make remove ui-plugin-operator

pull/2520/head
Steven Crespo 2023-04-04 13:45:13 -07:00
parent 9e2ca8eec1
commit 4ae88dd181
12 changed files with 0 additions and 567 deletions

View File

@ -1,19 +0,0 @@
annotations:
catalog.cattle.io/auto-install: ui-plugin-operator-crd=match
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: UI Plugin Operator
catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.26.0-0'
catalog.cattle.io/namespace: cattle-ui-plugin-system
catalog.cattle.io/os: linux
catalog.cattle.io/permits-os: linux, windows
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
catalog.cattle.io/release-name: ui-plugin-operator
apiVersion: v1
appVersion: 0.1.1-rc2
description: A UI Plugin Operator Chart for plugin management in Rancher
keywords:
- applications
- infrastructure
name: ui-plugin-operator
type: application
version: 102.0.0+up0.2.0-rc3

View File

@ -1,21 +0,0 @@
# Rancher UI Plugin Operator
This chart works together with the Rancher UI extensions feature to enable the ability to install UI extensions in your cluster.
## Upgrading to Kubernetes v1.25+
Starting in Kubernetes v1.25, [Pod Security Policies](https://kubernetes.io/docs/concepts/security/pod-security-policy/) have been removed from the Kubernetes API.
As a result, **before upgrading to Kubernetes v1.25** (or on a fresh install in a Kubernetes v1.25+ cluster), users are expected to perform an in-place upgrade of this chart with `global.cattle.psp.enabled` set to `false` if it has been previously set to `true`.
> **Note:**
> In this chart release, any previous field that was associated with any PSP resources have been removed in favor of a single global field: `global.cattle.psp.enabled`.
> **Note:**
> If you upgrade your cluster to Kubernetes v1.25+ before removing PSPs via a `helm upgrade` (even if you manually clean up resources), **it will leave the Helm release in a broken state within the cluster such that further Helm operations will not work (`helm uninstall`, `helm upgrade`, etc.).**
>
> If your charts get stuck in this state, please consult the Rancher docs on how to clean up your Helm release secrets.
Upon setting `global.cattle.psp.enabled` to false, the chart will remove any PSP resources deployed on its behalf from the cluster. This is the default setting for this chart.
As a replacement for PSPs, [Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/) should be used. Please consult the Rancher docs for more details on how to configure your chart release namespaces to work with the new Pod Security Admission and apply Pod Security Standards.

View File

@ -1,89 +0,0 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "ui-plugin-operator.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
If release name contains chart name it will be used as a full name.
*/}}
{{- define "ui-plugin-operator.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "ui-plugin-operator.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "ui-plugin-operator.labels" -}}
helm.sh/chart: {{ include "ui-plugin-operator.chart" . }}
{{ include "ui-plugin-operator.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "ui-plugin-operator.selectorLabels" -}}
app.kubernetes.io/name: {{ include "ui-plugin-operator.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "ui-plugin-operator.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "ui-plugin-operator.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}
{{- define "system_default_registry" -}}
{{- if .Values.global.cattle.systemDefaultRegistry -}}
{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
{{- else -}}
{{- "" -}}
{{- end -}}
{{- end -}}
{{/*
Windows cluster will add default taint for linux nodes,
add below linux tolerations to workloads could be scheduled to those linux nodes
*/}}
{{- define "linux-node-tolerations" -}}
- key: "cattle.io/os"
value: "linux"
effect: "NoSchedule"
operator: "Equal"
{{- end -}}
{{- define "linux-node-selector" -}}
{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
beta.kubernetes.io/os: linux
{{- else -}}
kubernetes.io/os: linux
{{- end -}}
{{- end -}}

View File

@ -1,33 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ .Chart.Name }}-dashboard
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
rules:
- apiGroups:
- ""
resources:
- services/proxy
resourceNames:
- "http:{{ .Chart.Name }}:{{ .Values.service.port }}"
- "https:{{ .Chart.Name }}:{{ .Values.service.port }}"
verbs:
- '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ .Chart.Name }}-dashboard
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ .Chart.Name }}-dashboard
subjects:
- kind: Group
name: system:authenticated
apiGroup: rbac.authorization.k8s.io

