apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    app: envoy
  name: envoy
  namespace: projectcontour
spec:
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
  selector:
    matchLabels:
      app: envoy
  template:
    metadata:
      labels:
        app: envoy
    spec:
      initContainers:
      - name: envoy-internal-initconfig
        image: knative.dev/net-contour/vendor/github.com/projectcontour/contour/cmd/contour
        imagePullPolicy: IfNotPresent
        args:
        - bootstrap
        - /config/envoy.json
        - --xds-address=contour-internal
        - --xds-port=8001
        - --admin-port=9001
        - --envoy-cafile=/ca/cacert.pem
        - --envoy-cert-file=/certs/tls.crt
        - --envoy-key-file=/certs/tls.key
        volumeMounts:
        - name: envoy-internal-config
          mountPath: /config
        - name: envoycert
          mountPath: /certs
          readOnly: true
        - name: cacert
          mountPath: /ca
          readOnly: true
        env:
        - name: CONTOUR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
      - name: envoy-external-initconfig
        image: knative.dev/net-contour/vendor/github.com/projectcontour/contour/cmd/contour
        imagePullPolicy: IfNotPresent
        args:
        - bootstrap
        - /config/envoy.json
        - --xds-address=contour-external
        - --xds-port=8001
        - --admin-port=9002
        - --envoy-cafile=/ca/cacert.pem
        - --envoy-cert-file=/certs/tls.crt
        - --envoy-key-file=/certs/tls.key
        volumeMounts:
        - name: envoy-external-config
          mountPath: /config
        - name: envoycert
          mountPath: /certs
          readOnly: true
        - name: cacert
          mountPath: /ca
          readOnly: true
        env:
        - name: CONTOUR_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace

      containers:
      - name: envoy-internal
        image: docker.io/envoyproxy/envoy:v1.12.2
        imagePullPolicy: IfNotPresent
        command:
        - envoy
        args:
        - -c
        - /config/envoy.json
        - --base-id 1
        - --service-cluster $(CONTOUR_NAMESPACE)
        - --service-node $(ENVOY_POD_NAME)
        - --log-level info
        env:
        - name: CONTOUR_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: ENVOY_POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        ports:
        - name: http
          containerPort: 8081
        readinessProbe:
          httpGet:
            path: /ready
            port: 8002
          initialDelaySeconds: 3
          periodSeconds: 3
        volumeMounts:
          - name: envoy-internal-config
            mountPath: /config
          - name: envoycert
            mountPath: /certs
          - name: cacert
            mountPath: /ca
        lifecycle:
          preStop:
            exec:
              command:
              - bash
              - -c
              - --
              - echo
              - -ne
              - "POST /healthcheck/fail HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"
              - '>/dev/tcp/localhost/9001'
      - name: envoy-external
        image: docker.io/envoyproxy/envoy:v1.12.2
        imagePullPolicy: IfNotPresent
        command:
        - envoy
        args:
        - -c
        - /config/envoy.json
        - --base-id 2
        - --service-cluster $(CONTOUR_NAMESPACE)
        - --service-node $(ENVOY_POD_NAME)
        - --log-level info
        env:
        - name: CONTOUR_NAMESPACE
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
        - name: ENVOY_POD_NAME
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        ports:
        - name: http
          containerPort: 8080
        - name: https
          containerPort: 8443
        readinessProbe:
          httpGet:
            path: /ready
            port: 8002
          initialDelaySeconds: 3
          periodSeconds: 3
        volumeMounts:
          - name: envoy-external-config
            mountPath: /config
          - name: envoycert
            mountPath: /certs
          - name: cacert
            mountPath: /ca
        lifecycle:
          preStop:
            exec:
              command:
              - bash
              - -c
              - --
              - echo
              - -ne
              - "POST /healthcheck/fail HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"
              - '>/dev/tcp/localhost/9002'

      automountServiceAccountToken: false
      volumes:
        - name: envoy-internal-config
          emptyDir: {}
        - name: envoy-external-config
          emptyDir: {}
        - name: envoycert
          secret:
            secretName: envoycert
        - name: cacert
          secret:
            secretName: cacert
      restartPolicy: Always
