chart/nova: update to the latest version

- includes a bug fix for dealing with null value of log_config_append
- includes several features, not used for now
- remove local patch to role vars

.charts.yml

@@ -151,14 +151,9 @@ charts:
     repository:
       url: https://kubernetes-sigs.github.io/node-feature-discovery/charts
   - name: nova
-    version: 0.3.27
+    version: 0.3.46
     repository: *openstack_helm_repository
     dependencies: *openstack_helm_dependencies
-    patches:
-      gerrit:
-        review.opendev.org:
-          - 899809
-          - 904250
   - name: octavia
     version: 0.2.9
     repository: *openstack_helm_repository

charts/nova/Chart.yaml

@@ -9,4 +9,4 @@ name: nova
 sources:
 - https://opendev.org/openstack/nova
 - https://opendev.org/openstack/openstack-helm
-version: 0.3.27
+version: 0.3.46

charts/nova/templates/bin/_cell-setup-init.sh.tpl

@@ -69,3 +69,7 @@ until openstack compute service list --service nova-compute -f value -c State |
   echo "Waiting for Nova Compute processes to register"
   sleep 10
 done
+
+{{- if .Values.jobs.cell_setup.extra_command }}
+{{ .Values.jobs.cell_setup.extra_command }}
+{{- end }}

charts/nova/templates/bin/_nova-compute-init.sh.tpl

@@ -26,7 +26,11 @@ migration_interface="{{- .Values.conf.libvirt.live_migration_interface -}}"
 if [[ -z $migration_interface ]]; then
     # search for interface with default routing
     # If there is not default gateway, exit
-    migration_interface=$(ip -4 route list 0/0 | awk -F 'dev' '{ print $2; exit }' | awk '{ print $1 }') || exit 1
+    migration_network_cidr="{{- .Values.conf.libvirt.live_migration_network_cidr -}}"
+    if [ -z "${migration_network_cidr}" ] ; then
+        migration_network_cidr="0/0"
+    fi
+    migration_interface=$(ip -4 route list ${migration_network_cidr} | awk -F 'dev' '{ print $2; exit }' | awk '{ print $1 }') || exit 1
 fi
 
 migration_address=$(ip a s $migration_interface | grep 'inet ' | awk '{print $2}' | awk -F "/" '{print $1}' | head -1)
@@ -45,7 +49,11 @@ hypervisor_interface="{{- .Values.conf.hypervisor.host_interface -}}"
 if [[ -z $hypervisor_interface ]]; then
     # search for interface with default routing
     # If there is not default gateway, exit
-    hypervisor_interface=$(ip -4 route list 0/0 | awk -F 'dev' '{ print $2; exit }' | awk '{ print $1 }') || exit 1
+    hypervisor_network_cidr="{{- .Values.conf.hypervisor.host_network_cidr -}}"
+    if [ -z "${hypervisor_network_cidr}" ] ; then
+        hypervisor_network_cidr="0/0"
+    fi
+    hypervisor_interface=$(ip -4 route list ${hypervisor_network_cidr} | awk -F 'dev' '{ print $2; exit }' | awk '{ print $1 }') || exit 1
 fi
 
 hypervisor_address=$(ip a s $hypervisor_interface | grep 'inet ' | awk '{print $2}' | awk -F "/" '{print $1}' | head -1)

charts/nova/templates/bin/_nova-console-compute-init.sh.tpl

@@ -21,25 +21,25 @@ console_kind="{{- .Values.console.console_kind -}}"
 if [ "${console_kind}" == "novnc" ] ; then
     client_address="{{- .Values.conf.nova.vnc.server_proxyclient_address -}}"
     client_interface="{{- .Values.console.novnc.compute.vncserver_proxyclient_interface -}}"
+    client_network_cidr="{{- .Values.console.novnc.compute.vncserver_proxyclient_network_cidr -}}"
     listen_ip="{{- .Values.conf.nova.vnc.server_listen -}}"
 elif [ "${console_kind}" == "spice" ] ; then
     client_address="{{- .Values.conf.nova.spice.server_proxyclient_address -}}"
     client_interface="{{- .Values.console.spice.compute.server_proxyclient_interface -}}"
+    client_network_cidr="{{- .Values.console.spice.compute.server_proxyclient_network_cidr -}}"
     listen_ip="{{- .Values.conf.nova.spice.server_listen -}}"
 fi
 
