BuildShardDeployment clones the helm-controller container out of the flux-aio Deployment and sanitises it into a standalone single-shard Deployment: - hostNetwork off (flux-aio is hostNetwork:true; N shard pods would collide on host ports 9795/9796), DNS policy back to ClusterFirst; - only the helm
(flux *appsv1.Deployment, idx int, cfg *Config)
| 265 | // app.kubernetes.io/name=flux and would otherwise leave every shard |
| 266 | // Pending on a single-node cluster. |
| 267 | func BuildShardDeployment(flux *appsv1.Deployment, idx int, cfg *Config) (*appsv1.Deployment, error) { |
| 268 | var src *corev1.Container |
| 269 | for i := range flux.Spec.Template.Spec.Containers { |
| 270 | if flux.Spec.Template.Spec.Containers[i].Name == HelmControllerContainerName { |
| 271 | src = &flux.Spec.Template.Spec.Containers[i] |
| 272 | break |
| 273 | } |
| 274 | } |
| 275 | if src == nil { |
| 276 | return nil, fmt.Errorf("container %q not found in Deployment %s/%s", |
| 277 | HelmControllerContainerName, flux.Namespace, flux.Name) |
| 278 | } |
| 279 | |
| 280 | podSpec := flux.Spec.Template.Spec.DeepCopy() |
| 281 | hc := src.DeepCopy() |
| 282 | |
| 283 | selectorArg := "--watch-label-selector=" + ShardKeyLabel + "=" + ShardName(idx) |
| 284 | concurrentArg := "--concurrent=" + strconv.Itoa(cfg.ShardConcurrent) |
| 285 | args := make([]string, 0, len(hc.Args)) |
| 286 | haveSelector, haveConcurrent := false, false |
| 287 | for _, arg := range hc.Args { |
| 288 | switch { |
| 289 | case strings.HasPrefix(arg, "--events-addr"): |
| 290 | continue |
| 291 | case strings.HasPrefix(arg, "--watch-label-selector"): |
| 292 | args, haveSelector = append(args, selectorArg), true |
| 293 | case strings.HasPrefix(arg, "--concurrent"): |
| 294 | args, haveConcurrent = append(args, concurrentArg), true |
| 295 | default: |
| 296 | args = append(args, arg) |
| 297 | } |
| 298 | } |
| 299 | if !haveSelector { |
| 300 | args = append(args, selectorArg) |
| 301 | } |
| 302 | if !haveConcurrent { |
| 303 | args = append(args, concurrentArg) |
| 304 | } |
| 305 | hc.Args = args |
| 306 | |
| 307 | env := make([]corev1.EnvVar, 0, len(hc.Env)) |
| 308 | for _, e := range hc.Env { |
| 309 | switch e.Name { |
| 310 | // Localhost cross-container wiring of the all-in-one pod. |
| 311 | case "SOURCE_CONTROLLER_LOCALHOST", "SOURCE_WATCHER_LOCALHOST": |
| 312 | continue |
| 313 | // The installer injects the node-local apiserver endpoint (e.g. Talos |
| 314 | // KubePrism localhost:7445) into hostNetwork workloads |
| 315 | // (internal/fluxinstall injectKubernetesServiceEnv). The sanitised pod |
| 316 | // is not hostNetwork, so it must fall back to the in-cluster defaults. |
| 317 | case "KUBERNETES_SERVICE_HOST", "KUBERNETES_SERVICE_PORT": |
| 318 | continue |
| 319 | } |
| 320 | env = append(env, e) |
| 321 | } |
| 322 | hc.Env = env |
| 323 | |
| 324 | // Merge per resource name so an unset value inherits the cloned one, as |