View File

@ -1,67 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ .Chart.Name }}
labels:
{{- include "ui-plugin-operator.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicas }}
{{- end }}
selector:
matchLabels:
{{- include "ui-plugin-operator.selectorLabels" . | nindent 6 }}
template:
metadata:
{{- with .Values.podAnnotations }}
annotations:
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "ui-plugin-operator.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
nodeSelector: {{ include "linux-node-selector" . | nindent 8 }}
{{- if .Values.nodeSelector }}
{{ toYaml .Values.nodeSelector | indent 8 }}
{{- end }}
tolerations: {{ include "linux-node-tolerations" . | nindent 8 }}
{{- if .Values.tolerations }}
{{ toYaml .Values.tolerations | indent 8 }}
{{- end }}
serviceAccountName: {{ .Chart.Name }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: 80
protocol: TCP
args:
- {{ template "ui-plugin-operator.name" . }}
{{- if .Values.debug }}
- --debug
- --debug-level={{ .Values.debugLevel }}
{{- end }}
{{- if .Values.additionalArgs }}
{{- toYaml .Values.additionalArgs | nindent 10 }}
{{- end }}
# livenessProbe:
# httpGet:
# path: /
# port: http
# readinessProbe:
# httpGet:
# path: /
# port: http
resources:
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 8 }}
{{- end }}

View File

@ -1,123 +0,0 @@
{{- $namespaces := dict "_0" .Release.Namespace -}}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ .Chart.Name }}-patch-sa
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}-patch-sa
annotations:
"helm.sh/hook": post-install, post-upgrade
"helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation
spec:
template:
metadata:
name: {{ .Chart.Name }}-patch-sa
labels:
app: {{ .Chart.Name }}-patch-sa
spec:
serviceAccountName: {{ .Chart.Name }}-patch-sa
securityContext:
runAsNonRoot: true
runAsUser: 1000
restartPolicy: Never
containers:
{{- range $_, $ns := $namespaces }}
- name: patch-sa-{{ $ns }}
image: {{ template "system_default_registry" $ }}{{ $.Values.global.kubectl.repository }}:{{ $.Values.global.kubectl.tag }}
imagePullPolicy: {{ $.Values.global.kubectl.pullPolicy }}
command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"]
args: ["-n", "{{ $ns }}"]
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Chart.Name }}-patch-sa
labels:
app: {{ .Chart.Name }}-patch-sa
rules:
- apiGroups:
- ""
resources:
- serviceaccounts
verbs: ['get', 'patch']
{{- if .Values.global.cattle.psp.enabled }}
- apiGroups: ['policy']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- {{ .Chart.Name }}-patch-sa
{{- end }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ .Chart.Name }}-patch-sa
labels:
app: {{ .Chart.Name }}-patch-sa
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ .Chart.Name }}-patch-sa
subjects:
- kind: ServiceAccount
name: {{ .Chart.Name }}-patch-sa
namespace: {{ .Release.Namespace }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ .Chart.Name }}-patch-sa
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}-patch-sa
---
{{- if .Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicies" }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ .Chart.Name }}-patch-sa
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}-patch-sa
spec:
privileged: false
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: 'MustRunAsNonRoot'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: false
volumes:
- 'secret'
{{- end }}
{{- range $_, $ns := $namespaces }}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-allow-all
namespace: {{ $ns }}
spec:
podSelector: {}
ingress:
- {}
egress:
- {}
policyTypes:
- Ingress
- Egress
{{- end }}

View File

@ -1,15 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: {{ .Chart.Name }}
labels:
{{- include "ui-plugin-operator.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: {{ .Values.service.targetPort }}
protocol: TCP
name: http
selector:
{{- include "ui-plugin-operator.selectorLabels" . | nindent 4 }}