 if [ -z "${client_address}" ] ; then
     if [ -z "${client_interface}" ] ; then
-        if  [ -x "$(command -v route)" ] ; then
-            # search for interface with default routing, if multiple default routes exist then select the one with the lowest metric.
-            client_interface=$(route -n | awk '/^0.0.0.0/ { print $5 " " $NF }' | sort | awk '{ print $NF; exit }')
-        else
-            client_interface=$(ip r | grep default | awk '{print $5}')
+        if [ -z "${client_network_cidr}" ] ; then
+            client_network_cidr="0/0"
         fi
+        client_interface=$(ip -4 route list ${client_network_cidr} | awk -F 'dev' '{ print $2; exit }' | awk '{ print $1 }') || exit 1
     fi
 
     # determine client ip dynamically based on interface provided
-    client_address=$(ip a s $client_interface | grep 'inet ' | awk '{print $2}' | awk -F "/" '{print $1}' | head -n 1)
+    client_address=$(ip a s $client_interface | grep 'inet ' | awk '{print $2}' | awk -F "/" '{print $1}' | head -1)
 fi
 
 if [ -z "${listen_ip}" ] ; then

charts/nova/templates/bin/_nova-console-proxy-init.sh.tpl

@@ -21,25 +21,25 @@ console_kind="{{- .Values.console.console_kind -}}"
 if [ "${console_kind}" == "novnc" ] ; then
     client_address="{{- .Values.conf.nova.vnc.server_proxyclient_address -}}"
     client_interface="{{- .Values.console.novnc.vncproxy.vncserver_proxyclient_interface -}}"
+    client_network_cidr="{{- .Values.console.novnc.vncproxy.vncserver_proxyclient_network_cidr -}}"
     listen_ip="{{- .Values.conf.nova.vnc.server_listen -}}"
 elif [ "${console_kind}" == "spice" ] ; then
     client_address="{{- .Values.conf.nova.spice.server_proxyclient_address -}}"
     client_interface="{{- .Values.console.spice.proxy.server_proxyclient_interface -}}"
+    client_network_cidr="{{- .Values.console.spice.proxy.server_proxyclient_network_cidr -}}"
     listen_ip="{{- .Values.conf.nova.spice.server_listen -}}"
 fi
 
 if [ -z "${client_address}" ] ; then
     if [ -z "${client_interface}" ] ; then
-        if  [ -x "$(command -v route)" ] ; then
-            # search for interface with default routing, if multiple default routes exist then select the one with the lowest metric.
-            client_interface=$(route -n | awk '/^0.0.0.0/ { print $5 " " $NF }' | sort | awk '{ print $NF; exit }')
-        else
-            client_interface=$(ip r | grep default | awk '{print $5}')
+        if [ -z "${client_network_cidr}" ] ; then
+            client_network_cidr="0/0"
         fi
+        client_interface=$(ip -4 route list ${client_network_cidr} | awk -F 'dev' '{ print $2; exit }' | awk '{ print $1 }') || exit 1
     fi
 
