque
data:
  UPGRADER_TOKEN: "delegate_token"

---

apiVersion: v1
kind: ConfigMap
metadata:
  name: delegate_name-upgrader-config
  namespace: delegate_ns
data:
  config.yaml: |
    mode: Delegate
    dryRun: false
    workloadName: delegate_name
    namespace: delegate_ns
    containerName: delegate
    delegateConfig:
      accountId: delegate_accountId
      managerHost: delegate_manager_host

---

apiVersion: batch/v1
kind: CronJob
metadata:
  labels:
    harness.io/name: delegate_name-upgrader-job
  name: delegate_name-upgrader-job
  namespace: delegate_ns
spec:
  schedule: "0 */1 * * *"
  concurrencyPolicy: Forbid
  startingDeadlineSeconds: 20
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: upgrader-cronjob-sa
          restartPolicy: Never
          containers:
          - image: harness/upgrader:latest
            name: upgrader
            imagePullPolicy: Always
            envFrom:
            - secretRef:
                name: delegate_name-upgrader-token
            volumeMounts:
              - name: config-volume
                mountPath: /etc/config
          volumes:
            - name: config-volume
              configMap:
                name: delegate_name-upgrader-config