View File

@ -1,101 +0,0 @@
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ .Chart.Name }}
subjects:
- kind: ServiceAccount
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
rules:
- apiGroups: ["catalog.cattle.io"]
resources:
- uiplugins
- uiplugins/status
verbs: ["*"]
- apiGroups: ["coordination.k8s.io"]
resources:
- leases
verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ .Chart.Name }}
subjects:
- kind: ServiceAccount
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
---
{{- if .Values.global.cattle.psp.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ .Chart.Name }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ .Chart.Name }}
spec:
privileged: false
hostNetwork: false
hostIPC: false
hostPID: false
runAsUser:
rule: 'MustRunAsNonRoot'
seLinux:
rule: 'RunAsAny'
supplementalGroups:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: false
volumes:
- 'secret'
{{- end }}

View File

@ -1,7 +0,0 @@
#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}}
#{{- if .Values.global.cattle.psp.enabled }}
#{{- if not (.Capabilities.APIVersions.Has "policy/v1beta1/PodSecurityPolicy") }}
#{{- fail "The target cluster does not have the PodSecurityPolicy API resource. Please disable PSPs in this chart before proceeding." -}}
#{{- end }}
#{{- end }}
#{{- end }}

View File

@ -1,69 +0,0 @@
# Default values for sample.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.
replicaCount: 1
image:
repository: rancher/ui-plugin-operator
pullPolicy: Always
tag: "v0.1.1-rc2"
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
service:
type: ClusterIP
port: 80
targetPort: 8080
autoscaling:
enabled: false
minReplicas: 1
maxReplicas: 100
targetCPUUtilizationPercentage: 80
replicas: 1
resources: {}
securityContext:
runAsNonRoot: true
runAsUser: 1000
nodeSelector: {}
tolerations: []
affinity: {}
podAnnotations: []
additionalArgs: []
global:
cattle:
systemDefaultRegistry: ""
psp:
enabled: false # PSP enablement should default to false
kubectl:
repository: rancher/kubectl
tag: v1.20.2
pullPolicy: IfNotPresent
rbac:
## Create RBAC resources for ServiceAccounts and users
##
enabled: false
# create: true
# userRoles:
# ## Create default user ClusterRoles to allow users to interact with Prometheus CRs, ConfigMaps, and Secrets
# create: true
# ## Aggregate default user ClusterRoles into default k8s ClusterRoles
# aggregateToDefaultRoles: true
# pspEnabled: true
# pspAnnotations: {}
debug: false
debugLevel: 0

View File

@ -13645,29 +13645,6 @@ entries:
- assets/system-upgrade-controller/system-upgrade-controller-100.0.0+up0.3.0.tgz
version: 100.0.0+up0.3.0
ui-plugin-operator:
- annotations:
catalog.cattle.io/auto-install: ui-plugin-operator-crd=match
catalog.cattle.io/certified: rancher
catalog.cattle.io/display-name: UI Plugin Operator
catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.26.0-0'
catalog.cattle.io/namespace: cattle-ui-plugin-system
catalog.cattle.io/os: linux
catalog.cattle.io/permits-os: linux, windows
catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
catalog.cattle.io/release-name: ui-plugin-operator
apiVersion: v1
appVersion: 0.1.1-rc2
created: "2023-02-23T12:00:22.517171-08:00"
description: A UI Plugin Operator Chart for plugin management in Rancher
digest: 76be9de8f41aa30a60c77f71951b0d8b558de70484f42c51fe0dbc84c4070675
keywords:
- applications
- infrastructure
name: ui-plugin-operator
type: application
urls:
- assets/ui-plugin-operator/ui-plugin-operator-102.0.0+up0.2.0-rc3.tgz
version: 102.0.0+up0.2.0-rc3
- annotations:
catalog.cattle.io/auto-install: ui-plugin-operator-crd=match
catalog.cattle.io/certified: rancher