     # determine client ip dynamically based on interface provided
-    client_address=$(ip a s $client_interface | grep 'inet ' | awk '{print $2}' | awk -F "/" '{print $1}' | head -n 1)
+    client_address=$(ip a s $client_interface | grep 'inet ' | awk '{print $2}' | awk -F "/" '{print $1}' | head -1)
 fi
 
 if [ -z "${listen_ip}" ] ; then

charts/nova/templates/bin/_nova-service-cleaner.sh.tpl

@@ -30,3 +30,7 @@ for NOVA_SERVICE in ${NOVA_SERVICES_TO_CLEAN}; do
     openstack compute service delete "${SERVICE_ID}"
   done
 done
+
+{{- if .Values.jobs.service_cleaner.extra_command }}
+{{ .Values.jobs.service_cleaner.extra_command }}
+{{- end }}

charts/nova/templates/bin/_ssh-start.sh.tpl

@@ -26,7 +26,15 @@ done
 IFS=''
 
 subnet_address="{{- .Values.network.ssh.from_subnet -}}"
+
+if [ -z "${subnet_address}" ] ; then
+    subnet_address="0.0.0.0/0"
+fi
+listen_interface=$(ip -4 route list ${subnet_address} | awk -F 'dev' '{ print $2; exit }' | awk '{ print $1 }') || exit 1
+listen_address=$(ip a s $listen_interface | grep 'inet ' | awk '{print $2}' | awk -F "/" '{print $1}' | head -1)
+
 cat > /tmp/sshd_config_extend <<EOF
+ListenAddress $listen_address
 PasswordAuthentication no
 Match Address $subnet_address
     PermitRootLogin without-password

charts/nova/templates/bin/_storage-init.sh.tpl

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+set -x
+if [ "x$STORAGE_BACKEND" == "xrbd" ]; then
+  SECRET=$(mktemp --suffix .yaml)
+  KEYRING=$(mktemp --suffix .keyring)
+  function cleanup {
+      rm -f ${SECRET} ${KEYRING}
+  }
+  trap cleanup EXIT
+fi
+
+set -ex
+if [ "x$STORAGE_BACKEND" == "xrbd" ]; then
+  ceph -s
+  function ensure_pool () {
+    ceph osd pool stats $1 || ceph osd pool create $1 $2
+    if [[ $(ceph mgr versions | awk '/version/{print $3}' | cut -d. -f1) -ge 12 ]]; then
+        ceph osd pool application enable $1 $3
+    fi
+    size_protection=$(ceph osd pool get $1 nosizechange | cut -f2 -d: | tr -d '[:space:]')
+    ceph osd pool set $1 nosizechange 0
+    ceph osd pool set $1 size ${RBD_POOL_REPLICATION}
+    ceph osd pool set $1 nosizechange ${size_protection}
+    ceph osd pool set $1 crush_rule "${RBD_POOL_CRUSH_RULE}"
+  }
+  ensure_pool ${RBD_POOL_NAME} ${RBD_POOL_CHUNK_SIZE} ${RBD_POOL_APP_NAME}
+fi

charts/nova/templates/configmap-bin.yaml

@@ -39,6 +39,8 @@ data:
 {{- end }}
   rally-test.sh: |
 {{ tuple $rallyTests | include "helm-toolkit.scripts.rally_test" | indent 4 }}
+  storage-init.sh: |
+{{ tuple "bin/_storage-init.sh.tpl" . | include "helm-toolkit.utils.template" | indent 4 }}
   db-init.py: |
 {{- include "helm-toolkit.scripts.db_init" . | indent 4 }}
   db-sync.sh: |

charts/nova/templates/configmap-etc.yaml

@@ -151,8 +151,8 @@ limitations under the License.
 {{- $_ := set .Values.conf.nova.DEFAULT "metadata_host" .Values.endpoints.compute_metadata.ip.ingress -}}
 {{- end -}}
 
-{{- if empty .Values.conf.nova.DEFAULT.metadata_port -}}
-{{- $_ := tuple "compute_metadata" "public" "metadata" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | set .Values.conf.nova.DEFAULT "metadata_port" -}}
+{{- if empty .Values.conf.nova.DEFAULT.metadata_listen_port -}}
+{{- $_ := tuple "compute_metadata" "internal" "metadata" . | include "helm-toolkit.endpoints.endpoint_port_lookup" | set .Values.conf.nova.DEFAULT "metadata_listen_port" -}}
 {{- end -}}
 
