apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: envoy
  namespace: contour-external
  labels:
    app: envoy
    networking.knative.dev/ingress-provider: contour
spec:
  selector:
    matchLabels:
      app: envoy
  template:
    metadata:
      labels:
        app: envoy
      annotations:
        prometheus.io/path: /stats/prometheus
        prometheus.io/port: "8002"
        prometheus.io/scrape: "true"
    spec:
      restartPolicy: Always
      terminationGracePeriodSeconds: 300
      serviceAccountName: envoy
      automountServiceAccountToken: false
      initContainers:
        - name: envoy-initconfig
          image: gcr.io/knative-releases/github.com/projectcontour/contour/cmd/contour@sha256:7212e8d3fb415189d5bd361dde75816447a4bd3c5b949c74f6fe2695b9a8d2c4
          command:
            - contour
          args:
            - bootstrap
            - /config/envoy.json
            - --xds-address=contour
            - --xds-port=8001
            - --xds-resource-version=v3
            - --resources-dir=/config/resources
            - --envoy-cafile=/certs/ca.crt
            - --envoy-cert-file=/certs/tls.crt
            - --envoy-key-file=/certs/tls.key
          env:
            - name: CONTOUR_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          volumeMounts:
            - name: envoy-config
              mountPath: /config
            - name: envoycert
              readOnly: true
              mountPath: /certs
          imagePullPolicy: IfNotPresent
      containers:
        - name: envoy
          image: docker.io/envoyproxy/envoy:v1.19.1
          command:
            - envoy
          args:
            - -c
            - /config/envoy.json
            - --service-cluster $(CONTOUR_NAMESPACE)
            - --service-node $(ENVOY_POD_NAME)
            - --log-level info
          ports:
            - name: http
              protocol: TCP
              containerPort: 8080
              hostPort: 80
            - name: https
              protocol: TCP
              containerPort: 8443
              hostPort: 443
          env:
            - name: CONTOUR_NAMESPACE
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace
            - name: ENVOY_POD_NAME
              valueFrom:
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.name
          resources:
            limits:
              cpu: 500m
              memory: 500Mi
            requests:
              cpu: 200m
              memory: 200Mi
          volumeMounts:
            - name: envoy-config
              readOnly: true
              mountPath: /config
            - name: envoycert
              readOnly: true
              mountPath: /certs
            - name: envoy-admin
              mountPath: /admin
          readinessProbe:
            httpGet:
              port: 8002
              path: /ready
            initialDelaySeconds: 3
            periodSeconds: 4
          lifecycle:
            preStop:
              httpGet:
                port: 8090
                path: /shutdown
                scheme: HTTP
          imagePullPolicy: IfNotPresent
        - name: shutdown-manager
          image: gcr.io/knative-releases/github.com/projectcontour/contour/cmd/contour@sha256:7212e8d3fb415189d5bd361dde75816447a4bd3c5b949c74f6fe2695b9a8d2c4
          command:
            - contour
          args:
            - envoy
            - shutdown-manager
          resources:
            limits:
              cpu: 400m
              memory: 400Mi
            requests:
              cpu: 40m
              memory: 40Mi
          volumeMounts:
            - name: envoy-admin
              mountPath: /admin
          livenessProbe:
            httpGet:
              port: 8090
              path: /healthz
            initialDelaySeconds: 3
            periodSeconds: 10
          lifecycle:
            preStop:
              exec:
                command:
                  - contour
                  - envoy
                  - shutdown
          imagePullPolicy: IfNotPresent
      volumes:
        - name: envoy-admin
          emptyDir: {}
        - name: envoy-config
          emptyDir: {}
        - name: envoycert
          secret:
            secretName: envoycert
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 10%