 {{- if empty .Values.conf.nova.placement.auth_url -}}

charts/nova/templates/daemonset-compute.yaml

@@ -87,6 +87,7 @@ spec:
       annotations:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ tuple "nova_compute" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "nova-compute-default" "containerNames" (list "nova-compute" "init" "nova-compute-init" "nova-compute-vnc-init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}

charts/nova/templates/deployment-api-metadata.yaml

@@ -57,6 +57,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ tuple "nova_api_metadata" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "nova-api-metadata" "containerNames" (list "nova-api-metadata-init" "nova-api" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}

charts/nova/templates/deployment-api-osapi.yaml

@@ -57,6 +57,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ tuple "nova_api_osapi" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "nova-api-osapi" "containerNames" (list "nova-osapi" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}

charts/nova/templates/deployment-conductor.yaml

@@ -66,6 +66,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ tuple "nova_conductor" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "nova-conductor" "containerNames" (list "nova-conductor" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}

charts/nova/templates/deployment-novncproxy.yaml

@@ -55,6 +55,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ tuple "nova_novncproxy" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "nova-novncproxy" "containerNames" (list "nova-novncproxy" "nova-novncproxy-init-assets" "nova-novncproxy-init" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}
@@ -144,9 +145,14 @@ spec:
               readOnly: true
             - name: pod-shared
               mountPath: /tmp/pod-shared
+            {{- if $vencrypt_enabled }}
+            - name: {{ .Values.secrets.tls.compute_novnc_proxy.vencrypt.internal }}
+              mountPath: /etc/pki/nova-novncproxy
+              readOnly: true
+            {{- end }}
+
 {{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal "path" "/etc/mysql/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
 {{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.compute_novnc_proxy.novncproxy.internal "path" "/etc/nova/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
-{{- dict "enabled" $vencrypt_enabled "name" .Values.secrets.tls.compute_novnc_proxy.vencrypt.internal "path" "/etc/pki/nova-novncproxy" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
 {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal "path" "/etc/rabbitmq/certs" | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
 {{ if $mounts_nova_novncproxy.volumeMounts }}{{ toYaml $mounts_nova_novncproxy.volumeMounts | indent 12 }}{{ end }}
       volumes:
@@ -164,9 +170,14 @@ spec:
           emptyDir: {}
         - name: pod-shared
           emptyDir: {}
+        {{- if $vencrypt_enabled }}
+        - name: {{ .Values.secrets.tls.compute_novnc_proxy.vencrypt.internal }}
+          secret:
+            secretName: {{ .Values.secrets.tls.compute_novnc_proxy.vencrypt.internal }}
+            defaultMode: 0444
+        {{- end }}
 {{- dict "enabled" .Values.manifests.certificates "name" .Values.endpoints.oslo_db.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- dict "enabled" .Values.manifests.certificates "name" .Values.secrets.tls.compute_novnc_proxy.novncproxy.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
-{{- dict "enabled" $vencrypt_enabled "name" .Values.secrets.tls.compute_novnc_proxy.vencrypt.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{- dict "enabled" $envAll.Values.manifests.certificates "name" $envAll.Values.endpoints.oslo_messaging.auth.admin.secret.tls.internal | include "helm-toolkit.snippets.tls_volume" | indent 8 }}
 {{ if $mounts_nova_novncproxy.volumes }}{{ toYaml $mounts_nova_novncproxy.volumes | indent 8 }}{{ end }}
 {{- end }}

charts/nova/templates/deployment-scheduler.yaml

@@ -66,6 +66,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ tuple "nova_scheduler" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
 {{ dict "envAll" $envAll "podName" "nova-scheduler" "containerNames" (list "nova-scheduler" "init") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}

charts/nova/templates/deployment-spiceproxy.yaml

@@ -53,6 +53,7 @@ spec:
 {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
         configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
         configmap-etc-hash: {{ tuple "configmap-etc.yaml" . | include "helm-toolkit.utils.hash" }}
+{{ tuple "nova_spiceproxy" . | include "helm-toolkit.snippets.custom_pod_annotations" | indent 8 }}
     spec:
       serviceAccountName: {{ $serviceAccountName }}
 {{ dict "envAll" $envAll "application" "nova" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}

charts/nova/templates/ingress-novncproxy.yaml

@@ -12,7 +12,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */}}
 
-{{- if and .Values.manifests.ingress_novncproxy .Values.network.novncproxy.ingress.public }}
+{{- if and .Values.manifests.ingress_novncproxy .Values.network.novncproxy.ingress.public (eq .Values.console.console_kind "novnc") }}
 {{- $envAll := . }}
 {{- $ingressOpts := dict "envAll" $envAll "backendService" "novncproxy" "backendServiceType" "compute_novnc_proxy" "backendPort" "n-novnc" -}}
 {{- $secretName := $envAll.Values.secrets.tls.compute_novnc_proxy.novncproxy.internal -}}

charts/nova/templates/ingress-spiceproxy.yaml

@@ -0,0 +1,23 @@
+{{/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/}}
+
+{{- if and .Values.manifests.ingress_spiceproxy .Values.network.spiceproxy.ingress.public (eq .Values.console.console_kind "spice") }}
+{{- $envAll := . }}
+{{- $ingressOpts := dict "envAll" $envAll "backendService" "spiceproxy" "backendServiceType" "compute_spice_proxy" "backendPort" "n-spice" -}}
+{{- $secretName := $envAll.Values.secrets.tls.compute_spice_proxy.spiceproxy.internal -}}
+{{- if and .Values.manifests.certificates $secretName }}
+{{- $_ := set $ingressOpts "certIssuer" .Values.endpoints.compute_spice_proxy.host_fqdn_override.default.tls.issuerRef.name -}}
+{{- end }}
+{{ $ingressOpts | include "helm-toolkit.manifests.ingress" }}
+{{- end }}

charts/nova/templates/job-bootstrap.yaml

@@ -20,7 +20,6 @@ limitations under the License.
 {{- $configMapBin := printf "%s-%s" $serviceName "bin" -}}
 {{- $configMapEtc := printf "%s-%s" $serviceName "etc" -}}
 {{- $configFile := printf "/etc/%s/%s.conf" $serviceName $serviceName -}}
-{{- $logConfigFile := $envAll.Values.conf.nova.DEFAULT.log_config_append -}}
 {{- $nodeSelector := index . "nodeSelector" | default ( dict $envAll.Values.labels.job.node_selector_key $envAll.Values.labels.job.node_selector_value ) -}}
 {{- $serviceAccountName := printf "%s-%s" $serviceName "bootstrap" -}}
 {{ tuple $envAll "bootstrap" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
@@ -97,10 +96,12 @@ spec:
               mountPath: {{ $configFile | quote }}
               subPath: {{ base $configFile | quote }}
               readOnly: true
+            {{- if .Values.conf.nova.DEFAULT.log_config_append }}
             - name: bootstrap-conf
-              mountPath: {{ $logConfigFile | quote }}
-              subPath: {{ base $logConfigFile | quote }}
+              mountPath: {{ .Values.conf.nova.DEFAULT.log_config_append | quote }}
+              subPath: {{ base .Values.conf.nova.DEFAULT.log_config_append | quote }}
               readOnly: true
+            {{- end }}
 {{- dict "enabled" (or .Values.manifests.certificates .Values.tls.identity) "name" .Values.secrets.tls.compute.osapi.internal | include "helm-toolkit.snippets.tls_volume_mount" | indent 12 }}
       volumes:
         - name: pod-tmp